xorist | 1005665b0240831a78aad206707cad93f9ac891530f05abf7895f1400ddcd44a

Analysis

max time kernel
140s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
30-10-2024 05:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
Size

40KB
MD5

7dfd0cd482ce6237745b82e5355f5e90
SHA1

9f8d910d931e7cc312e4a3cd5e88911d952b7465
SHA256

1005665b0240831a78aad206707cad93f9ac891530f05abf7895f1400ddcd44a
SHA512

746f05e85dc0ee920a5f61059ab96c3d0e57a0ca8046c356a735c306838b06a6dd56c941cc778310a700c690a5ee80934a9139793a8a08ba20f3061641ba19cb
SSDEEP

384:3ebFNw4Pk1itKkpAjjalrkO4qYvjSrkDCgSxnRogV96WO3ZB:30FmBkpKjqY77DCBJq3

Score

10^/10

xorist discovery persistence ransomware spyware stealer upx

Malware Config

Signatures

Detected Xorist Ransomware 3 IoCs

resource	yara_rule
behavioral2/memory/2380-0-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral2/memory/2380-4914-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral2/memory/2380-11257-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist

Xorist Ransomware
Xorist is a ransomware first seen in 2020.
ransomware xorist
Xorist family
xorist
Renames multiple (2201) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Drivers directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers\gmreadme.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\596KhShtP65qXDb.exe"	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\kscaptur.inf_amd64_b95d9f4691816045\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmsii64.inf_amd64_0f02175b17cd3f66\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\percsas2i.inf_amd64_a7f5d94e6751c911\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\InputMethod\CHS\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ServiceResource\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmvv.inf_amd64_26dc960cc4c84207\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netserv.inf_amd64_73adce5afe861093\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\en\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\ISE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Archive\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.ODataUtils\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_fsundelete.inf_amd64_741f159cc6ce7814\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netr7364.inf_amd64_310ee0bc0af86ba3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\vrd.inf_amd64_81fbd405ff2470fc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wpdfs.inf_amd64_1183fd0f13045f2e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmtdk.inf_amd64_9e49da794995b361\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_scmdisk.inf_amd64_d8f75a9c87c2f7c4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmgl006.inf_amd64_130cd40b355024c9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\b57nd60a.inf_amd64_77a731ab08be20a5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmlasno.inf_amd64_61370f3a47f08ebd\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\perceptionsimulationsixdofmodels.inf_amd64_acff50a7960b7d19\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\F12\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_fssecurityenhancer.inf_amd64_e84a289dd0df20ff\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wvmbushid.inf_amd64_fd2fe159a9daf508\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetNat\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCClassResources\WindowsPackageCab\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ScriptResource\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_UserResource\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\de-DE\Licenses\_Default\Professional\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\e2xw10x64.inf_amd64_04c2ae40613a06ff\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\fusionv2.inf_amd64_a47d9636ce0d7dab\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\InstallShield\setupdir\0003\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Security\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetSecurity\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_EnvironmentResource\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_RegistryResource\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\@WirelessDisplayToast.png	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmrock5.inf_amd64_e485f7ac03009434\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\MsDtc\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_1394.inf_amd64_cac08af12caec647\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_fscopyprotection.inf_amd64_9c108d8ac558a80d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_multifunction.inf_amd64_8bf0fd2423b20b97\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ks.inf_amd64_9fac168e1cbea90c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmeric2.inf_amd64_facbddcbb097c790\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\IME\IMEKR\APPLETS\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Speech\Common\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\MsDtc\it\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\iscsi.inf_amd64_c089962740ea1f84\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmetech.inf_amd64_bbd46500a9d0e020\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\wbem\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\EventTracingManagement\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_mediumchanger.inf_amd64_69ea0d8614286224\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\fdc.inf_amd64_7534987814b257b2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmzoom.inf_amd64_37bf8591584019e1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netrtl64.inf_amd64_8e9c2368fe308df2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\sti.inf_amd64_096c9e42fe4749d2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wnetvsc.inf_amd64_9a5b429abc465278\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_fsreplication.inf_amd64_cadbd20a667cf903\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ialpssi_i2c.inf_amd64_8e00e1aed7fbdf70\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\megasr.inf_amd64_72258921635be994\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WaitForSome\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2380-0-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral2/memory/2380-4914-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral2/memory/2380-11257-0x0000000000400000-0x000000000040C000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Windows NT\TableTextService\TableTextServiceTigrinya.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PeopleAppStoreLogo.scale-200.png	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.contrast-white_targetsize-36.png	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\iheart-radio.scale-200_contrast-black.png	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sl-si\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\illustrations_retina.png	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\jopt-simple.md	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk-1.8\lib\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-moreimages.png	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\ContactPhoto.scale-140.png	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.27323.0_x64__8wekyb3d8bbwe\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows Media Player\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\TimerMedTile.contrast-black_scale-125.png	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\MixedRealityPortalAppList.targetsize-48_altform-lightunplated.png	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Sticker_Eyebrow.png	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\MedTile.scale-200.png	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Program Files (x86)\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\StoreLogo.scale-200_contrast-black.png	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\en-ae\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Store\StoreLogo.scale-150.png	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteNewNoteWideTile.scale-100.png	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\LargeTile.scale-200.png	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-Advanced-Light.scale-150.png	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\nl-nl\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Advanced-Light.scale-200.png	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\StoreMedTile.scale-200.png	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageAppList.targetsize-24_contrast-white.png	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-256_altform-unplated_contrast-black.png	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-24_contrast-white.png	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\AppList.scale-100_contrast-black.png	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\BadgeLogo.scale-125.png	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\ContactPhoto.scale-140.png	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\splash.gif	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\en-us\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\Square150x150\PaintMedTile.scale-200.png	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNotePageMedTile.scale-200.png	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\RTL\contrast-black\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\ko-kr\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\Ratings\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\root\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\pl-pl\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Generic-Dark.scale-100.png	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Generic-Light.scale-150.png	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarAppList.scale-150.png	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsAppList.targetsize-48.png	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-40.png	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\LargeTile.scale-200_contrast-black.png	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\LTR\contrast-black\LargeTile.scale-200.png	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\sk-sk\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\he-il\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\LTR\contrast-white\SmallTile.scale-125.png	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\Attribution\foreca.png	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageWideTile.scale-150_contrast-black.png	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Google.scale-100.png	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\apple-touch-icon-114x114-precomposed.png	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\it-it\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bg.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\DEEPBLUE\THMBNAIL.PNG	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\GamesXboxHubAppList.scale-125_contrast-high.png	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GetStartedLargeTile.scale-200_contrast-white.png	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\diagnostics\system\WindowsUpdate\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\23\debugger\Breakpoints\images\eventTracepointDisabled.png	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-fontext.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_11d6795aee52f1e3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager_31bf3856ad364e35_10.0.19041.84_none_ffbdc333a0778274\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-ndis-tdi-bindingengine_31bf3856ad364e35_10.0.19041.746_none_1c0e323084570b53\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-a..rface-ldap-provider_31bf3856ad364e35_10.0.19041.1081_none_9b600c8ee4691d4e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-ui-shell-adaptivecards_31bf3856ad364e35_10.0.19041.746_none_7a604becdd5c855d\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-wmpnss-publicapi_31bf3856ad364e35_10.0.19041.746_none_69467668c56fda1a\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-appid.resources_31bf3856ad364e35_10.0.19041.1_de-de_432ac08e5d5a3f7f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-d..mdeserver.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_bc857aa31b113c97\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-n..quickstart.appxmain_31bf3856ad364e35_10.0.19041.423_none_72535ca9b59a9515\NarratorUWPSquare150x150Logo.scale-100.png	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-tcpip-driver_31bf3856ad364e35_10.0.19041.1288_none_4cc02c3b6c5e5630\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-w..e-utility.resources_31bf3856ad364e35_10.0.19041.1_en-us_b54e33bc60acaeb9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Editor.Resources\v4.0_3.0.0.0_en_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-internal-bluetooth_31bf3856ad364e35_10.0.19041.844_none_539fca50063617b4\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-axinstallservice_31bf3856ad364e35_10.0.19041.153_none_b4f0bd83cfc7701e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-p..ng-client-overrides_31bf3856ad364e35_10.0.19041.1266_none_8e5f726ca832e39d\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_msgpiowin32.inf.resources_31bf3856ad364e35_10.0.19041.1_es-es_1de7daf91a0bb20d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-d..tion-mgmt.resources_31bf3856ad364e35_10.0.19041.1_de-de_ef75261c233d6e90\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-mbb-classextension_31bf3856ad364e35_10.0.19041.1081_none_726e53fd9909a457\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-playlistfolder_31bf3856ad364e35_10.0.19041.746_none_b68d778e4c528f4d\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-u..em-config.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_768282a82748a6b5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-directui.resources_31bf3856ad364e35_10.0.19041.1023_pt-br_eef506143c1bff6a\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\ja\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-lua-filevirtualization_31bf3856ad364e35_10.0.19041.867_none_45c5d1f803793e51\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-m..nt-browser.appxmain_31bf3856ad364e35_10.0.19041.1_none_b1e502c19c2a358b\Square150x150Logo.contrast-white_scale-400.png	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-wer-sdktools_31bf3856ad364e35_10.0.19041.1_none_f61301ca804606c1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_3ware.inf.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_2a440ab1477a8edc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-provisioning-sysprep_31bf3856ad364e35_10.0.19041.153_none_48a10c747e2f96a1\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-spfileq_31bf3856ad364e35_10.0.19041.1081_none_e9c4bc0774dd1b98\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Windows\SystemApps\microsoft.windows.narratorquickstart_8wekyb3d8bbwe\assets\NarratorUWPSquare44x44Logo.targetsize-64_altform-unplated.png	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-virtualmonitormanager_31bf3856ad364e35_10.0.19041.746_none_8ea44a74d52478e5\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_system.servicemodel.internals.resources_31bf3856ad364e35_4.0.15805.0_de-de_c5c80a0ba2ac0c86\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-installer-engine_31bf3856ad364e35_10.0.19041.1237_none_8291e45d9d19a4c1\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_hidspi_km.inf.resources_31bf3856ad364e35_10.0.19041.1_it-it_542e068c8e1296bd\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-d..ne-dsacls.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_c43b7a18fc22fac3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..tingshandlers-phone_31bf3856ad364e35_10.0.19041.1151_none_6a306bb457aca3a6\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-sfc_31bf3856ad364e35_10.0.19041.546_none_852f0a4cbb00efef\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-wmpnss-publicapi_31bf3856ad364e35_10.0.19041.1_none_413e392005fe1bd0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-t..unddriver.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_52caa106eea4ab6c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_wvmbushid.inf.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_6be3dce140cd4d29\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_amdsbs.inf.resources_31bf3856ad364e35_10.0.19041.1_en-us_8078ca9d04cdbac0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_c_smrvolume.inf.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_29c0c52cefd35efd\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-a..grams-adm.resources_31bf3856ad364e35_10.0.19041.1_de-de_0af04cb6d703a106\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.19041.1_es-es_d9b3b0605a209239\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-directshow-devenum_31bf3856ad364e35_10.0.19041.746_none_418ba12ad31b7819\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-appcontract-bmpolicy_31bf3856ad364e35_10.0.19041.1_none_bab0858e9282d2e4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.19041.173_none_6486f23c2831aaf3\InputApp\InputApp\Assets\SquareLogo44x44.scale-200.png	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-coreshellextframework_31bf3856ad364e35_10.0.19041.746_none_6b78bd522e127f45\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_de-de_fa3317ce4cfa58b0\sslnavcancel.htm	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-u..usnotificationuxexe_31bf3856ad364e35_10.0.19041.153_none_51feabe070ab84f6\RestartTonight_80_contrast-white.png	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-p..worker-v2.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_eb8c959f5e09ce49\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..webauthui.resources_31bf3856ad364e35_10.0.19041.1_es-es_39d0c2536e6a83ac\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.Vbe.Interop\15.0.0.0__71e9bce111e9429c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Management.Activities\v4.0_3.0.0.0__31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-d..nt-winproviders-ibs_31bf3856ad364e35_10.0.19041.1_none_97acae5dfa83b75b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-dusm.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_4c5224ef0a5e3765\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-msieftp.resources_31bf3856ad364e35_10.0.19041.1_en-us_6a6519cc000a2234\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-n..tailedreading-ja-jp_31bf3856ad364e35_10.0.19041.1_none_1b24b4a8f370aef1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..lprovider.resources_31bf3856ad364e35_10.0.19041.1_es-es_a3db2d51bdc9a0f8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\WinSxS\x86_netfx4-web_hightrust_config_default_b03f5f7f11d50a3a_4.0.15805.0_none_e95be31feaa25a13\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-w..l-library.resources_31bf3856ad364e35_10.0.19041.1_it-it_cede4f01a8b4a96e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_net8192se64.inf.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_c1701697e2b88225\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_netfx35cdf-cdf_wf_target_files_31bf3856ad364e35_10.0.19041.1_none_22545e93100016a8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd\ = "AUKXKAQYKNPRTBC"	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AUKXKAQYKNPRTBC	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AUKXKAQYKNPRTBC\ = "CRYPTED!"	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AUKXKAQYKNPRTBC\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\596KhShtP65qXDb.exe,0"	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AUKXKAQYKNPRTBC\DefaultIcon	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AUKXKAQYKNPRTBC\shell\open\command	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AUKXKAQYKNPRTBC\shell	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AUKXKAQYKNPRTBC\shell\open	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AUKXKAQYKNPRTBC\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\596KhShtP65qXDb.exe"	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe"
1⤵
- Drops file in Drivers directory
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\aic_file_icons.png

Filesize
50KB

MD5
a42a3b0d60fbfe616bfd142c7665f63e

SHA1
8f8dceb49b00dc9b627d656d33528761b9509c50

SHA256
0f6b65b95b1dfb580946b9337f7b0f898a820513942185c89ee886428c67e754

SHA512
89eb9772459bffaf372e26ee6db71d312351f89b2befe6661a3d789e18dd12019328776cfd90cb646b7c01e3dd7f9218dd7e5400d16ef76b30b533fcc414da4f

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions.png

Filesize
1KB

MD5
549ba9fd4d77cdb98377a16656023453

SHA1
78bc7706000c682a4d2be47fd0e38c026bda3f2f

SHA256
455d98bc4fb57f02e530a2ddd88d2f40a32617d12319354a3d7a24ba804427af

SHA512
f283d3ff902c905344a95cd86f8c202971f0095767ce4731fb0bcbf6fb5fa8ff281cd2a13e97d315c34dba06505b1950321cde892603a75a129a9a1b9e667ec6

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions2x.png

Filesize
3KB

MD5
f19528f6b90d7471a2a1be65902e03d8

SHA1
2eb74efdf4bec0c30a467a817675e0c1f7a10428

SHA256
443e09b06483c1e14d7ec81afb929c682aa8d15b0aaedc82296c026e049acfbf

SHA512
319967ac12cef28cc446de1a2a21d82b461f1d6fa4be0d3185c8b77bd5b5012ecf626662e926f1e1e9bcd39c889159f2468caa6bb886bafdd489531a9cc86a71

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons.png

Filesize
683B

MD5
e552a530285e3d506d6e17a580a4930d

SHA1
7cde71b3fc6209f7c9a29174f3d750b24ea8e702

SHA256
236cf52c8c91764ba84bde96326da05c4e1381668e933d9d0fbfc19c0a801f3c

SHA512
31a542495a4b91bdecc0de3fdbfd7f3d541c684632745cb42822a4494632c1eb875d2091a34c25e989bd6b13157a9eb10a8ddb9eba6fdf9abd3aed644b4dcb69

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons2x.png

Filesize
1KB

MD5
e641dce68891cbbaf530cd9b3c934092

SHA1
cc1d7a6e3f54b8a0d2feff28cb434b3644d3c17b

SHA256
561a5f594a8206711472c3dd0d874735add28b211eab5a0d8710d96baa487fa3

SHA512
f4d6b0992a77a146c7a6d1ec4f83b004320b78ea4f18860d14300cda9b27548b174ebfeeddbf865a09a4b444b92b8791a928016c1989a331bda0ca49deea3e1d

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon.png

Filesize
445B

MD5
e6c51c1dee19c3b5fcdd4d17f5ca43f5

SHA1
79d0f3d8e8ef7fc945adada21a58ecee998ca0a6

SHA256
4540e38c9a5aef0d706f5b63e9e70d2cc8ff63ceb61be2435878ca1281d84f5a

SHA512
cb3bde4d937bfdd18d184a018a651f72e78bc96d647d730c18a3f0376d6e4e321fc4bafd32fb3a1bde6fcd5de191cb8475fee01e7ec9809b33c5d0925e4c84df

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_2x.png

Filesize
611B

MD5
e0519e695f221e2b0dafd7ffbb4bbb57

SHA1
1ed9b4c55c887505901ce8d280d6e4fd2cd0a704

SHA256
83256089514a6ddb1564195bb5284eecfb6defa8343973362ed79763064427e7

SHA512
19e8e14b4880bb545aed288a8d9ff866e23e9b4a5e26f99576c17bba415f1b7dbb7065c4c0e6a92be3138b7bf65478e258ed056956307de4a99229e1d203e5ab

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover.png

Filesize
388B

MD5
4bb22c38bcaaeb2f5024c91d3a27dc97

SHA1
a2aa2a92c18534437bcbadbf8f77e1445f6207d1

SHA256
db722c05aae5bb46b04f74dbd73b20c9c7ca67fb105d0a950aed1cf6f412ff4f

SHA512
1e334bc38c754013e9b032bf1a87f3dcdc13c05bc8b301270e060d880b91f404472317a3bb33525e5e2f11deb4174849ae5b9f836d4fd78a83d983241e4456be

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover_2x.png

Filesize
552B

MD5
082e7d96f3a9d34fc273d3291c1a102d

SHA1
0ddd372eb044ffc70aeed1fe25bf97d32cd4a625

SHA256
0d97ef170eac44e7f82e2f28e79fe8c57957ae0809ffe2d01fd61af20319f28b

SHA512
7e23992c833396cbddb484dea1f6c8e9a70a2ec64ccebd5567abfeada11f911bc0f3685e3c0fbed6598ee9c4a2b2f57624ce97cad0b6abf9321dafd92da0c41f

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon.png

Filesize
388B

MD5
64c76cb50e46293eb7c7c28c7b3f9b07

SHA1
4ce4693a1e293c73c0929bd94de82fc10c3dfc70

SHA256
c463fc1ab2598951e4d4abec3b500532c7cbebdf49f688ee3fdb613211054b68

SHA512
43ac4ba204ed283c606fd8ec6751a19f99a25640a013186e0f4a96b02c7b918f3422ac28ee2e9f88f9ee30f346abed59120a2335e169d38d1bcbfd9ca62c93a5

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png

Filesize
552B

MD5
d1d11c363d47fab360e5240c989f1491

SHA1
8aff4641d9f1db048f84e7b95477f06541a33489

SHA256
620a3fd034b6cdc6377d9fcaa2b68c433f14bcb0de16980d9749493753356b61

SHA512
0d1dbbb7f50207569a6db3df2a85b46aa914661d1b97cb9a0b77c0d940a62db35507068e9d3278d9e0f5d25976a464903b93c8426c0d6314da50ab2aafe68f87

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png

Filesize
388B

MD5
952b7d7bb474c157ed575b34fc2ca011

SHA1
1737a0e51e6d5754d7c2915fdd1dde920aa6f8d4

SHA256
ac1a41fc803d7663260da573bfe30233ad97210777d28972519b8edd51cc9180

SHA512
e716fdb1cfd92bbe4781c6a94c20fba372d22cc87bc4481bd4ed9c68c55e3b6960b478107ae260e8ae0f64829647b7411c95fda6183f2ad679122f6474f1f87a

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover_2x.png

Filesize
552B

MD5
e5bdfb6ebcf0db9ad74dcb346bdf2d92

SHA1
adbd5e885a1363542e4d49d6abdec5b69cd2c5dc

SHA256
6df76e30223c62bb18eee5cac18fd421eeb1105b50eb40bd93fce2a6ed64196f

SHA512
82c7e59acb5bd575cb137bd7aff3e9ae4959e87977cbd7240f1166a41654529eb47c6491506e06f7601e7981163b2f2b3bf793f33565efde309f0f2e15d0d0ee

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons.png

Filesize
7KB

MD5
9010a4fa0693359512456be269533404

SHA1
c61974bc4e7c173088f0f1a66966a343b53c939a

SHA256
7e32126a9dc16d8803baaa38bb4068a7d7feca8bc67c4c1faa660123d96102c5

SHA512
709fabefc6d2c93817c766d4253323aef5ea687e80c1dd56152e85269577504b78cc0ec388eb75e724bc025fc6473cf7966be9e5c699a59c6f9c922b09e3d544

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_ie8.gif

Filesize
7KB

MD5
0a1cc6954df63a5f2e23db1b6d6b1f7a

SHA1
1d63f547763dc94da07b8241647fdf296639d946

SHA256
bc5d31f197e98ddd3d650f09782b0a2232152a5a0fbfc9c7d95cbd14f513afda

SHA512
fa6842c3c4a9281b8f3434e11dfbab043c266b042bfe8eb739b3e49b15c572193feb4ed76f515f0da7aa14570459ccc7332e3dd4972fc3096503034800626c41

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_retina.png

Filesize
15KB

MD5
8045a3576d65aac77e2ce5ee4acd2e8f

SHA1
63b2e77f195f25417e06f64e6c033722972182ea

SHA256
45eb90c70db4c6cdf3478218c540a9dfcefe5725c815fd62b80c6d890a1a7e37

SHA512
1df69b060e09c272f3ab6de570e072aa66fedd59f956c479e881775f117504c7571629d693135db44f0ba0e41184328bcababa720fe5d3309f6121f1727d4720

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons.png

Filesize
8KB

MD5
3203b85c167a42ecd18cf006a79aa2a5

SHA1
115b2e942d83566af0b1367e36f6c283b2eb3487

SHA256
dc52affad69e61f172676d0338b2c9c81108b54b7319dea4d835b41a94644531

SHA512
32a7d1d090332bf29e2eed1344a72561479295e4df2f23264431d20613eb95aedcbf0bfd10b96c9dfbad5af8cee910c5947a296db6911e471d280907f41cc888

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons_retina.png

Filesize
17KB

MD5
636ceef9ed83dbbce752750d2dafa5d0

SHA1
c000a8f8048cd092955f7feff87f55e6416e7705

SHA256
a2002e47c7f5afe4a77b95e8da59042cd27c56fc990b09642d046433cc70d07f

SHA512
dddeb44fc3daffcaba2f9ebbed88039d2a7ae75ab98fa4aeafb480073845840dd96668268b81bf57cd5c79deb5448f62267418cf599caea02f92e40f0c947f1e

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_pattern_RHP.png

Filesize
179B

MD5
55a87abd12985e709b1bfaf9fb723f3c

SHA1
22a61e96542d95a5ff321402376ab5d715deb500

SHA256
bf294ce7c94b403b5bc27bf260916b529633d222fe06950cc20f1afb35841c17

SHA512
ef6c35f71c5f58a32a20c4895603ecf79a14965a76e2098cd3c2f7a548807f9d397ab12d5cd343c7056b424e1b18ef1981940ddf317006099858506f3139c1f9

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_patterns_header.png

Filesize
703B

MD5
9251cf9856087002c31721aef90a9db4

SHA1
edac71fcbb4457faa65df83fb419f5d1d6ee49cf

SHA256
161889ded5d08f6e40d2b137dd201533467d8676849ec42565cf7513e4a910b9

SHA512
334e187fdf1d61773c05eeb2552fdae2130d3218218a2c41752ee34857474ff258c813e4c8a54b86388dc3f046aa40c188ea8d26ee4e37782414084e1a103d96

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations.png

Filesize
8KB

MD5
d48c992f2fee93297811f2ee6e942eba

SHA1
3b55fe7a5b31fc3376f1c5560127ac80287af6c6

SHA256
b1251cdd29585360b9f29f7903b1410672524d10f5fb10fd0dc32e9571be69d5

SHA512
1651a77a61df6bf7275d09e61a6b6131f0269365a687cffb372aa6c191bf8537a234d2a0206baf752e25220015f3806ccdac09cf8006d7a76d3f7e9707cfa9ae

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations_retina.png

Filesize
19KB

MD5
01931a52e7319903b0373a0a7ed471d9

SHA1
800a35780a593fae9c9e9f513b0af153979e1f30

SHA256
3cc5e5eed8d8897a6ba74018f1196ff70f13182f22dd490d84f97a8696f3a57f

SHA512
2c233dbd591f54957e3a7cfecb60fbfe20b93073681527471d4b3082323ad8fe57ee118f2faf655500d99e169ddf486d3723113921aaa278c37fbbfef654ed7c

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\faf_icons.png

Filesize
6KB

MD5
1e6406c792c49e389faed1e2b8e53cfb

SHA1
0682af23421cebab2d238a7b8a8b70a49b1c3fd7

SHA256
c30a0de55bf47c986c40a2da5b65be41394568617187820c5e03002255282d8a

SHA512
080995cdaa055fb60465b75493a7a90d4b649a6ee431f8bb38970b81e86b550a9523466eaf8aea260c068a1e7495985232492da86535da21d9163f2f3a23d8fd

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\bun.png

Filesize
2KB

MD5
8323afaa3ab620520ddb6c3f647f5f8b

SHA1
2ea46e8ad08bc5d08a1531cf4b2fd17dc9298ca4

SHA256
6646034b9524b6665bdb6e6fd212493991d776e5f54f50b6c81c609ca5ec77c8

SHA512
515a794310b6ffc4afd96eb8f2e8592e23d181bff18a0282a7928734e267db8d464befa445de60ca681d421978fc5630ba1d05a2548924f9ebaa17274bd7ac5e

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview.png

Filesize
2KB

MD5
888cc9b829993290fabadbc090f16fd9

SHA1
bceeaf8ebd6cc78fc046438a1fbcf1ea2272fceb

SHA256
7f8344b7752a86982fb2c1dc07071c4c4156ff608627349bd705acc43732b79f

SHA512
be6c83b9043a763bc308026484536e0219f12e8ea4ba6ebcb5f5cb518d1721a16f47f67aa745ab080533d8b3ab5d68f10c26bf4cdfe1865f0acf2eca3c8de68b

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview2x.png

Filesize
4KB

MD5
52448e59d760b17cedd24dc1da228d3f

SHA1
6597206877599fa89cf292413b29b3fd0617263f

SHA256
6bb4c14dc6d311bb06574f64bb4217d4591fb620cbcd8c72f22fc071201635b1

SHA512
00660c6e41e0f7cdef4dfbd81ff13e8c04b2d91ada6ffb75dd9355bdace04c9419fbce9d9f59c593a307f197ef13f0436007cdd815537f1aadacd32466183e5a

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small.png

Filesize
289B

MD5
01679d85f0db85a9c7f190008e8a7bd1

SHA1
989d0a8746be3d2ec371e688df25686f17854e60

SHA256
c82367bfc0a634024f2ab5f1feca114e0e8c314d91c4fd8fb99b13b62fe4b303

SHA512
1fbff0dea9a74a9b7e842604e77aec892a68c3e654fe40de289eb6be9dbdfe2ad8ab7386cbd025fba972f3fea74a9ea73cbf0d24e6d5f892de9269c9083a5584

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small2x.png

Filesize
385B

MD5
21fc6ec9987af6b93be22ac137cbbf3b

SHA1
6f719d9d6eaf1ff2ef0b97ca0b29cd5e5c5b52c8

SHA256
f9c210c4c88bc36227f42ee702b1dbb5b5bc02d31b48fd9f3de59af5d7be3bbc

SHA512
e10b72b40a7aa8a22969f3289d84f01802dcfea9dde0666bd0da0b4356baa64c7d238fdf61b6c1505bcb816e21f943521d338bfa38ae85f06806521a86ca42ae

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\illustrations.png

Filesize
4KB

MD5
618405671046aef6012d2f98996c6cfc

SHA1
5969166b52af8f88592961944ded06f2f00dbcb4

SHA256
d2d3cd0c250b95aefbd30e21bdb3cb3dd24dddb8798933d235d15b6e57c94500

SHA512
a361eab0ae220b45860e7e952499e4376ec7c8521ed9b4c55a56434f9164d7e4f38d97a41950ec1691ac6028f740a123260b2f00be7427379ffaf809cd3d2098

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\nub.png

Filesize
1003B

MD5
26d44fed227cb8fcec3ddda711aad172

SHA1
00b8747bc0bca43f3f47d897b3f05b04608bdc28

SHA256
ac3a09ffc5cecfeed854234a1024f41154a92f0054f556ddd5e8e16c2fd90253

SHA512
39717e596ad7abfd5442d60e38a5c797f45d75f54abc18f0923efd8a909882feeec2569bb679aeb8ec27623514c089e4bf6c77ebc7f70df4466bfa4c0b40e01c

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons.png

Filesize
1KB

MD5
d1137d50fe073e6463de65cbdbe78885

SHA1
a2ddd8ca358c1097e206abb494bf9a7c35080233

SHA256
494ff7120a25829d74923008e1718e7f336a7f95ab35ea24fa7e1048d9bb8bb0

SHA512
b4bbb0c7939eac02c9b3cbed6f7aa14f9b24ee3896f9c754347543db270fa654b138b74c131fb84e1925aec9c2f4c97814e3050e4a6cd90f28d8b291e74ca74e

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons2x.png

Filesize
2KB

MD5
094bf60d8fb814097ae24b92b8a808e8

SHA1
236ff1da520acfd6e877d079f05d5ecc00ff4a06

SHA256
a293788977035aa67224e4b58df4c6d5dffda496dfecfcaae6e78288047013dd

SHA512
bea7377e24b53b54728f7599589d06c3d40a58ed82cf849da8658689ae007d8e6edc3ed55db96f6a7d8735f5132a2c5e1dc04bec7faa47a804f4abb354638777

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adc_logo.png

Filesize
3KB

MD5
058e60acfa734f4c79aae2c3be9cb44c

SHA1
3de629341e50dcb88bd2cfe4f790351949eafbf4

SHA256
c3d598e6b7413b7f0c6cc148a62635c1a16f2ac051a16895330355e57e92418d

SHA512
6c249de722ca1b94f51b930b3c1c0ad20938cefdada0431aa002308ac23a385c9f3cfb04f141858628198ae3f0d06fe450473fb857ba7a40b596f7b92d82669a

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adobe_spinner.gif

Filesize
556B

MD5
9c6174d47add72510a4cbc44743b9a19

SHA1
d9018384f328a8169719cc3df08f527c63982aac

SHA256
ec91ecb38a56f8cd4d8a13c8a9040df6d8b53ab4c12ff95e029c4a2badac0f18

SHA512
af87f05f5af340f035290adace33dee12a77247f3ee7e7b595640a4e87243f553e467e620b1916ef5856657dd85a71f26f42e41f44d81b89d43d7f2800732a67

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\logo_retina.png

Filesize
6KB

MD5
e109e3a204ce5f01e6135310f074814c

SHA1
7798b169fe194a930cfd3a4da3a3061f8f45552a

SHA256
cdd0ac59d0ca8d51a7bbadfeceaa88658cb978d4e66d6d00f388ba9a028bfdff

SHA512
2ac9148a56a2ad82691749ca763f8150e86eafbf736ca6780ad0d115fbb90107b7ec767977ee138a2e2eb4fbbd6bbe18b3766e193c8648b1d857a51d83270400

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo.png

Filesize
826B

MD5
4c927800d0750854855f015aeb92e8bd

SHA1
38a67c8370ae7f77909e1f219e67a3a59ce8085f

SHA256
a52f6d60f6ba8fcae145128b75cb62504542aebb49b4fe6258d9e07b5a8613bd

SHA512
758bfaa9f727418784f71d3c9488a26c03633725f810c5ff00ece4e550750b7aebe56e9ed26ea7bc1e9cb0cc8812fce0f249d2f46c9a4fe905be8fccb9ae4f30

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo_2x.png

Filesize
1KB

MD5
ec754ddf6af03772af5f18929d07cc8a

SHA1
4c11444c23b2956de54e01c1284cda01db70eef4

SHA256
70392d62ae8b257524b6b861da41cfd35c1d0f60ce9b66414d880c8c12c13ef2

SHA512
594687e872952d2f4772bbd7a0bb8e513ce82298d6aa7ef49bdeacacfa665fbd9ff787a44bea26f17f1d4817faf57ed57a2a4b3b679e4e4ce9fcd1ced4ac47e6

Download Submit
C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB_EURO.txt

Filesize
32KB

MD5
65b488c50b628928329e023a51ae0e57

SHA1
c9992cf3b5d218b80c528aab77c83fce9623ec5d

SHA256
d9a53872090b882c047398c5b20cfc23465a6a8b69f2d141516d3cc00b56aa68

SHA512
06745a7d722ad3dff613eb1978d51629c4bb48c9dabdf1e9954529cb02c21da7b15af059699442eaccc82a8916482b8ef3148eec732f9a4e8ea27727f557ccb2

Download Submit
C:\Program Files\7-Zip\Lang\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt

Filesize
413B

MD5
b7812b46bbc513059cb5ccf00c691fc0

SHA1
03028393605ef0d8acd6e9d352e6771832b8c583

SHA256
530b750ab27fad54d3f582b4112d2476731b541c8e34cf2ab101835442a6f62c

SHA512
5228e02db737a4618374165450d38a6c0487e223f9f8655609d769aba01ea26c311d2a6105d950529e0ec50d3eac73e237d4cd70143be9318163b9726f7c0d41

Download Submit
C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif

Filesize
153B

MD5
43400e6d7061a887079e6bdf19434ebe

SHA1
782774eaf236804683b99643943c638928b97a80

SHA256
a45a57dd15fbf9b34e14232e597d914f1e64bfa5544e1fdd88e1b3419547a7db

SHA512
c3261f699be93f9a190835a73fa4e4b2ae8b4c37dd5003c3e747e547b150f05b0d6ad01b044be1e1ee28d1efb575b7b411b7e878f82044c3e9ad2fe7b8f4fe33

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt

Filesize
190B

MD5
911fe86fc0656c4af1e48813cfd5b398

SHA1
b29603ead6ddb7f9727ac5fbd207832314959f28

SHA256
017e7de5b3f79a20e7683b7d4d7b66f0b3a9f537dfbd0f600dcf19e58572e52c

SHA512
b622e2916c8d045bbad10d8d106b29e87dd134e906bf9d2e8235b2a2b5f8c4c7f508d600ed0a048e8baf44f25cea83911eabcd7f1e5667a72d278d52e0d049af

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt

Filesize
190B

MD5
e34a5efcc08662f95f8b5f9ecbc6ada1

SHA1
b18589bf4539d0ad7dc77d3749c8b823621f46c9

SHA256
16ba0d9b419af10128a97d133ab73fd8d39353a9288b3b7f10e0bfda765f5379

SHA512
b76668d6fdec995535f76118df2ea32c9d47a5030da95b27f3b12fdadd0fc6b77ddcc1ac1aeeb73178c2e162724ea5989b3a8528a1e2884dbcc29ac1ee3d204f

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md

Filesize
1KB

MD5
655084137798caa20d846647d3ecafb3

SHA1
48c03662360c9843bc3ddedd3e7c9d6ecba830bf

SHA256
63474987f1a911f49be5996098d19800d171771665c14fa47c2466a1a4760796

SHA512
d470e556e94fd8277148b04b00529232170ea23832ab89fc22689efa7e58bc9c13196355f456da03b7bd66284533eab61c6b86343190611fdbeaea114f3b1a26

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\glib.md

Filesize
31KB

MD5
4d20778c30b9721f4fde4b6ebdb94f73

SHA1
51ee518a9dd603e0cabb8d24abdd1250ad86c7c6

SHA256
5886b89b189fd9c2ac3c4d65ef81d2edc8c112cb41378a877e328dd6b388525b

SHA512
95cefd5200acb5b005761e816f195192cccbb45d83b3952cff30b6eb96d190fd35281688eed2fde0b2bb1adcf8a2de62a558bab9ccec46193de95e9838cb1be3

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md

Filesize
34KB

MD5
c3cde0ae04122bfd21198a32ff9e1462

SHA1
93a527f4f73db2a0c90c2f1ea21bcc0dd7a2809a

SHA256
25f64ecf8ab6ef9565dc315d0e31a669304ed2a705dc40cbb1246b69ff881511

SHA512
64d6eb62a689ba7fa967cc45f4f249162a226c61dae707440c4529b4e78820de876569dbfb5dc279d06b971c12e807338e23939c1b32e4f0060dc67f273f3669

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md

Filesize
23KB

MD5
2db8f51678f5cfd333ac1c19b53ec5ca

SHA1
42b3460eadcd252e862a940bf8197119b437458c

SHA256
59b21c6f669bb3f145d279f90b0305a9b712c01d3ed27c406581ff5d276b6fd8

SHA512
4b9734583ed9f6c4111aa0167ebace74933f0f5da2ad6c2ecbffbe4beed0735320179cc264817a805f23ccb60489657b99860f86cf8ce3fe977263ec8d894825

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md

Filesize
2KB

MD5
4ff7790d381e9b824d0c451a6235e094

SHA1
110364982ad700292876b8b8b556771e7ca2749a

SHA256
108127df1ae864948d3e93e5fb53d7e93e1d54b3e9c2b6a21513de245b0ea2a6

SHA512
61c879a6e40432600956808098a3e44e97e7dcf15d660d3ccadbb537814e8b9f13e07f62ac85fc410f287bf1c84df2db552d24b12618e6e9042664211cb3d2ac

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md

Filesize
1KB

MD5
3d721781d5c711dcf589dc9b4ab8c4f0

SHA1
48a93f405be5032d5452b463796f4187ce59d0fb

SHA256
cf910bda6637d5c9c33ff421118130190d25d0933713d546212bec81aff6d0aa

SHA512
5b4658df5e846d5f8e7fd3658d8b8651a9247f582461e8dbd31a24f7df8999f4882d74e737f8d80ca9a5269ab0b424f7eb63145afc6af495bc235e71ffc832cf

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md

Filesize
3KB

MD5
ad299df5f667e3934aaa6eee83ddd681

SHA1
91fa17d30f6bbc10607b385057be8e612098be6f

SHA256
61c6710f2d6d5aeb46f0cb1c5a8249fdae8c0d8037e6418d38879ddc329c3713

SHA512
ebd1cb6050d57a78b4ef6462720c5628ef1f88b4e6f1125784f859b116ee3407bf74ffdf88e588ddbe398852e32ad8b7de0e1a920099ef87c2d1ee6fb788e33d

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md

Filesize
2KB

MD5
c2d45aec33552c6a7b2e35d37f685ffb

SHA1
e077a107b69ccc0734402e55f2ec5db1245fd0d9

SHA256
a7fb7ae04424b9f6862648e13dfc05a8e3bd9da7968419317c22b187e88f2e80

SHA512
c0de24b97dc6806b92e0611e156dba7558bb16ff2219c1ee0c34c215ab65a685c6e9a0bfdc005df3281aebb72ea17b305d650ae207261360b5929822f1db1d18

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md

Filesize
5KB

MD5
f0167e1f603839074c8a5fff4ce5d940

SHA1
693a31e884c3030e18216a2e182620777aba1bf8

SHA256
bb1521d804956227a4ba4c0656a17cadaa3a89c0c15698d46f600526dd86dedd

SHA512
5f3cf39a95306e5885bdd5f1265b95eca3117a541c7ce0c426cd0d5b7402df1be3e2d395a2c34cd22e0584cdc3abe0ff994b2c958e4ca6e0436a50edd1ff50b2

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\public_suffix.md

Filesize
17KB

MD5
5cdd39d47f998b179b4293d99c88f001

SHA1
ab203de3dcdf082f1bd052371637ba449918c3d6

SHA256
80410684db0e35cf7faefb5225028497d2fb71db53e5df53180b4e7436f90d6c

SHA512
1b4186a150c88d0fbcdb3e57584193b3f21b9b9b1dbbcc1b90852989b402df181e0e2497fa15ace04e465fcdbf3d17f0ad4bd1d230f0c876de4755e71997509b

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md

Filesize
320KB

MD5
463ca97ad2cb527a7a84ca8a7ef45871

SHA1
b8ebdfe4c474af8f10c82670ca44daec65ce12e7

SHA256
a438ce773cabbd1fec20aea40b89fcbdc5a2ef00f212bd6fb765ef27e906b675

SHA512
12b4974f452c67efb075544cf0ba048da2a32b4789be5dc293916a91ecd575309c83cc16a7527d7e0b8654bf07f84656bb6691366c0c5dfe990c988a8fc165d7

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\asm.md

Filesize
1KB

MD5
7207012ce722245bda285e7998a54111

SHA1
e71cc4fc8b979a86356cfedc2081b1fa4b24acbf

SHA256
212993f30404a5af94103f10d4255b145666f5f3444eadda19ca964279d19441

SHA512
9d1fa5165e716c65c4f43778191dfea411fce5bbb0029b9a3786d6aef4f145530db996e8834dd5fe9fb16a897bd1ab59110b23eee9ff7702dce520c06e8aeb38

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md

Filesize
10KB

MD5
b2f76f0b5307fad96dbf6e1a576c26b3

SHA1
35d8f938b417c68eec2f9e6b5735c1f644b9e709

SHA256
907131e84f7cd5fa21132ef9c7a872426f6c610c801fdb3afe4e52d4c8f4eccb

SHA512
f31026a8f58430b38c7d522d1555b92cc15d766a57e44d8c25453501efb2082ccba7234e9aa25942ab171822afe06fb420c6a475541f95a44f69b2cab65e8abe

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md

Filesize
3KB

MD5
62d2e143240523822408de4462c86d36

SHA1
9a4c1587063a21fdb46ca5b7447813bf12c05635

SHA256
ef0245080394c53bcfb56b2deb5be32e03d79352877be4e6c08646bca7966f7e

SHA512
2c0ef62680d087c8e381e6b32397c254d1fe5f5d9a7ed1472d204135883f23a792de40d57c5731f0732d728aace50061282fb1810129abeeb28ecaadf8a75afb

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md

Filesize
162B

MD5
9b82c7cdbeede72cd41d38bdafd2901c

SHA1
febb3461ee439d4f8e669f618d237b712d2d5797

SHA256
9c081bf4475592b3c5ec4e4fb81c176a46224b507d850d9b230df9e029bbce86

SHA512
89e99dcc105cd0c570e9e673cc06fe6bd6ec3f99eb481909f52dfec161e12e2828997bf3495c32f00dd26bd1de2cd228f28b2e4f52b469d7ebf73896cc1783bc

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md

Filesize
1KB

MD5
8821b3af22b7aa80c2473f8285082ba5

SHA1
29e0100c00380797bdf9fe94e3c947d32ad3fdb2

SHA256
15f018ce5658c922d997707f292c8b9ef4c8f154957590bd014ef89cc7a189af

SHA512
71b7a15f1ad04339f53293853847f263f5f9472e4339d732884acf05cd5a61070345f0353f9a7829313e6041e6b843a42e77a6e2c04cd985bd6eba7e4278ad9b

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\dom.md

Filesize
3KB

MD5
730c856f0dc037a5268f678849b0cc75

SHA1
26b9efe3a1ace9783a2cf795a660b357c5edc67b

SHA256
a814fe28a86dec4b7c7480c1fbbffab9570fea7fcac9589d36352215bd06624d

SHA512
2addbb78223b171398736eb6453fff3092432a3c22b29ee5ed020d79ca8c2a30570de11bec4cfadaab2f6d1ada04e7defe0cee1e82a5d9c696f7490917c740d2

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md

Filesize
1KB

MD5
4e56d007edef74583eb3ebe4fae0fd37

SHA1
068fa0b02baba925b27f9b5a31d848a5a2dbecb5

SHA256
e02e07c6dc637826112584af2943069483ffca46321647ff569cb9069a8a79b6

SHA512
c000d1b5f9beb89330210b549d5661e43271426a027042bd2bd91ddc71e6392989362a76ab601caa5e5b19b9d64a4e1cd99a9a613fd3a3c1ed58275d5d95f15b

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md

Filesize
28KB

MD5
fb258d3561872a9cd35fc4593b5a13ab

SHA1
d5c09dc1000c3f3ae036246ac913bc69a88df224

SHA256
6ba53ecfb9b2fb43c501c5e0bfc7fd3184a32816f047e23ce768823635829266

SHA512
4d2bd8c093b9f45b1a9ac9cff9405424ec78d110e123e47f4104d7fb05c96550dc50fe505cc4b7d6e9bd7126141a234133268edcef263162ea534bc69fa8b5f2

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md

Filesize
2KB

MD5
6b39574d5884e50e9e30a857cd159b9e

SHA1
3525991cc373c475c0f119e6842e6e02f01a6edf

SHA256
ec2f5db5107e9153ba9593b44c10b206276c1572dc8753645a79a883919ed991

SHA512
4fa0cbde11d3842924c780fadf38233cb4b27fb0af55d20108187d0a1a28390c6cf1d604061a30a4fbe77c158860860f54385728dd5128ae9bebccfe46a323f1

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md

Filesize
1KB

MD5
072f7eb659826db2e11c8e1262b392ef

SHA1
a7035062d882e3b944e1038f0cf8ee7c61ec4519

SHA256
81cd15db44eb21abf16a5b45014723a7177834e09bc517fa4d35fc65093d4b64

SHA512
8d93efff195cb07473375754bd6334dade124ed31a2d876a74fcbc782c99afb3c5daa6e83f83d34be313370cbb10fa2990ab53aa5897032ba126478e2a7d3930

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\icu.md

Filesize
2KB

MD5
b19e342f716c8b29cd368ed83df1a9fd

SHA1
ad11c0646f92bfc1bfe7704e37cd4cde509bf031

SHA256
9d76d6b534e4bcd9d1c02385123548eb37f0e76d463be6ea17c5a03b532b6d7a

SHA512
161815818013850d0937cc36923ee07362e6c81425d95cb99e170f72943edbadf0eec1c1f30f2e37c414a19d66cb3089603221b3a8e116a0fa751ddd0d4224a1

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md

Filesize
1KB

MD5
c6a9ab351ac2fc5538f870888119fe83

SHA1
2b8018b1dc3824675ffc6b27dfc7a410705f9b1b

SHA256
2a5bed5902ce8817f9d19b19ea6b5db493bc7cb9fbf56991dfa882c93df270f9

SHA512
aa9c115fb0e3afbb194d675df9b9ba466ae4d3c083b49be768381c4866c4b359e96e85de00421dc5b25096b51cc94cf410173084943b3cf2401fe48af77d50c8

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\joni.md

Filesize
1KB

MD5
406d4cdb781875c5377e2e4e581b47d9

SHA1
0d6150b050776e9bf445486916f7ba8276aa3fb1

SHA256
4232a7e1c94376fdde4517ead55acad7789f0afc9d055d9b9b65986428c2fd91

SHA512
eb61f96c48b597a395ee7c90fc700c1dd6edfca62e9f672b53faf6e79e6d51169ec55793996829be2691288544ba4e321e0ca16ccb342071d837c85a10eaf265

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md

Filesize
1KB

MD5
dd1807ac03374d36df51684215712008

SHA1
b08b9e21ab7d9905ebc2615ad18b2cf73660fc73

SHA256
b2b23bd2188b76ee953d3a236ca026c45bd589237171dd56f19ea662074fa944

SHA512
dceeb3e748ac6955848c307a120a0cb620054d3a5c6d5560c051515a9a2f5c793a09b089c3cbc8089274e31c14d61ffa2109fd9e32b358d7b1719d5296ddafbd

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md

Filesize
3KB

MD5
33506538b3c559d10d8028a1d958ab42

SHA1
219857eedfed30baea38a8c6a2acd926d1063c2f

SHA256
a111a7a7bc61d95673ebfdab3efd6be5857f27ffe35326ac4948e9bcfe77a360

SHA512
f19190b4415848f9bd217becffabcd20a740028d8cd9b4b3fb10b7935b5b1b9865ca430938c8500469064ab487bf1bbbbf85ab2f1e435640c97f6eec014066e0

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md

Filesize
2KB

MD5
5c7c935af924df513928b80f0fcaf578

SHA1
9a2c9347b56306e4be6c5021f9ae765b05781ca1

SHA256
769478005c5661ea6a200282a22ea89b5365362a6a44706d977688187eea6d46

SHA512
9727c0c5b064b1d03ed661eed472afb4fa9bb6c99ed2e9524cfe6338a5b575082e722fff5cd3334097f6447c4dcd2633460835d522c2abb60020b6bc56983cb7

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\libpng.md

Filesize
6KB

MD5
36b0b61b8ada93314aedae4f236baadb

SHA1
03359c29f9d433b780a0ee883c2361e133b86785

SHA256
1f0769b18134fd1cc14dab030c0d731933ed9ec368eb8c58e0d058ad55c2f8c6

SHA512
bb808340a39740882b15ac24faefb042bc1b3683471cc04bc687acc3d0d6f0773def38f19875cf6aea25b5afbc23f4d577779a290121e90ca1986b2d2137432f

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md

Filesize
5KB

MD5
bdd2a1ef702bec8de9a61d7bf398dc19

SHA1
9a5c65ff6ae2536409bcf482bcc9c65df3aae491

SHA256
81ba440e1356593cf80c72f7410673efd5d9d65705323e147d34b198472e2fc0

SHA512
b6ebeda7fc8bd8bc7089d446511923a0f62d6ba41af73c308a7f101f50feaea21ee3c63af097934910de0440e09777d138369d9e81e68618e4b4b50f6be90406

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md

Filesize
3KB

MD5
5fc6ffe1a0c4a30a194439cfb3d53950

SHA1
da73d18c912e8e4fa096788c619bfda4119cf505

SHA256
70bac16dfb8e985345823424d0d9cf10900fc8da4123c054c69ebd43512b4141

SHA512
b7589e017cbbe8e508cfc8bd250c4a2783d9fe1ea1393742848002eb8a4dbf646e87f8b945f99890690e530b60a2d060f883614cb23ac11cf927f09dc11151d1

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md

Filesize
2KB

MD5
2b5da838dbb01a95ffca754bbd485706

SHA1
8ee40241c202884e437b058e4c42bd2bb030de7e

SHA256
bd0c5b2f25a381bb29f0d26c7d470d47db45b2080d5e672f763519fe58c95010

SHA512
bc1fe162ece81585f79f8b01dff27550457b96c6552f5a08b19bc232e0aa81c8d5722b2e6e1b2f77352f9da9081a338d76a52eec87fc3eb7e7d619ad89211a2e

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md

Filesize
2KB

MD5
696d2626dec6072729da848054d2099a

SHA1
71e79133110feb2d73ed3c9cc36772d7e9ea9367

SHA256
986cb5b962883452d7dc3e3fffd14f11b1b709f7658c851830e21d37a9d5a95a

SHA512
9a1a854ecb48ed10ef85573503b6b98d2c304b04b538a3e2bf098874ec42f8bca965b9d0dc96ea0637cdfc729516c6d78a700bc02555b320a9b67f254fa7a154

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md

Filesize
1KB

MD5
5a0347155a3945bbc43dd6382934174d

SHA1
c145db2bb5fc2d7b2bcdad2ab73f0c611db52040

SHA256
045def713d1eeeed87a3a499cf41827980bed6941137438f8d283c85081cfaea

SHA512
723dc3af00649656db9ed85f39d49af70207897aa826e359ebc6018d32520bd2d693fea1387b659a034105a3faabf4b1284e0d108d44a0c6014364ee97b57535

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md

Filesize
1KB

MD5
8d8503d34eda0afd4435b8963322b4fe

SHA1
03f67b0c56b53720f8ee670ad49f382d34e3759a

SHA256
62df41ba54f7a44c4b20db3547f019e706137309ca9573daf27ab749e0227e8c

SHA512
d840c8bcf53663da08e46458692324a4e3f6ce5607fb311836242efc1f36366f1e60b42fd8dc7780717fda13a5d7e7f4e20650da75be0a9fcaf7c32e2b87e5ae

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md

Filesize
11KB

MD5
41f7d9afd7d337e0338988747e92ac1b

SHA1
550b41f126f864567086791fd800ed90a0571e44

SHA256
71412a38573d2cf21beafc344b99b4a320474057655306ff102bd9ee4ba19220

SHA512
586344a167207d4ec29b06bcb0500287f74ef3b3aa720ac6165a51bb029552615afc4c8983e80e8920b6d69cc60c16c0cb9a7579321a450d723591b8af4e1356

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md

Filesize
1KB

MD5
8261c0e81a199afc42529d12839037d5

SHA1
1789bc6d0eb5fd56a67c4bb9aba09e7a7eb9419f

SHA256
7a88be64736073e32dbd06b9515850c242f4d272973a0ab7bb704161725f8a66

SHA512
1bf2ae8bb2c4dd463cf4b3f4f13e2a96a524e031eb10068ceb2732868d0834e6d50627f8a13362f0a0b8d27676e6675fdae7bb93f236ee91273f50ff987dd7f4

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md

Filesize
2KB

MD5
49ddfdc5d74ce6f926726ade5e880766

SHA1
d280c228ffbacd6e2890cf45329cebeddb200870

SHA256
eb1b938549296f0656907b0ab63561e769b4e28090ae48b0954d527ecef51b23

SHA512
cdf5906a0ac882ab0905ed473afbaa8f0e6c0399bd05f0a07a54c2139ee8fa60143ee564a85afaf8d96f0a2d5750897c279b2406ba101feeae272e5c226919e0

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md

Filesize
11KB

MD5
79db6f3fcd529c9237b3d2f99f2275ce

SHA1
9fc160a0c762326fdacf06f99f180fc6a705040b

SHA256
34f1e044d2f69cb792bb3dc0a895335b86634a59258b3d99a265357e5d873e0f

SHA512
9ff2c0b839e8121ec2f3964d2aa6de06e1e90149fd82b05e1a241e17eeb6cfa6143f591c6831138a7c3fb6c513314d91b6a05abe49199fb7417e30c0a6f76bbe

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md

Filesize
11KB

MD5
5036979106425590c6af0b53d4e53e4c

SHA1
fae07bb7dc5c63b937a928f527d7fd1862765a46

SHA256
7c076f52787dd9f886844083245ca5b1060c5e6c6a8f2283abac67e7fc57d8c2

SHA512
2a6b6c9f5f1d83dd6c0d3ccc108f1a4ac0022825849392248cce3448c2bd114cd9f18f5c513419ed77cd38ab86d967b51d9bd8670e48bf349544bcb87b22d8da

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md

Filesize
11KB

MD5
873c39535d9a31d4c2c3196b2b558099

SHA1
165851ee1fe1b8c23fe7a56b9e9ab952e2bc9386

SHA256
d3aaa59d9e4ee4ef4e73c2f1db8da2227a2545763bc59c38e9898b4252066876

SHA512
77c2e4a639a74ee0eee8e2da736fe62dfc79bbeb1fff421f45772da3af379926a70ddcef438df552b8e339db13c3da7fdd82698b38f1c4afa4c8a47ba1fd3cb3

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md

Filesize
1011B

MD5
8cafe3d397964075e0535d465c5c2884

SHA1
c3a8aad38f568e01b9fd8f9ad879c4a0ba370737

SHA256
ffc31aa57b26882817653e6be32695ffef57b2cc70aa7b1a847de5c538e02645

SHA512
9983229ec8087c6fa6a033149f028cbd5e658fd231523991121c64bdc1f50125e5e1bdb6f0662687990f0ecafc8b3d83359f06479355b84a42264c8af68bdcde

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727655840085328.txt

Filesize
77KB

MD5
7125b39ba1de8be729b8e5959aa011f2

SHA1
0103adfd130e65c676f6a98e142bc902b64a4cef

SHA256
7ff56dec72b7093a4cd44e629b050ca2ddd63958e73fcad38b604193f7488eab

SHA512
dd2693b101a3ebc98a4109d447aecd371505c8dd181ad307cae0a57f32c5c85165482f82dff0224a52e58dc12bcdd19b21e36e2ab63a10a4362f3de5ce664669

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727656363999749.txt

Filesize
47KB

MD5
ad62a9f284b451d3ffe4f6b03da9a7d6

SHA1
1e256b6e29b0e0087da263e1ef6d2c87074e1f8c

SHA256
cf818ee04741fb34c3f493d52d620faad628e473ddd6cfd42ebecc579e54f98e

SHA512
12e20bd16a50a11b929ccf81c6492d16440ab7b6040e90349bb86b53e0e194a177d6fdba122000fe84a65fcb437eeb0d66defa18f5734c0b64fd0466537f709b

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727662640605367.txt

Filesize
63KB

MD5
433e04d2db2ba4496f1d52f8f510b05a

SHA1
9790c2e45879f28ad192231ca8df4ca80f938f1a

SHA256
d5b0adbef1f6ef9c859deca09cb5d561cf7c594fdf5c22a51d6f33eb25944de9

SHA512
97cf12d7b380f26dea3616f0aaa9bbdf03233fb76ab65617fa02e92dd592a5d36c54c68e3997be610ed4c6cee40860c172d750cdbfb363e514ea4e9c888652c2

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727665714398674.txt

Filesize
74KB

MD5
1b06149bb0c8ec72abea959d1a08c81b

SHA1
70c446e06ad77013c97ddaab41d729089baf373f

SHA256
3cab974381ca866ced2846198b7b850a229b1e21dc216ac23972d9792b85a6af

SHA512
1f4d282b772ba534168ace2b1327068dc5ac363aabc33d7522e5d8041c2ddf3f403246195d318093629c0866613a9ecd8e5366a5467606ce9b5afaa248906d33

Download Submit
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\File Explorer.lnk

Filesize
407B

MD5
d613d152e694be7b56d79091ccfb8d86

SHA1
774bf962925b7bed0ca2e76aade643c6de4fc975

SHA256
212d5d69348fa10317a2727ad65281fd84488e453231a2157ac3cc9a0c060a9f

SHA512
04a3dfb81125690bd118181aba4391daf889c9577142218f462be1bb16f19d773d6bd7011428e72cef6af9aecd4048e87ef3ae6ea23d1b23a01d7e759f24c352

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg

Filesize
21KB

MD5
9b0a79ffb646896d7d395ad448e9148a

SHA1
615d605b5f65c7e0991b6949f3f12f0ed129910b

SHA256
a19b0ccfcf344f8480ec5bd22c166d06ec1c6ee90e4500d7dda48dd1d2f077e7

SHA512
f4d037f325f20e8bf2011edadf17029a7d6224d245070084adc44c8f852b7e60dd20c9c13f9cf9354546d57d0691c63f20fc22a6e2b1cd28e0e288b7067915fc

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\HelpIcon_solid.gif

Filesize
1KB

MD5
91bc13e0b01e958b164320c9d12610d9

SHA1
696ec8be0c5b2cf74623b2270b930b55eb8a412f

SHA256
55b73a9b785e101961b7ce021854539530556e0438ddb5871fd48ba8631c2156

SHA512
2a830abe670f7be11a7b41a6aa73823e3c460a1817876e9f07d19eed733a7551d7bf7092c06a973df1edbd771b09b4f91f6524a76b3731db1dda687f9eef3ace

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\alert_lrg.gif

Filesize
952B

MD5
879ed6097be93bd18c1e6d703b3811b8

SHA1
557bdbc4b06ecac95967a2cb088b851b61558a33

SHA256
30e5242ea22edb0e29cbc6b49a3e71cfbbc0573aa25a5d7205780d4f12be2599

SHA512
1f7f01953db2eb8eac26745a97866769690d2fa022121d70d841a8ce78f2238f88585175d01ca8e38b40d6db7da292444a77e753fecfecfe6029f53de01c2557

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\aspx_file.gif

Filesize
121B

MD5
04e782846ce4d79236f76d46084e3292

SHA1
ff3cfd79a28dc8a27dc274582065d32bf7b7eaac

SHA256
fa2f663bd096efd1bf23a5f3921876788e6bbcbc47c1ad35d532eeeeca873b86

SHA512
bd3f0071b6943ca0a9b631bd1ef8e280b0869aec04b72db303f5bf46e5e0953dc2acadaeb01595b16cceca3c968f04cae123d1f811ae26cb5cd2c781f33c710c

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\branding_Full2.gif

Filesize
1KB

MD5
0f7117b6caae352eab01b7c808106181

SHA1
ac651444f03bc924107cb2437dd6ae1c362abf57

SHA256
435476fbea216a133ef5916c128fcf1c7367eacac126d53b40e217f372b39ada

SHA512
dbdc83b41c0882978a6e7b7ea5e573be66424d47496640dbdd88f85586a5ccaa47ba6f52fefaeea6a1eb30f523736593df8523deac6caefb87baba78ec84a71b

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg

Filesize
8KB

MD5
340fa70b77d969e10fc6f2a7a9e2f8fe

SHA1
e5b422c6d68e13d09a98fd269a71b04501ef11cb

SHA256
b79c50124f3ee977e8f1237fb7b1f2334ca96a00a84109a6776585058944babc

SHA512
5f8b43ebbe081770039428795eb64e40a523dc92773cd3187a2ba020b39ef8f2af90fb4ce22a78030b703556bdd0c15960e2971b6002af54f7878a895e155411

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\folder.gif

Filesize
914B

MD5
838b9f118f260e1425f5fa3e23c87b0c

SHA1
bf924f74317e982e2b7467a5f9168c0dec69c23f

SHA256
34afaaacf2d0a0d70bd433033e841ef18c4f96640076e8d1f8930b7cad701fb1

SHA512
ffbb89056f3e7258b91a44ef53824bbe3a17133a60202cfd2790600967d09f0f6e377dc348e383439aa93042d4c0db76157726b2265df5b1f58c0820da113d64

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\gradient_onBlue.gif

Filesize
90B

MD5
5397842c0b15594e357144d929ef304b

SHA1
10714ad21223eeb8cc41fef542b7a98bbcedbd15

SHA256
e945ddda86607d9cd303ec15d9db659b57aad54cf1e01795f147e1c73bc73ba0

SHA512
2f0341a43b41642aab6154e9fce20f52e8bd3425016807429cc55538e2f02ccda36c40915b9205df91644bac8d8ca27a7f67bf405ca659e36be3dde5172e5d21

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\gradient_onWhite.gif

Filesize
90B

MD5
23c502d2d6fe0830439deecf7db7988e

SHA1
8e86c0dcd298053e38791b005ec5aa0d3ed44c54

SHA256
dc2e3683746b2c520e9f326c81d448089dd2dc5cdd2cf45c5f7e51b1607786ee

SHA512
4144c56f634661ca37ccde11d4df8fa4e5b412f210178b224ae0a63d8b6620fc7c06bd4faf28dc44fe3879fcbad9c4ea59eb393eeffec71a79454d893e1e477f

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\headerGRADIENT_Tall.gif

Filesize
328B

MD5
2a60200a47386fb4bd04f0cd71372dbc

SHA1
554c8df76faa1b8ea7ec129891ee50de8f710944

SHA256
7ceb2bc25b95b45242b5a09f8372e52f9e4f9877f5916e46c9daaf690eab0a31

SHA512
870b1d242f83bf056e603e6debdd3f43fbc29e07f342343331c18d73f6d75b066283ea75af0ba9ab7d2322c1cfd0cf9e5f65952ea0835855aae36038af0d004c

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\help.jpg

Filesize
1KB

MD5
e3985ba8b9b0485c7f1dfad5ad694ebe

SHA1
215ff2c5976505083096d1a5eeb1582f74ac88bc

SHA256
96bf79a30bdce4c6bd5ac11af4ab42909e085897b80c94f1ddb95141de4e4b9a

SHA512
b3d9c21b5bd03f3c4c41c7cd8d59f51e4220a49786995e7609e5932a53c5071cf2cb26668f787b2ca8c64fe021565802c9482ad7ecfcb4778cdab5a591a1f18d

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\image1.gif

Filesize
162B

MD5
b09504a85b58675791af3ac1e6cdc361

SHA1
a77487383920c2ca72ba994f0c7ff6179b101ffd

SHA256
6a200bbe84428226aeb24f56dbc3c5004102cc30dcc117aa66b4c5bbe936a9dd

SHA512
962817518e4a3b0c1d2aebaaa862bb30fd8ba6db16dc99ef347e5cc1f421d5b5be13dac00e5a2bc97b549699eabf6f8bd7acf74af3e2814c7990e2fc9c53f1ac

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\image2.gif

Filesize
586B

MD5
962d909d8fa479428e90b831fd192ef5

SHA1
f9dd5dc8860fd462ef46feca17aa02c0c923dc59

SHA256
a7641f64f5497cc1a4859ea81396a49c8056db5662e5475b0151c68619e20fea

SHA512
e688dae1f1614c5be7c105447255a7a15a79d10c2fc1d51b5c887d05fd16b618b455778e7e30a57014a507b38ab93d6329d7a78fca56e21c20989972a0526229

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\requiredBang.gif

Filesize
124B

MD5
4754113a3c3ed98f2a8b249d320902e5

SHA1
72f600aea7f5b37a0d6a43a19274eb9559079a55

SHA256
75d81f1362d36857653d1790a0eeb52cbfb5d4cc4df02474f9b42f31ffa57f3b

SHA512
018d8f80ce33e8839ce8aa354a4b5fc4a5e85d2951a01d0ab32f8cff41bc6f2b599b59721fe68439bddaead30b451841203f260b31e6e29354c1821e0aedf1f2

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg

Filesize
8KB

MD5
246cb2082823331a44fabd661fd7e9ff

SHA1
c09679172a3bc69788b3aba27c38cfe86b2196c1

SHA256
102d206eb2f629f10d2782e2914328475a26d168861afe314a3ee1e60d4de5f5

SHA512
2216cd2624752a537c20565aa2c042bb26d65d58ce1c5359e0494a80ca0d91f702e3981277d4faafcfc495e241db5c66b84f2c338ffcff3741dde292736d22c2

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\yellowCORNER.gif

Filesize
880B

MD5
aded5381d800bbc73bdcbb9c5134eb0c

SHA1
e18e30fa633c682012333936fd34ec6b322b365d

SHA256
2f2f40a1bcc390ef62f33bb731d9c23005425a66c013561193219108ae61b2aa

SHA512
ebf632e597de4ab806981eec8fa1b08c045a650335098770f92aaba8dabc76f5f438f66c10279dc45d35af7f877b5b64b022c68d44b09a398afb6ae4b9fe7724

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group1\1 - Desktop.lnk

Filesize
1KB

MD5
f3431028e281442b92f46f228b8e2855

SHA1
fcf3f25ddf3fd54b80158e10995a3289d1cd0bdd

SHA256
5d8b8b7315c96fb71520514df805e39dacc70e1324dec0fcbeb17d68d8875cca

SHA512
262c4108b53eb6750dd5f9def5302ec2f2008584efd7c8a8d981d5ef0f43859d96562c20098b401e95ceecd12167d77544e310bfd66b90fc07d3db138d99b409

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\1 - Run.lnk

Filesize
1KB

MD5
02c2010c38b2b568b41cd0ec4c63b00c

SHA1
9f66ad9b6fba6ea7e22bf2b6e79ebb0e5c08849a

SHA256
c53d0fd7f386a0cb8b17c87990d88a2a71a5e7b4d9f797edf5b32dea328c86f0

SHA512
b79c41d789a8c7ff0697fb1a00cd164a9681db57ed3ae2dfded933edf3063ec0aa8c829d419baaa906f8ab79035382f209261d0530b7ea9815c89c19d5896dff

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\2 - Search.lnk

Filesize
1KB

MD5
c835147bfac9a811c170a4b8a45d0d1f

SHA1
c6d283f8e6fa966007edf4d270d3793516a5a295

SHA256
8aa609a2fda8765c3c7a248e8a453a57ccf30063b9ca50ce83aa7ed7df3613f1

SHA512
e95a1998c2935f4bcafd7a559f1a75d6f637f12f101bbf05482a761048903fe371c11157277cefa736d93671079f0de21e1aab249e8ffdeab19c4c6a5d92cd74

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\3 - Windows Explorer.lnk

Filesize
1KB

MD5
850ea572073d4e22fa6fda3466d29477

SHA1
79910e9194dc9c76936372c55fcb2f8ba070eee7

SHA256
1c81d29444ddfd4ad052d1507f4bd6ec2cec7dd5147a9bf154a0e294ff22aae0

SHA512
752f1039f06907f1c2190cd1b04cd8250dbb7f6dd0c3b1c54dabc3335ffeffec729c8e35db4b60ef15b6c8cd23c2cc2ae9c15e22441022e5bbb5bb12cdd7d057

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\4 - Control Panel.lnk

Filesize
1KB

MD5
6ba2195dc0f8b3ce35bc83894c9e6f69

SHA1
725a0cd12be4b4c45a7e1267dcf37a2349546fb0

SHA256
d67ed777e8100c78aa6bf329da09b1010be9e89990de2cb3d091a92e9450a80a

SHA512
47958f0132a7303415508c38f5ae93a8e3beb2ac4e052d63940bbbf5b451229654fb7eb34534b30a3a69c152ed418d0ae0c5e62186418a08feb0d729cc0faeea

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\5 - Task Manager.lnk

Filesize
1021B

MD5
8c29350e6991b78c1cd02b50a6fa9885

SHA1
6d16a6d5f3033b013ff896dd4d877f8041fc47dd

SHA256
8dca7d4df5c5891d9238bd537d3577b9f7e084b386809617b51e37fbb05f2dd4

SHA512
6c0afcb82ee34554fcf3a5063751c30a7f968d7be657fd921bccc3d39fc2176a692e9f9191b8977bd9b1aee70c5b534b875fadb2a01f71365b991403d84a7643

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\01 - Command Prompt.lnk

Filesize
1015B

MD5
495ba8d4ec7b17bcb88453a576c042cf

SHA1
61423a7102ff035c9c2a66606d7ec00a100b9818

SHA256
07bdc8329158305c1861df7f90b1776e6da01ad66563b293d65c739f648b0e25

SHA512
c24de1495f5ebaa89e3b214b8382029088f4914939251b336d897875ed91e4e8cf4094a997c2e78d9e41dd707bb4dc50f4ce5da049bde1a0b75be122f7f96b43

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\01a - Windows PowerShell.lnk

Filesize
1KB

MD5
4353d5a059c0606f1ae9e6c902aa1d76

SHA1
11fa4c48c9c52a37fb53aa10e278fcac10c665a4

SHA256
e60297e739ba940fde31cbe5309a95dc37eed15251e7836509934e97c48cc805

SHA512
2e16def8a8edd5a7c27dd21ddc30da43161912903e2f8bd80721e97bb8fb03139e198874e0bf4da3493c12efdb7c2755a9e13fb6f440904da455927791938719

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\02 - Command Prompt.lnk

Filesize
1KB

MD5
0f13db629f19ab0e7c8a4c6b3ef62fa8

SHA1
d3a0682f607cd6338285ca0b76b73efed2a647c1

SHA256
a0970a47830cd4bd612bce9c2844baee752bea825db30c922cfcd57ba1775f4a

SHA512
278a2adf127afeef1e23ce1d08c1d2b7fd9099277738e217981df1d01e31e870f1488e806942bc7ca434a8e272028e2c0b4b60d5f077384cf7e3b6d43903c6a4

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\02a - Windows PowerShell.lnk

Filesize
1KB

MD5
63edb1b062631bd0d462ad32d5a799a2

SHA1
62f7bb5617c7840b028f07c1bece790b46398185

SHA256
4b8af9e22c2c2eccb96cbc38ebea97bf54f8179066a8a393a816378b2ffb1f23

SHA512
1cc8c524aa5593bf0ac4b64e06382f90faaed2a4bc083999eac07f19404542791a0e81fae8dbb5836279058e5c01a41fec38a6d6cf1667c9e5c0ea247766b65f

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\03 - Computer Management.lnk

Filesize
1015B

MD5
2ef089989999e577f46470821bcb72c4

SHA1
88a73ca29841bd90b94d52b317f5ff77a6d049b8

SHA256
72a1d3421603b63bea6f71c712eb16b031c351d1bff20475ec786dd42205b0c3

SHA512
70a4c23c04b08cd858767bac6e331b10dd1b0d92efc35d0c9f47a74c21b82cbeb75f12a5833207e9a66a6e5a5cbc5ebbfbb1a3558729ace6e7304b3ed2782905

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\04 - Disk Management.lnk

Filesize
1015B

MD5
e832e87fbedbfff824cf54aabb988a21

SHA1
d81901a1c7fb2bd5415c896d69d326cdc7f53ddf

SHA256
35a1bb07ef7cdeb593a63467ff1870d17925fc0de5c855f14b53df072630c6ef

SHA512
8e192cc84a2443a55feb5227731b7cd09412e5a88982d5f9ba55f52073fbc435cb402098d7c3f7eaa377237a0a5723f5c12af71f4ca7c43bdc864f9e80cb9d3b

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\04-1 - NetworkStatus.lnk

Filesize
1KB

MD5
fefdce6fb1ffdc6e037beadf67751d47

SHA1
4b4a6b1db7d46507aeb21f326cacf60bc7c35f44

SHA256
d217a309c05a338f10e6965013192ba57311e7692c27bf337bf6d67724783efd

SHA512
c730964e60150961d74251ed88b91290df3e2299a052434446073232a156b41856ee1fbacbbd66f45d970e283ad5d85e2ff6e23f270e782f72e6866d76b6c44a

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\05 - Device Manager.lnk

Filesize
1KB

MD5
aa239d94fce4270567431fd29e8dcae9

SHA1
6596b246be1967d6c6c748642d89db6750b2576d

SHA256
e823742fcb35694fd4f18daf976def010283470775e752bdae1eefcde1351f0c

SHA512
2034bb1c2104edd3995dbffe046dcd55acb8de9ae37ddfdc8d4355658e8b1c485ae9cafa27995c7b4d323051c5bf385ce4cd24ea46021d8d92ca00a2c5cf796b

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\06 - SystemAbout.lnk

Filesize
1KB

MD5
5d9f62a839c8428c61c984f3bacc81e9

SHA1
6fd46883eb4156941ad242f97794c550fda32f55

SHA256
fa48a17a5fe18eeaa11c00a6ecb7ebfe324ce32e1c8b2a0914dfdf1928826958

SHA512
fb36195a1ecc1457b3cacce5eea1dbff9c2c05c338594d644a2c1b39e5f440e4e57d5e377ce2cc09949a613d6e9304d9fa29db477082b95d210e3f0c3a87f2c1

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\07 - Event Viewer.lnk

Filesize
1015B

MD5
6a402a56f6617af27ed826c840e64dab

SHA1
09fb8792d539cf21d8688a7a6dfcf872bd92e6ad

SHA256
ed5d7c41c4eda44013b8dfea336f8473bedf6833638dfecbdbc19badf86c1fb9

SHA512
893f8141159d031833d8960a729e0b4282b9f0a7dae70b012acaca56a436ec8b1e03f1eb01af0dce9e31702933e447f7f22b1f3f6890deb6398a4273e9c6fbed

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\08 - PowerAndSleep.lnk

Filesize
1KB

MD5
a12acf25bae630bf8b799bcf804fea84

SHA1
0811112003b83f4e92a6d1b38d3abd3456fde3de

SHA256
584e37a02f33abde05b73109511d3123662e8ed375c868044430ea1b5c903ae5

SHA512
98f4055e553556e3f9bd0ba49c982af9459b798b30ac5dcc7de1821a5cc379643f8623067202ae11f0decc703b5bbe0dc2896ef1e38c392d4f4619bb940b8a07

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\09 - Mobility Center.lnk

Filesize
1015B

MD5
7f3779dd7de1842002bb4c0911579301

SHA1
7e915affe07c23d39395352e4d1c3786898feb75

SHA256
6ab2cd6d89cb87a7697add39cfd1b1c7135b9426661f22d2bf0f10bf7038bfb5

SHA512
8554ff33e26a8185bf7574b5607c1c94f1f40aaa919a8c0e4d72f4aa704269b3d5462c66e5516902fdb2512c43c8fd949226b4c072242429bf32c8f7bc2a7bc6

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\10 - AppsAndFeatures.lnk

Filesize
1KB

MD5
cc67e09fff72858410e10499dcb3f7f6

SHA1
0580806949c91393f7dfee9edff645aafb061efa

SHA256
039505279c0bdd225dd55f7e796c1b7053c2523f01d5fddd115d710f5d192dd7

SHA512
d8a89d246cd6bfd41f1acdbe4cf787632df9e72a3e6084ef78540fcd1076607e8d5789031db53ad5ac297e9979329e51646ab27582755063bfb1c967f5fb8968

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk

Filesize
352B

MD5
f93400dab1ac31e4f9b01fd7c6982a76

SHA1
06866db2064695a06b33b4ad086ea3a52b7338da

SHA256
9841355490481abebb87fcc674ae11e61bb907ac4087b96b6283faeea2b36920

SHA512
47ca0c3e9db72afee48d6558e51aa62fc8e07889cb749d25454133e60a9e92630d5884eab0f01337c6451fdee564f755c7e4ebd2a1811d7ed4db839f6422d2b4

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk

Filesize
334B

MD5
b82e243b922032e4d76c2a07d973262d

SHA1
31e964a5fca4f2fcffea2133b64db4242ed9241a

SHA256
01ccdc0204ea691eaf1ca7dc189b4055544e428aef7c1cc18669ce3c529eda1e

SHA512
eb63382166c5315340c645b008767cbf10245b60f622e2879fefaf560739c88e0fc08f9440c1bf405a476976f4efb75062b36ce3fd9f80ed2c70447219519649

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Magnify.lnk

Filesize
1KB

MD5
7f553023b09b6e1ab7df5372bb4b3c06

SHA1
44ca90fce9ed40617540433f1e12eaa23900755a

SHA256
9e3b31405981f39bb7cfd4c2614d60ea456562e7823bca64f0bac4f4feb87d56

SHA512
859d0edf37959e5a29c4dbab80b4501fc82fe5188561d624633375f2970888e07cd3583e3508b817690040c1f372095b6fb8c5acf85cb38647a4ee8f9ea1deb2

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Narrator.lnk

Filesize
1KB

MD5
34df1406490ef830dcbe1dcdbd4adac1

SHA1
fdb7a56941dbb7fe2eab47de962f2e1e19a31046

SHA256
dbfcde4f12bfe9a85f570df118b632b254b2266adf0551373cb0a3fc4278b5b9

SHA512
ba78537f370661d8748b3f014029da9d0b0ac0f2ee3c024b4d69fdd590425616b4ef5a4553689bdedbf80e348e2c8db95ea7977c346d2c31207c61cc4e4ab2a2

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\On-Screen Keyboard.lnk

Filesize
1KB

MD5
fb54af718ad12a53502ae36f1b8558c6

SHA1
07fbd5d68247398282e5b1edbf93ce57a6cb84b2

SHA256
ee7c0bfe2b86e8199729f97320d4687376abbc56638cae39f7376b375a481724

SHA512
192987d435a8be6219654a596e64ea7de9670ef16eb43f114bea82832bbbbfd260f70e684edabd9095015a52e80c7b65ec610b9f68e46b0cb9a9abe12c651a2f

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Administrative Tools.lnk

Filesize
1KB

MD5
b5f07a2ed150abd117b03a0b6d62f945

SHA1
36f515f1bcd4fb14399de1a8faa15e6163f42c0c

SHA256
2dcc1db4af09692d3755d9280ee90616fb23ba30c7de4534e8caadf160f5cd02

SHA512
a1f2cc57df067a696c34ccd4ee8f50b15788ee2da637b0fb341301cecf4f6e6760aa45f63ed390739840204879da6a13469570c8f505aa5c51b282f8edca0264

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Command Prompt.lnk

Filesize
1KB

MD5
1d8583e5e32fe30bf694ba25983d77c0

SHA1
77e10c2b26feb0a5cdb4d8d4df12c48f01d59121

SHA256
3db91e8e4c68ed33b8de6c323daff4a62c1fccb2d13a3b2cfcbdc3b1b934a85a

SHA512
8ca8b99c0e67ff4e39ea04d0c880f25c3d525942db1b8bcdeb21171535f73049f728e792316729a2fb34f369fe3415839dd50c2581dea57fa48b212fe8c30e36

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Control Panel.lnk

Filesize
405B

MD5
15440a80453583a94ee0944b04e27b75

SHA1
a4ad726794d2712ed1a54d4cadfa6c8e8a8dacca

SHA256
f210d96cdf6051078fe3f57b31a5aeb1504f3ebc5a7f978a450773d2438c1c51

SHA512
c03b9d10d2c26d7cbfb7052f133747fab12efcff7101e3ea9cceabefdf88ef84b6d60e9d1bf6a63e83d749de5dbe9ee3a0601b91063be676a303cbcf078b8ac1

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Run.lnk

Filesize
409B

MD5
ad39f35cdc918d107dbfc6f35234b6b5

SHA1
a6146a530d72f57e1a71d1e51e84c74d9f82aa04

SHA256
80d2047704d59ea74238476dfba96d9bda2da9b37a2f62c0f3b816ea46338597

SHA512
e3a6995d13c4fd31b47617b413185a7cd0d09fb9d0a245b8d121594448aac569812df15bebc0cbf79882efd8fa5d0fa50cde9a4c123aea9257ea801198c23c4c

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\computer.lnk

Filesize
335B

MD5
9cf95e3d323b75086fff6dc2d1692f8b

SHA1
b13b88e38707cd331b75670a995c2bbf95794494

SHA256
2eebde68c95b7f5c3ffff7f7eadbcfda735a868e457fa4439b0d0a332348eaba

SHA512
06d7d73f6c02c7e7c71e41e103faa4a81e510c13b5e0c072a0eec29dc73de9503240ff7c9af55b7aa131701bfd0641839f6c3ceeae88e9c8f2f5d10043cd26ab

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell (x86).lnk

Filesize
2KB

MD5
cee54cd494ba1b6e288fd0239634683f

SHA1
e2e636d766df85ccce5e365d197b66d64b4ff0c6

SHA256
b30d24a1cdc0a00cc6e34958c612c59ebaede8255e1e869fded4863c80dc6383

SHA512
dd23fc4d9e0e91b32043f2150ff63e0061a9ac7e61016988a5356bdf0c96adf32113a0a4599292af1457480a39d88d3d2d9d853a3e19aa492c789807a0474168

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk

Filesize
2KB

MD5
4f7d7db92fb03d6c6aa60dc60d82debb

SHA1
adc52d1a427063d7f549774930e53a0f1f6696e2

SHA256
a519f8f30a4d3f9ba1ce1d1a738be8e0ad883dc198fb80f8a2bec824ec1a857e

SHA512
3f721a047b938089940a14f95f0b6c120a7c0d5c032b414a069b5333cf1bfe3a5fd7cb1a4871b71cfed645a825f21709e969bf66dfee9e0d86391b4dc210ad69

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png

Filesize
296B

MD5
51b6d4746967b21889b0d004fbae5fa9

SHA1
5185916bca85731ff1a246492cc3bb3ae5f05f41

SHA256
ee287ce04c857affd3d84de2c51db121dc4215af3b9f5cfd1fde1c7e4323fa62

SHA512
165084f0ecd5354815d28a8fa95281d24ac4cc52eac50eab944d0af895c3feaa985df23096b89a48b34d12fe1bf520a0ffe3bb9f482c276b2563c2a8157eaf70

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_contrast-white.png

Filesize
276B

MD5
ff8cb356675ac6628e5236b2edaaa137

SHA1
4f90b2da42e70db6d3e9ce5f91ef01714a392530

SHA256
6b9e0d3f71cf0a59909f5f2349426695b7df28a36c4a9c944b2dec9edff50eba

SHA512
a428d7d847d6c712e9fcf4aadc5e469e3cd5032a0f77d429d937e0a40fd0e4a333233d9ff7676e8abb45accfb6a8ca72129e21879007699a51db37206316b64d

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png

Filesize
296B

MD5
aba762af45988dc36008a5a63c9603bc

SHA1
c6af400ad114134abd22e14ebbcfcfc26de47219

SHA256
f828e415119c021a5013ce18e6ddbd8d6d7cfa1855c8fa4d5666372b1fbaa553

SHA512
78925d6261a5e77ce038f1b16d92c550353ede0c28101e818de68d7a948f88d6f7acc385745b5de26332f561b8464890106b4bc609b0c786c10c9acd05b1f170

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square44x44Logo.targetsize-44_contrast-white.png

Filesize
276B

MD5
176731ae038d63ac4699cfe193e18075

SHA1
5b068ec473d232c4e60783126126842dd1afcb9c

SHA256
1a61037a7d6c242728e7fafda932cd3e4f58bc710924371d7a87c239680f0886

SHA512
76b4f4d5becda09f66237be98681756f2d70e59600fac8293fa0cb86a11002702f76a4eb6ca3dee44c0347c57910c11c6521ce28ceebd7b8f2f792ef67d31249

Download Submit
C:\Windows\WinSxS\wow64_microsoft-windows-onedrive-setup_31bf3856ad364e35_10.0.19041.1_none_e585f901f9ce93e6\OneDrive.lnk

Filesize
1KB

MD5
ec8aad7f8695340d2224e347735801e3

SHA1
40b080f89b5c33660270d27a78ba24e510531e1d

SHA256
2799f1397a15db62dbd25c15754fb9f7000aedc853d6abee7af6d06da9defa30

SHA512
1bdcc8ab0d61ec31b012a4c3d419d3a6bae860b940d40f16a396deec4da9f2189f48288d340eb4b6c7fe0072424f3c3e64f582b845b68d0f88d0db83d5798880

Download Submit
memory/2380-0-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2380-4914-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2380-11257-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads