xorist | 726fcc36cfdf852f0a226228d94c6257bd04f3ee6d99b95adc6fbc255fb0f315

Analysis

max time kernel
134s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
24-10-2024 06:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
Size

16KB
MD5

72ac44125353f22e5e1fcbc6432c8e58
SHA1

fbf12e5efb4f8ded0aba082d3855c245f13f6f21
SHA256

726fcc36cfdf852f0a226228d94c6257bd04f3ee6d99b95adc6fbc255fb0f315
SHA512

44cf444d8060afc8ae143fec477d9ca6a43c2abaa79b1f67c04d19e8232f2f140a97f0f1767dd0650d32a4a81284eb51c8d2ccc04e13c7570ffc940d9f773e01
SSDEEP

192:azdrr1FG1WDCgmjPZJI84WgxFkuYpMa27OYYaOCIX5jj2J/e8NrXtUA:aprr1gkDCgS084xFupVg48zrXtB

Score

10^/10

xorist discovery persistence ransomware spyware stealer upx

Malware Config

Signatures

Detected Xorist Ransomware 7 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3012-6042-0x0000000000400000-0x000000000040E000-memory.dmp	family_xorist
behavioral2/memory/3012-6047-0x0000000000400000-0x000000000040E000-memory.dmp	family_xorist
behavioral2/memory/3012-10607-0x0000000000400000-0x000000000040E000-memory.dmp	family_xorist
behavioral2/memory/3012-10906-0x0000000000400000-0x000000000040E000-memory.dmp	family_xorist
behavioral2/memory/3012-11221-0x0000000000400000-0x000000000040E000-memory.dmp	family_xorist
behavioral2/memory/3012-11226-0x0000000000400000-0x000000000040E000-memory.dmp	family_xorist
behavioral2/memory/3012-11227-0x0000000000400000-0x000000000040E000-memory.dmp	family_xorist

Xorist Ransomware
Xorist is a ransomware first seen in 2020.
ransomware xorist
Renames multiple (2184) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Drivers directory 9 IoCs

Processes:

72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe

description	ioc	process
File created	C:\Windows\SysWOW64\drivers\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers\gmreadme.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe

Drops startup file 1 IoCs

Processes:

72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\GNcWPTsYMeQ17cZ.exe"	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe

Drops file in System32 directory 64 IoCs

Processes:

72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe

description	ioc	process
File created	C:\Windows\SysWOW64\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\en-US\Licenses\Volume\Professional\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\InstallShield\setupdir\0009\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\wbem\en\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetSecurity\es\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Com\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmcomp.inf_amd64_bf289615d063c627\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnms007.inf_amd64_8bbf44975c626ac5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Dism\fr\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\digitalmediadevice.inf_amd64_5b64b65052c3a32a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmsuprv.inf_amd64_696bb57f8e3bab65\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\microsoft_bluetooth_a2dp.inf_amd64_614ec8e6e63777b7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netrtwlane.inf_amd64_20caba88bd7f0bb3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\stexstor.inf_amd64_fefc1160d15aa667\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetSecurity\fr\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WaitForSome\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Configuration\Schema\MSFT_FileDirectoryConfiguration\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ialpss2i_i2c_cnl.inf_amd64_f668309b543472eb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmnis5t.inf_amd64_c6e181de81a59b54\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\usbcciddriver.inf_amd64_400a61104320a399\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\IME\IMEJP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Microsoft.WSMan.Management\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ServiceResource\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmeric.inf_amd64_41ae7c84b8d94de0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mstape.inf_amd64_3e2c4fa2d4cbb487\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netjme.inf_amd64_752bf22f1598bb7e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\sdflauncher.inf_amd64_1ea082c6cf8f6982\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wsdscdrv.inf_amd64_416a5877e9180787\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\fi-FI\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmsupra.inf_amd64_ed209c9a3da66777\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\MUI\040C\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Configuration\BaseRegistration\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\cht4vx64.inf_amd64_b03448ba0b72ec47\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_image.inf_amd64_31731e48047fa274\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\SecurityAndMaintenance_Alert.png	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmgen.inf_amd64_977aa23dfab87f15\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmusrsp.inf_amd64_4c83ce3a06d0048e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnms005.inf_amd64_add71423ba73e797\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnms010.inf_amd64_9e410195c3b236c9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Windows\System32\LogFiles\WMI\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\amdsata.inf_amd64_ea60132f1a9a7a62\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\oposdrv.inf_amd64_9090a824ce0d0e68\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\default.help.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Dism\en\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ArchiveResource\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_smrdisk.inf_amd64_bbef253cecafbb1a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\es-ES\Licenses\Volume\Professional\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\et-EE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\it-IT\Licenses\Volume\Professional\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Dism\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\bthprint.inf_amd64_d3a88fe647d71206\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\chargearbitration.inf_amd64_a0097842bcc7e487\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetEventPacketCapture\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCClassResources\WindowsPackageCab\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WaitForAny\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmvv.inf_amd64_26dc960cc4c84207\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\fr-FR\Licenses\Volume\Professional\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AssignedAccess\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WaitForAny\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\DiagSvcs\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\msdri.inf_amd64_97bef65a8432edd4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\nett4x64.inf_amd64_54eacac1858c78ab\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/3012-0-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral2/memory/3012-6042-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral2/memory/3012-6047-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral2/memory/3012-10607-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral2/memory/3012-10906-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral2/memory/3012-11221-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral2/memory/3012-11226-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral2/memory/3012-11227-0x0000000000400000-0x000000000040E000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

Processes:

72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe

description	ioc	process
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Square71x71Logo.scale-100.png	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteSectionLargeTile.scale-150.png	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteNewNoteLargeTile.scale-125.png	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteNotebookWideTile.scale-125.png	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-80.png	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ru.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\Templates\1033\GettingStarted16\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteSectionGroupMedTile.scale-200.png	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsLargeTile.contrast-black_scale-200.png	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\ExchangeWideTile.scale-200.png	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-Advanced-Light.scale-100.png	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsSoundRecorder_10.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\VoiceRecorderWideTile.contrast-white_scale-125.png	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\20.png	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\contrast-black\MixedRealityPortalAppList.targetsize-16_altform-unplated_contrast-black.png	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\pages\winrthost.htm	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\OutlookMailMediumTile.scale-125.png	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-48.png	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\it\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageWideTile.scale-125_contrast-black.png	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\Standard.targetsize-32_contrast-white.png	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarAppList.targetsize-32.png	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\illustrations.png	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\dark\bun.png	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteNotebookLargeTile.scale-150.png	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\dark\sat_logo.png	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\GREEK.TXT	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\MedTile.scale-400_contrast-white.png	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Thumbnails\Sticker_Icon_Kiss.png	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSectionMedTile.scale-100.png	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\OutlookMailLargeTile.scale-100.png	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-40_contrast-white.png	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\apple-touch-icon-72x72-precomposed.png	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\JOURNAL\PREVIEW.GIF	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\LEVEL\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageAppList.targetsize-40_altform-unplated_contrast-white.png	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSectionSmallTile.scale-200.png	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-32_altform-unplated_contrast-white.png	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\GamesXboxHubLargeTile.scale-100.png	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ko-kr\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\zh-cn\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Program Files\Common Files\microsoft shared\Source Engine\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\webkit.md	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-40_altform-unplated_contrast-black.png	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarLargeTile.scale-400.png	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\themes\dark\sat_logo_2x.png	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\locale\bn\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\locale\zu\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-64_altform-unplated.png	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarMediumTile.scale-200.png	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailAppList.targetsize-40_altform-unplated.png	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\Assets\GameBar_LargeTile.scale-200.png	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\id\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-96_altform-unplated_contrast-white.png	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-GoogleCloudCache.scale-125.png	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-black_scale-180.png	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-16_altform-unplated_contrast-black.png	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Square44x44Logo.targetsize-16_altform-unplated.png	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\Square150x150Logo.scale-100.png	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\VisualElements\PrivateBrowsing_70.png	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorSmallTile.contrast-white_scale-200.png	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\Doughboy.scale-250.png	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailSmallTile.scale-100.png	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe

Drops file in Windows directory 64 IoCs

Processes:

72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe

description	ioc	process
File opened for modification	C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\InputApp\Assets\StoreLogo.scale-100.png	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-g..cy-gptext.resources_31bf3856ad364e35_10.0.19041.1_it-it_052a4b05ead69c1b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-telephony-phoneom_31bf3856ad364e35_10.0.19041.264_none_d18eb583d16ed6e8\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.Windows.CallingShellApp_cw5n1h2txyewy\Assets\Splashscreen.scale-400.png	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-i..ll-broker.resources_31bf3856ad364e35_10.0.19041.1_es-es_dd4362edb35fb713\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-spp-main_31bf3856ad364e35_10.0.19041.746_none_c240418e0bac14d2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-ui-shell-component_31bf3856ad364e35_10.0.19041.1_none_03928ee4a9e5894c\RequestedDownloadsLargeCloudIcon.contrast-black_scale-125.png	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_hyperv-isolatedvm-svc-extension_31bf3856ad364e35_10.0.19041.1266_none_ba2d7b1e644c55e4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-a..esslockapp.appxmain_31bf3856ad364e35_10.0.19041.844_none_15e5bfcd83a1911a\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_en-us_a323edc73bd86475\http_410.htm	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_10.0.19041.1_none_1ebdec675f495bbd\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-d..mprovider.resources_31bf3856ad364e35_10.0.19041.1_it-it_6efcd443499fba34\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-n..tion_service_iassam_31bf3856ad364e35_10.0.19041.746_none_59a8ae5eb289884b\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-setup-mbr2gpt_31bf3856ad364e35_10.0.19041.1237_none_6b74aa3973213895\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-u..usnotificationuxexe_31bf3856ad364e35_10.0.19041.153_none_51feabe070ab84f6\OkDone_80.png	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-appx-deployment-client_31bf3856ad364e35_10.0.19041.264_none_93c3704f3937c819\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-profsvc-mof.resources_31bf3856ad364e35_10.0.19041.1_de-de_278af88823dcf327\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..tartup-fveskybackup_31bf3856ad364e35_10.0.19041.746_none_868c87747a5558e4\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-f..lientcore.resources_31bf3856ad364e35_10.0.19041.1_de-de_ecd44f3c4e10e3a2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Windows\SystemApps\Microsoft.Windows.FilePicker_cw5n1h2txyewy\Assets\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.19041.1023_bg-bg_716e22d250901c5b\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Windows\WinSxS\msil_regasm.resources_b03f5f7f11d50a3a_10.0.19041.1_fr-fr_d0a0c6ffa4585261\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-m..ontroller.resources_31bf3856ad364e35_10.0.19041.1_en-us_d8e35aa9dbdf193f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-w..-protocol-component_31bf3856ad364e35_10.0.19041.84_none_e370d2aacd35e6d3\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Windows\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-quickassist_31bf3856ad364e35_10.0.19041.1266_none_72c6a00123f43c47\Quick Assist.lnk	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-speech-userexperience_31bf3856ad364e35_10.0.19041.1_none_d1fafd8eeb2a2637\Speech Misrecognition.wav	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft.grouppoli..mpleditor.resources_31bf3856ad364e35_10.0.19041.1_it-it_cf6f34899f8bd3fb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-t..onmanager.resources_31bf3856ad364e35_10.0.19041.1_en-us_9282db59dc3419f7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File opened for modification	C:\Windows\SystemResources\Windows.UI.ShellCommon\Images\WiFiNetworkManagerWarningToast.scale-150.png	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-d..istration.resources_31bf3856ad364e35_10.0.19041.1_it-it_2c2b0820313203ea\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-m..ndation-frameserver_31bf3856ad364e35_10.0.19041.1266_none_2a87945d79cbf905\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-t..etpc-mathrecognizer_31bf3856ad364e35_10.0.19041.746_none_9645c26eae7342e7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-e..ifiedwritefilter-ux_31bf3856ad364e35_10.0.19041.746_none_c7c6fccae233c8b7\ResetDriveSquare44x44Logo.scale-125_contrast-black.png	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-a..on-logger.resources_31bf3856ad364e35_10.0.19041.1_it-it_e688c9dbc6221e98\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-synchost_31bf3856ad364e35_10.0.19041.746_none_51cf02378fc26da3\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_cht4sx64.inf.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_e7130d01644fc8d0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..y-ntmarta.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_e22198696ca7acd5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-d..frastructure-client_31bf3856ad364e35_10.0.19041.1_none_0c5043de76a7d97e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\de-DE\assets\ErrorPages\invalidcert.htm	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_mdmbtmdm.inf.resources_31bf3856ad364e35_10.0.19041.1_es-es_665c49f46f4f66b9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_amdsata.inf.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_24ee3e67a8522a71\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_amdsbs.inf.resources_31bf3856ad364e35_10.0.19041.1_es-es_8044278104f4ac65\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-diskpart_31bf3856ad364e35_10.0.19041.964_none_46ba1386f4ce2b0b\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-i..onal-keyboard-kbdus_31bf3856ad364e35_10.0.19041.546_none_67000d82a7c2a372\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-msxml60.resources_31bf3856ad364e35_10.0.19041.1_de-de_ece8342b6c3b172b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Cmdletization.OData.Resources\v4.0_3.0.0.0_es_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-wsp-fileserver_31bf3856ad364e35_10.0.19041.1202_none_ae02f5c0bff8da39\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-a..apc-layer.resources_31bf3856ad364e35_10.0.19041.1_en-us_7be7a5cee15a57f2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-kdscli.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_0eb68ad442383147\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-t..vices-bpa.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_96bb659ad243a387\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-dims.resources_31bf3856ad364e35_10.0.19041.1_de-de_22da4572ecd28af8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-t..honyinteractiveuser_31bf3856ad364e35_10.0.19041.264_none_a61d15efb6291d40\YourPhoneCallingToast.scale-150_contrast-black.png	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-updatepolicy.resources_31bf3856ad364e35_10.0.19041.1_en-us_ad9ca73025205e39\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft.security...gement.policyengine_31bf3856ad364e35_10.0.19041.746_none_0b2e52494db526ec\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_netfx-shfusion_dll_b03f5f7f11d50a3a_10.0.19041.1_none_d413b92c48c2acf3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-cryptext-dll.resources_31bf3856ad364e35_10.0.19041.1_it-it_b20e57281fbf45c5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.1_none_75cd350cc8b5dbcf\BreadcrumbScrollLeftHover.png	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-r..ienttools.resources_31bf3856ad364e35_10.0.19041.1_it-it_446d88c72b9afdc3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..iprovider.resources_31bf3856ad364e35_10.0.19041.1_en-us_8c7ca8bc3d6c201b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-c..termanagementsnapin_31bf3856ad364e35_10.0.19041.746_none_290f6af7d5263efa\Computer Management.lnk	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-directui.resources_31bf3856ad364e35_10.0.19041.1_ru-ru_6d3e93e7d64555ea\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-fileexplorer.appxmain_31bf3856ad364e35_10.0.19041.546_none_476476bb5c3a0bbc\SquareTile44x44.targetsize-96_altform-unplated_devicefamily-colorfulunplated.png	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe

Modifies registry class 10 IoCs

Processes:

72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\JCJNKHJASLNTBGZ\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\GNcWPTsYMeQ17cZ.exe,0"	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\JCJNKHJASLNTBGZ\shell\open\command	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd\ = "JCJNKHJASLNTBGZ"	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\JCJNKHJASLNTBGZ	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\JCJNKHJASLNTBGZ\DefaultIcon	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\JCJNKHJASLNTBGZ\shell	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\JCJNKHJASLNTBGZ\shell\open	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\JCJNKHJASLNTBGZ\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\GNcWPTsYMeQ17cZ.exe"	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\JCJNKHJASLNTBGZ\ = "CRYPTED!"	72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe"
1⤵
- Drops file in Drivers directory
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\aic_file_icons.png

Filesize
50KB

MD5
94f6a63ea99178366fd82587181935c7

SHA1
31dc0f0f4f559484abd8dab2c98413b6d59896bb

SHA256
dae52e39ced324d31677129ee60ea044caef41fd7629c053e09d20bce57a4b8f

SHA512
698c9d5aed4f1dadb943ae3d4162f123f07a4f2358eaf528f749093be29d892b26df10f410471fd175d845cadd8ecfb9848fd8027b0898dd9e15a6eebd45e86f

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions.png

Filesize
1KB

MD5
efa7c554a896810ddd2365ae170beb5f

SHA1
76795fa678065b9bd13942b6e148d6ee013fa1c1

SHA256
bc04021ae8c78df8bfe50d05a040faf14d121077a2e1f8ac4e7fe90c96804555

SHA512
3257996d2e0d450c1fbfb51add003c66f215cf533ac99316b7b047d6e69e7f7dc95fbab0d9992d4b9a00d3dc6219c47f3be56ce7987a09ebe007426952f2b260

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions2x.png

Filesize
3KB

MD5
0356c0637e9638a08c1bcb0d6c3798bf

SHA1
77ddcfe544492b6bce7b555d71d0666a94f9996a

SHA256
23c475df1c02463c3459f13cf611ab3f67370b5688a35f890b3d2bb4350fea7a

SHA512
390b92352e22957a01dc59ec110e768eae6b6579ccf4424de5fcb581087028ec053544be921b09e7f1671427aad5757ad171762b2a741510f5aabd05a0822c2d

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons.png

Filesize
683B

MD5
738444dfd467772b26ae7fe5a9f7095c

SHA1
12cdcd9041efbf5bbe9f0b0e905f08129e94372f

SHA256
4598f47ddbb3fd95afa2c28ef48794fd278954059ba7ff87fb6f399c8123c617

SHA512
7127abe79bb9a264b6e8de6f2df3ef1f5b51b8804c6cff53b3b868b4eca78c9c741c336f342fe1537f0939a3259383e4fd0edb1aee511817df63f664ae0b1659

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons2x.png

Filesize
1KB

MD5
41580aca1756c5ac7fdf37e0db835917

SHA1
2602644683c614410a1ad1d5b64c635f42f3e1eb

SHA256
66d809b9d8e356a641b2099ed689dffda359e2124bab2f590e0d1c30b5554ab7

SHA512
22a0e89f75ab3893419630d5a595112b8206b1f08435776d64a5a0fae26b0f308419ce6bc194e23a24c99824499af4558d9c7232ec6e2472191e5b1b96fb345f

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon.png

Filesize
445B

MD5
71d03f43cc632ab87d20007b066f2cdf

SHA1
93cafd82ff75b912d3aa54fa0bce37a51cf853ed

SHA256
8c6c62a11eadb70c849f1e268c2466e535ae492fcd4529497938aca1fddb4dda

SHA512
63af6be5acb464890b6a98d0e39ac6a31e9d550a0576e5eb47657bf8776b61269d10380ac2c5e96510b93b275bbdd05a9d3be57bbb1913837a0127e3905fe752

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_2x.png

Filesize
611B

MD5
ce4d1a86ab2836c0c06b83bbe8a9bce4

SHA1
9c28a3bd2199594d7b5a21d97d1175407bb0c97f

SHA256
4e720ca49f2e982a03f8230090ee8c4cf64f5371032cce7dac21ef1437fe7f7d

SHA512
6a8d0f8a5b5826e4e489bac2fe329a6a7b69531917adbe5db704278404ac542b1bd40c683046235f5931824b7fce4a51de0fe3fbc92f667a79a440afa7ce9037

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover.png

Filesize
388B

MD5
2f302d76d26c39ba701abd0d3403bf6a

SHA1
b4e225d2c495af566666825ea59fd8954ae7788a

SHA256
913e825a66dcc26ed12f0fea64ecd7b45022a3da9fe31f9c8950670f6823c9b8

SHA512
62b17c181c60697f70e7a09420e5c90523a21622d2f2f948262c301c596ce5c8e9311d194ab78117cfea1c6dbf24b75bc4b2e089162cb59bd55547e51537dfde

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover_2x.png

Filesize
552B

MD5
864bf0a4ef8332e0c79ae9ae71fc2fa2

SHA1
61ea8655fe15f6e9e61fee8b47b9f15f2a68f9b1

SHA256
3e2d83a07aab9a33dc445081bf7d5c8f5fe90694e5cedded7f5f55f9ab3836ab

SHA512
c786a7723dd9ee7f959d45a701813678355bae6f56524e9098733b9101436f6caa62fb0b90aba85bc1d467e0d0cb34870313d542f285d0e54c41f9b6b1975078

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon.png

Filesize
388B

MD5
4266f7894e97271e325f0bd02588c4b5

SHA1
a06eb517ab4f5b5f9851f6acbafea5cb40c9aaf3

SHA256
02e505cc5423368b15deb986ce3664f85af4cc7c986c6980a4d3b7df351ef0c3

SHA512
d484a8dde49a4abffa782e9a2303df73f243c21376ff913ab636bede59b5974c4b4fecb15694c86a9a5945fc0a12f879c72d65bee0159a47cd7d7e6b7dd54679

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png

Filesize
552B

MD5
8165a61c4b870b8f102fbf559b2f30c6

SHA1
6c2bc7effa1988d991a08be0b520c23da74e042f

SHA256
23330b5586a4d0a73295b5d7f6dd45b7f0fe6bf00075c23a61131ce37109e018

SHA512
6fb5ef9d69e212a74ba75160b332abcd8f83681650ceda7a57597ba045d3469bc0c022cbc85b5bd9c3afd499622c3cb961c785bf12ae4f0392ccdaaddea30a90

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png

Filesize
388B

MD5
a9e76af50f55e4039035e7c283198158

SHA1
f65851a2b1d1ed15a5862e502816d84d670599a8

SHA256
10e89ef192a9178085e8694bf0a874d2b380c9f627ea24b499079fd47976c167

SHA512
9ebc2bbecdab02223caa894965855a9738778dbff59ae340f72fca9f68674b371051d2ebdd9190c591675fcd75cd614ff17b168244857e5539acfb0092317e43

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover_2x.png

Filesize
552B

MD5
7804b73171e0a2995d6b478fb2fe609c

SHA1
8d6a4564f137579d39679aaf85ce24bf5dee7a44

SHA256
4fc1114f3a6785e20de11a4a420abf1341fc903f7a16e03877a5d9411f1bd736

SHA512
4c37ff05153957634a2efeca5810da32799b6986bdc37b1a38db5ed40e38b50552a54fc953c858061c58c647d9ff5d58b5902726eb521e9ec8a0736bda268a40

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons.png

Filesize
7KB

MD5
8e60b89bc473d4ecaf2d2db35d052208

SHA1
70038724b50400d888e71e4bafb78c6ac2aba697

SHA256
7ad47c85d6a1ef343ba32dbbcc86adf22da36967c3efeac62769d7bb91de5916

SHA512
8edbed23e43acc763f69e798a81970c50502f6d2cb13185a4c2b3f990ae4e36b58eb991c6ae5d23ec7eb13e107c98ce5d810e0f0722496780b7e8f320c3c07c8

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_ie8.gif

Filesize
7KB

MD5
f35dbeb4d1cea5adfafa45a7fd7dd81e

SHA1
e3f8920d071a99ae0e713d186fe6c494e179519f

SHA256
948b3f076b544e5809ead48d5ec9f1801de5a0572af3a2fed572119f547200fe

SHA512
156422d3d709319c2fbbe97b05958cfb485c76ab98a737a713ec0f0e7eecb43dd643af1579e249dd7f3ae06b88da60c1b6762176abf1ab58c65549e0276d455f

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_retina.png

Filesize
15KB

MD5
a9bdfa62f21a9c6c74f5cab53a438386

SHA1
a762fb7f230702920079e0f915a261a480a8758e

SHA256
dd1fecd9a539bd4730a2c7993b9a2dba8357b9e29217864ae7d3fbfa71887e84

SHA512
c82e20f09c2d60ca8fc382d4d20702ea124bfe71dd34c7efa80d957fdbcfdcbc7abef37f25cfc374006ef9bbdbeca39c7a67abfdf07a05d8d9365e3a79fed5c4

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons.png

Filesize
8KB

MD5
46c7da46d8dccfaf82e6cc5660085182

SHA1
30c5bbea36bbd5092bdc264fe4d98810a6cebf1c

SHA256
e7982bc598db1b0f09740297d3487a62b21311559d0e9f38058061d5dcdbcdd6

SHA512
969ed7fcd1733f8800bd84c6d2f4bee2c0b8155633b300966dcd70c177ba5fd0200495d2b08c266e4b355e9421d8abed2f1abbb3d72e923ff663eb5c835dc755

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons_retina.png

Filesize
17KB

MD5
af470b8978922e0cfa656f347d37ec96

SHA1
ac3e90a73dff8339589eb99d15da45b68cbd2502

SHA256
e1977d37dfbdf39d1fedff265f1fe78b0030402d28f06983c147a0816af35a8b

SHA512
4f3349659ed7c8269b8cd1353d17e00d31cd3f84b7a8dfc8f606bb446a820463fe56e5fb4155017c15d91307fcb563c8df6ed2f26c3c072e276f850c0d58dc06

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_pattern_RHP.png

Filesize
179B

MD5
a4a9c1aaaab75b89872e92bf9198a0e2

SHA1
73b37affcb284929727ba8b2f6a1c9829015edd1

SHA256
ed6d11982af40dbddad98a14859b5bc630876e273f9092ea1f9c474d67bd31bc

SHA512
5173bd3cd8a21f33f5f0fcb741deadb86eefd0c0e1fd786cd552acf7071cbac77a1487fa8dd0a2d9dc53d4d45ac3a36cecdf1fe28b55681a6d5dac6d016892ac

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_patterns_header.png

Filesize
703B

MD5
e18800ce785a7c608579e47b369776db

SHA1
682697d1e856e80c063978b7bcded262a50ffb22

SHA256
d51afc49e6234a438a8fadb7bc0ac6188322178c1a84705b3749867dfb86a10d

SHA512
c0491d23b09f668442815d2051b99640c403571c593246d7b0e2933cb75d9a1562016a64fdfd1b99c12e2e8310d77db119bb21a56f32347a31f1915e25cd9d1c

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations.png

Filesize
8KB

MD5
188c88513d78a41682b6288ab222ba52

SHA1
03d256183050ec4c7c54978c0a75a696f91a8f30

SHA256
ca9d5f8a7bcab6a21973be3bbd1ae60b1057675b91e7ae15477f62efe3825a22

SHA512
e95cf433470c6150273dc9e100284d1a5b0b2cfa61ce1021f6d71008d4bd730690935e0a0cd860836cb86f79258dbfa248e421932bf8537de1c6696ea1400e6c

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations_retina.png

Filesize
19KB

MD5
e3e83904bc3bfb948c3fd0891deca254

SHA1
775fbd6fd879474691a0846aae03975a72f5b704

SHA256
97371b374e53519384f62da529f60c5b1f786b79f115b69b768f702565b4cc28

SHA512
b890872d6894c34c82b239ea51edeb3c04439b458178ebbe322877bce527893050dde874de65e3b505c5d9833a29391c521f4b89a5784bbb2191c2a917b68870

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\faf_icons.png.EnCiPhErEd

Filesize
6KB

MD5
3f72c3ca592ea6253872e61af2c0fcbf

SHA1
072de84fe57cfd4dbf7207dff4439ab773388647

SHA256
6473cb30eb82ef3d038a72bf55f002b78e5835f58fb05511bb5d51b54c6c495f

SHA512
3ce9a3895fb59757b31643d1f770ad786c048a2c6a2e3d17e2ba530c5fa0a6e4d01413d9f4975d30226bdfddc78623b6dd9b35df73279a259e6047d53822d543

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\bun.png

Filesize
2KB

MD5
15e20f6e246d8b5f977d9157bdcbccae

SHA1
2df8e1dbc5381dfd4a10adefa0188f4fef1df321

SHA256
87b76128c041b5dcda3960c5af2451af161ba1820261226de991e6539e951d12

SHA512
1455d3b5c0cee20e6d6b4097007a7ea6cd0c8ccda60c96e800404145d84c12d69984f7e4e1c12a791c00f26c7dbc117e56921e72e0ea6faceee92c9a011e9529

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview.png

Filesize
2KB

MD5
209a06a10cfec6c9b73e877e9d9495d1

SHA1
c780ecd572bb426f9f314c529abf74388912cd9d

SHA256
b31ebf2f6daebe845ad445bcc2b9616823a1364c4681bb0bcaf8cf55be8c18a3

SHA512
483956fe4468f5787e6048bdeede0afae3ecffba625a8f30ee19046b9960118ce4c3e9739c244a906a75174e51939c86c770b5ae90730afc32241d93a3f15bfb

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview2x.png

Filesize
4KB

MD5
604a4071f0fab0f34968a7a010f5583b

SHA1
86eb9cdfde17589c91c1946faf881e233a394ab5

SHA256
ad168aaf1a6f645c4116f79d23a1827fd3427bebc91d890d1b3e239d84dcea3b

SHA512
edad1f36c7aef289b63e47c1c6d4ce508974702809830efccfeddfed12c9bd31a3a2f1c6a30a2186b6413f7b0e5ac8c7abe1bd39b9ee8555c2b96566f16bbc5b

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small.png.EnCiPhErEd

Filesize
289B

MD5
b8bb988f127339e6c7399a62e6649800

SHA1
2ffd89983a04504b6a78a137e1c0b67ceb910f27

SHA256
8f8b3f9f52e98bb3d991c8e4bde1388b8c2d432c1b4b32a0dc851790582d6386

SHA512
84edb50f34fce65bfb227b2b55675bbb341f665a108e4ef6203637381492c8fddba157bfda07c2a93e2dc3ba588bc2d24eec6ed1179dfe36ad9ed0e95cb84ec2

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small2x.png

Filesize
385B

MD5
21fdd9c9ef4e34e576f02ede1408006a

SHA1
dc8eab9a1c98c997e17fde66394389499a7f94a0

SHA256
46a9ddf44ff3770043cffff3dbb67f1a2b705b5729cec0fd71f31c2084aa5a61

SHA512
c057966d3c940aecb0d762f41a60f78d7ddada295bdf2187e222e382a1e3376e570ff2e852e983f239bebb134a00dd6165e19f7d72c51ba41561e8c405d73a38

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\illustrations.png

Filesize
4KB

MD5
481c5193e79e6277fb2677f8c5073819

SHA1
adedaf8d6b23fa06d0850074f30504b8e2e09980

SHA256
7417abeccce42808f5711d553ed03cfeab3e832a9acc7c13e9b853fd51726838

SHA512
feb1877a1f5035d9cbae4c4e5bd35bee1e2095dfaac753a8a5b1016ad2adc66359da0338a1dc616c0e0fd70f6e3a2ab0a32efbcab543556f0f498ee4c91540ed

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\nub.png

Filesize
1003B

MD5
8631d4b891f8cc07bb9b92301cbfe97b

SHA1
9bd2dd891043f881fe942104811f6172f653ef50

SHA256
0a0524637fac9ba957cbdfed6bc56c45e70b61b2adb8a2738ccf38589c48f39f

SHA512
e9768adcb7b378beedb59931d51a6b246851b551793b8ea81af17548423d66dd4c789b25523fc6cff04f2864da81adda737af892151afac6e38c73fd3825004b

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons.png

Filesize
1KB

MD5
1fa4428a081a9808f8bdedf39d2176ce

SHA1
8a1db57c03359909f37066fb0165cb46ec574efe

SHA256
ef50fde200654a0e3ecf98fd599cdfcce675dda6e49e7ddddf37d7d281e9c99e

SHA512
929ad157be235b55d51c7ba6621d4a60b1949d40441e69ebcbd575d1900e77ed890278ef68407b508fe7edc2db3544679622d5add668d8d313003120de31cc00

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons2x.png

Filesize
2KB

MD5
79a24a6aaf3d45574a0a9be7507e334b

SHA1
6fa8acfb8e731d7e2b52fe1d240818ba437c5d0b

SHA256
19fa505ff2290d16ff88e557880954fbe3ce06a7040d34a5cbc04965fdf7395e

SHA512
44e1c6e146b4396fef44eafb3af84132dc21891528887c856a48d7e32415ba901ec8b082a16a0d04d8b2b52111eed23aa53487efade1d9bc43812481539aa0e0

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adc_logo.png

Filesize
3KB

MD5
c0cbbce912050ea5d4e9c37035d338fc

SHA1
d37ed1bd1d2546b6be6cc38d99337f365b3a560c

SHA256
632285510e38207d4852b62844e5d0fb62bb6fae84ad0283c59bacd0368d2154

SHA512
62fb447f446a494b5da1a0a2347f8ab316418cd12e017fc8d15f8c7f000df4e0125f35bad567f4704c1041bc31646dbba02c7cceb61315e5e31cfec3cc1983dd

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adobe_spinner.gif

Filesize
556B

MD5
1589138840fd4f1d87040d911f14fbe6

SHA1
493d6be997cf83c76c2d5912b044d6b76d5e06fb

SHA256
2c2e06d600fcecc54839f38ce8074c2b31dd3185b5f5e03f92ffdebd3a8edf22

SHA512
5f999a3091af4f280d99f2f30017cb24ee83ea8529bbe763e641fc2edbf134730fca362f2988dbe68644fd7f419d07eed25eecfedcc4f54bb9a4c270bb9914a3

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\logo_retina.png

Filesize
6KB

MD5
2804e7779ed624c9797f7c034c580b31

SHA1
b5d640510f200cec5061daee10750b8c3fa2e98a

SHA256
de4c646fc7ae2d5b3612d6bfee64eda7d28c07603023c8a1c0118d1cefab4d85

SHA512
db378f1acd104f87efb7feb8da42117b3cdf3f72421e1d08086efa575ccf725d525fd9151eeef17126c9dc369ae3ca5244d70347252f89bacd5afc1ecf32f012

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo.png

Filesize
826B

MD5
5896f1a4ef46eba3958de8c5dbf81858

SHA1
81cfee0cff091fabfe53f87972d2b963c94e3542

SHA256
7702064ada50bfc1b99533a0908ceb66cabec1b0880cd0ea2d75646301b75555

SHA512
dbf925c3287df94311545be4875d3ade7621d789124c8e0f4a6c3ddcad0179d72ef408fd826db3a48cd7f48d37725d27b1967b28fe5856e0ef5986856c0c7f12

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo_2x.png

Filesize
1KB

MD5
6da30c83cb826524cd1ecd8fa924a6fa

SHA1
7db592b652b63280b04ecf47b570d5ce9b505e00

SHA256
6a2072c79755f3cabaa06dfe99f6407b85924ddc79af6145ee83dcb4a8f6b03d

SHA512
25bdc7aecb7dd4325d8695a55383f48506aba90a2e378e8eb1f5705453ccfdb96d6c00c02f4f8f3807305bd1fa7fac44b035839beba555ed040086ce667e6caf

Download Submit
C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB_EURO.txt

Filesize
32KB

MD5
157054fd8bf66bf5e0a6967ee95b61bc

SHA1
5031bb8d3023de02bedffe22c2c7024f81bdf761

SHA256
4adb986dcce408dd57ebe494ba51f6ec6360a924a38e50ea8168faa3eadff3e9

SHA512
82644ff90c08707862751f2d5b290910b8d394834bc7dff36d2fa720457afc45354cd31b732dd36a6489ed493ac16d16abc68d2b3665eb992e3ff1401066d63d

Download Submit
C:\Program Files\7-Zip\Lang\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt

Filesize
546B

MD5
6f648ef72a22a7904da3de08fd4a07b2

SHA1
6dcd74b159f584c64375b97d291497ffbc7d34bb

SHA256
c210bf789f938a56da9dce3d5875d54c05f9cec2946a35ec8eb3b36d13a47912

SHA512
c0a5c9d8f852eec7dc40dce74346c66e85eecd2f21524a5ab3ef88d938d373fadbf93d171c0883b081ec1a998180a949ba1d33510751baa2e81661d2cc2c3ec4

Download Submit
C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif

Filesize
153B

MD5
f99f517a9d62044a6ba96e5514ce99e6

SHA1
59d39f93c7f3a6469361e25f335f8115d3cb8248

SHA256
3216891a9fedb9e9a02e4fc32b56c2ab5f8b6ea013e27e1d8ca26e7f05642961

SHA512
100f3118f495aaf087fb638314a5572b5ff06b147d206c6ae7f5b6551b97e39a514338709313c224acce7b2f735adbc51701676712eeba50fd681b86465f8c2f

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt

Filesize
190B

MD5
2f66fe8d3f8ded2765e3455a43af5faf

SHA1
b30eec945177b65f5de21a7ffea40f12a5e59600

SHA256
20e6a1960082a96466b2a78c5f6892fca99ca466c41d473352c85eadd7dfac47

SHA512
93d449c574657dfd69da81a1698d368e1609310e4de4049fa31a413bdb558effdb399e764259d09a40828c4d6e2371e59aa31088fca7be2ab30853936de78bbb

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt

Filesize
190B

MD5
01c0a0f5d8cefffedc8ab9a0005d6d27

SHA1
a72408f17cc56e0cad5435ea444b51fcf7fb421f

SHA256
41c8a8a0d4ae7a59becca19774cc4771221db8ec46e9dfd0df35e22809c3e4a1

SHA512
061c6da5b02bb3a771a46dadc16df5c6b5b6f996e423ca9401b985c16403ef192b74401a3b5911478206c244e68cc6c9ce4242e5b5e56184dd0affab199b013f

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md

Filesize
1KB

MD5
c61f23b5064d8ace52c7a9d2a1f9d6f5

SHA1
c542cc794fbaf99f357296e21fec5b03cf6c422f

SHA256
fca9f9e32eb67b0b48dda2e7d91fe2d95009af4ee9bd5cdbaa86d2e5a8797b9c

SHA512
58ecf5f2a35776b2c3b3a92b5dafd454805944b652b9aefe566ce6ca2cc99152f31f6be18fdf6da45b6d909f0d51ca0a9bedb1a7e9141c44cc9c9269910ce2a0

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\glib.md

Filesize
31KB

MD5
12ad81c0c89e19ceafdd317fcd2769b2

SHA1
a76a74fb2dba8111f6e58283f8701c5551ae4044

SHA256
b302a590431a881da2e4af6641c95d495c5bd878d0394b4fa211b4353b080cc3

SHA512
c76c035b08257e08a8661c6aa58f021dcc2f957ae0a8bb40d55706a6ed5d51249009bd23707903704a610ba28dc5145c421146f76a87bff0a6ad3e7da274cea2

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md

Filesize
34KB

MD5
93431e201fa7cdc547a8760ec6e66172

SHA1
7eb9b7ebd2e73eb36172fa2ada49009e3785b215

SHA256
5758e6948c6eed2e4ce50dcc82f14b144bca3e65d068da1358878021a06d1087

SHA512
d8098b865e247f2bb3d7ccb3c37af41ae6ff78273f7fddfee626783c1a2e9e4e50c87b9cedaf8488ec8b1514a73ec597c77587f2d69f6d4f9801b6d887e2090b

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md

Filesize
23KB

MD5
8e8b032e0191e6547d134912394236fd

SHA1
141104987db64d95dd0808e246638bf161c80464

SHA256
e01303be9a422d33cd64bdeb7bad0a088131ee2e0aebef32db9ed414ac6777b5

SHA512
afa19ef2883290d483161e03c01766174b0757cc49386775cdfe46093d72c55f010d47387ec454e8411ebdd9918757c9e6503b1b14836649c74af84df05ccb1b

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md

Filesize
2KB

MD5
c26a8789205086eaff5126881cd994e0

SHA1
dc41eb24def8cfc232a96128ff0c526f3c430ac1

SHA256
ce204b722902befee63b7e1d1bfe9981630d6c6d8b20ee721e9de9f120316127

SHA512
6782a86aba9ffb2d4795565411b18353c800d9bb69f9a9f04e9e5c915bd8a4f24d90c85ae09563af1818eaf406a5bf67fe9637f9de83cc4f522321106dcfbb33

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md

Filesize
1KB

MD5
6e2d68e2ae9ad84ead8ae1d4dc9ad398

SHA1
bde90b0d5c11d76e35b49480749679443e4c6137

SHA256
5fea6042b73d0325aa22842f1b706b1e7e140265175b9b62a4b1e56f3e1ef460

SHA512
28b7ec575c4fdcf4a79d7940de2562e3415394678143b5effd887c128e3666ac641c2e9f82bec79656ac2076a44a599316e3ad1c76d49eb72cc3e27b8050191d

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md

Filesize
3KB

MD5
76b8a1e47f54048dbfa66c446d69a4c4

SHA1
39fc432bbf946f264583e1309fc7a70271339f23

SHA256
10147d2609a5c01a1a927647c3628671988f653fb0078a77813891eef5917640

SHA512
3aa34fe5b43abb9eb2ee9908a39e061b35fd083ac2ff489473742d75bf84d526556cccce4e3970c76377893293386c6e3d1454ad531e34d9f48b050aac3ac36d

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md

Filesize
2KB

MD5
791f352d03252db98f8e515071fab2ff

SHA1
30ebe87703c558a4cdc2291804c2ad798b760413

SHA256
36737b279d36a47ca2b816b1cfa64d93f29bd9eaad57476d21ffb1c7ab598a40

SHA512
390fde73c9fa9afaefb968df5b7ee99e277353379471660590e38b42c99d0525ace52188355a23e36c4d758368e23ab5bf1326105fd7d301098beba041c571e1

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md

Filesize
5KB

MD5
c21d0bacccc825dc2fc6903f1cd27ded

SHA1
b42e35e7a4eee92a0c87586a86b3a8b739a8e506

SHA256
3b6237d584abbd8efba8000470faa2151ab5b0ece50bb179dcf7d9429e19b730

SHA512
8d34af00b2d4e3cd41a972564f9f4c5361d40ce83eb04ecb97d5e0bbdeaaa9f1dd01f6e6703dbcf6f60d1d18ac5e1cc3e002c041248a9523d4a609c08d0b6f50

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\public_suffix.md

Filesize
17KB

MD5
1812d70257f4322227ab32deb1c3b641

SHA1
73f39d0f420bf37818a6bbffbe632beefd1cb8e4

SHA256
7e72c2ab91547179dd9ef4e58014afa2538bdf7f08855a9f2f58249213effb52

SHA512
5fcf6b82bc7b02b2e4b9a262d8fb9e6a215d303ce252dfdfb663a9d07a3a8645b033cdb25528fa60bcfec561f5c183334c76b6121fbb7ff36e854347d490ca31

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md

Filesize
320KB

MD5
9e01186ba6ea3a57e16c3fc6db317486

SHA1
c87fb0fd92adf763f61026408a633bec0e3933cd

SHA256
f276a348855d5468e91ec6af9a6f3ac6e603af831efad15d15626ae9271cc096

SHA512
01600b30b27acaf9871e96e44994905492bfe26d06d1fb3afca72700f7efc4b5c4e44df054984c88102d435b5d6482f77376a5e083e5934c15b3d8cdfaead840

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\asm.md

Filesize
1KB

MD5
c8577bcec9758155d5e326292f90f1a8

SHA1
d3ead5b8f8d612c777b98108cb67b666581b15aa

SHA256
a67de0664d9fa2856ad2c7f01553bc7863c731164151e688da0fe24449d50414

SHA512
7c954349c290faf121b3c0c7d752dff3269a1e0888090299f13da5940dbc22e261a0f5401530c3fa45bc31b0f47a18efbd0fe53a54fc6700cee766ed08f20091

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md

Filesize
10KB

MD5
8f94b63898ed5c8545fbd4bd9af1f95b

SHA1
0c7ae8f401031af215a46e9f34f6e64b186932f8

SHA256
65eab31b300ce45f96d46ab4e8cf4cbf0a1e22f86fbb2769a3b15e65c5d347f7

SHA512
09818ee7c20e7c8a80979634e3144ec4cadbe73b2a2affc6f530ef50b313553dc672bcfa521799a2fbb4ededaaa127c60488e58d7d4b1d375ca74fddfc468105

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md

Filesize
3KB

MD5
ea6b2b5c3b42d54b6d6b63afafb8325d

SHA1
114ffb9f23f0bfe7bb32957668f5d1d46c603a70

SHA256
b12bcbaab8a53845a28b3a9fd054d5feb106e04dd8a845555b95545878f09deb

SHA512
e4b9a762ba0b0d88ff1eb3a02f8280207b2f387d767a0fc8634a33ef02e393ee52ebb3c1b7c6c9e2930148b8a6786e7aef92aab07e966a19a96b861b77716959

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md

Filesize
162B

MD5
e731cc92872ef61eaa299ddea4807124

SHA1
c40382086ebdbc517f130625d72348b879e60c36

SHA256
fe919e967071f3da87b632278a53f94263f61a9fd7d38d2724926b970ab475ab

SHA512
cfc923b30bded6a7172cd6d488076fb031cca2e63cde746c077e569b1cba9a4905a148f622450090ce40bff02852d9d528517c1817e5ffa430c8b84b535d7cdd

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md

Filesize
1KB

MD5
e38a6c1cfc4d27686970e550b15dac73

SHA1
bfafab72050b1063f3e196b9239f71d12b5ff3ad

SHA256
906fa0848e7d6301e340dcacb6b882679f7dccb16d87dec94409d4e7159323d7

SHA512
96b273b89efc80214f623eae59b1c465ace7540d0222b658ea1dcecef0a7efc12f2a6e0d7d2eff0e1d186341de4af2399ba2a969bea16aa87ef98efcbabb0153

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\dom.md

Filesize
3KB

MD5
35254b82f147a444d66b68f8cb229e84

SHA1
1471f41f6b3f93511af0776b7d4bd92a36989bb3

SHA256
f106c6614d16a2ec5f01dcf7a1454152d0c16c347930a2eee9205ac5c94c5f83

SHA512
c302e58e9bb6bccdb6d7821dac97584329086b1b5bed105ec42696ec05cd466f78118c6933d682a157cd4df24f4f67f1851763d6e0ff04533b4661a2892c4114

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md

Filesize
1KB

MD5
87f1a3960aad99153b101e20fd022164

SHA1
58ae7e52c5bcb2b585a25bcc21b8bc70424ee054

SHA256
c6f0bea195ca662e4f2ee6b8f52c764b0edf87cd42d3a8c32a034b5ab8aa7f09

SHA512
50dd0d38293d637fcc1d10b0efee4b893e43a43e1aeacad696ee28809726752730566c7b393b9fa71d9eb0af3fd8f8e527c7c3ce08bef339a1dbfee107c1f431

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md

Filesize
28KB

MD5
cbae8036b0883d3b6729112af69872dd

SHA1
34059759a75639516c720812fb8411d72cb1591f

SHA256
270a4913b75a6d52322310a352cea9640b6270bf6e8d7835fdc92ae857918ad8

SHA512
096a732f25ab29370a54e5be6eff070d06a61920ca1bebd1d40e4858594cf434c7c3ddf3c8f35be513d73403077fe6382cdc25843cdcd78d5021cba55593f7d7

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md

Filesize
2KB

MD5
236e6066a32dcfac3b1cb7cd96b5a946

SHA1
56cb27662339eed5981f6d45730cce7a0fd7936c

SHA256
e2f080aa26199c73257be013704e3fb65cfc5a222c6712a5327daf49e5342668

SHA512
0beb9ea7e5c82986ccf9f9dc994b1b0e5bd5edeace149a5b14126b250bf4ee460b1395a31e00adfc71c847b0433e49c7e5c2f18583a67cee21f2feb0531b21a5

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md

Filesize
1KB

MD5
eeee4b9ccc2dec1ab54f110425c61fa2

SHA1
39fe26d6c40e1e813ff63c7d620995d417b2f5c8

SHA256
03dff40e7b9d5cff5815113d9cf4e61db0a47819b2cf354279dc83846af501cb

SHA512
ad4da652ae791245cc468f2a8cf48e474bda5b4a2afff70a8c151620e5b44c51f894a08edc4ce0a2d3877e7467ee20f9936aba4db6338f905fb0f5f14c34d39b

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\icu.md

Filesize
2KB

MD5
5c8986effcd3bdfbe9cc73ce7970cd03

SHA1
f784da9b6cb6524a2896fe1075069f1428af5df8

SHA256
a5cfdb02179fe9545316646cc1929f001c9a527c457ff3c2a4ab9791bfd56113

SHA512
c181c47300eed4d03e45247e20cca405b1702239c12e41c390a1c029e2b4fe18cf2a4f891a2329d49ba3a0a659917e09a74950edd25cd55cd01d9a2d22dca35a

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md

Filesize
1KB

MD5
e000c0f0e9cc528697346c2b0f021751

SHA1
60c70a2c8a9f74ecf32c2f4b8079d559918d57e0

SHA256
4e81695d7cedb3217f207411737825f75ddbc92a1ba1a434098f8e4f0c437386

SHA512
08ccb4de395b4fe0dc4d9ce389c73ec0a813101d78e671a9aab70521e811860f31b4e2439e64490ed2bc4caba0d72e1433f9d57d1572f35279218a3a213767e4

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\joni.md

Filesize
1KB

MD5
2cae4959dd6cea2c884ebe12ddf80fcf

SHA1
d652e03eb80d975f663f9f18d3b35d4e926fb32c

SHA256
7107938aa41501883428937c5855464eba04e48f0628231da0a3ca648d8b1227

SHA512
3539e56ff1f5c48eb3d09d4a84316b5031c3cb061d03596320a23a5995492839f89adcd6836c888394d4b14bbbdcc1c9b212a396e7b5ea5f6943778cde49a35d

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md

Filesize
1KB

MD5
2d4d9fdb47fbeedaf5f5814ba51e7ba4

SHA1
5d9ada906befa15fa3e3ec5b4cb4feed3a9dc9f6

SHA256
fbbe25740142f58c15cc861447524eadb699ce7ae08438d2c55e4616872462f8

SHA512
c56fbab959bcb652473db26ae5192d046b5345617a85dba39a3fa9a51ae0b267dab6ba8af4e0cbd33f7c2152be411be00ade9e42abae06ae73510ee7696f09d7

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md

Filesize
3KB

MD5
159a936162c07629765c38e5a67bce52

SHA1
e17d0c687c8c8c9432856510dbda534e06853cb2

SHA256
05e1a77b21cc273e34715bd17dd249ae23b5257d9b10e5971e44a06c1daf0ad3

SHA512
2cdc37b897c6b913cd8e45bf916bcbb0d91677796c31e0f60b28e3de4995e75ce31a66e2957538635ff6ff15c6b21d65fe246d79a74d6eaa790ff661908f5878

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md

Filesize
2KB

MD5
096a0e55ff6d4aa624680e365fa05fa9

SHA1
89dcb5bde03953783a6dec7d9528d0dfa7e6bb29

SHA256
031b6f5c9653bdd22b3cd844325038a4269b7e6f757a7cea9349a1a25a4d1b88

SHA512
88afcc4b8a2299d75837de042a2cf839a9f9c2847ef87f429a5bf7f37754bb25aa7b6834ca044483b04752bca813db67ed240e8ea4379d6670e026bb193a8eda

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\libpng.md

Filesize
6KB

MD5
760bfce3e33aa829236ea16810957b11

SHA1
92fd322c4756b08aeaff060b99d077b739b1364c

SHA256
e96c3e09a791996a13e79db189decd1ccecf215519159ec2719c0bbdb68e5633

SHA512
fef98086dac1e026f93ffb789624ea77181ea18ec708fa7b0e63f4b5ed6b6ec698bd7dea128e64de172b9a869f3168ed16b49c5e02a12246fe77da5b5254ec0c

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md

Filesize
5KB

MD5
11c2773ae4f6c922300f3dafa02e3137

SHA1
3f3df23c411bfd39a7eae5a7b420153504faafee

SHA256
eb98f2fac9e4793c07061678c43b77925eababd2f0de5f943285d06391ecbd9f

SHA512
f7dc9b4c7bc02a2d0230b65499e692f1454af0f75d478a03c1bf3e3c2994981cf9dd3af1cf478e02e601f7ebd96621a0c19e30dd31336dc127799f24e38f4959

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md

Filesize
3KB

MD5
7879594139b3d984065fae756465d400

SHA1
dd9e568168254631d37284b7c6bbcbfb340d3202

SHA256
188fcef05daaf4c829b6dc929519c0b267aa652803da026f39a3dd9ff07e6b76

SHA512
a5535e743af08b006c4c396f710e23515d577da1afdebefef54ebbcc8ab0b26e77e14abccfdf743582185fecff8b045dd3c480257133efb9a6844063713157bf

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md

Filesize
2KB

MD5
fad3ed29347b5ec83e89003bc7eec4cc

SHA1
d0abe76aa10f1e8e88f9be47163ce39e84ae2d8a

SHA256
b6b90713cc51784e2981fe60c22c14a527c666008a0343222e992a2a2a52ac50

SHA512
1bf30a7fdf174bc8df356024e2bcb5471642a4d8166e7546eb1d3ee56dd92d0698cdf7590ef6313d6d24fda80e264b5f7343dc4a2d3563408c9b953960f1336f

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md

Filesize
2KB

MD5
933e22bd4da6eee411c2a42b076269fd

SHA1
4ab0cb5790f3646c81589800ffd84b46afccb206

SHA256
7ed7533292f759caa6eda35235cd094df17f97d9d033344bacab74149ae1cea9

SHA512
83fffdbe861094f5713f2012fc1ac034484f956fc9c33e0e78f6ced11f78c31018905f549c760e44bee96b38e24b03f1073f8838530be22d4649a6bb6dbd0b78

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md

Filesize
1KB

MD5
ef3f7007eef7c6f242aea0499dffdbb4

SHA1
58c988d82301408be8ce9fd66f7d163427fe18b4

SHA256
33584bde8e8f648d57ca596902efef58acd10a0f1f360b32e637a2b95342af18

SHA512
bcffa6b83a338e361f44aab24df1d26143a3bf1dd7b985924f4b2b1ddaa3ed6bbb177abd16916984fe8935ab1fb71fa58d05a66de2e8dcaff20ce9df879d6f05

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md

Filesize
1KB

MD5
7d01419d408dc0fc7cfe51e59abff322

SHA1
f64852bfe8ef7b9067e08cffd5714527bb6d9bb2

SHA256
a07c0354b2adb1fbaadd3d603e9679a35870fbbbd4e7298c462be0398b6f9410

SHA512
3ea314dbb7c309c089193ed15bf880067604c3cff7e812b88d31292144de274c5bb83299cf54605d741dfdc67e66a42f0eec8297cfce83f20bcb0ef73acf3edc

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md

Filesize
11KB

MD5
4329f453c269911aefebf33d0f65f7a8

SHA1
34694c445fb967a101b2de74f128b162bb300f7f

SHA256
a281d74c2e8480ba7645ab73556ca6e987655a46efda1bb0074f8de10dd6c9d8

SHA512
1927744ce46a625071de5e7c197578e11955b829530e529ee1db96f4b8737fab0e1f2638e30e1af3838b74a0508e4fdce2bcdd1d0f812b547c3a0b31065a396a

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md

Filesize
1KB

MD5
6ff6ba48f3c9aadea72b2011ce12e350

SHA1
98a4d37da17bc6c6c5f468fcb0ae9c977891b333

SHA256
b7bd896cfd1689d9b1d6f67389412ba35dcd32551f0f38cedb8e8b1377e8067b

SHA512
828a65ab3c4e363fffed6fd1b75c5c5db722039b0008b7b9d5f7de3e6816854d831173aa301b2df24685b2af1da94d5db3a272ed4c88fee0b35a7ce7f8629896

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md

Filesize
2KB

MD5
9c7bbcc040d265271f153c67dfa4e2cd

SHA1
d1c71b086ac9ac32537113b05248605813942d7c

SHA256
905e2a4bb112ef9dcc2a00f43d73d21b4cea9868e8b08957000912b784d4b153

SHA512
b95ea8529c1b55346ca95fda999cd566630083e48d3b325c8907b4118c59eb1004a40eabd3ce108ae3df8a893c96f22799f54938c185ca623c9c2a1f5ae58f8b

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md

Filesize
11KB

MD5
c59d1091cb9c08869022d359bbda1d10

SHA1
5cbe6d8c3844539c415ad1dd21f8cff48c7f0cd1

SHA256
073284ef450471aa5c17da8098ed395017f658b0899f4325b19b17ee19addb85

SHA512
36c3f30b475bc91b5a1f491d728af0a535b3dfcfdecef18dee261449335dc77555cd3b928adc77c896bef5346f9de52e21432729df6e611fb47f25d38385198f

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md

Filesize
11KB

MD5
a1bb091b9785db647554271a8b1a238b

SHA1
a33fbd4ad0dff1ba182758b3f7849b22dd537e15

SHA256
9b3e58ded57b9856dd6b7d3af774487371884742d2b00f887babc6ff1b7e5579

SHA512
c4ac927bef3f65443475ee5ccd9e1e868b60b8cfab449b4fcea49c05056f26b7550b610d7afa1772b71f6a0da23a1676edd18a3417f9570acfed70ee9ebd02a7

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md

Filesize
11KB

MD5
be2a916bf667eb32b3e9a1240738920e

SHA1
028dafd591b961446e397aff23119576734080b6

SHA256
238b610827f7fd1a7988f30259164bb896c9bd369767e6f11a3be603d6953991

SHA512
328032a98e5f2b3920dffc522d3e5807112f91fcc810a0b80311137e288f35a08f7a0c2903e83ee7c8ee02bbf03bddd021067c9b87f0acc7caf1aaee44ba8375

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md

Filesize
1011B

MD5
7912d921ea1c5817609ef33d195fe250

SHA1
9b9f6aff13ce825c60ddde2b3a1a87943dba1690

SHA256
9e2f7471475a90ac2299254768d23b3c5c08b482048680f57f22cde3b475dc26

SHA512
5ec15cdc6ae73540d54b971017690438160db0b5329cc28e72308a5f4a405bc653329c746134e3a4c7a487c6e4d4e8996ad2a744a3756f3c29ade6f4cfa76278

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727658720680492.txt

Filesize
77KB

MD5
60c99b1d7d5394d02d6a4f5049541ebd

SHA1
689ecb23a76cc83e09552716842b853ef7e9c273

SHA256
9aa8360cae588f1d79e91e8c3b39917fb645e36d24ad0fa33e775bc30f3a19d2

SHA512
34642b54e6ffa616c782c9bcb256bbbeaf3f001d80d67a71e00f926ea9c80298dcce682155013b36e486927b3dc32256cbcf7a10edbef14d73b13101dd601283

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727659161166784.txt

Filesize
47KB

MD5
a9194ea0f7fe37bb7de298be783d69d9

SHA1
8bb725bcba0a44ec1c1ad5c976562d3100d4faa7

SHA256
6ef636b11ff902657eba83f23e016d51ae360fef144c8edeafc5432afdb98344

SHA512
8d59fda66d1bcbfe0cb7da7bfae72ecef2bcef8c62f22819597ca47325c41165a1cb80ad933653c121f155606355f5edac7232e23f995e8ce50703fdb616af68

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727665191668352.txt

Filesize
63KB

MD5
b46d5a5edf910ffcd16195e41989bcfa

SHA1
ff63b377e426e8c08d30bfb2bd37cb5ced8f4cbd

SHA256
b06a1286067e0e054f8f5e70b456e9be33595e54985df5f48ff0787b5ab3c1e8

SHA512
af3277115efe63a6aec4cee85960765fa32e8eb32009b8bb9777f79b1059799ce025d9dff9b27d67a4bf69fecb065377ea799bb2556f49643dee075a571d2603

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727667861810871.txt

Filesize
74KB

MD5
635b71873df1976c29122df831570f6a

SHA1
c5e0102f61557357baa645cb78830d2cf6eceaf0

SHA256
dbe27d8466970206097d1defb0f12f2da715c74bacd64116b61d98a374f0fa05

SHA512
a5d0ba41e373842197f427529f4d04aa99ccc661d01b1e458c1e4c196948f4f94fa7b46fafbaadb74b54dcfdacdb3c84aaccc6d2bb64ca9be315a48b9d00aef7

Download Submit
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\File Explorer.lnk

Filesize
407B

MD5
87619ecf40553358f2c74c491afc1925

SHA1
0fe1c09c028e5b4200380d70fdf2cf0e027e2f34

SHA256
b5cdf89be0f5a2b6e95932203b819a3546572b05d57ad78ee1c249c97ffb6493

SHA512
9a92ed8d118a657a907a94d498301bea49e465d26f6970501b5f0228aea5fd908e43d0a54ee97f4d6e7c9a1dc93e134d69f3a363ffe1ce8f7f1d3650eab0c1ee

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg

Filesize
21KB

MD5
5045fb57000d2eba0b6493db4776bdcd

SHA1
f5b82e684f4ef3b8308072726a3d2d78a6d2d57a

SHA256
d24b0b6902aba9a08ebaff2a4d1650372566e38c22e16c7e6680869a0cb2bb29

SHA512
96b687fd46a8ae07cc118c6048a63f3a9690e4d7653ce50ee8a32a575fc712d60f3c9e8c225e3553467f096987a658857cf89a8e44a3afce2c806b396a0a34e8

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\HelpIcon_solid.gif

Filesize
1KB

MD5
1adacf2cdae6b6d9ad82fe1bd73721b4

SHA1
b11ad374423beea4934834cdfb5d4af4ea015fa9

SHA256
c3b2892ade1d41e80163b79f6028a312963f524f1c388d4bf27448ec83034869

SHA512
6b61333571892e7f05102f0cf07f34c53fe7bb16bf4f90cb60009b81809e2efa1d3abfbe0c49987db091b928bd31bc013510a1e69f6bd418d19e812f73fb01d7

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\alert_lrg.gif

Filesize
952B

MD5
f690ff8f1a3fa6157c8b4c5757074fbd

SHA1
a06aedc04dd3ac525561985e223c6d59a12ff1d1

SHA256
b52bda519d461d2cdadec6b9e55467a285cd2d0fc16146934a2e40f283377c27

SHA512
25ba47cfc074827bf3986d0f1e993491363984d62d423e50212844455b5dcbefaceb2ac40ae8579e60cc91e1c92ad62c962e799d4cb5e01cf2ae5c90f31a06cf

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\aspx_file.gif

Filesize
121B

MD5
a530742394e42076d12a656c62e713ff

SHA1
35f804e3da6801c74fd3f89b013cb154688ebed6

SHA256
98f7fbbbf1e522289bf85bd1041b7a000a75a26506148bf1c4ade3dc5cdf4293

SHA512
c5649a1025f517cf023dc5ec6bc63f0dab8448cc5b01fc6fa49a6491c6241c0796d2349353b577f5445eb5254178d2c8f12d6a63265e3be4b5a3df56ef89ef36

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\branding_Full2.gif

Filesize
1KB

MD5
eb1130fbbdde8679c783de428d40459c

SHA1
b5aa5acb5c5ed87452a209a2fcc43b65e9eb7c17

SHA256
ab3bae093e87f682d46bfe57f1fce7644719240a1ad001510576d2c9ffb7ee90

SHA512
065ceed4938857cfaeee5fe889c2cc706c7bc51d773a3e82bfcebc29826d708e5cecb29a0b8868643f213f86bee66c3cb6e1abdc8a62406eb141d04be6ec17fa

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg

Filesize
8KB

MD5
8932eb3d8d98be3d6b7b816f9b4c0451

SHA1
db4c03ef9d1589db0397d90a8ad5f3d2205cf035

SHA256
ee2bdaa1fe5f183bbedd703682d5b07ca62830555bf8b20d8883ddd5483b5f81

SHA512
4fcd1ca131c3e932bedcbcbbfd56a08d7035296ecab392ca27787b885063a5d65f3b95e1b991d425c445f60586b3bd334def157500cd440beb4958cdeeea11a9

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\folder.gif

Filesize
914B

MD5
d02f250b3d163e8667201ac3d22120a4

SHA1
c53d171ccfe80b49214c4d4698fd48f26a40fc77

SHA256
a4277c1b5434bd3543fec53f3a49547f9e08e235b068eb0661e2ab8e1330cec3

SHA512
4d609a7e0acf23671030fecc01da013e6fc69ad48bba19b5f01d7eca2e1a5d8a2856fa308d878308c21270ff67431145c44962bc8efdaaad81a1648f55036a09

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\gradient_onBlue.gif

Filesize
90B

MD5
f0e4931ff203bb8f312c220ea7288e52

SHA1
51e463906e2b9cf85da5d4610aa859f4ac9480a2

SHA256
48cbafb9dffd320a878aa4220383e2d61c27027ea9c4b39dcb6cb94a5379dc0f

SHA512
d086a205007a19ee9eb1c5eae7fdeb41912c97fed59bfdd98812c9af0077d28c75bee571e702f53488d006e245c58558c37cfb9f3413a553b7fa464f1dd710ba

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\gradient_onWhite.gif

Filesize
90B

MD5
03d03e51e67959e9455df43c06bf58ea

SHA1
a360804bffe0dddfcfd692dbe5b2b977207673b2

SHA256
30e7fad37d3498dfc5da9f21cfc57496b2ca43be39a90f9eed2bc6f1ce62b0f0

SHA512
f4c58b2ce4c53401cf7b0936268e589d097931c3adb174aefe4eee553653bf825d599c1db3298af43a0187c1acdd417716a696d50ee762d5f075d2dd1e5457de

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\headerGRADIENT_Tall.gif

Filesize
328B

MD5
93b6a746956237bd0a4cb2c056bd7f12

SHA1
d51602b5c2a10308c58397d58fc934b54dc13535

SHA256
28d9da29ddac12cfa49ebad9d26d7dfe822a947864ad68ebbe3a70ad728f2168

SHA512
1305bd5b8d60b3295f2914854e2455e2161452932fc3d4ffd9e7d85fff592ff92bad0f8aaeee836685090d270a62f5646c45930f361c23d2e750c8d1374a5d94

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\help.jpg

Filesize
1KB

MD5
77bfa2b6d0f3357b523912f66a2d3fda

SHA1
3d1d9dd1815fbf273bf9192181bfac55c39a2a51

SHA256
e491d17e6d41efb534ec224abc42764c4c59917fca6a48cd09fad6c01ec7d5ac

SHA512
83b398bbffb018fd9b3a058ab52b7c49e380801304422b77c2cbe18500614e8b2c7e159505f2c08d6b711f75e6930b18322208852f56d51841719978897118c4

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\image1.gif

Filesize
162B

MD5
d94aa698224d3c806c512be368d747e3

SHA1
abb2ba77fbb3dc23298feeb96d60b0f5c67d4b94

SHA256
bb7ba5f7ba5762a5664ab18c3bb4863d9ff118cb6c6ca4e515056983014e0a32

SHA512
4309c3e8f226e832cf68e9de2c8d324023b92bde385229b54330cf113a95a124a8493b0d7e75e6e314dad6f1f49af3f827695b754b013b67fb0015de522898e9

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\image2.gif

Filesize
586B

MD5
28aa555accaf835adfb8031bb9b9b69c

SHA1
baded71e444e155d76b11954aa859a1c657729fd

SHA256
77916e19fc970aac1f38891440604ea3311752ba17794cce99d082a5d7b3d630

SHA512
b4997e8055ffa2a8234e71d15a142e2a52e482d2bc874b1a4abde172fb86b91da47dabb2ca2ae91ee08e722315fff5c0ff6eaf20b97fb8021f4cd3c43ea4eb58

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\requiredBang.gif

Filesize
124B

MD5
9671317bf2072377df40b0b0113a99ed

SHA1
3eb6295495848a2a5622a70b9b321e4a8d81f39f

SHA256
562c3d3e1e99079a61be54568fa6e2f8e616f0cfeee6863fc90ad21305398713

SHA512
0e58c6b3fc0848f83c1f4df45a205eef7927539163e0a98781d0422192c5af56c8ba35f46a289ce4746f506871c3027530e8f6897e10d2cde68d4612d2bd1813

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg

Filesize
8KB

MD5
fa4cda5e2fe8b69aa1a92d03e9934223

SHA1
72d69c52c24af369bfc2edd6ed11099f28375b3a

SHA256
018881290b2d1fcca6fcf7252612c317af6fc99b8f20a7d46d35fe6df8ef4509

SHA512
1953a29be80527c0d8aecbd1e7891b78dda6c23f6931b806a5ccc73942282b913abd4863547f0e28dd9183d032854ffe14f233d912810f58074bf67cd7539a73

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\yellowCORNER.gif

Filesize
880B

MD5
ef239de90088e1d350b01f820fb6ba17

SHA1
47c157ae8f766b540398b27eb096e0a4767542dd

SHA256
4a17b86b63ec28714d1064990bd7030a091c090af8361a79ba41a83a0e569add

SHA512
f418b4826de2d79401eab395fd987fb5b0ec4b8b8ff52b0f70c168a5256e762fb4f050df6f64f037d55e3f85286aa3ee72595115259e5f03aa98956e0caf6540

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group1\1 - Desktop.lnk

Filesize
1KB

MD5
9f93feddedd0ac9a6688e3f56df12ef7

SHA1
d92c3e810449b8bc0e29787c3a42869bac0161c3

SHA256
8695ac58e020d220014e1be82ff252c5427af702472827278ff67a39aa9457eb

SHA512
b147e74c7f7671506d13fbb9730ed112e5dd7f1b8f2d89ed01ed579046158651adc65c68a06a2fcadabee913ebbd2e2d9a95ee85f4320a24a8b14f7e0d6d93ae

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\1 - Run.lnk

Filesize
1KB

MD5
c406f0fd5e6cdce4174645cf9543283e

SHA1
4842dea0f43264a046f199ff24bb7dcaa2dacf69

SHA256
90de9d650de93d43e09a0ad9497dce4d52efff5403edff145380a62cf977d676

SHA512
cc34127c5f3d239e3e0bf82b3627cd1dff01a840945e5aa0ebcd981c2dd8fabc05523ac482bc4618c3f07bf31270126a3f938b2eee62084f66764542ed6ace4a

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\2 - Search.lnk

Filesize
1KB

MD5
68b2ee4ac55545050063325d980bfab0

SHA1
72cb1eb84346f2002111bb3832f56959f4c407ac

SHA256
e5d288eee35c121e1865a40701811f79635ebeecea263d642a40450bad18d759

SHA512
d01473e3f3d8ab3ba6216c437597f8da7424dca2609395fb6c88dfde008928953a7cf876a6046b2b974e857dd6261e2ca975757e248a7305946d8d9400e033f5

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\3 - Windows Explorer.lnk

Filesize
1KB

MD5
d8879e97121117b950fca061303ab412

SHA1
3dab22b3b737c46b19e52ebf4f5653f2dc4bd465

SHA256
701d3947dc0211971bb08d3d6362c683ad6e02579b7cf6bf536b20c4f256ab52

SHA512
932b8586d2ac4e4acfde0e5df652331744c3a92f3fd71bf5b865e17566565adb13f7fbc4d3a9fdcadc09d4f2e6014781e9ad9e099c0d6b8d06eee7f934f5b7a5

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\4 - Control Panel.lnk

Filesize
1KB

MD5
50c9856572bbd54cb823782ffa8a7f64

SHA1
348837651046efa6f4d4812392ab9c39843d5ccf

SHA256
1161de4ae166ee5048332ecc02c6ac48324494a81f54238627cc2f4c58c03b27

SHA512
0b81f517ed2cca345c5d6949039873fd0178dbc671a9ab00c2c1643a003221f36194315a9cd634ae37acb90031c7d241440685b8e27a71995900791e7a82fdb4

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\5 - Task Manager.lnk

Filesize
1021B

MD5
d09a8608f3780e83eb309724e6aee809

SHA1
7afc1f637514f21246e4f2156758f809b07648b2

SHA256
dd91f99d660ab30ac6c1c35d606e60213b0fe5077f9da8a0113ab96ff29ffba1

SHA512
29e298b6d748d11a85b6c1758192d36fa4841cf6908e058f7c52354c98dd2c6918911c9a66a8ca95bc4b4f0c0c0c8a4d2abbca0aa67a724f7a5830cd435e19fa

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\01 - Command Prompt.lnk

Filesize
1015B

MD5
c2ee7c4c89b2c627f9eb71cb4b4b4465

SHA1
eab4995596e1419fc00ec374e11f192828b721ea

SHA256
7b7dfc76943776b3ae4c5af663985045e6ddd811eb87aa03cfdab9d2631f1743

SHA512
8c5c438193bfb60462f0c82931e0eefa2985c621a2bb66668fa86222eb93ca5fba91c141df53a38d56479c54fd9c3303ecb8bf8bd3ec385c248ac31aa0efaede

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\01a - Windows PowerShell.lnk

Filesize
1KB

MD5
5b60eae7b5a689e392bbce27febc3858

SHA1
f2342c34a03de3fd01ebaa29a5b9955f1e56492a

SHA256
da643777b1cec5fc6ac12d5616e0b147d74e3570acf2a23978af2428a2afed00

SHA512
4790b049fa51802f5bc660eea53a4ad41de2e6752813459735e8de667a780d41d088c8a3fb6f9e52a563f0a4f648595fa2715bdaee8c1a9b5862cf26def26c70

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\02 - Command Prompt.lnk

Filesize
1KB

MD5
5545bd4c46fb9b81ebd608d109f906e3

SHA1
55eb3187e84d47b260154b4405d4ee471e0ed5c9

SHA256
10e8fd714865e45d64f3d5ef546b0850c87aa74c028ef90d5b20e138c70c9574

SHA512
799d4964a1595f12001b5d342d7dcfe1935f8166066b932435859d754e95af5bdbb92413fd433820c974e3517698fe8c34e9058b2c630549815261f443af19b5

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\02a - Windows PowerShell.lnk

Filesize
1KB

MD5
cdc6204c9d3a83df00539c6ebd343d45

SHA1
cc18ad613664b84f20eb733ff5c7b8c4cd8937e1

SHA256
27d3970463cb66c847b74affb78eee5a9b5d9607793ad65b681dd106cee3c140

SHA512
b4f8669d038ee7f2376d9e084b3eb0d82a1fdcb4c619b8b229d76ff15452425e4a4460f8ba8e5850766b656824cd0fcc854d7f643a0d8cf95537ef2545a29b07

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\03 - Computer Management.lnk

Filesize
1015B

MD5
d992c137239647d17a7d1ea16c3b5f6a

SHA1
8b418bd8906fc238df27dd72cf5c213a71b764d2

SHA256
dacb8c18d7b4b48678b0c8b97becbaeaf28f5b718681288cffefa2ac9ee07cb1

SHA512
d485b3551bffba4c9c12dff89bc265bb44f8d2afe87a348a669b8f7a33c94fa0242b352f2275fb1ed82cac275c0c948edd202ae9c64744d8845ceec73111ace0

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\04 - Disk Management.lnk

Filesize
1015B

MD5
d8306822d97e293666caff0bc1353a4b

SHA1
031a49bc0dd8f1a6a47ebe7a32477b93c328b6c2

SHA256
4feddd3b7c3142254d3d41cf4d5c1849a2d5b83971904f7565cd939d93d29148

SHA512
39b36eb570e7544c44256f9a6926974a5839ef89097b68ab6611ebd75c0af61c255766be1b105d0e7f3f86e3d57b0baa229e9180472ad2f46b4368cefa8f788b

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\04-1 - NetworkStatus.lnk

Filesize
1KB

MD5
e3a39e1a44803abfff21fd0ade6b7d46

SHA1
2f8084a48e5b34e3249c20c519b13d2f4cbebc7d

SHA256
fe91f98adbc9516e90a745a5af3ab0ca836aa5e15a1329f05801eab35233b492

SHA512
1aa6fe23b6942e0f72d7fe1b7a17473b39497105d2390dae7d6968c6d6f5d01b445562c603542921147c8e2b88a77ecee8dbf9c6539de0ea2f94ccbf7bbcf108

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\05 - Device Manager.lnk

Filesize
1KB

MD5
16daca036e6ffd638058c3dd084a2334

SHA1
693405e2297731c42fadbb93d657fe63e106331a

SHA256
1ba0337a138102d51da638b86ce6e9b53141e4722f674c710ac26189825aa6f8

SHA512
61172aed44735dbc0a4d0f5165c5be32ddbb5d4d5ffba4a2d0a21cc27147786ec272b7cdfe9f709cd6f0092f6fd28feb804b1176fce46af840f9d0ae875b6b25

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\06 - SystemAbout.lnk

Filesize
1KB

MD5
f8b6647e83ae480cb9bc028a71ff2fc3

SHA1
5c20138ea6eef77f81d940deda0f361a020adce2

SHA256
0bc65071b84b2e657c5f54e73128d24da62d11f8eda146caedcd6d4befd48fcd

SHA512
b0c6728263cbc1ed472929ac1effa9b592235a82a40e7277882a6ad4e9767c011ca4441a1fd5ea0464c227c76b6be70f2c922c1bccdf201044cb5e1fa4b0a6c7

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\07 - Event Viewer.lnk

Filesize
1015B

MD5
3759b1e60c1cfa682ce150c104303914

SHA1
763f595dd3b37b0245d38c2255f3ff063dfda7d9

SHA256
362ae5df63ca0e9dfeb84df1b7ae7f06fab555686b15fc4a22785fc49fa87360

SHA512
465db531b54039328df9d76326c2224992dc369fd7603341719fb367ecfe0ce51e47510261f8f6be4c298c8ab815ce9f3e978688514564f38e925d095eb65315

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\08 - PowerAndSleep.lnk

Filesize
1KB

MD5
be4fcd9d909cbf101025286b4b5f37de

SHA1
7fd3d622e25946cb7ea8f0b26384f168acf5199a

SHA256
6b5e9f3992e204662ca34654aabf817342d90546cce7583fb1b8aad38857936f

SHA512
ab277f06eddb90ac6e654ba056170a8528dc32e41ce5f01e881f01b48816516d9efe0aa318f410e7bd157d563d74571b6a9d60abc5294c26b742722ac1844213

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\09 - Mobility Center.lnk

Filesize
1015B

MD5
764b71f8f2773e172da6c2ddc7ba6122

SHA1
5641fde13c0b87659f208b89351ce46a0fcc1d3a

SHA256
f6dfd43e6a909ab9f74b961cf7059366ef3e014fc2538a654e4c0574a9d9c1d2

SHA512
b20933e1d0053b9430c0b652391fcdac98c0b3848074450e9eee25e97d1a5ade43c506697b0e85f851cc036174e620e5749941a1ca2b9aec3e01a33b39d0a444

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\10 - AppsAndFeatures.lnk

Filesize
1KB

MD5
0376b2d2b4b59dd5a3a46ef43918ad16

SHA1
a36401b16751c4f8b93b74f8eb2e10cc148bc4eb

SHA256
02a2a9746cbe0ccda6af55a2571d4f8bd86d33e768492b33a108a70451f42be6

SHA512
b5e8d4639af5919c4bdc6498c553d64fb91c91e7e2c6400bd3f8ec0d98e14121aa3cf7cd567594b64430a15f6fc4e361f8d2889576ed26fd3a077270b44327d7

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk

Filesize
352B

MD5
44fc159631baa8839930e611ad27a0cb

SHA1
c89dec066719c22f9aa766fc7622a07019ed6ede

SHA256
0cafc3a740d1648d09f9ed996ccdec5001b256cdf6018067ecc0cf3dad09a057

SHA512
9e63c64177f5dc1c56a0fb8e6ba20d51c9b0eb3806ee3e897567598f3a6278530b246e2ea28e268ac21234592f6b0a46de3ecf9e796049db1e9b5cff4329f03a

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk

Filesize
334B

MD5
8ff88e7fb76748e1b0e0289c2afeafbe

SHA1
ff74dce2ec2ca13292ce407a78e78bcf66c51bb4

SHA256
c725d77c9189227293509638130fa3df37c258f2798896adee8a970ac7be0a8f

SHA512
b610f98e5e5793486058b8db0b6e7381d9f481841daf2e5377cbbc273ca309d3bd0336fa42d92ad6b414b2eabe502adbda7ea376991caabc70cf77c8c8602e2e

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Magnify.lnk

Filesize
1KB

MD5
8dee0a72a6bde81f81901ff6998d9d90

SHA1
f98ac65885f2b74f668cf6043450fba3b69e39f4

SHA256
58a574ecd05d84bc299c3af248952cd50e181a5fce3837ca330e7961b23ded8b

SHA512
51b5632d5629600a22fce5c6a8efb196421c7235edfcc7bef228293cd480f45b7bfeb42eff16a504d625b80f534e23c83154f53769bcdb899be06c7f1a8daa90

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Narrator.lnk

Filesize
1KB

MD5
df7765cd4ee2d46ed428b396751204b2

SHA1
fbb349ecb1fb19a283c5b8dfa2a09286d1989e19

SHA256
5c432b8faed0619764a275e553ce466c8f4a95c424625d95a99afe7b1058987a

SHA512
cef9da9361bb67e1f42955cc85f25a110710ad2cff4f46354228dbcbb5c16235033988de6ce5fbb497771a9f193e3f76713019e426de447d469b96fc0a412a92

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\On-Screen Keyboard.lnk

Filesize
1KB

MD5
7df89030362d4ee5a5883612efc67112

SHA1
3710a8f6680c2a28d8c42ef41f6a644d3dcf4b1d

SHA256
f2094d9601c8bda5572d3a423af3e6009b2543e300b7a90f69609f2855b27281

SHA512
af81759738e44f5bc7a2ce2109a0498077a1836fe97f15dbc71efaa5a2c65ed62935bf8c2b24c782dae31b149562c42f1a8e9e1f142967bfb47d21aa29e55601

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Administrative Tools.lnk

Filesize
1KB

MD5
57d17c4703dc1084cbefefd5bc19cc34

SHA1
71dc1a92cc274901a1b537410dd915f15e7fd977

SHA256
4c13b4a7a57f94e77b0402bc4779378d99e788efebae038e181c267b73b50486

SHA512
048eb249e89a2fe707f31e5a2b9a78e8f6409142fdeb04e17ce659dd05ff885caf3bafbf5682850f1ef99afede3c8b7761d26b87e7a48f1852056e473ad8eb57

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Command Prompt.lnk

Filesize
1KB

MD5
9aa853132a878b4edc3e4945b375f8c2

SHA1
e46d309b8a4c9199d966c02e613b4c894ac3e9c0

SHA256
94439feca529cbec1d9cf080e67304f1989eb4e3f820328f3fdb4bf190bb64d9

SHA512
9fc9d59d6e9f7d0d2a3be50335749e6d1d9f6d7bd79921fc063faa0d682f8a91953c0ff21002daba96703096aa7d533990fe23aa91ace2a3f1fe7ea9eb2ca784

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Control Panel.lnk

Filesize
405B

MD5
19d94794c224f11e37c5f8e21e08dfdd

SHA1
64a98fc7797ed1f065ce87ab08e258afedf40f9b

SHA256
ad02d1c5a9ca1b5329d649f82537286799df9781d436dae4a6359281fb46e613

SHA512
0f33d91f8ac26960299cac900bd87db127545252bda520bae57318643eed3ddc0fa756114bb305eb5a320a828e91791a15ed4d9b4a7ce1d76001186218707d08

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Run.lnk

Filesize
409B

MD5
dc6a8cd11e5ddb444f20a31597b03bb8

SHA1
3f62ba759c2e1907b1b9ac3f08e2c2a5b10e09d5

SHA256
999f28a913458a0fbe8e9fd203d131bc8fc0b820280cb668e5f5e322138b1796

SHA512
b9f20ad14d51aa4fa55437fb426d4a13209e67ed9ec0dec09f99d82c0f738b29511d689554a9302428f0d702429a075665913553e27d963228e786435d3ffcf2

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\computer.lnk

Filesize
335B

MD5
ccfbf27e4469fddee25733ddef775374

SHA1
e3cdf1943f59a12a177acf8ac0e9d46e6e4b1109

SHA256
828003af8cb5d775ecd05374b025f8c20f34bb66c751dee8f670e56750f17cb5

SHA512
e9bcd93ade724373930993f97723e79162445525f5c38e27370bb4ed76a1612736b975aeba156fc82dab2b702cad596cccf74bd3b77b7edbdaf44c552bbc867f

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell (x86).lnk

Filesize
2KB

MD5
43018aa4a6758e3dfa491a42beb3b368

SHA1
32f0b3d4913ad30d1c9ba5835f803e7e8c60e751

SHA256
c5f177ced6ca139e93cd21482bb151874c26f9a0507b4595aa2b6f4c90d9ffab

SHA512
2400c7a72602afe99f9e7b5669a3e65f2cd3088f50482dca6e463f6181abf365aa363aab2904c09b0d3cbe6836c29443a8ff8dce121ffb857ee07ed1e6766ddd

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk

Filesize
2KB

MD5
ddbf5668ffd14a4ff0e3f6cc407debf9

SHA1
521b3aa78e6abfc1ffe7699b20c95fad826735db

SHA256
5c5c5fc6823d93d17600198ea519d49063f36f73af3b865d1e80118248f04331

SHA512
c4609d99bc75f48fd020217c7f929e3202a2ea6fec670064a65b112e91b2f44f55707f53481a651bf6ea26364a03011bd397107733ed3284a972327db4170f5f

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png

Filesize
296B

MD5
522314484c5cca93f9c8f14c6c81bc29

SHA1
2c301632de9ff0dfa3deb1df223331383ebe9dba

SHA256
39b931ad6a4077a9e7bfa374dc959711627362652777d75abfecfb04e3d3aa22

SHA512
245c0abffaf24ac9b56b622cd0587c6049073700e5192cbdfd885a18adfffeea21c6e55454abdb49e81c1e9f1a43afbecaca43a9dc034afa1105f941f4cc44b9

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_contrast-white.png

Filesize
276B

MD5
5f82ecb768ea52ff8fd49977fa7ef048

SHA1
e7f7a994996fb6211e8bc9fb88513191f8cd5679

SHA256
69c729350bab6849c4e13dd8f3f7d12ab06ef17a6873f92b87510edac6fdc77a

SHA512
a286dfc7b9db956e0b038a2e7a3c3e3d6fddc67fb4bf785ee9f5fa0783e64d1bfbcb1922bbd05c33a3cea8e0f76b0dd43d66fff966e7371ad463a2d503037cec

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png

Filesize
296B

MD5
f406276ad837da11112a97fd4d8f4ae9

SHA1
fa46fc7b64a3b76670c833dd4712b051b0cf2b5f

SHA256
978c4fc44c563f1a031fc85acb334f889cdd1974886ef33b6dd08f953636673e

SHA512
eb96284407791c0833aa54cacef19ce3c2e6a8df8b5ad66f0930c9137782aded5b9c369594bb71f441dde0bd806e249d9f4c5e782d68e90d735c86b00622fa38

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square44x44Logo.targetsize-44_contrast-white.png

Filesize
276B

MD5
6ec126626f34fd9843dda85ef42b95e8

SHA1
96529222b3574497ed6ae4a86f7f491f42fe9c48

SHA256
5db4dcd9e028b814310d703a642a120bddaf00db723954ba68e5e0fc162222be

SHA512
546e034df0098c9e81f8e2bc2a39f7c5c3cc7a3a53377cf0825046d559111ef1d49060b67a02db6310787bcc1c853819d544c6a1e5b62a3fc2cb37b21047fe1f

Download Submit
C:\Windows\WinSxS\wow64_microsoft-windows-onedrive-setup_31bf3856ad364e35_10.0.19041.1_none_e585f901f9ce93e6\OneDrive.lnk

Filesize
1KB

MD5
923efcd32f536ecb43b14e4fba8be3c8

SHA1
cdae707c777d178754b91358d2e1dbf6f85051b2

SHA256
6e89dc0351897740bf26fad1bd818e791efa4fe1d0badaee3250090ce1f7575f

SHA512
63ff0643d14adcf66f1b5a52596a18c3958f78dff0f5cbd5dda0fe75a904c8e04a6f3b6c09489b058e1ce225b57dc6b9293caeaf39e6d7480c0b28b578e413bc

Download Submit
memory/3012-6047-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/3012-10607-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/3012-10906-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/3012-6042-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/3012-0-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/3012-11221-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/3012-11226-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/3012-11227-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download