xorist | 9103d39318bd1735df2eb88db26011c7d7ab6ba5c62a6703f8c71b6dd3049fbd

Analysis

max time kernel
134s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
24-10-2024 22:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
Size

7KB
MD5

75191b0312aebc9d5fe6d03e8811a11b
SHA1

1665498c8373958239b5a1d524edca8babcdd203
SHA256

9103d39318bd1735df2eb88db26011c7d7ab6ba5c62a6703f8c71b6dd3049fbd
SHA512

c737fa9d0f659c16beec70cbaab390d09ca66f8a2fc706a366851fca47836af8da1e730ed26d5b969688921b5eaf35d6aa6c06e9965fee34c2f2068904215df6
SSDEEP

96:cSZhl8wdS+r3yOYW189fTwUVF0CWHyjk8P1LOmjXfihExZ9q8p8SAtV/p97pvpE+:5zdrr1FG1WDCgmjPZZFpkVxj2FMUA

Score

10^/10

xorist discovery persistence ransomware spyware stealer upx

Malware Config

Signatures

Detected Xorist Ransomware 8 IoCs

resource	yara_rule
behavioral2/memory/4064-5133-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral2/memory/4064-5139-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral2/memory/4064-9846-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral2/memory/4064-10910-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral2/memory/4064-11219-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral2/memory/4064-11250-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral2/memory/4064-11255-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral2/memory/4064-11256-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist

Xorist Ransomware
Xorist is a ransomware first seen in 2020.
ransomware xorist
Renames multiple (2197) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Drivers directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers\gmreadme.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\BmC2VdM2jaV8BW9.exe"	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\FileRepository\c_fscompression.inf_amd64_2aa5f249d7ee104a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmgatew.inf_amd64_7e6c377859cfcb7c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\scsidev.inf_amd64_55176c1890d480fe\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\IME\SHARED\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Speech\Engines\SR\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Configuration\Schema\MSFT_FileDirectoryConfiguration\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\microsoft_bluetooth_a2dp_snk.inf_amd64_213eeba98cc6f2f4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\DefaultAccountTile.png	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netbrdg.inf_amd64_8a737d38f201aeb1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnms013.inf_amd64_2b1aa5c0f193f278\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\rspndr.inf_amd64_4e80c2bb5314f071\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\MailContactsCalendarSync\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\th-TH\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Dism\ja\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\Bthprops\@BthpropsNotificationLogo.png	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_PackageResource\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmadc.inf_amd64_7b6fc0e15997ce81\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmtdkj4.inf_amd64_3bc71c4327f9f94e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmtexas.inf_amd64_ed0ab85128ed7a01\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netxex64.inf_amd64_ede00b448bfe8099\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\InstallShield\setupdir\0003\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\ja\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Kds\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\bthmtpenum.inf_amd64_3abc48e730d08fde\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\net8192se64.inf_amd64_167684f9283b4eca\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\sdfrd.inf_amd64_25779da6eca4810a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\en\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_mediumchanger.inf_amd64_69ea0d8614286224\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_RoleResource\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnms011.inf_amd64_f83138380f5fb6ab\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\F12\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Licenses\neutral\OEM\Professional\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Speech\Engines\SR\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ArchiveResource\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_UserResource\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_cdrom.inf_amd64_f08f2fe1cde58aef\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\volume.inf_amd64_bfabc750039f8ac1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\ja\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_EnvironmentResource\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_UserResource\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\TrustedPlatformModule\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ntprint.inf_x86_c62e9f8067f98247\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ntprint4.inf_amd64_0958c7cad3cd6075\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\usbhub3.inf_amd64_6a68abcc31aaa333\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Management\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netrtwlans.inf_amd64_97cd1a72c2a7829c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmnttp2.inf_amd64_8c1e04ee38482578\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\megasr.inf_amd64_72258921635be994\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\msclmd.inf_amd64_d677afecc5e43162\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netrass.inf_amd64_7f701cb29b5389d3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ntprint.inf_x86_c62e9f8067f98247\I386\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\setup\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Archive\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\hidbth.inf_amd64_76fb27776958e530\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ialpss2i_i2c_cnl.inf_amd64_f668309b543472eb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\InstallShield\setupdir\0021\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\slmgr\0410\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\wbem\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Configuration\Schema\MSFT_FileDirectoryConfiguration\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ialpss2i_i2c_glk.inf_amd64_7b6c08738ca8a856\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wvid.inf_amd64_7c50642b144b870d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4064-0-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral2/memory/4064-5133-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral2/memory/4064-5139-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral2/memory/4064-9846-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral2/memory/4064-10910-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral2/memory/4064-11219-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral2/memory/4064-11250-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral2/memory/4064-11255-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral2/memory/4064-11256-0x0000000000400000-0x000000000040C000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-black_scale-140.png	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\Weather_LogoSmall.targetsize-32.png	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarAppList.targetsize-24_altform-unplated.png	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarAppList.targetsize-32_altform-lightunplated.png	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-256.png	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\LinkedInboxWideTile.scale-150.png	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\ExchangeBadge.scale-400.png	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\eu-es\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageSplashScreen.scale-400_contrast-black.png	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\AppCS\Assets\DeviceNotFound.png	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailSplashLogo.scale-125.png	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions.png	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\sv-se\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.scale-140.png	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsSoundRecorder_10.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\Weather_LogoSmall.scale-100.png	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\LargeTile.scale-125.png	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Images\thumb_animation.png	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\Fonts\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00.UWPDesktop_14.0.27629.0_x64__8wekyb3d8bbwe\logo.png	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-16_altform-unplated_contrast-black.png	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-36_altform-lightunplated.png	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\AppPackageMedTile.scale-125_contrast-white.png	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-20_altform-unplated_contrast-white.png	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\StoreLogo.scale-125_contrast-black.png	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\StopwatchWideTile.contrast-white_scale-100.png	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\kb-unlocked.png	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-64_contrast-white.png	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\rhp_world_icon_hover.png	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\fr-fr\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\Close.png	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\Square71x71\PaintSmallTile.scale-150.png	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-40_altform-unplated.png	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\ExchangeBadge.scale-100.png	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailSmallTile.scale-150.png	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\WideLogo.scale-100_contrast-black.png	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNotePageMedTile.scale-150.png	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Yahoo-Dark.scale-100.png	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsAppList.targetsize-64_altform-unplated.png	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2018.826.98.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraWideTile.contrast-black_scale-125.png	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_neutral_~_8wekyb3d8bbwe\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.scale-400_contrast-white.png	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-Generic-Dark.scale-200.png	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\eu-es\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\images\Audio-48.png	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\152.png	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedLargeTile.scale-100.png	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\SplashScreen.scale-125.png	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\LargeTile.scale-100_contrast-black.png	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\images\digsig_icons.png	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageWideTile.scale-400_contrast-black.png	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_neutral_split.scale-125_8wekyb3d8bbwe\images\Square150x150Logo.scale-125.png	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\CalculatorSmallTile.contrast-white_scale-100.png	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\OutlookMailWideTile.scale-125.png	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailSmallTile.scale-100.png	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\css\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.contrast-white_targetsize-60.png	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarAppList.targetsize-60.png	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\WinSxS\wow64_microsoft-windows-rascmdial_31bf3856ad364e35_10.0.19041.1266_none_52c199243eeb2e14\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-u..-socialrtcomponents_31bf3856ad364e35_10.0.19041.264_none_c3b8e8e15e8aba70\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-defrag-core.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_58de25379aafa93d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-n..mplatform.resources_31bf3856ad364e35_10.0.19041.1_it-it_df4f6cb34ad26a7d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\wow64_microsoft-windows-healthcenter_31bf3856ad364e35_10.0.19041.746_none_93ab1751f704826d\SecurityAndMaintenance.png	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-wmiv2-mi-dll_31bf3856ad364e35_10.0.19041.546_none_728f32d9a31e3e05\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-c..esources-mrmindexer_31bf3856ad364e35_10.0.19041.746_none_46afd7212e24de92\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft.windows.d..eshootingpackmodule_31bf3856ad364e35_10.0.19041.1_none_d715acf7955c3b33\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-w..utils-dll.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_166bc1e892585c4d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\RetailDemo\retailDemoLocal.html	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-p..m-library.resources_31bf3856ad364e35_10.0.19041.1_it-it_35b543fa13574693\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core-wbemcomn-dll_31bf3856ad364e35_10.0.19041.1081_none_785913d6d8513d6b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\INF\Windows Workflow Foundation 4.0.0.0\0C0A\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-o..es-fondue.resources_31bf3856ad364e35_10.0.19041.1_en-us_c8135710b9469ba5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-imapiv2-base.resources_31bf3856ad364e35_10.0.19041.1_de-de_f0709138ee95f5c4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-n...appxmain.resources_31bf3856ad364e35_10.0.19041.1_en-us_27066454eebe7c1c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-directui.resources_31bf3856ad364e35_10.0.19041.1_tr-tr_b246c8a3bc2a6236\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-m..demanager.resources_31bf3856ad364e35_10.0.19041.1_en-us_bf493abe1176addc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.19041.1266_none_802f96a5044b0fbe\DMR_48.jpg	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-peerdist_31bf3856ad364e35_10.0.19041.1_none_dd6a4c32bddaf430\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-p..ellextensionhandler_31bf3856ad364e35_10.0.19041.746_none_fa8c18c202212c8a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-systemmanagement_31bf3856ad364e35_10.0.19041.1052_none_d66f8d1a8186f994\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\WinSxS\msil_system.runtime.serialization.resources_b77a5c561934e089_10.0.19041.1_es-es_7bd8078a942a41d1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-t..s-clientactivexcore_31bf3856ad364e35_10.0.19041.1266_none_a4b3db427ad98ca6\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_netfx4-presentationhostdllmui_b03f5f7f11d50a3a_4.0.15805.110_none_1aad94ce6cb2232c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-scripting-vbscript_31bf3856ad364e35_11.0.19041.1266_none_0b2c951a40edb356\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-t..lservices-workspace_31bf3856ad364e35_10.0.19041.1_none_9134b8402ddd12c8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\microsoft.isam.esent.interop\v4.0_10.0.0.0__31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-c..tionauthorityclient_31bf3856ad364e35_10.0.19041.1202_none_4c3de265f1dddfc1\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..ngine-adm.resources_31bf3856ad364e35_10.0.19041.1_de-de_43b9c1ab93991fa2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-g..licy-base.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_a5f5f155cd89b58d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-tapiservice.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_6b9733513e4c173f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_system.servicemodel.routing.resources_31bf3856ad364e35_4.0.15805.0_es-es_a896d3893bb8c9fa\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-hnetcfgclient_31bf3856ad364e35_10.0.19041.746_none_79a98942e170e882\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\INF\SMSvcHost 3.0.0.0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-m..nt-browser.appxmain_31bf3856ad364e35_10.0.19041.1_none_b1e502c19c2a358b\Square310x310Logo.contrast-black_scale-100.png	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-p..sioning-diagnostics_31bf3856ad364e35_10.0.19041.1_none_a4e7941a4827016d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_wfcvsc.inf.resources_31bf3856ad364e35_10.0.19041.1_it-it_828ea72c41c9951d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_5b152a8d329397ec\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-detectionandsharingapi_31bf3856ad364e35_10.0.19041.1_none_ef94245e7d895c07\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-heif-image-codec_31bf3856ad364e35_10.0.19041.1023_none_44a703b11bcb0d0b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.117_none_e0d32848ac56114e\oobe-light-frame-template.html	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-filepicker.appxsetup_31bf3856ad364e35_10.0.19041.1023_none_39a4d63e07cea862\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_system.management.resources_b03f5f7f11d50a3a_4.0.15805.0_es-es_310703e090a00c53\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-w..e-utility.resources_31bf3856ad364e35_10.0.19041.1_en-us_b54e33bc60acaeb9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-a..l-systemuwplauncher_31bf3856ad364e35_10.0.19041.746_none_ed5986fc58f1b817\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_windowstrustedrtproxy.inf.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_cd56c0cb7998a1dc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-browsersettingsync_31bf3856ad364e35_10.0.19041.746_none_192fd2e81c0b8a0d\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-hal_31bf3856ad364e35_10.0.19041.1151_none_1ff907b40ed3d811\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-time-sync_31bf3856ad364e35_10.0.19041.1_none_a76b54bfd8721426\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-xbox-authmanager-component_31bf3856ad364e35_10.0.19041.789_none_2777a97bb9a05cd3\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Wide310x150Logo.contrast-white_scale-150.png	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-t..xtensions.resources_31bf3856ad364e35_10.0.19041.1_it-it_04f8c59e46592043\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-s..vider-dll.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_ed0a82b9efc09c89\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\es-ES\assets\ErrorPages\sslnavcancel.htm	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-systemrestore-main_31bf3856ad364e35_10.0.19041.746_none_24d91ab4120e42ee\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-t..andinkinputservices_31bf3856ad364e35_10.0.19041.746_none_04fb1ff2ac42c9e2\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File opened for modification	C:\Windows\SystemResources\Windows.UI.ShellCommon\Images\WiFiNetworkManagerToast.scale-400.png	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..ets.icons.searchapp_31bf3856ad364e35_10.0.19041.1_none_ceba36fd1b479c4c\WideTile.scale-100.png	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-wmvencod.resources_31bf3856ad364e35_10.0.19041.1_de-de_89af7d9f638d5a7c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-n..quickstart.appxmain_31bf3856ad364e35_10.0.19041.1_none_4a388618f6365227\NarratorUWPSquare150x150Logo.scale-100_contrast-black.png	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-w..-provider.resources_31bf3856ad364e35_10.0.19041.1_es-es_9426108bc476f97b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-sctasks.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_85e0b18d0f9a8f14\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
File created	C:\Windows\WinSxS\x86_microsoft-windows-wpfcorecomp.resources_31bf3856ad364e35_10.0.19041.1_de-de_62f5941788723da4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe

Modifies registry class 10 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\JSEUQFSUDNERIDI\ = "CRYPTED!"	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\JSEUQFSUDNERIDI\DefaultIcon	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\JSEUQFSUDNERIDI\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\BmC2VdM2jaV8BW9.exe,0"	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\JSEUQFSUDNERIDI\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\BmC2VdM2jaV8BW9.exe"	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd\ = "JSEUQFSUDNERIDI"	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\JSEUQFSUDNERIDI	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\JSEUQFSUDNERIDI\shell	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\JSEUQFSUDNERIDI\shell\open	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\JSEUQFSUDNERIDI\shell\open\command	75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\75191b0312aebc9d5fe6d03e8811a11b_JaffaCakes118.exe"
1⤵
- Drops file in Drivers directory
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\aic_file_icons.png

Filesize
50KB

MD5
031c85661120d9337457d5c04deeb220

SHA1
ffd4cfe7dad83f01ba1f7f73913194dddf6ffa52

SHA256
96d1834eb8384e36040a69d822c9c1018aec1790c362ce4c479b5562c8b539e6

SHA512
edebf2866b6be36fe8962121224d33b813b4f40db1cae51174e1e0eb3d151b1383ea3ac1575fd34296321efd5776edc5c95de2e15fa7eb7b9d2e7a5fcca6e9ba

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions.png

Filesize
1KB

MD5
427e7f703b215184d38dab2c5b229cdd

SHA1
870498d314b885953157e4e139c22c16bb802723

SHA256
4fafa3200071c7b355ebbca3cb863ddc5635ec8d9cc493fcf5a83b34c93b94d3

SHA512
16c57a80ccabeae08c444f53781e4b1ea1ed9a758cced1ce94c2c9a4ff7b6a0250d9eeceb98093875d71e6e06704dd1bb08366235d6604e17655cec2418ebcd7

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions2x.png

Filesize
3KB

MD5
60743e085bb5384db2954405b73d3996

SHA1
8757648066996318b16dcd9aba87d6b10709831e

SHA256
2d2214f4a6332a1c39862813894889822eea49d2c05fadec9d1ad9752d55a881

SHA512
d1be5d863af23c3124bcba8c399a7aa8d2f0a0da2238b40dc45f9f6ed03f09b9cc366a081ae2d8c11abf3d5d1f7ddcba885ce3282a9030241d78dd1877f2078e

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons.png

Filesize
683B

MD5
bedf09d9f3ff7f949bb40437f35e3287

SHA1
119608adcfb7556083f49d73e6e8b8fc9b745079

SHA256
21aafeebe03db0de7e7b82e61e09f19835ee4ec2cd48be77227af67e191250dd

SHA512
1c166dfabd075c56850363c3144a2b32cddbfbfec6de40c1e6014d20d9893b3c20b62f5fc61f28d457af139580b181b38468d6b85f1d91d2a80329aa30fc813c

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons2x.png

Filesize
1KB

MD5
49abd73b197e479acad88d76c23f1af0

SHA1
60241e0e648bf8a192e2bb6fd4c9de8bed11c18e

SHA256
2d703e7cf6163d14d169c74b556183ba9e8b94073777e0c03d60fb04dcf80fa0

SHA512
d31cb850f0a87cd69c9a61bbd7549ce097513830bc69fa00d0a161ec832f96d3e8456db5c62ace1c92dc1051c582b99a84ceac328a10fcb7fbff067d6d67e5ea

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon.png

Filesize
445B

MD5
3a985f7618ed935118003275eb15ef02

SHA1
735759efb7dd5838d0e49107e27f92dbb15016e4

SHA256
f322d368fc3516d496be57e81630680d32788f1a6f0d63949ece25dfb412e526

SHA512
80e924b467f2f196de9e3ae0eb0180ec49ad8e408cb2617ed7aa7bb8eda6bf8d07fbcc7d90b24b885dada1fbe953b696c5b60fc0c118b12070e269363b03f265

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_2x.png

Filesize
611B

MD5
b70172615979585e34bc0f2b3cfe7f1c

SHA1
f690b8fe436c70f4aa6217135b882049ddb16c8c

SHA256
c19e3471be3dbadaa43554802e574c2b32aae9f91cfea566d9c0850c51b34ba5

SHA512
587424c6a811cfe18c1c8efd833e376eec14e50271f3dc81aee96ceda300f3ff4416f8329a8dfe7ed545a0d3585a5a073141b012f8dba33cb1c0d28b11bcb22d

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover.png

Filesize
388B

MD5
63d38640c220e691a1e4208c5e24bc04

SHA1
74b139b70cacb5c62ab41f889edc95f026a72ef8

SHA256
4e75a2df06f8e3b7bd0b95c9a46dbf397fea2d801252bf08065733b52bc949b8

SHA512
b7f0a67c2189db98d422c70b031774aea3cb2a0a0bd9fdbe3bcef496a26326fa6303150bf541c5fa23413b3743635432e2634828496535d7c101de253bcb9fdf

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover_2x.png

Filesize
552B

MD5
32a37b9eb0d4b5741d6566abda850369

SHA1
d5a8796f731f4de5808840439658890a58b3d7f1

SHA256
d4397723648091f8367694c8e56b5efaa9b3964d6a86dba4e61ddaaba8d9dd0e

SHA512
e9c8191a42b2a3b109eaed670d6ac291ffd77de638230aeb9be1457e4ee90b9cc968b3b6ede6498a097afeb0ccdc777dc7ee2f96cf7c560884c6d6d873176537

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon.png

Filesize
388B

MD5
01f1144c248d5c7ddcf686c0948f0f12

SHA1
4e379f55e391d8d3eabcd558d92a208e2cafcecf

SHA256
ab3e3bd01f1714bff64f95803a1836daf32c1210806f7c0dacd3c6747f39032d

SHA512
094370b8fcc49f80188d5802f8a1cff1e10b4806c0a859a556e15ba7cd9a456bb0fd95f7bd274f607c9baea6b9cd8f1f9d464883c7bd7ac5f4297f0284f71794

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png

Filesize
552B

MD5
bcab76e58c41fc7ea319a7cd4ffb3952

SHA1
34e86e15207f2f1e8cd9509f29a36a6f9e5f5657

SHA256
fa361533078e6e8c4b225d539313b01c534b6d7585d39eae947aee441b014301

SHA512
e24280028018e423923110bbf4733a22a2eb8232acc55fd500422498a5d37978e5fa576148ca387f68cd9c43ec4458996207faf7ab6f0d595866c8925d01bed0

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png

Filesize
388B

MD5
211276cf2dbaf8ba57d7f728c13b9629

SHA1
872e9b52e9c58427db220ebca6390adb9442b381

SHA256
6e6a97aeb5402b35057558be064922a5c81cb24dc44261a9168de0a0837f7d71

SHA512
b2f95d9d1b12d4a908aacf513595a0c9f98d23fc2c79a23621ee661bc32fa78271240e6adc4f2e3edaeca1d3b7739e0a42b3bdf7456083c2b07d44e3729c488f

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover_2x.png

Filesize
552B

MD5
f87a5f115968903008b0c5be6e73b254

SHA1
1838d9d06586de8e850c8829c6b9b6ef6f80c982

SHA256
448e02ebc814c825b1c3a27ebf80b6799c31c40ce316060a80006f2ec6236bc9

SHA512
b2d2681360bdd0481ec4ffb0527bf09f7cec5016966b4bae4e5cbfa35281a79c3302172d408f6ab15a5d3439a7a9ba4f18b5f767a326641b59b4bb0e784f3982

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons.png

Filesize
7KB

MD5
19e18b9dc047803aed46e1527756a9a0

SHA1
acb68393d7838aa42b109d202e71a92f902b83f8

SHA256
4328ac9aa8a6927f532d4a4ffde85dd304f44264acaed8e0061f026dc0575e78

SHA512
192094f9710b72b6243a9399613a2c34a37cce8e1e1e9c925c53e124de43ffbf97c88e31ea464749f9ec173299527dc29b959bd7c7370cc9c3ff37b91d905230

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_ie8.gif

Filesize
7KB

MD5
e00f09a6843d54d327b8c24841744b85

SHA1
4d00d1721d859a3bd3121b9f588f044ed48cf5fc

SHA256
02cc4e23335f1182b914c325cc650232026859e43c33d9b7ec87f8bb970ed5d1

SHA512
7605bb2ff69497cf213df516f027721ee0e706a82f2025454823ca44c3990cf47c629a47c352cba295703beb19aae06906cf2853c6e91ac1213f543d8efdd9c2

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_retina.png

Filesize
15KB

MD5
ca98cd9cc4dca8733e99a013a00f723b

SHA1
cee15610101160849fe4558a23d1c8797234919b

SHA256
b7e4388a4ff78e8d7247cfa0f1343b9761ae397dca2fc783175de2dedc05fbf7

SHA512
1d893c6a48962dca2e9e177f7ba1c82085403450a7842fb15d5c1ce1931eeb6c6296c995d6cd54efe90a6668db9c70da4967dc450f312fb1e2a80e532d1c4999

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons.png

Filesize
8KB

MD5
2b2dd95d6e1c4ccc844158c959197505

SHA1
52553d5944158b2ea457be2bbf21b5d674cd0c16

SHA256
99b25ebb730ddc0145aa3d2b1a74be76c42a09ab973d1546c061c7a737baa928

SHA512
5a1ec371cbbbbfba09d890af31a7e3e63180baf1fade64c3271ab61a20d4ae29026c6cda72e85419c566aef1631281c0d517ea74fb0a540d2e9e48a57921bd46

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons_retina.png

Filesize
17KB

MD5
296a77ee11d24fc504800a7e3c5de6f3

SHA1
7e3bb0aa5086fa46c6eb09a12327c5acf73620fd

SHA256
918342f1ac9979203aea9ccc0152565bcb99aa45b989306aaa2fec3deddad6e5

SHA512
a2df2dfd7b5fe4a184d943c1c1262a8a6ee6c2bee04e322fa7e5d1de2be2a722a44199210db787499f0183136e1c9e749375ebdd24658419a5bb48b174ba0a55

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_pattern_RHP.png

Filesize
179B

MD5
c6a9e5e8e03723cb6ba09f4662339b8f

SHA1
d262861738acb0c999ff751637193a735819dd0f

SHA256
d996f95852bb23677c5851b077bee2acbfa97f7cd1f814a0510292b8063b5b4d

SHA512
1273aa997bbe0a0587dc9d50a1634ee0286f9383a881ec7374475d5e9937b3f02965ffe3e66e12de121d08d5fae96f3229b9269fb224f8a5670629d5673374f1

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_patterns_header.png

Filesize
703B

MD5
bdd282b3aa221e311732403a9f3e9854

SHA1
b6733fb6c5992143635d5dc96e87e1658f5a8fbb

SHA256
ed33c963295a637c5a914ed4605657283561fa3fa599b4ed0046e0aa4302877b

SHA512
4aec996240daae557c66eae86640f68f0f93705589c5c638b7b252c1d488edefbc28eb1ece485be8f2e6130d3c029d2bd00ae330d288b846e8e2dc1bb010b028

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations.png

Filesize
8KB

MD5
94ad06134fd2328025384bf4cde8c098

SHA1
ffcfcc0b6a456459ead231aff032a9c382d4fb02

SHA256
8c8c01ed325f2c8d67e767a9b3dc9c39d6bb32f0ed0bac0ab223b24603a9c043

SHA512
a6d8324187a2766b8e03a96878d3a061cdda466f3d2040be7a3e9eafd74215b1ac82e91c84a042a3ff91a1c5b53c6f400e28e70254ff8b231d561998d1ac8c95

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations_retina.png

Filesize
19KB

MD5
a15e0f8e08e8f1fbfa175fdbabf114f1

SHA1
13c8fb6087998cf9f4a982f104c562b4b437e8c6

SHA256
21a8234364ea5be3ebcb191101f2362ee91d2ea6889a4353025c9861ad6d03ac

SHA512
15087133711bef3724ed3f35109adc2d6a522c880ac40fd7886363821c607b860cc2e4c5b05cfb4dd6cadbc533ee835ce9ea66b0bb3b29cbe222a8df828b454c

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\faf_icons.png

Filesize
6KB

MD5
2ba3cd14dd56823b3ce7132830f016ff

SHA1
7dbba6b94ff5d75a7e37bff60629ccab5b0fa333

SHA256
54f925f8c865d8b182949a97e2459aa329b66c0feb8c904b9f8e5f73857b4ed1

SHA512
11433c4aecd7759c93552f387c9281c4a73161137caa9d8c4d69e76b097e07b4051b79903b246b1691bb848452c9e8fbe7dd77c2618b394a9756554a8205471c

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\bun.png

Filesize
2KB

MD5
395c1b40078c29b0f8722c99a2da8931

SHA1
3f0d81514988b395712be3b7babd096878f569f1

SHA256
0f87897094263810a5f604d932203e7a9e2ff225c230439417bc917aa15f2ad0

SHA512
71c50de9affc1a32714be888e1c4a90c24ac8e533864feff29d4869ab25401cac3d64c37157bdcf84ccdc6ad9620be9e5f53cbf8d74e7e0f94cfebf12de0460e

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview.png

Filesize
2KB

MD5
66d3d458f690b68ee6d40b21debcc282

SHA1
fa4fa2967481540e5d922efb3837defbc79742a8

SHA256
8a8d9ffd16e5c4ec9b02f66c47515ec07201c0f00083b44896322ffad5d91dae

SHA512
c9f1ead66f259afb81034958b68197782bcab1051c9116e13bcbf2ce602272c30fa2b0ded224c3029ce05d66e6510eb56717aee7668978a5135183cf6926056c

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview2x.png

Filesize
4KB

MD5
b6019da9ef075298f31e029590dc7fee

SHA1
bb8903056a38c6ba60ecb577bcbb2f9c9be92118

SHA256
a8d3cc6e9c56236155d08477116e2085ef632e71d9ffc3ea27d3a0d623a533eb

SHA512
7f8358d2610e77033e11e22e5c60085a3da19a36861181095cc08a73b0ae57344acc1d7efd02118e443023f530f0e1564e2e44adebfe59c68cae8094a54c33c7

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small.png

Filesize
289B

MD5
2f5638cad1b5a9b396035b0b824b872d

SHA1
d672d5ef418cf628d0762d18a2b7c85b345bcd08

SHA256
01b5a2e9e3a02e32e5a0b9df09b456214ade9133ced930ecd4280222de0145d7

SHA512
508a9c0270cc22efb07c35f87b75338bf27941139e9d3db174846cb955fbab57751c3becfbafb9517b4ade50f11f57562af9e40d6ab872257380c16de493007a

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small2x.png

Filesize
385B

MD5
2c7ba7c5f1cffa016c2f7df4b0174cb3

SHA1
b63e614ec934e46cf681898c740c7c3729d1e392

SHA256
387fa6b613c0b2da22778418f6a563b3e46654a07a7bd667ae1bc2f9d6e35feb

SHA512
a9ce59cf1892740c9506e42545243d53583d075af2d4e8924d2a232d686ad8b731750a409c398dd450fde5f5acb64473470fc6c5e6a88f269f80ef1523d69455

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\illustrations.png

Filesize
4KB

MD5
0329e04c2b8d49a7f6d5a8cca64afe05

SHA1
670aed1e635bef941374d16f5e8d6233aaa8138e

SHA256
cb2dca5261c76ebebd68320833eef40991001beb4f43d1738f7279e13f36647c

SHA512
031e1fe44c29fab1b70d7c6997b0610a5a77e4d989e1b6d2c6511f82e15ab4818276b2d4ea54ffbc92f8f16ce2a878202e5d4a496858bb91e70708f7ec18a1b4

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\nub.png

Filesize
1003B

MD5
2ae11a42bf0d9883667d36bf3cc07c5d

SHA1
9928878732977ba92caf54f13def17544ec3bc00

SHA256
0aefa7eba4a9d8bc175e49f30d85d0fed9baefd7ff62246c76f0e03c3c327870

SHA512
4b2539650e5b138732f1f3541f06266a4ba0930ecd126d5700be766301fdb8dcd6941dc58870254b650e742387cde82ba933b435de02ba90c1e75fd79ad74f1c

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons.png

Filesize
1KB

MD5
d1137b9cef1babb922956303200e74d4

SHA1
3e2b23a0dc15437af72f9edf4d4644d7c98a27d6

SHA256
f39342a6556ce255f02f88de794f16fd81f5e4113a74fff225a60a19d3d2ab63

SHA512
4b4c61298220d5d6e930d71b151d1cb54d370a3030a6e92fdf256127744d24c866d0001f6752da8757cca19f8cce6ef617ed711aef7a4e3963f59be7da2319cb

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons2x.png

Filesize
2KB

MD5
55429200025e173c5e852c71d13ac903

SHA1
5bbacb144db5dbece83729d7c2f073d65cf0e3e6

SHA256
e248e155d3e629dd20235c552ca0cbbb8acfabf294b507664f7e3c413016b786

SHA512
617f99d3f4ba274988258afa282ea6037ecda32c199169e9269fe8c920e94bc42be3762bee62ad2349c799f8a45d78c1642ae97268faf6659dbf812d1981a6c9

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adc_logo.png

Filesize
3KB

MD5
d54cb40286283351aa9a3c07425efccc

SHA1
84b236701410ddbacc1e1441e7102318a3c19dc9

SHA256
c8e366a758bd1184924c12433c0b17ab72081f188a43e6280c00ebe51a44a7fc

SHA512
dc1024f5871c94d9bd33d5a31f46a8ec8f6eabb74645edc12e7dd9fc84891c495c84936ebd3232d4a5e8494810f7d35e244e2cf83fe134a03dfa43515ad3902d

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adobe_spinner.gif

Filesize
556B

MD5
1271ab3d3de3fb5f06ac01d835a6c956

SHA1
5ca2af690bcd4e325d43b5ed9108b395f18f13a3

SHA256
248ab8c67abbe99a0bb0532a1d4e0ce1b10d4b2a38afb18f1c0d6c1cf9e3293a

SHA512
65133573a2b2839008c65f508cd0c09a7b364817fec7507afd1312e6fb360916ff9ddffce20c2ff44ab51ffc60fac68f85c77c6928c9ca86f3cb705e88a1f67a

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\logo_retina.png

Filesize
6KB

MD5
2ce4c7eb67f4fbd5edc7224afe8d6b04

SHA1
f35903bc7b0272a9d5d5662db73924afcc6ad029

SHA256
1e656fd30add5b997472594e3fb2d86df2853be48c3cddc701f9f7ad4b629a56

SHA512
0ccbd016460291e47821fd4c03be158b48573e3facc7fef1d6a3274a4360bc311fdda394968b3009f699a33c4c173c361f00920422ab5ad6e363b097c8cb2de4

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo.png

Filesize
826B

MD5
41b668e5e83e9d38f22948e8e17f625c

SHA1
158c16380532be436f8ba8bafcec6928b76ff456

SHA256
f508044fcd286a8a39f90160f0bd0aafdf5035ae6ca071177eb9f949ec197b83

SHA512
521adebb1d99ea132a5dc1a0a39dcf5afdb221b0555fcb69e335fdaa365aafe3b33c7dcf83443c209066a7f3617afdf086656f2cc52313c7af492cf6389a9d52

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo_2x.png

Filesize
1KB

MD5
5d8a2c1e4fbe6f877088873ddaf08d6c

SHA1
41c030dccd7b8ebc5b920db64dd63293bdfb4634

SHA256
93b1b4a0ef7b7cbc5402e649eedaf08de67ec283f22e4b335fb5f937c811cbf1

SHA512
f1b7a03e1c8cf6b5c499d31de35d74aa5de74b9b8827a9f7d9960c8e9f0050529a6859940c9170f501dbe715f54e511ae20c02cf6df9b831b8275b660db0edd3

Download Submit
C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB_EURO.txt

Filesize
32KB

MD5
e0c3195e582f7e3a30950d7cf098d772

SHA1
ff32331550efcc6c1b133da4862a66e1f7d400a8

SHA256
c99d3e774c42b00390610408c94d2e110885363b1841ff1219a93f6a7daff944

SHA512
596163bf81a30493577f89ebd0ba570d88cfcac5b2e005a863605df5c05e1fb8c448322570c3a21e31a61119e2b31aad79733b2c5d8c9fc7fa1488562c1f34dc

Download Submit
C:\Program Files\7-Zip\Lang\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt

Filesize
385B

MD5
354ce52b71e8bda8bc4fe983ce41ec17

SHA1
e10a9007c3110e017609d114aef31fe75795009a

SHA256
cef8415315eb254eb7f2767e356e4fd5ccc334a0af402c794b91d1a0975572d8

SHA512
a412be789ff8dc9052d54b962df559cec1fc48a905be143b31a4e242cb88f6f8e86b4e814712d4506790b69e51aec23fe43ffb32c72c9bf8d7f4bf46ff33a09a

Download Submit
C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif

Filesize
153B

MD5
794e3cfdbbaefd465ec7126c8c5830aa

SHA1
a0e343409dea6d9a4de42075d7442f3c9c988e47

SHA256
9e6217410afc3e159a9b2264f4ddb96d7c0128f5f689dbe93469e4cfe57fa951

SHA512
f39e00e9c842bdc24f83f7c8bf09b29127ea7dbee922327eacc9c6fca16115b98d606d665cbb900a50077b00290293b63f1a8b8e88a9c49ff83cd5750865353b

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt

Filesize
190B

MD5
712427c197cd23a5a609c65ab4c9ac12

SHA1
f6c0404c05c20b4e3c1a899b65944118a56d6865

SHA256
4e6edcdd804c70047d4a47f7207765884ad544ee6dd68e98363fbe50288365b3

SHA512
7e8659bff1c39e17f39885fc4168f0aff05d27053c6dce94342944bd694c1e6c32c60c400c09be176135bf864a7ccbc6a745c29a158afcc7272f6c2a77187d19

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt

Filesize
190B

MD5
fad1c6ff8ad85d6efac167d938625042

SHA1
2027853b23d356e2b33ae661e326122e5f004e90

SHA256
bc71146bd539a393c325be20918cb622145ca303390c1e495932f6499ad5ea2d

SHA512
e8f4b0495433c8156f68e1b7475776decc278c2b23f188f4a38220cf157f556741de57aec68089e6a8eb982ad1c78a22913dfa67324c3ba70e09c1cdd1dd490a

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md

Filesize
1KB

MD5
fa2dbaba50d0e7b335c94456a2b910d1

SHA1
16816f78a6965f6a6f8d87ef96bff8a7581f09ea

SHA256
0631491a74f4a86c346509ea14fbb83ffcea188c6a2ac79dbb26f87999e8b480

SHA512
0b762dc46e7473ad316f4626c4f349acaff6f1642912babc01caf571b6523d2b431ff33418b0100214b7084f176061cc4341a099e2cafe38b9240dac54993db0

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\glib.md

Filesize
31KB

MD5
15ce49fecd04deea166483e7616180ce

SHA1
1c9efa9bc43ac90dd3744751259293d25ec3e4ca

SHA256
80b10497133e79e89a4016bff1c2568a7b77659e5080c6078d493c67a3818c09

SHA512
f1e5e0da52451316b66419e2e303522324e3c9787491484666f8e23e8d46e07ff75e700a11cd08d27e7a7f3ae965611bf054e5024ec797a699d21c2a9d49ac23

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md

Filesize
34KB

MD5
022f1a3e36adb00225785a770c103c8e

SHA1
e8aa8b3aa1fd8a7a0f090edb076ed1d4c0c62fbd

SHA256
8ce8329445deb284d13bab568728a4da3a3e69b19319d5db495e6ece8e7b8821

SHA512
b2e5caeedf5247f8aafa1bdf68675199be33b10302bc3bd7da8edc255c8e43887f63f002a3b96fe26d62ea69fcdcbe270a1bc8edc0374fb9acb951ab5542c790

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md

Filesize
23KB

MD5
a106aecbb8278eebc644352edb0d8d75

SHA1
2ba74d20212e84def8ffcd5fb61c47a1c0b8f307

SHA256
feb0f5015de9fbcd6329269f7d5dcd3e9e4fa61850b7b5e5bd022d32e54f0400

SHA512
32fba58f2419a36f51fd60f1593bd8ec9b5239f8daabf3f6363bb8d0664be23276b24947d43642d376e9d36154c48bbf111b828644d056a8974007495ead0883

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md

Filesize
2KB

MD5
72f5e26fb30f38042eca3b9f21ce645c

SHA1
897b3676e01be30f6f3e75686260dd9eb9fc427f

SHA256
a1eeb6356c7f1e54cc53f8f71ab296a5a5b45f8c3cb929d536190e9fa4a0131e

SHA512
824ade7a7ca693ad5e88bf21aae0ec0e10704718e252710fbe8116366ad8ce11d00642bf6591e3e758e790e83808f1950dfecbfb73c13c8efefca60d49a8778f

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md

Filesize
1KB

MD5
506c778119516c7309e6ad61466e4df2

SHA1
def15f1ece21d9eabaeb1004b31c36e03b3a0145

SHA256
db65c41a121b574d147d1ef6e62b33a85cff1e31295cb72c00b03cb18379c458

SHA512
132cc985052ec357ce384bdb6f4e3d3a984bf7820ed00d47f75b9e5209c8b850a463e0ac7b704ad5b3ace065e3acdc815e2a4623661af144c2347ba0f5fa649a

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md

Filesize
3KB

MD5
ed27b7c93c16e7c5938f54f5a59417e9

SHA1
111667c82b25111a83424e463894998eba258b03

SHA256
cac37e5b247408e1181ad065dca967aef8cf1220eb1aa0b4fd6b24d859e525a1

SHA512
18eec7da368679cc70f4af2d7ba01c84ae455ec7d65220f753aad0bc44ddad366a5f9bc6c0d6c46c18351f194fd550c81026211b3ed7b7877fdb1f8771946c9d

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md

Filesize
2KB

MD5
e499fa74a8d56b71dc59f8085e17ea54

SHA1
eff69582879a404f4820d008069710f00feb6da4

SHA256
228f33bff1a06e824c765675313bb80762bb5f7c35a93d444a7d45ea88d2356c

SHA512
e6a259e09bc5c2a9d59e5d61fa96aa070c1301f0bbb710ab3f40c90985a6233d8d62d8169ad1655bc537916c2ac09ef3ad0eaa75790809f568f3d467ac6cb918

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md

Filesize
5KB

MD5
88e16a5eff0ed11439408040e584b828

SHA1
41ce9db70bd6be36b637fb413b05a0009c1f75b6

SHA256
0f835f7c0587cd9206c70b37c468eae917de1a7d180187154e38d41a34e8092f

SHA512
0d39bae101c69fb984558ffee30b3b9f1160300b12453f9a897067b8096781f5ee954abd41d448556d93e7a59731f2badb04a217587a45f531a7d26d4cd210f4

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\public_suffix.md

Filesize
17KB

MD5
d83a92994c3f2b8680f2a88b42c3c9f1

SHA1
1d992c05211c125c038be05036d3b942729911b0

SHA256
d637e84bf01812abae51601dd308815041bb5694be9c58432639c08fbbd20de7

SHA512
7587548792eda4ace1c4dffff8efb3dfc374eb26d2070a7db4adfac9fe5985874d0a23862a20122460ed9c02fa489046aaad4962d6df5af8ed8a343d3fb136f1

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md

Filesize
320KB

MD5
7e5491ba96558ed43db47bc4e92b58d9

SHA1
03a57843957c482509864a740253d3d0ef10df57

SHA256
eb9ae862d40c44e47588ad3fa9c0fadb724e1aad3a1a27dca48d7b3231f7c80a

SHA512
9469c9b5ba203b4b25961839acf30bf72e1acc19798a1338e7daf1f3c3f3dbdad7e9a2d40440f72eeb10379990dc5b430d7792b66650b76ae9afddaf3a58f458

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\asm.md

Filesize
1KB

MD5
a2427e1058eece8232dc3887bca79171

SHA1
b0f872357167af23b25c4289daacb7930911713a

SHA256
7fccb3d6d36f7596e3855edf8100b5a1347a02dc235e4f5df579f3e4275cc6ae

SHA512
4cf26f9e8147e8c19bbc470c523a35c94f7e0b4b1ca854b7801393db3327a65adc2491dc5aa259b51cbbd10da773237cdfc169fa501d84ae592e781e2c9cd5ef

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md

Filesize
10KB

MD5
9721b17508e4c16b9e747a3a785c1949

SHA1
ed5827fb92f9ad67a82efe367eff690592960654

SHA256
599c820f42270850ca056de1bf2fddf4cb1e4da3b0df39aac86002b9a63247ec

SHA512
3d2e60f634b3e3f0910f525dee3e848eb9c6511037d88877584c0ddf4617bcd5d64c9290cce304d10f00e0bd3de05c397707246a64e3fb64de6c9674467c0a3c

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md

Filesize
3KB

MD5
98baef44b9062f67a574646e9e34dc86

SHA1
aaed517c5ef09a8a09eb37085b38e0a3201e6bf8

SHA256
2632fb3047f1d0b195893e588189794f0f77f3cc6a0efb112dde7a420b6d01a7

SHA512
b6db3a487de4d536472e05270baa4202d4f879223905bedcc39a72224833db729c262b8f67356c3486792ca5c278acc1855a3db1a70a1df6054f740b6066690d

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md

Filesize
162B

MD5
222a44b8b3e306834061eb95df8624c1

SHA1
138997a693e39331fd16ef09c577c308c1b25ac0

SHA256
6f3dae15775028aa0f7c0668e0d80670938dd2248fe908af1dc6d83a8a08ed8d

SHA512
1383b7ecc8c48426f583ae2c55e455ae4ec97e276823ddd63de6b5aeb7a3df713c0206efae1eb72aba13890e66edb16b46fe8d2571c74f87500e301404c58c96

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md

Filesize
1KB

MD5
cd1f64f5ae6d3be2bf618792a73069b4

SHA1
ffa6e58ebf9b1a7df34e479815318d881875d4ff

SHA256
6c999ec9232273bfe783e023bc3e2324d17e720c0340b51883990633513912d2

SHA512
69812bb66d9126568af09f66b6c3da3013625f5702fe3e14ec7a73fdb84a832ded21124f921b05ba84b973d57a2c72dd0d453c2f32891111f69680a2c8df0dad

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\dom.md

Filesize
3KB

MD5
78ffa99abaca5fb66ed2c40f39450e70

SHA1
c8329841f8eab4751beb6872f846f2b441b525ed

SHA256
7bf6f41750016a53ac3f914ebd55c6ad16448bb4cdf6053897b46134a298fefb

SHA512
5031546532230537fcedb74c275dd3a33efd16d9f96cf30dfd9b9ac2b5f36f89ae9e6348b44f636a107ff26ba09ee76ba64743f828f05e26f445a8408d9c5e49

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md

Filesize
1KB

MD5
c6bf9bc7f0907a606b0d521cbeefe3b5

SHA1
b551d2585095d0ec835e72c6f045186263ff3440

SHA256
79be45725957de63e6528e6f1be25dcc7d55a34a2a1dcae05839f420c6953bcb

SHA512
abc013a6720533105aa82f6aa1078b0ef36af07ed9b3eb6ff4292333e380108e738b7f950728bde75c6cd74f047bee0bed30992c7f99ce5bb9a6dc01b70371da

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md

Filesize
28KB

MD5
305b8b5a93e1a610767565f896392d6b

SHA1
c3a24f058b6199df3ab568d732dfd0083062ac6e

SHA256
ca75391ead21ac247971a1b898dbf896738c9a2addf8f33652e368f3dd1e08c3

SHA512
e6ba8866654813995d2b1d62cb5ed60c038f810a838ced360dd9076fb664bb5caec0e4fa50c3c5662861eb6a5bb4a2b74e2d4c7b8d21d1c35dd4fdd3918b7cef

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md

Filesize
2KB

MD5
6955d45441033d7bfc447d8fd1b98154

SHA1
9ad29e4be2ced34da005f2a6013439d45f6027a5

SHA256
adeb785109f11f4a23e96176c9e72b2a6a651da2b1c34330db9809cf5f91ec71

SHA512
4c3b3e9782bd821e6e526554e1c596d34b4f3df777d65995e78686d14621a301fe8041c0d15237f1bab59d0c03bd5d2919d9dcc8018345de0289a40c63574145

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md

Filesize
1KB

MD5
0528fdb9838977d7bfb024e8c1f63e51

SHA1
e953949d14217a0d122b13fdbee12ed6d5d8c233

SHA256
ce63d774cb228052c6a901301d73602d338c2b9da47dd9edfb5cccd9cdded52f

SHA512
13dbde5649ddbc0b6c701ba616feb5d3830a5c067835922fd5d6e20d1d3260a070020025e6135a2ae8ca44f336232772745c53b4c11570bfd11c918f6f21d3fe

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\icu.md

Filesize
2KB

MD5
5c762d941bf560f759499b05b7262321

SHA1
a5057cfb952be8e40c3c07e8c75e717812d98012

SHA256
7f7bf65faaa31501736fab2a0b5f5eb7b5b3a9226ea33ebd66b1860693867ebc

SHA512
85ec383b65b4fead431ff0ca5d508e33306391967458a72472175df9e32803cc923e6370865e002836f8497f45ec8ecd68518318d2aeefe45b385d0a2bf57552

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md

Filesize
1KB

MD5
95cfda4a544f01b82452afe7b17e7271

SHA1
8633364068ed5df0fbf743c0199db23d4d0c731f

SHA256
ed67ee7d3bd212c021e81a4f19d09da45d9d5d2d62dd2722e0ef862cc529a494

SHA512
d2c67bd71f3e464b7301a99899e6d0479910c6cdbe2c02c7a9c8223ae1d4e7cc92c33cbdd5a6589c082aa721904cb050491098243bfde6706a6fed7ae9315a23

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\joni.md

Filesize
1KB

MD5
c37dd60adaa574ab460eb10b2e7e6ccb

SHA1
97cd2c3ecab7877919b9e47bc647640017abbc41

SHA256
f7632dd056f0241988ce77b73a90eb3227ae934022d8a12683af62ffc0d1c0bf

SHA512
a096137b6fdc606eaf3085fe44b16d9f0ba47be5187cfc45a9216ee74d62c58c92c36458ce92140cf61945649d2bd0bfd6bddd89b36cb1dfa2e2ecaa671fb663

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md

Filesize
1KB

MD5
09c8523c6ef1e38da57f0008601209b1

SHA1
b8d028a4265c98da5d6c061361ac0656fb633f9d

SHA256
b48e0a7041b75da43d573a877d2d82f3e9ed96de1bcbda8d30c03c848c3e328f

SHA512
dfc5d39c348f65b1d23faf2e35340e6a93ea3a62682c68fe90ea4ba25cbb4db241eb6c54e8f9ae8d82f5c7c31cef3ddca67a4bc9674bc2f11058e1a48d566a23

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md

Filesize
3KB

MD5
fcae0962544c58ca16fb4d455ab8bee8

SHA1
6abe144a567334f6aae049e5ea0980fac439b552

SHA256
b26113e98ac53a7c2f219c68560806b4a10ccdc8e92441b6e37b31c08ed9bc64

SHA512
b473d32eb9a75f338ccbc79926df9e100da9a7e912481d178bf2f2c81ac35fdb7de8fc93a0a145792398d32243e4d0eefcdf9a678697563bfb3ee6e1341f69d8

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md

Filesize
2KB

MD5
3770766d460b47a502a6ab1b67e23b99

SHA1
517a8355b3d4c836d70384528b56e2c532762515

SHA256
e46e090cef43d5d53667000990e0eff5dc74760ca3e6186e2b981814f9cedb12

SHA512
2a5fccccf9ba56f9e867c468d89a3f6addfc4c82fa4e3103792830d29b3f5294e675a1c3349c478c4257f92b6ba435454434f043e8052c6b1a8f3ce60f2cd965

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\libpng.md

Filesize
6KB

MD5
4746066a9623a029788507b23f2e6016

SHA1
aa27aa82c6f801685fdea00c44a2adc2e64a9731

SHA256
87db5fcfeeb36405b2e01dcb732a0bcc46fa5fe27b84635321e3c57fd1feb093

SHA512
a3097a3791ca651a63e8265edbe8acc665dbb6588b1f3ac2b1427498b7a6ab85556c6972c2d736055500d19a21a2ec032f2c545c3f919888aa5d9db1b4e6ecbf

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md

Filesize
5KB

MD5
38b4bcbf61f79c47f717321020352b48

SHA1
67bb77c75a7194a2c34876fbcd2fbd9d43e82dcc

SHA256
f5958cb962688d387dbefba9f4944ec421731e356863a58d4336dc654e96dc8a

SHA512
18530944367aaf81c06f0096892e167ebdc99616c49a482091cc156d7095e4c5cc1f5fded405f6b736ab3874819a38ec3cdcc3140c07f9487eede475c5047bc6

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md

Filesize
3KB

MD5
16a7a7ec9aeb035ac16d5912daec3966

SHA1
dc681ca073d30936cb54e93fc049ce51fc191556

SHA256
5c4c5a76dbc6d63d5047c3ae16f4e9e584f9f0c491ebe4351e65580877296a3c

SHA512
522095114b227f0d217c47d5a6b5a31dc2150df3cc48a77a0e166bc6783e3588390a0ad340ffdde3a2ebfc11d699e8931a7216363519b6ecdba2a3b2331a6d27

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md

Filesize
2KB

MD5
28d4fdf472a96c29ccbe165c5b58c512

SHA1
d2020eb6a972b281cd2bd4fda16f5b35fb82d027

SHA256
9607b28b620fd5a94e361e78a39d9c91affc4a56baac10cd7728d7988e690fb2

SHA512
3cd9982dad5dba87750a36c9f3394c537ad3bd46a8d54f829e374ff6270a42f4a72ca30c7f015fd8b7ee1b552ffaceb9745e443d51e1a19476bf018c9c8f9a09

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md

Filesize
2KB

MD5
0d7fa3eef61fced19ae0709760c9d1c0

SHA1
1d344c8d43cb34f547fef444ba5a5618d1cc67a9

SHA256
eeb9d2d41d06ce0f2940af236a77b2c7d449ae1542d30a2c19df4d2d1528a5e5

SHA512
029b56d9f807fc741ca947f3cf1073dd98e96a3a8c93a44371f514c985f42f56617655a1d011943a35c1c95108748e8dbd0094fa61db87c48ca2d9cc2df0eb23

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md

Filesize
1KB

MD5
83862325c6b98cef3083d22329b3a9dd

SHA1
4433d4b74020ef8b82584354b72e871501afc565

SHA256
ba13b74381ee3ab290140fb55fefc722cbf124b4f77fad0eb08e7a58a9210bf2

SHA512
f2f9b524e223997a00535554c8c11e88ba2f724996955c5f56be6c0b91bdbfff4c5526873371fced47f11012007d076716e35202b841bb918cfe00f42a845502

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md

Filesize
1KB

MD5
b3cbc3ef49211dfe81f2a083f3203f7f

SHA1
088abd95c1a8b209cf5f2eb7250dfc083d9f7337

SHA256
7e1137c0953d8f68e06a2a4903da72eab071070afca3fda61e07912c1aa996d5

SHA512
f0bb7f02c28cb26b20f39d96f4a9557b7a1c5ab9e32dd8f48a99fe58377b7afc4ec106e843954bebe0b1b4ff287be1debd7c22dbcd5a26a3d40ba79732b23623

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md

Filesize
11KB

MD5
d80a5d3fa5490a975a33c51752b90816

SHA1
fd08347a2f9ec26236bcd8884edd409b4296e979

SHA256
a1b576d5d37a37c34967eb21b77684a265a55d2baf91a78caca7dde26745b374

SHA512
08592b2ce258e3dac2885fc435bfd388923670a80c813308c25e704feef90056ba5e91059d1294867b2b637e22dd166cb75218cbe6631430391544808a8f2c29

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md

Filesize
1KB

MD5
a3a8e168180d84d2bc9ad9877df8f4cd

SHA1
51b2b873b5b1434129c8e2d6f0e2d2c460944467

SHA256
f302555c389037fea1a4da577ff391659603af7bcb0bd353bb675ed3ce35df98

SHA512
8877fa6790f1124a4640c449e214c42d8f2b3108af67cbf8505c546e7b891b9d13475609ce8d12351ab99cda24d91decf1dfe2b4209f2117789af62a35e80500

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md

Filesize
2KB

MD5
35fe5a8bc1d07e17aa949e209cad598e

SHA1
cb49ecda8a6051fc50cf0d7c30906f838ff13baf

SHA256
f00edc9bc40982803f42f449840280dacf58970977eabb9d07656932a557c241

SHA512
46ba0ab78d4febd2a0e8dab86af7fc00a894d5d3b967c952ff50a33a25b41db09bfedf87d85b420c70ebf6772081d5524d987ca88e948b94c549a3140382f3a3

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md

Filesize
11KB

MD5
165e95df901c038e6ee0257a6eec3bfb

SHA1
ab6053117203b8be221835e19d86590f4ac63401

SHA256
a1838a7c4ea2f7ac78813f421dd2b6d6bc63af3b0e95a30f9a7997d25ddd3b60

SHA512
728bf247c838f3e8d34e3fba0d337d74070245174966fc370618bf9f0554668fcdc6c0a7e14615e3c77db342dc97dde92f762db42a2924647812455f118b9592

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md

Filesize
11KB

MD5
52cc0c4e7e610c4308820ece690a002d

SHA1
8c4adc976f6c27bedb4d561172033ab4645ab3c9

SHA256
1d46f7bb00a0daa5c54c3d116c14468d4fd18ed0ebafd45f9a9ed553aa91bbeb

SHA512
1929e8e9b329793dd63577219b3646409a59a6a63b51545638ec0c67ddcb07ea73626146433bd3250d5ec90eeb026aa5024e10a6bc21a4ffb1e1a86a17c818b3

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md

Filesize
11KB

MD5
2c1561ee26b739e171c4751a2b81aa00

SHA1
7e49249b3379eda78e0e5eb3cb93156b03bafe10

SHA256
fe6adf329be9c3f159da253e10361f668e0fe6f36d317ecb6709da0830201e80

SHA512
f3cd979e2f080bf23c0f5cbbf257dde359417aa4b92293a9288851374073a0b9206a3b21fc3841eb1230c9c66388c794c0e035b855f33ad7a94233359488849f

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md

Filesize
1011B

MD5
c308774a04c71232d74482fe9b7f2f33

SHA1
091bac5385cc7cbe8b4c91f84a566aa978ecf4c3

SHA256
45149a8886944e3d28ef0fdc6a368d105b02c1655fa35e7e690500af13159a6d

SHA512
985f26c65bf498e34e6cdfd23b73f94fccf351f30088ee472f4aea7762ad5f4a293ec45d6b9fb489e270345afa58e24c8cec22c49849fdcb4688035101a4b9bc

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727656120098725.txt

Filesize
77KB

MD5
684d994d039ef435dce6b10756cc3b29

SHA1
ef2cbb7bb03b4b4010dd3e0aa3ef0e28c1a43e09

SHA256
ca6bae86efe997875355508fe531a53c3c6b6949ef83d2383114c1d90de0d789

SHA512
59a67e6a5ad8c0a7ab6434b018a3621372626c2bf787f54171ee714e07bd066a18f0bd693ac6621c714e2cee2a87904ccaf0fb88043c2008c778c31b683f96e2

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727656590293648.txt

Filesize
47KB

MD5
2e26c2517c93834e37b79c978f9b99ac

SHA1
3ba8d1fce0e67457db477f49e298352129ed8121

SHA256
29ab18cfa2e97debf2fe112a119ece71f57b657242f495fafb52bee994c1b586

SHA512
b7e2e3a7c4494cb43323211d920a4bbf3c2231d1ac1cb8022ef36fb963cb9aaa26b160ecde784924d7c8ae0ac2668b421ef22bfc19f58fe7c0d7390b8ecd450b

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727663328721506.txt

Filesize
63KB

MD5
82446ae8478942457a2ae8874156627a

SHA1
c9777bf4540e18d5a7fc1dc9b655fc05da975869

SHA256
44c09a1895d5203af9bba35e7139bef2ace11b5081d3d3c69888a660324ad65c

SHA512
5841ba1e4515073300758223985fc5b7d3cf165f3ff67c014c05c9053185db4b4ac06da78bab675f0b0198f92aac37908da1731385414bd2322fb5fd1d027b93

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727666039184869.txt

Filesize
74KB

MD5
3b7f9b422ef5f93bba793aca5e0ee61e

SHA1
555777bb68123777cc3340d5fb3e901fe4767bbf

SHA256
2d56a91abf3308dec4423a7f98c330940bc446fcc7927d727a29fdb7fed636aa

SHA512
bc5c1ed8618feaff915b6394672cc1dd076479527ee26a2d8d1c4934e3879c4fc6854fff52ae1a6147df19c1c4be5afd4c9e65d0aa3fd084b1614da8fe9a90c2

Download Submit
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\File Explorer.lnk

Filesize
407B

MD5
405dc8bff0e8dde6ddd2cd6e5788491e

SHA1
a79867f725173365470a76f468a47f2dc253340f

SHA256
6af2c0fa1c8d6c9952a88ddb70b9d86c645c1361dcf5402ae35d84942cbc3e6e

SHA512
96df126d2612361951659cb761be804c26f877ae1e27c12323bda12798c6d0165296e9c7ea0d603573788692fb4d2b2b19c4864aeddef76b7e6b41f3f4ae8c4f

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg

Filesize
21KB

MD5
696a2e4682f5d31c62193b9558fd35c8

SHA1
a08ead3fc04fff046fbd93f4f81b60ab05bd7c4a

SHA256
dbdabe9bafb1f547a3265b7b072e6881efbfcf4862f4ea4914a86d49ab14ee1a

SHA512
2087a8160be43d29beda8d71db7a94ffcb5b9eaf443ea486048c76bcb88f1171506973f07b65dfe2a72edcde0f1b1734329c4c6a03dfd9f03e3500041da0215c

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\HelpIcon_solid.gif

Filesize
1KB

MD5
d3bb9bf59060285ac0b37269d65fe587

SHA1
a62fb2b3dcdf1b8c244c4f6dea1b7229d00f3f88

SHA256
b7e306d1494469d0e80777ff675d7668cbfbb871fdb129df529ac69bd772c22a

SHA512
89873ead0025fff3c9cc704bc0a44210fe59082d3895c08ac95175fb12da58acb188412246d5376c9b547395866e0f0123e44d816a32b2920d37788928b24b56

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\alert_lrg.gif

Filesize
952B

MD5
a1fe0ebc289aed0e1b8b55a5a315e25e

SHA1
49b3189b80c2c74b0d6d77549916f9a900045b45

SHA256
3274f37f05facd148084e0fe6cb754083a6d1d0c4e6f50ffc301ae63f2724324

SHA512
f2847bbb42024e3a61c4143992003bd7fd609e52a34eddea52b6060405e39ba5c4f44e182f720a919c85cf7e07470359833a1a9a82ac7184ccaf4138f46ec436

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\aspx_file.gif

Filesize
121B

MD5
9efa2168f48f4595241f4633809a4aba

SHA1
23c641fbdaea11e0a07ce119efe0583d57df1797

SHA256
dfe78b8e9c5fb8c320afcba47d05008497f4b8762738d739850f70800785b79f

SHA512
11884a114706a53b972b9221367dd0461fdf433cb04871534149cb7b01c5f88aca71fe1ba49622999dcbf343c8ba0e33ca2f146a6273ecf794fa9174bb43393b

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\branding_Full2.gif

Filesize
1KB

MD5
e2c8afab75bfdc6f04e5c1ee3f88aac6

SHA1
426cecd3392145fbc52daf1b8e2150b56a155624

SHA256
3fa3fbc704a9f722525a8bbca2aa65c0e4dffeb639f10e734cf2370b1ce8758b

SHA512
ef891f64c440a6b1205e6ab564b583cfbecbb303e23164c244a321cd37a66cb802fba797877e89ed83ee032940eef24556903bf5d831ebd49479fca4981ec923

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg

Filesize
8KB

MD5
24a58c4cdb9075b5fe629da1d485dbad

SHA1
10a2d4db197095a8db90378d98bf3e0ebf2a7c8b

SHA256
eb811fbb55e54193db0a8ef9438545dd09c126f470216420b9bc01682933db08

SHA512
25daaf2214afe3a29f84dd3bd9bebf7a222a6dad1623c5aa46b6c198f4d59a1b11a650ced6b073c8e50340c32768c264cfb0fe667b2bd99b39795e90c6eac715

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\folder.gif

Filesize
914B

MD5
6a3e41b437c7d36fa312e1ef8bb1031f

SHA1
510cf5866f9857e793acb6e713237668d5edeaa5

SHA256
5bd6449a9fecca3cb068b518abb2023524c5aaa19fde898e098e67f5dd19d40b

SHA512
be27d80a2c76386ccb745df718d529fdaa3a6dd51e12dab9bb98d2d0a487711de91883b08f535415bc9ac7eadda953007916c0314d438813bc695d5bee3a7e70

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\gradient_onBlue.gif

Filesize
90B

MD5
eeefd2109a72adbac4b1ee55c4848426

SHA1
89574d483896d3974a8b8c1827093b1034123193

SHA256
ab67fd1cd041602bb9018b0013f215d0e3fa97fcc978aa154b7ea5e4c6d09e53

SHA512
870e363d83e6745e27fc6d7cf68eea1d0234a803e87ffb35b05b081c11764c01f9f9d540407a25ac2eaf8f2bb0d13a0bb22425fd4e8e85107f972d69d620706f

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\gradient_onWhite.gif

Filesize
90B

MD5
f2a6c2f1b473c0a8ed4475c2fb2a1626

SHA1
9183827e5c624048fe6811aed957a9e4861b18cf

SHA256
8b0a9b26132f12d58f53a70b549f66b0da94e4c22373b6b83cc38798391409c9

SHA512
fd6d4b09cf32be44b4ca1a7eb95b8f437ed9089eaf2570dbc2e0050cb0fc960db967961713158bbd6d00349344c25aeb3bdfbfe278c906d3577210a484b5d83b

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\headerGRADIENT_Tall.gif

Filesize
328B

MD5
20ce47b67ae6c80decbfc735caa4520a

SHA1
868f791a22e14436fec25a304c7c2a3b651ce507

SHA256
5543f80ee05158eaef3fa3bc5acf70a13c374e53a4126249d963606546a9b022

SHA512
7d6a7c69cac99427446898ab915baa118f3289bff9728b05f5a945deb7cc6f7cdcfcedecab7c6f2c3d10fc6f0b72eabd7fe7d37acb3255c2f8145c4fa903048e

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\help.jpg

Filesize
1KB

MD5
a08c6ec4e542427ac1d6e5e56eec62b4

SHA1
b67e18dcadbb70671ddfe82cf83a22d09cf1e8ba

SHA256
851817efd454f78bea5a2d48838a0567687645b784ef6b27b69ee652876050b7

SHA512
98b3e5e8a72076abc38910cc2dbc43102cd53b6b4b36a50f290364de4e56f9ffb20c9306274d3df00417d7ee1b5ae12ed5a1cb5c28c0d19476f2c2b72351193e

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\image1.gif

Filesize
162B

MD5
9bf63a8421cbfe4d69342ee9dd66a25c

SHA1
e8b229ac6e6bc86b7abdab5bc6ab9c5459822481

SHA256
2c2cdb6c7aa3b869c60286edca5e333a3b5b0c302f67c0bca27934a5378d6180

SHA512
d174d199a824302d5561d4d1cb3bec16eb2b2da5448d66775f69abac61dd9f78b2f1eddfbebaa77292c2c364fca8bf557b9d175b371d13af64dca19376d0f305

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\image2.gif

Filesize
586B

MD5
b4fb27305948b2a2d38da18af1a4ea54

SHA1
2d7cf7a3b794b03edf88624bf8bced05e8e8c2f8

SHA256
716e122d7e771cda7351cc98141a2a809baeed5d3a9efdbb27aa93f569cdf25a

SHA512
c74c0f024046495e5ca864d851e5d7896b214bfca80bf64d114dd81c4e36b5a1734f7a1a531b368585192e8f55ef9d8fbae902ca7f5c8190de5ff4cc8bced60f

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\requiredBang.gif

Filesize
124B

MD5
56b5bed2479d77e8ac0d900cff674ee6

SHA1
f04ba203a3d99062e26574ce00916a6221cff6dd

SHA256
90a3d0bbc840b5bc146b82f24db797f53bda54d8a94245450de85cc0c3f48abb

SHA512
c1f943084a7ea401df870d2e5075bd9d0ab8085de0af9751fc4a99a3cc36a97f7b5fe9f2a92876d8ce8cd8543178bc73d53c2c44c557ae1b09ce92941241445a

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg

Filesize
8KB

MD5
77e33241c12c95522afadb3f931a4288

SHA1
80996dc931cba7c512598774c30b78422d72d6f7

SHA256
7ec8a7aa7d851df01dd5cfacec192f10e663b03a3ebc7798fae095d480c4f8b5

SHA512
f0808ba5895b573bc71a0f80ec4882891906bc4c9bdd58f1ed4cd48d33157b0702feab31f30065784a58d500ccb9157ee87d11a39fda83d1d6eae66883f3d7ff

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\yellowCORNER.gif

Filesize
880B

MD5
bf46e9bda396be6f1aa9550049bb2446

SHA1
947caa537ac9633a123220e424029fb3a786eb40

SHA256
6fecb0dd8c9d7b54fb0843535ec81eb1b3ac59992ff1b9b231c6f10f4199a69b

SHA512
c38543feaec92b0a4f83c0753e02dcad681c30c40aa3b3e05122fb6dd70ee7727c2095914f06cc99088ef0e883ddd0304bc1ade0f7952b387231d1589ebe8ab4

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group1\1 - Desktop.lnk

Filesize
1KB

MD5
9aa22f6d8109fc2c9d478d5c23d0804f

SHA1
77138bf28f578137e9df1dea2ece73aada52d881

SHA256
19f5e7a3f2197e1638abecf8b3a6121ecd96e558c189c675baaefde3c8a28778

SHA512
38d649276769156aadac8de1e73e14fd1481cd26f795a44757678dded10b93fb0d207eb714d71ed1b5963399f72100c3f2d97753df5635f60c4611f3cc0114c2

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\1 - Run.lnk

Filesize
1KB

MD5
79e1084b302dc5a5493ebc6eef6129b1

SHA1
ebadefd792064236e6e3375704406b37bae0ccbe

SHA256
e42a88165e1207a910848900034c9b9ecdb9cb6d227c21b09bee3e136c8b5dee

SHA512
0e7b7109e3a7bcea2f2c46e814cef5b4de96e06644db2c764752a7b024acc61e6b381c6585ec82f50e890c551339ab569bd4d73901f6b4be5e595ea0b74ec35f

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\2 - Search.lnk

Filesize
1KB

MD5
44cb72d80b11d2aab4fe6ecf127a1f32

SHA1
7f6f9b463a7efdaa45dc364cdeb07622c593629e

SHA256
247296a686de1d2a0ab5d4fc9448f5b9b6e13923f8bdc004560fae5f8820ceb3

SHA512
aab212ec0e05ac4bcfc6c671452bc97e0480365b2919c4ea356719e5bba413d246380b0636e8f3278fe3bb05278c73730fb372d6bd2011a6123950ee0b4cb7a9

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\3 - Windows Explorer.lnk

Filesize
1KB

MD5
d944a40280e079bbc0fbcfe1886113cc

SHA1
ecdd92e53ff3eab3750ac0fbdbf68f2124076aaa

SHA256
ad4490f294e85d26883ac49916287e1a0bb27d61c0ae8e1796aa68f3430e2536

SHA512
c18dbd141cbfdf7152bf6d9f921c4726e7000fc7bf1574a1b6f7f8d05517bcf7d46932cd860e9c0786b89d80ac447fa57970bc9a973537ab13caa1d45fc434de

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\4 - Control Panel.lnk

Filesize
1KB

MD5
609d5fbf63c4e30c1273a200d924ae6f

SHA1
a07fc3d4a8c5ac9e8ad35ab3f7c374620308e813

SHA256
14c1e0138bbceb084a796fc0ac73f41c4b90138ef0d0bd95435053bfd259e19d

SHA512
c356f05023699f1cdd6189797df793f00cd3b2e4d0b3fc85ac2daf216081f060c590e7ce6b8eaf159c085b97c0d4c3dfaee00c8f0ab0d5b286e5381645bc3611

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\5 - Task Manager.lnk

Filesize
1021B

MD5
638581eb782274f5807ad04d09b96f71

SHA1
42c5fbd6284a47943cde8abf8fddfd7858ed4ff3

SHA256
dd5f847d0e2777265630a2ad7e0557460ba670bedb5db2c68d5b3d903423e77c

SHA512
56382b2f803067735772f419d641ed8d4d4adf9362472e8be94fb3a7a37fca20a84adabd81abcac9bf1740f53deb5d7516f1b31751dee61b5d2ce4ab10460b7b

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\01 - Command Prompt.lnk

Filesize
1015B

MD5
de602ea5a7fe175b14167672c7b46b5c

SHA1
9739aa1e624abaca37fa003b3f41597399c3f99d

SHA256
3ab9ff10b16687b967e0965a2db4193b9cd8df91464fedd5f5a7f34148cac72d

SHA512
bc483ecf98e48cdca8f0068177cacfe4bd485843a83dc0aab2a6213f4cff776be293286928c6993259ea8419686eb425b448c8d4ef307382111bc485bf4a9cac

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\01a - Windows PowerShell.lnk

Filesize
1KB

MD5
fdbcde668d326f74b64f07bf711f942b

SHA1
9bb90d494bc5685a9e8c7891d505a8980aed8b1e

SHA256
f60d63f157631eab20a74b8a033b8de5824b0416d4b6499248cd112b117cbce7

SHA512
3c617d53a25b649904002df258a444cb6339127b35877fdf5327df42a15c68c303ea03fa8e9cc3455ca6af658691fd90fdc83d86e537ec86db69eb86464b630f

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\02 - Command Prompt.lnk

Filesize
1KB

MD5
fc5018b72999c05f9b294ffb7d8c90ef

SHA1
1d5b46374a77b2a56e14e98660bbe64396bb891c

SHA256
cd549a8cb22ff94eb875509fde0f7034f10a41fc4d24ea8b357fad67a67c5a2f

SHA512
0d89b656622dcd2e3dc31cd7b500261913d8e5e37c033f043e107448b777f71e1733fac8d5c79bbedc6e99607821605858ecfac2956d40196560e43de06f5a64

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\02a - Windows PowerShell.lnk

Filesize
1KB

MD5
09c9f5aee6061e73ec4e67d44e55b0d0

SHA1
a4f577789d1c72a293f3a0916624e9a01e9747a2

SHA256
0822b25dad348600e47da3291ef659a8c03fa126b36dc542c7602a7c6389e563

SHA512
b56747578fade2bbb80b7743f60c8fdf922cbc781e76191f9d1c07e12292a192f33b806a289d433ac8d2aa29ae96cb04796f255071959304662e129e63bd9354

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\03 - Computer Management.lnk

Filesize
1015B

MD5
fa4f540bb22c005f0bde2272053dd91b

SHA1
b9b26e57cc07988e35ab1132e9930c50ad9e70db

SHA256
630c6bf4e3e543ac12e279131db2ea1ed0dafd9aa128df2f787cf018d91f03df

SHA512
ce501e2470784815cc946d18321f651c83da7a36632e0c7ec668ef3796cb5fc240aa9deec85d3cef7aacd82dc7a41791d69753287fbc3f897ca9f772d0350e77

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\04 - Disk Management.lnk

Filesize
1015B

MD5
6ad8573c48a0d9b4984bcef38bd47768

SHA1
c6747dd85ec1cdda7b58fba8c5833e9326326f4f

SHA256
61b2ba32d6d61f8c38831b2e1caec7b2aae6489dc88140e21e6a7636e9752292

SHA512
f1e658253c2d88db8093c3b4ed38bb9e3034f2b68ea511ad4bae358174f5ac7d86a733e21f91ad4929cf69cde28942bf91f8b7e93040944373cd419e8f5e5bcf

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\04-1 - NetworkStatus.lnk

Filesize
1KB

MD5
81056cef6959751bac93ead64715797b

SHA1
8eb785a32906c3b961a5ae5fae99a8fa8aa2db4f

SHA256
eea50637096e103e3ac9cc6ccfd6852d512b54dcde11a3a7e4d6795f0541492e

SHA512
c7a1c1dea97cd64754e86905d4c62040d206740dc70f873fea83765edb449b5c2b34a8624632d817764936abcc5a7b04b7f32806fcd362bdc00d81a9f46d03b5

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\05 - Device Manager.lnk

Filesize
1KB

MD5
0e7b78d8133fa02c3c26c92f520a94f2

SHA1
80fed6d55588a2023f54262b87f3a35aba0c95ff

SHA256
3e9f4972a7d9831bdeea6ab297bc4ef306409543a5a52ab8827744c2075a9c7b

SHA512
c67939ea24f6bade6d5e951ca02786039e2d88c980232b1cd54ebcd9b409b81e18a6cba8901a712ada1466d073dc91ede2e8b5952f51a388194cb23a38fcc2dc

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\06 - SystemAbout.lnk

Filesize
1KB

MD5
76a75e303ab5be22f801aadb174cb2cc

SHA1
2e15d0b82cfe531958beb094a021518add0fac84

SHA256
78ee9bcafdaa21752b3d889594428bce6f526c6a480bc3beb2f91c3e7e2e0a5b

SHA512
3310d21a467dbff7ceb7788f814c947d14db1c9c92f19af7ca7a2ba75e85fa10d8bac01ae6e6c3d8aa27c70d98c4cf6bd66b97a7b919b84545620784d60d47c1

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\07 - Event Viewer.lnk

Filesize
1015B

MD5
decf4cc0d3d046dc70363c4ad6781f74

SHA1
5a828bf64e4867a40af7ae36c4f5d4b15b367f01

SHA256
d92e7b57320857cde8a8b6d5f676b27d3bcaf0f561249e7e243ad74c94072797

SHA512
e502d69c31c2f273481b9ed7ae897217b9a3e472d9c8a715b039d218ec02e57895cb5b4fbbaaeac866ee3e89da65c00638955d54d3f5107462387a874a42020e

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\08 - PowerAndSleep.lnk

Filesize
1KB

MD5
0bf340d819a2631228385fe23d95e7d3

SHA1
c371da3ff10cdcb7623b29d7ce599875071e3fe6

SHA256
c41a9bcde2944f59e97056b001fc4b539b20e62a3e8b296cbc430e21eacc8c0e

SHA512
a16cccdc9a3180597bcf1ff81631e92d6c0efde17d9e44441406b120f97d6021c585f9d325054621352b56082f73efb1366c653efff44b8ad93fc855a0840deb

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\09 - Mobility Center.lnk

Filesize
1015B

MD5
62188b0a1618122e4b430ef8207d8f0c

SHA1
32d1796949ccb091ffff1ec7dba75d6b0d927fd5

SHA256
ee9e611861f748269a644a901b5f76d5214eda650e3622695f2cda27e06bdd2e

SHA512
45540b59de111dd96198144c676a3d9fa7b8d48b6a73a4ce0e269f81e3941848f66e591b2a4a3df9ceec5e4932e23265e4b63222a478b5fc277fdd70336dd7d1

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\10 - AppsAndFeatures.lnk

Filesize
1KB

MD5
d922353a47073825b157cd019745c969

SHA1
5f34f28f0ccc0b484fc37869277645c92574615c

SHA256
32c0d0235ab1004f76d2e10170875061af426f04890df49008f5b3838c97f051

SHA512
9e7e7c7ff6fd5541e6340094005ff818c9ff52cf5085089764246bf3102a74640f88e3a8f98e98018c9ce0d22a3a457171196ca8acc5dae97efd0236be305c51

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk

Filesize
352B

MD5
6b006cace007c2b06491371862ae2513

SHA1
9ad3230b370a19738918ffc979bf49e3acd57fe0

SHA256
cde5cec79d0c6a1717e3eea5c380e267576c7be6fc80cbcdd1042b937074aaf8

SHA512
81b2a8a00e3eea4203df4b72a2677d03bc3d880b6ee92a2d522ba1ebd57c9663c1c1e2fd2b1b93763cf102060b631068ef0f0b2790b2761d2d57e7fcdba5d965

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk

Filesize
334B

MD5
50827d1c0861cb78439a4b9f792ee2bb

SHA1
cd41c8dd619d1567f56559f2ed01a08dc879e356

SHA256
0339784a6757a9e517648fbef02fdd0cdbb75f1632fb424cb451c72ae4dd3438

SHA512
0ea3068b2d6d61709a01bb5f4e1fdf320b935ace80d9eda7f9bbd9001f89d544a565a0ca2f7f10794138219630f1f3ddfb4ab92ef14680e12849e50c3e9ff312

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Magnify.lnk

Filesize
1KB

MD5
4f7fd1a068610149b47030046fd3c622

SHA1
26b2d133afa8eade23b7797b4ab78d8d7a1cfc9e

SHA256
761828ab19f6108f9adf34f8f15527609462e9ee14287c6de6d6b7516a665e7c

SHA512
e8ac6fe90d699a00878538b1b97d6efb01b2a8ae6cec091d9a2fe09bb5dd1b7f5daf205c82ffbc85ff2471ad2ffa140f4c97cba961571ed9e4aa06ca672d4e02

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Narrator.lnk

Filesize
1KB

MD5
cc8379e7db2f1a0449170153db6bc5be

SHA1
e0a8238647020da5783d8ad2965233103a9ec13c

SHA256
f84a6c071a8b767d4cfa9367b3d56dac90a5e69bfa70c3fb51cca3d6bc4c9d8c

SHA512
e7bbca0e2f4dd4bd90f6f7534f134b796e5e71bc6b9f2d7e6e567d61b99bcb2f4ff0430195b8d44ec459b199b632f6bda3718e5aa728253b21d9d302f64dc49f

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\On-Screen Keyboard.lnk

Filesize
1KB

MD5
0bbcdcebfffd8425b77a52958b407e75

SHA1
085bd25674fc86daa10274af229f4dde82ad8419

SHA256
7378fef91f4e15f6839d5621345699d36a507e1adec08664572c2dd70018f020

SHA512
e9be7d3e3d61b19d0ef24c228a1f2ee67759a3265681177848dafdae9a5c1a444f464be549dc4377fde8e3e236caee8a6fe2d0120778723611face3cd3a096f9

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Administrative Tools.lnk

Filesize
1KB

MD5
34e3727869d9faee6b6147b86b6d3614

SHA1
0c852aee03bdb65be34311f50b66a61700eb8b2e

SHA256
6783a9108798ba1e0a536c656e965dd7e1bf1b40fb820f11c4f2c6be5fe602f4

SHA512
05eeef62afdfb0f28716345c87c005410c314a0f21761b77b37f818e2ad98a33dde0a0f83cd34c9c757a3f95ab0b01abcb97ebdb58eba8c5f73f7ed8e6702901

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Command Prompt.lnk

Filesize
1KB

MD5
32e2b40e29da5fb91e49250597880f98

SHA1
da5b5d50e5555c7fa5759e5a948667421ddbd2cb

SHA256
3d2dcc2f8c637bf6d5b7f7f7704d0f4ec78d76536403e17fdd15ab32a5dbe9e8

SHA512
a31e86bf1e45a5463a2a080c5b247469f467fceba31d0345500cdb13cadb578a2423c6cf84cfd1d9a60c2ab4d747414498d2016e9772d9264680efc4bf3025fa

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Control Panel.lnk

Filesize
405B

MD5
539c9af5f823eac86b19fdb5186662a5

SHA1
3e32670b463a9d7d7ffaf7bac840ad79115fde02

SHA256
2723c4b010c71d05cfeab6ead9af36dd4737fd06719bd56f8d459ede79454c58

SHA512
8092a45701f1386df648423939363c813b086c3e64092bb365e76f1ccec755989d53e996cbebbbe93df26148ea66d2da3bedc7654be8ca6258252b10bb2879b7

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Run.lnk

Filesize
409B

MD5
42022277d8d9d4ddf06c98ceec78d539

SHA1
f11e922828bda81631240a6b85e585d03a43dbe0

SHA256
ddc640bf2f7afc8b2199d33c8282978f37426008773737b8d4df9b00369d7567

SHA512
7cf7d5cfc71cbbe2188300e9c728f2c5ed50c89111bc219d64b9e0bd716e26788fa11f7f792f777bf89516524b2155d8deb113e0e1a50a90d859199c24064230

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\computer.lnk

Filesize
335B

MD5
7540fd7a44761a48b930bb404a3d50da

SHA1
4f3eb51c565628bd38124f4d61a1161a5805fb86

SHA256
dc7c79eb788dd31cbb219befc9aa408360e8533ce74287bfa298777b6ba36440

SHA512
19db927478260f9cd8ec457d0035f327036b1b7cdb526e8bbb8c80d99616b7fca5883827a1bd6f410ef97486216189c02b1c6812d44558972c2a9b7ca55eb120

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell (x86).lnk

Filesize
2KB

MD5
98da2eac9c3ff779370125fa43f1e065

SHA1
88f41ef54e908e14f001307bbc761657ce701e17

SHA256
3c4226637b3dbf065feacca9a56e29332a2845cab7f51d6b415552c3beab9160

SHA512
35645fd35558fdbf2b33a1c8d37130ac22b861fb8028c711e9d502fade68bd5d43a9e7a919f9dd1cbf7aac1cea8220fd6c6f14835c965be00b274c89fd58d345

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk

Filesize
2KB

MD5
9d2ff7bda11b037cffb7c16619fde589

SHA1
cc6dcadeffa4822a560b867b49a4f27c27b2173e

SHA256
11fbd533add35de5a07b63c61f31a7b27962551486d84144a01c557b9dce99e4

SHA512
e3a9c4bbf2523a1fc7b1369e6c9466f6dc152b66b636ce1135e9b4513c0d871e84deca4e63298c6914528e692ed57fe585d0c1b3dd23bbc849d58161525905ac

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png

Filesize
296B

MD5
68cddc6c06992b577ffc60ce8ee25283

SHA1
f3c0cab9b9540f4f4c35c23302f957c9fb189536

SHA256
fc50d48e3f8828e5a200bcc1ca0080cb7e32e65a0b94d16dc7cd47238f6f8ef2

SHA512
bfc11cd83f7c8b52d9df4ef5e3cd605023f1732814fca53a130d8c54350ff0eb132ee844177d93103b4bd14343d21f0a718f803a664a78a20923b1e199e4ad65

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_contrast-white.png

Filesize
276B

MD5
3999f561bcaf3ef6064e6b30c895a550

SHA1
792d10b0a9ec01a8c860ccdba606875ae5a93979

SHA256
83b29f188e97204080fe9e14ccbee96d0dbb94eab30b3617b62666bc07a438d9

SHA512
986193183ebcc504c29f1763c5650cdd4a753d47fb7d71604118e0fda9534cca230da77d31c7b634727a7267425646a473bd07b1774bc74eefa49804528000fc

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png

Filesize
296B

MD5
a7a6f64a1fcb8c22f934b1f6895a1e0d

SHA1
969c70f8789a6522da8c4ee6e80060e0629518a3

SHA256
5f619b55587bbd478972e887fbd63ffe46af38e06768e52c8bcfd5edcda2f0c3

SHA512
f85a24107927c313a8d2b6102a334c25eca6e4cc7f45d28dd5ecf476cb9ffa4399eee286af7ae2bdaa6cda3e1add71eeda032a06ac82cd95707b66d041068f9b

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square44x44Logo.targetsize-44_contrast-white.png

Filesize
276B

MD5
39c67d437f7be458ac7ae89da3c260f3

SHA1
43c85fed577065420ca73a1ad58e36a8a0a6b9df

SHA256
82c1d08bac4ed6a6634113b832a4c7fd2511352a9be8877e8869e40e84b6a04c

SHA512
c654f34eb179937155f290eb62daf9caf0e3587533dc6dc3034dc3579d62436c2d0ddd4cc79537f5118e469c79ba2283e35f1c9c9c9eec42486ba2f3069baee8

Download Submit
C:\Windows\WinSxS\wow64_microsoft-windows-onedrive-setup_31bf3856ad364e35_10.0.19041.1_none_e585f901f9ce93e6\OneDrive.lnk

Filesize
1KB

MD5
b4a5bf057cb81513ec641361f2daa6a3

SHA1
b90a03b348e0477c834a3303ea44b2634a15805f

SHA256
dcb648960a97e1da3ebe9e1328b13e63008dbe0fdae713d9e11f1d6d9f3af9b2

SHA512
fa0f193bf79717038c1122fbd182bd818c4c5044304b5f9b778dd08814b2434fc0d8ae99c9af339162ef2ed81ea7734c0f652ecc0b06d0dd51d37e361e13d90e

Download Submit
memory/4064-10910-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/4064-5139-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/4064-0-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/4064-9846-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/4064-11219-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/4064-11250-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/4064-5133-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/4064-11255-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/4064-11256-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads