e566579c89af9f90d139c687c881559b7ab5eb23279944d72c7be108cb2e7290

Resubmissions

29-10-2024 05:57

241029-gnx2tswfje 10

28-10-2024 06:37

241028-hdjxwszqbp 10

Analysis

max time kernel
135s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
28-10-2024 06:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
Size

12KB
MD5

78333fb57f5787544e1086ec1afa7e2a
SHA1

ed97ce47e2d513ea809d910603885130a0020ab2
SHA256

e566579c89af9f90d139c687c881559b7ab5eb23279944d72c7be108cb2e7290
SHA512

d40797abcd95a14fca363447ad0d6eeb09259e7f39e8f8a5330e0c429d85ba7e73d22a783356684431fc6cc7b9d54c9f288d951ac6a45f49e50fbca4d6a195cc
SSDEEP

192:u/TrG62a6B10k3g4fXk1iTV3HGc7EkpAqEjvu2q9C/YpXnAITZfPtRM/EYev4:uebFNw4Pk1itKkpAjjI2Ypdm/8v

Score

9^/10

discovery persistence ransomware spyware stealer

Malware Config

Signatures

Renames multiple (2506) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Drivers directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers\gmreadme.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\NQT4Y7r7VZ3jI59.exe"	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\migration\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_RegistryResource\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_smartcardfilter.inf_amd64_3573afe136371e51\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netbc64.inf_amd64_b96cdf411c43c00c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\nete1g3e.inf_amd64_af58b4e19562a3f9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmlasat.inf_amd64_36a71a022d8bb0bb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\usbprint.inf_amd64_86cdf3e1f512cca1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wvmic_heartbeat.inf_amd64_ad33c2d1c7a3023e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\RMActivate_ssp.exe	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\setx.exe	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_mcx.inf_amd64_fcbcc3807cbf63ec\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\intelpmax.inf_amd64_2ddee95f7a5d85db\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmgsm.inf_amd64_d7b1959484ec8228\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WaitForSome\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Speech\SpeechUX\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\CimCmdlets\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\iSCSI\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\urschipidea.inf_amd64_78ad1c14e33df968\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\fsutil.exe	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\net1.exe	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Speech\SpeechUX\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_UserResource\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmgl001.inf_amd64_e09ac82d497a19c5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netrndis.inf_amd64_be4ba6237d385e2e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\scrawpdo.inf_amd64_466615aad3be8e26\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\setup\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\ConfigCI\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\MsDtc\es\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Schemas\PSMaml\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\CheckNetIsolation.exe	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmpenr.inf_amd64_20c8782372e47bd2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netvwifimp.inf_amd64_ec11d0ad3c5b262a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Storage\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\bcmdhd64.inf_amd64_e0bae6831f60ea5f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmdgitn.inf_amd64_6360d736a6f64e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\msdv.inf_amd64_5c153f7ff7d0d00a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\migration\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\oobe\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Speech\SpeechUX\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\cht4vx64.inf_amd64_b03448ba0b72ec47\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmnis3t.inf_amd64_9f214efed426c12a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmzyxel.inf_amd64_1edcf626fd489056\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\WindowsUpdate\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\autochk.exe	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmboca.inf_amd64_c4ed3602d3c754f2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\wbem\WMIC.exe	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\en-GB\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\es\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.ODataUtils\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmmc288.inf_amd64_3e3f05a8a446e75f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\usbncm.inf_amd64_9957a38c3d2283ed\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\EhStorAuthn.exe	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\umpass.inf_amd64_3daa9a904daf9501\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\fontdrvhost.exe	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\fltMC.exe	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\pt-BR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\Robocopy.exe	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCClassResources\WindowsPackageCab\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ProcessResource\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_fssystemrecovery.inf_amd64_aa57df1ffa9aace0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmnis1u.inf_amd64_64035dd8a7571ba7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netpgm.inf_amd64_e099e4a7092b374c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\423x173\32.jpg	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteNewNoteMedTile.scale-200.png	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\onboarding\landing_page_search_for_friends_v1.png	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-256_altform-unplated_contrast-white.png	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\LTR\contrast-white\MedTile.scale-200.png	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-60_contrast-black.png	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sv.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_mixer\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\LTR\contrast-white\MedTile.scale-125.png	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-256_contrast-black.png	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-20_altform-unplated_contrast-black.png	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Collections\contrast-black\SmallTile.scale-200_contrast-black.png	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteSectionLargeTile.scale-200.png	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_2020.1906.55.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\EmptyView.scale-150.png	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\relaxngdatatype.md	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSectionLargeTile.scale-400.png	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.contrast-black_targetsize-64.png	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\EmptyShare-Dark.scale-100.png	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\OutlookMailWideTile.scale-150.png	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\email\dummy\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\images\file_icons.png	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-black_scale-140.png	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-black_targetsize-72.png	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\CardUIBkg.scale-150.HCWhite.png	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\ExchangeMediumTile.scale-150.png	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-GoogleCloudCacheMini.scale-150.png	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsAppList.targetsize-60.png	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-white\SmallTile.scale-200_contrast-white.png	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Transit\contrast-white\MedTile.scale-100.png	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\dark\cstm_brand_preview.png	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\fr-ma\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Program Files (x86)\Internet Explorer\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageStoreLogo.scale-100_contrast-black.png	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\ThirdPartyNotices\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarAppList.targetsize-80.png	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\TCUI-App.exe	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\AppIcon.targetsize-24_altform-lightunplated.png	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\de-de\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\pt-br\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\Weather_SplashScreen.scale-200.png	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-24_contrast-white.png	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.contrast-black_scale-200.png	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-Generic-Dark.scale-400.png	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\zh-cn\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.scale-200_contrast-white.png	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\da-dk\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Collections\contrast-black\MedTile.scale-125_contrast-black.png	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSectionGroupWideTile.scale-150.png	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\CalculatorLargeTile.contrast-black_scale-100.png	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\Scientific.targetsize-20_contrast-white.png	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\upsell.png	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\themes\dark\example_icons2x.png	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-black_scale-140.png	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2018.826.98.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraSplashScreen.contrast-black_scale-200.png	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\az-Latn-AZ\View3d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\images\Wide310x150Logo.scale-200.png	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\core\view\default-contentview-template.html	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-explorer.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_5e66678405f85976\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-i..ntrolpanel.appxmain_31bf3856ad364e35_10.0.19041.1202_none_8f7e37524c3e1a13\splashscreen.scale-125.png	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\msil_system.web.mobile.resources_b03f5f7f11d50a3a_10.0.19041.1_ja-jp_6498f926dc75d910\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_hiddigi.inf.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_8f6095b868c94ef7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-a..srecorder.resources_31bf3856ad364e35_10.0.19041.1_es-es_8391384229119eaf\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-p..ntmanager.resources_31bf3856ad364e35_10.0.19041.1_it-it_5d192fe9f208e5ab\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess_31bf3856ad364e35_10.0.19041.207_none_e2f2dfeea7fa44fc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-devicecenter.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_48fb65f79179b2e0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_es-es_12451df02dbd2879\401.htm	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-pnidui_31bf3856ad364e35_10.0.19041.1023_none_b401799922d9c905\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-xbox-authmanager-component_31bf3856ad364e35_10.0.19041.84_none_4149bab988d0c5f7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_winusb.inf.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_57ed3fe107f08d7f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-c..rs-serverdefinition_31bf3856ad364e35_10.0.19041.1_none_c8f405ac645f3d8e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-wifinetworkmanager_31bf3856ad364e35_10.0.19041.84_none_6461f879a9c4a23e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-xbox-auth..component.resources_31bf3856ad364e35_10.0.19041.1_en-us_de9530419edc661d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-u..dem-voice.resources_31bf3856ad364e35_10.0.19041.1_en-us_ae3e597b886e49b0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-a..cationmodel-daxexec_31bf3856ad364e35_10.0.19041.1288_none_2a33f99ad5e8bc2b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-thumbnailcache_31bf3856ad364e35_10.0.19041.1151_none_b3ea9b6cce50c7a0\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\x86_microsoft-windows-ieinstal_31bf3856ad364e35_11.0.19041.1_none_765fc5f6e37c509d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Windows\Logs\CBS\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\msil_microsoft.iis.power...commands.resources_31bf3856ad364e35_10.0.19041.1_es-es_6df6ce5982daa149\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.19041.173_none_6486f23c2831aaf3\InputApp\InputApp\Assets\StoreLogo.scale-125.png	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-t..tservices.resources_31bf3856ad364e35_10.0.19041.1_es-es_d17307771c224e8e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\it-IT\assets\ApplicationGuard\LearnMore.html	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_d1f435fdf91e63d5\http_403.htm	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..spanish-autocorrect_31bf3856ad364e35_10.0.19041.1_none_fa859bde26563edb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\wow64_microsoft-windows-d..x-directxdiagnostic_31bf3856ad364e35_10.0.19041.1_none_e409500831824146\dxdiag.exe	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\ja\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-bits-adm.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_21c1d4d9a4333033\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_en-us_a323edc73bd86475\forbidframingedge.htm	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-r..iagnostic.resources_31bf3856ad364e35_10.0.19041.1_it-it_70de048887a603ed\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-gameexplorer_31bf3856ad364e35_10.0.19041.746_none_1ff999db200c4640\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-ui-shellcommoninetcore_31bf3856ad364e35_10.0.19041.292_none_994eb7d332ed2c04\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-xbox-gamecallableui.appxmain_31bf3856ad364e35_10.0.19041.746_none_0119299746221375\Logo.scale-100.png	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-printing-spooler-core_31bf3856ad364e35_10.0.19041.1_none_8c3cb0a560e64b91\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-shell-family-client_31bf3856ad364e35_10.0.19041.264_none_78e8dcb8b16ea17b\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-p..ellextensionhandler_31bf3856ad364e35_10.0.19041.746_none_04e0c3143681ee85\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File opened for modification	C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\Assets\WideLogo310x150.scale-100.png	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_hyperv-sbresources.resources_31bf3856ad364e35_10.0.19041.1_de-de_fcaacc14c47709a9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-m..ameserver.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_c33e7651fc794168\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-n..xcorecomp.resources_31bf3856ad364e35_10.0.19041.1_es-es_b93f20b731d4e79c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-a..r-service.resources_31bf3856ad364e35_10.0.19041.1_de-de_21882d7392957643\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-m..agnostics.resources_31bf3856ad364e35_10.0.19041.1_tr-tr_7131f73f8712cdaf\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_dual_3ware.inf_31bf3856ad364e35_10.0.19041.1_none_4bfbcb89d64dbe65\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-n..quickstart.appxmain_31bf3856ad364e35_10.0.19041.1_none_4a388618f6365227\NarratorUWPSquare44x44Logo.targetsize-64_altform-unplated_contrast-black.png	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_rdvgwddmdx11.inf.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_67a003a02a7f18e9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-d..layswitch.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_5fc7a8483d51cacd\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\msil_microsoft.web.manag..davclient.resources_31bf3856ad364e35_10.0.19041.1_it-it_939544f6f45cc082\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-rastls_31bf3856ad364e35_10.0.19041.1081_none_eb97bc1a39a37318\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-w..owsupdateclient-aux_31bf3856ad364e35_10.0.19041.1_none_55394f0a91181aaa\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Windows\assembly\GAC_MSIL\cscompmgd\8.0.0.0__b03f5f7f11d50a3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.19041.1_none_6da8f779b049952c\computer.lnk	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_dual_mdmaus.inf_31bf3856ad364e35_10.0.19041.1_none_6d8eb2ffdf413eac\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-t..mpattools.resources_31bf3856ad364e35_10.0.19041.1_es-es_031b98a13332aecc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-t..nalservices-runtime_31bf3856ad364e35_10.0.19041.546_none_bad936652ad03072\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_wvmic_heartbeat.inf.resources_31bf3856ad364e35_10.0.19041.1_it-it_cef8a0837f060a06\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-cameracaptureui_31bf3856ad364e35_10.0.19041.746_none_4bb997f4e1eec8ac\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-i..p-support.resources_31bf3856ad364e35_11.0.19041.1_en-us_88f3b3af5bf180c7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-msf-providers_31bf3856ad364e35_10.0.19041.1_none_56318e5c7ea2ae30\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-os-kernel_31bf3856ad364e35_10.0.19041.264_none_4a12028313046a9e\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File opened for modification	C:\Windows\SystemApps\microsoft.windows.narratorquickstart_8wekyb3d8bbwe\assets\NarratorUWPSquare44x44Logo.targetsize-40.png	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_amdgpio2.inf.resources_31bf3856ad364e35_10.0.19041.1_de-de_5e26512b8e6d8fa8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-c..vider-dll.resources_31bf3856ad364e35_10.0.19041.1_en-us_60dbe57cd682c53a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\UIAKDSQQPLXISEE\ = "CRYPTED!"	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\UIAKDSQQPLXISEE\shell	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd\ = "UIAKDSQQPLXISEE"	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\UIAKDSQQPLXISEE	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\UIAKDSQQPLXISEE\DefaultIcon	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\UIAKDSQQPLXISEE\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\NQT4Y7r7VZ3jI59.exe,0"	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\UIAKDSQQPLXISEE\shell\open\command	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\UIAKDSQQPLXISEE\shell\open	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\UIAKDSQQPLXISEE\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\NQT4Y7r7VZ3jI59.exe"	78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe"
1⤵
- Drops file in Drivers directory
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\aic_file_icons.png

Filesize
50KB

MD5
c02171d9d92b2a24161eb50c733ba09a

SHA1
61b6ee93e7de75d27d881b443d4dbc6dc11000d0

SHA256
fba366b1ada8be71ebe9b74bb3529bab0a452fa754bb15a151bf57a245f6d096

SHA512
6d6b264a433ad4da397a7b08ca90bb23dea25d47769e1a30396157324624e8cc8ac01ff89dbc49f681f5a11db20e0a1e33135381b455a3bd18ab874bdd49adc4

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions.png

Filesize
1KB

MD5
4b05c080081fa99cc4b2f69cad73adab

SHA1
a899f39d5514533150400aea4b95342f78cf6b90

SHA256
d37f0bd106317133bac8a627e9d61273ee372d83ac1d5fdcb66a1fe367a9ac7a

SHA512
f2fd4cf0bd9ad084e03b26b86a7ae3009be556fa3995d810bc26277f5ee1c403e9c98fdf08c76097f1ceacfe23223aa05db25451139fe68f8b6997156719654d

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions2x.png

Filesize
3KB

MD5
fda0f3fc5c688bf2445af9d092f491fc

SHA1
010631119980bcabb085c550bc38cb85cb02a6d1

SHA256
a588d3bfe9dea97e0b90ccefd93c457619a2d968faa9bac20cf5f390d1819b31

SHA512
70920a6dd6ec9145dc43ecc01ff0904694c15d26ee172e81892d3b8385631a90202ff3b1b1be9af7fb871df192ccf8de4de8d705a7211e7ba4838ca816f18a98

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons.png

Filesize
683B

MD5
39b817ac8a4f147b34c9de6dc4240c86

SHA1
a42cd69e20a5aca59bba1b6f6ba361c8e44e5d53

SHA256
8f35fb61e1b23ec0e4c420bfe8f2c13ecff966ef1d521044728e2301b889c2f0

SHA512
076864940a8ea05a34771f320bb71d6fafc094db8c9682d15c9a809425e7c3495ea8f8e2b1fa9726146280d33fade80e2a7b78da243aa98e9a5d2664d8b5d0db

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons2x.png

Filesize
1KB

MD5
10289f80be647c3e7aa5289e71928549

SHA1
1fb00ee780d59029ba85055d9e917e718b875585

SHA256
6a977f6c071c6504b0f8f4bc62bb2792cc047139476e7fc501766527abed933b

SHA512
b04134a235e0488fdad8873f9742f092d0625fcee222fa6839ccde9221b07d82ffbe4b57bf0c5e7709c3cb2b2511a32fa298d9b99a09f4dac84f7f30237104a2

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon.png

Filesize
445B

MD5
1900739d533cfdffc7b07935bbc1a6b1

SHA1
e73ede722b0df6e8df14260ad084509816c0f674

SHA256
4226764277db1a806600f78843f42b501df2546a2563b33bbc40bf120c958f33

SHA512
940148a2ab5a7255afe558e5b69eaeb3ebbde7de347044a0d1d5568aa41ddb086d8a583f8025555a70447adc9777888d10bbe721c530ab1165314878547a8d36

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_2x.png

Filesize
611B

MD5
40c7c8363041df08695b130b9d7cd2cb

SHA1
e186f708f37a85d4b6bc79011b4166a91f6789c1

SHA256
0f0de8ac9c2b0b6ae1f0d52ad5eebc3ca3197ac3c96452579abd6847cccfb921

SHA512
9a684e85fd4b58d88fc274bf8dfe1f87b7466b3f7bad6a92acf9fe36a417dbaef8d957e131f78673aedec71d5c279c9bf36e9930f1412b21436492a74b29a711

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover.png

Filesize
388B

MD5
47a079a5d432148908951271ab14af3d

SHA1
f0346b45cbe215fe395ddf96cb5d02964f22ec7f

SHA256
fd7068c8d2ef37c91179efbd80883177983b3f3786b2d7a9fba9a951373e7212

SHA512
14502460f14ef22b94aba9426ddc456e4db5f2c833f9237183d76dc4838cb59456d44546930d81a63775555ff0b43131a26da35a4923d12785f4486ae5963383

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover_2x.png

Filesize
552B

MD5
0d402bb64ab031a9755657a5a4392b8a

SHA1
cf9fbbe8b34c8d5aa5abb0f15de2142dddea6729

SHA256
0466d3e9fb06d4d39e3abf87a92edcf820fc56c015c90537fce6804a4d1f6ad3

SHA512
8c161ba9f400402f92b9174b5cea00ba9b721fb151fc983879f12667e01f093161ce73710fcbb1fb772a24cd3a62b1b461c77011f7d39269e656a2f54ccdf0df

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon.png

Filesize
388B

MD5
38c6522cce6b85e43517a9a819d381c6

SHA1
dc0f0745508159e28d39dc00b048f9d416166e26

SHA256
ca5bf55b246d3f24ef4630b40ca6cdc1b310ef5afea6fa1cfca346289341a121

SHA512
c8b99edb1b7552bad7c87d419229301e894d3ad2deaec375d53ea433d6613d23c63ab8f576d7947155e1393c53a160088dbd802ccef62ea826a61cc00679dc62

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png

Filesize
552B

MD5
b0b14ecf91233a6bfef023c39c75b0a4

SHA1
479d840b42de1170ea75b33c9d4c3da98d43a3cc

SHA256
e23a2390bc801092a645106c860d64ed5d8811fa378d73b356a19b936f935272

SHA512
55962227ab43b663e70071be5dec666e5de686f22f72420bcc74f9d5cd5506ff9d486804ca8f91b6ad67723681250dcb146881b38542ac1d60fc6432183a22e7

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png

Filesize
388B

MD5
f16fd437a8b232c302f286e79c524126

SHA1
179bc5ae068d3154579de6b2767f079efa642b20

SHA256
8aa9c29ed3e011bcf1418cfab73b9354cd26c4646d1f88d30f168587ba651433

SHA512
2f5bee2eae44a70464981946f1dd2fa73bd49f9f7566f26713d5933e19e8751262aebec9772e0d756dcd7ac44edfbc22f8195326fc1eed5e51841deec2004c64

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover_2x.png

Filesize
552B

MD5
54e027f66686bfd1862565b22e711df9

SHA1
cc929f5d23957a922a17faf46b9642872cd2146c

SHA256
6cf24d0caefea82cf3bb51925ccd30fa42fc84282c49f2d74ae4e001169343cc

SHA512
f8995398b8460daa2092997b2365aed437004e17b97bf2bb33ba6acca89bafa281f97e970a107e2407f4faea1611d8b8951982b191e5684b407e7235e5774d7f

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons.png

Filesize
7KB

MD5
b289b7901eb30c42b1724c0862e02e8e

SHA1
d633147fff554bd3abbea0325af4a069208e17ee

SHA256
ad09b6352cb9fb50fe69b4855abb981a0bb162b359480d4c52d115eddc2a6b9c

SHA512
bcd8e855b1bc56c77d80a6c733ac15c2629dfb02eef2c0061e68ef2e35c4b0b9c2392b3b38dd4335232ce73abe4695e28d0164657c58224bd2122395fd8e1084

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_ie8.gif

Filesize
7KB

MD5
b9a269c848df7d6b08bca37aee9a48ac

SHA1
7521b8593b6f55c4331634eb2acc92da9392e718

SHA256
2bc0d44960fa8f8749f8f41e9dcdff94ded8e31761ada4ae0b0ce44955d1205b

SHA512
98de3029486ff4f880e3e81468a3d55056327e06e98c7877e825be06c5dd474bad3343c28efae53c83a8c962b4f982cc0665b50c00c0142194be1994fef1cfbe

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_retina.png

Filesize
15KB

MD5
a1a3eb66b2b708df21ab4e3b48b6c807

SHA1
ad0ef211c5772dafaa1655c8705dba94d744456b

SHA256
d7211e86607a1091e640e90cd962086ffa1a37706a9ba24847fe41d623498633

SHA512
8cb5725bd1522f74892a7f35eecb86a4523af6858dd1f9819a0fa326856f03fb8e5b4cf93126fb3cef8a4917ecdd7a2ad013ca6242dce9d8ec9c5b3097bc5493

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons.png

Filesize
8KB

MD5
164c0aba6f1330b08d82e53870631179

SHA1
88759088cf954a368a86914db93ab5c8b497b6cd

SHA256
8975e4032d3ca386c694767eab79be98f349141851224dd07dd2d8830bb36e3c

SHA512
1a693976ef2b54912ec980d595a7e20d9be4bb5f70dd8e1d7c0151f73e96c1d7978062734837d9eb5b89c4bf59659218eaffe086a68acff3801593a6b512c0f3

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons_retina.png

Filesize
17KB

MD5
d9ba950beedaf9238ba63954ebe80083

SHA1
9b35edc51591faf92fb6e984ef158eaefae6a591

SHA256
04b05e321c15ec550fe1b4384dc3f9ff8ca26b1a39b9d43458636ed75a4c45de

SHA512
797c04262d7b7d6c766631adba6cb4eed83fada452a7036b60603e58139b5eab32d6a3d7e6a1d402e708b0692fdc59a573a6f1d75a3a2fd675629a62e0e98256

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_pattern_RHP.png

Filesize
179B

MD5
e033e49cf232a32f86124880e8b73102

SHA1
89c3f638437279114549e57a61f1ce8bad1faeff

SHA256
4e8a0b1b40e06b84daf9fb1ca4398d5ba24bbf328b35963ec522de30b4935d2c

SHA512
7e47d30ee2b4242c3c78651e4c0a174199028eae2a9bf2dbe2d8e4c6aba443ee1ecb8f3527a3258944b25b1275621286cb8a60dc2f7aa7691f50c89be4733c59

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_patterns_header.png

Filesize
703B

MD5
5223b87837d919b456ce277d747efedb

SHA1
b676321e83ed2d0355e141a0c1935470d6dba121

SHA256
99ffba1b12f971b6e4f9486799f2735e772958225db95f53a962bda4e448c022

SHA512
cb7305691a29b1a6c1329cdc55677de3390dad660bcf48d9871a8ee708e34fe81c1cbd5c5cab8ea7ed46d38b77816660c97e97627ef1bbc22b5d21e9592fbdd5

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations.png

Filesize
8KB

MD5
0501dad09470c513c9528177b05eb1ca

SHA1
313659152cc081a666effd92702c5b077eaec2ab

SHA256
955cc882501d53a3036dfa4c62a80db157cd5aa83f9c3880cdf32e2fdc9c4ab4

SHA512
123c1370ae0631c74ffc97ba32e8c088ae49133b7cd6cc53707744b82a3b7d0543fe3e6d4db1f2a8fd29007d136f62a0b295b199ac95ca54ae19d9bee9ad10c0

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations_retina.png

Filesize
19KB

MD5
c21c2dfc6648bb157fbbb7c4ae47d10c

SHA1
9ec66631b0d549f47a2752d79fbc797ba9475838

SHA256
5c6393252284d311e9ad4f5c6185f8fc3e3733480b49b30b1fd994462915d64e

SHA512
ef47ca7806bb54502e7ccee9aef541ac855aefb0c58630e683b49844296a6e1528b1ff79a05d3df1b0c67a4d4ccfea4b1d0cf801b21974bf1342a66fba5abd9e

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\faf_icons.png

Filesize
6KB

MD5
8e91033bd471adfbcab0d382a5d6d493

SHA1
70a2c8b43517568163703ed291d8f0358e459816

SHA256
7b08eeb4549f373eef278f6585fca92ac20658d0153b8517244805186d117e91

SHA512
99d59289335dafe3eccb5e980d3fa4a0647f84bba388092608d7fa3ec99245d278886e6cd6027a1ca84e5b8c7c97769a7af5d85bf8258d836a5b29f6a131e466

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\bun.png

Filesize
2KB

MD5
c8d24bb3074335ee9d7afaf8c2120288

SHA1
6475d6938fbf71f771c908026a5a12b583ec3f9d

SHA256
74ec4146704c6f5bdbbf9aff94efea6ead9d3ebec8d1ec971b6bc7b3772a890a

SHA512
0a9103074228a1615424217385a52610cbd035eff851d090bee2a4e43f9d3ef64728f7bd66e71f30b8d4b9272195b27378edb66e6a9f897bd40d5732ae3fb89a

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview.png

Filesize
2KB

MD5
2c00b994f69f50d06fd16547dcf86676

SHA1
1b9850b3a6ec24efd3ae10bad8fc06bac081fad0

SHA256
7ea0fa89be2ac224cf6c1dc64f53a6cbc7c0a82275aee28d2bb2c4928b3e1e61

SHA512
cc8d965cd414af0b05799ecf70904ddf2b84f3ebb98ae0656cfbaf03aa891f824ff3660eb31ff48bb8a9d639fc245f56829a6d4adec0ed97a7aefae9fccddd51

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview2x.png

Filesize
4KB

MD5
89c0c472620c786c69f702c3128d8bd5

SHA1
15b6cd3db8e15e01a9e636f140ec9ea67a4ea0c2

SHA256
5d9cd1d10e766b149eaa85b053f1a5ea0a40ad9e1bea92ff4594048ff80588e0

SHA512
391ab0f5c3a505b7f52583ea77dc0a1b4698410a024ff1dd7b98d1d60caf18e0c4527d0e0373424367ba7cf67e2ed00dcfd995ae59af71f0fe6c53a8b177ab67

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small.png

Filesize
289B

MD5
c09b09491acaccda03d5bf91d3905c1b

SHA1
3fb22c9044f77a5da841ac360edc576f573ba297

SHA256
d8f1b413057faa1e73e7231c99d0797f550e6e996a37ad03888895b0fed1b5b9

SHA512
29bb96806f13297f9c924db4ecc7a74dfa7ede91243e25e3a5edeecd06b00e69a36dd65159e1840e570f4710385993b35025c09219a582cd0d1e608c7f38de1c

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small2x.png

Filesize
385B

MD5
f9926cb51a5882b035132b2f8ed87a32

SHA1
b65e9e3e6d67a4373e6423452d33e5f8815b942b

SHA256
1afe6b3aee359e7a21bad6f6093aeb9af3017b545eabd4c01ba7712bfa2c7882

SHA512
8ed90dad4633c4919f9c7b217a255f4f5ca0d30eb42a6c85156cd177c74ce44a20fc6e756ca7dd29f4d19bd75bbce640d89cd5c8831db544663b7065ff138f38

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\illustrations.png

Filesize
4KB

MD5
127dee81bc53044e2ebbb9becdd56093

SHA1
97e00378e76fb0272b2f4108d3041c830dd93be9

SHA256
c84e43a13b4d63855096e998ff30c8ea9c95ebaf380b8e20e1a60da2c8654263

SHA512
bb92dcf6241eacbe24190ad4ddd09c877aa840d3cf59f408a421f56b1328bdcfc31a99c9f3ee0856c4ebd61c5f9a9337d9b96afb3fc17ed2d48b6ed6f8c9a6e8

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\nub.png

Filesize
1003B

MD5
70f6b890e0c3dc8ac80674dff6f3f808

SHA1
5fd166222ed60dd5fbdfe8853612839cfc1fa0e6

SHA256
49b63aa8c8de447b0f5bf16b5680ff1888e792f748d14e2490eea6f8999540fe

SHA512
5138832b6b19d5362cd02c75b9e224a3854892941401a48bafa344bcceff4f6f30236402f382473f30d680182444953f68538c507b2444da47e3e4980fbdb519

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons.png

Filesize
1KB

MD5
31976097d8b4af5df524ac4cd916043f

SHA1
522a120155f998fcc26768bce52545f39be11599

SHA256
50511b79fb34746b2379157e842ea136e53e4fc57e037fa4fc2e6cd326736a67

SHA512
a2dba5fb45c9e7a1f0414e96c868660f20427739a1002d4cec4738d41d6141b820210dc4dcb6369cf602071def4299ede1f0ee7184c09eeff6613ccc7850194b

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons2x.png

Filesize
2KB

MD5
9503bcc0bff53db220743e6afaa7af23

SHA1
99cffbefc263df305456ee9d0f0cdb2bed211d20

SHA256
20c45a00d97c32ebbb0b1aea40efa28d50ac2310dfdd270a6543fe8e753f0d43

SHA512
136c04b9b3ce7b17088cb19565d7257a0841477b189016a6e5513bd5da11fc58532945ef92ab7ee5490204b1b0cc2a478f8058e4b6226a6d11e647792785f256

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adc_logo.png

Filesize
3KB

MD5
d4d37097c6623568db86b878991ecbfd

SHA1
7f90c71a1efff29b3f1bab3c6a3eeb28a923a257

SHA256
eb9fedb7c365ab71181b0332f58d55384f6c7e91057b2b440496c779acc5e106

SHA512
56172db887ad44eb49d4fcda7a91fa77c251516ee8d7fb0d436b8dd525071d2d263a3fc0b287a6cd71f6d9889ec5e0a609595d60bfe361e14fe67da14d818a77

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adobe_spinner.gif

Filesize
556B

MD5
7fbf67133a99b0ad5ecee25e8c96c399

SHA1
d386ab42cf1bff6fb3fda7da248a12394dbf6440

SHA256
4511e8f4c2cd5a78d1a7261740ec45c582ac3a70662fb5d388b4a01f0c27fd26

SHA512
400cc62af68e2d27f190864640847c60646aa869ebf076c24c628dc134ba747cd86ad3622beaf0eda47c2f5855b06228f1e4465d7fe73b80deef7fe9101558ab

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\logo_retina.png

Filesize
6KB

MD5
2fc5847896420f2445cbeec62e29a7d9

SHA1
31ade3e51ed97b58151dac19c383deaff703c9dd

SHA256
6f345ac29c40fff9219b05d057f2cd621800052111d84d36f7c60b3a9556013d

SHA512
e7a6939c69ba3cb2df4776eea9fbf37ec10f3c8f46ca50de15bc63844f160036db8a0e461b172b30aab6e6e44d44fb82d7128a39c27e7d0aafe492875d634648

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo.png

Filesize
826B

MD5
dd552c5bf71eb7536f57bfbadf768ebe

SHA1
057d0f0ec7bad419897e5fa6c4d86ea6b4067978

SHA256
34e54b254c17d6940de8184834f07c6098a0ce6ebafda7936b99119ff1de0ad5

SHA512
a8e8b08a968bbd0c943ace95d20e3010e69cf41e17f5c5a8aab530361a306ea9163989ac3bcb76dd2245dcd117a793de75acb3da0d141648ceae14aaf920851e

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo_2x.png

Filesize
1KB

MD5
4656dfbc57123ca60dd98772d2b42a77

SHA1
5859a3193f7f0d6353725ce0e57bd23a6a4e6e83

SHA256
d13a6277e71cc00e32a677751ea47d8ef1ca7f64b25b75e1bb35b193760c2d7e

SHA512
da31a76706ac42c352ff8bedfffcefd30b542d86b44876b5c51d1f5bbd762d20b716a628b1adeddaa19e8dbc5d808de8bcb2951672413df94521ce81cffe3929

Download Submit
C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB_EURO.txt

Filesize
32KB

MD5
b77e3779945849bb07b1d049eb92594f

SHA1
b8f653f05ae72057118d581e99b1d31dc988b5de

SHA256
57c2e5403e1b964f74a6708bdf77fa45f844aca213651172030688d6aaa0d451

SHA512
6eba61798a3f7e1643f09ed7f075a07e4dbc7d3497e181c8a56e18e56674eaaf32694aa6ae3ba25855240301562e5fc0f80f5a7f79bde290d1732b01c6543157

Download Submit
C:\Program Files\7-Zip\Lang\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt

Filesize
436B

MD5
40ddd4aa2da1380a355d0959da892895

SHA1
a5ca6e445d0983feb6580dec3ca377a1e53bfd6c

SHA256
8ed0cc377c8b7d1cb41d65f5cd7eb254523ef7d78f43b8e592469dd9f759d225

SHA512
4e3185b7127f9e94d3036902ff58baeac074e0923cc4e90e746cdd5c62fff13f0e6c640634389aad12f785d40a210b96fb652030fdd47d216ac6219222481d8d

Download Submit
C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif

Filesize
153B

MD5
880b4511e2af1f6c0e8d80f8bb19569f

SHA1
7838c729fb01916aa12e26a0ff90e3f143eb4e0f

SHA256
a20b9c21d24e6f54b26ce185e6e9690171cabe63d618ceb811a49f952566bb74

SHA512
91be3a77b82cba342abe9d1b88823d5a130fd35f5775129bc1a8aa059292963779b2d15ac3b634801055ae5aeb2b9af0c07e450441b6556d60c4a4db411c50e2

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt

Filesize
190B

MD5
ea1693426563a161c0d4fefcf3b97049

SHA1
a27c3cc4ce95e6baf3d43b25936441bb51b2502b

SHA256
41f30dd44ece154a71b67d705a2e2e5cae71426a6d1729c8fd1a8a97146ee057

SHA512
8b43730e11ba75aff3b1c91989be26b5fb8fb70a5a6bd70f2f92488a909fbc77e94289c27ff3487ac9efe32115318e0168169349fbc1768bf15e1c9c2869ad89

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt

Filesize
190B

MD5
6b7b379fdbec9da7558f6d44f969ff28

SHA1
b679ff78c4c01b4a8c9f3e9ea231e87ed34dae20

SHA256
1654eea8cccfb1d2eedd98e02d8d33b3034ae15412156af2b4f0e712e3e29093

SHA512
fa7635dc9b7083204f503ece4b3054b1f838de14239e499d243138c37fb430efe2a7b222cc587a0b98d9f93ad87ec5dce15614c40a475fe00f76b833a7493376

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md

Filesize
1KB

MD5
26cfb1a4e1d082ce37a482ed7f56f896

SHA1
754120c783737ff7f42160185bd362f28c188e6a

SHA256
3abb65abe60dad01b286011ffbf2aa50a1de7a6ab417947ae9b2bf01320bf4cb

SHA512
3fbea8143defa08cb08d682d7d92fa0ecd379d74dbed1cbc041414001f32be68c54747a7f243cad09aa3e91bc28a55d7617cc8e09199338ec3991c3b721e532f

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\glib.md

Filesize
31KB

MD5
32aea47794d8bb5e31a67308ba5d6321

SHA1
0b6ec157fe477c54737108875cbada4e43c24e5c

SHA256
cbd26b12c639485c7b6b97e95c5747b0da641df9d8ec2fa1ca6281ceaac6ac4b

SHA512
74a322e779c74b692c4234fce16ef373fd69fb8f80ba3ec6291eec56eac3a40471b8dd9cf28d6e8880829208b4fdbffcf4814327cfd69133cbd3abebfb7fcea6

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md

Filesize
34KB

MD5
595ebc9086b64aa3b0f4d666c0a86d86

SHA1
ed664bac794a558ae02202ee798763c31629a156

SHA256
30777f2f3ec7fb38fa9b94f1f6358e69656afadef84f8edac16a004c884f3d2e

SHA512
a52bb90dd8b3ffbda7254f1b5a27c927a8948b88fbaf86da0bc820692c782c127250e32f3e325e19a2356c6dfdd911e7aac1e756fbff21e921eb917436750927

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md

Filesize
23KB

MD5
0b4973be888e78c6cdedd2810a841b30

SHA1
906e30e1eb7f8775cf041ee875c542de1e4fbc5a

SHA256
bac7b06ba7f86857dbad8528e5316ef3d5953fb69a15c09b72cbcd58c6c7fc70

SHA512
b722764da5028bbb51355c5cedf209d8adec8774ea1525ef2b6126b781065a04c9e9bf843282909cde4b09bf1102c2ce44ed087703197b1da4e7afdca2312180

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md

Filesize
2KB

MD5
cb769133b238e7ecf9778f906baee3b0

SHA1
ec4219dbfd151902d9490c0d8a4e7a97109d1add

SHA256
b5a83f9808e170aad3d342f57a962bb36c1b799e87fc1311e10e70a34b7db0dc

SHA512
4feedc3665c2c95ec6bc6f6b28f97177e58d16142eb316282b0fe80b4bf19967fd3d50a804f482d30186e05db0ef7c28b77bbd32f317479af98257312f5015dd

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md

Filesize
1KB

MD5
a945e696193a9f59fb5a809a7ed91dbd

SHA1
c6b46def5f97d648169648c98525515565cccef3

SHA256
2f4d4e73ea8a076c01ba52dc69a56a9b1481d3daeac6462f403cf30355eef9a3

SHA512
0c334012bdbacbb233103bbd59eb4993da6e4650414f0de2aa291415e5a994ffa38a3f097d6e8da37753fe322b48b1151dc086f785e7a332fd2f0c9abbdb07cd

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md

Filesize
3KB

MD5
832b5801b29a9219bf354f7e780b1513

SHA1
937113d3758d7a5473f88c8589bd790b9e287e11

SHA256
ce70811b523fac813672f9e1dc3b899059d81dcb5f456173c8adef331640c3b4

SHA512
d0a21cf937cd18a55e8b11135ea94724963340886223ce670b007e106f61dc0f6572b1f4bf6a91e4cdae992fe243c40d516be9e70341eb5329c8f58b2316553b

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md

Filesize
2KB

MD5
6f4df8a948be84ed6edee70930e3e3bc

SHA1
44899420a92438fe121dbd616c7506049e6037b1

SHA256
1b24a80eb0d29f46948ce35de9f67a1340ced5f23fdf95481295246f95dc2f26

SHA512
3510a620c83bae26b60ed51484193e7b7d3f33d5fd22a9e988b7d323f702391c233a0ca53d946c5ff091872c38cc240ee6042206d7f977e9fb7f208977a05ba5

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md

Filesize
5KB

MD5
678a1d8f223e6bc516537eb2173e6777

SHA1
a728cae99082d5f09f1f6384abb572cc16a7f884

SHA256
777dfc6136569d424a3198968ff4b1f051273bbf99c1c5a9c548f1ce63277daf

SHA512
d06a522aaefaf94a4e2fd287c171dbaa992d383cfb577e72615e55ac16a3ea812207f94c11db4dde4feb3c4af2971f9ac9e902b6b9ea4d9e5e1e2bd3be1149cb

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\public_suffix.md

Filesize
17KB

MD5
6bfc372c2f6986bcdab47caafe15c332

SHA1
45c2d7dd4d1a75cd34ae0505a2ccec3761072948

SHA256
faed16f90b72a879c34ac13ecef046234fad4ed10aa0c6785a8884aa38e03075

SHA512
ce5b61ff19f7bac2bb84099a9341c30f5f4d0290d5cc394cb8786cc5d7833333b3ce28e72a4f3740a6aee39ff0274ae7ae5513b6212324150ae44f0bd503d3f2

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md

Filesize
320KB

MD5
7212f0f7919e1fcfe525dc013091e17d

SHA1
8bab8aff2f08fa10adacc4d862e45e0e02b73ded

SHA256
00354f9295af0626c3ededd0e530cb2a56d7e8850bd793aaa63dbcefab2c0b4c

SHA512
58cc68f964bedeef33784cae1ac13504133740f72565c9d4efaa8b18be23308c6743493839ac097977cbcf0968dbe325497c5fcb6cae23f0c330b0729871ad0c

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\asm.md

Filesize
1KB

MD5
77df4917d56c73dd25c1a7422f18cd59

SHA1
9a8b7396061170d22a3de9dffaf5f4c0eebccdf8

SHA256
e228246a6f0d738b143b685ce3dfe72399d543afcce702531b84dcc03da404dc

SHA512
a586be255eb857be3d47a7f447acd6023095c3c1fbc4c7bc463b2f49f489397f2318c57657f7f59b09522e462260cde0985192fffe05f5ee154f457a7ae5415f

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md

Filesize
10KB

MD5
c8d018a3464754ad7b890619ca797f45

SHA1
e0174d51aec4b25d4a917718571cb63c1f757d2f

SHA256
62f2e6039d073cdd96c4650a1502b1801054a932901cbddcc707fad1733d824a

SHA512
8f11b6fdaef28aaf8e36004d62700ac21da9e6be1a89a3f506ffe68833d84328fd9848dd9c9b492c70289743234e04dc7dbd02b8772ab457729a29f3b6634f8c

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md

Filesize
3KB

MD5
4c9e891a20454161bdfa2ea8e80131a0

SHA1
a0da238e3a4347ac5746249d0c60585ea1f30d0d

SHA256
77c90566f0da901e2713c0cc42909b7b770f1b5dc6882623f57784cb8a147578

SHA512
4f55b969f7c388f9d9418a99e325d9719dd110bdcae0d3829a29891f9baeac188956dea9079a90ed1ba337b505d6dc15687c2ca5288c40f89d9e8023f89a38a8

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md

Filesize
162B

MD5
0908d257374f5f3564d8a66d134d4bfe

SHA1
3b9e362a8d10601bab9d8699061041b7f16cd31d

SHA256
3bc20a4f77bfd8bf4e1b4f606a353d6d59e1ef5575d0aeb6fb0b398b7a3e497f

SHA512
e87086c16a0655552ef9a0da53d6f349e550d633f2c054a5f76af4293d1f766918cfc253edf4ab70d01402830df9dbfdf5af820e6715c77b031576a239090896

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md

Filesize
1KB

MD5
12695f63c102e6403afd6d4cdd4378db

SHA1
a5844b4026dbc90bb929ac722a4625181557994e

SHA256
c671c2e6b0313d16a6f2d2b9df0a7f52e5376917989bfb449e0c5c7a6cde4a60

SHA512
d0c9fa988035b2a73afe13160adff57d4d91e754a110d31a5c3c3c499af1e98f361a49d709cfdfe6d855e5b90ab89786821b565b6fd0b092496308da85459e9c

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\dom.md

Filesize
3KB

MD5
1f44b2ac283d444d9d2f206c610e1c7c

SHA1
49a21a8e1c5c718d42c45c38a95f1db420546ced

SHA256
b6ee533dfc569b0a7832da316c46f9d1f1be6bc2b95b1a738de19519abfeda0e

SHA512
dd9a9d4c79d8aa36f3e8b6f995462ed3afd0a4a34d3c46e227b9edc55496ccfc8047d23919935fbc5b14eccec903bbebfce392d01858c20cd50d34095f88f7e7

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md

Filesize
1KB

MD5
91ee6ebfe4cb6f0f295c044a35b5fbd6

SHA1
8a1157cb6ad61638e6e8099d74a93577a09dde7f

SHA256
6bac4766c225194b17a3cbde04c496199c60033ea9e079753e4cdce7c03e5428

SHA512
58b31f0e55cf33f1cd87efd9ce8e403431d20bc31eae8fbd56d39cb2eca5fe14cb48766e377c1a42482295fd4bec972f97a6b8843745c0601b5bc3de80cad259

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md

Filesize
28KB

MD5
aa9211e5085baea1e56884bc0331ee5c

SHA1
0d473673731701807f5857ec81ee3342323320cb

SHA256
d30158432e8f345fdb8738859b6b7d0c1328a8205212a5b88d784aafcbc5405e

SHA512
a82ddbdf8e60d2ea44a2cabf9cbe47566db79405a09c052e38d18b0686c503b9ea21701af565747cc30202fb36327b49f6663882013b582716a9801f1a201d2d

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md

Filesize
2KB

MD5
a329e9c8b5d58eaf15001da9f32b66a9

SHA1
03c9febb0f4b98dc372f0f578bd10a69b44f3ef6

SHA256
cf9faec9d18cda38027224ed71dc6c99bb002d2b2d708fd9ed930f5c3117eb1a

SHA512
424cba10f7e56fe3ec4c2112e780af6b909817971b5d26dd139e9d3fa2d2931a9af7701995d647ea702598765addae59b10454e7040e492cc78ed4053057b80c

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md

Filesize
1KB

MD5
af79898871bdc4606acb72830b2fa0a9

SHA1
458908e1705d453d3cc2346b34403cfaff6b7042

SHA256
a2c9f63d8a70ee8049f3e5f3d409e004d467abec0b7406c29ecb2db7d8fe5e9f

SHA512
a3b12f10d6fd1e7fb13084c05bb69f3f6d870b538b27c41f7b2c7829290f952243ed967f965468928fea2d3d37120bce213dab5f0e83b174b7772c1035058769

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\icu.md

Filesize
2KB

MD5
0ce3575258dc25fdc03b87396be31ad4

SHA1
3e163ecec7f5a6a6ed84844a478a76f24e3e3d43

SHA256
14a4a63f541a1a46ae99a90f35d1e38a88087fbd1b887190d07d8016c22cbf37

SHA512
d60623dea88064ce7f0a29dadd8ac6eda065d67bce3bf83b7a203639c3e6f8358b1205cf6c351803e9ad7b20612f54880f6d2a8b44c1f60dcc7a2e44f97429ef

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md

Filesize
1KB

MD5
ee17fc6558737d1c08090fd97451ef6f

SHA1
424f4835de3f88c63d73605e5f2c012c899a6b89

SHA256
5c67e370f7b038faa14e038f6fb0586cede18278965b57adb0ff5ec5d4bcd94c

SHA512
9b8029852f8e6b8cf79709c238dd84eabe9229f3ac67bd07f60a1ec5de5bbb8fa64f935be951520319c6e6415c3e43a2b2678835a6b0302fa6f26f826403872f

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\joni.md

Filesize
1KB

MD5
df5c7d177b6853dfe18b1440a0e5d092

SHA1
b89577136cdc334018b51001012c4384b3042a60

SHA256
b065514e5a369bb34317b4fc95b19c017e96c237e0055b3c644a84cbdf2a71db

SHA512
db5d31f08e8554001270d4394275596e1615d53a318a5ab789e3a7e726d26f5d6123d1685231878496169a03c7b21b820c031682f20bae556707e8ffa1ab8cdf

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md

Filesize
1KB

MD5
102894fa81bbfc7619d87dd8ff3058fb

SHA1
5de33b41397b6a7b9308c3ffcdfaa3a07d94b8fe

SHA256
ae97bf17da6a4dc5f0d49f181d0503deeeb7b5ccc3f98e7ccdf2e63c3b2aaf18

SHA512
42cfbe1d8fe7b34c43ef37d78ab84b877dca11ef612c48d77dcacb6fcea994b632fad201acb23be1157374ab3c37a844639a525c9628e5ed5dcaacba757f2b7a

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md

Filesize
3KB

MD5
56b5c21322d05270f1c404d81f40a4c1

SHA1
d81b5bd058c2b712c52e2f8816ce781da36bbfb3

SHA256
200c58b741171b862003ab1be5b65d46d07d8f9660d4255ab1dbb005a0ae140c

SHA512
541eaed853530e5ba63e579af57d6dd44427e6ada0f0198b783acf5572f06994b27375f35b6fe948d9cdb59d23e5731dd76678fedfbac0c51a9514162ebec8d1

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md

Filesize
2KB

MD5
7693b9df52dd61c6b8789942dce2097f

SHA1
69c70ab34fccecdc2f54d89a5262cf4740137a10

SHA256
aa26790030fbfe74fa502ba51d753eb6e88ab59b13d49de21c0cb4e48928c8ce

SHA512
a24c3ac490a8356f65f06716a11d54794c64eea873e9f87784c0ddcfe8e7a5240dd50091f5b67e89d2d286039d26e026ea997912e7b22f86661a1e4d753f298a

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\libpng.md

Filesize
6KB

MD5
b65ac410f01f4b1ed1c4fd46d8ef0caf

SHA1
0e8fc8f36eec65110dbd6d63cd79ee0259b111e3

SHA256
dca63a0b0592156161730920b19bbf2bb4d99574055ef29e2584b04000988dec

SHA512
47709f788ed9e5298f267f2dcf0ffa4e628281061b2ffd6e4277d7ab33d39399463c5a7a22ec7b265d56d30656ad14238a6e4c9583778f4124d84c1e0e884692

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md

Filesize
5KB

MD5
7d99581f3c22cd7e963b412a11c581e3

SHA1
fe536b446c966cf3d72912b5c46330a247cef550

SHA256
269a9a3f7b71ae05453d3115640990f211e44abf2788647eebafb284a3ce2b0d

SHA512
9c0729480130ffe191495fb4fd82647034e0b489c3bffca7882e1eeb3654910de7ef321f21d9f05f3d7423ef63e8fae81d739ab0b893d85b0eb3fd8f0b0027a2

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md

Filesize
3KB

MD5
1a7a7bfb87660875d85dc6d03a162af3

SHA1
61cfbe3784bc2d6b08d8ce2d60b503ff6739dc18

SHA256
876b90fc93585a79a485318a28d10884cdb6bfcefed9fda5242800ef2f543fca

SHA512
4472a4203a3cfe28a0fff01368a559618d88d87c8c931aad4d567e03df785232977082c9596f72abd15977aef5464f2d7c97ab3972366cabd531e891cf879ffd

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md

Filesize
2KB

MD5
57bfd652a35fb23431ad657c739bccff

SHA1
29f42bf7597e03b8b913d09aa407104d781ea664

SHA256
f0075ec90ac082b1d8ed14e9e7d0782369c6886c7c2adee4cef88c04e048a99e

SHA512
b3bd6f6decb3e2b7c6903ff7f562d72d31dd379a054f7548803e2667e5c0a6690cc4c40f87c690de3808c60a390410a7a42220e551af989d475af01ab79d584c

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md

Filesize
2KB

MD5
59d0ced06cabb56ec90e617fb568f59f

SHA1
edd657c79a37eb2befe5f7596ccdb497bc92bf94

SHA256
a4fb93a36a315e1d366298a66314c504f5e0632dbb857c57f215e88ccdb2c517

SHA512
df9977afa9b9ad72ee4126b3f49cec5bd508e5c73110ce6bbed44cfc9e0d6ac99fa19d2bfe658d5722cb249ef14b40958c211d9228dff9e5d3f9cf9f4f1d1682

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md

Filesize
1KB

MD5
83cfb4a5d3b65aba7ed8d2deb2d4cc02

SHA1
2a0647c3459ad575ba26602e60880a4705ab4fa3

SHA256
45bdb813c0df5ec18ed63e23f6cde75f699a6f4b5d9a012250c7847d77dbe273

SHA512
131cbb4524dcd1a5ad9dd466c6042df2d4614f3d0a118ae0c98c30efb21accfe3c94933fbcfe5e276e27baa9aa939d2c58390c4e60e7f16d5900c5d70f3c1a66

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md

Filesize
1KB

MD5
15690842fc3cf7205f3acc5880db188b

SHA1
bd21dc79bb4d52cc25aab2a910da86b6e09edd30

SHA256
738b18e5d75355505bb3a6c5bff2a945d70250cfcf12d32a2ef45c49bd8f40f9

SHA512
aedd9cd4367ec763ab4d76142a7f52af13abda151bf75d488a558ce81bd3ec4e42b980c214ea89c314da19371e7508cfbca4073d12ed9925fa2a741f5f1a0ba0

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md

Filesize
11KB

MD5
1a0369e2c3d714dccdf7805a904d195e

SHA1
f90ac8c8d26d5a160731cf4c658659c44561abde

SHA256
a252211c3a69d3438b23558c1fc97a8eb569aa71ba49f62fdd4e1d463769ffb1

SHA512
e5baeee39c0d2b05deeed7614413f9481de5b3ef470b65cfa4fb14f71b12d027fb0c7f933bd61d620f4edc0db8f1caae8f8be4573d05405eaed0d0b24e7db51b

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md

Filesize
1KB

MD5
0fb36d4903ab9e1a307bf494800ef521

SHA1
dbdc3d1edcb01e601d5008caefc5302b4704687b

SHA256
e668b50f23b071dabdd5b2bc56928d5e8228ad2e96e94763a3f7bb12944f96e3

SHA512
cb6be7686f7619a1a44807ef2821c2d46a025259e4647d504d716e76d7f697dccf1f33f9886837932c47deb6858f97fb50327ed73da5514d0b2ba1ad511b924e

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md

Filesize
2KB

MD5
1405a117bbbca7032c531e37f7f51061

SHA1
dbe6779e2cb94e31aee26569710354c2802306be

SHA256
9fd397a1ed8818b1c17030c9bc40f957d6ef8c9b6fe22a9bf2afcac1718830a5

SHA512
33c72cdc26405e0dde95386cec18caa83d70f26c3f17f5cb311d50b4d364dcc5dccfc9b25fdd59d9b6ebeef2e2d18e5e1763ec6b045e9b9fd83c7bf52f685e30

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md

Filesize
11KB

MD5
6c73e42f7c7fb68120734d071814aef4

SHA1
fa80ce6b1b95cfa27a18f93bfdaa9f3f9d251907

SHA256
f8ffcded894c884cf61b40da98e1b3540846a7b5f3c5aad9a812b14f575d018e

SHA512
0d1b12837638316cadaa4351488d081419cd0c1697ba680ef37fa3cc497ed1da5d2e92ca1fa903a41fffc60b729b85ec31391d0720dc2acd0b7a5558a346e590

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md

Filesize
11KB

MD5
d9a02f4535c36ca242f83b74e06f0dc4

SHA1
6c50967e7b3d5ccf2423fd7954eb74990899ef31

SHA256
832d67ed8a033c753836e69c59def29b06dfc0d0cad2403132821e147b521949

SHA512
d31b393b20f6787ee45644e7b7188efe885d9d04ca96c93e4c927acdb11dbc982cd2563c93d344c133039f18f0cbbd897301fe26732eec1345eafacc3893cc91

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md

Filesize
11KB

MD5
377d4e6345eda9890c53489f03ddc24c

SHA1
762059c83ac09c9a10f25959090a6f98e886d8a5

SHA256
24d81bb84ade1a016df03564dc6974398c46dedb66c9ac66f68dc08ea1c89a86

SHA512
2d85531153cacec4b53e9b513600444a5436187342d87d979d35c738f11a363475aa80ea0d3c6a7946725d54fe04d948d5d307237d95c0e89d9349935323b289

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md

Filesize
1011B

MD5
bc15015bb87494565e8f2437b3f37d53

SHA1
1943228aef229bfdc5bb8de5fd597717500fb998

SHA256
5bffb1853be60420527594c63c34c81b45d0314e252221511372789e85223904

SHA512
de0c80eae0e6efbdb7ef9ad03d912202788d036d5771713b023626c56aaa7f51c69e25c8b06bbd6f51238cbd3dd5abe5e086871a2136f6d1bd56e4083d0a37b1

Download Submit
C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt

Filesize
42B

MD5
170ef1c4af5cd82344159d4fb029ff75

SHA1
bfe9f52143dd7cef1169c06a005cd7db5b0f70a7

SHA256
bdba9fcfb1d4db5331746fe8a4683e7e7396d81967e743ac56cb60c932d98430

SHA512
c0ebe6a4c9a8446456c0d99534c8828e3aaf74c82f7d097712945e6807e8a349d01eeb1f267c5102139acbdc1ace37cf0124ffa60200ae9d7e19f1b32dd71376

Download Submit
C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe

Filesize
1014KB

MD5
ffc5a928918ea7703c0d8fabe9527cc0

SHA1
c86eaf18a465b64070988489a87c409c2fea6f0c

SHA256
d1f8c52512fe2c4e9c11def916228d652a981add7bf97e7c131abcbe3d4caea8

SHA512
81d6e62940bb263ed828b181c3ef4267c6041c60e8980df31a235b896a8cc531cc8d6f4dc0e144abdf78dc39443d66f66ee4b06bef5b8726d0434690df0fdcde

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727662527520250.txt

Filesize
77KB

MD5
2eb6e284a09b71df894d18847073c061

SHA1
a08f772a82d9ee0ade3e38824a149d4023ea57e7

SHA256
82ecb8243ed30e297c5e0bbdf2fd2a405b8c951acffe7bef7b8a07407ca040ab

SHA512
495a423b5f80265f44a0c9fe77ccdfcef4518bdadd8d3779df53eef36239354c924e0fa765e6ac7b561a28d7ca81009050b3e1f61823247a4112c80828de8aec

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727663115600892.txt

Filesize
47KB

MD5
fdcc956cd9eb0e76df6ef2df1f68d236

SHA1
29f5b90030ea3fd94ae796ff1594e91ad58e2bb4

SHA256
f495a365c1e5dc99618e6aa6aad3fd92ea0706157e2c0de492ad1b0c859ea282

SHA512
5207358ed101a036e53a30a5f28c5301feb6af1cee808887492d2d6b6748c37631cb1470312e538579a5b6d3ae6dfdf646c5f141819c4bb9ac52716977e9a2c7

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727669117479246.txt.EnCiPhErEd

Filesize
63KB

MD5
0534e433f7d48fd150bfaefe83fe9bd7

SHA1
ae4cc737e43c7297a1344c09182f13c635e6e1f7

SHA256
dbcabd924880345ecbe937134fdb0e89df5c13736103a1c5d1420d3366e06fd1

SHA512
0792df7c3ff260738bec425cf53e3749f3413a4da4755868f68ee7313fb331c53b32cee7142b2aee8e47933169745adfd1d8ea6f6de50690070577373cbf4497

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727671764608349.txt.EnCiPhErEd

Filesize
74KB

MD5
1b2222b10753c0d67921216b6aef68f0

SHA1
037aab00b819d13b0e92cdf335027f535576eed9

SHA256
bda771aeb65e46a5ffa791688ead273a6c5ac5498862c4cc6dcbb2d8a5bdd18c

SHA512
aa6c227c0a9f4e3718c5ebbf85776e1f5cb0a0706ce4a7789fe6adff0eaecb247b8df9bde8e42af082037c6c4666cc11987ce8304176807215fdaed526a8922b

Download Submit
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\File Explorer.lnk

Filesize
407B

MD5
c0baf52a6303e54017501952579eea7e

SHA1
17a3b360dd3b25c76792f5468c110080931d2eb1

SHA256
5a268dc5531782ac1ac55d9a6faa514ddd34df925f9c8cd2015ec09f40fdbe13

SHA512
6a86ae6e4dc97f6df3a74752ed9b03f7b1c7c8ac3d00a91d8d5819b1ef394de9b5e744dc20d9993f114068e85b50f2a853beab681316427721eed7dff4a40dfc

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg

Filesize
21KB

MD5
4e55f8204570dbf4da2d473fdc46a7c6

SHA1
0e38aa669be1b277c48a8c11e13342d624d11112

SHA256
cb15279573140a204cf4beff8ce54e42d40d407361fde618a0ce36907135e141

SHA512
9990a9cbd0c71cde22be219353dec2ce5257f19fb5011e9f8a5bd6c6cf8cf6bf09939adaf1aef054c5d6a6c1b6570bfdadec57c6487f74b8036f58383d61b472

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\HelpIcon_solid.gif

Filesize
1KB

MD5
74ec63d3ada8eb15ffd92d0a3105be81

SHA1
cdee8ff6bbd56da7e05c8ae719e7438481ac83e5

SHA256
8bd75e5f26a3bf7e37ee51e1e2bf7efa68ed060292847a0350c648a0bea21f5a

SHA512
0c5f8e576cf58f6354d81e2ef9b3432f594a77acdb34395a39d3c4ed685eeec0892c1189587491945cb277cd9d79ddd339e5de8c42388d0141580c4cf5511472

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\alert_lrg.gif

Filesize
952B

MD5
024ce5830f4a61944c7da2798daf33d7

SHA1
9a13dd996e5d8f773db84357fcfeaa7a99286d49

SHA256
fae139d5a6310e443784bc8141f3168c266193c9d091027e7cf728f617a2c0c3

SHA512
360d7bd7532f7a20f368bafdcea9c4a8e6fd15960b7fbb444f77966d710afdad30d8948aac510f6f0ed5adcf7297599329c00fce21ee84d8aecae37c67efc77a

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\aspx_file.gif

Filesize
121B

MD5
2a5fa5c31ff6de966ea9a93e1af4342b

SHA1
b09a2310fbc1c9f8a8c86a645e30b06cc79d43cf

SHA256
d353c0bb29df1e7ecb957ada706c3a1608927a63e8dee38d8f2106e24c330cb1

SHA512
1bdb7a9864441e4d10b18fcca944e0becf8da6865ea885bd9099561c5f8a06d556c9d82c59a95461a0785d6de572afe7f51e2d00cd34c46399f5570b8d0e7d3d

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\branding_Full2.gif

Filesize
1KB

MD5
103383a9c7afa2d7067cbe08b79bacbb

SHA1
e38c2a10515b35818d1d7a0da366e8a50416616f

SHA256
447e448608530848dffa8319608881e13a1a5d6f6f98f3c9a263e36a6f78d9ca

SHA512
13a5d2ea329afb492f127d19cdd8157885ea5e4208f216fcc3b838856203117eda7e41438509470ace48015067203ff5106ba893254e986ab3ca26cbaa0d8c24

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg

Filesize
8KB

MD5
4bbb1fa3783bb4a3ea4618b4fd2f4c26

SHA1
9b9bc01cba6f9a9be1d2f66092cc6072a22c702c

SHA256
b324f22dc032ba0b8e7ed53956a7f729beb6b2d80e2910cd487f1e7a9399a457

SHA512
11a039fe2a87d1b18dbd919d69dd24fbb918cb8666af26ed9786023501d91d834344e548a990656a3dba31a6e715e93e1f94dc0ca7022c02b58c10238165a8d4

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\deselectedTab_1x1.gif

Filesize
61B

MD5
e46721de334f54cd6c5fec188e5dea30

SHA1
d4177564cc58495ad9e4616a43cf20e215e8519a

SHA256
3bb4540109becab54cb14b1dba4f10471857ca34f5cfcfc44e6b082252fe25c3

SHA512
32c963872eeb8132845169d498a866679538904f6a6d709f56160c8f8af4474a581b8dfab68a7e07234fea1567e027053547f78f3f3176b1315be2d64fd3b362

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\folder.gif

Filesize
914B

MD5
b1cdcfe3c7b66b2537ec7c6755f2c114

SHA1
de1d2aa3df52c99227dffc28f80d0004b9fa8263

SHA256
80f59671e2d02714ee8065137a36d23c022ea0f123084f97d08c2c8e99f7c11d

SHA512
515aeb7ba8bb46de0621e7da879f5d13dda0e7b9281f694dedf80c116d13dc6ce021d39fd97c2bd47072df1d000e7ce467c804e576dfea68c2533dc0bd68c59b

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\gradient_onBlue.gif

Filesize
90B

MD5
fe807b17ba2794415ae2b8aefe29762e

SHA1
fdc0812d93eb99a1c1fa93a604c1b6401fb53122

SHA256
933b2f8e9832d4fd7e530d30f1777273704717fd4ad9eaff59f36f3a43635399

SHA512
90548c7a354c1c55f3f8ac9ecd6afb7c3ef8edd696aef6eb94463ccdbb6a5294ac0868133966cd256db4ee11492db038fa7353e233334217bf826c84a2275e86

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\gradient_onWhite.gif

Filesize
90B

MD5
a6853c30abef18286e4802c543edc315

SHA1
992c2eaa630709480ec9edadf5daa2da736da554

SHA256
5e216ea566d608d08b971dd1ed63b48633b40ffe407d51238c7cc7588042c03b

SHA512
b949a9e20e725badf87903b3b18636f37fe0659d81d9c76bf9e53362ca96184c6b8b9b4d771316e545c1babf07bbcc9854100cd81160a52898dd0c90273442a5

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\headerGRADIENT_Tall.gif

Filesize
328B

MD5
209da4fda1f5823bcab181a8de82895c

SHA1
64788a9625929d9ff2941452c6b7492f00416b2a

SHA256
33642040d64a3740ac761618ec8d2f37c671da0f684a637dacb8a81ab470df23

SHA512
68fdbe15519bb95b66dfab7db42f535182a6d915e742f75432c8f8ceef50b3ac8fbf0b10c62cc1c885bfdd6b3c110f3b2d6c7147371a46f5fba01efa75ed4467

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\help.jpg

Filesize
1KB

MD5
b72636fe7164caff3c25f984f8c47eb8

SHA1
3ac2e1a7de60e380cac73801e7f91ee57a7eaa66

SHA256
e7f3143e8590b49df338ccbbe314dc67bfe98d2f8004dd20c172c6e0a23d5dd4

SHA512
89dfaa98ec777639bd6af7c107752829492b72c9c2d3c7629c96360ad6fcb655e887e5f4a8242aebc466bc5bb2d17835682cab1d053379f45a343386a312137c

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\image1.gif

Filesize
162B

MD5
81e4f2b7ec2f750a703cea9e3433e694

SHA1
9ed7e250dd8f275c91ee27db0fb6439d2b463b4e

SHA256
9c507343d8db5d161bb3b820a9846fabc727d664b66eca8d666ef61cc8898aba

SHA512
19c5ee40523eab3eec63eaf799153ac7c1ca808e4d7fabd6db12bdc600ddc04ff7d2aa485f7186007b1f87923e84dfcf15976ed0adb5c78e7e8ceeaac4d576ae

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\image2.gif

Filesize
586B

MD5
2c04705c210258979274b866c93b9de7

SHA1
f91d95ab3e23c55dbeb58554c14bae48a5c2b969

SHA256
65fd2d1c23fc82b0e6122874d74d733eebe55683d5377502f7ceb4561a148dc2

SHA512
76b4e9fd4156ff6e5e15a8313319d3d3a061433f39e9684f9f7b394a44f308c481c2512fe2757917bd80cd22ffb336f85d446ca9ca9c5e69b40318398d704908

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\requiredBang.gif

Filesize
124B

MD5
5a048c6e758f84805511c2a78139eacc

SHA1
36407b4cbfa320f649416eb9c49002831cd47937

SHA256
0cc1b84b07467707e0fa03933892b5bdce5858a6af60b3af631219e4437168aa

SHA512
87efbed215fcbf13862129c26e05f3cb9328f93e1bcabccfeb057153422d7ffebed4be01dead215ad405cfbdba7e851911021a3f69dd07a94859d54c44dca4ed

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\selectedTab_leftCorner.gif

Filesize
65B

MD5
02f2e0bd33e119e5b8eec0cab98c4c23

SHA1
004fe61df69009e122d9a879b430c1c3f2de7bc2

SHA256
e4d37e8c94171018dfcb88d7a21f25597bea395a5b1f801e049c178d836478e3

SHA512
e09b480f56c9091c441ee73f92f7a9a02fc07cccfda17273512ec2fe40a71b5543a33dd763af1268fcb140583cf0b1817a942de66a9bcbeb23a8a026c5b3ba78

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\selectedTab_rightCorner.gif

Filesize
65B

MD5
76aa27b810e10705e5c51fc0df447525

SHA1
a7b2e220e131ca059f50cf7938ac69081a556340

SHA256
b72055754696cfe781f9b3ca5125a94619a3b97b8718ce4f51407440e07045a5

SHA512
e1a67eaa8812f1b31e5e3ebdcde3942731eeb4e5842510f802a7456eeae78a8a3c4cb1c753199d2ba28f38f7d96ef9626d49e3c831974af7958a8b951337ee9b

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg

Filesize
8KB

MD5
9d92acf14a9638a2cada2aec21d5a452

SHA1
09f9a202a8a35cb7f138a781077ede75333d9ca9

SHA256
6a63c0e3c2198b5528cd6f157e9718f5e902241a8687688d43cec7e5bfd40c25

SHA512
28021c31269af16802e8db367a0a05bdb545dbbc619630ab9471e2f31de542b57fd13dacaf31abb72a8d1a3ca715a70717d29552e4c2820fe1e259b5934681da

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\unSelectedTab_leftCorner.gif

Filesize
65B

MD5
2828fbda72760c8282c0ff7e99fc3a3f

SHA1
0696cdd724c807331f2531314b0df5cce5fc1dd6

SHA256
0cb0d5f98ebd2a401fddf1bde390d17881e8f907ab446d9a12e424e9dbde3bd5

SHA512
f0107334f8cde7b3ed2ec2f30bd7ba8946b9d3ce0a7c91cc23166bb35b6870bc58a5fa32ffff609756992ef2f10eeae71847467213e2e448c83737b1be3c0deb

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\unSelectedTab_rightCorner.gif

Filesize
65B

MD5
b171891bcf8af64f858b7428379601d8

SHA1
c9f41091b973e8e5f19a028663b7fd172c21d377

SHA256
a13fcb988cc157ada04186a41633ffc5d012cff63a8cc270d2c3d7d2ca8be7ef

SHA512
4967fc22dfbca055d9f25b3accba62332d8e78b77d528a65ca16a64aa0e158e3263ffcf3dc5674ce672607bac89c4c4c37ff6267f13be9ba48da73d34649e8ce

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\yellowCORNER.gif

Filesize
880B

MD5
6a019fa63ca0acc5475fb12b5f1a2a76

SHA1
e7877795e95382f93d911a8b604d0c9cc811e940

SHA256
4eecdb268c1b93667768f5e649da746fb356e50b81275eec131c7caa1779f6b8

SHA512
da75b5d0bc1a412f6b80722cf07a493e5a2f3ebbea732f5018dee2006fe00b28bdcb52f77e5e16580ccdc1cfde4486d96091b5bf601e9c8779495d4952d00073

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\security_watermark.jpg

Filesize
49B

MD5
679ac571ad10f44d1596903f99e2da78

SHA1
fd23e45208e3f42a517cb4665f5f51cb7b2b3f39

SHA256
7b17f4eddd3103c3272d259eb44dfbfb5e14185c52bde92d9562c3e4dc4dbfff

SHA512
6973f9c277599681937e320b205df6f319d47c821968a07ae99adf5de8d7170c2ccfb24ccce8c999c875ca360e927fb4549cb18954d8872100eb9ea0abf3712d

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group1\1 - Desktop.lnk

Filesize
1KB

MD5
d8805c56dfdd4190b3eaa0376289278d

SHA1
67c45535f5b2ef18b9f47e6676ef1decbe127f5c

SHA256
b0bd4e1286dac09097f6184636332f8a8e1eccf7a0aa9a17827e8bc2919ec298

SHA512
820cfe4d34858fe00fd121edb97c156de8b330645fabb1343ac90a307af85837a05e4333713b76f28d8146b9ba84518eaff0a352110fda19f903232716204339

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\1 - Run.lnk

Filesize
1KB

MD5
d6d5f9a868a8b557a0c726b8cb01a03d

SHA1
d50b5e30c444c86b84b9e52f30162928541ceadf

SHA256
9074736aaaabd6f0dfb8a66cddfb76a9705df2c7bb8814752361d70295d9b0a4

SHA512
7d58877a7948f5e2c4e164715cc492fb6a43be58e5ad3c94b10d91cb662e663c2b775d4cbbed9308f72de7df5a2d9d157795978a7400be3723181eb7ff35558f

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\2 - Search.lnk

Filesize
1KB

MD5
ff8297f671d8cc8e5f2f3c1032ba59ba

SHA1
5505b6c9b4822568a97ae3ed7f94ed81ea90fda5

SHA256
03bedccfe3fe3ea0e7d94eb3b8173ee847e214a5e9ce754b4d05e43984c92b16

SHA512
3d629fec8a8f6599c24c41d8b4ca75bb75e9a79490017baf3cb4ccb428b200525bbee01fe9c1d9a19f72c9a7ebbaafdee5486e9854e51e33ed385bd546d672e5

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\3 - Windows Explorer.lnk

Filesize
1KB

MD5
c59045d81e58a76bb7586c1a1635cc6a

SHA1
2ba5dd4d1729cd7260b29e83fcb082e694e88e42

SHA256
f32a02bd1866c1152f6d045d0f168e9d12e002c38c59650cfe7bcdc38160e35c

SHA512
0d77bd27fc6b2432a42ec85c05849fdb9421b83fafe83cafa81bc83eadad4ea7cb943a983b53e8a1ca706cca4f708b2b88cf2a7725b17d2ad932ab639df37698

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\4 - Control Panel.lnk

Filesize
1KB

MD5
3784c08cec6cd6ad4ecdbc5f5412e03e

SHA1
57a85982aa5e2f8f38f37c9f9b93ad6575a6477d

SHA256
0c2fdff99fc51c34acf534d39dd964a13dd17830b99d97cca4cf8ef574a4aafa

SHA512
5ae26f143ae7a68bde279d2c9db6936a4092972180d6cf6cba66ba6ad36aefcf83f96b1d6a602a214a5f355002ce4d9e4805c814fc9a97afda822f449a08f710

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\5 - Task Manager.lnk

Filesize
1021B

MD5
d3de530a4f01533734f4b25aa2b0bae9

SHA1
85a1db64331deaa4db7c21f5c9ff21dabd8b0c99

SHA256
192590e344441bc6b64765ccfc9905ca67c56d7c67fca3c599e6bd350c3171d3

SHA512
48c42c7fb6b79360882932e9c31b62cd0ad357558855cab6c53565b825b47b8b4ba5666b8f68a3fb5e8a22aa71d72173d29a1fdb536e4577365a0d516664f390

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\01 - Command Prompt.lnk

Filesize
1015B

MD5
7308c3bd1b0ec476d411b73daaff705d

SHA1
32e9da8fdee3944e63115d3fd82be3b66f9423a7

SHA256
81c0d7c16a054e5f4e77b533ed0363e4a9ea82b4bf0200f789b7b6e6227d1d7e

SHA512
5448abc37e6aab3cd4bd589e3086ba84d74a2972ec6ed7ec04d6e04df90afe216d1339b4e4f8ebb36f1d0f87b7762197e1a931639152113e4cb78d87169fc74d

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\01a - Windows PowerShell.lnk

Filesize
1KB

MD5
b321bb7521b3c1c7be360fdeb68a7758

SHA1
2fbfdfed914f4eb61498dbaad5d35969527a617e

SHA256
836b0fa0872ae20f2068ec71d1a54b6d36f56ef39f591a95b35636b8f426d12a

SHA512
88782fe7a392d65ed9bb65cff3e575e64dc4d1bf4c59b1000c13f9ba90ea0f825699507a24f9359ab4d8beee0b876f3795dee8cffd6bd02f171e74f4bb9d874e

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\02 - Command Prompt.lnk

Filesize
1KB

MD5
21d7ffe092c7de9992a4a0a8c9dd9053

SHA1
170882ce09e48bef82ccffe1f2de5bdf50d8cd3b

SHA256
7fe6c062573755747df2264b9c67d7add5144511e1deaf41cf0241e9d94bd68f

SHA512
7591e10070169d93eed90f9de9e99d1392ae6e70c5a89755bf42c507263729275e6be425bc5e54e91082900493abe685c6d5e788d7a4db2b49e81aa6751eecf9

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\02a - Windows PowerShell.lnk

Filesize
1KB

MD5
8136d1aa7406806511ec436defa0ee44

SHA1
b8af8f40ad0897f7f5978e88e1c493275ed9599e

SHA256
0a130d724b693a9c9787987a0f33db4b1d7863cea56a4b65bb2c9beb0be1ba7e

SHA512
d3ef6e8ce2d1f1082ebef1bef7cebec08516082131f4739984395e4935048e978ed61c7a4a84e38b760eb96e20908cecf9a9b8263173a835da56169786df5f65

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\03 - Computer Management.lnk

Filesize
1015B

MD5
72ef5c0ad3010535b500f474118d4837

SHA1
63931dada811c28eba8cece5a41881660725297b

SHA256
49073310100addfc84c62e0ffecc76074e2ce61f807f8cec74a4361fafc22ea4

SHA512
699bd20d52099a9a8286e7a45e40df6e33abbe16320302375d152bb887cf17fdf4b19fd9e5a005f030cc9239a2fb920a621e7c9ed5d317571d203e47e7a0bd66

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\04 - Disk Management.lnk

Filesize
1015B

MD5
5ae5e687e7c9276533f214273d67b420

SHA1
7b75b410cba53805bb573a352449e1ac0daeacdc

SHA256
2a949a2f49bbd5ba7c1b1b8c9bc8c8be185d2be32255b9ee58e3c45ce6e2b662

SHA512
b5973e9564da693090785b9e25059e0a072a5c5bc0c661b65ebf776a257692028808dfbf0826aa81b4e4adeabd6819e5e615e4c420a34d39c26bf319b375cfe0

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\04-1 - NetworkStatus.lnk

Filesize
1KB

MD5
47520a093c05d898127333498b9389f8

SHA1
ccc4278b840e505431063cc384daae2a27512772

SHA256
22ff4dda2fb9a82ac85a5fa3de7e2065ada7c773a7e25dab6e68f1f3dbba5444

SHA512
9853e18d53bdb93b47e02482f1983a9bed9875b116012b8e222ef79de1022ef4408e9f867aa6431df082e5ef82f0d2b3b1d22c62d56806e766d707e291cbf49b

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\05 - Device Manager.lnk

Filesize
1KB

MD5
52e7641fe2e221cc041ae7e235338280

SHA1
6ee09b571861f84461046ee965e8981376bdb479

SHA256
58668f3354ae4e8129932e4006a026fc1f5f821a040538a6e4873c16e505fb27

SHA512
3a2e0241ab6a83b33862f3ee2be1d711a6c08c9b1ec1bd1111cf3e8451ed03709db94679b63fd74b1256b36ffc09fd4e84aa21212768ad87c3bf88da4aee596e

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\06 - SystemAbout.lnk

Filesize
1KB

MD5
a3a25b0da0915af9ebad11d4ed758199

SHA1
67c8c1c7ccfdb1ca42a8d11a480efd4fce7158de

SHA256
cae06c53fd85ef5d44fdadac7c6f8e9b1d693f4885f5a39f1823edd2e6138cec

SHA512
9145a75a0d4c5a76391f91a2d774cc887d6f2dc191a75e53714e9e81aaca343703b5b7ab0f9d746bf9bb24fafe4c94d1f37c6995cd35ae547068868db159a7b0

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\07 - Event Viewer.lnk

Filesize
1015B

MD5
c5de7d6f6526d539e9198845fa755f9b

SHA1
7e144de47bf8bcf96f3fe93d4979f79d29f2b103

SHA256
fcaec953371c4e341415251895055850a1f09a0535c9c3095f4cd354e692b072

SHA512
bd7415d086d2a47915b1a107407672f1fdd58261153f3967cbb459df886dbb5fa7c354b9794f6e488e8cf1b14476fab57d2269e01a1c113446ed16b09e93eb24

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\08 - PowerAndSleep.lnk

Filesize
1KB

MD5
49b323e362e9e4f3527ea810ff2f9dba

SHA1
cb8d811cd2737fc4cc3a2a800a90e7eb4ccfeaca

SHA256
5318690f3ddc6aaf2ccf96c10a2d3766de73fdf46b98bc9f302f604d5291aa73

SHA512
a706305198fd7c7b2edcdbe7ec8e9d73ca6e24da0aef39a988e8969ab9447d19af761756bccebcd96adf79e1063c9e8183d1ad6f7e4408f1815f6935e20444dc

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\09 - Mobility Center.lnk

Filesize
1015B

MD5
edc9e75027a3f2669f679762617844a7

SHA1
f4c2a01aebe11280f10a75cfd414c51be500cd3f

SHA256
10eb34269e5b4b513b55069ddadc46ac4aa907cdca7b5d8520d94a0a3b84ecab

SHA512
2e045fd8f0664ab5b6e9a2528997d6dc3c603b28904723862bf9f9b867088d4caa0b40692cea87e24fed835a244bf9abee26c2075f2504312ad6fc77727d6d56

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\10 - AppsAndFeatures.lnk

Filesize
1KB

MD5
78bac97a4ff0ac2d936c953b625c6fb5

SHA1
1f8b1d9982520d956bd0d8c8c230b9cf0d7f8216

SHA256
db4380a6fb06a54900ea8b9c23be1688263b2bac0518faec1ccfe4927b6cc154

SHA512
1d87ad521f96e6465e74ffdc73714cfcb302cbea3d5862c7a91f76a82f7eaf6d90489f433ff716799a4cbbf30154b5f402d630d4e49053d9e3be2526d2fc1bbe

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk

Filesize
352B

MD5
88a04c3c12c811cf6af1b3e0006e0d11

SHA1
a73c6feeefbf3babdd9f7f137a2cb5dd53857a29

SHA256
2524fead34555a41430cb412b6e27cb7c51c30ab98eaeb0adf3387ee8c17dada

SHA512
3da71d70cf10004bbe6c4a34b4110c4a3f53544d34b957bbcd02d712fab88bd1fa5992e896554f539c183a83e1170144db079980b8572b0c35ca45bc930102a0

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk

Filesize
334B

MD5
73a21674c0ddafbd85725d1d9ea90cae

SHA1
39980c9f61dab259d8a2ebb7e2aa10e5fe9313cc

SHA256
ff3a2d6df83cb58624c7ef491361f00fd3038a48aa6451652d4ea1d7a17e4d74

SHA512
03824e8594f78e1372e697d2c3fa291d41184f6c75b6703a3e22dc124036b7a518987994bea32ef67f2b17f52953941c209e3bc57dc10f5864f4ba8089aa491a

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Magnify.lnk

Filesize
1KB

MD5
978752d92a5d689d69507ba6fc172ac8

SHA1
c54e1044109e98b1d0e9aa2afa8c26b798bb3a8b

SHA256
55ef51c9361e984befb055ef16d7451961f96b7347ec428214b0cc2144c50c59

SHA512
516c2d386d90956368efb36fda4297ee97ed97187bf6dc5645b921ab308870ade023fe2335d703b4bd394951cddd8fc89df1553bf899bbbdf3b34b3db9dbdf1e

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Narrator.lnk

Filesize
1KB

MD5
b41d37c6079902c6dace40ead47d4784

SHA1
9ead48836bc83f36c0b61fd1b98c1ced7da42581

SHA256
708995271f02576f9f2e3e5b9a31398f8137c52e402871b65e64f8da5870fc42

SHA512
27fc7d020fbf4d3d50f0cbd8fe08d6af2f3a8d698fd550cef2384ace3b01b8c3602b0123b767a1fb10e6fb97a7f867ab14144a341f2fe520e48cbdae82ba308b

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\On-Screen Keyboard.lnk

Filesize
1KB

MD5
92afa7b1fbb79a8656a5068a4f8bcc22

SHA1
c85aba8b94fd6908d592eeea49c6d39ee454d521

SHA256
fd21c27dec50d9e308a3054a4db6c942ba525bee2bfb2f5384e0ac70c9fa7b0c

SHA512
27721e21ca7d8cdb8618fc5d74d9615a845d70775de3b80fcf822fedea835ed13c414a73c347ad5e1ad2fc5b453c77e5ba3fbd71fe8e1f53525894a7742c800d

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Administrative Tools.lnk

Filesize
1KB

MD5
d7e957f90fe48d687c88d506b7dabc16

SHA1
5da08dca9c5f6df48cf3e56b92ea52588048fa13

SHA256
4ed09b7ba833a2ad0f9d81efeb15f7128b5cde5f6b95130a6879dabe13ff3b33

SHA512
5766a3d01d45a2a6922b6ec164c5b05e80edeb2df1254b77e7a1b3ac895bdc29d2fc2cadc08382692a0d703a9d8ea07308139af43c112c95ea4aa627605557b0

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Command Prompt.lnk

Filesize
1KB

MD5
09ba72c44952a31064ec89625eb8119a

SHA1
7becd2440f4f4842e931dc0a89b8149c2ec7b77c

SHA256
fe913fbb460718490f2dfca52c081fb02249f09f193ebdf4dc9f5b7d8c41dba1

SHA512
482e39672822b729b8991b979d8fd5677532f3d7f8d617df5a658488709586cbb4c4734982bfb135c44fffd79a92c8b4033a4e8e53f38c3c8cb86b0b13de14c2

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Control Panel.lnk

Filesize
405B

MD5
aff91ed750d1043216ace3d7a6436451

SHA1
6e70143f3d63d8d0612674ead544c36a855b51b1

SHA256
902032a67e07e367779053f2efd125fd6ee19f7bee46c539afe594e99b6a988d

SHA512
65a6e50e59784dc5e601fef6da60d258c5e2d85276490edb4dbc9fe66f7e0849485ec308221219123038e42ae74542452e9a70297fa1287941922f6259bd95dd

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Run.lnk

Filesize
409B

MD5
fec53eb8a3b2a7a8977a97c64d3dbda7

SHA1
8691716090a50ade694456e3c555c68d6e928851

SHA256
b1d5c80457fd4de1d6e67441a986c2957c7f07ea332c27d4453d3832fc8e490f

SHA512
3ee8781ed4dc6dd19aa0756313d42dd6a617fda6ad4f6fad4befdd4a40b2847da552776cff9063779d5bb50ebd3f620fa4a528cdd871b19f12a282169e48835c

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\computer.lnk

Filesize
335B

MD5
a0c10f339ad7032b72de9e9b96dd9cd7

SHA1
1c30ab9544520d27e866dce6d10f0db963147b5c

SHA256
f54fa801ee976495d6822002fcf919c035189460618cba06eeace98d534ff362

SHA512
c57dd180682dcc5c0db3dace1552c0e64ccf12ddb3cdcbb40d9c8bdf1fe82f7c047b2b15a9f6c72f8c3cf77c8294b4ce31992b58e1d39dd666c15de1d6a36c33

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell (x86).lnk

Filesize
2KB

MD5
8264bdd7615a445fcb92d10f11839695

SHA1
db75032faad740e4afa328ea179a51aed2582dfd

SHA256
e91006ecbf43477de3515e9c43e7431c4b295902b8ba12f935d1d72fd5b5fb19

SHA512
661e26ca3ef4744db01ed84e4d6766ebb2b7ad5dae18a2ab372a73cb8c45099131cdefd30a185a6629a7cba49271c241b55a1a9d63865b15e12d35967c2b1a6b

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk

Filesize
2KB

MD5
3727f246702f9ceb16cde93a5b91dfdf

SHA1
0c6b8dd8855401e0f7ae46731ab273d5424d322b

SHA256
26c803846fbcca499fdbab2dd21b7c1c9ec46f014a36339213d10ab86a15d7e2

SHA512
7c6f00f4a71d36be62a575b9e8a1d9cecc7a713bf49d50d7c99b19a043665ea76825ae1c3e91b8dcea7d41d6242aeb792f5c7ae6c925a78fd7737517548f16b5

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png

Filesize
296B

MD5
de21c36b4a7062e5fc99082067391b37

SHA1
12d96775beda8c9124765d0b98e77cd3d282ee95

SHA256
5739cd84ecf323dac7c01ae5dcd580711c7e51c1d60a822485d067f497e3d791

SHA512
b4fedfbb28433872772337ee98d0cc13bd6e257b4b07f97dc8b6a92cd7c3aae7c8b77b5b3186d937e6f861955bfd911460ba53c3985f1f182c75f3919d14d884

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_contrast-white.png

Filesize
276B

MD5
1a40ea01e02a236b27e0dc3990b33b44

SHA1
6c7f1fd18073e0aa6577173d09fd08cce09fc40b

SHA256
9582664916d890ab1b412e063ccec6a3e4f49b083ba4e7f7ab0468ebdbb8663b

SHA512
4e2f3420e1d8bb1fdf4844a50d450539ca80f0e662b08e0d7da7c6c912e03afbec58c387b68cf4c18c13fe171453f6c7332ca77b601b3f1f594b5443c9e80e1a

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png

Filesize
296B

MD5
5b47e1281c8ea76f8a26b1c69c9fa30c

SHA1
21e9a843ed9e94565970c20ae44dd6940057ec3c

SHA256
4fe100f83afd2286baf8a06f8d2fc78c8eaeb6c4a08349e6a442ac068305485f

SHA512
d05786d606c065eb92a8a9d0c017674fc76187940957bac413121355440a88f06a29499fe6bbed37edf5696d7624760a4e60a75ce65a7376f277f54edb562594

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square44x44Logo.targetsize-44_contrast-white.png

Filesize
276B

MD5
2285cf901320d77d5444ff557d775fc4

SHA1
e143db1a794db0b729a23e07f2acc53b331229f8

SHA256
fce47a463f587e165e5be9d19fd7b301fd5c1ed5b6338b7993e5c5cdc19a96f5

SHA512
8e0db846c2d8bd7337057a38ba32559dcf5af4b2e1a3eeaf1a0f3e370ac80cc7515bedee396f36988cead3762ce654d2532990b9f0fcd1cdc7d0b89f7858c6d4

Download Submit
C:\Windows\WinSxS\wow64_microsoft-windows-onedrive-setup_31bf3856ad364e35_10.0.19041.1_none_e585f901f9ce93e6\OneDrive.lnk

Filesize
1KB

MD5
ae8dfde61f6f3348c1946866724b8716

SHA1
fb37a0b639e8c25ea19f4f0941f8dee8b3b44246

SHA256
d51ec6382ff98b361c91907b0231b23ac07e72b2cc206c9ebde164bcd32213bb

SHA512
2e818c6a4665461b6b4c8a9b8906084bfc32b3f3c59e89d6757875b070c5568d988e339aeedf812da6ed42140b03156ded827d525a94a262099bba1b78d0e540

Download Submit

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads