f87c5dcdedd6fd11d77c53d10e4c9d01465507ff50e1e18d325636ff6f114b78

Analysis

max time kernel
139s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
31-10-2024 13:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
Size

65KB
MD5

8327db221adfbce5ad764b38406eb18d
SHA1

43feb642e53be99b8f957a49228ac49b4587e8f3
SHA256

f87c5dcdedd6fd11d77c53d10e4c9d01465507ff50e1e18d325636ff6f114b78
SHA512

e1ea2c6957032d32e1ed4ba206a3de01a128b5df720f48e9d80bb2bbb2b247a82186a124aa6e41fede659d79a4a418dbe79b265922970c1ee0fa1458f71c6576
SSDEEP

768:40FmBkpKjJH40pCJ8/n6U0SWvqLRjD/HIzZA74joVKQPF51a0RktftI0NQtomqTc:4OD0B/68WveXHIlMkGFvSKsQSf5FXi

Score

9^/10

discovery persistence ransomware spyware stealer

Malware Config

Signatures

Renames multiple (2186) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Drivers directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers\gmreadme.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\v70HZ1c088loop8.exe"	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\wbem\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\ServiceSet\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmx5560.inf_amd64_209486f1c39d4b46\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netmlx4eth63.inf_amd64_3809a4a3e7e07703\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ntprint4.inf_amd64_0958c7cad3cd6075\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\smrdisk.inf_amd64_f945aad6094163f4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WaitForAny\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\@WirelessDisplayToast.png	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmiodat.inf_amd64_95e01117eb9c1bd2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\modemcsa.inf_amd64_a76330a2da8329a2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_fscopyprotection.inf_amd64_9c108d8ac558a80d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\MsDtc\en\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WaitForAll\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmcxpv6.inf_amd64_46a3b42507e9d29e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmisdn.inf_amd64_ded39545dc6c301b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\net8185.inf_amd64_7a30f5a9441cd55b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnms006.inf_amd64_c3bdcb6fc975b614\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Com\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_fscontentscreener.inf_amd64_bd1517e25f3e419f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_smartcardfilter.inf_amd64_3573afe136371e51\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmcomp.inf_amd64_bf289615d063c627\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\storufs.inf_amd64_a7a5b507fa22251e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppLocker\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_cashdrawer.inf_amd64_a648ee708660440c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmhaeu.inf_amd64_e0c209c891e162a4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmmotou.inf_amd64_8370fa408706074c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wdmvsc.inf_amd64_8666ee4da6ad6325\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_floppydisk.inf_amd64_bc7bd9dca28933ec\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmzyxlg.inf_amd64_c5ee07feb8dae038\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\F12\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DirectAccessClientComponents\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\keyboard.inf_amd64_5938c699b80ebb8f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\tsprint.inf_amd64_6066bc96a5f28b44\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\DriverStore\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\cht4nulx64.inf_amd64_641bf08bee8ac46d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\idtsec.inf_amd64_9321d33f1997dbfd\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnms008.inf_amd64_69b5e0c918eab9a6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\@AudioToastIcon.png	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_usbfn.inf_amd64_64da5751ebd2f2f4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\perceptionsimulationsixdofmodels.inf_amd64_acff50a7960b7d19\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Configuration\Registration\MSFT_FileDirectoryConfiguration\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_fsencryption.inf_amd64_b4b4845819a23338\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\winrm\0409\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netpgm.inf_amd64_e099e4a7092b374c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\ko-KR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ScriptResource\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WaitForAll\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AssignedAccess\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_GroupResource\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\ProcessSet\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\hidir.inf_amd64_7bf4a320e4ec8b3d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmlucnt.inf_amd64_f4769cb994ece833\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\el-GR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\virtualdisplayadapter.inf_amd64_bcc7550a6e285f92\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\InstallShield\setupdir\0012\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Examples\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetworkTransition\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Configuration\Registration\MSFT_FileDirectoryConfiguration\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Configuration\Schema\MSFT_FileDirectoryConfiguration\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmgl007.inf_amd64_41e31b5786c6884d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\innadfilnnaccfhk.bmp"	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\animations\OneNoteCheckmark.gif	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\SmallTile.scale-200.png	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ru-ru\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\legal\jdk\lcms.md	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.Services.Store.Engagement_10.0.18101.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\Autogen\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\EMLAttachmentIcon.png	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-72_altform-lightunplated.png	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\kk\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\ExchangeLargeTile.scale-100.png	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\Assets\GameBar_AppList.targetsize-48_altform-unplated.png	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Functions\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\SplashScreen.scale-200.png	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\bg4_thumb.png	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-GoogleCloudCache.scale-125.png	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsAppList.targetsize-48.png	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-36_altform-lightunplated.png	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-16_contrast-white.png	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\images\Square310x310Logo.scale-200.png	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\PeopleAppAssets\Videos\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\LargeTile.scale-100.png	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\lua\meta\art\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.scale-125_contrast-black.png	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\uk-ua\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteAppList.targetsize-54_altform-unplated.png	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-black_targetsize-24_altform-unplated.png	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\ExchangeSmallTile.scale-150.png	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-GoogleCloudCacheMini.scale-100.png	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File opened for modification	C:\Program Files\7-Zip\Lang\vi.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Assets\Square44x44Logo.targetsize-24_altform-lightunplated.png	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\MixedRealityPortalAppList.scale-100_contrast-white.png	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Thumbnails\Sticker_Icon_Star.png	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailWideTile.scale-200.png	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\tr-tr\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\Assets\GameBar_WideTile.scale-200.png	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\de-de\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\themes\dark\SearchEmail2x.png	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\giflib.md	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\images\Folder-48.png	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\StoreMedTile.scale-200.png	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\StoreAppList.targetsize-32_altform-unplated.png	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-48_altform-unplated.png	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteSplashLogo.scale-300.png	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-white\SplashScreen.scale-150_contrast-white.png	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\license.html	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\eu-es\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Program Files\Windows Multimedia Platform\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\AppPackageStoreLogo.scale-125.png	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\EmptyShare.scale-100.png	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\AppIcon.targetsize-256_altform-unplated_contrast-white.png	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsLargeTile.contrast-black_scale-200.png	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\LinkedInboxLargeTile.scale-200.png	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-40_contrast-white.png	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\LTR\contrast-white\WideTile.scale-200.png	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\legal\jdk\jcup.md	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\en-us\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteSectionGroupMedTile.scale-150.png	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-72.png	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-32_altform-unplated_contrast-white.png	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Images\LockScreenBadgeLogo.scale-200.png	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\en-us\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\A12_Spinner_int_2x.gif	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\WinSxS\amd64_microsoft.windows.h..pedrive-driverclass_31bf3856ad364e35_10.0.19041.1_none_481addfb5cac00db\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_eaime-traceproviders_31bf3856ad364e35_10.0.19041.1_none_ab58a7b7c9b4e802\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-security-ngc-credprov_31bf3856ad364e35_10.0.19041.1202_none_0c250b856a6e054f\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\WinSxS\x86_netfx-sbs_iehost_dll_31bf3856ad364e35_10.0.19041.1_none_718a9ca2296a3c92\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File opened for modification	C:\Windows\SystemResources\Windows.SystemToast.Calling\Images\DropAccept.scale-300.png	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-p..mmandline.resources_31bf3856ad364e35_10.0.19041.1_it-it_3113a8887972deb9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..tryspecific-license_31bf3856ad364e35_10.0.19041.1266_none_caff3ce2871d8077\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\cache\Desktop\16.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-m..nt-browser.appxmain_31bf3856ad364e35_10.0.19041.1_none_b1e502c19c2a358b\Square44x44Logo.scale-100.png	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\WinSxS\msil_microsoft.virtualiz..anagement.resources_31bf3856ad364e35_10.0.19041.1_en-us_b5aa2f5dd3dc44ed\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-g..ation-adm.resources_31bf3856ad364e35_10.0.19041.1_it-it_f9232901830984fd\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-p..rpautoreg.resources_31bf3856ad364e35_10.0.19041.1_de-de_8b8c655d4789ad47\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_msux64w10.inf.resources_31bf3856ad364e35_10.0.19041.1_en-us_4626be9c5fa5183d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-mls_31bf3856ad364e35_10.0.19041.1_none_26d1df24626bda37\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-refs.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_0b42ed22ae518b2b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-smss-minwin_31bf3856ad364e35_10.0.19041.964_none_5c42846f47acb1a6\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..container.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_ddac8cb5dad23d36\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\assembly\GAC_MSIL\System.ServiceModel.Install.Resources\3.0.0.0_ja_b77a5c561934e089\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-r..ndows-media-editing_31bf3856ad364e35_10.0.19041.264_none_68ad99b62c32e38b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-m..ac-sql-cliconfg-rll_31bf3856ad364e35_10.0.19041.1_none_2ac3d0ea2e16077a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-npiv.resources_31bf3856ad364e35_10.0.19041.1_de-de_f455699036d68479\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop\v4.0_10.0.0.0__31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_presentationcore.resources_31bf3856ad364e35_4.0.15805.0_es-es_3f983b20eb2d713c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.19041.1023_bg-bg_716e22d250901c5b\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-securitycenter-broker_31bf3856ad364e35_10.0.19041.1_none_1130ced19cdd5598\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-onecore-sharehost.resources_31bf3856ad364e35_10.0.19041.1_de-de_881b257d159a5de8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-n..quickstart.appxmain_31bf3856ad364e35_10.0.19041.1_none_4a388618f6365227\NarratorUWPSquare44x44Logo.targetsize-256_contrast-black.png	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-dot3helperclass_31bf3856ad364e35_10.0.19041.746_none_5d14b8f5a54a1e81\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-mixedreality-runtime_31bf3856ad364e35_10.0.19041.1_none_44db35563e8cf073\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-b..demandbroker-client_31bf3856ad364e35_10.0.19041.1_none_c8442b87f53a6a2e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..tingshandlers-about_31bf3856ad364e35_10.0.19041.746_none_cb156de688b76372\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..ty-integrity-policy_31bf3856ad364e35_10.0.19041.746_none_8a20106aa387072c\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-taskkill.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_58bca534b091a238\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-security-tokenbroker_31bf3856ad364e35_10.0.19041.1266_none_22ccf50c942e2ac7\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\assembly\GAC_MSIL\System.IdentityModel.Selectors.Resources\3.0.0.0_de_b77a5c561934e089\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-g..licy-base.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_23fd2654379d802f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-s..lerevocationmanager_31bf3856ad364e35_10.0.19041.264_none_ffb8f52de12b6487\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\SystemApps\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-wmvdspa_31bf3856ad364e35_10.0.19041.1_none_a6c18d38d87363bc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-sigverif.resources_31bf3856ad364e35_10.0.19041.1_de-de_27190bb5664f441c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-ucrt_31bf3856ad364e35_10.0.19041.789_none_89924141786cea16\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_netfx-dfshim_dll_31bf3856ad364e35_10.0.19041.1_none_2e7103f3fc577168\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Serialization.Json\v4.0_4.0.0.0__b03f5f7f11d50a3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.19041.1_none_ff46bbc9afee54c5\RatingStars30.scale-200.png	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..edpc-accountmanager_31bf3856ad364e35_10.0.19041.153_none_196bf4f8f4d3bbec\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\WinSxS\msil_presentationcore.resources_31bf3856ad364e35_10.0.19041.1_de-de_106789e99fe91d28\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\WinSxS\msil_windowsbase_31bf3856ad364e35_10.0.19041.1_none_f0f15c7316a3acfb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-a..ence-mitigations-c8_31bf3856ad364e35_10.0.19041.173_none_e9ff08f651307ad7\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-i..ntrolpanel.appxmain_31bf3856ad364e35_10.0.19041.1_none_d0af17ec366548f3\TileSmall.scale-125.png	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..e-runtime.resources_31bf3856ad364e35_10.0.19041.1_de-de_57a31ef671a9a1d9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\WinSxS\msil_microsoft.powershell.gpowershell_31bf3856ad364e35_10.0.19041.1_none_212fd29e57852d28\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-wmpps_31bf3856ad364e35_10.0.19041.1_none_6ed007ae0fbb8f43\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-n..quickstart.appxmain_31bf3856ad364e35_10.0.19041.1_none_4a388618f6365227\NarratorUWPSquare44x44Logo.scale-150_contrast-white.png	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-t..e-syncres.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_04dea1e60ef477f1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-u..tionuxexe.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_247930607e3d4efc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-d..cache-adm.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_a5045b725b203a07\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-i..l-keyboard-0000044c_31bf3856ad364e35_10.0.19041.1_none_bdb3e7fd29b54ae2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.117_none_e0d32848ac56114e\retailDemoSetup.html	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-lua-onecore.resources_31bf3856ad364e35_10.0.19041.1_de-de_848402175f135dad\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-u..n-desktop.resources_31bf3856ad364e35_10.0.19041.610_en-us_17fd4f7135525d83\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-photoviewer.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_ff59009903c32791\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-r..tymanager.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_01290908e402f929\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-n..quickstart.appxmain_31bf3856ad364e35_10.0.19041.1_none_4a388618f6365227\NarratorUWPSquare44x44Logo.targetsize-72_contrast-white.png	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe

Modifies registry class 10 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VACZAKSPYMVNUNW\ = "CRYPTED!"	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VACZAKSPYMVNUNW\shell	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VACZAKSPYMVNUNW\shell\open	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VACZAKSPYMVNUNW\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\v70HZ1c088loop8.exe"	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.777\ = "VACZAKSPYMVNUNW"	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VACZAKSPYMVNUNW	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VACZAKSPYMVNUNW\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\v70HZ1c088loop8.exe,0"	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VACZAKSPYMVNUNW\shell\open\command	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.777	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VACZAKSPYMVNUNW\DefaultIcon	8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8327db221adfbce5ad764b38406eb18d_JaffaCakes118.exe"
1⤵
- Drops file in Drivers directory
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\aic_file_icons.png

Filesize
50KB

MD5
afcbe78e45d215586275d08c979a2240

SHA1
9c49167f7db5b07bd3199cce0c448e7da3917280

SHA256
ed6abf04ffeeb1f6eba0aad82db022bc79c614581eb32d4ac1075b92a5969bf6

SHA512
4929c901663756dfdc7029685a0c4cc12bdd8ab697f5bd205b4270c394b462513e1a0bb25d07ed1e318b5fd06a7a95008c28ba26fc8fe07ca59576da5ad7f0c0

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions.png

Filesize
1KB

MD5
fd909780c9d57eb315f239e0f956a3f3

SHA1
d93486ec8c1372e0d4e57cf4c04e1b4c7f26138f

SHA256
6967fdeb0cf39789d3d01a0b4821e9a744d49758999564fc4e165ff14d7adbf6

SHA512
44405c5d33d3c14a235ba413bff541158a4472c4b071cc8cba80ed1c0ef0ef2ae6e691f1672c86d31ecda1bc1ced62ea220d17e68406d8a0c335e2a5b9496284

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions2x.png

Filesize
3KB

MD5
92ae4c2626a6e7aabb3cb76c421aecb7

SHA1
ba3c5f6581235ae7a1dcc643bffcbf7a23a0f1bd

SHA256
0851d390a5962fe761c10735b8a380e3986ad66c15c76b52387748790e01cdb7

SHA512
f6130431d9459b85ab36a770c0f5ac72f134fae8f6be55499cba93d066ae6661dfa76700013f54730822523176fefca1c22a68f1ff5bbaa7e7f5c85e684254e4

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons.png

Filesize
683B

MD5
499ce96c42e026b6adeeb6cce9f2ddd1

SHA1
3a257b63d1b0db5a82abc80765a629b7e48c8505

SHA256
d26e64834f65a3b5f993a8d28f2351d9beef12a94d4eb0e3e8eaec18e806af36

SHA512
a5e7704853bcb8cd9053037063718122520e2579857219e1f7051fde6c5eb792c6ae7148827512aca0669a09445adbc76f831b164996336f367e561b3194710e

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons2x.png

Filesize
1KB

MD5
a3e4bc3c66dc807dddfb3431a24c948e

SHA1
39ab3b2ea7dfc17d6143380fefdddce5d0070a1d

SHA256
5852ba104c527768a751b4c5994e33c072f74a94dfa018a6e2ef37baff6c2651

SHA512
a94b12d3db5b9e28e1b73783d1edb7b30566bddc693d281a4a0db955292a7c0f9822aae69639a5eb60c9288de1e1b796d2c8b16bd8328d1566708f82e675dd83

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon.png

Filesize
445B

MD5
c5933e9b028f96e5ea9ab0fdfac1d69d

SHA1
5a0d978a4e24b1ee3e6bab4cd4d1518326c1a7f3

SHA256
26436d59ce2eea470b1993ebf92f2b4280492af93bffc6629b3519843042eac1

SHA512
fc8f645d5a15a1f6aedff87d0a032449a34b6f0981dd43c0cdf204a0b09fcb52289165f04a179190e50dd29d145d35b2e5adce255f099070b5061e539b6366a7

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_2x.png

Filesize
611B

MD5
b2bc96baa18e3cae28f57f7b559320ad

SHA1
028f1b583794f62809558fa629ca363e082d053a

SHA256
08f072483ae02348998f01527c32b95a893ae6dfba0d89ddf7729ca6af383f7d

SHA512
00bf88e57ca8827374a214699bf943ebc1ff552855eb3ef04f137e920e65df0b8b97cc3c45369dde3a3d574e2c0cfa4c199efc71043d3e73a9717ce270ea69de

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover.png

Filesize
388B

MD5
a6411079f3d0906327444ec7d7e6e8be

SHA1
b761923749d869ebd0610848658a4ed0d070485e

SHA256
4224f5b1df070dfb9f9a3aa6caa0199c5bed7a1ac9dced994cf7bd136f4a81c1

SHA512
5d243b5beb839fb0db51f40d55ce7c5fdf1ad3f03e2e3a66c40d11b5ed51b2a9ed83919585a98b0b1d41dba460310a4de150e88e4b9e9fa324b3f2d1ade1d3be

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover_2x.png

Filesize
552B

MD5
b5836baf4840f0a8168bdf77b3379715

SHA1
e27f45f9c7010bb4ec86efc47aed37ae4210c90d

SHA256
6acc54c3c7576a09df6055427fc7e1d4f617461524bc75984b0c7fc5f0ed6b16

SHA512
4aa735fc318eb570131468ff63f50663afa39032a1b3bae2614c22b6936d69c4db8afa3090c44e373b4d122fe2a65b8693e80ed7ff4202f8a9afafebdcc3097c

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon.png

Filesize
388B

MD5
a3cb67da08021e6581802b38a75f3b95

SHA1
69c6a5cf42ac849af6137c93f4f321cf5a3574af

SHA256
45ce05fceaf6c5bb63b86de19fca3f3af9fee8dab2e5984d7c62f94e71134a8b

SHA512
be893b34ce021361eed6f8d0b2a86e08573a08f1566c01725ad7fcf6b90269e157ad6b19a08f9eceb9d97876e68f3c48664087731cfb7822eed67247129e9cea

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png

Filesize
552B

MD5
a873c98d626de72fb7f1c403df6446f6

SHA1
ec28c9994b41d902759df4ae200a5a7c8077cfd2

SHA256
0d4df7c797a98eea478f8e9f55a653041e2110e3d7fe37ea0ee71e7d47f9b73c

SHA512
abda1b36f96e5af1220294006da7392cedd5e050f34ca7bdc64fbc6722ac7ac6a5012f3f2171cc209a12ba75ab4b1bcea4355a193c6bb13b48ae6a6bdebdc4ab

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png

Filesize
388B

MD5
b25672a681a6fa34afd58454edeadc27

SHA1
7664dcdcf7c16be0905c0d77e1e8d0db96d00a87

SHA256
731d676a4c02d009c5340a95e1739411bbc7f237b37961ac703f98a061a6a89a

SHA512
f383205f8369505ad528095a106aac771ecb0006dfba7ee0a57adffbc328ae2b0342ef7c10200ffbef20155264cf6fb32e64ba9d4ba607caf177d46b19b27686

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover_2x.png

Filesize
552B

MD5
4a0e0c9c89b9766df330a3acc932cf83

SHA1
5283f0082fcbe316650b43429e90e3dfe4cc146a

SHA256
612aac89afe34d41b09e01a1f01464d46ea7f02b1d621eeed12a80967aa21238

SHA512
f97a514bc81f5ca555af1437f015044973df928fe896b7b8f455e7a6624022d15030c3c0217d05f387a42a3d11b5817e1128bc163383d567ce745164a95f3cb0

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons.png

Filesize
7KB

MD5
b4a2201b84070de02cb7c9a16e7924d2

SHA1
22c247e7f4bfc54ce40bd89315d28ae009b765c0

SHA256
63de157dcfb8419fb450b8defb543e8fe1d930f0a7b964f4f82c2ae76a3b1626

SHA512
2c59418400f693e85296e94ed55a499e10945cc21d6e819333730781b6651d3309d5bf4baa6dd9913a257acd99f36273cb53c98283c2df468c1fa6c6547ff901

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_ie8.gif

Filesize
7KB

MD5
96d4067493cebb602b6dd692e7ccf229

SHA1
5e99219067d48d17528ae36b292060f6c92db330

SHA256
039ea9fbca867ddd6cde7380bdf1dc5033084d80f306d4f396474e46642b1adb

SHA512
90aeb4fd044247336f32198b32d78998763af7a3e53883d3ae2fbff581e2894feeaca254e263b06c94b5723e1cd23ff67b57d48b8fe6ce2ce8088828d87dc00a

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_retina.png

Filesize
15KB

MD5
8b9c3c6c4c861d8058b6b6ad914d098e

SHA1
227594f8ae152d065d58b23df24da561bbb77f64

SHA256
46fc2023b3f2f738075a8ec08ae95087570d23224cdc654f6d857c61b1a6ee85

SHA512
4dcf0dd3106c7e44a49cdf30da3c89be0da96307c092b69ccbc477b1304d762ae6ff3871aa1900a23259629c5197096c0452ac19b89b54aa51fd332a9d525517

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons.png

Filesize
8KB

MD5
14b8458e875c51d5c41c53401cf3c4fd

SHA1
940681b06eadcfede549a9e474caa945266baed6

SHA256
85962c3348affae3de58955ee98efab0f8b8e8171c2d62fee5d9ed9df78f058d

SHA512
fe550f0c2d7fd46317343f65472a5b91d64489c966265e192e656dd103d082aa87f92a339a2e9b5a8c0a3700ae0878b9f85e24e62704649c9b4a7fe78a0eca4f

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons_retina.png

Filesize
17KB

MD5
8a30a4da99eb957669d8b15961d44227

SHA1
4882a079e0dbdf99b41e128ebd8ab477b8b976c8

SHA256
8e7fd8059dd2132c37f707163e836c6d75cf3b6406c27152b52e0bcaf23a2dc9

SHA512
eed2fa22eb31c06bbeed164aa2a5921b14cecf7fe165810c0143b08006d155a51e19e7bb0728d19a76af4fdc0beb3203c661cc3a2a763e8da660186f6c827b59

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_pattern_RHP.png

Filesize
179B

MD5
5396e0ee5f6873c2c069659a3681c14e

SHA1
0c8b161df5c010b6de7b7ace7ee4d65b429a9444

SHA256
9436875d4d15b83e102311bd1520be959c80a6c37f781a49bdf2935a760e0a51

SHA512
32f66c399912e15317fe40b9a0ea045a088fa26e176f643245f9ba370fd4be3bf999a501f4f57d6d59f1d499064c0e9105dd7e1a96ab1e3e91f57fa271e2c752

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_patterns_header.png

Filesize
703B

MD5
50d4c8f62d87f0d32d14119d89a6fd9a

SHA1
15e8fb2784c17ee29d91a7dd2a515b6ddbddfa6c

SHA256
921a7ba9daf68e6d74f3f8ba1d2c9c959967bde8d62584470e3536ada4c2853d

SHA512
0306d5cdddc48dbfb37b1b107b980986214d70d5716add1299050b6861a370c9ec9f3745a86a9b4dc9e67237b022694bc94adf54f06cbd428ab16f4e7a0e27d9

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations.png

Filesize
8KB

MD5
1fb2b63df2f8a429b251eb41a58fa09e

SHA1
b5b491b15f485d11af75e44ccff3c490d102cf38

SHA256
f5c85d7189b4d3144c2e3e144b6980cfe79ad746dc8a38868b344b6e71d61696

SHA512
f1d84af4328f6336c960ac51520f1bb0328d376ecd8bb7903753760e543b3a0da36c06c0e13e1f48ea70d946b60796fbed72de99227c1e4a694e5dae5e4fc9cd

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations_retina.png

Filesize
19KB

MD5
97c04b36f29969e6547237d0ea6bdba5

SHA1
a687303745d68a556eb5c67a442fd5097df4d0c4

SHA256
ce04c6e98b4fbcbc29a2f15bef6d151f931cda313ce201fc3c2e706b40ecb54b

SHA512
9d89ec361322abb9ea608436358b7de1a5ed25bbfff6a654b1ce69c0d8feba167968d7a09aedf3b88b047c13d50f07eeb0abd9a25983f4b29bbd01b287c70155

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\faf_icons.png

Filesize
6KB

MD5
06ea50581c390db04e0295f9ebdea13b

SHA1
28e34610eba3ddc15eaa9f47adb816da641c87ee

SHA256
e19b62b3ff63e46d59633f95a7a60d493c4e8d51a70470fc6e42418fdd3fbd51

SHA512
43a2b6eb937f09cee69f35a1c21cafe2e0e142de16b6565155d07a4dfdded91779bc794e2d1582cae7d324d9b29232be349778a9eef8236f4a01024ec42605fe

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\bun.png

Filesize
2KB

MD5
615783144cd2a5ce0152398f21d7b682

SHA1
3cad92eaf40acd3da128eb71fb7ebce8cf7b677d

SHA256
d747809edeb81b0551a009783493ea2d2a2c7f072267c8ac325b58fd18a0c676

SHA512
9cd22f600790fe0d9946bc5d4fce829ac2b2d70bb9052434c65c585e431bc0f4a2c953c5205e1e81004aa6318ab2c9a4e5a46268b976e6bbb5d00a5541912efa

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview.png

Filesize
2KB

MD5
611f63392cc09b813eed2ba34c21d7e3

SHA1
527514ea6a90465adda3f29ed07e73ac64d43016

SHA256
1b41e4e297e7c3a41308904bd682ce90318380d35797af5dc2e04bd6e297f5f4

SHA512
7cac22965a68a0b29ecef997682035e492c6ec15e4b2cab6dd76147d769a9b094186c24d51e6ee0def02a89eb5d93b1ff9c0dfbb78c454e6322d82781098ab9f

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview2x.png

Filesize
4KB

MD5
bcc0b2b9ac9a8a10db67afdb7c70beaa

SHA1
1e6302110035103b2948addd5d18e8ca8fbf99b1

SHA256
0f29a1c2303ae63213126144a0048922ec1a565274d953254855803245ab380d

SHA512
1f5d6003fdf6fb2b5f4a7d53e2604d6f6cccfac6d0d9e9f76c046dc1e32a94c625058f08ed0bf73620c6f8e61ca97d92195c83c91d26c5b872d271bc795a66fc

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small.png

Filesize
289B

MD5
7c8c2c9215faaee206685f34f0ba3efe

SHA1
b4ebb3168eee62b2ec9fd67275aafb9269d01c26

SHA256
9861bfaa93b780a4a73b7628ef046de2c63c462f04b47cd9384def0d41f55f16

SHA512
267d9984d057ed4f55ce0f6aa7db2f02bb05f2353531431225b3a98e240ced0b5a9ce52b4723d646438a70246a49c368ac1fee19ae20e03973e2831c547b5c9f

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small2x.png

Filesize
385B

MD5
3724d478d89367de0462b04af42021a8

SHA1
a9633be45a58001abcb091e6a485b07ff8096496

SHA256
ccccb5da459b701eaeed3b69746ff9c05c56d1cbede74aec0b9af77524d74716

SHA512
2dd988a226741841c7a5d256baa9625a7a671d93c436f1a453c469fbaa4053f5689f5052881cdfffb70972ae7e76d7399b899d8fcc7b3d5664da0c1e9b3a536b

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\illustrations.png

Filesize
4KB

MD5
27125b4dad95cdac7633f96c2e5abb59

SHA1
d7d4cdf5b53fbe94f52722d97d9ffb40dabdc710

SHA256
78789e73f2e7349b1bdf169d75b193acafa103024921628f489b76e12743e183

SHA512
dc9219915872927027265a871c578fb1c0ea2715a3a5ef5ea197568f5be479181bfffefbd490d184ea2735cdbed8b5c6f4010db22022e43744b894f7ee3a885a

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\nub.png

Filesize
1003B

MD5
33037ec39ca4737c9dec5ff22786d1d0

SHA1
133a6209fe16595997d87a6b6998b66e6860113c

SHA256
0a8b531fc1277e60c8d66c70ea6bc676527ac348071e56a4796788e12d7deacb

SHA512
295b2307b0ae73adab6093f7cea5d40d93696993fde3736d199d32bb7da7e79427dc46f7cfc81146315a40f104b1d94e83b8f2b93035861db9107324ba8db408

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons.png

Filesize
1KB

MD5
0f31b4823e7ac6e388851bc1d662238c

SHA1
e84705392ff69f0a88965be76eb0d00fe8f216ed

SHA256
79308c665ffe2771a7bca5d430d88dc74ea9a2b7b99eb18c88320b83af7db3ad

SHA512
456e1d65111789869c1136ffddef327c05aeb64ca07864b7a61ce1be4994deed0858e5fa0e9ba15aeac65de5202a57d1fc95580a8a6b8f983b8f5f374f14782d

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons2x.png

Filesize
2KB

MD5
65571fafe7189c0f544a0a23574e3c3a

SHA1
acad165fe2ec3ac0515fa5dff2d00ca9720daaa5

SHA256
65a9a794646687cc971e3d002470e1154964905c1dce43612cdc6041f372600b

SHA512
99c3370311aaee462f2d1b526fbea131ed6f646557b36e59e1c419d12b59cf96a42507509d3be45034da93080ed7e8795faaa234aba4b168cb764a8d53d803c0

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adc_logo.png

Filesize
3KB

MD5
4b31286679a0de6bea648c50de832728

SHA1
8435d28231d4645daefa6369478b9d99054ac77e

SHA256
118ba401abf8525fc16999a8f34b27f45950dd7d156b18b3556a58c1da09a881

SHA512
0f7371c82b9e9322217a37d3559ad28667b487df9a6a4dc08fb00668deed55ff52710858f6cae3cf073a658f201147ea7e749620888c5bde7853142aa30477c3

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adobe_spinner.gif

Filesize
556B

MD5
8298a191944247c4e2112bcf890057ce

SHA1
d04f6938913b8fb40f0426ce36a074d5a61e6f46

SHA256
01a6b4af73802c2229568ea90c7ca958ed831b83e6521fcc86727495628c9e6f

SHA512
31a50607a9ce9764f25e2b6fef6b163db4a3370c3351692dc7ab8bfc228cb8271f08f1eb0a424c16a40b26018da0af661cc4ef200ace8a99a6d807b2eb86c75a

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\logo_retina.png

Filesize
6KB

MD5
4f8fcc12e388f5ec41c349a63f163ae4

SHA1
ed462a4959c66cc3249c3e088fe6cdd3dd478c9a

SHA256
c3586e1d3ec52866b99f102b031fe765c6e33c704c4fdc2387b056ed45c1f228

SHA512
de1d981169fb75cfac271dd7eafa765b5ed26129a21a589bfdf2bbb770cdbc51192954c19f115806c3623e53182f8c4fda8847ddd364cdc345ac4cb8b2467b54

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo.png

Filesize
826B

MD5
6fdd2a61cc4ffaf63c50f958b9667503

SHA1
dfcda66dc7f4e13af716257afa994e862e2dc21e

SHA256
61ab4ea2bf4134af47696be9ee83b2226b400152a9f49edec20fd9970a42a6fe

SHA512
bc8b367228a6f7c07efadd5ec3dba08d3f65eec1e4c3fbf2e2489c208d095a4d7c2a4539319a0ea1eacf8a7e196ebc7ac86a0f4ae8e8829662b5b66e3833ebb4

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo_2x.png

Filesize
1KB

MD5
380474b7835064335353d9ec0a96d8fe

SHA1
7e869172bc504fc802c44b63b6a89ede68800412

SHA256
0b401d1c4143272035147da2868dea3eeeba5c89828583ed84bc3d8b99c568ec

SHA512
6e0dd9ffdac91bbc9b7fb067e7bd01f42189ad93b9d704c505acf827fe1aa479f8fa3937de3edaba1673a874a12da40fc1962db5fbeb7bbdcf7d328981b5ff2c

Download Submit
C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB_EURO.txt

Filesize
32KB

MD5
f3eca9dacf35081d6a29fcd73eefb0bf

SHA1
21a5683f5d52c897fad3ce6559f64b798683a62b

SHA256
dfa4a0e56cf365a592622e9f2edc3095b81bf0e099ce488d4255df3c80e07336

SHA512
23638ce04fc81f72d7591ad5724fdb4459fa0ca4175f7d3eafda62a62e0c93095eec80d451dae02807c2133e11e6e172dcf2b215172d334bce6f448e1b9ec1d0

Download Submit
C:\Program Files\7-Zip\Lang\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt

Filesize
498B

MD5
6bb043a09a8669c5c44d542d5b3caff9

SHA1
fcfb7c9dee9f532b44c0b5359796e71f63d49404

SHA256
c21690656273040bda831c49aa565831f13e586630d49a8eb1962f2169516b4b

SHA512
bb3716654e2a4239acba0132208b6e69b4a7d7d51f049f003e62ec7a774dff68c8610860c28708047accab079f0fe866c5680e14d93d64c3d7d33228f36104c9

Download Submit
C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif

Filesize
153B

MD5
ae0b0e36c1d85281d7f8dec8e2935806

SHA1
f618b3606c3b5284cfde9a6f60770c47cbcb1bcd

SHA256
86f522bc510d0b3e5c796cdf51977fd875dca3f634fc2a7e76323fec9d73c0a3

SHA512
58ba76fa02204347c9095fc17dd64f9362565b677ab7695d5cdddcbce01462247a9b90665690f654074ebe83f088b7b7a9d698b1509bfc050a5525c4dd7f527c

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt

Filesize
190B

MD5
006537754a487401ebc064b7c3e6ed80

SHA1
24e2919bca40bd2bbe2aec03f9f42b259baf2697

SHA256
cf96d1fdb4da28e90e656fed54f800cbfc5d5acef27fef92a7b71eadd0496aff

SHA512
31ec4b2abb344609f55388ccc5361ee28d1966c0cb485b057e939cf4f7a351e9c321d26b1207a3ce15ea322632de10d8147c7cbf275a2ec6f0247ba123d531f4

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt

Filesize
190B

MD5
e49e3549eff599fe34840dd32e010c16

SHA1
a837c4611c55e6ba7af1ef43d98308857433acb7

SHA256
f47136a3ffc9138ca8257e1ce5573b853a6dfd66f5711576ffac2b2dd315d5f9

SHA512
ed61beaf82acf480289a865b854a5412a045e4a6fe5f4b9fca448b203440baba36c0531b9fc8644ec3dec3da280b49d1ae0c82118fe2a41e21c72e05846c908b

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md

Filesize
1KB

MD5
2c4cc6621fd14bf3ff7d97dfc5098322

SHA1
da3894b110d46c166b2d8975d39386d74d47f1d9

SHA256
ea7a7c3e3aa7e24798f0672eaa7f4be5b7e526c882cc51ac65502fb61dd823bd

SHA512
c8ea76060b66c90d7f80f6cadd5346474d4f6c92dc6a3c16bf39d662df2067baa9c392fa90bcea7f91b6185a17209cd329523db5a3481f4b0a48b1517907a0f3

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\glib.md

Filesize
31KB

MD5
5922828b431272dc8708de2248968a6f

SHA1
b34597bb60256e425fe3b0f4f0dd0d9bfd1bf6d3

SHA256
78d8595734c87bb622426c16e4a419479234a3c85f7bb0a0db8d2d89f944f247

SHA512
4a380669af4c8a5915705f09354eef466514a6f54d920b5198b6cf31d3b47804767270fbfbee15aa61cbb79146c48976f1719370a46bfd0e6ec3fc7cd9a9da45

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md

Filesize
34KB

MD5
c5e7c4c63e92be9cffbb290c02f47778

SHA1
4378500fd3c76a79ade1206237366a7434c999bb

SHA256
f2c52076371e35cbba61e21dcfdd8257dddf891e784f0f189bbaf2a715db85f8

SHA512
73b692658abd0ea48cfc658937aba83be6ef98e8f5ad9b08ea61194ece5571e55d986e5c3e5a3573e4697ba01506d642236fc02d9bb75ddc061426f4dfe7bb7f

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md

Filesize
23KB

MD5
ec25eb4491564a8d16a84bdc8df2bba5

SHA1
ed0bcadf58b771a17a7208bba591abbd5b7eb43c

SHA256
17bf145a35c0200b8ac2eb3d82182b4e218c9372b014aaa2c55e2a525dc35335

SHA512
3ddb33773f3a8cac722a45e04c6e67343f16d283776b2c3302c01dcc40e4a57359a7415cdecdb2e54a60dc4549d1589c311d0ee383499d2567808347958585f0

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md

Filesize
2KB

MD5
dd077379673dcbb3d79d2f94d55b8aa9

SHA1
d3437045207d7ca977cf1734832425d7d3966a2f

SHA256
65408518030f29810d84da774d093ee436167c0448c83dff652e1d92e853e910

SHA512
7282ac0fe957ab80359898cf24921011dcc5384096b8dffefa371c267a6c7a534865f009862fb8f61d3ab49a0e2b3e53518ed5820c435bd81784ef4df3919bdf

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md

Filesize
1KB

MD5
8ab5889ba3bdaff2ea23cc4bba71b013

SHA1
c1db065ddc6592b7ff1b2da08505881bf6eeb837

SHA256
6e624056d56232aa784f9162cd6b8f0956a0de596c147212a4c4b093414d0d65

SHA512
54c706ee2124a493f3f09c51358ae773f77872cdf96f5064c984cb2f5d66498c5019978cb0d0fc791a5e2077fdbcd29b97181861c76dae2555a8a9573dafbe14

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md

Filesize
3KB

MD5
a875ea8ef4bb3f0d81efd318658d8b36

SHA1
d9e5066e93986b5385c07383901e70ef4e26d347

SHA256
839cd83a6972657b862ba72a598c1d4c0d229e4eb677430185cb85afe99b9860

SHA512
487158ce96db03cc9cf358be5df3f1fa686e27707a8662aa3bc42c17b9d7178248fb42513043330cd5e1b2235401f4168f729a6b80d637281cc205a2b0472860

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md

Filesize
2KB

MD5
6e55c76e4bc39be82447d3d350b4e042

SHA1
f18eb022c30c3f31df99638d1febee2c4048c06c

SHA256
501494bf17507fb92ef24feb764128bd608bee4b39a37ab08152f71b408e0e53

SHA512
7b48a6c72f025e91863acb3dc7a8886bf74be127f5334b545c8eb227f73436ad7a544de6d74460d3c973c510b5602927cb45e7b9e2428501cf5d001cebfcd96d

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md

Filesize
5KB

MD5
c93d715c5b66ffb07fbf890424081f45

SHA1
7a10dec2eb261c3264240009a71886b90d69ff5b

SHA256
c5123dd75eaa692ebf620fd676b6793dca92398c66d96004104cc5536429864d

SHA512
ba3ba6d7fc35e2dd773393c2a8a76b563d5d41b7b28881755c7fa41e077e5e00b2ea3d2aa633c9c12a6e093947fcdb698c0a5ce2165a65b81ff4fab41c2fcaac

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\public_suffix.md

Filesize
17KB

MD5
20284dc827e0e9fdccd7b6d3ef751623

SHA1
43f428dd1d8032abd6b3630226780c1941a8cad0

SHA256
f96311b77769fc0bcd8110c6762a68d09506b0563c85a268bd7930c8ce86816a

SHA512
abee000638ae9c6114584660f784fbbfe22975d937a37e4899be96da3102a3ce8dd4e5b7a0f263237e9a658491a42aa2762bee0bf62abdeb7c44ffd8f332a50c

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md

Filesize
320KB

MD5
f1b5f2cbf194b60448f03ce9deb7f697

SHA1
cc6099596c2edfc95a14cadc880993a6bd562798

SHA256
28bdc0cbc86b9e4284bec70d1f21d082997336adc5fb9a1f34767adc5c2c951e

SHA512
0ba617d2d17dc6be344b78495bfff8de56a45c86c8ea5672d885b1b70e59e50d75b6de6821788c097f4b468787d11a38d3b9a81db95585e88910670c434ed6b9

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\asm.md

Filesize
1KB

MD5
a15f8f362813213b1e20940e86079ae7

SHA1
e3d9361e187cded7cb24322bfeda24270cff1519

SHA256
f3243e7a7664318e9e08ed7f2f3381223a2307ddd126151f9944368a53c89597

SHA512
6f0de211f739bc4e37dbd90be5aaa3bfd29ade88543b21ef09a14683b5412c42478fc4c5a2cc10d0383fb6fcbfbdad1c9ccadcc5e9a569b4d73e1386a5130b79

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md

Filesize
10KB

MD5
0e8de557a0c688f669a301de503c1caf

SHA1
6b16f419a99c6c40eb251da1aed7325d724c0881

SHA256
08d8123016db3abdb3c794772ba9435326640a88a7adb831ffdb6ce524bedcf7

SHA512
11464b00f25c5e16201d87e180a8933c75aef3c40c606e5ff027a776304966227f94e36bfb85b97645febc1a686a70af2cc3968c9c09d64aa27af0c90480fbac

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md

Filesize
3KB

MD5
ddf8ce846a9fd67566264d0ec2b13709

SHA1
4a63d0bbe86e0d1dadf8ea1be82bf01845b7c624

SHA256
0704583fb4d95978725736bcbe9ff665c6ea5503d8a9ecfc72b953a3f0ab66c1

SHA512
26590e3f2e6c2d5ac211a04ab3827de817bbea6b01408b4d1fc7b699ca46a91faa72a792e091b49b3177859b5bcb689f829e97de2d1a4d906b3a635aac79e204

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md

Filesize
162B

MD5
5b4d2e5f050bdf940f1ba765eeed5a5c

SHA1
5070067ca81bf0e2b84791ded1d68c49adeb9cce

SHA256
316688bb8ffcb6b141e25c758402226d7f061e7c5b4acf48fac62d1a232fd399

SHA512
558b7bb3066028cdf79107138155a9cf6c2c551f618d316456f050c16a26319a23723bf7ccec6149f0b03649db3ca9c279c32b016d8ee21066a40ee73b755ce6

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md

Filesize
1KB

MD5
9f8c9e93b33ca7dd76db4ccc6c49d832

SHA1
7f09dce8a919ebb4a5231b28bb3fb632d64c057b

SHA256
7325d7af5512c3e02a9c6775354222eaeea28f6d01ce2ef1c86a7028e265123b

SHA512
96245e4e0037112e956ce6a85a23a7b5cbb2140ed19965e44a5f31ad0409d2ff7db2ca2bc835da621e9d66647bd818713665f7f244d0959ce3bef7c17fea787d

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\dom.md

Filesize
3KB

MD5
46969b4146e68d41e33861313b9fdb10

SHA1
6af38553444fa1c3115d3def6e4ecca027527b03

SHA256
8126c5de53419e875b37d386cd91f8e6d67a5f60dc366c8b14a25c37f57ff2ce

SHA512
ef15cb53a0ffb5ebaff262b018064d9ad346ddc09d4ce187233a7b7120235fb0dd648027b9d0ccb859a72c4f4c3d6da4882ba227decc1359bd0dee1716bf76c6

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md

Filesize
1KB

MD5
58258b6678236d36680f081fc43b5f9a

SHA1
aa083b7f7e70c266e9899ad7e2bb120e308ae082

SHA256
1f238a5e8c0c1c67aeef5757daf0257cc3220ab75863b211024cedb2645de560

SHA512
3f16285fef04e9eb593ecc7e719fce91f17af703237d3a1e6df4658586cbf485e19cc178165896b18e5319a5bd3117e05ae19d54f26376a774da3d43dc7cfce4

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md

Filesize
28KB

MD5
ed6f77791a5941bacd77c9a31bf2f128

SHA1
385f424cc57844e4528cc53920aa51beeeb57105

SHA256
481cf24de99a428afdd53a0e0810a6b03b5a44d6bcf9bdcbbf86c857cda9e47e

SHA512
7583e0022f82b52f9bfa0badd57eb6dc28a58e2e9f5b56d054fe4c510189859989fee38d0d697f053e8117788906cedc7701357c56bb7ee3e273a7e60e6bfc72

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md

Filesize
2KB

MD5
2a973592f3757ebc9193129714a39cb6

SHA1
cb5c9e9f5e129d1e80e25f84c0d2b11fedd9d402

SHA256
5115ba17633bccb072b7e79a3395e6bcca80fec2e0811321abd61f512311a5cb

SHA512
062824f37991ad19627f33073744bfa1dbfc704e23bc317b599e867c041fee321e557c0817d8f513e7b7b04585cba63c1a9a0196aeb7cd604ff756947fac7ae2

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md

Filesize
1KB

MD5
213ce4d3df1ba61f274d573fa4630466

SHA1
f7c1d806fe4fdbcf58e4ae1ed161fa12bd45eb85

SHA256
bedbd87dc573c8eb786994e15f8961504e4b9e0f6f006fbfdb868c92ba9f800e

SHA512
dca6dc8db07fa0c4a841fe931dc747f8cbdb0e3d3ee43c7140eea8eb08a9ede6e8e3b5c21c000bc4e6005c99194a8e654ceac546558e3f90b48c6eb5686da2ed

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\icu.md

Filesize
2KB

MD5
df7fd6199bc4484bf549830f051465f0

SHA1
e929183dcf959620d9ef91306e89d5a1dec8f51a

SHA256
4228e9c34f8ccad4bfc8c9b7063440c022508d482eba2b897fc0f6acc06ef40e

SHA512
4f4eac4c313a9b1cd6612ef422e78b921ff3305a52580d36a16cafc8915b748111e23f5170b29393b9625e3e2bd46c18ad4f3b4a0b8659271ddf07e50924830d

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md

Filesize
1KB

MD5
74ddbe15671cbf31b95b8b6a3f042c3d

SHA1
d5c94e485962291af2fbe9d94b6b334e1872111b

SHA256
6bf75b6ad436b4c3ef5de02f36923f6fd209c281cc0e988f730620356cab45d9

SHA512
3bd7c23ac670a1db933d778032f0dfed302a2f1b88c981e1ac8bca2466d33a336a9b992445f57b35055efb82bf05f513811bb9d6aff90b9228821e11f160513b

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\joni.md

Filesize
1KB

MD5
6264111ffab995528490243e01bc64bd

SHA1
818f52703951dc57505dfeb579d515f2109fc0bd

SHA256
eb15ab533b87081df4ca61db528e4fd72d9e2ec7f7ae67b7006033b93f07a754

SHA512
41d55d3203b0010593536b42477d82bd9e39fd36028aa0fee5c70e198245bee81b32550966b49a1980a308f9b0bc0df5240eafe95b42f695fbf44e8e4ba63f06

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md

Filesize
1KB

MD5
2577bf260b9bd67064ee71a000b6c424

SHA1
85ea611f71fd5e4c7b424002de2118b6ddc3ccad

SHA256
22de5d907ede9d94021564d34194e9921ff92f7d3b252d4121ba5a582830c2b7

SHA512
72edb7d18c9d831695ebb76e144784cfeabdceca25216d0ce32d925efc9e278f1e9ecc152eab26fd0afb2d6a644a5199747288ae62feb3909248601aae88ecae

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md

Filesize
3KB

MD5
80d834e95a4f820ab61f763e991593a8

SHA1
58cb4f3461f0bdd6261013a129ef77f0f449c1e4

SHA256
d4c21ebf6fc3afb2eef69a5df6e359a285d1bb25873176c755d083a152cef23c

SHA512
7d1959cdc42c1ea0800d21a27b06276fa7bac5f39d1285cc3848e43c90bbf5c4165d0a5851971b661e77eb50052d8018be8f22213ed1eed1a8e7d1fc09beecd6

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md

Filesize
2KB

MD5
92721ff58b3e8466cfea3f43cbd25ded

SHA1
1a66128497e48241d7504b032327d8f2192684a1

SHA256
7c51ae70159abba03ee927e5f05074d722cf3129ff468e5d39dd3c8347ec8082

SHA512
fcedfd383656086bd402038ac939cad1046e8f8d9204a6716f59c0639784442f2acdc29bf9660575310f35a7216263ff15e5574afc0693c2b7c646dd259970c0

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\libpng.md

Filesize
6KB

MD5
91897b442031667b5f4c866d1acc9dea

SHA1
04ef1ca06418262f09c99b436e9f6ecd7767b402

SHA256
08a448bb35ad8ba3074dae327205e6286a8928cbbe5e364ae3d36b628f1eb97b

SHA512
03e3e781b61ca6e2c9cba2b26cb48e612e899add40dfebc2f97207123a1d31f9ff3d01b93e829a0409c0bbf0a7423e44ac59aaeaa4655422e755236536af4c97

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md

Filesize
5KB

MD5
cec62fe77d09f80dbbb735f4685021da

SHA1
ff5eba3ab0173228548098aa5a8451fbed8963de

SHA256
cba92ead4318c90929774a4a38444a39848f578512d2e5cbf6df4410f52795e1

SHA512
6a8715538e41d062f2f57a9ea96a0da5a9a1a296b284d95720f92099ad8afeb2da0bc77c0fdc03b621a1d513ebd86ddb47a5be67aac986070ca902b0fff98243

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md

Filesize
3KB

MD5
7711aa3b3244769343e159eab9305fef

SHA1
d362b517ec971012a562c1fa55257af004719149

SHA256
6e9a2fa93321d7f599dcf2f614b2995989bdbbd6b0c6bea1933ac8994c95b255

SHA512
7eecb65984c13b9a6e3c0b30faf08ee197dddbc2b3d798183a7dd94129085307bc7158d589d610692947c43df762b75fabb3f6c7bae6f964ce25567dbf7aef48

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md

Filesize
2KB

MD5
c155531c37b3dd8e634528538bd53982

SHA1
8244525db22bc0726687e4d9acb1506626557b9b

SHA256
6b58c55bc88e7df3a41f744660ecfb49801986526e45e3f4f1e5783999c115dd

SHA512
e1854e1e8f324a1468fc57c66f08203574d026068d7b111d2444fe1df10dabc976d1789793f49143d219988ac2e94e9ef9852c5de6076400b11525c37e3fe508

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md

Filesize
2KB

MD5
c74685cc4e22a9dc16526ce681919f3f

SHA1
fa46412d7cf6408c5a218dad0b7cff9e59eb835b

SHA256
6de81cf635ff3c2868152ab4530bb1d095eebf2a19eed52611e4d37bbe7c3e35

SHA512
92b22e6a16ada1948d7a8ba96e8405b5f44d4f2d6344b60a96d71b4f20efe2d3452a1f5f93f5b6a1a53c0e03d7893e3c2fb3f218b7719981b2c03972a9d8d1b6

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md

Filesize
1KB

MD5
916738abb78775ae5dcd8e204071155b

SHA1
ebd9fa8cc89378fba21abaa4f9978d585f63e8d6

SHA256
0a36bee3a1dcbd86199e2d13200ed1af84e698c3469b7e1394c1dd2310860c9a

SHA512
15cef3e9aed17b9c62f2730a9a31fdfa06d7c9c8f23afc3292a3aa0addf8a0480b78156a7744457ad85835453a8ffafe2fbac03c3b6921be2024fe545b45e22b

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md

Filesize
1KB

MD5
f8f126b5f26817331b901eb6032158e2

SHA1
c28b9109ecee0b74605911f1414f0e6220f07735

SHA256
5954a69cb05fc1b0cd4958b4e013636332697db264e33d2f69de81f2e4753c4b

SHA512
45ffeff47b255efe3077e0bc3c90f5631975d82ba4b2cd9e4dec0ad902264ad9ec44e6250907ab1c827749e0f38be56c565e1459954ceff6f50e06f2b6a62a61

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md

Filesize
11KB

MD5
2c2ca47671d6e9ecc2b8c31d9b315a99

SHA1
546c6c9c2a767a23cf401b56e444e9282970975f

SHA256
960f852c44b30d433719f24fa9b0acd78ac70edb0794db0a3c8632ef2d9f75ba

SHA512
10332c603fd06c4198c0c2fa61a9566ff0905dd2380ed1494dfa9a389877e00caac42a7cae36aa4294237f2bbcee64c7ff67893ecfe30cb5f46bbbd395327c4b

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md

Filesize
1KB

MD5
b48e8de490ca4a4d5e67fb73c4ed9488

SHA1
74bfdd65856bd1da4463557f33e50db297bd4e11

SHA256
38b4442e0778723e4f0f9ce373454c0801451f0bae1078950957b0d4b6fbbec5

SHA512
a0aade7da1a093bc85de148aa01230ebcd94272d6d3802fcd3076b254b8980a238aa7b1d0346673aed98de6fec766cfdc933071171d26945b2734027c8f7c5b6

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md

Filesize
2KB

MD5
435c8cc75300b9d8d1ae1f81c87fe912

SHA1
b6d05f5d44f93e8e638148dc26afa1370f647ef4

SHA256
a3c05d93584df6df9308fc8b3506bca776cd61f72afc31fe8fe4f982ba60c64f

SHA512
d26628d99550b0b37b30ac79abc49ab331b227dfc0876154f781feaf95140c6405bfa13de2383048bc2ef01fca2b3b4e8a492b9b6de487fb1820fbf3a0ba1da4

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md

Filesize
11KB

MD5
401275783a706289a91bee82e863a419

SHA1
f5deba42afe104d6d3b5e7624b8a417f961dcaf0

SHA256
a61fd3fc0229beb49234ef447e12ee09975675ee75894fa200800a348a3847ab

SHA512
5f7ac6c743a1daea29308612dca5a5b0de00a992d7c8c9409971618feec2ffb8b0038fdaae70b8a0f0dbd0dc52962a7a64b659bef9795bc89be2131436199b9a

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md

Filesize
11KB

MD5
e824138a8a695b12b048e9fb69b3f3bb

SHA1
3dcf162507375c7bb9c80dc3c16236ad69adf8f3

SHA256
544f6aa86f8409a9c98bb261812b2afda88a3753cdb8a7f0c4f10ede76b028ad

SHA512
7e0c3bb6f4539cb844ef16da05c53236ec602664a20c9189bdc92127749ca7e5ac650939fdac387f9010eae29160fd15a080edd423e3af591f2f7cd29d630a10

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md

Filesize
11KB

MD5
3547012330b116f9b71ab86b2bd06a3d

SHA1
1e630246fb421ed4058388cb9ef762294eacd62a

SHA256
3f83069570ceb671958681b383c2adac959f686bd97ada1ef721f8b306185c34

SHA512
e448a0861620c44593aba8d445b29a3d7872cbfdce09aef05f2804fc572eda9788267d1f087ffb358767b71c835062f8e142d9d21a5c0ff1e4d0618bb2d03b58

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md

Filesize
1011B

MD5
ae1a18b5187d298b7219635a5fae20e1

SHA1
fab1ea088175c3cb5d6f13a646bd8a28819637f4

SHA256
fb73dad19103391dc1d900b4e0ee95e4de70553f282b188bd6bdaaa050b49f4f

SHA512
83d215510ad28156717312d62ba4906af5944597eefb98118a35b1501daa1dfb98a5ad0cc5f7eedf7b3ad996d615c4841e92be526db825149f7f481cd53e300f

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727658720680492.txt

Filesize
77KB

MD5
88cf8debf144996cc19020fa8a1f2085

SHA1
3beee094ffea2b2c9a79b9841612550e5ee86b14

SHA256
e6d0d65d74339b62b88e64ce8966a9c0b9405f0dc8af05f4338d1881a83e970c

SHA512
c360791f8d51cfcbf65e9c68220f431cd6837dce3a50fa12724fa751fdaa3e6e1ee984d041ea36a91db671d83f2f462c479f3edcdab589add40b5ef815768ec0

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727659161166784.txt

Filesize
47KB

MD5
ad82b1ef32db3d5621023957d94f2821

SHA1
6f6de4dbb30dce5fd901b6a51d911d438fb2ebc2

SHA256
145a8d4e16f298818f7e7443c2c80414b5838035583d2b80535b6c256f32500d

SHA512
16a4f94ae26fef230021ad6aad6831d7efc8669882c6192d2cd9f04a59fd71a881c71a0c8154b915e95245a14682c140444eb16949daecfee661eea084180416

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727665191668352.txt

Filesize
63KB

MD5
0107eb7f4d2254a58760249f2746a6a0

SHA1
151a42c81eac3fa732ee56bd01dbb9c483c528ee

SHA256
6b407309d5158682c90560c594e6d5e146ebbbd6a21b82e516f464b818deed86

SHA512
f97e623379888436ec328fcd0e108f2035b5e49c07a84526503f5005348076fb314fcf41fc2b6ee702271a9a9102f134707f97931a3e80b32945d69af9bd12a4

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727667861810871.txt

Filesize
74KB

MD5
acc127aca22fbb2c9245779f7fa51264

SHA1
9fd66431a35801b572ede24b9d0f43c65f61c02e

SHA256
30a94f4bbe0c8543b7f644363fa668c8446701b184d0e140c22c1619ba1caf24

SHA512
47f41bf3caa0e89285400d91033861de3354fca49891ebfbe83d8815776fe650262242157c0cd9cace349d8978c33b3c27c5598f5a3f5fd660ef09a768c9ff3c

Download Submit
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\File Explorer.lnk

Filesize
407B

MD5
abd85294173443addb6aa67c8aba9b59

SHA1
481c6733966b67fbd992b390fbd6ac0c716efd70

SHA256
2f5d568638409e6f3e4e2bbd3155a2957141e85a4dc6ced63e01f78302cf60a9

SHA512
60d68db8c4e12f17bda58f1be44846c84e596c8a0ac319e11c9dd2996f86009289eb867a41ca4e5eccc359244fa5720728c3f8e66accafe93bbe4d24a26ec952

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg

Filesize
21KB

MD5
475b82ed88e2e15c77aff0f7e3674560

SHA1
e6cd530356cfe3b47baa3554a0b2078913b78b49

SHA256
a6b0920edd7d8688b0d77afa0fbb2337450464ad23d16fe7729f10fbc829a13d

SHA512
b17b94d474f9e573cc4375ff5024156c601cd2d54073c8c74c0fa8257cfe9d3695a75c97f813bc6a12b2f7435aa461aea017044191bd8ef2ababfaaf105c244d

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\HelpIcon_solid.gif

Filesize
1KB

MD5
57a075bb40921480efb9b3a4b8d6ece0

SHA1
df02581f6438e4e73a2e387ea157848d13657866

SHA256
5f990754ccce7cb2430ce17080c52490735dbf7f74d81ba05e21c21e85524cf5

SHA512
79d38aa753f422c4639a575bc1dc462e0c4a8a0e436aa5d55563fc6d0e3631d228b1fdc6dcd419b6a24336a9af1fff3ea3d8f0d437a0a62057bc1e373ecb2451

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\alert_lrg.gif

Filesize
952B

MD5
2c6c22da606f975b845aac3f4ca8f2da

SHA1
4dc3b4bc217252947e5f4c57ce2b99c5522904f8

SHA256
52110da0780a359e9511da8ce052e3008a020edfafb3780c5de538cbacc2a7a4

SHA512
2c8fdfc059ebd0d902e728f9f06422e1a67bf76138116bf7fa61586321a380b9ce06591b320a34c255215f0953ca6f96b12978e85cc61f2cabe6ff9d540cfa12

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\aspx_file.gif

Filesize
121B

MD5
384eb6122868168ea33c7760381ccb12

SHA1
f621db69aa9e2ddb398ebeeb6ddf04e560818eaa

SHA256
6fae23276263a55f3c75ac5cd70a91eaf62ad6ff8b2ce1db1f49c5d0e2a7b141

SHA512
be157411b9f0a93a1af3abed6ca220f457adb36298a93262319a582e7a46127ec1e0ac29126646e6f11c7aade9ebc1318a2d6c4aa751dd302bb3baddffbcba8b

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\branding_Full2.gif

Filesize
1KB

MD5
6ea853e9df8cd7f9ea5ccee7c59268a8

SHA1
2be5d4119c4e4dbbedb151ac72998d50329d5e6f

SHA256
e00a97ec706535a7edaabb56dfa8fc837eb6f737d1798512693be6e1df310eb4

SHA512
bc28d6e3e979aabf39c72fc54e83881e453143918ba93fdac1709e23307f6c8503feae18b011875f026bcc2f98242a5f4f35bcd52d0172ed9e0e7d64a35ea193

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg

Filesize
8KB

MD5
6a19c7f3286c5047bea5c65371f85514

SHA1
f951f26c6d2fb810b91914818103a2b5b1138f1f

SHA256
c9f683ae5c40c3007676154e14c3eccc9bb6a66d36409b30720a001ff76609bd

SHA512
5b4d62af462cedb3ee8ff5d764038f0a08c2e3168a4da38a2591380dde2b7cb3b4c76f642daccfd9606a3652788b30cacb1d74316b03aca8cbbeacafd5002526

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\deselectedTab_1x1.gif

Filesize
61B

MD5
72046d9ce2b319185af8e439624582f6

SHA1
46fbb2926f66469ae85f39082fb46dc868dbedfb

SHA256
fb5859c33f7084e9209e94206f2a1354c4c466e56b9c8bdca668229b2fc713dd

SHA512
17724e6706666ff62dbe233e05b299e52e96ee83685934702204a80c582df11fd18857adb2621f6933104c791450348d358b77150ce739cdd3010f0a4017585d

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\folder.gif

Filesize
914B

MD5
be762fba04d5648cd22359b831ea5ae7

SHA1
5291f92a6f5c8f753b7bdc52cb9f4ac286e16380

SHA256
33edc7f72dcfb3618ca843ada93881d126c69202ec419fb2208fd1d0dc0d70c1

SHA512
ac622bda73841be6fad49e95374988a4d95abd9385c7eb00e1f3a6f365d8e90ed7b3d230fb8b060f41907b300f7c4aabe32370b1ecf5240225f5f2140d7d7433

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\gradient_onBlue.gif

Filesize
90B

MD5
ffdda14727e59da2c9a9e34f4e8dfbe3

SHA1
bd54ba3751488dc4a2d6408d9111f0884aec75f3

SHA256
71cd041ba3ace679ad584037ef9eed80237f831035ecf8f7e86c5db8b091563f

SHA512
82ea0c11d66c711bca444cb9ff55e65d344969db7e0984d612c6703737202d12fc081c43b4d7f1130e1f7b315725ba8cd5c67ba77e8cbc968fa218932e48bc4c

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\gradient_onWhite.gif

Filesize
90B

MD5
3402b3dd63c9377fb8563a8b264dc1d7

SHA1
8c65f62c241e6adc93f1e7b26dc3a3d6f299b8be

SHA256
ea67ae9e7196e20d34cfe514311bc9e509eaddde5be2cdc729d8cba0763f711c

SHA512
b8bab842b79fbed86d922342ea668646f91dc27a5437122806573c7c91a482c10e37e3cdea0679657b387cffcce0eb969602c374a46d98174ac3dad672af1577

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\headerGRADIENT_Tall.gif

Filesize
328B

MD5
565db514ef7933ee85e172e794963d5a

SHA1
ffc51eaa52c6ffd16376151eaf2c0e3dd5ceeab2

SHA256
f73a21a924f59eb27d509804050c3e6172d7e0e4062fe8cafe9b15cd1ac3b784

SHA512
995b66a4b3730e2eb866bc9eb1e502a9ee245f1cfa4ea1491dd849607b66e3cda0875a337ba13372c701786b2b6f4cc9d003024dcb8f1e97a95b6d7b6a248d19

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\help.jpg

Filesize
1KB

MD5
cf67888208ef729beeaa70aabfe3a9d5

SHA1
7061bf957d9dec06df34d9a26dcc2179d61b1c83

SHA256
fed954e3abc0fb70aa06064f96cfc7393cd664a569c217103f3d50a574bc594b

SHA512
33d45a1c96ac09df897f43bb0a027e692b75bbcf920a89f9484c476d0ba12be649fd6f8bad7817014c486a0cbdbe445b79c77ec13a27b9314f8e0edf7a53ae0d

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\image1.gif

Filesize
162B

MD5
47ba5821b2091d8cd61f84ed5b52110b

SHA1
0f28dabc9ee64d129cf5a032437ed215e5e0a9be

SHA256
81b260e3fe58971c9b4e122a3ca1bb7207d6d2d3c20f9551a0186f7d92f634da

SHA512
0aa14ee3b20eb79ec2bf237ccc01de380e30fe27d3afd2bd20258e4a561ee4514687c2af16001a7ed00ebaf566b7dbd4ba103b48977fc6c61f66d8a06afe5b94

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\image2.gif

Filesize
586B

MD5
dabb02d3ce480e6227076610a1b4b762

SHA1
7a7d598288164ffa3b4d55dd1245b7c9b105a26b

SHA256
efb57e58a641330d3cf4d577477b4bf0e6307d43a2e0161215ae27322118d9c0

SHA512
beee275a94ffec468e1492e8645b1a77aa49a2d48b113686ae22e7a3d87fe95fa4b1b26e5c45161a8a9c9a1a286540941f5bd19d7a9b563324beaff835afab94

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\requiredBang.gif

Filesize
124B

MD5
3e903b6f84f870dc277e56cbd57ba159

SHA1
33ad8ca3c6dfa8c1d29f3d8e58da49f08b28d67a

SHA256
2943e0edbb7bc2fdba373b36d93e42c06f2e87618f2bb1bc466ad31c4199b97e

SHA512
80bdff9d6942c014ce08472413c18d6b8d01e30584fa1125af61852127e46f7b3cf69fd83530bc9948da9ebfee6f2404ccc6c7a39539dd7b8c3535b4573a4b43

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\selectedTab_leftCorner.gif

Filesize
65B

MD5
998da23e4d77ddccd0e8fe0aeebb29cf

SHA1
ea456113baf7d07347727e11a908891ff1d1a2e2

SHA256
879fc75e44d333c014517cb50737f7f7cc33721b88680ac200b9e2ebc2d15eac

SHA512
1be2f6a5c96338195b242b69c39c165f948a16e4b0cdb7170b6896de63f9b89370c57766f2390c5f7e9238a2cd3fe7d9b3090175beff9477dd5c566db71fc348

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\selectedTab_rightCorner.gif

Filesize
65B

MD5
2cb85c3b4fea5250d383a34dd7983a28

SHA1
250dfa97310c7f63bb580cbc74a67a92ee558843

SHA256
ea01d4a0fc2509395eea2b84f1effbe5c11c72486266e54b7a575bb61ecc845a

SHA512
1d25f30f7088afb1ecf0a3bbed11e2531000ed7729aeff5ff8c800f28fd3fef96715836b5a388aba2e1a8a8c63e425917e5bc7132f2a0d391aa253f2016f9f8d

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg

Filesize
8KB

MD5
bd8f0758bb11d1101143f77c7c98220b

SHA1
1d107175ee942b76e3472588d73ba32dce0887e7

SHA256
704fc1a7afb1fc74d50e216c636a6ce8af9b7581eadac5a566bfc272ac441411

SHA512
a5ccbe8b4da7e1f258329941ae2eebb9c823738a03610b8b4b5365f3db1043cae34096f92d5c55d01856c4baf4a50d73cdd74d37e34c5bf7765216b063d24cf6

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\unSelectedTab_leftCorner.gif

Filesize
65B

MD5
6b625fe1028a39890518c02201524fc2

SHA1
0325092efba4ad49b1657a1eddb09b79b7d6bc3b

SHA256
ff3b1e8ac089cc4da2179089365b88d283907e181552891cbb4e26cd4bc28925

SHA512
07b35a011983743be94c32b39dfd484091851b1c50f1ab48954bed490c593ab99d55aa396e92e4d862f49a842211ac8b1322cc79f535a42379a800b0c836c71f

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\unSelectedTab_rightCorner.gif

Filesize
65B

MD5
736e17833c0d1361a85dd6a0a8a2b281

SHA1
00f7e70861e9767061fd6a4176cb452f892bd907

SHA256
761057a82a71b1f9112a45da70a58676d77b708d4ef826557814fbd2c57d35f4

SHA512
648924b6876cbb9a9a1b77cbda3b9c628bc818dad1cf1f8982ee24dd5f281a2e73d797707b03974b8dee824404ef0578fdea8a0a8a643e76133c1dd979bb2aa5

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\yellowCORNER.gif

Filesize
880B

MD5
bc82e13c50c49fbbbc356aa29ea2b451

SHA1
fc12fcdafb548324711bccf93c30d1238b88d83c

SHA256
d67307b6a8673b84eab9e7cb237654389dace12e3c94f57b2050fe977ba3214f

SHA512
c260c62e9359cf5150b505576a9865fbd2202af497005c132f889a4f3ede992033f1eb206195ecc65c854f436e77ba9347a7d191115a8206445dd60c6c00e8f9

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group1\1 - Desktop.lnk

Filesize
1KB

MD5
e4c81a49a318057ca89d8f67e191ae1e

SHA1
7d3954f979965aa8833e4fec8eb6d39b99e34e6f

SHA256
0d79a43c9046bc768de51462c29d1ba5dc2a2c4683bef0280392b30df8a3686e

SHA512
d3f4105ca6c72041607963606f6ad1608dab17646389f07c45ca799441760e23f1f90052b212f93afd012b19d1e7154013f91402be4de16796ef75de52ba2f0f

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\1 - Run.lnk

Filesize
1KB

MD5
df165688551e6aa840acec30c5cfb70d

SHA1
65c0679882732109accdf9e03fbfc13be8fed7ce

SHA256
f2bd840be0cee04d090652be0b54ba49d7f7aead477470736dad0116cd836bcf

SHA512
be32f8c3b639c759bdcbd8924abbb8cb666c690429d2144176152ab67f30dd3f8b0739f87ae9f0f4609404498249cff7a8bea331f843d7b0f1fd9c6ba9680905

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\2 - Search.lnk

Filesize
1KB

MD5
6945f0e9ff8fcedc2964ae823050daae

SHA1
3801f1c63be3b848cc1928ff1fa9dcf3bc295979

SHA256
d7e76303cc827dee30b53ecd1e674d7652f013290b6fd8fa0ba1744956a79ba1

SHA512
7904747581b3a504288e0f31349f8c3b9831a8e5da2b72b42da4f46058eb30c61a5dbc993a35f2df43cee4541f7714e3d8f8c26a80ca74fd32b82264c7b4fcce

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\3 - Windows Explorer.lnk

Filesize
1KB

MD5
6a0a5707547443a892637e636974d4a7

SHA1
b721243426634ac1dbf9facd5a763b178b0af171

SHA256
a184fef38f4310896ebf23d13533ff9d5d91d8568f91f5a48335a3e385f18360

SHA512
2a923ab0f2d1b39ff2d757359988045e4aa011e74cc5700f79f95e70ffd469ab5efbb38c92017645ca6b965986d43aba98afd0926adeaced8b545775367c8866

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\4 - Control Panel.lnk

Filesize
1KB

MD5
5d131e965b3559202f26d19ca9f67295

SHA1
5c4cb201bfec2d932ebf6a6918774be89c84c38a

SHA256
ec32bde3c2fa3a0c8f48d58c379413de0e647533d039d955892368f70c787cbe

SHA512
b4e1c0630a48f22d4e615118a276485f6c332eff0b7b14c50c4f2eb465ddb935854a7b83b7414b00c0f73a590eabe8a7647b3045106fe24fa6eb5f196abe7027

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\5 - Task Manager.lnk

Filesize
1021B

MD5
a237b6fbe5aa5b6a143cea7ced8a41ce

SHA1
d550ce5f18a5dc011833155577004e47a59c24ee

SHA256
5763347659383705d0be1c93bfd2e2155fb90694d05380a5aede49d6b25b013d

SHA512
47ac0fd0b4ec834f2b3879d773643e5fcfd6ccc47e7cc936bd64fcffbcff00aaa6d3c6058f986965dd581701ef13b53ceaf05b0c7be00a1d9e03e66aeaa0002d

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\01 - Command Prompt.lnk

Filesize
1015B

MD5
dca1570f9ad44dc775b4851897ec11ea

SHA1
cee031b23b8f9442cf3e9a8026c4e489e4f066fb

SHA256
a0972fca87257020127d5f3515a548dd9d100f0aac01f932e6700720a36c1635

SHA512
de604a0f498eecc5a1ef8d2234d9df11bbd77a8e42c4156c2838f1a558b23481253748e86e41e0a6bfaff495ed5d60d9f7657f600f10950be7be015de15eda2c

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\01a - Windows PowerShell.lnk

Filesize
1KB

MD5
8adb1232cf99b55788d3eaf384c60b67

SHA1
b14e69f7c0cb4509a4b606758948d423df8287de

SHA256
92b04ba1d94c2f8b8e07c2b3e1aae84311b5f39ff3c96ea864accf481ff89a0f

SHA512
554f6c046b8fe5459e5c6fdc2642f02996e95fa9a6a7331ebc0259100af28e26995c2dc6404787921914360057fb9e7f454188621d213e35a1106bd34db788b1

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\02 - Command Prompt.lnk

Filesize
1KB

MD5
7a2b55c62fb59b18ae82d4fc5325ca12

SHA1
9985b86edb787025c9396d759a440e288d16a165

SHA256
3b0b93433666ced399428205a95d2b7cffc6b2b782b55ca529aaf37e7b98ed1a

SHA512
c145c9df2d15e61881b352e3577bd10a3ca79bd6805270d1966169593e7ae212be240c4f265cf2f54e1856d59671e02a9a2b040d7b6ca596d3004241214653ab

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\02a - Windows PowerShell.lnk

Filesize
1KB

MD5
f40d489fc04bde63df4fded3a9e292d9

SHA1
672b979f557b0c78765d5c560ef9a77f4ce6ea53

SHA256
e4d0115fcff4e11c8621c531572fb74a6585358145b8976bd1fa3acb76319537

SHA512
ca72128a0b18d0655eb4b0a672854b87a2c8d8d274968905c55c4506096acf75f8e731ccaa4fb22322f6efda9d493ea1021513502a5e7ee5465a64b7d4edafb9

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\03 - Computer Management.lnk

Filesize
1015B

MD5
75c169e8df8c2e60c91dc5dd0c69e3d6

SHA1
0868de73d2e05dd840e17c6cdf0184f9b01b26e6

SHA256
91a5993ef8d3c864ed772ee4df5fb7f812a8bc926063cdbf101ca9b5c6a1ad80

SHA512
4e64c13b81965fe908c79ff3c18cdf899a5176485f0def3cfbaf8a9570de12769f9779bc8345beecd7390653bc8bddc90e6b9c99d7ea5f232a2090a55626fa3e

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\04 - Disk Management.lnk

Filesize
1015B

MD5
bc3bbee11d736509219ad9d39f987ca9

SHA1
29434acb3e1defdfc4fe3d14f12e913f0f59cfca

SHA256
d065dc59cc3461ec525481f22dd04853b9b15242fdcb1f7f8fdbe0ad285e8328

SHA512
d3bccdff5c959aa08c0b246ff6add38bdba0b0dee64178afc33dc553505ac82ffc54347fb5d51c6009905a16cd5e0889e55c133076a95a513779097caae876b6

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\04-1 - NetworkStatus.lnk

Filesize
1KB

MD5
be4114f6b2c37b9b87ed19c846fead4c

SHA1
ce9ad411ef251a73cac494ab2a081b80858c1bde

SHA256
9b40e4b22d2b3e5ccaf3eb0c18ced36e54a406678b4d195cba1f736a2d5dfaa0

SHA512
20f2786e03dc26bec06dc28da129e520dd8f6c090c7d339622b4f388cea232623a5f32f853a33a541d7f16ab3123e94324389ae6399f2a62661a33e40bb9b81e

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\05 - Device Manager.lnk

Filesize
1KB

MD5
718808479ba121a25132369235c0428f

SHA1
25b46fb5ad4e8d613dc01107f5e593b83fb4b16e

SHA256
104208638183fa6a0acc4852e41809e29484ca2b153eab7a94722c31dde2de3d

SHA512
53fa39826ac81ae6bf8a1092b05ecf25f89b8cf7d7187d1bf2879847faccc66f69eddd95e10ccb04b724512bac539ab4e038329885da09a17ec2f2e015ef0351

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\06 - SystemAbout.lnk

Filesize
1KB

MD5
aa0927fb961fcb6f2f7453a5a3e9e3dd

SHA1
79ca88ae22514c702f36216322b2fa5a191a409f

SHA256
f8a1a7fcbc4474b3320184211934be9dfdf9745d6c1652417784af0929b4850d

SHA512
25e26b9f5c20b4acb93c16100c3299925b67d396139a2ce21723527caaa2f937d6f5befc01b3157b4d7f9f4f97d2c8b2ea61271a1a8097a98204fd3a2470cefe

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\07 - Event Viewer.lnk

Filesize
1015B

MD5
07a60d729c565f85630d0fdb3dc67f91

SHA1
96b6618405f16c8f30e1c22777d5c318c36d2b14

SHA256
183b9698a4cd4e1e0d6c95a8fe93c36fb203f0863b65e1f4ac4b4ccd7819cb2a

SHA512
1fdbcccbe22f9a933bb9d73a2b69bc8d2979393f7c14da3519e7108635adb5cd4cebd47418b391335e6c968efa5794d1d8063072ac1ee2d7cefdeafc6c96c767

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\08 - PowerAndSleep.lnk

Filesize
1KB

MD5
5d29290d98fe65f9de396bb91a91328b

SHA1
f9f6cafeae53511bb8d71f59d8b976ae323e8b1f

SHA256
04103b7cc92eddc64b0df61c65b861879d3edc43d17010fb801117096f6c0b0b

SHA512
4f3cbc933b01fcee7f40b6aa431ed96e6d5daf4b7337b5c16e6b062da07639c9845575e7a15d74f6aac708b197492e9e8f7336352a06802d861efea887201a84

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\09 - Mobility Center.lnk

Filesize
1015B

MD5
5c00fe4c7fac8993bbcc9544296cab59

SHA1
b50c2dddd58fab9275014bb73d5267cbd1c32cea

SHA256
b3fafd2baed7d8dd5152ce168f1a3265a569914a31975d423b1963602f03b151

SHA512
e7c339cac0d6a937f8ad20e22ff8af4c7de8a7d6f6952b989c35a68900f5803f5a581ee6ae3626fd5608d3f3d63f0aa0adfe12c2ba8aef81c6f71444623719c0

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\10 - AppsAndFeatures.lnk

Filesize
1KB

MD5
309b65d386ca6decb632d17a908b8ad3

SHA1
59506edc0dc1f521d54377b6110767c499dbd779

SHA256
e3e1d08d6e4eae37f4e2d1a80ba50f1af441744292930ae4359ac045841ee63d

SHA512
565a645074d7785b6a10347a9a2f0b509c6c6f9a9047785ab80aaa89cc7c71dc37d7aee766aa473d247ce1d4e936236b0bddf83951f23cd3eb245d0042cc3403

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk

Filesize
352B

MD5
6ae77fc3c55370ba364eadd1fcc3776c

SHA1
93ba8bfae56fc13090ff6d453ca1fee1865710b7

SHA256
ed1db6d65139f19154c06a5ee78f47e9d64f78861e6a6a3b0c2fe1cd933d6c56

SHA512
30820929fc856299e6c61f40836ff04e666c0fea3fdf716cb01dfc0d484c998b289741dfc86bafbcfeb7acedbc531191791f78243e9fac7bb660f483c4661e7c

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk

Filesize
334B

MD5
580197500003f5633c049801c9ee22b8

SHA1
f99e3be2b6d732ede9211aec7c6a2c3f373dc7ec

SHA256
51ab5d14241e4c45150b9064152a7b74d86df720c8f987087e79457d5986bedf

SHA512
539d6356565422df64223eff71b91417f9cd26be02ffac75b25429f3adb096d4e159377ae2ef31afb510c8e45c0cc031567728d928e9663b93f7d977f087744c

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Magnify.lnk

Filesize
1KB

MD5
534d53c8f65237f2bdb903161785194c

SHA1
42bf861e94e9eed82244009e11795407057f10e8

SHA256
fc4a8dbb83fca1c156dd860e59aa971612fe0b6aaa63e7e8ac0a95f20b8358b6

SHA512
fb2912e18f97db5b534559804221f8e66b7903dd0f6518cfc2d89b34ecf69fad3fba69c0c432981e56a9860c2a830e90569c17010d8a3d6c743a4267689a2f94

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Narrator.lnk

Filesize
1KB

MD5
6b8e7b979c92b521471eee682c2df38a

SHA1
a44888c71c6dd284d9e34b545cafea849a987b77

SHA256
4dc865eb388fcd0aadee5222a216fc9e1bdf5827d7d8f673cddb28e877320526

SHA512
3340838c434a4b8ea132eb57406d6421cdc62fd474675eb3f9bd40553d74fc7c7eb07c275040fc1995470a8b8574f76384d16b497dba00c971d660b6211ffc22

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\On-Screen Keyboard.lnk

Filesize
1KB

MD5
69d6cc64ce870dc8f1473aa33d19f30a

SHA1
d84a2a7cf8d535368618af7b05aa26ca9c52681a

SHA256
38082e7fff629db8d63ccfd3b08ab7dca543a715ca5d294b54ee358a1e70168c

SHA512
434e54e3d5f4356947773e00c0cd3c262c4841fe9b1290f20c473dee6fa4750ef48931d23590b3f078e6de9311ba9a2334191cec534270ad3ab6e271ce916ef8

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Administrative Tools.lnk

Filesize
1KB

MD5
a5b26cbeff3b4c2fbc67dd5cc8db54ed

SHA1
d3f8d641641f647d249af544371c4342728348e8

SHA256
9a29dd30451dc30e974d7f0d238d874563ea5fdb31c4a0ac310161bbf31ba2c7

SHA512
a8a31f10cb7c9fbede5e792251692d744718d039cf293c232539061b4176af4eae96a5b25488ebfab80a030d4d68d4e1e105d39c1836e18b9bd26ecce6a486ec

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Command Prompt.lnk

Filesize
1KB

MD5
2345f62f8826fbc6debbd4253d4c7992

SHA1
4ab5331ef9230634d4c2f21bb4e0e365942ba389

SHA256
5813965ab6eb3a73eb4c9ee581453de3e1eb211df7a4df3c7535d975773f0496

SHA512
8aca7ceb64e9527d1197e716df84690b56207347c3f622ebf1665737e37b0b5766b5ad6e7d677ae797655de6a5484a3879e981f1bbb0c8669a193bf218ad0d28

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Control Panel.lnk

Filesize
405B

MD5
c9c5566080cbd16d853133bb5fcdae2a

SHA1
b7953b8ef00dc4207528b753404edec2f99ff33e

SHA256
9ce623a5b07686076a9e7992cbd281359af0e836c81666f6ea5e5d198fc9aad5

SHA512
d338dbfc10c7957a55ae73a98cc19a519ac9f9f6c99d12426f82fd0e851a519fb5dd7bd05d3e16f3f605af9d4a62e7e9bf8074c70abb82b8e23780e11a530ba0

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Run.lnk

Filesize
409B

MD5
d51dd49f17ed8575db7ca0c105e06331

SHA1
6bbc4285e5a2bee42b172ac36e10fe296813d083

SHA256
4f3afb89aec1b36ca5c6aee87f25bba93d98827c388419f5cf7820f4f9180276

SHA512
5dd9be151aa09cd8b5b96d8ecf6edcd4772ef06f5bc20d0a4c7b99bdd535e91489bd46cb868420a6d82e23b6681e70c021f59f9bf93e9f6432cd1064005cca60

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\computer.lnk

Filesize
335B

MD5
290d5e51062d68355050c4ee29d37fa7

SHA1
c89afa2378bf0443e81f177c3fa9e3fec067ba08

SHA256
47de60b6ceb710591789b6cdcbcd122da9105a7374b891bf7483edd322dd8fd6

SHA512
89d062ac4ab89a8bcc4e57144dc7136b0a0af7caf1b90be34bbe9274287518756906a3bf73e59c6c435dab583bd92441dac2adb5402ea84298c2610cc4e5dd18

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell (x86).lnk

Filesize
2KB

MD5
840d1e1fd89297557270ef4b9664cf08

SHA1
ca8b54698747fe562b268e72efe6651acdf08955

SHA256
b0769073bc501b08e03202d8add781c43333597a986e640a735b4c0ea01f5353

SHA512
60a276b3d4339ccac829db73cc9929ddf555b2bca2bad75dfa35b943a91e3282d12bf4eadf0874a60ea2448e6c382914a3ca55c61585acdd3c17552618ef6545

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk

Filesize
2KB

MD5
cf6ea853a2abc5dbba9fa8dd99192624

SHA1
fbc93a287e31b42e1cb22b837dd0cc752b28ab00

SHA256
0947d15289d73538f3da33456857d3abdaa52b2b72ab0286ca128966815c232b

SHA512
1d34ee059e71799c48f1afb2fffa3a47689958106658589bd1201f0716f1b430510519f435a273d0caaa4858067de7a236baf2dbfc698fe03b5d552cb043cf7d

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png

Filesize
296B

MD5
123d69fe34155a34c2c9c5e8df067e05

SHA1
0663c39fd9779db90a22114b02926cb5bbbaff38

SHA256
f794141bf4d6343537d2851b62f2567a2a8975351b1c48f7537a82fd5166341a

SHA512
e8fb4eb09c4bf23c97e4326c38c1ef616f823a938a187dc25511062ce006d21b29d186409af3bd36a1571c5564a1fe8986af1bbe154f9f8d0d5d9eafe78a543d

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_contrast-white.png

Filesize
276B

MD5
ad5994d198348cbfd844a90f20283eb6

SHA1
f75c6467a5fe2a92a804a3373fd3923f683c65b2

SHA256
6781adc4130b939f4a0b760ab9c9cfb2244c203918b2f7270c70878a4a1e1ffc

SHA512
7adaa62e7056790d526f0711c8ac7669c7b6f548358bcd4cf52a6abe67180a94d1f959ac2e4d0e1aec2f71487102243a99ac8a336d49de37cf25fb94e688ebf6

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png

Filesize
296B

MD5
10fe9aa0876bd764685f46da76d08d2f

SHA1
e0803a7d1d7b0fedb0e56316d267fbafbbab5fba

SHA256
8953990b1671805ca8e7191cc68ce90487cacd1d8fa0912e269c38d330535282

SHA512
db71451f841e5677c16b94112ca3330afc3640b6fa849be514dfab5ae2c86bacfaf12aab6190a788d350d0a0ebd3d49f839426c020a188e316537a792da25b37

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square44x44Logo.targetsize-44_contrast-white.png

Filesize
276B

MD5
1ead1a742ce2fd44f9659bf2036c235b

SHA1
770f9642790c3cb73fc1d9b86630db2d6d1c6d9d

SHA256
35049c749c4f2f195291b0e086538d66412034667d4366f7f0fbe853d522efaf

SHA512
3044e230db8a37dbbcdaf525fd8c2960753f6904bd4e0067eb1e9a8b8fc18c25ead7d7e935dfe4ad981579bb43edeabcf7a5fda08d5c5d5e89db21b06f6246a0

Download Submit
C:\Windows\WinSxS\wow64_microsoft-windows-onedrive-setup_31bf3856ad364e35_10.0.19041.1_none_e585f901f9ce93e6\OneDrive.lnk

Filesize
1KB

MD5
3ad42546f16627ac7276eea78ff12da1

SHA1
523e2c720ede2b9af801a0d79acf67a92355fadc

SHA256
437727a16c9b7ef83ca06061de48aa25b012a5ab3d1e526978acb8927ca8d4ec

SHA512
001dcaa21fce09dc74d91202ccb3e51d17b51bb2dab4d1d1b7b23c1278b27835adeccb514a861641791da85bcaee4327c3b2f41b43fbe08b4a1949b8d3ac2f36

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads