xorist | 3238992b0375e73f79fad977801a1d6e8a267a216e623aff0532e2edbab84bf7

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
29-10-2024 22:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
Size

39KB
MD5

7ce1f02da1a962576a25d42ae8420448
SHA1

e4707e3fc45a5a697305457af1168497daf0078e
SHA256

3238992b0375e73f79fad977801a1d6e8a267a216e623aff0532e2edbab84bf7
SHA512

a6b50fc80a91dfb7db34a9df037c7d29e0ce06ce21ebe2495ff83c04bcdfccc4fda2fba4ea0d5b4e0e24b8ed1ff80cd99090462f43e1a99301f95c9685045ed3
SSDEEP

384:tebFNw4Pk1itKkpAjjalr+PqYvjSXkDCgSDMB:t0FmBkpKjKY7/DCI

Score

10^/10

xorist discovery persistence ransomware spyware stealer upx

Malware Config

Signatures

Detected Xorist Ransomware 3 IoCs

resource	yara_rule
behavioral2/memory/3604-0-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral2/memory/3604-5930-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral2/memory/3604-11155-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist

Xorist Ransomware
Xorist is a ransomware first seen in 2020.
ransomware xorist
Xorist family
xorist
Renames multiple (2172) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Drivers directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers\gmreadme.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lBxOMYQ1FP9x2q4.exe"	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\FileRepository\c_keyboard.inf_amd64_56ea9763e933f7c5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\InstallShield\setupdir\0404\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\migwiz\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\default.help.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\winrm\040C\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\wbem\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\1394.inf_amd64_a08737ea39f5790b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmcpq.inf_amd64_3acec385f5d67bdf\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmmcd.inf_amd64_43b149b35876b241\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netvwififlt.inf_amd64_c5e19aab2305f37f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netwtw06.inf_amd64_2edd50e7a54d503b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\en-US\Licenses\Volume\Professional\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\IME\IMEKR\APPLETS\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ProcessResource\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_RoleResource\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmbtmdm.inf_amd64_9e5602638617558e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netathr10x.inf_amd64_2691c4f95b80eb3b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\icsxml\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Speech\SpeechUX\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmdyna.inf_amd64_d89605b6b478d768\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mgtdyn.inf_amd64_a6235e923dc4047c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_fssystem.inf_amd64_89e15d7e662d6584\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\idtsec.inf_amd64_9321d33f1997dbfd\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\multiprt.inf_amd64_a9b96d6c7813082a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\MSDRM\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\th-TH\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\digitalmediadevice.inf_amd64_5b64b65052c3a32a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\heat.inf_amd64_b73306c081719f1f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\microsoft_bluetooth_avrcptransport.inf_amd64_6506aa4ac05430d7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\it-IT\Licenses\_Default\Professional\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmsun1.inf_amd64_5b6db32fd04403a3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\msdv.inf_amd64_5c153f7ff7d0d00a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnms004.inf_amd64_c28ee88ec1bd4178\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\rdlsbuscbs.inf_amd64_0eb96a1741539c14\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wstorvsc.inf_amd64_50cb8ebb1c9584af\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Speech\Common\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmaiwa4.inf_amd64_b74e18ebf47de72a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\fr-FR\Licenses\_Default\Professional\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Dism\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_linedisplay.inf_amd64_a720ddb820f10790\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmvdot.inf_amd64_04863374c9db2052\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\wbem\en\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\MSDRM\MsoIrmProtector.xls	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_nettrans.inf_amd64_b6d30279f382fa4b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnms002.inf_amd64_2176cc45624119a9\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\dc21x4vm.inf_amd64_3294fc34256dbb0e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\tsprint.inf_amd64_6066bc96a5f28b44\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\umbus.inf_amd64_b78a9c5b6fd62c27\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\InstallShield\setupdir\0011\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Speech\Common\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Dism\es\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\winrm\0411\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\sdbus.inf_amd64_55c0c78952233d0c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\MsDtc\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\lsi_sss.inf_amd64_503a2398f4c86893\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmcomp.inf_amd64_bf289615d063c627\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\printqueue.inf_amd64_12d9f43eb5d02987\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Printing_Admin_Scripts\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_PackageResource\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmsmart.inf_amd64_3ca4b12cda56232e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\migration\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3604-0-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral2/memory/3604-5930-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral2/memory/3604-11155-0x0000000000400000-0x000000000040C000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-36_altform-unplated_contrast-white.png	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\EmptyShare.scale-125.png	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\Weather_TileWide.scale-200.png	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\people\kennethMarchand.png	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\SmallTile.scale-150_contrast-black.png	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-24_altform-lightunplated.png	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarAppList.targetsize-64.png	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\hi_contrast\core_icons_highcontrast.png	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\CP1252.TXT	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Examples\Validator\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\StoreMedTile.scale-200.png	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\GenericMailWideTile.scale-150.png	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\sv-se\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\it-it\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\LockScreenLogo.scale-125.png	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\locale\de\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-32_altform-unplated.png	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_split.scale-200_8wekyb3d8bbwe\Win10\MicrosoftSolitaireSmallTile.scale-200.jpg	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-Advanced-Dark.scale-100.png	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Car\RTL\contrast-white\WideTile.scale-200.png	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Place\contrast-black\WideTile.scale-200.png	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\System\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\da\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\MixedRealityPortalAppList.scale-125_contrast-black.png	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\DeleteToastQuickAction.scale-80.png	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\StoreWideTile.scale-200.png	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\progress_spinner_dark.gif	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\rhp_world_icon.png	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Assets\ImagePlaceholder.png	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\MixedRealityPortalAppList.targetsize-96_altform-lightunplated.png	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\Assets\AppIcon.png	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Images\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Square44x44Logo.targetsize-40.png	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-60_altform-unplated_contrast-black.png	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\Assets\AppSplashScreen.png	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\de-de\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\pt-br\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\themes\dark\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Program Files\Windows Media Player\Skins\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Thumbnails\Sticker_Icon_Sand.jpg	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteNewNoteSmallTile.scale-125.png	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\GenericMailMediumTile.scale-400.png	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Exchange.scale-250.png	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxAccountsSmallTile.scale-100.png	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Collections\contrast-white\WideTile.scale-100_contrast-white.png	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\themes\dark\[email protected]	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Configuration\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\ar-ae\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\vreg\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Program Files\RedoConfirm.mpeg	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\ar-SA\View3d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Win10\Classic\Spider.Large.png	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Assets\1x1transparent.png	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\LTR\contrast-white\LargeTile.scale-200.png	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\de-de\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Program Files\Internet Explorer\SIGNUP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\eu-es\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\uk-ua\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-30_altform-lightunplated.png	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\subscription_intro\auto-renew.png	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-80_altform-unplated_contrast-white.png	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\EmptyCalendarSearch.scale-400.png	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\WinSxS\amd64_compositebus.inf.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_f371abf5687a70a2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-onecore-unifiedwritefilter_31bf3856ad364e35_10.0.19041.1266_none_9e165130188df1ee\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-b..onmanager.resources_31bf3856ad364e35_10.0.19041.1_de-de_f449f22ccf00d90c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-p..ne-client-overrides_31bf3856ad364e35_10.0.19041.1_none_e861ceb4c1ca233e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-iscsi_initiator_ui_31bf3856ad364e35_10.0.19041.1_none_9830e2872fd0279a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.Windows.CallingShellApp_cw5n1h2txyewy\Assets\Square44x44Logo.targetsize-72.png	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..ty-identitylistener_31bf3856ad364e35_10.0.19041.746_none_5775da15bab2bf7e\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_oposdrv.inf.resources_31bf3856ad364e35_10.0.19041.1_it-it_a92e7ab35a946fc4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-s..mmoncommonproxystub_31bf3856ad364e35_10.0.19041.546_none_555b2ae6e4aec524\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-kernel32.resources_31bf3856ad364e35_10.0.19041.117_en-us_1b3572f483fa94f6\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft.powershel..er.events.resources_31bf3856ad364e35_10.0.19041.1_en-us_f362bacdbd28480a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\diagnostics\index\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\aspnet_compiler.resources\v4.0_4.0.0.0_ja_b03f5f7f11d50a3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.Windows.FileExplorer_cw5n1h2txyewy\Assets\Folder_Small.scale-400.png	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-onecore-u..iedwritefilter-mgmt_31bf3856ad364e35_10.0.19041.1266_none_41843efc8f66bc7c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\WinSxS\x86_microsoft-windows-i..ngsupport.resources_31bf3856ad364e35_11.0.19041.1_de-de_1b967932deb206df\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-composable-dragdrop.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_7ed5bf8cb31844c3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-onecore-actionqueue.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_872e160db4fcdc17\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..ets.icons.searchapp_31bf3856ad364e35_10.0.19041.1_none_ceba36fd1b479c4c\SmallTile.scale-125.png	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_urschipidea.inf.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_b60e70a87cd6e8cf\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_usbxhci.inf.resources_31bf3856ad364e35_10.0.19041.1_de-de_8317c55c86519429\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-userdeviceregistration_31bf3856ad364e35_10.0.19041.264_none_018f871837d42eb1\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\WinSxS\x86_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.19041.1_fi-fi_5b82975c7223fe3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-magnify.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_4e00e12c7ef994d0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-mfds_31bf3856ad364e35_10.0.19041.906_none_83b2e84f7c2bdfaf\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-directui_31bf3856ad364e35_10.0.19041.84_none_b8edbb3751142b20\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\WinSxS\x86_microsoft-windows-msmq-powershell_31bf3856ad364e35_10.0.19041.264_none_4ac5a50efa7933e4\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_windows-application..meventsbroker-winrt_31bf3856ad364e35_10.0.19041.1202_none_760613fad0044db4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Windows\SystemResources\Windows.UI.Shell\Images\RequestedDownloadsCloudIcon.scale-100.png	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-f..emutilityfatlibrary_31bf3856ad364e35_10.0.19041.1023_none_c339a4230ee91273\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-n..datastore.resources_31bf3856ad364e35_10.0.19041.1_de-de_9432e090e5145c90\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft.secureboot.commands_31bf3856ad364e35_10.0.19041.1_none_ee2b16a5c323ae23\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft.workflow.compiler.resources_31bf3856ad364e35_4.0.15805.0_es-es_e1e4390e292b1291\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_product-onecore__mi..fp_hf.inf.resources_31bf3856ad364e35_10.0.19041.1_it-it_eb67a732d90cd35d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_windows-id-connecte..r-wlidcli.resources_31bf3856ad364e35_10.0.19041.1_es-es_c960d50c0d30130c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-i..codepage-additional_31bf3856ad364e35_10.0.19041.1_none_0b4e711bdf4c1580\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-t..installer.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_bf9e775f550223f6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_system.core.resources_b77a5c561934e089_4.0.15805.0_de-de_7dc93d3f48b5f3d3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\WinSxS\msil_system.componentmod..notations.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_48df6cede5e85063\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..mcomputer.resources_31bf3856ad364e35_10.0.19041.1_de-de_6827432ee2e4a158\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-t..phoneutil.resources_31bf3856ad364e35_10.0.19041.1_de-de_447fdb256213f95e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\jsc.resources\v4.0_10.0.0.0_fr_b03f5f7f11d50a3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-l..ker-winrt.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_5b7e9f5b93420189\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-devicecenterdiagnostic_31bf3856ad364e35_10.0.19041.1_none_c2a7679e74f61c19\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-g..enhancementoverride_31bf3856ad364e35_10.0.19041.906_none_0e7903f268dd7326\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.19041.906_et-ee_1ed1a6cac19c067f\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_en-us_a323edc73bd86475\PhishSiteEdge.htm	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-n..omain-clients-netsh_31bf3856ad364e35_10.0.19041.1_none_baa8000b182fb17a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-wsp-fileserver_31bf3856ad364e35_10.0.19041.1202_none_ae02f5c0bff8da39\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\WinSxS\x86_netfx4-installutillib_dll_b03f5f7f11d50a3a_4.0.15805.0_none_4e21a5685361a7d8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-a..ence-mitigations-c3_31bf3856ad364e35_10.0.19041.546_none_ea1d7fbe5119e8f2\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\alert_lrg.gif	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-tabletpc-softkeyboard_31bf3856ad364e35_10.0.19041.173_none_af877ec0b0472fde\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft.packagema..agesource.resources_31bf3856ad364e35_10.0.19041.1_de-de_653fc8b4a93a0062\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\WinSxS\msil_dfsvc_b03f5f7f11d50a3a_10.0.19041.1_none_26b5e44019fe7ae2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-b..isc-tools.resources_31bf3856ad364e35_10.0.19041.1_de-de_f0470ef9d1b74408\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-i..l-keyboard-00000411_31bf3856ad364e35_10.0.19041.662_none_cf765fbbf77baf4a\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_dual_msmouse.inf_31bf3856ad364e35_10.0.19041.1_none_9982fe03ac22a90a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_netwns64.inf.resources_31bf3856ad364e35_10.0.19041.1_de-de_49daefa2efc6e8d2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-d..ic-module.resources_31bf3856ad364e35_10.0.19041.1_en-us_4273e4a0998798c3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-o..-adapters.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_747bb9c712f41663\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-composable-dragdrop.resources_31bf3856ad364e35_10.0.19041.1_de-de_a714a15d06f4399e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-microsoftedge_31bf3856ad364e35_10.0.19041.264_none_ef195f564f00d259\NewInprivateWindowIcon.scale-200_contrast-white.png	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_system.data.services.resources_b77a5c561934e089_4.0.15805.0_fr-fr_4034bb77c2e6c27c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PUIKXGMFZDHXQIU\shell	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PUIKXGMFZDHXQIU\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lBxOMYQ1FP9x2q4.exe,0"	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PUIKXGMFZDHXQIU\shell\open\command	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PUIKXGMFZDHXQIU	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PUIKXGMFZDHXQIU\ = "CRYPTED!"	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PUIKXGMFZDHXQIU\DefaultIcon	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PUIKXGMFZDHXQIU\shell\open	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PUIKXGMFZDHXQIU\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lBxOMYQ1FP9x2q4.exe"	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Hacked	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Hacked\ = "PUIKXGMFZDHXQIU"	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe"
1⤵
- Drops file in Drivers directory
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\aic_file_icons.png

Filesize
50KB

MD5
55807cee01feec9f2d6a44b1defa9b97

SHA1
792f69e0ca4da40a643ab3ec08c8f2e6674c8c02

SHA256
87f6e02a07abf1175727b4ff77b43ea925ac8eea3413d13bdb31ff3e2a191ce2

SHA512
d5265454f8b63f8e411ec0abc5b224760ab809537351dc5b4851eba50b273c578a6f3bf97a297cfbccafad27dbec9a0bc35a01e6b8d7fa69d9622a89ad11f93f

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions.png

Filesize
1KB

MD5
92dfd01890b8a7b3ceab38d114a60f50

SHA1
9c6d85dc9a32891c01fabe55ee01024e1065305c

SHA256
5860fcfbea7714c3a367056f69081c6dc6103767511a38f28f96e2685a1902ba

SHA512
5ecbd561de03d6555bf4793e7b199f5e25591794631ba1a1a61711d0cec8210c43a6b72cc0057b0b6230d61d105079dcea251daa1061727f7e5f1a5ed6de3652

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions2x.png

Filesize
3KB

MD5
1babf239c2f27e344d1de5c81c35d641

SHA1
3c075c0a09d6b115371de38c813031ee4c2f6f30

SHA256
d9b1d7105192469821f78f1d6b15d5bb46748d59b91e1f8796b088a8e3e5e9a7

SHA512
7a763de8501b0d771e8166604da1a99e7b0bd5e063d09e45d5ba8fc7fdc8910b4a186f1d360ba6c8f6015e1d6770be1cd0dcb08b042cdd1b39860da745a3fd86

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons.png

Filesize
683B

MD5
3599400e004589b907945be954296545

SHA1
b6c4e9fb173d4ce4c7c4aa0eb7e41f2c0fa2502a

SHA256
6e998b08820928d9c21a0ae8a437a439cf6a54f65acf0a6c4b695874e90c7c02

SHA512
d2bc201ecc917a73fbed12d2522ab45831a3ca236f8034641045559d7404711e9b0e9aa99e848566090d61779807c26b64fb35a32afc20d4f8a7bcf57522ecb4

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons2x.png

Filesize
1KB

MD5
4c02c92b32f60a219c326d5c4ff26ad1

SHA1
9b6579ced7bda7b6a2d23412a13c47682cc65565

SHA256
5097f94f3d9c99093a0073420e8f043d46af4e784c94340d074c41314cb53ce5

SHA512
473a8fc68c0c563b74aad0c75d6f9bb5a71656ac46febcb03a65f8e01acc887052837d3fe6ac938098b8f5b9e70854f2d7f995b35e00eba1b7625aa5c924d981

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon.png

Filesize
445B

MD5
48b29aab5ead96a16be1a5bce787b837

SHA1
96819dad8b2d55586fcbc2d11a42645d19d1bdee

SHA256
c7fa6127d93f93f20af0e4f6728c0d42652dc322ebdd3f765a132a3d5c63e666

SHA512
ce6b1bc924245b63797f9264e373e1ed7a53fe88468c3246b739957aa132901c45c38e9e2528f481210891a3499568c5ee1718043ac9b5fb9948c57a0439318d

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_2x.png

Filesize
611B

MD5
1046dd20517ab8778799fc61288aafa1

SHA1
d2c29efa2aae6e1e3945efa6a66c882b9701001f

SHA256
24b0e4bc0c08456d831044fe8f1358d1f25b72ef4b090b9612c7f46d8de180b6

SHA512
b0e039ca39a33d5164c514ecb3079132ca3eff34446983371e13ac357a0f630a97f0ca6e2091eed08499e031ee6a2358f0c1cfc99e37860fbab57323893ec092

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover.png

Filesize
388B

MD5
f331be2f928dfc04b869aa70c68a819a

SHA1
cf57ee8d8cf34f6810a0a2730afd56286f4055bc

SHA256
b5c12dd5c606a37150593e94aeb85c4f41eda23955c33ff54d75ec5b06e13f0d

SHA512
adcda75aae82b8f56ad61ee8f87c27c9794eac523862adbf010115c0ba867ed46549a4557b093590b2e819600fcd144b3c933646f1b796099e2291e2b8f0fec1

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover_2x.png

Filesize
552B

MD5
d8ada906a1b9cc44c5784796861ec1d4

SHA1
fea45dc13a1d664bfb66d9a16793904a84f828e1

SHA256
dbc93c5aab9a6a9a9a0865bc6933c114f1412c169a8baf2f5e9feafc5950a5fd

SHA512
758b3360f0d822b6237cbb9ed4684cfeaf3c0aa5ef612c306ccbd1747da9ba0b05008ef5a7f848ad2151c0cc15b14edf5821a023c85019c86448d8eade7fcc02

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon.png

Filesize
388B

MD5
c681073334f59ec5066d234ce12e397e

SHA1
9fd16c4325bd6ddcf62a8389603f369dd9b7bc4e

SHA256
d3dbfeeebe03a4c213da425d97c398bdc45534f5edeea2f5fe51f64dca289a8e

SHA512
beb65f0f52c98ca71c0031a38b0c3ea0f7255838be95e1045a5fec369c124c2005603da15a2508c696bb8432ac20c38eccdb8bfb35a0e6042d5b53bfdfdb9b96

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png

Filesize
552B

MD5
9c42dc711a39ab70c27c111655f63852

SHA1
a7394b26a65659f096eca7adc648488ec0548827

SHA256
a1f5497fa7c907e8735755a14b32cb1cc925375e6ec03ba78e8892d94e4e229c

SHA512
61c7de277826d04828ac70bb42677d025008cbfa6e2d62a5d580d6bb8edc166be23241b93c9e88fb53997fe7cfaf79a408d1066913fdeb815b0decbfb8782cf9

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png

Filesize
388B

MD5
9a3904f5887bb1e68efc00efaa830002

SHA1
0f87122317c49d3510e2977d0274e72de6777831

SHA256
018d08939def1bb24c23c6d2ed210ed3ea8b4991f143b36f974da16a7c425e17

SHA512
3e693260cea453fadcf81b3095849c91137e04a8dea856b8691c582a1c554308abee610bb1cf9dbefe78b2a79aa978be0590925c4bbb7cf84053342ec2cc0928

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover_2x.png

Filesize
552B

MD5
5d8adefc08c7420f1f32a26cdd45e599

SHA1
956761fc49ad4f94118a06eebc04d2c815313c7a

SHA256
de1f045659c015098c47bf42bdf697eeaba25d0799b94fe78f04a0ee93fb6d1b

SHA512
52d7bb5c60e64df9553c0567ee2b87f3635a209653c3ab60b77f0e38377c8e995b4437d47762d84f1d17837687a847dbd5735779e91791418b712e918d5cd1c3

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons.png

Filesize
7KB

MD5
af2661b4d859c983076dfb86846f2b48

SHA1
f5f32bd57dfad3a79c2681816e10266b367a521e

SHA256
59569311eac3d9afb7afd1848a3f5d166482f61aade84b5dd99c80d62632f8ba

SHA512
8968c0277af72f0e1680fcd1581cbce303c9b18ba16683c23523a1cc2ac27a77f276115a7d8f08ce633c79bb4b2325e1f69c098b97fc8f1ec396ea58f65f1d05

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_ie8.gif

Filesize
7KB

MD5
ca27ea7263d49d1c772f6c286266c752

SHA1
63caae4b4d48bc08c7e0055c6636bfdcf11bf7db

SHA256
48d635ffe29411b04c2391fcdf1589a761f6f49e8697c6a0115c77d9ae312749

SHA512
2d0ae79f6c12168e069c455d4af438c70b1b8d46ad56c465974ac94f224bce74d56fb11a32228abfcc12acdfc0c8214b30b106ac2fb2e451076eb2e4ef301be9

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_retina.png

Filesize
15KB

MD5
b453544b75bfdbd4d0c382361c8e61a8

SHA1
5fdd820000ed03dc6fbfbfe807894f029455bed4

SHA256
a5ef1af6921e2092659085ef702545798b45a335d3f50ab9fa226fc61612255e

SHA512
aa93d14fd00c9c890d3975f50048d6d10c4753e185b9799ab8a4e022fb4b20402c32435843adf209a998bd466dc4dc67d915155d4af7109e44dd613fce40b437

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons.png

Filesize
8KB

MD5
b871191aa6ae090dd97d4728d435c9af

SHA1
ff0fd2c07b9e2ab3f0f1ef700f748f7c3b3ed560

SHA256
c2b1242ab425030ab68661e28fcae8b8c4992f37f7fcf5fa96d769089d8d5455

SHA512
7c3f5962ee92d59d7931b8df19472e0cae0e42cbbefb6802bcf22f89c051feaa542b7c4de99a372de218fe31d62038485d698845b2d4583678bf26a31965e87b

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons_retina.png

Filesize
17KB

MD5
6b75b05453314e6c0351826399e32087

SHA1
50faf31002b5be8954e67b3a2ab82f216d94858d

SHA256
cddbe86e994e8f60c6d503367c347fcdf7f91c42f826747301b56d78fd91a789

SHA512
e80d18d063d1477641434fe238aeb3d31bb84ea9349d51ee000b5fdb2437d0d3113371948cf6f211c76ae5eb26a65e0d6f8b6c687b87a37c5c501f5868e58356

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_pattern_RHP.png

Filesize
179B

MD5
762022bd6d069649f00293239add3142

SHA1
6a8d4ab531280e5a8ad0de2cdb69f6e09d4a5e5d

SHA256
34b4307b9f8f2d17bc7a96b346257ec2046ec3620b8d39e604f902f6e1ade4d8

SHA512
9b8336559b62937517370e5d07336560d3522d569dc11b44f1358e5386ea82a3470ee0ecac34142d31c69bc861d6d666bee203791212201d7bacd62649c3c761

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_patterns_header.png

Filesize
703B

MD5
5a42a61fb1cf31ccb75690fb017ec62f

SHA1
f77da060cf1bc4c91fc011e691dec4b17a3f1328

SHA256
ff4fcf3e4eea40901c83fa599e91ead28cd0b244249697805d4c94f220d4aa02

SHA512
5da2b240a749d3ba4c3bcb889d32a461a3547468993766f4f8407e36de47a76af9e4dbe39ef04ad249fe9fbbb1af2a7026e5ab8f2c124c45b929dd9750a35ab1

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations.png

Filesize
8KB

MD5
1c70281d601806d42bdb48d3ad4bb55d

SHA1
06e2251b4e50cdcf53641523f645d23f614f356f

SHA256
c45c6d4abc4dce09bab9d955e1c044f391a3502545eec5f6c8e3874ece56e0b0

SHA512
b06264646869e08d53530c5d5fc6dcacaac62e6059b7e63af361b867cd9019496afc13b7321bf1014234e0e65ec77542c54ad27ee1d00881756869958c374d57

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations_retina.png

Filesize
19KB

MD5
067209406c1e19a06d160c477058d48e

SHA1
d5e75910957ace862679bc841443e5baa9b6c3cb

SHA256
41927dff47730eb0dc6496a5f5c39c63e093878ecfedcf34a8565f1ef3358b3f

SHA512
c4b9f58224c931518663ef201fae03caca64dc27537c33d30fee28fe07eb134a486a0dd78895c0b508d909a9b1df808695c9c74969b4dc7d576cc6afffb1fb21

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\faf_icons.png

Filesize
6KB

MD5
03a0ed855fdb11f6525029ebd5997361

SHA1
d64a9938e20ce583994b3efd2680351c05d8e28f

SHA256
6b397b0b110948a1e1f65e97b5b801ba525625ec38fc1cc97f4302a1b9d9a6cc

SHA512
193600d839d0a8e7a36dfe87f16cac0f64313649f84ceb65e1c1956fea6d2a7d89b1987c061cb40df46d7f09651b16bdabdca617c403f314cb2ff1d342e594d7

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\bun.png

Filesize
2KB

MD5
e096bc4103c399bb663d007b6a49ad75

SHA1
581dcef5332cfe195c8a3a151a125fd31ab28b9c

SHA256
b8d2afb51e028497ec9621963dee747006236711aa4cba6f801b9e3049c122da

SHA512
5e5db726187b82f6ba1d0e7cf89baa121277573ba0fdc98913cde54b402d81d93ee6b27da99230f8911eb12eb963ddc247a454f236ae9bb5ce6e4a4aae45bf70

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview.png

Filesize
2KB

MD5
1949423633264ddb5e6e1277a6ce9cf1

SHA1
b4e745fd2909e9e2c74145286f8ee22b447bfc86

SHA256
df75183103d5f47d70a57f2317c0c2e2a00a0d0a2f8bbbe0c4601360a3e67ac4

SHA512
02674473ced0af5dbadf29163c6bfd0fad27a32bdf5e936f42d10f30b3b32dbb76f8e1621496a14a700e10c46ac68b2b05fa9671866f76d6446d0afbcda9759b

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview2x.png

Filesize
4KB

MD5
61989c104e464dc37aacd455374fb50c

SHA1
3d4286c9d6aec20a9a24adbd1e1bbfdd435f7e09

SHA256
004fe4ffa2d50a63487f3d3686ef5a0acbfb5aaf5fe3bac98ad8e52f9142c581

SHA512
d459689bd8616482cfa64f738983438c557cb70d0e79541e3346f9aa3ac5219bb798057effc94c62bb308fb436dccc586b4c2a998752a162fee66aa5c122800c

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small.png

Filesize
289B

MD5
a29cc223cda67c6b8e7a674fb138397e

SHA1
a8833315292a1a4a38e97308ba25f54b2ceaa223

SHA256
d227b208ac4c759fcb1ef098fd7a0fcbb8957786ac361633b8a2cf7041021933

SHA512
57779dcff82c12bc47619ba0a1d0524145e11dc4c8242767adb0595d36ffba76da9261bd24f4fb7f2749220223de7b18bdc3dc2e54d293e59e6ac0ea8164827a

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small2x.png

Filesize
385B

MD5
bcef8c2df05433890f9301c0b6f4d2a4

SHA1
59b85e908c6b50ec9271cd5c6282f3e3a3fed506

SHA256
62929269ac291c9b3f58c441d80436f15c9439175cbaadc98a1bbc48e8885d13

SHA512
49121a0d6d4493c2a28aa45af4e4d9ca680cb40f994561048836b2ea8fd6415a62a8e70efcaa9ea156e2c34c821b57ead01e8a721af71ed6bccf658d7f06aa55

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\illustrations.png

Filesize
4KB

MD5
00c30dad1a7687f5d8b06a1c30f96428

SHA1
82fdfc5d55005ff6df1ff057c3675ef2e5d919f3

SHA256
f3398bb49de72ad4e705b5c2d10255b51091fe48b3e932e751dd4795a0d595fd

SHA512
11eddce3b174649d8b98d182bbd52f9da725b77738aad814cab5fe87566a03cd7b001c77c4d881a0e7587ee6188ab5656537aa411d0f0ca088787919cb10d224

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\nub.png

Filesize
1003B

MD5
686ff3d5c10b2e6240791674b4fe10b5

SHA1
bf2520c0c69d7080a8baa09ae610597c0bbee5d9

SHA256
57e4ea67c26d2a50c3f5ee602441d77e892225f2094619e2e02ff627ac89a181

SHA512
f1957fb8dd1d5813078efb58d94cd1a4d59bd396823a6d865798658581e263b4886baca8000c1dbed5f222c07599a9a39b5e3bc37e1bd7ac6cd006426f858a1c

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons.png

Filesize
1KB

MD5
44b5e26263280ee8457220ca5143350b

SHA1
0cfbdba8f702d4ee957f235fcd92ec34107220fa

SHA256
b79cd9462265c7a4e6d1fcf8363232c1a2ec09350987bbad01003a53372527dd

SHA512
3d879229999e0f98d8cb1b47eac85285e6de8f385c8fbe44ea67884bff6de7e7cc014a91e8f1cc9c1a90be746f7c069c32a8e4fd8f638892be9b6d2d711933c8

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons2x.png

Filesize
2KB

MD5
c75d06edf2ea591de6a6f4dc92ad33a0

SHA1
5b67464995b52688acc975d23a63dd0913f2f9d1

SHA256
d18f157f751db56f5ad19ca4bc70678283d4ce5b334095f45438948373a92715

SHA512
e4af307cd1e04bd7105990177aab240227aab1ad73f8e557b242f53e998d3b2a5822ea9e97e89c6b4c60dcfd3a062e902bf993a9c23839834e30f4598fbb03f8

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adc_logo.png

Filesize
3KB

MD5
99fccc6615a40dda75890adf460a8f34

SHA1
cf68476d4334c626f231dbf2ae6c944d249a7311

SHA256
e5053815286840dc607a54493964af02d26a630e983bdbda07663900edcb1c18

SHA512
4c7415ed3000ea446ce39d50f841c10c571eceb48f635929f91449b44e906f9cd41827847a346b90e2e38fd0559dc7821495227ae817ec0f3367d7e925941bc3

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adobe_spinner.gif

Filesize
556B

MD5
9fdc579dea9fb24a59d61bfbb117eea0

SHA1
8e8fbe7b99ac4217be66c9cfe68316d5d11c4dfe

SHA256
3e2ad4685decba2086664b8bc34ac032669aff4920c5a0cb4885335cbe0482e3

SHA512
d12cc2173d5b696834747f1d2297dffaa3585baf610439d302982d89e410189c0c8a70a540a762ea4c301fbbc88506ed2c3fe0ca856692e793ed17e71f36247b

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\logo_retina.png

Filesize
6KB

MD5
35fad131ff6f5f8197473fbda89dd9f3

SHA1
5ad7551a9a658e56c6ed069496e1a8b81f91e2e1

SHA256
4ce54c7cbc14048dabb7288b971f317b40507d2fe58c7f554833305d6701ccb4

SHA512
7142a1e52d2444326cfeebf0fe93812165fd27f68af5794e593780f5f2b3ac7476013a05d4bfebe48e7916479ac4df957ff63d10935f0c7c40be2b802d5a8ba2

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo.png

Filesize
826B

MD5
c948e81a85156aee1cc035a7cf60ef5b

SHA1
ac1aaad1f83cbeb49d8d70b6b407b6fd23c649e4

SHA256
5f385b415f0c877245549cb976291cde1527c075603734a95509679b1e722edb

SHA512
3ba24733c52263994b1acb66c5e871dd46c17001bba49341746e1acc968e7e0d0a7e6e35d26092239ca506707e425d5877262836e6299f0581981afa62175a38

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo_2x.png

Filesize
1KB

MD5
aa4531ee2de889c3c0ada98d01e2138a

SHA1
873e716c2e7b1d84a50a5e6a4baeae4a1f5c4b36

SHA256
ce6e50e28712669bd2877b1de7c6530e12ab0ab47bb5cddd413b00501167fcc3

SHA512
950835350b8c9b815f41c14dcf93222d49da1871ea93d29b023d4976367fa22cc48e6fbfca4b74e846383c2dc235bae7dc438ac7fa63819eea41477aec314941

Download Submit
C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB_EURO.txt

Filesize
32KB

MD5
ba84e13552267058a180487fd7aa0a53

SHA1
c1e615fc7e176f76f3f311119dd179f91cf47a6c

SHA256
676b434bd2bfea70106f10a777dfc92ee3b168eccfe80da19e4da2cf0a937c20

SHA512
a63a590d4ff5245abe87790d33fe205abea05ea4d1bde4f6c0d71b62d9c2ab126fc1110d96b174d8e1e1646f3a0b80a996af40bf3c1d641523f60c4a5a595930

Download Submit
C:\Program Files\7-Zip\Lang\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt

Filesize
163B

MD5
14fc5620af59c64a6e1c57c01f96edcf

SHA1
6770fc907bec6411f59ffa5c0f3655a4955347c0

SHA256
225111917a8cdd942a5ce1306334750b9127dfe3f8b6546d860d694c83176433

SHA512
e45b29fcdf90eb33ed13b17fe89d159a17fca9a1ef1e71dff375fc47fd30430a2ea1f5153596c20eccc545386880175ad34cea7536560ab31fb09efe83288607

Download Submit
C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif

Filesize
153B

MD5
71c73d53f5fc9369eff969b7444c7dcc

SHA1
e9684207108ef7e7e0a6414ee92ecbefae47367c

SHA256
1cd3303f3a415dea64a8b03c40dd9dd2c5354b99ab11b4e17b967dabbe2dfc97

SHA512
47d5a9302cd6ba3f895f88249763bd955b5ac0ac17a4f63600e69f7ed1424eddb821bc77259e3cd6b939dec0283e1a1fffdf02aab196d0b793fdbf3d52c38b6d

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt

Filesize
190B

MD5
d269091f74fc3ea21b5d8296b1ba565e

SHA1
b9ccc38764a5347c3d379b57fad7bacb285cd5bc

SHA256
3f27f6308e9561f99566d97496aed10e20997be572fbb60738cb935572ee61df

SHA512
66d4377f5c02085c93e218bec2a936456d0274d0565a16677760bd29533c51aa2d75e7cdfb459f5ff801f24a2ad648ca84ff1a3df2e2c32110d333d86609706f

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt

Filesize
190B

MD5
9ad66740ace2a9aa7208c95413e71286

SHA1
0b08fda22244582e75ef6a8a8f31733c210fdab8

SHA256
0d3044521d13d057b703a3150a699170990db0e4a3ba03970468dc2d1b24a090

SHA512
99b025bf97f6e617532ed4b37e161ad298d439b8d326d52e4674ba542171ff90e9da169ace13fa6ebb6be691e31ccbcf7d9ed94924901873ef67637a71a92281

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md

Filesize
1KB

MD5
ed60280dc9cd03db491b7405af0fec8f

SHA1
58d03f7ddd689b77661a05c677ff6257b5a97d37

SHA256
f46f5e5d7ea852cd90440b960e95179370a763eb2ce1a3e4eba01ef55276bf77

SHA512
f99cad807c12ede8dc9ce296bf3594f8a11bc321bca208bb8e43d42e06832245fa12615538691909f7429e081ba80558d604872833496107c45f2af3df0d4665

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\glib.md

Filesize
31KB

MD5
d617f0efe284c75e8c2da960d1de427d

SHA1
3081252fd0c1bcef3f1a288e041d036d02c549a8

SHA256
4e79b67f873f3f4be5e717a26a7c57ea22abc9332a29118ae323722a17e95953

SHA512
ad034d2280a4483534c557502705cdb7a1a62ebfb7781110948e865c2879dc754213253e8730972eff99f1f94777c51206dea6793fdcca80f59232223a319e05

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md

Filesize
34KB

MD5
6d68a661dcdde41496a59af506d4fda4

SHA1
8bf9b6dd819e3ae3e4608abb942f180234ca68d2

SHA256
efe8542090311a352c6a3e4b4871e4377c6307d81a856c04d6cebceb27cdeec8

SHA512
fdd58a80bc6fd9afee2ca8a47dcd366c99b9ef39c701c5f96169805470c6fda7ec0cf9ff53f48e3405db215fe3d95a7ddb103a1db7ec5cf5675c1f705ea36c55

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md

Filesize
23KB

MD5
bde9021c4dc0d2c3e5d30bc01daa2f9f

SHA1
3db736b30b0b014637b18e4a282c73405fce3fef

SHA256
536651e58a3c86b4563772e72ecfd03ba3c7635337c4b3a8750de02920f4d8f1

SHA512
3d9f2175d536c5baa789cda511fbaaf255e7f9bf68de73f90c2d473b195b233e42b8c8181aa9924f9763625e717a526dc38c4e81b3085d059f26ef17f8d0d5fb

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md

Filesize
2KB

MD5
4f6306f1b1046f071c453919d27dc54f

SHA1
088b1c0f3bdb2229f014e67a21657698b3c13906

SHA256
0723a073bfbef4cbab39c3dfd8a3dfaa2be18c17dfb9dee9e1049431725639df

SHA512
b83be0407a6853b8c9bd2ca7886c6adadf406a2e773c2df9543506964bce73700d023ee55b03f1bb53eb813db01d915ed9f07983fd319629002e397bfa373abc

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md

Filesize
1KB

MD5
9538defb00d0bfd9938479a911cb6477

SHA1
e640b533de454511dc70eb2cc1251d73c6537e55

SHA256
6aeed16180c557bc2f6a0cfa8656783a2486d7e33e5681878fd798e9b12fccbd

SHA512
30ced24e6cc827500bf542223dda2ea913b301d3a95685b7cc383ef5b3aa39bb42b3a784f20d16d385935fafc9060391bd6b63cfb3e1d3575592c350c9550c63

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md

Filesize
3KB

MD5
bb42c567d270b17003b62ad104aeb2d3

SHA1
ed1af0f601241baaa4f7ae6ed2d47575c7825b4d

SHA256
f58ab68c20e00f4e6131a5a9ccfd81bb3bbc645ebcd14792733cc2b7e42d2ef4

SHA512
df90ace187cc8ce4957707da494959d71b256f734223cf3f26735f4241dbb48f448e65bd8bd27534b3536452761a948edac81c10b4d2f834280d4750e71d1137

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md

Filesize
2KB

MD5
8064669a27812706601c9203923d4639

SHA1
4841f02dd3754fd778aabb396d5dca34252b8a13

SHA256
1fee2ba876770ed699e6f0180b8f4dbf0cee1a171206fc41031da63c6cb151b6

SHA512
ecc851ab6f49ff35be7557b440a9bad8c894e70f0704baf026a4a46a20c70721b6aaa0ee0c69d96cd2a3e8a54d690fc69e219a04e643a3b44303350fe7eb70c2

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md

Filesize
5KB

MD5
78b2829ade4cf640d9bebc6b7b4c231f

SHA1
0725148661e57d3b6e918f1e4f79d5898f7030fe

SHA256
1c8344daf9d2f446c4a2e9029bffa96883ed665fa131077e58582ddbb8b10cd2

SHA512
1ecf311859c3777b2eb6865e9a1fab3761b42d3032980346e1e1f5cbea22faae21ef5a1f85d669b3a11641f08a53df12f793417e5d31541670a2c2778ce19ea2

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\public_suffix.md

Filesize
17KB

MD5
d2ab6c287450e8343a7e848a9bf8daa0

SHA1
eaa16fd3f0e9083af086af6ed5b8fb3df56da1db

SHA256
a90f71d23ef53c0cf4ab1fc4b8ae4b3fa5c7f14acf9fc1ec0d98e160dfdb3374

SHA512
261b247d13757198e86506c8f7f9a70192b36e8becca5979640ffd29b98064188ef4031e191365a91e012d4f084eb80efa4e53250d13e81f12161daefed4c8f7

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md

Filesize
320KB

MD5
8c4a84712fb4b0e1f42f9e13a7ecc278

SHA1
b378dea258e6c9bb25358f8131151d32a77f2b07

SHA256
88b9e101d407759b05adcfc83daaeb89efef480a8a5693a38ecfc45efd51947c

SHA512
1e405ea555e0881104e54280ab7d2aced31e63a894ce52ecdf75ca2e6ead3805043ff5f6bd70ce7048e24d1ded75141df21870615777df7d051af6ad4deb602c

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\asm.md

Filesize
1KB

MD5
d081a6f1ca3a53e49997c3e63dbec24b

SHA1
24a40575da915b6262a0552edf1c9c24141d7a18

SHA256
bd821d8516876ecc50e053acb8f3b132d46a79bbcf9a2632df55ea20d81f8aba

SHA512
ae5a1ada026f3d8a455e76bdf1bb73b4a92ee8dafe7be2f656762af61f83c988cd170fe37b7728127ba0d64e8c176a91be9ecb2960e2da50ccceee790c64749d

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md

Filesize
10KB

MD5
ee15c605d26070a1415dac469f668c4a

SHA1
3d370e70892f7cd3c90d5fd797c1fdaf938f27a9

SHA256
984c3aacb01e0df4a435b5ab5e723af18685d1891b97cdefaeff82188c60a6a1

SHA512
a0ceec88467d06a2fa4aa38c354ad2a52c4ef7bfc880d8f88b8c1aef4ff3d76e875e4776abf91ff57554a9d704c92da873b3f1c1cb10f283a1daeb72705a00e2

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md

Filesize
3KB

MD5
c22d8886c8c8eca752938063d705eb3b

SHA1
7f028c685335736a2e2d610f82d89d470aeed33c

SHA256
63bcbc56028183f4bc7ddf4c471ba91d1312bff918ae3c645b3843995631b27e

SHA512
0e0925079706a88c0cc586de01ffdfc99f2e91534ac91c2177311ab4f5137929468cdadbc28d952caedadc20f50a82075f4a0f357d05513aa1e8b567024030e5

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md

Filesize
162B

MD5
837ab1289318980fea8351053f2d7905

SHA1
f4bdc89b33112cd92de2c859a92511982bc491b1

SHA256
7d2f1594440926faa39504e4a6886a6cebb279b96ca9385c1ff9ef5b80908ff1

SHA512
4bc7c34f521b7a93f8d1ee0e2b27dbdc8196e08d8b21d41afb3020b3d5b457861cd76127146c1281d2e8dfeabfca40ebac8adf2107b67c8710b2b2dfeb70caff

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md

Filesize
1KB

MD5
e6cecf9a64bff3700bbedd6dc48bf4cd

SHA1
fcd401d985d62869fb3c2c63d7520f862ab96553

SHA256
c956850a698626e6c6f7e0afefb373c7733e01a287e4aa5ba91059fe20241a8c

SHA512
fbcf108c4d6066e440005c1fcce7fba7162352e2a526d6d185914bf5c361f0a50e7f6f6875732c601a3f350b4b0249e11ea9ed83c4858d728c9fe6f51787f66f

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\dom.md

Filesize
3KB

MD5
ec3d6a2c4c26e48c5ab9c97149b4abec

SHA1
669607123c775569815b833c83ac48d0d69cba0a

SHA256
80f30674313ca323f17900665bb4997d10d062d9f704867ab775aa6838b56be2

SHA512
b89c4d9f52e48111d565c2397df2c23d19552aef2fb7b1e642bb57af030613039a9815a4b150e3303419a53ed57241b2d25782ed11a5e1716b8963178b9c5e73

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md

Filesize
1KB

MD5
f6bac3b2e69ec62d753db71df4a6eb65

SHA1
3323068b57f7d2332aa7c24d9112cc22d0596696

SHA256
d03f117d534615450a682726267ed47c68630fb7dcdd493ebe2a9c4a38be4ae9

SHA512
3fa37a20e892de67a6382a2feaed4f236f8a0f514c337f88583168964e8b63e8280fc36703e0ed1106beb24af7e9246b444fc3e266f10c455c3d6d0c8998a72d

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md

Filesize
28KB

MD5
87bd705579706157d537b74f111465c5

SHA1
89207b0f13c7fbe1f13ce40f630159c326cec7d7

SHA256
84ceacd0436fd9df41d2bcc9b0b31088e4ba8b7a1bf1cbb97161c4b5793bef39

SHA512
99594a6e0d114cffceca599c30b13432eee32df382e193fe87ed85c79baeb0bd6889ae3207fb328d12aee9f7cf44c13fbd5c2bfe090ad7b95a7b883fee4f8271

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md

Filesize
2KB

MD5
c990e27c871bea456dbd089bc9591e2f

SHA1
a3f26e0e8e559e90db6e3e5a26167d53624f40b1

SHA256
1c05b1a4c768baa29f85aea62ef2bd6e2ca26e936c65becc0ab126b82b2698e2

SHA512
ee306d4d7c756c3220e1abac136856c7965184c5e7768f8b50051e215fc93af7c9aff11318c83d0109f3d315ab19875cae167c9434ffdf983b7765734fd752e4

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md

Filesize
1KB

MD5
66f453eff4669e4508d85cf777450b48

SHA1
392011160d28b34e01af31354d0ec978f500f95f

SHA256
8cf0ea2dec739f8f452e1773c160fa9b0aeb98ee155f9598644c16627eb3ed81

SHA512
dcd89eca1b2d0f5bb96e9ecfd4678cbe2a0e89f1502941d14ff69bfcaa72fad4ae916dcbc04563623f013c4761a17e158c4becb8e59f2ab23b0ef0bf62e86e97

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\icu.md

Filesize
2KB

MD5
1e5120aafd4a0e29968b75722577c3fd

SHA1
5d5f44e12870af5293473e2b9343554d51f550a0

SHA256
0c73cd50806f1fba76a0f40ded5a860352a8947ae2d504f0285849bebe5a2a19

SHA512
323c9f92533a587d138643bdc80e5d611b76974f8d2a09e85337fee3501893df34fc5d046634b0507868587f830c13f389da5fcb49245173a9fb28ac01c7b9d0

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md

Filesize
1KB

MD5
f5b2299e3b33502857bc2389f296ebc9

SHA1
8da8a7978178fe9e6803c837d916db1dd087d3fd

SHA256
af15bd513cc5859a42c7f269b8f1af28d0213280d39cd3b6c0975b90d0736818

SHA512
d5ab11967a85da26f573fe2a2d97bd9fb52f4f5eb6b112906681d4468f9ec93c2d40bc71150c089882b51f90cbbb6e6a9977c71561fe2f7bcb45e9d7de0b3dc1

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\joni.md

Filesize
1KB

MD5
1b880b0609d6149b13cd900792c88817

SHA1
40eceb4a7f868306a4735691047bade8e5bd4f98

SHA256
9ed118dc8f4cb94914cabb01b8456861a2e6228b54090d12aa54dfee2d19711c

SHA512
de41474c913c0af5581d41d1db9478067a471828414be3fcad50e635cceab001231859027c28f2448386fbabc195455184dc00508178b2bddbc15202957a95b2

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md

Filesize
1KB

MD5
b5bc18c08d891b27b395fd08c3e39b81

SHA1
ed50d08693b425282fbce19dd672fc0eacc35efa

SHA256
6b7178b9979d47233ff79376bc9a358ca215201d2f50fcea318f1081bba3ba61

SHA512
efbb2ac37a84a7fb232c2b9946fe8887d854511431c0b2892bd857155601c4f44afc22fb7fcb77e4e2f23e631a33c3161192c93c76d7db67ad18a2132173acc8

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md

Filesize
3KB

MD5
933be4b7e6895a52ff0ce7aebf965ebe

SHA1
0c465be1540ad7e9b6e3fbe7297c55559749c094

SHA256
41989ee16ce2f36bbd7a7e747b82604b52ee08afabad6aac20c5a868da29695b

SHA512
ff12301054270287f18dd78d2367c927b506ccd2b18bf0636f81f59adb8813e4951c06a5439b9bb50d5bc1915ee4c4052b1cd6a91e1a96eb9e6bafefe44be3a9

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md

Filesize
2KB

MD5
3c9a94431b7bf8009304b7a5576773ec

SHA1
1e3dd61ef7d1f77cc87559dfdfe347218b8063e8

SHA256
db065474615333752fe3c2efafef35a82972e420b14147f3640dd09a60e7180c

SHA512
84ebffb00acbb1cc4c4c7e5804b6a4b112b358efec67de7f2ad8379f3055b502d227755ccdae43838e0e04c6e6acc970002180fce42d97e8fd4611bfb1a284fd

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\libpng.md

Filesize
6KB

MD5
5ca1c701167232c376e2aed384bdd276

SHA1
e57a218d86555fbbf393c7884f2f0449e058b652

SHA256
91950ce0c4340734ff18fe717054d9dd6c45130697839005dfc9ffdd8f400056

SHA512
71439cdb54daeead30e4d0b566f7529acd543ac6f108e380e2739d350c521f2c7f2d6033baba8da7fa17f91c1ccf8723ab7d6a65ba1b47f73c34e12b0d78bf1d

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md

Filesize
5KB

MD5
f4a40abb3e6d089d501ae957251bd5db

SHA1
ca35adbeb0b558b8db36cd612fc453fa674dc3d2

SHA256
9856490b9a13be84388ee9939ef1a8acdbc1a64ffea4d0b9519bd5db5008644e

SHA512
5a7ab862ac5ee5c402da88b11a20ffabb51337f95ad2bd46d702b4f037dbb47bda2840462c36659ad38222fa410696e9d3493fb73c7298caa47a75b2503b2f83

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md

Filesize
3KB

MD5
488fad719c3c4f775ca2186977a91be3

SHA1
695bf9a320a41e33f3cf3b4e6913830f1b2cf74f

SHA256
df39b8a7d241ce1e71636f787ea82a4d9fff49edee54ace77e90c81a6cabb4f2

SHA512
18828174869e743ed43fee79149ef073e2009d44a389d1267ca10f37d8712b640cd5692bd8911af7f3052e5f04300b699068a55ca6714c8ed1d6fcb4f8e8ba9e

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md

Filesize
2KB

MD5
2f4ba424bd8291e3979aa555241b2151

SHA1
324cf228020b81bce340414aad4545d7b48994b2

SHA256
78fdd684a33937e73ac6502b9281c3d1fe2c946454420bce694bf1917e9495bb

SHA512
505b9c0b11172815e3a11fcd82e342a5aab61e411592fdaff99da35d920d3f0376202ce23f8a96630d846682c8e0b1097cc6c8e520c847ab1e5683394cea451b

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md

Filesize
2KB

MD5
a380f45888d25f5b64c223cbef0cef6f

SHA1
e20ec48d9308130fcc6e2f563bb0cda57900a0ba

SHA256
ca2ee74af8ac0ab4104b2f4dab5523444d636adc4c25ae365a31a96f4ea6d7cf

SHA512
7ac2833a240be74e387aa410613967d3f64e60c8049cc9532acec847cdff306b886439a8e3bc394737b5b46cb76ee75272a2c96e76dfba6fa57ff588acd46119

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md

Filesize
1KB

MD5
2ba184072991c7ea3b5b8f13cda6e79e

SHA1
843dc91bdce7d0c868fa2df684681ebf854126a2

SHA256
bd8e98dbc95a2a4e5d878126be04002e7a64b76e6e3d5bbc1e1e886b8713cc29

SHA512
e3b7e657d838484545feb43ddfddef56342af34b65f7ea53c9ad18fdcd40f13f920ab81dd550ca45b7147b921846202a16e94e76cfec9f0c2f5d4f079bce9b52

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md

Filesize
1KB

MD5
f93923abb265d0edb30082f74d1c1c5f

SHA1
d65e1d9a9b612a5135aff362f014fb2bccd6fff2

SHA256
08aa46585d82044a91c367211b752e3ae232b8b99c2812cb9a10463a7ae38284

SHA512
ea869645dd37505d2653aa4a48c514c30202709e6754051ee0a1a80bba5d6d92b09da15ea8b938e3133a7c135d51bea340e75cc5b4d3f797838e17fe815b1d1f

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md

Filesize
11KB

MD5
2e6aad3d48537befd4ecb57a67342af8

SHA1
c548aeb7af0d1f0e1fecf5aa963725d397a71879

SHA256
861dae273e299c8d74af814769fe4f08791d51b934bdc461fc9f6c4b9871ad13

SHA512
da88847f45a0266132e1afb285f8b7aaeae0440d041218f854610fe9996600e8905f9bf318ac21e238e34a04b1f6c941cab6266e334395a37550fc1b49bbf0d4

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md

Filesize
1KB

MD5
22b6487afbd44f1b7e82e90826b47062

SHA1
fe9f7866b8f254a69e5c9cb5948c204b106e5e56

SHA256
16127d3d243c0ba18242189c7c5296f8aafb3948e4fc114349a66554c3c10dd6

SHA512
a72e9d7c8d5bbd26e5866323e3bdcd939a5067f58f0156b1d53101ba38aa50662525b3ae467974e698d15aff82c4026732ff7b7270ef845eb2580d5fcea9c8b6

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md

Filesize
2KB

MD5
78a0f41b8139ec153141c187f44712d2

SHA1
819594487fbfb620f2ffc99be523f796dd3f0dcb

SHA256
f11bb6d6535ad9d9365db6edc7cda1f648c8ce34350a09359622f7542906f4df

SHA512
37b8cb731c1e00f4a20ee355bf382f952e8d78437e484d9747c82bc5d1ef29c33fa4f8047a92fc7121288ba7aaea28dbcbbc7f412d9fa267cce1949cffe7f3bb

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md

Filesize
11KB

MD5
54e4a869dbb2a4901aef90aa639203d3

SHA1
2e969a792f79b58fee67f787619f37b95138ac48

SHA256
08038fcb30d0ce340f41af5fdf0b65dd1c855e01ce9a0b35c6215cfe21f5692c

SHA512
6855340b8c7e8343d0d9851069e83f3852fd17e25c389c8b05fde57742eeefc12c19a54bd792fe077ead2ed40ab4a480d9795ab14cb670a9db7023a76e5d4be3

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md

Filesize
11KB

MD5
9df55641ec8eaf051e7abac88434e2e0

SHA1
e818b44d544f1ee7f16bc4f4478aeb3706bab6eb

SHA256
b74f43b63788ba7d6f5c89f80cf55aa57ef1d3466a204ffa164e5bffba0f1630

SHA512
0eabcab186be6e9c35df503dae1c8cd1ec9d78353c6f991edf6a8bcf81beef9a3ae23ecb8c1fe9750c3091d75082afb99da0e556b30806d5db74c471ec99e906

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md

Filesize
11KB

MD5
b72c5ac494d3d72986e6666c66f72f12

SHA1
014543ccc4d366d2f68c3a02d13c666b7d7a68a0

SHA256
d31acc44b8dc7c9e22b12ee680bd7f653501b4533347fb09610bab3bfb5e2e31

SHA512
cc92b2d6741734adb69b69be2648a90d1c22da4c5bb9f44563edf2a28f4e963a1fb5addad2b48fb13a28d2b4489c1535ef5d05bc79923289fdf375c399b4480e

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md

Filesize
1011B

MD5
3539adfe604cbd149500f7ea8c46a5f9

SHA1
3e7570ecbe9888d3e52279e50d5220fbc324fb5a

SHA256
78c81e89f4673b863251a0a53ad7e2a8db17d5c65fe8f9a6019ec3f7cb3ef982

SHA512
b42978191e5440cb2a323693bf4bc4cd656fc880188c714e347db3185191867ce3299f8a8f33b88b0421cb76b5ae2c67f08266b6dca290e762d463d1644bfa4d

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727662498327333.txt

Filesize
77KB

MD5
bd11c3112090641ba426abb4181ffa51

SHA1
57f22cdb0d03b5feed9d0d50dbeb3a3cdf6501a8

SHA256
f0d947035f8abab89e5677cdd4afe6a3348a78af9d5a9752110e779ee5f50c99

SHA512
80e4c5f6f897658bb6c1638ee4ed9a89da2909613dc721e9910bde744bec58e8f0e7e828cecdded6dea904a9c960c84514d0fec6717b0ee3a8dc193c3ff05028

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727663013511623.txt

Filesize
47KB

MD5
7d3dd5e3cf420c2cd58522af7768f0f8

SHA1
e59a260cae4e7e41c8aa8abd88a6aa83102f7640

SHA256
7baf23d47ef1e82a3c46003ecf70c65f004c2fd33c89f9827c6f82a07a0670a2

SHA512
d4c22d440c9865f4ec224b81b893bd202f899b200f37725bbee9b0d6836bda7115b945ccc29a92a2b5d2e0d923856fc04023190ebb38d32e6dbc9676b2e95cee

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727668912544901.txt

Filesize
63KB

MD5
20ed4a522999dbce95f0eb9c9c4c6197

SHA1
468569e0910c0a48af96a9df924694d4dac0c775

SHA256
eb741a587bc00cfe5fbe67f2d2880fe2cbee691845819e6c32846a2fa50c3b8b

SHA512
848da7b1b742ba5b4ca3f38495aed380a0d83f8541b098bb17bf38ddb1a4009e5749fb4f49e7425a9244c178df71fbd24ec028aa306076ae18ecc7ac91fe7cf7

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727671578469739.txt

Filesize
74KB

MD5
7e2a6bbc0960dc894076b1303a813a24

SHA1
08c19fb9953fb1d7cae3324296641e24bfae69e4

SHA256
4234627bb9a9c27bd042f50e938a74de8b34d7511e2eb305f47b1c5d1bc17354

SHA512
29aada24358fd441338bb05b9d48720e3039ad1070f41a986f31b10bb28b95e6f4f4fafe0356f97936d6de4ea85fde8ae273d466865f703af71eedef82ecdfa7

Download Submit
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\File Explorer.lnk

Filesize
407B

MD5
c389075e5a2c276806ad40188b1e23fe

SHA1
31b46185e7c44a4069b892112391ac7f22ec8eb2

SHA256
d514927f88ea0aa4b7090ae1a9a4af5717246e619221e97038dfff8335580815

SHA512
d2f42882632b9491b7f2c6d25f4ff86ad743401e2655467a4014a500737a640cb5863721df254a44beecc225e29a0241019ce7dcc25e7afe148a61fccbeeb38d

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg

Filesize
21KB

MD5
0ec34bfa63d9989f88f9aaf9f7a8ee88

SHA1
a74619de15c46da04b93a269f6abca97cf3073b3

SHA256
2616c4a59d14ddcd1a7595cd7d5563a37daddaf3f84b5137543a6d8cade9d4a3

SHA512
89323f6c96639c5285ac701c554fbec23cc970df327cccf857135bc0d92cc64fd5db6a32656185af9add397548cb45e7b0bed19574c8886a04963d3c0609227a

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\HelpIcon_solid.gif

Filesize
1KB

MD5
e5e170b83cc89cdae3c56b41b5f2fa73

SHA1
9586e7585dc797bab3bc4477ab5246788b92753b

SHA256
66c393306547fa8cad9beb6ef4c1e9d25f1873edec86d3d77c9551f8da20a52a

SHA512
555c28c1027b63d4442b58db21c09e86b85f22e6ba18fda3af36a7fdc31b513961668ef13dc9bde287792f9d783847b099482fbf14795df2212cb87a98f8a330

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\alert_lrg.gif

Filesize
952B

MD5
256a36210462d52cfdd57ae0a3cbcce0

SHA1
ce098aadc9f591de99e3e4bb9f5588203bc270e4

SHA256
d076dd134062b802659a30c30f06b92a2aa504d37ee2dfe7024ca9bbfec41629

SHA512
19313bacb7b2807257994bce1516ad57a7d4b87565c689dfe292b9ae49631d775303c46b8fb60338c52d1038cccd0a0836eec1b2e7ac616ea0102474988f7cc5

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\aspx_file.gif

Filesize
121B

MD5
55edd503ee24ff684196ed33ecdbf634

SHA1
2fc881267822542e3f9136b30136c7b94c93e03b

SHA256
fed3f61b459406c8e22f90ec692458d45b78130a37ca0696d8e28da7964970ae

SHA512
1ce22dcf56c9e6880da8a6698b4d764dacd56ba8b1cd80349cf686cfbda71830a242b1bdfca9219348866047725a7405c142f36ccb48a75337e81553edfb8790

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\branding_Full2.gif

Filesize
1KB

MD5
20d9645c986983f3aaad906a114283f2

SHA1
62e639b26f91fed2a754c3caa07e766095ec9716

SHA256
a1f8041ffaeede2dbee8c19fbddf33e2fa977fa098e91affd13fb8de2766c890

SHA512
2c911f462a7eb0f8374f8b9e9dcdc95ca3310d1dcf0e6e24ac200c1fce1cbc2faa8a752c5c76557e8ba77f77a3d16549053d9d5b3190a82e2d716c9ffe8419bc

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg

Filesize
8KB

MD5
c84000ceaebfe0a01a32bd7f606c5a6e

SHA1
fb9687a9f2b18667ec66a9d52f9596b1a5e4df47

SHA256
fc0ca0a47a8f188285eaac214ea8c0ff864573f83bf0814a1e4a12be8e2f0581

SHA512
636b077d9770af4efb1ceaa64ee03a4a29b3dc0564340fcd4b21d1aa4fafc14695ca9cbea7a99742518926554950f246f7f9ae79991ad71972c73fb83e3c5f15

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\folder.gif

Filesize
914B

MD5
28d927b84d809f628bd7f174ad2715d8

SHA1
613f3feaeda9ee97a3f7fdf9cd47b07cff4425d5

SHA256
ce6a2afb86f6e3c5eb07408d986f2725e7aa0716ab9a44fcfc739e347c8985ce

SHA512
bbb5fe579467e74784521615fd342138a0a76112624844c1a60e6bd5f2913687b48d42a5fa42f5830fc9832ac89a3acde84a49b443b0ab2574096d2bdc6de964

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\headerGRADIENT_Tall.gif

Filesize
328B

MD5
224962b9fc335f199b9c077e3974a5f7

SHA1
adff3acadacffed5a35d123f8c80d7102027b71a

SHA256
8c74c010ef69fa65a6d34faa2c4e3a474c805acb2dff5210c41637bff8e201aa

SHA512
37914ab97cb32b242a9a01cafcd79c5efe61f910a28d7679e8a3d39c2b6dbee7c0cd70bcfb7710c55de53b6fbbd7c1c836e4858628b7658830f05df1ccf37851

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\help.jpg

Filesize
1KB

MD5
aa402176c9d07219a9bb9f845d4261a6

SHA1
cb50d8295a5eed4347893467efef640673496849

SHA256
c7a1b3b95b32916f8c1c79e5353ad2d899b47135d6ca60da42e6ec4a5b204564

SHA512
f1414da9ec6ca97c2e2d7a11be01173faa93634bfb4c43914380906fe5e132b1cdbc3142e64e11fbc14bff2c5c2402638238acb413db93f4c69541a7e534111e

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\image1.gif

Filesize
162B

MD5
ea52213fc35457734ee2d078ba8f2656

SHA1
027bda9609bde3595d3ef743fb90cf6efa28c1c7

SHA256
3d11d5b0ffb6e00f7f73d8d2f3437781f3522078396bd29424054a8231d16b1c

SHA512
439e3727398b39381f3074e38ae58642eefbc7d9be64c978a093dbd7d1d11e1c04aeaf6a4ab58496e6e125bfce3c63dc54810c65db079a02d9d509c2f30c16a2

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\image2.gif

Filesize
586B

MD5
cbd8d5ddfea7a9701e9828e178a01169

SHA1
a5e7ea12470adf56f4a0f0e6e59bf019edcf4967

SHA256
8cd59b666cdde77390e07f66c52af24edb1f18df56de88885d6c5927bd53f51d

SHA512
d0295fd8a9622fc141a3d0feeabcba8a09ec6e37ee510f0af92e412e0fc651058922a6ed72f2899450c14209c37fdaca812ce19d6f5b7e5393dc091ae73d99d0

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\requiredBang.gif

Filesize
124B

MD5
6f89506e63ed32b423746ff63bf9381c

SHA1
e537fc728df276de8663b793b8bc286cfaf6b4f3

SHA256
a827051462d1b8bc9557e6b648f27c2b42f6ad0950752d1e6d515c023c0b356f

SHA512
dda5b077eac6772f62a02486e6b3f59786a0568632308890f6bf83bf5cbec9e47017badb3e0fc1daade12cd606d1b6b3512fbbfe4972af5d8d22b486b16ea9b0

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg

Filesize
8KB

MD5
4fc652c51fcdb428f53ab21f3a70c462

SHA1
ea073f9dc82d0bfd2dc07faa5ee7b9e895e8dfb9

SHA256
eb932f1c8abfe16a07705c168850b8e6eede5993989a6364c8e7505e6ec7a563

SHA512
419f90b8f5a672e2dacd8061d39927fbc380922eae7e8217c46deff040f2156e65c802028f4d45e115edf6ceba414e27b3d3c116a8e469a86434374a646319cf

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\yellowCORNER.gif

Filesize
880B

MD5
b0065665ff1f2114a60c2efa36f93d49

SHA1
2b9fd485da679bcd81bc287fae03db6f6515e0d6

SHA256
6cedb2aed1379751dbfda898f049ddac683a4a888bab1017507e3bca65f5aa5f

SHA512
ebcb2131e2749ca7bfa4aa4513b1b30024915ee8a40457163684b5504a950afb5e355fc52f6acdae5804bac191226b31f759f80352fd773985a751a781fb729a

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group1\1 - Desktop.lnk

Filesize
1KB

MD5
f925f6e9534ae6b8db5e6225e0cf7b24

SHA1
10c793c1c859b73549b0bb40b48f308da763ccb8

SHA256
22dbde2f8af63aef57539b9a47113c7ea814c6264e19447e6288e071f389c13c

SHA512
a52181ad4de683c0c47d7f777bbd4b2fc7de6edec6d06b505c7be9a962f5c86ddac16d4c20ff9dac0abac5953fd44e94902f0639b7d806bb4a6629d22eeef9e8

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\1 - Run.lnk

Filesize
1KB

MD5
167511190a3aee81675c1a5d5d5d648c

SHA1
c066ef770fc1b25c573447f1e06a1a26dbde0b2c

SHA256
f50e891624f940a2d1c986cff7ccf622c6a01ca43909a8ee34dc268ce7c083e5

SHA512
ff7dbfef49c6095e9bdf2ce53bf32f50a9d3ea9d13ff80c55028672d5a14a8d93dbf6284bcb3bcddfa03e3b83be46b39d37c2a9a01977ec2da7bcf2676c989c7

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\2 - Search.lnk

Filesize
1KB

MD5
5ff8ace816a1adcf1179606d7d2dad75

SHA1
1cedcf33717f90454b30db9de6d57df74101115d

SHA256
f85d4eaa4cb2523a4d1ac2da21cd68bfe22f279dd92ce43248e0976cc5db1383

SHA512
f9f6dbdf88207487c8a7e151ef4f9d531e7e8208add67ba276f246845e32b699f7ac1de153d73d263c0e8117fd78b6bf79de06c0db0ea7686e42c898baacd60e

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\3 - Windows Explorer.lnk

Filesize
1KB

MD5
1f86fd374befce59a0cd1b995e507d46

SHA1
1f6159e9fb59503ae4dae8e8ec5db0652b9313b3

SHA256
ddbd2e7bef132e7205e7184bd4a568ffb998bc628b4cff6aa1f0b6b5d5bbd985

SHA512
e7abaa8853d43e26ed7190f26894fa28770c65577536a24ac02305bc58913748952152b6408a6475b0981ca12c3fc7c3a598b613942cc397e681bb91cb499a88

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\4 - Control Panel.lnk

Filesize
1KB

MD5
8e9610b718c0410a17ac1262799863e1

SHA1
6c65281a2f74484c292d63d24e23991b357f7689

SHA256
7ce89131cac795c1cd46912512a9e91f498348eb669a51e129f648cf75235d40

SHA512
0645201b51987e695195ece9837926be94df0cc7f864b33651231ff0b6ff919bcecbbff611b26c4e2b11f9e2d738a2d3b471b12cf079ddb99f1435c0a593035e

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\5 - Task Manager.lnk

Filesize
1021B

MD5
ed1a13339b051ede20e731a445fcae09

SHA1
5ffa64e1f6d9078bd7d948806700cc1a3af6ae17

SHA256
81af39e56119a3bbda547b06dd86b04b77b6c76379e54f288402b8ac5e8f8730

SHA512
c12e0cf9f4ed1fda41102a7ac9ff0d56e2505a91dc80b6a0d2895f7a9478c3d15788381dd15c82c08291515fd2adcc37674994634999bcee21cf97ef34e2f496

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\01 - Command Prompt.lnk

Filesize
1015B

MD5
e8174e8b0ae2774e29cd4d82b38dcb5e

SHA1
42d5c41a667910f2c2793c420203a8b2596e3c0e

SHA256
bea0bf9423f8fa397552f3c7c242fd4d677032597098df1fb4bd65830a0918b5

SHA512
85c11a23e7b624bd23df9fbb313651891ca2e30445c87a47452fd01419cfc0e9f6a69e655eab89861574d7615df729211de83ef058b0b4b956c1584153d3d0ad

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\01a - Windows PowerShell.lnk

Filesize
1KB

MD5
ac9e32ce76a488c4080c5857cbdd6611

SHA1
d9b7a34eb682e27bc25c2c652cacabc758953a7d

SHA256
200e8448962b5d7d1846c6c050c8cd2782d3aba28fec96b515bf671f16d92e55

SHA512
6dfc53d45663e1b46856c9c92422a0e09ac95872531e7cd8fa9af7095364d487ac8f3c2a7f323bf4a000b87d3806b3ee5cbb59c7503d2c8454ecd56b286b703d

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\02 - Command Prompt.lnk

Filesize
1KB

MD5
4869801310185e29078e48abbcf33137

SHA1
9b7a5c17fd5611cf6d454353ec48c96c8f104a00

SHA256
d960874309968a8f806d34f6ba60a61623614fb80615783f2a6a65f5574bce5c

SHA512
839ee38b5d585c280d30444d58744f8b804fc4ff588233e33ee1a2dbce4e1c6a2ac8c16e6971f5e6d9a30f15660a23b51d97cbbd4a3c027909e5f059d7891d33

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\02a - Windows PowerShell.lnk

Filesize
1KB

MD5
bdf65c40951b11d34e469e5e363fa516

SHA1
d2710eb3ec53b15d4becfc72dda485d8c6256661

SHA256
5a6df4fac8d72ef3a2beca274d459cb38af2e4bff1ae08c2a2731500f5cd05b1

SHA512
d89cd89704216ac8fb967d44e01f58e1feaeadb84dd956ced73120511b02eea2781d48681a39b272c26fd4fac909cebf5488cfb6d0ec229e511448990c8f46f5

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\03 - Computer Management.lnk

Filesize
1015B

MD5
fc7bdd33ba29d543cf8d76da6eab033f

SHA1
faa15f3b2d0aa2c03c1935f5914eb719c48e89f2

SHA256
031b7eb8d0de852281de9648d9112130c7820edd37b921e8e26e1ecf20bd5b67

SHA512
0d16d35d3a68474df11974b3b828b27a65d847ca2c32acdc46bb8bfff61b3331791c787582f520fac817d7644dfcf89106896ddf42fd508c346ee42a1210ba39

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\04 - Disk Management.lnk

Filesize
1015B

MD5
1f1c28d6220939a49e1416edac875a86

SHA1
fe4f047cd20c6497601c807304c815d8b90b6b4d

SHA256
de360c6fa7354c31ac4aba2bc607eb7d4c5ee0f7ae4bb8ad6bc3c72bbc1ac584

SHA512
dadacbc3cb65657c0c508cc43492ac23eae1442a536ec0cf92482153d0531253643677d3acb522ab99e6a66d513678b471057bd4ba26b9f40a0c7855e8d0df4b

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\04-1 - NetworkStatus.lnk

Filesize
1KB

MD5
56970a92935de6383891d6840865b8a7

SHA1
f24e726ba45713a1bef0d761d917b844b41b2cf2

SHA256
369efd03caf8b89f639d9d0e3acb9906fb88ec3cefac4bcb2696e8ec9559b531

SHA512
a30b67b7796f6257fbbe02804a22d53301294c2f0aec45b98ff1f9bff5ff022e0eac57b3df29c8d042f3d4a559058081ecf881bdfbf2f5140db95d77a91a5715

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\05 - Device Manager.lnk

Filesize
1KB

MD5
9dac8b5e2057ae428187cc89923cb90d

SHA1
c960ef4c0557cce8a7ff508ccf7899d6187ecf47

SHA256
b16c2b7f9241e820f836dbef3a8dca9c18ebcd9c91cf879c99aa32b92a8e0d05

SHA512
0e6d8661a5fa45e3cafa697414bea519fdd352234f5f6a277297c66251edc2c017b4ff23be5845e14d13e324a8e3df1654ebe64b9137ff8cb28c46bc41edde72

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\06 - SystemAbout.lnk

Filesize
1KB

MD5
117b93f612695f1151b24158f50fa9be

SHA1
8764714cdc9ccbb252fba7c4ef340bc1d3a33321

SHA256
9beaaea5ea99963a4c1483062dafc3a56f8e29547cc87f4e73b60b14f7a2ab97

SHA512
150392f4d63fd270c6a0773a9d7b850e43e23c2174959091ee37e33b483f313ea9496471629f9b08a16c83d4b156a3ddd075d8af106fadbbb0bc8280978363c4

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\07 - Event Viewer.lnk

Filesize
1015B

MD5
27a9c74001e1ef36c06fc58acee25c90

SHA1
b2861d4cc70d7d8747160402f6ceb05adb76c265

SHA256
d74334f7de4f64d3479be40c5da84fdc05cc7c259e8a2ec376d8c7f96f72705f

SHA512
8d58041a5fc8b58bf4c2d74bc1fa567335d757f80fe1da1257af8fc3e9183233b9b1875edf601d2473396521ffc3205f5f487561b68f136cdb9fb77ec40fd354

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\08 - PowerAndSleep.lnk

Filesize
1KB

MD5
a4b840c86a8464bbaea64eafbb982987

SHA1
43ba781e07b2251382a3b4e915c9a4d9ee6f8c58

SHA256
85444ab3a750996e9d9c1af1ad772bc5cfdffbd45520c36ddb1c7fa8c2fa64b7

SHA512
fd909ce922c677d48d3e528851f819e6a32904e7b3364c1877d631dbf2f5b54725af5385985cd6aca196ecb874dc867c501f5ecf73c51264fbe3882bfb0bc124

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\09 - Mobility Center.lnk

Filesize
1015B

MD5
d7c1ead6dab44e9d3aeb147bbc9440c4

SHA1
7617eb9f0ca7bd6fb8b580697f3719c67b323254

SHA256
3d4874c81c41e2c1cc1dd308709decf74a25243dfc6243dbf7b52c38c0d442ca

SHA512
f0e9f49a445ddb7e0a624fdcd5f1539cc942c4c6100a7e3d18796c90150d7810a0646bbf8ede941ebee3649c2394d20331c6f61dfdf347828ef5ef1c5f31c5b3

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\10 - AppsAndFeatures.lnk

Filesize
1KB

MD5
e6fbe4e2b03890005b5cf4ce25c75a4e

SHA1
05def20054f56ed992a4f36d6306c1e90af7a383

SHA256
a5c72587d9653d9f84adfcb8b35c91225ed437a96dea43f76156a74325eb6f14

SHA512
80cb6635fd3bde76542f63d9d29329a0d8d2c5a3010de3c20afc45695ac3a59d11042d26b85b8bb765342c6ba1ed125620eac2d1e8073aaba975249096f3841d

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk

Filesize
352B

MD5
fad2e73e7afb251508c9c41d4ea9fef3

SHA1
d41602c2741e54e0a759245a8399bec7769bcb2c

SHA256
33510babd4869fd607622ab2a697a599581421654d3fc4cc98544f331fe8183e

SHA512
1e5b9502383629a15f4692e6b09c55006ec674d712fa063ba2d5d2811ac06e0abefe10127af9dbddee90b6012889f1e28b2ea0dfde1313ec8fd747c32f773129

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk

Filesize
334B

MD5
4e8b4910af3a900d44db1ea66f9612be

SHA1
6aafd60ad434a57e2004cc1aa2ebb091f08525bb

SHA256
dfa50f0e3bb82964f33988dcd89dfc393c4541ae3e28c793c7a1a3e1c4348dbb

SHA512
5488ae7d5eef012f4089dd381c6791e0c3f6bb6036783a2d1087be3d91be57070494be4d0d9bc0fefabc9186059cf6ae36beba9c1723618d286ea91366f4a128

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Magnify.lnk

Filesize
1KB

MD5
591c66a00d0480eb268d3ecb065dbebc

SHA1
0db7089d78e9f81860eeb44f94939f90c659c0e8

SHA256
1df68fe7e8181fe1e76fd099c922527fe8497253eba6b498da8371519dffe0cf

SHA512
3580ba0c2a9b36d2ade3a5bfc20eec5bbc1da5d035ca3220db443cdeff7eebf66ede1b60e72493874b114003568d8b8b71ac92a397693108f53d602caf8b9609

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Narrator.lnk

Filesize
1KB

MD5
8370bd8498030ee6d4e9c32d9e23af1a

SHA1
03e1c0cf56840eeda3b0cc157f00f4735e5e162e

SHA256
6822410fa2dfc62d5a198faf65ac26e3647c4fbc112bec13dee0197c2c8f01f5

SHA512
be9fcb408e0f9ca40c37d7e554c1ae2956694aaecf2232a16d5e96069bd4a6d97dd49badf56045941f03b30090eddf6198cee07e6378a450b0ae81db842c68ca

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\On-Screen Keyboard.lnk

Filesize
1KB

MD5
02d28710d5cf3c38498ce043fc6cd3e5

SHA1
2990d1f41c04be192ff4f69dfab7777fa189ecdd

SHA256
4baf85c64c2c3ab8fdd8df7d13558167a6f19a96a4b3d99cbe80f811adee4aa6

SHA512
46a1a03ebb5646aa6c9022c3547c6896c939a1083a0e616006800a10a599bb34cf4ad1e99036772ef4a2a1ead757491bc25b0beca054a63e8d01b3361a2db751

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Administrative Tools.lnk

Filesize
1KB

MD5
34048de69912b85db6ec95599a6da436

SHA1
88857a5917fc80f18140a87571e08cef1624ecc1

SHA256
6bf412f3c7d1979e75df077b5d543159d401363c563c8a228dfcfc2f20061c20

SHA512
72f042e2e26c11428e139e572ae9f6777a7bf5a544e8cc3c4b410669ab29ea1db1900d968c052bc7bf58a2e58fe2d28ee124446406954df464643722cc9d08f8

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Command Prompt.lnk

Filesize
1KB

MD5
21998107c2886ea7bb660ffe39dd08f8

SHA1
2ff0c3b7bc837ae9dbe95401015f600607704591

SHA256
e230d6efabd2857c6f70b236fb438b65bfcb3e95191eae3f6c6485c987c49085

SHA512
74884914cd8b4057e9fbe1bc7ce7b3600349180b15903cefbdca67a64391ddd2d51b19b01e93bae060ce0289b18ba9a22133fc81564055720511c29d50d936b4

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Control Panel.lnk

Filesize
405B

MD5
1d30e4bbfc9a8fa40596dd91513b2c76

SHA1
68e227d20e0d01b703a7f5ae429374a97953b073

SHA256
d188b7c0e6f1564c541db41bc11d07dc36cd1569d47073b7053fbaa80f8be619

SHA512
aac29835815f182c150a225353416037f6d4f56f6d3e555a36901474c8276000b4a2239a415027cb2c1fa2414429db4ee670e7972e5ba8ec5902671369d25eec

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Run.lnk

Filesize
409B

MD5
8755e58738409eab695fccd6f5656773

SHA1
30036e74093b03ad0404f321e2252bbc0f456e03

SHA256
ae73ea1d758a5450b196394786f32d3f2fcfdfec4ec1af4449104822bd49e702

SHA512
9cfd52bfcfbf3d09873d92effc1357bc023e43cde05098ac09c1ebe2ca31e2ee39c30d63fdfa132a8069ab8c201d518686be8779a9b0028f15d659da052b097b

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\computer.lnk

Filesize
335B

MD5
2d88bdc15ccb0448ae8c1d66426cf86c

SHA1
97c26d28a30d9a7ff717cb7dee5b219b751342b6

SHA256
4cc4e390bbb3adf510bb697d9ecaf0082058ebb1d23650ecf3ced856e8ff2ccc

SHA512
4d029032041a6ad10e4704c06320fb555a830a5ecf2bd4a593823ffca10ca85cd23103f954ff4efc7c14dc47a8e5a05461ee9118812d63dc942e451f03165d6f

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell (x86).lnk

Filesize
2KB

MD5
d6dfafc5567c3bbb6e9eb2e95a8bf6a9

SHA1
fd79896055f92c269fad18487ec6683b1d4636f4

SHA256
8f43aeb9a549f8b4469eac700de57c753e2baca9d00efef7f92d32b340065fc5

SHA512
e4b7df767cb63489eb0637100ae574581b8cd03a44a5776eb5d61431d5020745c8ff9d64fffefd2fb13763fdd357c0dbad9f4a60f8103ffeb614ecef1ea59f91

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk

Filesize
2KB

MD5
d33c2b198f20748a3559e4c9ae0ec3e7

SHA1
570738635547876e84ff85958c4dd4892c6d7ccf

SHA256
4678e89ec67164ec32201ace23cb0b4314a6092da8fcf67cdcced9ceedd6023d

SHA512
26311e2f97abe245c18cd200c8d524eac324ceac125d81610b218c5f53df5fb4942720bdaecce7baa47f8a4543fc24d248453cb94487eb603af279c4fa626e81

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png

Filesize
296B

MD5
cacb0082cbac8a40fc9dbd9790ef489a

SHA1
e2de63781bba73f279343032889c61697ed0c90b

SHA256
582c845c778f38c4f776b0944c179f5a2ee7ef14a701f5199456a44dff0fa284

SHA512
834164ad6a7991bfce364360e4ee747afeaa06a9268bd3be4fe72f2f8691f1f5ea38be6f95ebce58271d26d5e0b5c545e9c3b8f8e773fca491ef130c9b6a9218

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_contrast-white.png

Filesize
276B

MD5
64241b113464b061ccb59e1e28e3a0e1

SHA1
78a4a47f31c25fa29ca1d2fadc22c46b633c0964

SHA256
ddbeab2c4413b2143966a9b3b223a0e56fe14d3fb2bd60218e962c462eb93dce

SHA512
c82b70dc0b50f3292c404d94587ada010c3790434ba81fe60eee3aaf2f6d307956962fef59b414cecd5937901d0917914039fe189ceb3f0eeea54d08b6c147da

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png

Filesize
296B

MD5
ab6f3e28c20c902ea02c82575100ada6

SHA1
a492d37b4c2a05bc78723c28a3050dce42026fcd

SHA256
5dde7e6a9a824ffe201a37415bdc2aa8366ef7a87979dea9f699d12c8f9ec8a7

SHA512
70d48631e57096792d0b41dea6de041a4b562588c8df7d6970818ddb29dd28d82314c26867eb156bf3aa5fb86ca48964741e9bc7623e0744b2daefe7abaa6dd0

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square44x44Logo.targetsize-44_contrast-white.png

Filesize
276B

MD5
e396ca084ed849106bb577fc908e0571

SHA1
31a853e2d7f911729ac92b73a30833c70d21d84b

SHA256
2dc4e310489061fdd57c505db3db9f43b2eb1d4ac4bbebe993ab8a6946ff43d3

SHA512
cf6da6f6ae777e03e7183a14a76fbedaa710dbdfbfab789559d42f4904009cf8be93fd86292b78d05209fc73bb62bef54a39c8a27e0f13ae9ba14e5ce6b298a2

Download Submit
C:\Windows\WinSxS\wow64_microsoft-windows-onedrive-setup_31bf3856ad364e35_10.0.19041.1_none_e585f901f9ce93e6\OneDrive.lnk

Filesize
1KB

MD5
239fd02e518ca3ef41479102be747351

SHA1
892844259fb2d9891c87d7c24deb2c42cb7e3c91

SHA256
cc91167c13b2b55f9138ca8721a98984cca5f679064bbf6abed37993aefab745

SHA512
4bb4bfbe227c606fc7c0e5fe48d52d11797d47e96e107f8db08764084aa8f55cd450b501db02c20c1850cd1c82123eb381ae4ad4a5e1e7d471e0a2b165c9fc1b

Download Submit
memory/3604-0-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/3604-5930-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/3604-11155-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads