xorist | fe7bba242f3e8f051684eec632a0a0bb66ea4bb69432a9998cf413e90942eb42

Analysis

max time kernel
148s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
02/11/2024, 23:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
Size 7KB
Sample241102-31qdeaylht
SHA256 fe7bba242f3e8f051684eec632a0a0bb66ea4bb69432a9998cf413e90942eb42
MD5 888c9c3d4ac8113c9ebe6ae8563d0e26
SHA1 349dbb63c8b41daf91c7f5f52488ac9aca4de1d4
SHA512 c3a8bc425654d05e96cc24c928584cb81ccbd1e4b16a2c033465c0b914f2eddde96b3fbf1e8b74a7e68aaa2f2b915b5372030d514eef7ec2254f250731260019
SSDEEP 96:lPZhl8wdS+r3yOYW189fTwUVF0CWHyjk8P1LOmjXfihExmPiRxQyWmpp7RJ6rmQN:pzdrr1FG1WDCgmjPZ+cgmZU/pGMUA
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xorist discovery ransomware spyware stealer upx

Malware Config

Signatures

Detected Xorist Ransomware 8 IoCs

resource	yara_rule
behavioral2/memory/3104-5272-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral2/memory/3104-5283-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral2/memory/3104-9907-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral2/memory/3104-10973-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral2/memory/3104-11288-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral2/memory/3104-11311-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral2/memory/3104-11316-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral2/memory/3104-11317-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist

Xorist Ransomware
Xorist is a ransomware first seen in 2020.
ransomware xorist
Xorist family
xorist
Renames multiple (2178) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Drivers directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers\gmreadme.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\FileRepository\fusionv2.inf_amd64_a47d9636ce0d7dab\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\InstallShield\setupdir\000b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\zh-CN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmgl001.inf_amd64_e09ac82d497a19c5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\perceptionsimulationheadset.inf_amd64_47c7e539c0156424\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\IME\IMEKR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmgatew.inf_amd64_7e6c377859cfcb7c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmmts.inf_amd64_bc07e137c52c529a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wvmic.inf_amd64_ae02676ac3e3c474\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\tsprint.inf_amd64_6066bc96a5f28b44\amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\oobe\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\wbem\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\ISE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Archive\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netavpna.inf_amd64_f6f0831ba09dd9f5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\DriverStore\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\urschipidea.inf_amd64_78ad1c14e33df968\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\en-GB\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetSecurity\ja\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_multifunction.inf_amd64_8bf0fd2423b20b97\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netbc63a.inf_amd64_7ba6c9cea77dd549\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\adp80xx.inf_amd64_efb36fdc260e8bc8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_avc.inf_amd64_8ee511eb19322856\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmnttme.inf_amd64_edc94fc65bef3d27\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netr7364.inf_amd64_310ee0bc0af86ba3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_PackageResource\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\acpitime.inf_amd64_e1498a974ab95ea7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\usbaudio2.inf_amd64_8d164ac6f7088f97\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AssignedAccess\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netax88772.inf_amd64_5d1c92f42d958529\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\ja-JP\Licenses\OEM\Professional\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Com\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_fsencryption.inf_amd64_b4b4845819a23338\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmati.inf_amd64_16fbf6520a254fad\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\ja-JP\Licenses\_Default\Professional\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\migration\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\printqueue.inf_amd64_12d9f43eb5d02987\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\transfercable.inf_amd64_911a60fb265ff111\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\fr-FR\Licenses\OEM\Professional\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\MailContactsCalendarSync\LiveDomainList.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Configuration\BaseRegistration\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_fssystem.inf_amd64_89e15d7e662d6584\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_scmvolume.inf_amd64_de693592afe8a496\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\kdnic.inf_amd64_6649425cdcae9b5f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmke.inf_amd64_b83f029888180def\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnms012.inf_amd64_707d3849370b9d23\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\fr-CA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_fsvirtualization.inf_amd64_078671a0cdfe2870\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_volsnap.inf_amd64_47e3741bbf4d6b06\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnms007.inf_amd64_8bbf44975c626ac5\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\oobe\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_RegistryResource\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WindowsOptionalFeature\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmelsa.inf_amd64_f187fca538857daa\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netefe3e.inf_amd64_7830581a689ef40d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\MsDtc\en\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetworkConnectivityStatus\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_magneticstripereader.inf_amd64_86e291110e37418b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmusrg.inf_amd64_bb7c44c7bb3664d0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnms010.inf_amd64_9e410195c3b236c9\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\InstallShield\setupdir\0021\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WindowsOptionalFeature\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3104-0-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral2/memory/3104-5272-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral2/memory/3104-5283-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral2/memory/3104-9907-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral2/memory/3104-10973-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral2/memory/3104-11288-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral2/memory/3104-11311-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral2/memory/3104-11316-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral2/memory/3104-11317-0x0000000000400000-0x000000000040C000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\StopwatchLargeTile.contrast-black_scale-125.png	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteNotebookWideTile.scale-400.png	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteNewNoteLargeTile.scale-150.png	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\PeopleAppList.scale-100.png	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsAppList.targetsize-64_altform-unplated.png	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsStoreLogo.scale-200.png	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.scale-80.png	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Images\contrast-standard\theme-light\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailAppList.targetsize-36_altform-lightunplated.png	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\RTL\contrast-black\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderLogoExtensions.targetsize-32.png	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\VisualElements\LogoDev.png	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ARCTIC\THMBNAIL.PNG	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_2019.19071.12548.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\PhotosMedTile.scale-100.png	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\Background_RoomTracing_05.jpg	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-24_altform-unplated_contrast-black.png	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\OutlookMailBadge.scale-125.png	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Store.Purchase\Resources\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\close_x.png	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sl-si\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\multi-tab-file-view.png	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-125_kzf8qxf38zg5c\Assets\Images\SkypeAppList.scale-125_contrast-white.png	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Outlook.scale-300.png	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\OutlookMailLargeTile.scale-150.png	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PlaceCard\contrast-white\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\zh-tw\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-72_altform-colorize.png	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailAppList.targetsize-256_altform-unplated.png	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Transit\contrast-black\WideTile.scale-200.png	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\LTR\contrast-white\WideTile.scale-100.png	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Collections\contrast-white\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-64_altform-unplated.png	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\fi-fi\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example1.Diagnostics\Diagnostics\Simple\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare310x310Logo.scale-200_contrast-white.png	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\System\msadc\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows Media Player\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\lua\meta\art\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\171.png	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-white_targetsize-256.png	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubMedTile.scale-200.png	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tr.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\LTR\contrast-black\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Square44x44Logo.scale-125.png	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\sl-si\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_Pester.help.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-white_scale-80.png	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-64.png	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\bg1a_thumb.png	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\GenericMailMediumTile.scale-125.png	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\423x173\4.jpg	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SmallTile.scale-100_contrast-white.png	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\ExchangeLargeTile.scale-100.png	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\OutlookMailMediumTile.scale-100.png	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Program Files\Windows Media Player\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\423x173\7.jpg	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GetStartedLargeTile.scale-200.png	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-48_altform-unplated.png	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\7739_20x20x32.png	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\WinSxS\amd64_dual_sdstor.inf_31bf3856ad364e35_10.0.19041.1288_none_b06a3a09911ef032\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-pcw.resources_31bf3856ad364e35_10.0.19041.1_de-de_a369d8a4b817ac3f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-dafupnp_31bf3856ad364e35_10.0.19041.746_none_9ff4160625a200df\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-ncdautosetup.resources_31bf3856ad364e35_10.0.19041.1_it-it_67401f247610a75c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-ui-shellcommon-core_31bf3856ad364e35_10.0.19041.1_none_91b1f58702057373\SIMLockToast.scale-100_contrast-white.png	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_openssh-client-components-onecore_31bf3856ad364e35_10.0.19041.1_none_b5ee49ccbbfbfddb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-m..ureengine.resources_31bf3856ad364e35_10.0.19041.1_it-it_44e2d3f797c55ac0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-netlogon-adm_31bf3856ad364e35_10.0.19041.1_none_b161ed0ab564b738\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\assembly\GAC_MSIL\System.Printing.Resources\3.0.0.0_ja_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\Panther\UnattendGC\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-crypt32-dll_31bf3856ad364e35_10.0.19041.21_none_533343740bd8edcf\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-n.._service_runtimeapi_31bf3856ad364e35_10.0.19041.746_none_698e4a0bbfaaf49b\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-p..tform-adm.resources_31bf3856ad364e35_10.0.19041.1_de-de_ac1e938990a73ce8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\images\wide.DefaultPinTile.png	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess.resources\v4.0_4.0.0.0_fr_b03f5f7f11d50a3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-r..-resolver.resources_31bf3856ad364e35_10.0.19041.1_de-de_e100efbab3b4d69f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-execmodel-client_31bf3856ad364e35_10.0.19041.1151_none_969496a90f08ec6f\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File opened for modification	C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\ScreenClipping\ScreenClipping\Assets\StoreLogo.png	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-i..ntrolpanel.appxmain_31bf3856ad364e35_10.0.19041.1_none_d0af17ec366548f3\EdrCalibration.mkv	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-t..honyinteractiveuser_31bf3856ad364e35_10.0.19041.906_none_a6600355b5f69459\Answer.scale-150.png	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-t..languages.resources_31bf3856ad364e35_10.0.19041.1023_sk-sk_0ff0ddecf400ecb4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_netfx-aspnet_webadmin_permissions_b03f5f7f11d50a3a_10.0.19041.1_none_0e1fb02a57158eaf\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-rmcast_31bf3856ad364e35_10.0.19041.1_none_0a6ed9b5274885eb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-n..line-tool.resources_31bf3856ad364e35_10.0.19041.1_en-us_7b4e70c9967466b8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-photo-image-codec_31bf3856ad364e35_10.0.19041.867_none_877305abd8fe2b99\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-s..s-svchost.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_405ef0e6387deb46\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\WinSxS\msil_inspectvhddialog.resources_31bf3856ad364e35_10.0.19041.1_en-us_cfff18f1c078b862\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft.packagema..iprovider.resources_31bf3856ad364e35_10.0.19041.1_en-us_4413c095d47562c5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-devices-background_31bf3856ad364e35_10.0.19041.746_none_94c098fdfd235275\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_b4fc93ef208f3edb\403-18.htm	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-msmq-queuemanager-core_31bf3856ad364e35_10.0.19041.1_none_35a8f127fef72ba6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..gevolumewmiprovider_31bf3856ad364e35_10.0.19041.1_none_cdc4d38aa94a3684\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-textshaping_31bf3856ad364e35_10.0.19041.264_none_034dd448b05af73d\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..espaces-spacebridge_31bf3856ad364e35_10.0.19041.844_none_17081bfe76d80f3a\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-wwan-lpa-api_31bf3856ad364e35_10.0.19041.264_none_c2c29c19f21ad300\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_multipoint-logcollector_31bf3856ad364e35_10.0.19041.1_none_56138d203a7fc4cf\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_rdcameradriver.inf.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_38ce4d0ed1e2e9e3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-a..ence-mitigations-c4_31bf3856ad364e35_10.0.19041.1_none_c216468b91a73e4d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-d..istration.resources_31bf3856ad364e35_10.0.19041.1_de-de_f68f68fd78290aa0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.423_none_9de80b9d881a1ebd\NavOverFlow_Info.png	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-sxs.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_4a450e5e1824d217\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-winlogon_31bf3856ad364e35_10.0.19041.1266_none_e488d49c8a22d21e\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-i..ocale-nls.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_c1c6266f1ae3c1c3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_414a0942eadc3634\403-2.htm	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-wininit-mof.resources_31bf3856ad364e35_10.0.19041.1_de-de_75287cc2038ecd7a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_wvmic_heartbeat.inf.resources_31bf3856ad364e35_10.0.19041.1_en-us_424dd759b4db1c81\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.DataVisualization\v4.0_4.0.0.0__31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-g..-base-mof.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_856b80150089f232\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-nshhttp_31bf3856ad364e35_10.0.19041.964_none_518ed510d35bb200\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-ole-automation-stdole2_31bf3856ad364e35_10.0.19041.1_none_a91c7b19ecb3924a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-rasmprddm_31bf3856ad364e35_10.0.19041.1081_none_1848e150b717de61\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.WSMan.Man#\73c6ae4303a31ae701dd97dcdda2523d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-b...appxmain.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_b3b24982a3164dc8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-c..services-certca-dll_31bf3856ad364e35_10.0.19041.546_none_e1e7b56148dd5ae4\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..iveengine.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_9f78d2906280a501\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-dot3ui.resources_31bf3856ad364e35_10.0.19041.1_de-de_71471c3319bede98\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_vmconnect6.2_31bf3856ad364e35_10.0.19041.1_none_5c4aee22bbc45ef1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\WinSxS\msil_microsoft.web.confi..eprovider.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_c526372455fb75bf\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_dual_errdev.inf_31bf3856ad364e35_10.0.19041.1_none_1aa239cbe9936d09\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_windows-application..ardserver.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_52167fbdea8017f2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\PresentationCore\d182a3c6e8e7b5a8d7b7070466afefd8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\Toolkit\Images\dash.png	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-webapi.resources_31bf3856ad364e35_10.0.19041.1_it-it_a311946260914345\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-w..indowsuiinputinking_31bf3856ad364e35_10.0.19041.1_none_afb44774b6e4cc48\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XAEVBKZRYEPYDNY\DefaultIcon	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\XAEVBKZRYEPYDNY\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lTFMbE460hA71N2.exe,0"	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XAEVBKZRYEPYDNY\shell\open\command	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XAEVBKZRYEPYDNY\shell\open	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XAEVBKZRYEPYDNY	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\XAEVBKZRYEPYDNY\ = "CRYPTED!"	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XAEVBKZRYEPYDNY\shell	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\XAEVBKZRYEPYDNY\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lTFMbE460hA71N2.exe"	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd\ = "XAEVBKZRYEPYDNY"	888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\888c9c3d4ac8113c9ebe6ae8563d0e26_JaffaCakes118.exe"
1⤵
- Drops file in Drivers directory
- Drops startup file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

aic_file_icons.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\aic_file_icons.png
Size 50KB
SHA256 1f5baf2bd59ff6ce6fdf03a0ab18b639cd09f71a2a806c8402d9b6702ca113cc
MD5 343c2258e973f55f87d68dd22129fb83
SHA1 089a400ac458ae0c231f2d845ef87ab4c54f7cb0
SHA512 0b88385812cb5e0dd301094c115c6f0ffa5a5c0a2d9437d88b4b8ae836ec9acbd4428219e553860e4bc0bdb5656808f2c653ccaac04cec96bc5e770d2053a94e
SSDEEP 1536:VF/3HFQr0KkzPdnrtsC17cWjbsVEzntGb6ycW:T/3+r0KkDNrGC1oEYVEJGb6ycW
MD5 SHA1 SHA512 SSDEEP

Submit Download

selection-actions.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions.png
Size 1KB
SHA256 a29eb9528af8c6de528641fc78c9e82c551b65e0feb537e6212ce3b28ab055f5
MD5 023793f40f4a4049b5d023eb314c1cb1
SHA1 19a29fbb556bdeeb24d568f22ca91d2bfbcd2646
SHA512 188cccba351170fad73902a4dfb132ebe7ebc3d4e432efee6871ef6e3430f89fcd787b466d06aa235a7943be378899429871475809aa802be296ab27b9923cb4
MD5 SHA1 SHA512

Submit Download

selection-actions2x.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions2x.png
Size 3KB
SHA256 f0af4c59b4b055b7e880dd3a2c457f9ac290a039fe6e73c832205b8c7fe9fd16
MD5 36a6d8b095ebc03ac5b4898a47e6a383
SHA1 8122c184487fc1ec47471456010380d84c60db40
SHA512 eacf1d77779477f1200545dff818032a7dd8e6de8910bc34885a24d8bb605be7d0c1c44c2be6a7157ec5b3623dfaddacaa2fe5d452c06889381174b646f05e60
MD5 SHA1 SHA512

Submit Download

example_icons.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons.png
Size 683B
SHA256 0602812c6b7f40186699225aeb621d1b51d88ea7b95374c344a04474a5b11d37
MD5 67b257c1b4ea91afcbd5285e44729a16
SHA1 8772b90df33e80bef01c606d1b4ea5307516c9e9
SHA512 aa55320c9c4979c96e20135d5e342fb46e1fa23e29ff7bd3978a732d5c25b131be031c507a26544c6708737310b1dda5b9cfbb927afb5d30bdf667767d994291
MD5 SHA1 SHA512

Submit Download

example_icons2x.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons2x.png
Size 1KB
SHA256 ead4e739557611b6495a660b6c1fa4ee8ecdbe2b217060f83dc8d9fa5b0082d8
MD5 4b5b9085ab314f6e409b83fd6a167878
SHA1 c88ac48c64150c2a8f18cc17beea900f176f82a3
SHA512 8cbbb5c2902473b71c750595bde1ef73c057288dc6326ad7b0dcf4471531218a68ad08a168c04d44f25d319f72d87ec1098e7b7481e61c6eabc13ccef105a055
MD5 SHA1 SHA512

Submit Download

rhp_world_icon.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon.png
Size 445B
SHA256 29e61599e7873752222360d7b470412bce6ea719a8227ad056558502fed6ff6f
MD5 ea6eaf2b50b01b65749f465ff8d8938b
SHA1 afc69a70d577d643956f96a151ea74052a514894
SHA512 e7eb58eadfc6a146cbd6e9464cdf419595109a0d7510ddcd70cf6084128f1581236e9fe48670dadf77d3fcbc51944f9dac853aa9539be26a7defc49e950bf353
MD5 SHA1 SHA512

Submit Download

rhp_world_icon_2x.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_2x.png
Size 611B
SHA256 e8d26aa749004b4450e01e33b748487bfe39b86ce41f0e07f691c87dcb8aa975
MD5 ce3740bf046a621c63c2c48b5bddc6a5
SHA1 94ce5bc43b8482fbf56071bdae520809f29dfc63
SHA512 7fa3df39a2bd6541fecd22a638330d06c712c0fdf217cdf7871884aefd25b95d34b022a6dbe2c2c8413148ed8ba10c242f89944dd3556d99cada5498f4567b89
MD5 SHA1 SHA512

Submit Download

rhp_world_icon_hover.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover.png
Size 388B
SHA256 3d852f7b6104d5f370c6241d14dd3ddef05ce04e1250b6516b218346810a3c17
MD5 34a0a8b1b9164e550e5a05c9a031197a
SHA1 36d70de1adc5641c84f741c1c7ae9179b606876f
SHA512 f67295ffced8a16cc43833f498d5a22ca2941e6de4fea4f381b43ccc91ddb88542f8232a308a186739c53b2d75548d6a5bd68fc1cfbebd4ed03e3bb62e4a82f5
MD5 SHA1 SHA512

Submit Download

rhp_world_icon_hover_2x.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover_2x.png
Size 552B
SHA256 d3aff27538d815af74caf02ead38903bae62f2c40ce494795493275877d0cde5
MD5 b6f778d54186c3238e0fb38bb1ad1f8e
SHA1 102409fb51fc15ea9821fb8fac35559afea3962a
SHA512 ea72d632d461119aa334c9baab05697d2cb87e14849901eb8ebf2c02cbada738d66fb0721af2536e97b77d931f84e164bda8698859672ab279a148629407bef3
MD5 SHA1 SHA512

Submit Download

rhp_world_icon.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon.png
Size 388B
SHA256 4205326d224773baba406128b6c10f5f78042d7760716d8c7b1bd93fae1703ff
MD5 866b7e9544b7386e9bd377f4babdc92d
SHA1 c3cb9485880fbfb52c0651d5d565500a59ef0926
SHA512 fa4458cdc6073b7d88cd16d8a359b319f6d4b8c9ac3645c1f8f6a97359767c4afeb3ec0d896041239a1e0e1e0f08ad52153d5f135978b0c04a0c24ba4773e025
MD5 SHA1 SHA512

Submit Download

rhp_world_icon_2x.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png
Size 552B
SHA256 35d4023b4912ead157ca4151dbfbc218f73772f98e61e3c468d2570f2735004f
MD5 e2dd09239ac62d1c145c328477f21d94
SHA1 70b0ec00fc30234b21c04169e190f93eb9c3ca09
SHA512 b31888be271c898aed54750a7e302c66b421165309bfb0dacc8b67d5db01b9020224b43590a417f313666f090c866ef76c47b842f1f13bdd9da69c9c2ed52d65
MD5 SHA1 SHA512

Submit Download

rhp_world_icon_hover.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png
Size 388B
SHA256 6543bdf28e50910a190f6fd17a6a536f34210185ad22fd743c825bd6ebf93b87
MD5 8ce3f78b6cd039cc325b0e2b49ee90b6
SHA1 9ed60322baa1e408b5dec9ad2e52250d5cb66996
SHA512 bf278f19cc93d42037e2b6607376b76b10a8c3b157da086339d8aeb271bc7fa8be7d33431e28b43c8389c2f6d533362f804b1c7b2eeeb852e5a6e0f03568449f
MD5 SHA1 SHA512

Submit Download

rhp_world_icon_hover_2x.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover_2x.png
Size 552B
SHA256 47e7e040061a84b20d67074a343fc24f0d6873d7c2a083dd236700dccdf909f2
MD5 7c77850a694fc11923f2df7f8e6cf553
SHA1 4e60b3b408a3fa4b2b10a09a6ae44201fc3e45d7
SHA512 81aaa986b3885a8ee33a2be48db7b2e7190e8b7b4e638e6aa5597e3b3bdfdf9030379d3ae851b73ec7fa7fa4c85c925c52a613594a8ef516d258f88c392126ff
MD5 SHA1 SHA512

Submit Download

icons.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons.png
Size 7KB
SHA256 9512e63559a5df4adeaac5d5f408aa962e8b5eec6ed826be7a8c20243d909f96
MD5 b5529cc0fbda9c47b8f279df75a2ba0b
SHA1 fc444184aff1d7706fce4016cb99fa6c8736700a
SHA512 3b0c994cc38871e1dc9e66f3227703422a90e0fd965ef9e8d6afee428831a1cfe12a3ce772c07792ee7dad2566d051d4f473808206dab0b5b778be0e7c984d82
SSDEEP 192:KhlgJyN1hnk4tt+gKug0v/YqCA4wScWT3jvjEtpa1bV:uisBkIRNMA4wScWT4pa1bV
MD5 SHA1 SHA512 SSDEEP

Submit Download

icons_ie8.gif

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_ie8.gif
Size 7KB
SHA256 a0ae6f2d9b029b16bad758a8d37849f334e0223e5ea66cc0f04c81898fbc1f0a
MD5 2ab2982d1813fb7d86542a6c2bd0d085
SHA1 16de5ae291ed98c15adbca0d075c77da83a0b9b1
SHA512 2b5bd53c0957bd6c608107c611fc029c476f892c179b51ae1376637601a2933be70361159efdae45ad551bea136fcbe722ffa8401ffe2f14ef82470aa8a982b8
SSDEEP 192:pkLOHp7aLiVw7Xhf5VqIkUgfmilkF0UnkuWOiAuUPSBJh3nO:nJ7AiVgd50Uq5kF0UnJiA5KBTO
MD5 SHA1 SHA512 SSDEEP

Submit Download

icons_retina.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_retina.png
Size 15KB
SHA256 742404112f941f4510c445cb8268e541d6755fcc25f27aa678ba2f0abcea28ff
MD5 48baa8ac235ffe3d72d60a14e17e19f6
SHA1 5d9443f982b9ef4e1da3d416ab83130f15b3bb9d
SHA512 0f1500ed07024286df12b61892c818c5ee2c1692099abf3b324733279c2091e848c2077c8572e26aecd65c32df1da357295d60de8ef45a38c18796681977e043
SSDEEP 384:fRjndxGCK/BdPiXjHcPVCx4xoEfssypebzMMafwaI3:f9nHGC3ECyxT+pis4au
MD5 SHA1 SHA512 SSDEEP

Submit Download

new_icons.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons.png
Size 8KB
SHA256 da8ac982c34a3c9ff68cba326cb262389ae725e631a7f6f67317dc5dc34c15e5
MD5 2734e54e1e91a0c7191e361fdb7b79e8
SHA1 df1d3baad8a423687871b3affb9d48f42aa3a70f
SHA512 58a8a6a4bd9803044b634bb946c9774c26e58e17ab31ae022feb8d9b17ec764b8b12932411513d553b103577c023ab122de376e2f8172350a08a01fa25733778
SSDEEP 192:NbddFmRhZc0qC4DqDmmmsygrmgtds4HBmmmLrnZwofmmmmOCCKaJEmmmmZ5KAZ:NJdaG1ZDoygltdyrnnmCH4Qh
MD5 SHA1 SHA512 SSDEEP

Submit Download

new_icons_retina.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons_retina.png
Size 17KB
SHA256 8262e114d4c687d29591c539136df6c5f5422f4475d46dbe83d25f17cdf2b4ef
MD5 328cd3e1455f9de213c32dc8beb16e3c
SHA1 54bc93819411cbe6bac5ababd0c87b16bff7c849
SHA512 c35bc276b01e15cb57aee17783e10ba14143952f26c2dab9f6cb6c5d124ae2035cc086eff6f543fa128f69cec898a5127c243af7730d3d4d0f1163091c66b7cf
SSDEEP 384:dGNkb7zhm0JI3l0dnnL+6esd2Hk5aMYafaVPqjH:dwm7zMAI2dTJd53YnijH
MD5 SHA1 SHA512 SSDEEP

Submit Download

bg_pattern_RHP.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_pattern_RHP.png
Size 179B
SHA256 f6228811c6bb4146adf940401c02417a1b658c79dd80621feff44a4347abefbf
MD5 e42db9b9a6b45551d4473db0196c0527
SHA1 a45b466a248c573ae82c789c34f4c74e090b748f
SHA512 fac1ce59467926f77b5bb4de3e4999705bc24e8c3495c06187b1eb94affb8f7d81816300f7f4ad64672f3641e6961ad5a21b6b8c92f329c2581a66d89c0ec152
MD5 SHA1 SHA512

Submit Download

bg_patterns_header.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_patterns_header.png
Size 703B
SHA256 4d2c5830e207340bec3d454963587606812f8de1bc509d6f1ec319b80238573e
MD5 db352cf00d84cd108570a639d944af1e
SHA1 652c9d6b015ef51d14ef650291b4806094d89d30
SHA512 88c53e440764cb72c55f88da8a00051c4188068309ae052ee35b93371d32699735327d9ec5b5eb7824bc56bfeb7cf20cc50ee510716c7a09f7b52ba4afcdf742
MD5 SHA1 SHA512

Submit Download

illustrations.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations.png
Size 8KB
SHA256 9493ff547a300f93dae68faa552a0d5f5d03ae1823899454938b0c8f0c541c96
MD5 5014af0ad40c101afee4db5f180cd61c
SHA1 f857b80865786a07780b5b416ab282207cdaa167
SHA512 946a35344160ceea92118e1a197af938ce8ea0bb4d65a8aa4f96442c8fc00f00dd864e8d0a2bbf73425a836432f731f508cbcee269cd5f2b5eb559b0a3c87b81
SSDEEP 192:OfHER7lGSVsLNQ5uMxSAJt84NjmDDPn0JR5RVk5rddxG275a6d9OOOOOc:AKxGl7YU4NjZfRVMrdFQ6db
MD5 SHA1 SHA512 SSDEEP

Submit Download

illustrations_retina.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations_retina.png
Size 19KB
SHA256 08b7ddb9d5cedc4e41e8da038b2cc8f65e610d6b77255f37e9f5b53465a107bd
MD5 bd7bc31a4dbcf7d1589ba569ac1be3d8
SHA1 a835a4e13541673304b5e80a1b446827a777e3ab
SHA512 63a50905981628f9a4c2ab3e53809dfb927d3a6eb169f106ba833af809357844e56acb2304e6266679309bda6c3af874e3c66267959503df1178af067e7d8ff2
SSDEEP 384:IfQFlF1ioGJBDFCt015pcMV5UcpJqrhPgYdKC6g2qKP55cpDe33+j:Ionv/GJBDgIcM0cbeoEg5CDx
MD5 SHA1 SHA512 SSDEEP

Submit Download

faf_icons.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\faf_icons.png
Size 6KB
SHA256 19b1c542a02a93c9a57a5ef7bec05389de2e73661ffb702156116ceee073e7d9
MD5 ab039f5901d719646d2b5cae62e68224
SHA1 bb7906585fca4e964fdd991959b4f7876bfcb011
SHA512 15f33367d6f08432c3d1f4a0e0b6e9916eb3436dfbe4f8016419ae0d8767f5900a7e447304af018b022a1bc9998865d4ffd0830dbe3ea5d95cd5a57bc7b723f1
SSDEEP 96:MxzQJmhGmjNyZ32buI5PDn5OkFHx9Ol0TZs+8NkYV+I7tkqvRgweGgesulg3AZu:+QmkmjN2Gh5DgknZs+8eWLGqudKu
MD5 SHA1 SHA512 SSDEEP

Submit Download

bun.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\bun.png
Size 2KB
SHA256 6fe3cada86ec766bfa5d062fea28493f7204634b4f779f7aab568b7a2d126124
MD5 387cc456f6c5701ea906293c56cea33a
SHA1 4e07af7cd53ddeb0748a288192c80da3f56e8641
SHA512 104dace375bcd027cd5919135c23ebc486b9fa51a92b6fa912ca9c52a7741beb11de94fb7ef8f19386fdd8b23b3535061630985a911fbb8e1d22f5b3a5e6cce7
MD5 SHA1 SHA512

Submit Download

cstm_brand_preview.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview.png
Size 2KB
SHA256 8b6666998a33317fe785bf676d6a9da4bc00f58145793a7f7d915ce37c8625cc
MD5 b44b6a036e4859d82909081d39f2883b
SHA1 a9e5aac9642cb66c2c73011bd4192d2ac84fa7d8
SHA512 cd2f9a29882a994f91676393623e09c9934227dc6e531a64191b49f555264dac7ba560d6f971c768dc82d0a09a2e78aa86d252b5f7bede120d9e5cd4956a3f52
MD5 SHA1 SHA512

Submit Download

cstm_brand_preview2x.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview2x.png
Size 4KB
SHA256 8a022548a2daf2abd4c8a6e78e74c31d8b61d961aa788d29151beb0b52b67910
MD5 abbe204b3b033c80529a84e18af91789
SHA1 47aa13bfde87a749cb81aba920ca76c10b14cd1d
SHA512 5862e52c82efc72851778023f9bcb1647456ac8a6c7861f9cbbb8dfe62aafa90daa73e08a26b25f050378c91cc0f3b183d0f0ec17cb97969ccd8bd1fd121240a
SSDEEP 96:vsv2T8vSCyXksSyS+ViyYxSQwm17MhF7gns4ewm6hZSjwZhkn1B2HwcnP:0v5PsjSPSphF7gns4ewm6zSUZWO
MD5 SHA1 SHA512 SSDEEP

Submit Download

dd_arrow_small.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small.png
Size 289B
SHA256 8a253f39c07cbaa11be80f755a9924c09c7d9b60744f409b6ab64c4bee0dc6bb
MD5 4524144ef3e91a77c0022c5d1f83aa5b
SHA1 00a07f45b58b70ebf3a7f08c2419c408f8b393a2
SHA512 b6581da67dfaad4b806f0bc44b2c22b94c56ae476c1ce4769600ba2bfa4cffd2f59f14face285b225f699bd78189281bd9b1c978b99bea1e4e2231398d072b31
MD5 SHA1 SHA512

Submit Download

dd_arrow_small2x.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small2x.png
Size 385B
SHA256 22c6d0d11bd3a540c410a73c3f2bb2dfed4f63e43403f34b4c4689a0e1cb14ec
MD5 97bcf19fc5aaa892ae66789a7b3b1a77
SHA1 034c3507ee6c9ff4587484d4abca2f2985124afc
SHA512 d212ea442cac34cb96e712d1daf79880a8040774e2a11f88751c97e5f33711dc32daff5a090e9960725ead6f1b41b9c6252d8216e5c3f2f0fdd688ad90fa7024
MD5 SHA1 SHA512

Submit Download

illustrations.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\illustrations.png
Size 4KB
SHA256 1a1116d8c79328f776a5ae8c8f31ba92e46ab0b614c533912d1302f0f3416244
MD5 40e0e8033f50dba27d2b38182043ae8f
SHA1 5e9b6836a00e0aade3fa89ca20dc2febbd76fc95
SHA512 4031e8201644674b042ebce15dfce30407f48c961328662b99c1b74f75afc35f7a6e92a0a272c634243ea6fa51850a51a7b6da0e9e8be9faedb3b265a8bfbf39
SSDEEP 96:OzKxBKpDTaFxXBUykypQvECg92RE4qnlMqngh+OPa9SV2:OzKxa/6xXCypSg92RalFD4cSY
MD5 SHA1 SHA512 SSDEEP

Submit Download

nub.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\nub.png
Size 1003B
SHA256 9befb363e22d7fc234c446f00c3a0cad05990f43e2918272c4130f0d0af2fe86
MD5 cc758ec02fc21340e24667399c67412e
SHA1 c6017d8f811a88e4bef5ba67e70dcb9fcebed499
SHA512 94a9dd82f21fb2de2073c5cc01ffb27461ad019de704eda61802e1cffa2aed5b31c562160b969b63873ecea2414e595006b819c91636c99bcb54702eb21396bc
MD5 SHA1 SHA512

Submit Download

share_icons.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons.png
Size 1KB
SHA256 1d49f74f20e9ad11a0d2c51d519e8cdf19d5ecf61cde42116c0bd51d3c51b75f
MD5 0b2ea6483c1f1c7511401a188de49a51
SHA1 21ddb46e5be61ef251d622220605ff07c5cf7277
SHA512 8ab2232c927224ec8ce8cb007609a567a915aac66d92df7c61021051c2c2cc7ce3568c059bd765109ab4a5e2be972da88863efd73fad0105ce0068d2fc28ed98
MD5 SHA1 SHA512

Submit Download

share_icons2x.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons2x.png
Size 2KB
SHA256 64a6293d8edadfe062a2cf84e982260cf4ca8678de805748aa41faea66e2e0aa
MD5 e57a23cf69d7f43d2bbdac6f2fea50dc
SHA1 31437ccb6d31e2651d7b084de26e85e7e67e2b1c
SHA512 a5884c88730f8fd4aa02b47f7bb43b526c2bfc77ffc5bb699a34601040ab7023f81fe702948ce3420cf31abb86f50af84780dffa318080503ed2cb7cf2759707
MD5 SHA1 SHA512

Submit Download

adc_logo.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adc_logo.png
Size 3KB
SHA256 341ae7ee3386a991597bf05422bcba9ab6a69c53ce447eacc51bed115dc929a5
MD5 71546893e1d39114c5dff9b181a62773
SHA1 e01d07dbf1e9a31351e3d8bdfe44c9ae3ff38933
SHA512 2decbb5d82492e8279393a0f39ebb0eda1a8c8433c1433e35b1953ac6ec4c767c1d43b9f59356e4184a581f32ca84397a7e9ffab14a70a72229b6851424810d1
MD5 SHA1 SHA512

Submit Download

adobe_spinner.gif

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adobe_spinner.gif
Size 556B
SHA256 a317dced0c56d2c94ee5f2215d76dfa05e399175148ab72a8232dd066a375ce1
MD5 b2f3255d1ed70a7164cbfe5dde888be3
SHA1 b498175ce7ac6f27d2d9ed62c9ec46e471942c2b
SHA512 e8d60563b5865515d8fdc4b1702adac51d1387d8b790b2afe14b26df2e2d937f399ddbb3d0e800176a52d4fa9bdbdc1d1fb5278662d5cca8e74d65f21ffb1ee8
MD5 SHA1 SHA512

Submit Download

logo_retina.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\logo_retina.png
Size 6KB
SHA256 39fbe02858f4b9d356c56ef03067166c9c39dc5e854bc991c58bac4bdcb88382
MD5 2398bf770e9068aa171128e245bc8c72
SHA1 b3711e8c58be70bd1d1ff5c1746aaf322059485d
SHA512 c7595fa1956f4fe9874cd102c57c65488c142ea11f015cac225f18deef96dc74981ddd574721e3b780a99145c54b8c0f80128c1f211620ff9ba4e252526d73b9
SSDEEP 192:u7W64OnF/19AbN2MSo0jB6BfI+Mt+bK6IH/L:u664od9oNBr0IBfjIj
MD5 SHA1 SHA512 SSDEEP

Submit Download

sat_logo.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo.png
Size 826B
SHA256 06bd469a34e90736252ebfd39dfa6633a890c2aae24222ed98f564128803337e
MD5 40493289f5ddd4d2711be147a2dc364c
SHA1 a89efd570502c87c24d49f91404ea5fdd02a578d
SHA512 817ac1cecec326d7b372f85fb90ff071c630d4a6d4ccd28a7d65d5123287af2617066fd6346fe6effd3fe977d1ac21174b57f81f353c9cc309ee408779af1042
MD5 SHA1 SHA512

Submit Download

sat_logo_2x.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo_2x.png
Size 1KB
SHA256 428efef442fd5bc7b17e87fa259842cb1359dd72a7fbc68fbd3b7916fb7bbd5c
MD5 77902dba31964ecf667c70a7c7cf5ce2
SHA1 85e3a9365d2698a93c226fa17d4741394c69e4fc
SHA512 d5a6bc296e07476c66539f349718539be3f1358c0bfdcb95885cfa7dab6028e34b3465f71d0a94a0b12ead0235d2cc8dda566ee6479c6fd6ea6f40bab7ff870a
MD5 SHA1 SHA512

Submit Download

DisplayLanguageNames.en_GB_EURO.txt

Path C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB_EURO.txt
Size 32KB
SHA256 0c81a1daf777c4ad0b1e1ecc9a1a76981baa57d60e33aefc26bd7ff6a2e0eeed
MD5 7cbd863912ba57c9a1e21204bd14d2fe
SHA1 7aa39635a822194ba3580abaac0c78fa5b4e166a
SHA512 954514301d72845c62904ab03f35574dab6ba72f24d376caf907b66f97f626458f7df8e74dde36f6c9fae951e39ec53013da0fe01ac666dc1b2fd945195d39e5
SSDEEP 384:0VDe/LL2XeGftpE6vxFjhCFrQzpQkgoIJQPg2FAt/Mv1Frlt4bA:05EqXeGftpq9NoKQIUAhM9FrltP
MD5 SHA1 SHA512 SSDEEP

Submit Download

ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt

Path C:\Program Files\7-Zip\Lang\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt
Size 282B
SHA256 2ff127d5bc4c7333c8f522aa4b456684eca97c06d452bf7d00b6a99b49b11b0e
MD5 69a98ef655778f1cb3764a923acbae80
SHA1 22683321e95c9a631039d15fc49ac5d3e639ac54
SHA512 610fc09f40124e1a74ff303ddd95ad5809679be9e0c381e5d367ecf8e1e137c3da188142de7a2c5fe2b1225e12482245f2b5c417d43d73618108bfb1c32a5ed2
MD5 SHA1 SHA512

Submit Download

win32_MoveNoDrop32x32.gif

Path C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif
Size 153B
SHA256 6ee7f0752f66ddab52ea7a747dabebba5200bfcb614f89c7aa6e238c9ff1632f
MD5 0341912209d84b4389154bafe67762fa
SHA1 875d6665fd9e945c2d29ccb185ad7d565de1e7ea
SHA512 883eb411d91a1369b7e6f26273b28601264aa6839470103a7eb35613317a172da4dac85d7d2310e619426bcb428a5da8e8832a162319b6a115c30489c0dc62eb
MD5 SHA1 SHA512

Submit Download

THIRDPARTYLICENSEREADME-JAVAFX.txt

Path C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt
Size 190B
SHA256 d139a633044be84f5f0e126b6717e91615825d7b7bbdb67fe4f855509cccf6fc
MD5 4a43c6e7eaa35d7035721ee031c35ec6
SHA1 57565def31979fa30fd0396f7fb3edac4ccc9583
SHA512 01305a69e9b9d3d755e66ca9192c86d966055b64fa2249c86f3a7cbf63175178fdf15d20b3e363af5a18113b1fb380eef7906475f8c46bb1ae2f3d6df3e889b1
MD5 SHA1 SHA512

Submit Download

THIRDPARTYLICENSEREADME.txt

Path C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt
Size 190B
SHA256 01fa86fac524d8471fcc71142c74847306f48f86816006ff6a8a8052a6ca0e18
MD5 bf156af43cb4eef3de7dd47068e487ca
SHA1 ed06c3fe93452a0fa270223483637c306a61af5e
SHA512 9aeed4e3ed6423fb659f3961e5b6b4f82b0f2f09bb1577acb5012717ee31039b6d36f600e5a79093cda60f9dc3641d368ba0610f6c57f779c80eba1918dcc497
MD5 SHA1 SHA512

Submit Download

directshow.md

Path C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md
Size 1KB
SHA256 bc6c455d95c2af0051abf7b13e96d68d9fa60e0a76fcb67e7dc248c0f7e52d8d
MD5 13a9a345dc0bbce042281ac688a588d4
SHA1 92f64d7e13481b1fc6d635f1c2e7cd69ac6ca6ba
SHA512 2148c83c1baa4989a71c640ececfcaf2491ca572a1535efcf0bc751fc3f086cde446e1cc92a8f6e0d31dbd5b096740f1a50b9dded0e42a1282a6e762ad431027
MD5 SHA1 SHA512

Submit Download

glib.md

Path C:\Program Files\Java\jre-1.8\legal\javafx\glib.md
Size 31KB
SHA256 1e2b73a3e54e48e2d907de4ded7c8cf15261b391ad6d12a9be3a22b719c61731
MD5 3fba11527e6ed745f2b0c022ec1acb16
SHA1 3649708b4c03aa1b17baed96860f233d888c1e2e
SHA512 1ff83eb2f4cacbfcdb1c8f4e153e4ad3beab7276134d0dd0b70b8f5e47502c3b08da990db64efd8bd7f31f8ed4f69866aa3c988cd802d44b6553e12bfdb50142
SSDEEP 768:iEs7laxQQa7xtshH65W4xSQx+2UQb+uabW+6eMDRm+R:iEs7loQJ+GWl/HZWZeSmW
MD5 SHA1 SHA512 SSDEEP

Submit Download

gstreamer.md

Path C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md
Size 34KB
SHA256 c2000fdad0bdc720de249dcf2f9943146ef17a394f60a13f891d63af8f26dfd4
MD5 92ee532a8fa5d4a368d2c6702d943cd3
SHA1 e05162dfadcab0d0f8a0cf31bc66f5e420a1823f
SHA512 77775660a18811d58af6442d8f4054ea05bcfc05a98523e44db5193b42df2af84d2524a1d0f64d8dcf9c33468348f45d3512ab3cd8ab40bbf6f1908f41310561
SSDEEP 768:4Zq6axQQa7xtshH65W4xSQx+2UQb+uabW+6eMDRmxhj:4foQJ+GWl/HZWZeSmxhj
MD5 SHA1 SHA512 SSDEEP

Submit Download

icu_web.md

Path C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md
Size 23KB
SHA256 cb19e30beb4ac0dff28ca96162988ae6e5ea97008aedd28b1586ad1e254b3b7e
MD5 3ffcc18e805a2e97fba39d830f7f39b8
SHA1 c4dc47740c20b784fe52253ab63f052eb6d1e0cd
SHA512 96cc0bade096bd041e0798c09cb9b4adcacb099b42249e1a1312cfe06c25f5b5c045a59b1f874c1c245f1acc1efd99c51b4137ba93391f8c04ac835fecb9fab3
SSDEEP 384:3b2VyCo90swyK6CpVUO2EvF9NO2EA4kxSyZKTjwZ1O9n6UMA6yCABY+EiWB46Sa9:3bAFtyBiVvPv3APNkYys0ZU69DwYlFNT
MD5 SHA1 SHA512 SSDEEP

Submit Download

jpeg_fx.md

Path C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md
Size 2KB
SHA256 f07b79dfc94cde51f8480ed5f7f548b434379e9498019c7cf4097ad9ac296b33
MD5 7d31ea278f843d36d3783cc06d5440dc
SHA1 b74644271e498c6960366b6fef3e6d666de32a09
SHA512 4830731faf5768c9e86c8cab5f8ba0efea38d99aa89c986578f6301ebd1be7db7ce38334d567e5700e531dcc3db3e1424fc37b8c5437684120f3ced1d290e363
MD5 SHA1 SHA512

Submit Download

libffi.md

Path C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md
Size 1KB
SHA256 6b5dcddb46ba4d9c01ece1b5c1d0c931a4e0c96912728aa2dedff2fd894adbda
MD5 0b03adb065aef9ab7c5e4fc2db147d7b
SHA1 9b2a617b342d0586d4e58d90cac4f7762cd785fc
SHA512 bd58f408ac04c1b6f98397bc4d6ee279dc9baa4b3e12db7d71e5feb2c1084d779ea897e01d3a8a22626a55aa262c909969916710e3ed60a3622627015a1c38e6
MD5 SHA1 SHA512

Submit Download

libxml2.md

Path C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md
Size 3KB
SHA256 3107fd53084411a65625cfa611e7f02aed147bfaede00baab819ebf1b23d5e0b
MD5 40c1a7cb2985a37514ecd2cbe3daf949
SHA1 37f7022e89feb55cdd1952debc34fcd8a4325e10
SHA512 e71bf907678e4af4cd05ca524736f2b42d85e60fcea172f63d0490e9e1652d84dbd20e1fadef28a0489030fda0d196b4d46bb55c03aa0b5d40694bc833bc0c66
MD5 SHA1 SHA512

Submit Download

libxslt.md

Path C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md
Size 2KB
SHA256 f50cc04b58f0ac3b338d104059c5e4791b0c925c161fe70d5cb9fbcdae2ffb34
MD5 ed647bec69d11463eb9bcb876141e91a
SHA1 102313e254c42099f9ce1f53f1518ae888ebec07
SHA512 6f7b30518b7147870d522bcc7ebe9c926d7447121aa9637da4a52fa934574baf00e222caecbce7a0907e0f5094525b016fb824784e93b836a541b7c248e6847c
MD5 SHA1 SHA512

Submit Download

mesa3d.md

Path C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md
Size 5KB
SHA256 ad9d0da72db38101da572b7132304e29e1412780375f7d0086131a9b545856c2
MD5 7234c02e6d93e7abbf1525b0de1a5ece
SHA1 ff5d520f6bdad9f1118534d202ef5c6f694a8834
SHA512 34c2a73aaecf379de97bd8f9220ed9e8e693cdea28a16d2f7c2d1799db77d9c7efe0b4ddd484594943b911ea9c98fd6c92faf2246b5db22cf40a5e706913fbff
SSDEEP 96:63wE0PttNMqwAeX70zH2+MDr38GPch0dM/ED8OJTGw8UXOPkDfzAQP1pVWO:6AEiAX70T2+Mn3XZdWFwpxDzXJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

public_suffix.md

Path C:\Program Files\Java\jre-1.8\legal\javafx\public_suffix.md
Size 17KB
SHA256 4f924d8e480f79ab020237a20a951e9c98ff75d190d3281f8c2f5a4444fb92aa
MD5 c937283d4ef58540fe2c642c90416a71
SHA1 487e2a32c2c41a99d0a3e571fa0a3223928ecbb1
SHA512 10acc5145cb9518ec519eddb28f9c3e31ce547d63a741813efe21678788b2668c2139bb2212a24dd0c450e7e75517c4a172f8bca4f2a91cfafb4cf1e7bccf784
SSDEEP 384:iS6E8tP2Darf+3aZYhuAlrLx3jetw3cqOQgaNowvZfKK:QEdDK+qZDA5BjeC4Qg4owxr
MD5 SHA1 SHA512 SSDEEP

Submit Download

webkit.md

Path C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md
Size 320KB
SHA256 939378e18b4c419b86ccd7f90d1f8d26f57b509facfadbbee2faf6b5ffb77499
MD5 21aa0a7506308402ad3018b6c5f02889
SHA1 e099ba8efb95bcc85441d6bedd5afc685d36d049
SHA512 702ce56f4b9a60a497adf3ac348fd062a9ae77d11d0366d9cfae3f939da64fd7a81d983682ce7347e497dd7736582a601f70aae7f56748f89597b4ef7ab28804
SSDEEP 3072:pGyJ3iXGYKCUciWXKITa5z1A4gtcKpsmN/5pYhVghvvHHOwHGpwBHb+w5uGs4++R:pHiGYS9Qwz9e/5nhoe
MD5 SHA1 SHA512 SSDEEP

Submit Download

asm.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\asm.md
Size 1KB
SHA256 b255263d2702ebbb980b388480611648aef8ffd94cc4be3f97473f4fd23129a2
MD5 fbf6678caaeddb6feb95821508d9aa93
SHA1 33cb292905588f5b0e7152fd036a91d688ed2712
SHA512 c82b5cf2803c2eeafb82b5cf60ca869aa099cdde13dfe20fe2386db4086b77a677a41a4fe5f47c0fa660062c45cf7a499f76c4f20ed4fee885f88d751f84ee93
MD5 SHA1 SHA512

Submit Download

bcel.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md
Size 10KB
SHA256 e3292919a8100b6a47247134c0443f06569257d84e6f686321f67f9e993a80e6
MD5 3b04e1a773ad880dbe28aa46ad3860b8
SHA1 6dac5078a2e27cd666c362bca8739feb1e563420
SHA512 d9a0ba22fcac433a97375d1099cdb4039ceab3893f7ee3fe01843909a6e69e87e7166bbddf1e579662612420b1be5035b9dcae1c41e01befc2e2b04e493dc34b
SSDEEP 192:eC+g0Q+FibxZjrnruLTRRwqTTwlBHEZpFmjjOgVfqV2V3NMRi08fE82dbWJgyrQC:ZR+gZjrSvwuklBHEZp6OgrzAixs82dbw
MD5 SHA1 SHA512 SSDEEP

Submit Download

cldr.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md
Size 3KB
SHA256 977d411cbf11b54c24bfd9a27dd58577c6ed0a0bfee03c9a74bfa396e2cb841a
MD5 1928c06f80e35139b4d84074bec54646
SHA1 5a6c9eaeb72c449810de17874713f1ae35dc4558
SHA512 382fed6c4e60bb7bd35decd3443b60970dc4ea3a04dd0dd2e9703e98f278dfde60bc2abe4d68911b0e5368a4708f3ee448f5d1f96536bdfcda4674c9fd3ff39f
MD5 SHA1 SHA512

Submit Download

colorimaging.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md
Size 162B
SHA256 9c15bd8c71fe8fc5e3e874c67889db5e7828388bd977d668e218178be2935760
MD5 5693988b1cf24cb1d0f765cf39fed3f4
SHA1 0cbb968eaef54d61560e0c1aab6f7f3f64863eb4
SHA512 49e10e04c0aa0afec36a47116f9c78f641a2fbfd558fb3860c8108942a8a3445a73a826da7cf02eef3378ec53feffbc306f241017f401953e1e646b5d34f92ef
MD5 SHA1 SHA512

Submit Download

cryptix.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md
Size 1KB
SHA256 02458d36ea78832284a03cd620e94c59b7403a2964aa8f65bc160bf6cd74b25b
MD5 43f938e9278b6042f88a73a240444a7a
SHA1 326deb18bd286077e26c425939ae0c8e8d5c4234
SHA512 2a4946e0e3eb8f4397aaa693567829124f7b2d5c17491aa14587b249c01b984459594348f20fd5292ea9ca5cd615de69675f82b4651712caa1c1eb9dda7097af
MD5 SHA1 SHA512

Submit Download

dom.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\dom.md
Size 3KB
SHA256 a51bfe674839178b5db6f3b00f8bc29675cdfa1f0715b321627fcad02f0b7998
MD5 9277693a5a19941a3fa7b48047c875cd
SHA1 b0a8164ffe9f684cb1a829162deb193b9dd981a7
SHA512 fd4d5232ded6dd4374ef43e8514de45bcaf9439af39c4a1cf9e65746d837571e80512c8896838d7f4379d982e550dcf4f1174b78d790f323653fc51288af2039
MD5 SHA1 SHA512

Submit Download

dynalink.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md
Size 1KB
SHA256 7162975dfff95e8a9ba01b40d22d1324144129d7bee9d6d0cefc775fec9aceae
MD5 699924d19550d97ab6878818d66397b7
SHA1 6616dc714cbd3a401d841c552bfe62312e72c659
SHA512 f1eadf0ce73a5d639c2b64d266f616d18bc4d08e1a9cfcdd409b90fdb85cda22f47ff667ebd24a0c54b053115b4bb3de04d10962a8fab837892e9b3e8df6c6a9
MD5 SHA1 SHA512

Submit Download

ecc.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md
Size 28KB
SHA256 1b556f15186ed32399d387c79ff69033e49360b3761ae4d4c1de1b15c732e263
MD5 99f607602c90e8208d25221b95b3c879
SHA1 12081b345e3d905d26d5ec4b7ce63a84049b1acd
SHA512 d2ffbfa1a22ec832e52bb1b6a4554b59e70a1a697ddba1925fbedff89943780e02db1f7b2210c8e4b2e4c0d02fae4df161cefd25184678ed6fa11642c52875b3
SSDEEP 768:k7CiF9Gr9/fUlaFJvZfZdeNM1bDSwMpa/Zi+QBB5zN:Ed9Gr5UwhZHB1bey/Zi+ezN
MD5 SHA1 SHA512 SSDEEP

Submit Download

freebxml.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md
Size 2KB
SHA256 e59de469e18059755b2414ec79daba9e419cc19dd10611dbfe286ad16a40ab02
MD5 f3910d822391c99aac1756c17da1741b
SHA1 2f3daad897747bc00f0c64a51080420f7f0a6f79
SHA512 9b0ea6f2274c1063d2573bcc54a4d6a4f9d8300f9a5de52c841e2b4eeafa992d2043f46a159c361e5bd5f9209fc6d16bfa49b92405007528820a51d6d41d4819
MD5 SHA1 SHA512

Submit Download

giflib.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md
Size 1KB
SHA256 9a0e9ed892321cb85e69a77fff519bb038ad392cfd1c2487d2bd40d2f2811b4b
MD5 976569bd223d5a2e68d366ded479398b
SHA1 1f8424297e00ab2e42bbe37fbaddaf365084abbc
SHA512 f44dd826882b57c04a86c2e6320049798c3d2c9b854f604711364b212e5ef8a0629a737ebfcb76e28010af39bf9b79c86e9a0435600abfd6a9eab40e6e2fd93a
MD5 SHA1 SHA512

Submit Download

icu.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\icu.md
Size 2KB
SHA256 c705b70726a48031f8b293bd92afedc1f1bbb582804df090cf766103323021ba
MD5 ddd740da21de47ae72a19c9e83f3848a
SHA1 49fbd820ec268358c19ee0516d9a651a731eec98
SHA512 0cdeee8e7917c1cb0c0fcac948dd4063f814d189cd9c7cb30ed69c4d43f86b7fdfb7cd6962505ddf2c6ddc3811375a7079155fca469b534ad8d006c6141f34ee
MD5 SHA1 SHA512

Submit Download

jcup.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md
Size 1KB
SHA256 612fc79733a5661aa87571ed6b660c1b1bbfd8f1ed35b5ca3524a50188a8729a
MD5 ef86c4b8f28cd85ec558062ae284fb56
SHA1 b24d4f65d7e0e283a4b7d5961fde7b601bba3923
SHA512 d142d72c43b19d4352455df691af1555b158d4efda770819703a953c4e642d76ab55e86d524fb307e64690f62bc758031ee9cb289482c6f4871e307f0b2d2c06
MD5 SHA1 SHA512

Submit Download

joni.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\joni.md
Size 1KB
SHA256 486c9f14985aa88490b70c45f404734d31f57eeb203633af32e46cdaba033ffb
MD5 3bdf6e19d8bcb0cf8b5e3f170a19e179
SHA1 dd9d744e885679984a029b2a6d8bc8f94d5f5f04
SHA512 26decd0c1b132e3f09bb8f91400e0c0b31026d091fd625771824dab4dfec7e2dd599584dc3e787e038457ee0f49eb1ad80c935ba2a585e7e335365a17692330d
MD5 SHA1 SHA512

Submit Download

jopt-simple.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md
Size 1KB
SHA256 7727b43ec86644a90527392ddcd2495689ad360465c541ef274077e11ba45ff9
MD5 cafd22d36e7c8628cfd5aa04efe34ef9
SHA1 9571d2937559d99dae728492a061f03046167cc8
SHA512 f7b18e94a29acd29470caa4319ae8394db7ab438cd6d8c14b14d5292bd98f9b127b536231906c694fb44c1662d32330fcd2e1bb69b8c006d9ab01222b8cb38d1
MD5 SHA1 SHA512

Submit Download

jpeg.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md
Size 3KB
SHA256 3268bb0873ee54a0a7fe08763988ec692de0db33ce46bd928b27314d0a9ffe2f
MD5 0623299ddc0fbb5268f17939bd6b41a3
SHA1 1f2ac53e7fe12fd4e0b394ad5688d1d282b631ea
SHA512 99c02612c0597b4bc876fdf9a797ac82f6a4fe9a582c456339a353b158af8f3705cf941b02c06a334af48c01412d58e27558989b73207f62363db7c9b1369a34
MD5 SHA1 SHA512

Submit Download

lcms.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md
Size 2KB
SHA256 bde5c2eb4c17ab7f31e179e63024d2506c62381e62dfd90e2f9b2649450172d8
MD5 6e71447ff2e5806cc62a41a06ce33aca
SHA1 72ed83e88cc7c3cece24bf3521e268000a360e53
SHA512 532f81d83b888532ce4f1def8721336dcefff662d2cf9c485ff6addcfc3272f2f1e4ad7fb65e95e3d19d9dc34fec31f42383d980a4629bb2277da53e15e4730f
MD5 SHA1 SHA512

Submit Download

libpng.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\libpng.md
Size 6KB
SHA256 5765e90cd24ffb0f3956a5988ce234f142f33eb4e33d254d9cd7b90ec214d8ad
MD5 7437c05a1725b43b5598602e16fc2e38
SHA1 b3b694748d53862f3294461bb199359d7a8a7894
SHA512 036adc8a54b4fa8a3035dbab1ca27591c6040009f459d3e2ad045530c69a12c5a4e6bcbef60159f224cd5066fb184209254d579db706a29cc8b78e8a3e020e07
SSDEEP 192:OxlqnpPFIFtMc1km9NGNTOQuLkAPBmKls:OjqnptIFtd1J2xZIkames
MD5 SHA1 SHA512 SSDEEP

Submit Download

mesa3d.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md
Size 5KB
SHA256 59bbb5760bfbee046675b044885566ba02f451e4b06c958ac72fd747013c4bfa
MD5 65f3b20e77ba3bca2946f35956eb6789
SHA1 1dc6dd6cf905b36a817689aaa823682955adca4a
SHA512 558e374855c2d82275aacf9f5fd8686469c0b7dc2ad35a4de049fc0e92ebdc862582f5e1440b5890654dfcb48c3dea3d8f881e76809fcbf7ef460b9cc63f171c
SSDEEP 96:6mwE0PttNMqwAeX70zH2+MDr38GPch0dM/ED8OJTGw8UXOPkDfzAQP1pVWO:6vEiAX70T2+Mn3XZdWFwpxDzXJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

pkcs11cryptotoken.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md
Size 3KB
SHA256 52f5bfef30d1ae28994ab00048e5bb76851294ed60c516c29115b564b5c265c0
MD5 7cb8f0d2499effbd9f63614abf0dfe28
SHA1 6a76611fa3ba1dcf463921c0d1556eeaaa1b756f
SHA512 bff901e7c965e271b6f86c258075cd88189e4778ccffe1658b78c93e1bfe8e108bd8a1e4834aae8343592c100ac36c52669159df040d66a65a7fdd6858222b20
MD5 SHA1 SHA512

Submit Download

pkcs11wrapper.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md
Size 2KB
SHA256 afe0ac75191ac087f9f392490a89dfeca12eac21dda79710f83c7c129592e8f3
MD5 102f16475daafb214482ec3a7fb15791
SHA1 7a6a9381034f0c56173265c1f7f6ed565e919bed
SHA512 f69ee57966a05929d06d19dc07bff41d7d9b57e0246e33b6251655d4cd287cecfc2e56b49df21f5a5c73f2785e6b7daac54e81fc18579f1e83711f243e8f5a51
MD5 SHA1 SHA512

Submit Download

relaxngcc.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md
Size 2KB
SHA256 8cd6b76e89725a370684b21f3fc59bd241160a1ffb219ce995a3443cdfc95605
MD5 01b347872c90512939d851b22002684f
SHA1 d290cbae0b0d381998622407693bfec052389d25
SHA512 e25cd555e5eb114d755deb38496947abe2c7872899a681a776ef9c9dfc2618abb6d051f7759d8ad511b1e7c70bb58a9e9c24850ce7bfe59091b3b73a11d2efd3
MD5 SHA1 SHA512

Submit Download

relaxngdatatype.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md
Size 1KB
SHA256 714ede395aeb0138533bd791c5f3bf556cf1dbafc1afb1e8ff598ad813489f80
MD5 007909cabbf57304656f021fcc2a606f
SHA1 fbf1a7bb59a56d357c8ffea22910a93f035f33cd
SHA512 39fc9e0647bf2966d9cc4c61598b84e006a9c2b56ac257b1fc4c32aae189517c348ffe0cb3b0aeda8d6d9300b80d6f9a4026f6d75fa87e5139a015703eb8ebe1
MD5 SHA1 SHA512

Submit Download

relaxngom.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md
Size 1KB
SHA256 f8160ed632f0d049103bbc758207ee81076fc9383e04a7e2f17e3a51b9780823
MD5 74b618dc94a6a7c065d229c30264916c
SHA1 496fa4cc4ba6ad6e31a6274265f2bbbce5b12241
SHA512 316906b5e4ffacf03a6d42171aeeee5e1961ab055d1bfd308d6801faa95deeaf596b70e7d55efae85e86caa1d5b59ea3659a71e6f8e117a639ecdfb343558211
MD5 SHA1 SHA512

Submit Download

santuario.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md
Size 11KB
SHA256 9c75cfc3dedae626dade66475701036df90098c465feb8ebc6dc3bff733d9dbc
MD5 ae8ac7ce2e8197f09250751a8632fd71
SHA1 7db53ed4b5bd41f91f9f566008fa5b0540c124c7
SHA512 e5c13d954f06dc40e07ca5a80c0991a7977091a4af8abcf66bb64e74a8af6c4bfbaa14b432f4ba9c813a52d71f58a559258e72a85af4fa3743fbf82b84dc6783
SSDEEP 192:waF8wMQ00HqNndMXUjJBsgAsDFBjU9bkGoRurzpidwPVHahi3DZaFeblhD3jnT09:waiBl0HqNpnsgdDFBy4Rur1c9YTswx5A
MD5 SHA1 SHA512 SSDEEP

Submit Download

thaidict.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md
Size 1KB
SHA256 6f5e9cb7889342f348987cf4e6965f4089983197e7c7aeb6907853cc2eb650f8
MD5 c475a6fe35b33d5a4939649f32962d0a
SHA1 0212e49c933980e7accab9cdc563853e2cb7b9fd
SHA512 6943cc69110a72a62abfe308f23387706367b8b4c4ef768aecb09193b9e1d2a3157e20f579a97e00fc96277cc58cb507ff9d3aa9188f138e57861faca2a7fa99
MD5 SHA1 SHA512

Submit Download

unicode.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md
Size 2KB
SHA256 28d61eb108b732c187dfa24822858e1f27d5d6e59f072d3a6c6c29d9679ff172
MD5 0d06b7a0dd7e2084a7eeb0a690c43f79
SHA1 ce5f43108f01f1f1ad63e0ba6193054204466fb7
SHA512 a8805d07118e18302e7da80a30e9642ae3ce5f038bf339630715fc78537cc25aab1de13392921e0051b54444ba24a3c175a1edf0fff680686fe6ec6cf931d123
MD5 SHA1 SHA512

Submit Download

xalan.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md
Size 11KB
SHA256 7217e6a403ee96dfcaf334037678b94927071459680ef42047e9049359684baa
MD5 5c8ac5e225eac489d3b8195e741aa2e9
SHA1 0e1eb1592d0823130268c1b811004f50d85cb05d
SHA512 5b048cd0f1e5f4792beea10dc761ff8ff8cd7f32fafcbaad8957665d5328a0dec4561a80a7a593ce4b1af0b02dedcd41a2d6824988650da3d503cb625f0bad06
SSDEEP 192:QAySIeqHTzVMd3xI5n06gLRlog8P8lei+Cl7vlmB8Oolr5GGsn:QAyjfVah6gLRjoI3mNolhsn
MD5 SHA1 SHA512 SSDEEP

Submit Download

xerces.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md
Size 11KB
SHA256 93b2beb49dcdb3e0b5415312eef11f38cd2d5aed18cd11ad94f37f39ec123008
MD5 5cc8d30336eb6bb3e90746d695e1d85f
SHA1 ceb136403f35e595602b43ca1de1def9342b1228
SHA512 19e6db6e3babb561e4628709d513c55c43c004e2c6c35f0131803389d34ad35cc19fc91a8eb3bbbb12d0cf95c4b4f9ba0e4754a1fd15df8afb8a1db9686a4651
SSDEEP 192:xBxx3qeaAuwLj9GyGIe3TjrNCsG/cyyDH4ZIru6bgdnq17FvfhlAhE/SW799Jtyo:xV3qVwv0EiNCF0/HMI3bgdq17FBEWR9l
MD5 SHA1 SHA512 SSDEEP

Submit Download

xmlresolver.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md
Size 11KB
SHA256 64bf93caa0bc6350c7628f9cc847a9aace93256d849b918cf673dfe240d37a76
MD5 7d10bdd9cbe3371f626dd6871414a7e4
SHA1 11817ebf9ffd1465801ae07a6f376223c8949b0e
SHA512 a8dc9b78c0ff12eea96e7ac6b5e777c22d14dd115ed7e478f48d6343dde57e39465c2c19a62c647f2691e8b37e20626612a0b604338061e1c13b4d4bb9b37092
SSDEEP 192:ZO5JSIeqHTzVMd3xI5n06gLRlog8P8lei+Cl7vlmB8Oolr5GGsv:ZoJjfVah6gLRjoI3mNolhsv
MD5 SHA1 SHA512 SSDEEP

Submit Download

zlib.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md
Size 1011B
SHA256 80a56ff10fcd46964dff4d22a6c8359fcf171b2a029fcaa37a7ba65762f900b7
MD5 99b8c696c638cf1828df6102797af2da
SHA1 4ea11adfdbe36a4ebe5a2fae6059decb2f26eab7
SHA512 ec1ab38d9472a1c3e2c8a70578a01b2349ac9df118f71944f1633166972832841f42f90466bf75fcf62ef47988ec5b1c5ee784de6258ffc9d4aac3623b8fe4a6
MD5 SHA1 SHA512

Submit Download

ClientSub2019_eula.txt

Path C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt
Size 42B
SHA256 85e80c9bd0223fce7201f873f04b14f50e2e5cdf1de01b4f75008c938225bd04
MD5 b3f1093b5fef377320cf49e397434b1b
SHA1 5a6e377c4f90c1550b1e7a1d7e901b8627a538f4
SHA512 5132b00326f95cbb9c5f9ec363eb2c9f1a4c801cb4892dc9b64367010d5c3a9611ea6b49c8e0350b5bcbf856c8a83f54e6ac881d5fb0bb9e0b050aa824675eac
MD5 SHA1 SHA512

Submit Download

AppCache133727656226049089.txt

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727656226049089.txt
Size 77KB
SHA256 3ca3b592e044af7fe92157c21fccaa7af446a7faf269dae3b6bae679efff58f1
MD5 b28e27602d9ac52295c132a968b4e968
SHA1 a6b189c68f56a2a92c55f7c8eeb942ece66f22d5
SHA512 9545f2abafe3517cb97fe6dd67dfa4c529b300c15b7343c462bed66f7e0a2417a47dc7a2677d2a575086d752e0af869865610ef4adbf84bfb8ffa735313e13c2
SSDEEP 1536:PKmGmlRRz/3a5udj0ze3GJkU9BGv1sRncGSzY:fBggvwuY
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppCache133727656623420834.txt

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727656623420834.txt
Size 47KB
SHA256 762afd3574e13ee224d995c589d3733d328c81a830c14403d9e042fddd6624ad
MD5 5e75d762e0c96f9767aff9d9cb2dd47a
SHA1 19cb02da15d8e7522eb07002e8abeac8276a2199
SHA512 1324de1fd109d1a2a6d4402e09e84ecae1a29a45586442baecd2a6edd8e6f3d4d1613c1133c75ce79e5d8b3039cd682a4a353dc344cbfef72dddcceab62ec40d
SSDEEP 384:prcnwJEeQssYadNI1bVNXZbD3MW7H6r/ImhtlaxaTthKdFA37fQJwyFLikpgxjkE:RqtCn3b4VY5FOkpgkaEc4+6I
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppCache133727663536793873.txt

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727663536793873.txt
Size 63KB
SHA256 10620cca7db6b5b35455773e08b92374e43851f5970a75b9c6ef3eabf12b4d0e
MD5 883d453a5b76f00dbe9b401aecc36806
SHA1 a24fb807e1c3a51212248b7f09932e64bd02476e
SHA512 7a08b993ba0bae661e5d27818f42bdbe8929479d26cb666ffbc3c4e77bf6b5d7ba2b27260520f420d8719c325637a89af318426a8c9c1f038b5c7dbce558772a
SSDEEP 768:SHEMGXlzBuq1ANtmAQLDrLaXaGsN1sBejCKas:SHclzBuwANt7S3MZszB7
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppCache133727666235612999.txt

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727666235612999.txt
Size 74KB
SHA256 3c2af492f6dd08ba4391b7f5e8337239b6ca5346e6724c23fddddbafe9f5b9b3
MD5 01ea8306d94053413783c4c3a13c2710
SHA1 e086645aaad17104f1782506f2c0ea03d20fad55
SHA512 34839c10a520d6d0d7e22260d9e4df7ed82e0c05d942cd409a916adb82927e7c37a5a9b832b93987490858a086676f87ef2eed35e6daccf8191fc74614bbcdbc
SSDEEP 768:/L3qwqt0Ef+Zz+if7C8emb02+7PCAL57Eiz2NOAMAEiv:j3ot0XTC18m7x7e9MAb
MD5 SHA1 SHA512 SSDEEP

Submit Download

File Explorer.lnk

Path C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\File Explorer.lnk
Size 407B
SHA256 2b24f7a23f966b420a77952874202251bd1b4e54d3222187b8dbc1bef78ae7a7
MD5 0d7041f90f056af08b1a5b7bc747abff
SHA1 9ac06bbd349b20245e76319949c37cddb1732805
SHA512 aac369b397ebf9b5a09217b4b368876a4eab9855277cb639e59d3d43242c974664fb7dbe2951b28bfe4a8ef1e1a531430e94768cac6507cb47b6478e3bb82937
MD5 SHA1 SHA512

Submit Download

ASPdotNET_logo.jpg

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg
Size 21KB
SHA256 631f9668b71a1b982362cf2168873869f2276d2b5b2b86973d5f78e16b0c5b0d
MD5 a07a895e45bf0fdfc144f5b8c6c2b00d
SHA1 184deb60fbc9bb6f044d2bbf2e8c9ee9ac5a7bc7
SHA512 04ecdfe76f5d14dbcfddb7fa905bbae34fecea036c2c85784d406ea8eb95236de8223bce5a130f1cd6029a835e2faef3dbf2cbeff430dc40d20edea4c45147ae
SSDEEP 384:x6JmKzKxyUv03a3uAtCdgHDeCveAaHzR3ObOq31XyxkVTXRlTYR:x6JxKxY3a3uAOCGAaTwbOq3ZHXRlTYR
MD5 SHA1 SHA512 SSDEEP

Submit Download

HelpIcon_solid.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\HelpIcon_solid.gif
Size 1KB
SHA256 af82201ec334aa89a225bb2a90dc0b3cd3a9cdf6cd5af51648ad1815a66ba407
MD5 7e8f1448984706c10cdeac9786c388f9
SHA1 18b2a638290331b16fe77e8708c08b874643d182
SHA512 952f6a0270c930e753223d016e50743bf34c3987baa2dc460a044b8159f47efcb3817e0a41fc43d76afaeb0ec07da06adb3e42bac7c45e1a964aee7a337755db
MD5 SHA1 SHA512

Submit Download

alert_lrg.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\alert_lrg.gif
Size 952B
SHA256 231364c6e171bdd3409ad9f507e0bc0e82d685d8779d400816d8c988baa287d3
MD5 dce3b3bdbda0bd154c7a5ffa8b19ff9b
SHA1 5b572cf579bca6ed863c579abd38da2a6a15b9f7
SHA512 7101158b2ad3153f10726f70b232fba0220ce0b80f8c98009d9f6af724197c55c071409f2b6e57bb51d4a0a3e1f4cf8542650b12b102aeda7f80464c3fce56ce
MD5 SHA1 SHA512

Submit Download

aspx_file.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\aspx_file.gif
Size 121B
SHA256 b0735c50be905f6814188df60c992c9e01d31ca2b8d5b470aca0bab3c572c40f
MD5 a781b55cdd05eb48486612b9bd9f6f7b
SHA1 337815ac6fe1087c541b1bf8484b7fd7fb6f5772
SHA512 5c5f076702f87a06b3b539946e1532cdc5af2d46d20bc9785fede43ad40c158ec5dec777972349cfb3b224ac1d682bc397569b7a4b5f58825f507e21d629146c
MD5 SHA1 SHA512

Submit Download

branding_Full2.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\branding_Full2.gif
Size 1KB
SHA256 5b4b41b4528ccb4144177ca4badf33372419b8579e3efeff9a3aa7ee448e3d1e
MD5 e23010c686c684ecb2d63fbdc2c4ffb9
SHA1 3fd05cec4a37baea827d2ea501d4ddeec89f61db
SHA512 8543e46bb5be52f9d397440b5bcf9aedcb6e8e9b930efe6c9ea78fa2e9e02e68ad1496e5561fbe537c894a08e115823c108de014a5ab2681b11b8bddda997189
MD5 SHA1 SHA512

Submit Download

darkBlue_GRAD.jpg

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg
Size 8KB
SHA256 16970ecdac85642c9a03c6d184e9769dc4fdb2fbc453a6c31d89d6b527f34576
MD5 fc877f8afdf1fa650b3a39a0665328d2
SHA1 5f5b9342c649e59c3d98df3f7be1457f1d24a9c4
SHA512 2577bee18e3ac588c03f8bfdfcc6fc42eb213f40221203053b4117923db7ec42e8ee41304085ea20c6001111e966994e9545643b69d5992dabda1ea8d7aa33f2
SSDEEP 96:B7TAbbJI9PwkJB/9l4/0OZ+xPEEMj7Hg1YzflNlNlNlNlFme9:B7TybJwPC0OSPKPHam9
MD5 SHA1 SHA512 SSDEEP

Submit Download

deselectedTab_1x1.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\deselectedTab_1x1.gif
Size 61B
SHA256 4b00dc6a4e432d3b0b716813996cc408f789e701cf6d4290865d8ffc28388346
MD5 fcc3127c47793c568dc293af82c85e49
SHA1 bb5634ec00d546fd8f6bfc9e9e3389940b1f4109
SHA512 de04f286af2f82cf8e719f6d1a8e3f39fbb5198a9208586e217c38b07296e9278b0826ac2726f7d8168983f0034337888ee130d80e836df7f5461cdc550f95a2
MD5 SHA1 SHA512

Submit Download

folder.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\folder.gif
Size 914B
SHA256 439d6132be42451165c2ad7bff719153303b5608eedb483045ff27336f9ad69d
MD5 71acf686c80ce31be411b8e67aa6bea9
SHA1 b04f42f3eaab70e59cabc1fbf05b6a7d9060611a
SHA512 e3759fdb3725df169aac96ed0e0e1c90d68aee0f238bd3f7088c797802803029fafce75dd7901e0e1d0ae7cd62cecf009f6913263cfbc258aa1aced7e646e688
MD5 SHA1 SHA512

Submit Download

gradient_onBlue.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\gradient_onBlue.gif
Size 90B
SHA256 6cb147412e4390fa7a7e24deac25d232569a28445be0a6a54cbe72773263acab
MD5 3e2f2064298f7c511ad93c3025b15e9d
SHA1 b799be96aeb18ea59f6e6a19194b74098a3d6f25
SHA512 82fc0adaec88287765baa4b43814c43f01b1aa24a8673634c2847e47849e44481e132a0200e887eb5ca3242b1233ec86338984c51b6204bf26fa89ccc9b4452c
MD5 SHA1 SHA512

Submit Download

gradient_onWhite.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\gradient_onWhite.gif
Size 90B
SHA256 60ab6f32eee13787b32d359e9781104a90297c3bce9a3b921f716c5cca9fc8d2
MD5 1f1b9394efcb1cd877d5bd4ed63e9d2f
SHA1 c02109d3e832ffcca8ef59b8381ba5f531da0c3a
SHA512 84badc6225a540f2f191f32931794bd3d492995fd2e694467a28d16d43baa7667a99a1da2b5bbb3de3fd28ef64153513adcc32601383db6606603274427093e6
MD5 SHA1 SHA512

Submit Download

headerGRADIENT_Tall.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\headerGRADIENT_Tall.gif
Size 328B
SHA256 20cbee3c4b0ed49fcb52dda081c309c24d6d7dc51169e8e34a1f968f56a9ce1b
MD5 cf2966218168404de2ef45c2853eb907
SHA1 26e2dbc757c19e77e5a2c90fb7506c262ba4b473
SHA512 a9265763e1375cbd3861a8279b8a6c9b7dcb0ad4645c640ff5bff4b79e319c7a3fe6ebc26bed6e9622f9af2f97b1976f0286959eebe45134e904b8ea76937373
MD5 SHA1 SHA512

Submit Download

help.jpg

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\help.jpg
Size 1KB
SHA256 c58b5df5d73b6a25daa536cb8c1dd47847c429d4b2ec7bb623f9455a91d644ca
MD5 97f6b883b2aaba57470d2d6e13ec3814
SHA1 0c4baa27dbac329c08f4ce23b72170047e13f2a4
SHA512 6f077d71fc158d775b2ad91d3a04dacefc16091dbe5f8c96f913984578102ab47d6f3adeab88d36278e2b0fba16e746a856cdb2965ccce51742ba9cd23a17982
MD5 SHA1 SHA512

Submit Download

image1.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\image1.gif
Size 162B
SHA256 9bc3cce66af9bbe3b0f1b57f639f6d8eef2fc66f47167075b23c7c5212616c55
MD5 ff8301f63edf33faa04445bf406560b9
SHA1 79519dedead6dafdd4f2a2cfbd586963ee95aad7
SHA512 b4d92175c99d9050ee3d02e98c676ed8d355d6871a3f06719b3f2bab9f6a598b8e5053b0111e3c26cd2ebdb15a19730d3999a4f3a4604366094649416fd5a19c
MD5 SHA1 SHA512

Submit Download

image2.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\image2.gif
Size 586B
SHA256 8f67a31dc43b5000eb7a03c73140ae5f2286452dea6fbd230b0f643d085be462
MD5 a92fa0bb8d732dfa83c835f090f1de0a
SHA1 95428f8f6be83627f5625575ceaa4c32ffd67580
SHA512 4788edcd98171195c2aced40bf9877f78492fc4d6b51385d957cc6a1b20f451c38c9b30885d90eac1ea1cc01f427e99efb164389d20ee3d8133bf37066061bcb
MD5 SHA1 SHA512

Submit Download

requiredBang.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\requiredBang.gif
Size 124B
SHA256 00180ef549b968a98a714be9cfd5b51344e6787d4cdd189a8f08970ece30ca74
MD5 838b57c2281bf72d723093e6a0753a6e
SHA1 8d052e12c52bf39212087f2474a9b67ca353cdf7
SHA512 3b3e911b69012232641abc9794ff3386ee829d49e930bd3ea323409ad23d4f1b2811eaac2a51418378731c350d99a79b7d2787905d56ceac7f4cca41389bfba9
MD5 SHA1 SHA512

Submit Download

selectedTab_leftCorner.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\selectedTab_leftCorner.gif
Size 65B
SHA256 b5c3cca15aadc1f8a629c29fd5e7e297e77e9a8c1fb3ce13c2ed86ccfbae43f5
MD5 6e508458e3bde95b6f2b039b8d986e6d
SHA1 82b9a7a83be07eaddefb9f56ab9b7221fb88d4b8
SHA512 a93e6d4c4d3669c0857c9bde6ea15ccdb6296f7e52769e1e7441a0b14246bedbcab2916b697469531599d4aaed8fe91da8c513692f30128924d2fdea310927b6
MD5 SHA1 SHA512

Submit Download

selectedTab_rightCorner.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\selectedTab_rightCorner.gif
Size 65B
SHA256 25e982be8421503330f30a05dd83cf6d6c6b372645e0e2b04ae6e0b79fa39527
MD5 cd6bd3a593ac1e07b647580a59ce7560
SHA1 1703ecc2e8b238f0a22de63203fbfd8d710209bb
SHA512 44235bdf2305b65bfc528d9227d8de3433081e662290d53bf4efd0db636c004c83e974e0acb608dcf3ad7712a415aed988ea23ac2fde8f8facafa2f91c4814ac
MD5 SHA1 SHA512

Submit Download

topGradRepeat.jpg

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg
Size 8KB
SHA256 2cc83cfd8178966d576b0e26279a9c0345179b69d8c0272b1cdb93cb2e55b532
MD5 f634fa87ea56a3c1cfbcd5e786cd195f
SHA1 57a5c9dfc2eb6e31673cbd3981b351a35dc483f9
SHA512 b3cc75b30d0b747c9aa27e28d00fa86c959ecd0148279c973508fb6df7e2ce1d01cf5c4f657032a185037a5f161fd4727e1d99db3e7c7a46115d5d9b29795b2f
SSDEEP 96:XjTKA7h7QWmee8aTn9n0ljv5MykvKK0osaHOfFA0lr2ZC0w6HustKKKT5xKBBrfg:TTK0CsK90Ll5csautAOr7saxK7fg
MD5 SHA1 SHA512 SSDEEP

Submit Download

unSelectedTab_leftCorner.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\unSelectedTab_leftCorner.gif
Size 65B
SHA256 6911a70edf8da55228da3448534809d1c4a7813bbbcd1c659d36c84b36585bee
MD5 580f5173fb25b7808233dc2ed3bb933a
SHA1 e794d573918edf4434358f3298a59d6aec85cf6e
SHA512 a081e1dc70e65907af7fd233f24ffb216ebb7c7fee967deaa29c5b38337870c36fc3355df3524bf8e0beb87b7626ac8995096451712579da07346391dcd9f13c
MD5 SHA1 SHA512

Submit Download

unSelectedTab_rightCorner.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\unSelectedTab_rightCorner.gif
Size 65B
SHA256 694041d0e85d0770e5e5e71f6838518f522d2589907d7e5710912831b4cec029
MD5 813f30791b16de3caf3ad97def132197
SHA1 67fddf4b493683fc30302fd95167840720720861
SHA512 44a5389809dbe09e70ca96abc23797a4b2b0abb5776dbcbaa8cf1d6683d7269a03975938120f026eea8bbca36481ebed28124b139217d373c8715eccdc6f2505
MD5 SHA1 SHA512

Submit Download

yellowCORNER.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\yellowCORNER.gif
Size 880B
SHA256 b09ad4782b87ca5c9b0aae6f72afc9b6576d85811eabccbf09f6d881c91a1ce5
MD5 7dbaaa4c95c00196e6280a295d079c85
SHA1 e1c20e7a8d8c1f4003ff3888ba78abc92ce70ccd
SHA512 60fae5ed0ee27859f28a639e211d3e986e0834ce069131fffdffc38dfdc76d4a0eedf5d0781433bfb69290ffe06b22bca8b60ccf5fd9f8e7784c65336ca00641
MD5 SHA1 SHA512

Submit Download

security_watermark.jpg

Path C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\security_watermark.jpg
Size 49B
SHA256 f46faad59dd49e2957b5247b8b70c56f256db99bfc45388a30b2e67a9d3b6930
MD5 fb33d5529ca832faf310ccf2f818c9a1
SHA1 9fababed10573823f836bb1ceca70adce7f4edd2
SHA512 250f59bcbaeee2002a4fe16d964f2c368ee2b14e4a90dd20ace577c211738c0e27cc8f7cca45206ff52872df350400d022a10ab6895f2f223b89f22a1e7aa6eb
MD5 SHA1 SHA512

Submit Download

1 - Desktop.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group1\1 - Desktop.lnk
Size 1KB
SHA256 54ca201ab5999b00954bbe8c06fd427b1bc46f6be11dd2e9acfc59527ac5f4d0
MD5 0114aab619d2be16c13dee5d7b8ebb7d
SHA1 c0b88f20ba19598ef46235de934f76675e918361
SHA512 d559d387d6816d92dc4e0e85bd86977dc5f3c36c7e9a79c65b3c97caf240262c46079f02c75586911a26cc5de160093f644ce60481995754258237639fe01a74
MD5 SHA1 SHA512

Submit Download

1 - Run.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\1 - Run.lnk
Size 1KB
SHA256 035836416f664c28f41d12a2c795bfdd092101f58f7b4047a699e3b6f583a832
MD5 7b22e24ac0de6581b5af2455ccb5018e
SHA1 b0a8285b7e4610ec5be2a6d6c650a2e6216f26b5
SHA512 4ca3028e68424212ea662bdb5e681f6d3728cd5e5b8d1980793c17081bd1326aad33c4cc6604c38edb4ef53a60fc81b980b1d4217002ca9551c1f0a31c93a6e9
MD5 SHA1 SHA512

Submit Download

2 - Search.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\2 - Search.lnk
Size 1KB
SHA256 1ee33efef097ac1393cdcce3f970b3db6aabef5543976c25a1c9d5e1d74dc90a
MD5 ba1f8b271702f6e6d4e6dd4b7ddb663f
SHA1 53d50744967e99a3a1de06462044acf7b719084c
SHA512 f73fac87313c812ab6563fd5af1bc111357df678f7613b1220898e794c765eea41cefe9fa7919d72edcd10a0dd2cd32deee6cf5ec7ef1dd69029d22167d962f3
MD5 SHA1 SHA512

Submit Download

3 - Windows Explorer.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\3 - Windows Explorer.lnk
Size 1KB
SHA256 6b8a6c94d2a3b6d3079785e27cd07b58c8055982d78016d68cb75e76f9cf89d0
MD5 ad02b94bff42b8c356a67f0cf6c5a0b3
SHA1 1d064640729118ca616842037cd400e3bb2de872
SHA512 f75f60c47961fe338034f44fe4d1b61418e97a6f6c99d1e5bb408870dd67c02d72b2ec7540e5adc6953185501f86eecd14485d78e9c15f8bd5a1d4e7300b9c3b
MD5 SHA1 SHA512

Submit Download

4 - Control Panel.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\4 - Control Panel.lnk
Size 1KB
SHA256 7b59e02817a28e389877d1cce165213d13b342ffd9f2facaddcf244017e1c129
MD5 3f9d3c5f665c8043defe214d0ddd18ac
SHA1 259111ca7f06509067fbd7fd3ba9966d9b42ca80
SHA512 3eb2ace874cc75405b7ac06d99f2fc771f670785e5279c66874582da4f6609a50d70e891ec0903139e608403a8eda16ffb75a71704e02b528225cb0f5d49d383
MD5 SHA1 SHA512

Submit Download

5 - Task Manager.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\5 - Task Manager.lnk
Size 1021B
SHA256 f4b7a09a6d007081f65972663e898e3768a4068ef69a148144cf508a02b2a45a
MD5 b00f412c25131fe7a81ef0be6b813c25
SHA1 edc9e4193eb5f939fa06f1936f0970232401f748
SHA512 890472d23d3ba52ad38bbf4b1987f45261dec22dabf4ececd1a823854e213dc1d3bd90040b8c4cdfa74258d6e21a08680cd61e4c6bc1ffba0b242aa0662db884
MD5 SHA1 SHA512

Submit Download

01 - Command Prompt.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\01 - Command Prompt.lnk
Size 1015B
SHA256 108d3d67ec87f257f2d7ef034c1d9a828a7f75e72095045a3497692519e476b4
MD5 bf460e2249767ee3d0d488cfa434bcf4
SHA1 eedec19edf529796a472b8b120f830204c4d8fcf
SHA512 5a13c43523f41d133cef8bf470a5c292a171f8036c0cd35964558ea253c53d42634cbc5ca69660b4c000c6e1ba92ee90726c3f063360a9c16faec79822beec92
MD5 SHA1 SHA512

Submit Download

01a - Windows PowerShell.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\01a - Windows PowerShell.lnk
Size 1KB
SHA256 a54246f99eb6e4cf6e7e3110ce092924aa59325b9498752326a13d0b4c837af5
MD5 18f9d5befa52e131eb69dcf82d246198
SHA1 62f2a1b8b97d5c38b4e84824d54d9ad4c7a43f09
SHA512 bd6325340eefc52392c7b13d621bd4a93c29c98a9c81d998720e511d61833d6d13ee270aab5ef1018bd37a394ab7eb6b7b2947468684cc917b40b6e3a3ccfa3d
MD5 SHA1 SHA512

Submit Download

02 - Command Prompt.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\02 - Command Prompt.lnk
Size 1KB
SHA256 ec752b7aaf578561a63a7bc55dc665f03266922a02a538ecace13d6cdf600d3a
MD5 704d4b66fb96d3f0c1a9e6eda2fe31cc
SHA1 c7c174f0b51bb7061ec14343b5c9c57fe6369804
SHA512 fd484d1a5e84367557391bea5ce742a544c8fa003d869dcf6ee9e64944ba6b1352d7b9afbfff11e067e0c5078db5d4fb0b985dc3737e31d0568332419ac56c46
MD5 SHA1 SHA512

Submit Download

02a - Windows PowerShell.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\02a - Windows PowerShell.lnk
Size 1KB
SHA256 a6865bb9423e5575f4bb3bc6818223eeeb5e7e4e36cfd6649c34598b37a4604d
MD5 43c4797783c80bf8f22e376a073cc050
SHA1 36e03646d1c3184e4e8d385dbd5ddb2d2fa17b8b
SHA512 0445d09324218f4d7780cc1a06c64d1f20c1391c413d856735ac6128614d6aa8dceb8a0579787ec0696ea6f18b8a611193ab455daee618432be9418e71e03eca
MD5 SHA1 SHA512

Submit Download

03 - Computer Management.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\03 - Computer Management.lnk
Size 1015B
SHA256 fe90b8dca0862799305520a98c5ca7b41ea686806edb5dd668956382c0929fc5
MD5 4d3d50008ef10829990beb4aa51aa5b9
SHA1 0e53ef0c808cc9917403d1b3aad1c0de3ea0d895
SHA512 bcf4bf1fa346500a0e1a9a946da7fc268341d396a2a08b579b81314867bd2cfc87a97490132eeb73f903cea23b104801336df88239b62d7e480a60971d86a0df
MD5 SHA1 SHA512

Submit Download

04 - Disk Management.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\04 - Disk Management.lnk
Size 1015B
SHA256 529843e91a13ff50db91bed7f7b8853e611b7a77a701fe1dfc1112f857b8df98
MD5 4379f44f6ee0f5e3731e61d3580efcd4
SHA1 e137f4739ea9ae7a6d113538b7bd15779b074146
SHA512 7f5c892c14a49e34224c5dde3c9b75ac62885f52898aa69a44692b219dcbfec358a36cd33084ec3e06ce427adf2f63a55cbc60a597dee8e505d393058bd76781
MD5 SHA1 SHA512

Submit Download

04-1 - NetworkStatus.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\04-1 - NetworkStatus.lnk
Size 1KB
SHA256 fa3b153abdd17e5c1a164a1a8be9e560ef2616312e0c3536316fcf2d57dbd98a
MD5 f8ed34151aa5c0859d39e8e211e52e91
SHA1 50f17fe86f187b6a63b1b49067c6aa2742945eb5
SHA512 9c25f9984cd5073c96473b183ea9376dcd23a08b0ce86379f11c8cc460802a146459a6c588ea384cc8019c8e7ecad8261b04af1003f8b84fd4b711a8e59d202c
MD5 SHA1 SHA512

Submit Download

05 - Device Manager.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\05 - Device Manager.lnk
Size 1KB
SHA256 e56db673b19c0e857e5e6db47503c23cc8f782ae4bfe13678655ed54f5709db9
MD5 5f58d2080786ab54d02de029a1a2674e
SHA1 3f125831764bac2a1fea332d21d93e4e3fce7aac
SHA512 5dcefc7c98579840e7607c7be9579d5814a02d64973d93e120a50e83dddb6cec7f4f82bfcf30e42c6a5d18564bd85f73a983cf14bd26eab63d505bdbd37de59e
MD5 SHA1 SHA512

Submit Download

06 - SystemAbout.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\06 - SystemAbout.lnk
Size 1KB
SHA256 200bf034a3358397e7ce3e21dd0400c79dc193e0a478d06801e3cc66e3b17d44
MD5 86e0213e20b1ee448a3b81b959fb468e
SHA1 5ab4ae99ab0c4cf1e91326e63e859e846f082486
SHA512 dbe018c7efc8000d15f1ddd5301d354ee7a8d2fda0d7cb2fbc5c06494080aeb7e014e0dafc96fa4ade4c2b206f0459c8459d3e78f3e768533d401ee6b347de23
MD5 SHA1 SHA512

Submit Download

07 - Event Viewer.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\07 - Event Viewer.lnk
Size 1015B
SHA256 467124b4aa7c87c56413110bf53274e8722acd558a31cf8154c391454d0430f2
MD5 fd2feb7bf48f151e311a5e1cfd11698d
SHA1 f3f0ab91689d095f2503b55edc9da75d157038ea
SHA512 499513feafdcc8a49aa9774911d91c4949182856c4336755531b2b35c107cf51ee994fb40fe00efd5898cf95b0dec128b667307a7c5beed2288b840691765114
MD5 SHA1 SHA512

Submit Download

08 - PowerAndSleep.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\08 - PowerAndSleep.lnk
Size 1KB
SHA256 0f85961d40c3b7651f44644ce10ce3670bd7f078c29a97da5eb69387366a1aaf
MD5 2ed4185b7ee28574b708f962eb6e8aaf
SHA1 35c2d6f630db6da88177894f76abe30a5e6bfe7e
SHA512 b67d9af22cf9df90ee3d79296babd76faaf85c2a0fc17465a6ff204636716c2f8626e1eb7bcaa41466b8fa82df73fbba9fab81ebafb57c31ecc3c0fa18792271
MD5 SHA1 SHA512

Submit Download

09 - Mobility Center.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\09 - Mobility Center.lnk
Size 1015B
SHA256 64588b5ae2c1282f828eeb98f0acaece259f0a59b6fde45a3b10410b83908a65
MD5 c5fb1851a85ff7da8c2619aab069db86
SHA1 97385bddc0fbb3f8783a64b5f6c82c3e0b4e32b3
SHA512 4a357db2631319696e10d2963b5bcda6fbbc6dd0ff80e11d8a70cab64ac5d3eb65241b79eac800e54ebdf5fe78bd7ba28a96a75c16e40921594439f834f5e1df
MD5 SHA1 SHA512

Submit Download

10 - AppsAndFeatures.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\10 - AppsAndFeatures.lnk
Size 1KB
SHA256 a8ce145a5722e2545c1b2d5c345f3c68e858399815c573bb3df82aea2452e9bf
MD5 fa5501ed54ec20ff53a04eafae1eeb8d
SHA1 60485210b1a939c1a65f18d6463fbcbac2ef0441
SHA512 ecd87ab740270323c2d6300c87d966999c2987bcb36011f7a59426617d4b31837a01f06e2e7b0db1235f7972e9acc03942d4e911ed7d5e73bf482edc40d5543d
MD5 SHA1 SHA512

Submit Download

Shows Desktop.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk
Size 352B
SHA256 018824b2c014519d80b417ce793429248dc8968fe314a55f156ab507f1c89bc1
MD5 58ec3e8122f546d8f6ae2b07a1cee4cd
SHA1 ef0af1824a12e15e4a89d15ab49434cb703da107
SHA512 c088f7d747e12716e6e559856395b13e8aafc4f333451203b8deb844f6a821d53c71afca86884729db1a81e9b72d2dd2c1856a29cdd6f5594729870b76d68986
MD5 SHA1 SHA512

Submit Download

Window Switcher.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk
Size 334B
SHA256 0295009eae895788c2c03a9ce31584238f11b0338e22031932a2fa54a5d24a02
MD5 7578292c1687bba371f4f91b88a847dc
SHA1 52914e256d9a7f67465e6d25ed24eb28b89b2e46
SHA512 cfe90e410fb18f1c4ca56bde140557df620cb78f5c3a5e01c9c26d43e9091c50204427e078b868fe4c202bffa3823e47a28548781e91b472fd764c8bcf4cd552
MD5 SHA1 SHA512

Submit Download

Magnify.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Magnify.lnk
Size 1KB
SHA256 3f8d93d58cdd1e886e2b75d84df98869a4b91ba6afc87fa02815e217d7fec328
MD5 c11741ae120fe72ba5c48380aed9a89f
SHA1 12f13637ec392892e2dbfe40e2728a31824d06be
SHA512 05a47a9f5a46fc094c842dd65f7ff169ec2a6ea693b314f225edff705a0a697fbcf18745680f8a1338e6c00627425014022d827be35c6bfc8ffa4a1524075eb9
MD5 SHA1 SHA512

Submit Download

Narrator.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Narrator.lnk
Size 1KB
SHA256 98214033f0ef5c2ea0e9e83a263d9d1e97919b9c11268ec8fa2b5818f36a2d3e
MD5 0e9c754b2aa950d0fac3777453d379df
SHA1 c03d879f5f37a361b8518e13d85a29cdb6cb8d01
SHA512 8d1e5bd9b41f240403fd2e829e163d164173aeeddc4ab63cd29b1d215723d54dffbfc289e720f897708dd0a317938f83ea9e3002de1ab2953f710258df0cc5cb
MD5 SHA1 SHA512

Submit Download

On-Screen Keyboard.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\On-Screen Keyboard.lnk
Size 1KB
SHA256 606d711e300e3883693981266ad2dfb1be164754a96ec24b944f8decea8e3d5e
MD5 ad6bf38ff193e60f78eefc07f412c5f4
SHA1 ff6062e02ff90c46f37678ce6d66ae5973e74898
SHA512 3aeb30fe01e0440ff8d4270e1361fa96fce23374f083ac994759ef7e7857c282b30504e672591a82a40dda900176a074ca33dd42230c58927042aaf0faad224e
MD5 SHA1 SHA512

Submit Download

Administrative Tools.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Administrative Tools.lnk
Size 1KB
SHA256 1746e178c390a951b071ed81e454aafb960b7b6cac709f245c10d1603852f7bc
MD5 f03753d1da476e09930714df2d9e804c
SHA1 f4b17e20a315d58b4a11c0575ba3ff926a7f33c2
SHA512 075f2c2d8d53c0af1c63a32ead73b0b7194957e1525b0e4f38e360eac966116e595a00b058378e5c32e8062901ebc5971564176adfdfbb0c88d3c66b02af4536
MD5 SHA1 SHA512

Submit Download

Command Prompt.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Command Prompt.lnk
Size 1KB
SHA256 4011ae786a47d498c8f5c3657269cabc1d8891cd4bc04f941bdc720f2839eeed
MD5 f2b4624cb4786ecd7c92d713bbbe2569
SHA1 ebbe029f779ba87696b0e3b1c68e383bd55a97df
SHA512 c7c2eefebcb97622890465053badf08b6842eae40afddd5e8156239b64be75c42ac01ab9f311416a543c3a4e454b98e9cdf252dd2f5fcbb2ef300846fbdc900d
MD5 SHA1 SHA512

Submit Download

Control Panel.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Control Panel.lnk
Size 405B
SHA256 f1362dca72c822926f942534d6c5c411a896186699be2ed91efc64c47a539736
MD5 b6598f3bd0a2201216bacb83eb431afd
SHA1 3f6d63aa7977db8076c6f6563c2126078928e3ab
SHA512 0904fcb184f04f5d267fd7c140565c92d1be2da4bbd65f2e30592714c580407549b179dd1d7530ed5173e6f2483eac3f3161139fb4be1e1867e4ebea51d9c8cc
MD5 SHA1 SHA512

Submit Download

Run.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Run.lnk
Size 409B
SHA256 d697d161daa29d63a78b1ab28c38df07fe694c4155d481cddd01c31241d42dfa
MD5 d6dd4beac882f186f01301b09297ea67
SHA1 7de137fabb6a6b72176e2473f38c52869e5b0c99
SHA512 44b287d240742d8443dbbda0363b9472a56018f99f4a3532203c2c3223bead64b8349e20952828c63970f886b00b3edb3cd43d6c45caa86a13269287236e829c
MD5 SHA1 SHA512

Submit Download

computer.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\computer.lnk
Size 335B
SHA256 a3aa009be4b1432f38c1b870f47db89d693b13a3d70dfdf58bf3628dca05a5d7
MD5 fae1429e0badd5ef32afccbcf91f2d1a
SHA1 fdea7f003cbb248b7f07726a918cade60683d0f5
SHA512 cc496797ead3c3265234845b2ae3ee4a828f5860222841c6876bb64bbcd15030dc40cf697e72739e756b0ca1fd38a72201f0910aca55e961117b6342d53e2bf8
MD5 SHA1 SHA512

Submit Download

Windows PowerShell (x86).lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell (x86).lnk
Size 2KB
SHA256 48e912039d4eda34232979decc194bfbbe0bc3beb5fba429e389b98eb1820cac
MD5 0504355e7f98c786779aaa374fafbe05
SHA1 fd82b0205ba53f88262a3e4a460844cfbd9fb702
SHA512 b85be7f97ff77ae932fd380d22336b7964b64c11013e0aeb666fce67f35e7466f5cf40ecc3c0ebe6721e73b4a2ddb12d6ba56f0877ed99386f4e0f5c863a5d6a
MD5 SHA1 SHA512

Submit Download

Windows PowerShell.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk
Size 2KB
SHA256 be8587b5bd4be1694682db4ee06195207fad98622f40fe505221cff406047331
MD5 79e79dbfb2aaeb06527d7ee2b87a8fef
SHA1 f7cf9b976a560f0f5d7eee4321618850918d5407
SHA512 2c3464c6bd7cf24bb7b0b7147f6ffc155b91295cbf404fa0af05c76d820eee4b2189591f4185f366c886be2c179aeeda26ced6f164656a4edb02c73e6d40bb63
MD5 SHA1 SHA512

Submit Download

Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png

Path C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png
Size 296B
SHA256 aca0e0133724384f9388b0a6e68c7ef2d9d99bdb5e2da8bd9bb1818c2b052b5c
MD5 009250cc16f6551a0c1f2596dab51b6c
SHA1 9fca3ca6b02927cdce31e745d3f18d0884693ac8
SHA512 a3a97eabc4b103aca41127731759e3904e263c64c00c35564525830554196e40942184f1e923c118b711299c150c18ada8b61c983a4b73c0061c48eaafa2e4e9
MD5 SHA1 SHA512

Submit Download

Square44x44Logo.targetsize-44_contrast-white.png

Path C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_contrast-white.png
Size 276B
SHA256 d2b5bb67d5deb1b38b0b49efbb5de8cdf70c392d55f04d13180fc51125e84676
MD5 9116c8f782413feb2c3fefa01d29de1e
SHA1 aebac7b9f107abf48984aba67f706ef53d650b04
SHA512 d85e8d388239c8bfc1e448733511eb9c60d60b2ffafb170b200062b42747f824cb2fe56fde36f92ea8253321078edefe957ad18b832de3832b73c836f11a88fc
MD5 SHA1 SHA512

Submit Download

Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png

Path C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png
Size 296B
SHA256 69ba9434832207223880e2cd8f1784d8b20f34742fbe273bf283702ae257389d
MD5 5520d940170577b5c44d392639b9d001
SHA1 dcd6e8b3f08d34ae79b923808015fb2721b490f4
SHA512 144ab440af1fba78484e9e1166856b19f842d8eb256c998d889dd15f8cf8a9ed31bc9f92e9d63191ecbe8cc8055ed94c7407b95d9a023d9ce1cb9b91646ceefb
MD5 SHA1 SHA512

Submit Download

Square44x44Logo.targetsize-44_contrast-white.png

Path C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square44x44Logo.targetsize-44_contrast-white.png
Size 276B
SHA256 8d14dd658d5aad1188c58a863911de8f813292615170d3fe13e585b85e867a99
MD5 c8899517e46ddcbf39a5850e32ada735
SHA1 12ade86783308bfb605596f3aea0299eb622dc2e
SHA512 612ae31cd4d134dd74fc3576f4678a3fc239c0547df1c504f3196def3e9de8a4637c8929697a028e09a251f8579c9a60d6333fb4c23358f961493492e95ee79f
MD5 SHA1 SHA512

Submit Download

OneDrive.lnk

Path C:\Windows\WinSxS\wow64_microsoft-windows-onedrive-setup_31bf3856ad364e35_10.0.19041.1_none_e585f901f9ce93e6\OneDrive.lnk
Size 1KB
SHA256 30b77debb383a4cc40f5870adbdbb85dd818a78057a682f9888ef8465188e6b0
MD5 1afc7c8e2200090dc4d1f687fe790baa
SHA1 21330845252ffbcf611bf0b9442b778ed995fa25
SHA512 556eae68609e0c63570f7bd0f30ce8735025456ef81b7e6161a70be085481c6a5d0ed4ba7b17a023c853b4ac88270932bbc9af87b23fe303c787982dd6ce663a
MD5 SHA1 SHA512

Submit Download

memory/3104-10973-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/3104-9907-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/3104-0-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/3104-5272-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/3104-5283-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/3104-11288-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/3104-11311-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/3104-11316-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/3104-11317-0x0000000000400000-0x000000000040C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads