ec4e0441e96950e7f5b64860b1ec33b2ee544fe0779d34ea4414fb0e780884dc

Analysis

max time kernel
141s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
03-11-2024 09:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
Size

29KB
MD5

8aa695771695fcb2debf32be36342fbc
SHA1

dc90c5bb99de71190ae5623032ba871ec81e788d
SHA256

ec4e0441e96950e7f5b64860b1ec33b2ee544fe0779d34ea4414fb0e780884dc
SHA512

df878a074fe23c37c5b8f309a698f54fb2197f3559b042361ab424cda4a6f88bd239fcc8c6775394f0caf71f341c73cd795ab0e50e6fe582f0c46f06e54171b3
SSDEEP

384:eebFNw4Pk1itKkpAjjI2YpdmZ+9saOxj8uO9GtWkA5WuHVjR4VW:e0FmBkpKjPYppOl8uBtWkA9iW

Score

9^/10

discovery persistence ransomware spyware stealer

Malware Config

Signatures

Renames multiple (2197) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Drivers directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers\gmreadme.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kg4SQNj6ADx9boQ.exe"	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\FileRepository\eaphost.inf_amd64_d37080dfb66d830b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmcpq2.inf_amd64_2115846fffc22bb2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmsun1.inf_amd64_5b6db32fd04403a3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnms007.inf_amd64_8bbf44975c626ac5\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnms014.inf_amd64_faec3fc366f8e1fa\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\tsusbhub.inf_amd64_bd91a147ab4ebf1c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wvmic_kvpexchange.inf_amd64_b3c17aa69dce1e0c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Configuration\BaseRegistration\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmhandy.inf_amd64_d2feb24c2d3b69d4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\MUI\040C\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\sppui\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\de\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_battery.inf_amd64_5637e58e54fb24bb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmusrsp.inf_amd64_4c83ce3a06d0048e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\sti.inf_amd64_096c9e42fe4749d2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\usbprint.inf_amd64_86cdf3e1f512cca1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AssignedAccess\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\digitalmediadevice.inf_amd64_5b64b65052c3a32a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netmlx4eth63.inf_amd64_3809a4a3e7e07703\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\scrawpdo.inf_amd64_466615aad3be8e26\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ProcessResource\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ScriptResource\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\ServiceSet\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\XPSViewer\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Configuration\Registration\MSFT_FileDirectoryConfiguration\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_fssystem.inf_amd64_89e15d7e662d6584\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mvumis.inf_amd64_f0f4d0c799bb854a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netevbda.inf_amd64_1503f4d5a0d6ba56\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\perceptionsimulationsixdof.inf_amd64_3ff016f4df6d2b8a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_EnvironmentResource\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_UserResource\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\hdaudbus.inf_amd64_533c8d455025cc59\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnms010.inf_amd64_9e410195c3b236c9\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\ConfigCI\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WaitForAny\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\cht4nulx64.inf_amd64_641bf08bee8ac46d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\modemcsa.inf_amd64_a76330a2da8329a2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\nulhprs8.inf_amd64_e65ae5a38cb839e5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\icsxml\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\bda.inf_amd64_d32fe6b1c2b7b2a5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_scmvolume.inf_amd64_de693592afe8a496\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netl1e64.inf_amd64_8d5ca5ab1472fc44\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netnb.inf_amd64_0dc913ad00b14824\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netrtwlane01.inf_amd64_b02695ef070d7a42\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\InstallShield\setupdir\0007\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\migwiz\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\pt-BR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Com\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_floppydisk.inf_amd64_bc7bd9dca28933ec\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_fssystemrecovery.inf_amd64_aa57df1ffa9aace0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmairte.inf_amd64_a99a7ecb03853141\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmminij.inf_amd64_a85c8e1fe15a9532\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnms014.inf_amd64_faec3fc366f8e1fa\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\MUI\0409\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Nui\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Speech_OneCore\Common\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\winrm\0C0A\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\XPSViewer\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\dc21x4vm.inf_amd64_3294fc34256dbb0e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmhayes.inf_amd64_055d85baabbda8f6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netip6.inf_amd64_f29ffcd2b14f21f5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\onboarding\chats_emptystate_v3.png	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\sl-SI\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteAppList.targetsize-64_altform-unplated.png	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-24_altform-unplated_contrast-white.png	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\ExchangeLargeTile.scale-100.png	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\fi-fi\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ro-ro\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\pt-br\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Images\contrast-white\Settings.png	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\WinMetadata\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-24_altform-unplated.png	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\email\dummy\fake_logo.png	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Viewpoints\Light\MilitaryLeft.png	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Work\contrast-white\SmallTile.scale-200.png	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\typing\bubble\light.gif	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-32_altform-lightunplated.png	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files-select\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\bcel.md	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-80_altform-lightunplated.png	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ca-es\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\sv-se\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\Close.png	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Program Files\Mozilla Firefox\uninstall\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\aic_file_icons.png	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare150x150Logo.scale-200_contrast-white.png	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\GenericMailMediumTile.scale-400.png	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarAppList.targetsize-40.png	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailAppList.targetsize-256.png	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\AppIcon.targetsize-20_contrast-white.png	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\tr-tr\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GamesXboxHubSplashScreen.scale-200.png	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\te-IN\View3d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-36_altform-unplated_contrast-black.png	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ro-ro\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\TrafficHub\contrast-black\WideTile.scale-125.png	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\Doughboy.scale-125.png	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ru-ru\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\it-it\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\en-il\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\StopwatchLargeTile.contrast-white_scale-200.png	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_2019.904.1644.0_neutral_~_8wekyb3d8bbwe\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsSmallTile.contrast-white_scale-200.png	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarLargeTile.scale-200.png	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarAppList.targetsize-24.png	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\Spotlight_WinterGames.gif	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fr-fr\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\it-it\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\eu-ES\View3d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Archive.zip	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNotePageWideTile.scale-125.png	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\LinkedInboxMediumTile.scale-150.png	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\StoreAppList.targetsize-48.png	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\AppPackageSplashScreen.scale-125_contrast-white.png	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactNative\Tracing\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-256_altform-unplated.png	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-36.png	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-white_targetsize-30.png	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\adobe_spinner_mini.gif	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\en-ae\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\WinSxS\amd64_microsoft-windows-c..lter-mime.resources_31bf3856ad364e35_7.0.19041.1_en-us_6987bb3917153259\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-coresystem-smsrouter_31bf3856ad364e35_10.0.19041.1151_none_8b783a06616e69bb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-flacencoder_31bf3856ad364e35_10.0.19041.153_none_f27a39a2b7cd3b01\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-m..ngservice.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_0a74a0583789ad29\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-h..providers.resources_31bf3856ad364e35_10.0.19041.1_it-it_1d3722c5c1ac183e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\napinit.resources\v4.0_10.0.0.0_it_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_lsi_sas3i.inf.resources_31bf3856ad364e35_10.0.19041.1_en-us_a9a80d390049f398\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-c..ngshellapp.appxmain_31bf3856ad364e35_10.0.19041.746_none_0b4ed891dd9ccbc8\wide310x150logo.scale-150.png	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-netcfg.resources_31bf3856ad364e35_10.0.19041.1_de-de_44f3b896d1c628fc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_net1yx64.inf.resources_31bf3856ad364e35_10.0.19041.1_it-it_3966cd5b62e026c0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-directx-d3dcompiler_31bf3856ad364e35_10.0.19041.546_none_d1a00ba6af407536\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\rescache\_merged\1936697710\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_dual_intelta.inf_31bf3856ad364e35_10.0.19041.546_none_53869a995d79e64a\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_dual_rdpidd.inf_31bf3856ad364e35_10.0.19041.662_none_6d39935cdf4c2f41\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-onecore-a..ore-other.resources_31bf3856ad364e35_10.0.19041.488_en-us_d1be908c47d549ab\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-i..migration.resources_31bf3856ad364e35_10.0.19041.1_de-de_f7c545842741e09f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-u..usnotificationuxexe_31bf3856ad364e35_10.0.19041.153_none_51feabe070ab84f6\X_80.contrast-black.png	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-directx-direct3d11on12_31bf3856ad364e35_10.0.19041.1_none_bc1d52451b36c27a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-docking.virtualinput_31bf3856ad364e35_10.0.19041.746_none_2c0c715916f96491\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-duser.resources_31bf3856ad364e35_10.0.19041.1_it-it_b7cc4f508c587352\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-help-adm_31bf3856ad364e35_10.0.19041.1_none_e339acaa2adf14a5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-homegroup-controlpanel_31bf3856ad364e35_10.0.19041.746_none_942e09d520211fbf\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_netfx4-clretwrc_dll_b03f5f7f11d50a3a_4.0.15805.0_none_cd42337291cd5c70\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.1_none_75cd350cc8b5dbcf\debuggerPrevTab.png	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-a..audiocore.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_094fe93477011d02\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-kdc-adm.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_a352edb4095c0e82\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_netwtw04.inf.resources_31bf3856ad364e35_10.0.19041.1_es-es_e4c57ccc8cfc2d04\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_startupapp-task-data.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_7305d74ccb7b6342\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\WinSxS\x86_dual_ntprint.inf_31bf3856ad364e35_10.0.19041.264_none_66e0b708f017bc79\f\I386\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-onecore-l..layserver.resources_31bf3856ad364e35_10.0.19041.1_en-us_14a4bd492298f7cc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-netbt-minwin_31bf3856ad364e35_10.0.19041.572_none_c981575636cafecc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-proximity-commonpal_31bf3856ad364e35_10.0.19041.746_none_6d5ce38d4ce6ad0d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\WinSxS\x86_netfx-aspnet_web_config_b03f5f7f11d50a3a_10.0.19041.1_none_5f0132d8aee083d8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\WinSxS\x86_netfx4-web_lowtrust_config_default_b03f5f7f11d50a3a_4.0.15805.0_none_64c27b3126a2f1b3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-m..count-adm.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_d9184d797398fb4e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..ty-smc-cx.resources_31bf3856ad364e35_10.0.19041.1_it-it_3b0d2c7884323427\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_netmlx5.inf.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_ff1b7f841cf0454d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_bth-user.resources_31bf3856ad364e35_10.0.19041.1_it-it_a9564d7fe2760480\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_ds-ui-ext.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_76a9f2508c964d9a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..-credentialprovider_31bf3856ad364e35_10.0.19041.844_none_ba9a38592c771431\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft.powershell.psget.resources_31bf3856ad364e35_10.0.19041.1_de-de_971474199f3c1bca\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Activities.Build.resources\v4.0_4.0.0.0_de_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-e..epassword.resources_31bf3856ad364e35_10.0.19041.1_de-de_0e22f8342b4ed105\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-msmq-runtime_31bf3856ad364e35_10.0.19041.746_none_7edb1f4894ffbbf6\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-rmcast.resources_31bf3856ad364e35_10.0.19041.1_it-it_2a34f9e63b124291\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-e..epassword.resources_31bf3856ad364e35_10.0.19041.1_es-es_b6df2b111a53ce6f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.1_none_75cd350cc8b5dbcf\i_filtering_options.png	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-mccs-syncres.resources_31bf3856ad364e35_10.0.19041.1_hr-hr_c2a780e13215164f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-w..pdate-adm.resources_31bf3856ad364e35_10.0.19041.1_de-de_6b0e328273416a14\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_wpcip.inf.resources_31bf3856ad364e35_10.0.19041.1_de-de_690f7acf80356570\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\23\header\Remote\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\Assets\Square71x71Logo.contrast-black_scale-200.png	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-c..ngshellapp.appxmain_31bf3856ad364e35_10.0.19041.746_none_0b4ed891dd9ccbc8\square44x44logo.scale-125_contrast-white.png	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..aleducation-license_31bf3856ad364e35_10.0.19041.1266_none_ac8d2c3ca59c96a7\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\WDSC_Illustration_834x834.png	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Diagnostics.Resources\v4.0_3.0.0.0_fr_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-n..quickstart.appxmain_31bf3856ad364e35_10.0.19041.423_none_72535ca9b59a9515\NarratorUWPSquare44x44Logo.targetsize-256.png	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-g..policy-admin-appmgr_31bf3856ad364e35_10.0.19041.746_none_e307512049297c65\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\WinSxS\x86_microsoft-windows-m..ace-remoting-xactps_31bf3856ad364e35_10.0.19041.1_none_dae3d26bf554a35e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.JScript.Resources\8.0.0.0_de_b03f5f7f11d50a3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-flighting-settings_31bf3856ad364e35_10.0.19041.264_none_66b7f4dd4df876d6\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_de-de_fa3317ce4cfa58b0\defaultbrowser.htm	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..ativehost.resources_31bf3856ad364e35_10.0.19041.1_es-es_e798e432a20c5d07\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
File created	C:\Windows\WinSxS\msil_multipoint-wms.mmstools.resources_31bf3856ad364e35_10.0.19041.1_en-us_94ce42426fe482ef\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QMVTCUODNBQPFQJ\shell\open	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QMVTCUODNBQPFQJ\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kg4SQNj6ADx9boQ.exe"	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd\ = "QMVTCUODNBQPFQJ"	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QMVTCUODNBQPFQJ\ = "CRYPTED!"	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QMVTCUODNBQPFQJ\shell\open\command	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QMVTCUODNBQPFQJ\shell	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QMVTCUODNBQPFQJ	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QMVTCUODNBQPFQJ\DefaultIcon	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QMVTCUODNBQPFQJ\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kg4SQNj6ADx9boQ.exe,0"	8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8aa695771695fcb2debf32be36342fbc_JaffaCakes118.exe"
1⤵
- Drops file in Drivers directory
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:5052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\aic_file_icons.png

Filesize
50KB

MD5
e6753794f29f695ceb805d5ea94468c3

SHA1
842fc93900f3fe838ce0853290cb1752a9625d2b

SHA256
11a8a5a97688165b63ed546b62d82dd0c54b563ffc7a28006ada7571d02e5f94

SHA512
994d71368a2eec53a42493a20021e4d3c9db0524084a96fe6ca38a5e04418aa603ca6bdc038f682108e8ee23d8079f00d642fb3d16c33a87cbe2bf208defed38

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions.png

Filesize
1KB

MD5
6115a845241c9b2dbcf1f764897d3468

SHA1
849148f28c5ac79daf31a1924fb88b3f2fe8434a

SHA256
6d936232673ecb96c3312afc69f8a994cc5d9cb2cff0a4cbb9c2c57a63c2c2f8

SHA512
db8a2bcd1ba951963f7215b1f14901013909c036b2804180df9243f2457b67dc5f4bee4d7da8f418580f2015113eff0df2b081495ae6ccbc90ed01a566f94332

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions2x.png

Filesize
3KB

MD5
4b2be79fa9dd5c67675bb1f0722c0639

SHA1
71cecd8aec286d6102a9b410dec567992990938d

SHA256
6e148a17634ac94365d664b533484cc57aa58372036e0512ab27a28e56c13520

SHA512
fb54dd11e32f8e6d9058381ed8e5b70af7e5df6b04f112610084c84ec699c086f328829275621e20c45c02fa7704d7fb3f1158c25acc86425833166e41383203

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons.png

Filesize
683B

MD5
3b887b1dfd82d5c5307a0defb721e86c

SHA1
dae89320203129d59723d255a5fad19aa0eb6a0d

SHA256
bbb4735b3c905fd23e18ae1d4e9bea20220c459dbd857f50bdab992d26408412

SHA512
4c0c06af6629128153bb3a614c755662ce8265c298a1857d7317313629859b8c5bea1ab093a1067f1466f6eba455dca21df1dbfc00663bc0e71fa3a3ebc63f07

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons2x.png

Filesize
1KB

MD5
4b6e936aaaa7b6caebc7da12fdcc6643

SHA1
6ee6412824c75b06fbde615e8e5ba01ccc625a36

SHA256
9eee55033f97338389ae4dedf6c5eb4c801e934bdc25ef6ee2ab6c028ba76b4c

SHA512
632f8af519048442a9937ac0225a464f025776081284840b54e680135fddf96515edd7fdd267af19c626124ab01d0994c758fefcc1a2d37cf377898330e26a5a

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon.png

Filesize
445B

MD5
917bb1ebe48178a23b0dc45cd5c383bb

SHA1
752ad59b0d1d5ffd0683bd70d3edee59ad93c7dd

SHA256
a1f84ad9d725abbd5e2530ab02335cf716803d6d9bad70b44217d2e93ebbe1af

SHA512
fcfdad501b4f64b2ac066a522c9389b9db3d03befe0c2c9c28764558dd0b4980280a3094f4300f19927a7bb3171d065cc5766e6a271af17255ca87f6e3920102

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_2x.png.EnCiPhErEd

Filesize
611B

MD5
3a3e116b969b79607193039d6a10a76f

SHA1
0ba972001b3167955b68701143290ac1a9c7784b

SHA256
906fa586922fbc95cddabb5d3fac88dfbd74260f61bb9b3736b54db387f1839b

SHA512
428c7ce9383cbc62bf6357a8eb52150c1bdfc2a986e9289d311e0d2297ca2e1dd9628ee7e58d0c519bfd404e89f0e4cf158d30c3a2ad7e47846db885349ef583

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover.png

Filesize
388B

MD5
eebaadb9d243f014de842e3c63d86598

SHA1
02beda7021b01480c747af2f3884172849101541

SHA256
1bedaf2c235a3fc8665fe57c92c2a5c723782594e8d60aa82bdde3fc90cd867d

SHA512
f5dc5023972b324314d64a5fb3ff8f3174162e5c0c167a2afecc8b82dffa6b2a1318a7fd2c4c465cf122711d706ba46f3b196dad49d8f72221e6388822580086

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover_2x.png

Filesize
552B

MD5
2c7ee654b218d2c09a69a7de9c57dc46

SHA1
0c2fd5a900053f05748554f7b5bcc3f17169f8de

SHA256
4bb24e4ac016c549c8a800c3e25058ee53b5c720bd0f8fbf4d284bfeb982b665

SHA512
fa594766489fe7fd4840a6be60a47c5beb9b57f8d3a2c507565d64a155066f79df23446441aff3310016d598c6d80a20b229678ec3476938ad5e103d3141c713

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon.png

Filesize
388B

MD5
fc3c20961cf0d08d0bc340d39ced3f94

SHA1
8c066398e8db2deb9dce06690210b7d79f0ad6b8

SHA256
98e3615469982836f0dae2c895d15cfe94e4245c6fcebe6d7275b19be11de37b

SHA512
551f63f364997c7edf0fcded532a1a81d59f17bcdec9b264986b67c0ff3152e4871652d48d84c1403fa707bdbff40d06944a2284da83b64bf7e4d910905fac57

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png

Filesize
552B

MD5
75c0b6feb3a590b1f0adf29ec8f2224b

SHA1
4aaaa804977ede7351ff1bad636392fad2727aae

SHA256
ab80b823065401782fbc45a5b41aa49ee03104432ae06729d90ceac1743f1ba8

SHA512
11506c275bd4e661e77705cc3794555cd25bf78149711107e6a53eceb59d224c41c4f02a19d70ce3f5063430dc3cdbae18ae527538f813e337ae574166cd2d9f

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png

Filesize
388B

MD5
ce1d95543d80571d835eb60f3188a528

SHA1
c70b214498811d28831059621f4b77cd91eb972f

SHA256
f0cb726684bd80ffd65906b472c29ef7bd6f0a721d4e60ca18cc36fe8aae46c5

SHA512
1a63899496ec2e4e533ad664e7ef5c29fdd9dfe00b4f7fcd7c15209a088f01a1de71e36936a3790dc91c3b9bd19d9a2e4fe0309c36f758b19ed30c80a7878dc0

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover_2x.png

Filesize
552B

MD5
e22b192361062d505dbf9c36b530dbfc

SHA1
39553a9dacac03e2d3a95f922ef98f6777ed9622

SHA256
b58e7de8576606a507f732add1d85f30c1b3dc9867999737e3dd064b6bf6398d

SHA512
6ccacfb53b305c733aec55eeef54e8ca061035c9dc7b143499912e36aeb7cb4c13416857d94ed7708af9ea2f9d9fe23473847897ec98803cb9b09a64509e0a71

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons.png

Filesize
7KB

MD5
a7653816cc07d6ce1dfedd94b2ccbbef

SHA1
778496f61f00de5c5234fefc3984f056c943aabd

SHA256
f376b6efda79ef6c33d70c4ef50af2963a3890f732956e75fcdc97a026e633b7

SHA512
6baeb65072b0196139bac87ce57bab64c62021ee7116a43d6d856b081f2dffac03a28643075781e1bca4d72126c5e4b82110fd801c123d246ee1dda779689571

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_ie8.gif

Filesize
7KB

MD5
971dc3ce3e0db44dc32fddfa75eb059a

SHA1
cdf27d2eaf32ad72e1ec99da1d498cdf249fb0e8

SHA256
850dab1cceb7071dd4843d7d90afcc7a44511aa02ad77fb4fc45f61d1ccf28a9

SHA512
8e9b089e38c9a526dffc6ab0a31eaf82819006dc205dc08ed764ccb1fc7ae642b4ea46164166a2f341c97a7d1c62a40d2a85a3570cb158a3575045713a9dce64

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_retina.png

Filesize
15KB

MD5
a018c6820d479ddfc63f5e197cacf172

SHA1
2e546fbcda6f35eceaf4bdfc82c4cdc16ecdb5e1

SHA256
fd72e30b8e72e77fd459224745169e19b4ea3c0d5e801c30e745d90448193375

SHA512
1ee9ef43be45f01c9ca2d5ec7cf0fa18ebd4cd199a765cca769f3c18f93d3e7bff4ac66036700ff39aff65ecb399d2f7028b16ff81454eecbe9b90f01a2dea9a

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons.png

Filesize
8KB

MD5
ea52a2f69f8ddd8b71dff418b86426d0

SHA1
53d1a60e1d233b60b67373b1c831e504ae94ef0f

SHA256
139130b1059d8f569a81b5387ad17c9404267f98d42f442aeea304a8261c4d47

SHA512
3c188ab8063d9fafea3f1edab092ae3d3469f5dd28395463d52f32256eb85e84ff3043b57b4cc1ba075807551e1f5254a0bc8689098c5c4bff953d771068c4ce

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons_retina.png

Filesize
17KB

MD5
55c74ae6c3f4813c041ff44ec255967b

SHA1
b35de1a836bd492ff617f3f6e096f4933a285019

SHA256
71f9888cc457d8f7921987370bd6174f20ee8b3058a09a82f0020e7dc1ad6270

SHA512
115d88a0548e9b6d249131d4c2c29f579be5e29bb7686128b29682fae57e347fa73a42b82e8d67d955af7e015694117d37df8cc182565f9395c962317cca49ab

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_pattern_RHP.png

Filesize
179B

MD5
33a0269e61fd10e43c51b2de7b19db55

SHA1
bb127ea6fac4932eed0426ef373ad53d051e8fa1

SHA256
79fea941b46675a373a4406435a00520e25804c87a04451ab828c9f1bc3bfd4d

SHA512
583749f4b066466380dd7d3a5e39ac2e91943368d3d936364eb24334877f38ad552817689834dd3898b08bb435a7afbc5a74cd6c5827d7412a8459f9c355943c

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_patterns_header.png

Filesize
703B

MD5
d55826ac011f49275474ea5afab74baa

SHA1
75c7f6429c0d78eb34ba9ed39e5ba673ec9adab8

SHA256
8028614b84d67a3ba8e687aad4441f745a7d25228ac9607788f40341e27f5704

SHA512
9902ae6550e163d333575ed9c7b3420076d6351f34491e7bdd11bb8c6fc13c1a949df8991b03c5c8dcb8f9a4c1f07b4cfeeaf214fb32c3736b591665e52859e8

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations.png

Filesize
8KB

MD5
d29fdf48bab53f57ee5ca032cee908cd

SHA1
729b203d94c82c3226091e15f9e82b6010f0529b

SHA256
ff276ef9cb50a25c2875cb4b453d1220cf1a3eb15a559349f3bcb2884e85a026

SHA512
189702cf88bba46c312bfe754b4d94d52465baa242a5125097cf1312c341d7e70ea4c3d6a194b43dc93893168515e8af251ac41d52fcaf02d0d52a6ca5120dfc

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations_retina.png

Filesize
19KB

MD5
c469847ff53d9a3716947452039e0549

SHA1
e83a8e9877da78dd66ef56b0314785cd4c40fcf4

SHA256
95e12138e8eac0090f7ef059bb544bf1423a7429cee89ed4a511b2621dd3ad9f

SHA512
54aecd1e7c64ef54987afcd3c09f02ffc849f5bd84bd51542722c491c642bed01cbc62298b404ca10b887a795f60356cd12d061e522e8d48289399e2518cf7c4

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\faf_icons.png

Filesize
6KB

MD5
15af010197671e91ddf3bf1e49896936

SHA1
5da94cb67b9a3e6a50a3d5787b78d5ec7c18d10d

SHA256
6cc9943f7734633c516b7985d59396327e4107bcd47f1956281c89000303e6c1

SHA512
272d2832cdb560c0fc0031602bec3aa510295aae23121ea32bf33b698ae51b4d8ef216c78f37399798ca532be2f34a8fc4384e9414ed9c12807e06c922f1d9de

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\bun.png

Filesize
2KB

MD5
8b3954fe554e1892ac0d8027e7adacf6

SHA1
b6895559c6f243d6fce279ba51ed127d48cde788

SHA256
50fc58bdebbf60bdc1e339978b1a60e8dec1f3971864f331f033950239a9cc6e

SHA512
802596b970a1d7ef9a1685081a6498194b00bb6bae11be98e86ef1ff200c568b3454f0c130ffcfbd1321149e069f329bf1659f498bdaebace65933dfa38bbf6c

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview.png

Filesize
2KB

MD5
9a2068517753cc305239b46ea85874b1

SHA1
752c2ab50d1a7b62c55599eff2bea8d047b1dced

SHA256
a3cb297ab69bfe7c353d7b9f33f9f105a199ea620021f2e0dda302212d75a8a2

SHA512
5121c12b84b06ca3a52877dbd171dbfcb0f8e909edb5262f49ccd734802cbb2b219dddf94050a180f4a6365d6e357c643cb023ec8e9e69f75dce44327109d87e

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview2x.png

Filesize
4KB

MD5
3fd893ac2527b3db36f678e6f3e1e895

SHA1
fd85dfe6feeebfa3aa02b31f007bcb0a933c48d4

SHA256
80e9822fb91d84afffb2505ebe4aca3e2320feade5ef47f8af8aa5bc91d48cfd

SHA512
8cf56341200249b78c235fb29590b8504ef303b906d4ff7e4ff23adfa858d27b5349ea4a658948bac29ac64959ae41f4276a06e4005bb2f5aa728a2671dc4d7d

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small.png

Filesize
289B

MD5
ddd422dd2933a68177e5cd7f4af3b670

SHA1
592b62a0390874c8005d84b3a315cb0740f7a9a3

SHA256
3d324b8fa411ab7f0a70498a1bd48635a3b6aeed4c80c7e4fc8a562111b925bd

SHA512
65c412cd39c6dd10c3a7695b13441b920f163a11ec78525953331808effd5b169c64bcb572bf2a53e2fec874379ab796c5bdb04a1463c6dfd8657133e969c2a2

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small2x.png

Filesize
385B

MD5
417a6b1b8cbc9b7f31981ca6fc16ee59

SHA1
79f87c1288b4e77753e34089e2c569c2a88bf978

SHA256
c6396ee9dd5a487ab7a196cb8ae8f3d6e21573b50250cc495e35cc69dc5be1ec

SHA512
9a5aecf554722962d5fbbb52026f73e5b08524339be21479aba5a41bef0813c1da21b8e6eb1ee29388f3b7a5d6064fb45e6e7cd1934740f943badda2e37dea56

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\illustrations.png

Filesize
4KB

MD5
1e618e957ef6fca4bccce6a0fadef772

SHA1
d8230641bac8c27761882e5eead436a5db8cc380

SHA256
d501e58fbf7a0d5d6f71d91f4c447c3a9692c05332737e31a7620262346b9988

SHA512
0782ba108964e8b2b88d4c9f8320e7c304730bed5c0c62fa9a3c63fdeba66c36df1117f4f4c72a077147d4fadda34d52708b91fa6115b622a40f3806eeab9eee

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\nub.png

Filesize
1003B

MD5
49165d911ddfe5f20a81eb8cc7c32be8

SHA1
0578b760e26b2b0f3ca3d5c25b47d3d658e02806

SHA256
eb339469abc253485e52a1e36b3f0b63e9dc6fb25a531ed148bedb04745a3a0d

SHA512
5d2a45b939ef34622524bab359a0ecf6a2fbf493c64be50a9ab4414c052a085d1d4f501bfb7bb1a6feb6451a22aa66ef2ae4061cf61fe99d57cd74a77ad24854

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons.png

Filesize
1KB

MD5
a161281b4e67ed6f0b2bc34a5111d064

SHA1
638e44cf218a1e95fefa6a5d2eb7b0126d273c26

SHA256
79e268c670084da4830579c60352a6c8aa06deb6a03e1e07d137a499683ce5e5

SHA512
32f7a10d9c833ced4d914d946f8b8bcadf089641e539cec2ef390e278f9912389d714483097adc6f8b3db9d26e9ab3dafb17d55de559c5ebd4f93105bbfe2185

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons2x.png

Filesize
2KB

MD5
b8eecc4b30a8721b1c3af57974c2d9ad

SHA1
faae6cfaaf3dc456dcd94f36d3e22904035125ef

SHA256
1f4ba91c632edb43baa55606f75b143bda82bbb3bc5063bfa7658d943cf1a17c

SHA512
5b538697cde9534664302a4e26dd634a4d32a37fee3243f6444515bd5c91ee10d9cd550116b562aa0e6b92f10f76e8ce746538afec7c901782bb9b51fe4330be

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adc_logo.png

Filesize
3KB

MD5
1526aa65dbef5df96a12cdabc70787eb

SHA1
c689aff30813b74d5aba042a24acf51f8587791b

SHA256
5242899e3497d5397765ba559d5819d008e15870f50c36b2356df14240333a3b

SHA512
f8c604116adb45aac3136c1f06c0e4fe0bc59655b8224f38bcb6d414b7fc4316933a558b6720479b136f39a796f5e46d3816dc30e90e421e7ed41eeb05e9cb05

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adobe_spinner.gif

Filesize
556B

MD5
4f66244884956a5bcae28d84ee507da7

SHA1
c228fc1d3531208bb36740dac7c9e633e0394a06

SHA256
c0c99a80f01c52e406380f4533a7db0832174fe81a67b2af301c7f03fee2d6fb

SHA512
18acd77cb972cbba3f340abb60e1fafb52d13177583c738accd0555baa02123a0fcdf6faff0934fd207894385ae395d3737536bd8cf678046cee6cad72ed6990

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\logo_retina.png

Filesize
6KB

MD5
38465981079f018651927d3981a400f2

SHA1
f917537c5c3e2d1e6a40896aa648a35bcd79e6d8

SHA256
6c4af6ac3b4a48ffe2d24b706e8f273167900383a907b8615c2341cf92eed479

SHA512
014ce1fedd281829c2e77b1143ccce1a132f064f67fed26c4b23785f195166c22f6c3b3567db95edf700ad33c82b6f020b0b5990f0f729b1b280691e952ae170

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo.png

Filesize
826B

MD5
cd19b42e28b788113de22fb3d5f496b2

SHA1
06018e23ed78185e8e994d37a9781b806b43b22e

SHA256
0ecb2fe5176347e6af2ec25ddfc2836736805e37746392154fdd243d5af9b118

SHA512
3375068adeed95fa04173cf5b7d65e0fdac91232c0d6012ea9f91a2cc4ea589f16c9616d7aa6f3fa1a326ea96230311f33ade69e5f49a6fe9b005c9ce72e5da3

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo_2x.png

Filesize
1KB

MD5
e6e8c3e12e91e473c231cedfc9b96fcf

SHA1
f48e79ab9c54f46484def6c0fc7464527ab8e82f

SHA256
727b7209d20dfe8ef02c2d73aeb4cb5f3e7df612ce9c7f33871ff3511daafd24

SHA512
3965ee6e24b8c8fb7cd7018eca454e6bd96fce9ccbcc869b4145f280bd0037632e699462375051e557d9dc9600f9771622715828a01ae02093a66b05c5f1de4c

Download Submit
C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB_EURO.txt

Filesize
32KB

MD5
8bc70709a0c905217c08d6a012d4859b

SHA1
d984d6ccd5814d71ad84702420cb4a517db0fcd8

SHA256
30b029fc13757c184402745e87b66afe066d23c35fbc8c47bfeedf473fc68c91

SHA512
6ae484ad353ddba7fbd0cdcb954afbca0007bd6e069a547e4be664fb8ee5287af996febfb94a675d159f8b3d910e5b29b18802afdda7dc0ec78a826528fdb7cf

Download Submit
C:\Program Files\7-Zip\Lang\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt

Filesize
39B

MD5
1f2caf2ab718c2742e44d826b3fb57d4

SHA1
ed7a1dbcff393da891b99d628803856e288af595

SHA256
12c0b9521d25b699e8387295577c2afea766c3af6aa4bb091223cb9a466f7512

SHA512
879e46147070c5ce4e7b8a0a8cb2f19a205573c71c4920787d4f1a9968945e8cd27f327383341effbc87974c2abec319105451670c40a60aacc30a31140e8a11

Download Submit
C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif

Filesize
153B

MD5
46afad398683be92e87b27d53ce2d221

SHA1
4d35c623735cdc88c30aac1fc515c9124ef35fa1

SHA256
10436778690a5d7ea34f4e2d6e85024fcb0fd6a3ec8104095d9ce5c06855d706

SHA512
9abfe32eba2fce9b1da4bc5548b805efcb6059e377af73aafc1e9905333f030409858eb0eab3c925192eebbbb314edb9da530f9bdc7517ae89aa4643577ef3de

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt

Filesize
190B

MD5
d2ae45c33b8900148842ea5061c7bcdb

SHA1
14f61d2e365c1c78fa0aaa38e5d2a837430e832f

SHA256
26e463a89756270c58581a89f2495fd1a6b6eebf51531fdf8e4f9f0c3d65d50e

SHA512
4fa71586153c97a53fb7d025af2a4426faaa03042359e45f917e1156af799150c2a5375b695485d9362bd30a016b2a6a9e39b1e6936f633e1e380aec8620e804

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt

Filesize
190B

MD5
753c1ee86abb4e4eb239293b8fcec267

SHA1
d95d85a6ae05584f4e68f19a88cc9bec3d51839b

SHA256
1724ad061ee4b38b2b6af2855cd7949ddee9960d16cdbe2f5333fa2d2cfaafd1

SHA512
bc86148be34c1af2c49a0c0baee9c1bed8d85576a72af279b0c48618bd8399b3f5b166ef363c93aff30e5100869e71d23e3b1dfe2b0dbaa5b0e68663c28ced44

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md

Filesize
1KB

MD5
7f26474cccf7e4e5c040d9d48233ec17

SHA1
3d044e5fa48fa34e0032378bbd0703e1bf29943f

SHA256
771dd054b44838866e57007c9da27b84ebdf071ec9c14f6979f833887494c32d

SHA512
70f20a8bdf6a27ed98dbe335272477f38cd79808ed00198999b58f76989a83db5026c24e00e295a0144d9319b0cef335fa76bf117d72fd43fd9ac075dcf6b26c

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\glib.md

Filesize
31KB

MD5
209350a157c7134ad1623e8289de2fcf

SHA1
91f0790b064ee59b059dfa78055fc89b985236d1

SHA256
db55fc9a1f725ff698845ab9cebd2b2f9dc25e7783d04b94072d4f433e9dec8a

SHA512
a362fa0aeb4c8f9b1c7f9c34a5ff045d5726c7599e9fdfad13d4cf131a4a8892462095c3e0161bb29f1dc5aed96b30c4f4feb5f334709c753a733b12776bad6b

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md

Filesize
34KB

MD5
fa252d71419475cc2b08ace683c61bf7

SHA1
d1f1d07ef6720b8b9d1643144dcce6e579cbd8f4

SHA256
1ce9dfd0ef34ad7ebefaf8d08256d41b8b451f06f2c0eb14f1819e3e9481ae53

SHA512
6d87c24878816129dda07b5dc7d51ed9aff666317083a54c6bb8c24bd13bed883839dee8d39db8d9d7643063d10f6c7924f97f146797b9120f5935c9e4091458

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md

Filesize
23KB

MD5
fd513f5483d53be6fef4bb693b044f65

SHA1
3ef7e2cce7f5193a52101b3c74f3c7ef7e1b832e

SHA256
efc4462d37c86f04a77839d374c05d9ef3d25c3a539aa273402e21355513fa45

SHA512
5ee0254506e9f21f6feff073425accd2a7716c788c4ad4713f075b5a0b07d0e31586f2422d852b0be26d05eb33690d4b40b18878ab41489eb6a4932c1ef9d5d3

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md

Filesize
2KB

MD5
5909518b283103f288e16f66996f602a

SHA1
c2cc15518391c1198153a782b4c057fedd4bc464

SHA256
7c180a3b99bd70e0e31890202e835a76a7d1890c2c365bd7a2334d2269c578da

SHA512
f7c810106289af813e4f3d0c04af4f7a655ab03ca04dd08d6520f57de417a6e5b99b46c071726e175bdeb3f14b4ec341a6af07cd10fd250d0f9444147e7e7052

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md

Filesize
1KB

MD5
527eed19be736910a2346e403c481fea

SHA1
99429051a67c2115c2c28a8bf6e25dc4cf9e546b

SHA256
933b3625ccbf72cd1e1d988ce3afef63145cca5be0e92e6978f29de9dccb6e48

SHA512
99f7178f8f241836a675b2606750d297c35a5b46d66d7d3a49382e3cb94811ce128caf18ca540b035d7786a577dcc69e24de1a3f26f32c66265213b6d1b8f69d

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md

Filesize
3KB

MD5
1b1ae4d20daee667b0860b5ab93930b7

SHA1
f8c90fc625af1ec6a99039dbee4b2c8edd6ada2c

SHA256
194003715f0a1d8b032193dba1a25f27b9bfc6d295d3254d58ded29c4c2a7d7c

SHA512
254c2e28171c3d3839ffca39b61e17706cbb27f5c94e16b462e0eda9866f933287e3ca8cfd9b6127e9a80a7a4267aed943520ffb5f32f6080287ec88788620d4

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md

Filesize
2KB

MD5
afb46f0ad9bbbe63a08ef0a3b4e73806

SHA1
83420d045588011096e25b658b1708d89da9324c

SHA256
d6c3f1971c6e151104a3a0b23b5e81734fe5744b09f825d9740274a3fc1130a3

SHA512
155ca084fb49444e266254b534eeec38a3a4aec1edd32ba36b0f041691cc2b895873b2162b3d30c606a11fda53692249239caedd301e5779d1661f1ef4b59308

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md

Filesize
5KB

MD5
c174c7b3e49d45eb4c3539c3a6b14db4

SHA1
e765734d0f2fb76f415d8058b47cfe19c53fbe5c

SHA256
04919a6ec3924e7061106c6b366a44232af7b1420fcc0bd01766ba23319a5cba

SHA512
51aed3c6f22190d05bd837d3f86d58572d93db41463133523a3ec39d6a208228e339457d9c96fd9f0695d35fbc8c09644ae5e693d66e1d2fa19a023e7a53c9bb

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\public_suffix.md

Filesize
17KB

MD5
156a84f0db214835cd68aaef67a320fe

SHA1
767d30f32b54c506155652d9e876c15f19efe087

SHA256
5e74dc44c09ced44914bc58fdaefa6e1d1ac766d75c153be8a5bb2a1a21bc38e

SHA512
ff2f27e0142beba9df11c9f96ad6e097f33fea2e1de33f1fff1efd39a7f4aee06f722a1611507dbef1b91ee0daa683836ddc0b46ccad5f6762d01eaeff5e3111

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md

Filesize
320KB

MD5
e5ccb8074efc3417fa81733a55c9d5fd

SHA1
5c4244eecc8fb0c3d04dbfe66dd53d61281a461c

SHA256
c0654b4bf9609048e6f1f23cf811faf310059318a126192b5344a8c8b51a283a

SHA512
95d761ee0a2ec96efc21a4e8f02670c9fb3e4c316b3f5b920c7f108adbf447e79229ac1780416554533eae0d638fab5662f75a64cde5fa2119b26cc2e370c6f3

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\asm.md.EnCiPhErEd

Filesize
1KB

MD5
5d760d784b57cb30d61d28948512e65c

SHA1
cb9ac4eaf1c3749211974870f9fd98a44dfe7b54

SHA256
891a4b11c550040444431cb7d78759236074c2f4705bd5867388ed21de38f6d7

SHA512
c59f8674da3a0b875438ea737ca840d44e578118f2dcbfb28b0d0d32aeb2b9222500c902904ec467c65674896f6fe2a790db0b43f3e465259f69634437dd2493

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md

Filesize
10KB

MD5
b68b7e5c5e5e88c5f23a2f1c6c1831d5

SHA1
43d33b058034b131e45af5cb99b49b3800ee628d

SHA256
0d72288f2401b2d1415c416f9031e4edd1866fb474be3246826dbd80e0a8bc37

SHA512
912e5b61bcde4b1b3391fddf0c4b2d1500986b6110a93d33cde489c83e5293c3245304f3fd900cf9a882dc2dd9b03310f49dc656eb17416c831ba2ed48d62285

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md

Filesize
3KB

MD5
1ee48332ae1e625643649f5f421f67b5

SHA1
2eb3a77caf6f1f54be3cb91fedc920a1445e14d9

SHA256
7db666cbcc6f9cb915e8e9a7477b0bb8fa552dc43c91990611a4b2f992fbf40b

SHA512
cf182961cc208c1fb22350e488e8780367bbce73d5a096c5af06a0dbf5834c4dee6d51759c904f1be20aff333f8c82df9891fd792ae3d40bbb7e5c36fa3c1ab7

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md

Filesize
162B

MD5
f4b1ef719a62623d205d08d6b483f353

SHA1
4faf38733056b36da7815bb0cd538b9e2127b8f9

SHA256
3a1573537679d07f451b6939ccd754121417d6fb84a735e04b12a5ea5afedb09

SHA512
869c37222ce101c2f9800a9f09b539ea01b1be8a94aacf553fa1b20d2b4e5e6d06200f61c0a8f47edd0202d463725ef1b65c52bfb6c5c799d959a5f0836dba6e

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md

Filesize
1KB

MD5
9cedb2f11a1e9fa792a76490cdcaeb40

SHA1
084fbb1d1b46a7dae8d063c28afced9b3e35d2ac

SHA256
7122b8b1a0ef6ca0da7f06addc8da9b1550c132ce93723ddb0f6360df2ceafef

SHA512
3f9c89c384c4a886398edce4be921d4bd044e62804a7c0c3b1e7233c72fa46fb7ab8dc8f2f49701a2fea9c4da6627b8d4b9a832e04625bbd61f8a689ed59febd

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\dom.md

Filesize
3KB

MD5
d78a4dec8efe66d90eaf6f397aca778b

SHA1
47ab5cbd89fe6b8d990844dc1f3871ab37f78497

SHA256
eac55606afd1f6d1dfdddee61480ee78742516c43745fc046a014eefe0db713f

SHA512
8d85c0ea7b2b0648462cc8630ebf6b0dcf055cc6ff8889a50ac16e8057e074d0f3358603f412ba1a3a2bce5c642b1764ac4bd8b03be05825afe55a5eaec56425

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md

Filesize
1KB

MD5
58f97edc76d9d12c04854aff92aa37b7

SHA1
081766c6a8dd0d4380a79cf3adea557b7026c090

SHA256
db1f0c980920f139a2216096a343906f77409ab286951722dcaf5961e9ef5251

SHA512
ea3c151c9ce229aafb7c63c107b0904e99c27a7c58ca648015a747854578931068b7abcf938f8ac97f92fcc1e8c440bd736d47711499f87e6883d243ac07a4a1

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md

Filesize
28KB

MD5
66af2d8151235ed9663f2c4b134b5f86

SHA1
cf94bff6865a89dea4a1bbcbecd7f0f985a17610

SHA256
3f03323a80579ec33be726fb9747d8a90a574588d9bf4bc36f8f3fa1a08c54ff

SHA512
6f4d9c48ade5d748f72f28321effa78443f2021fbcfcc4d1496c0453ebfd1801e8059b3981831af29ab8f3da0633061f64c60c732307e40d31029cf003eda777

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md

Filesize
2KB

MD5
926feec6a2b34f7a53e12230eaa00441

SHA1
5dfb26b29294a725d4537fa3c7912b21861b0901

SHA256
a901f370af74d795a3066767f60679833044d0526ac8a05dbfa9b6731d2a2265

SHA512
7f2c364d71b11d84e4ed9c3ed34fa5ebefd04541afec6e1061cccc3c022ec7f289157f5d183259dd0e9da466b91035fc782c3e8286f5684e2db4f5c491e18d8d

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md

Filesize
1KB

MD5
06b48990570d1a23ac8f0771e8ce1e34

SHA1
f67b31afd093bd91fd4d71068387fb750df33624

SHA256
7f529ce6efca24b0bb3469379127f46d6f2b3ac6eacfd39b98b0a93a41d5cdcb

SHA512
dae0146ab840f6a5749ea51175bb4364220a2bde5d461fd8c33a9acad386c9bd7b931e5a97f30ad7cd9d295abd823a2dd036225bea2a3ba2b03bc111a5de3012

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\icu.md

Filesize
2KB

MD5
25fb7c83b0866e2fc2d68af273fbd8a7

SHA1
f6174056183955c18a6a8e43cf4008d3e43e91cb

SHA256
c79c63b44e37d76f514a338fc81dacd0a24560374c326bdbc5287b644be70f3c

SHA512
4d8345e091e8d5a80033f6357c40022f910f17614911c050d6d5b5db50a5e5674b5ca11a329d56972dfb28edd7814e783882ecc6418aa2279a5f5c6161e2c620

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md

Filesize
1KB

MD5
b58b483705d5ee7b5001c9076914937d

SHA1
ecce9987305d25ccbf8f25478630e90767906578

SHA256
e0620b73698d2aba4d9be24e40f9a31c14ed54582167ba7f1895c211beb7c024

SHA512
37a765526795aaf1e6e542940f4b710ade44c2e32a172885469204e009e44d092d5b2e9ff62f258c8227a1dd75b60f6a687c60550db853fe71efe97fa4d6f042

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\joni.md

Filesize
1KB

MD5
11853924b8efccce00b05aa937eaa2ef

SHA1
07808192628eed949a13ce2ab47ac001071b46dc

SHA256
2c00e0adac34d3e54fa51f2e58ef01d917de9e1bbdbfd31e9c09c5c437af624f

SHA512
a54ebd1dc7697d54442840e360e2b0ccc0ca0288f46d80ef0ba969da789d7c363467f95f91959425e37f4b7a3eafe010e73fd9752eaa4601027b4d75abedbd68

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md

Filesize
1KB

MD5
457e0b920ad4e9b67f09716ab22b393f

SHA1
9704d16753b4ec4471e272c3ef7f881051196f03

SHA256
c02a2feea141f73daea80e5f5b2d50dad835f227fbd0305b25e401fdff16cdda

SHA512
34e29d3b32d8298cadeaac983b250e829d460e9d3ac0b6c549435f5f87957031c50b278fe6f4fed5777a29cc7c0e43c9c17732fd4d4e2dc578c7c47fe4f8793f

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md

Filesize
3KB

MD5
039f51385405f01db21e2fc8166c3287

SHA1
5d1f947919414e466c11690a23c9a3348083d34f

SHA256
d76520d64ed3cb4e7cb239200e96837aada1b9ce2dca78cfe560e73f37bd997f

SHA512
efb76de75fa8a73abfabd5db947821da8f6c8ebc33ea89b5f883dac8c4cf5b6d21d48e90b863983f1e55798a6f34f7257d43bb9b1bf7e9053a6b215a57dd86d6

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md

Filesize
2KB

MD5
ea124b08810fe4df02494212f9abd530

SHA1
6664339096946f2aad8b7b65f455601e42a53950

SHA256
8e10faae6b6de3c480cfb2a1dfe7422d803d88ddd9be98b5a58b4ba05b0c0758

SHA512
7b2d21d5b70d90bf4bb484c2b50476b234ad89dfc6f37f5afe24a755ff2f29a0a368c455ba6acc39d5d86e09b157da427b63379bcf29db1ae11136e7edb792f4

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\libpng.md

Filesize
6KB

MD5
3b83bc22869047ebc1718ce5a5237091

SHA1
4fb8680293bfbae5042241a13cafc2c54eaac2f5

SHA256
509342587e728042836a05e8e44cf2fac1ea8daddce1f66cd7224aeb43165dfb

SHA512
e9a7a5f275d84684bf8c37741444a218b302995e3eea8e677d516d747ac7a4532f7fbbe3017671688f81e7d4877bf6c2c7983f9877e27a99257860ab2d038622

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md

Filesize
5KB

MD5
95035cef7f88a69f8f507d308d3ee925

SHA1
46da80d653a1338dd65b4b89c3535041d8647502

SHA256
39b453b22eff5ca4b5aec0a71c617941e041ab9cea7fc42ebd0051418f99c664

SHA512
c80e760d7e74fd189f1e973fa927a0a37be815c5ffc429f99fa3d60995f79ea85c95dd1b1de5ed769176e86c934c93135dc7575b7007b18c1e8a4ea05d981a6d

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md

Filesize
3KB

MD5
1378357ea7bfcaed072d6d3cbd554989

SHA1
f09cb80e79590811712a30ee607d2dad2728fdb2

SHA256
b971800f3ed7ec4823fc4be205cd4026ed11bfe180fd727ff381de12786097f8

SHA512
9eb2e08ee4bccc138df567ba0ff61d1988945b6acd9afa6a9f28917016a875d612b232ac59e9198098f679690ec13d0b6eb5c8a0b5f78f8cedfd08883bb69d52

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md

Filesize
2KB

MD5
3edfc0867786e30e7ccf7d99ca0cb073

SHA1
62df22df66243e454d935243f5d1073f0e10cba8

SHA256
71bbc17cf98c098c740c204fb09afe1a07add20592c32d398ec2c849b993bed1

SHA512
481d4c71bf423503d62715d0d612b00d8baef55be229fb8bfb399180e9fa1a6c9d6bba6e731393c8fba9cb344a54caa04532b5702bf575c39182cb475c078dee

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md

Filesize
2KB

MD5
6661eca508a4d2b83e71ae8047992138

SHA1
7eb6ef1688328d2e4f1e395d4aa0388bb5b95dec

SHA256
dc23c510c43f2f3744c726b21a28e1a1b7fdae27fe2eee26dc78e9b02ff9e5bf

SHA512
14f87f8d06abb23056d98d26d0dae3edd768b0e9e872d448f09f478002099945b9cfa3fe91758db084198f623edfa418e5c4da33351297d46de256ff15b2541f

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md

Filesize
1KB

MD5
4844f4cf32ebb3d1281cc6a6e6dae299

SHA1
131ba868e54f2ba8219d29229f48140412209f71

SHA256
f52289fc579b43a0bd19afd0f83a7c8a6900637c7fcb11cceeff482dfbd37258

SHA512
4ea5b7d4d81774b83f889782180efa6df07c1d3c0e38f0f2a817a91818755715e872ebac9694c4c455d87c81b5794dea3da60242551d6ace2c5581d5290571d4

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md

Filesize
1KB

MD5
7d29d55eabe9b4633da3da551b58d3d2

SHA1
a0df0ab051c07a3e15c35fe93abd0038f4774382

SHA256
62c241fa15654b1c7bf9de33108a605ecd7c09d82c57f77ea7035564c5ea1505

SHA512
cf0b21bc34231f39ddbbe42127e9193cc7affbe21bcd68ea224e30996654330ce69e6d9abafe8cf4600e532c34756eb1dfb3a821faa9a120da25c1c17d902418

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md

Filesize
11KB

MD5
1ab679b3aa5b6893f4b0320b946fdbff

SHA1
82b7addb5533d1ae88bb9774325a98980f9235b3

SHA256
32c0b70e11d8fd9dee198c87e3abb1cdf34c25abfb405c9a279e660564df0c5c

SHA512
a080f25a72bd0c9228d6ff8628d33d2e74fe8309e1e6e661c09abc3e5981ac07472afc77f0b52eb3b3cbe72c849f857f84e02571e8449cec099b28d5d15fe722

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md

Filesize
1KB

MD5
7905b4d829759cae37f7d1ffabeaeedc

SHA1
15fe9b145f0b20efab83d51f55fded5d590c8c24

SHA256
9d5b23a73baf23480b81c45533e8fbae254c69df2a5b58566c7186470670ecaa

SHA512
1add5c675df8de4b32beb29dd77a36f6f566a1930ad4588f54a9b08dbff50cb165b36b0055211ab7516d8db60e3e6aefd261c36fcdc721843351d24ebc4daf59

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md

Filesize
2KB

MD5
8f1d43279067d1d908cc72cfffe038cf

SHA1
9fb57ad8f3f0dec75f26d9c95ce919e2b4b36b09

SHA256
833753141f1202f9baa449cfe3e59e9044f532134089f946e8f80cb17156e81c

SHA512
31b86579db48b2fd8e5df04248372b81e674490fa73dee0d14e8547fad33b627570129906ae993d17dff55457050f3902c9e6b651297a8f6ed76fd12315abdb2

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md

Filesize
11KB

MD5
d85434f1ec089e738c700393cee4449d

SHA1
c268cd7a27f04f8a64f009ab6278aff40dc3b520

SHA256
155f8cfeac7b1bb2124ccb4184b37c56533e3dbf20cf3c11d37d42337aaa6911

SHA512
551d4720e16c3ac3b95647fbd97e0636118e36e8bbad775bbb4eaed9bc738b4413bc6af2e8fdd05c8fadd2bc9d96c16964632dec8018837b23a2505e32c468d5

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md

Filesize
11KB

MD5
2916244ea84ff3ea41c824ea647f9275

SHA1
072bc3d483a6763978c0773f8067d16fb92231af

SHA256
16286137e3c70a5e95b3ceef7032aca3cf3558ff84a64f69dc5577fb29cc7a39

SHA512
ebe0171084f67c0aa96b48aa1b48ee8c6bfb0f17166d11c17fd93e29eb45037302b09c71f6da9a898ac475e17f1eba0b68c8c5a5132a9b82585d40c1c72817a9

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md

Filesize
11KB

MD5
8f186b1c62f501df0028414a8fd5e5ea

SHA1
56c1e29afe5211d359e0689a35cfd49c38956ef8

SHA256
d2961dc58cf35245d869ac6041716ac1d5ca118dc2ae89969488103529275611

SHA512
327bd4c57f89b9c1ff6b3e7775fa298ff7ed35af4dbe71ed759ca26b979fa37a54f80e255b22b7d0f9b22d197b5daf81dbc174be5210b19e701347a1e0578ada

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md

Filesize
1011B

MD5
e762a330e6b3899f38c16a4fa644ac02

SHA1
20100d8f2f50f822e72979b024031575448ff9b4

SHA256
a091ba721c3fc9adf0c70d32f0fda54df04cb7abcd68e23d0a9a4bcc8e3431b3

SHA512
8f55acd5299369bafe50b3bee0675558cfc2f460009dd2bd4f5df73d5bb987be43a09e6a6a2692501a5aa237140c617163336053f81f39fd1599d8071143cb6a

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727656060295712.txt

Filesize
77KB

MD5
36086617b3a568c11d57b0b209b4de97

SHA1
664f7fb80a2cc642164352584a3590a68ebda469

SHA256
61c09e71b72f955eae7da116f96fbcf74fd2c8a9d8b417a630f3107fd19a758f

SHA512
3591a7d40fc578fc20840884bbe9e1de98ec930229aed0725473077415da2a1b8f05e1de218e6d0aa8f383c7fcb512a7cf509bf421a9ae2ed5376a15d62e9fdf

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727656525478361.txt

Filesize
47KB

MD5
029cd820b17da7ac0ea995969cdd4d85

SHA1
b614276555b7c4a2a1b27616f64d8c3dd4dee1a6

SHA256
99fd05fbc7610d0e266e421e1a531dc98aac46d9f34543ca770e6cb9ee86bad8

SHA512
c6cb59406a17ef6d81d0a77c1ba6bbb9bf7ff6eebd4dadb9d8828de9d85fb0fb40c90d27daf8f6e1cbef53e9c019980337fdf40cde90a851973efadd30e72d3f

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727663169040966.txt

Filesize
63KB

MD5
9cada8cdc439a31f71babdf87d65bbf8

SHA1
ec438e710d2990bc71e94ba9cd6f39a63d96fef1

SHA256
ffc2e6a8dedc0cd9cccd4b1d7c9b07a4e73550deac4463e751ce79584821a297

SHA512
f22c97c6bda6feb72ab4a91db6374c4ea061abd18ba2b153ef46b9cd20f0ac847922389421573e87b9b543a7dc32dab676a1f1b7460026cfde0a49888f5a03d4

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727665885684530.txt

Filesize
74KB

MD5
bc282c9a82abc7b95dd8f9363035883a

SHA1
fd8c053d9bac7f9ef2607da4b865714c1b05a2a9

SHA256
01dc55e3e4da8c2e51b1e0e64abd522218dbf64886deff78a04f140af93d6c9b

SHA512
3dd164341d67abe146a3463bda54cf0d168f24d0ce612935d6eddb9f6f704b5684a2ebd8e513b07342095f58c73564446b1d469281283ee500735d62c66fd7b5

Download Submit
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\File Explorer.lnk

Filesize
407B

MD5
b9db9300093c0fe52028988e18bab213

SHA1
e0460d3cfe276143e07c3bcf922a60f0a1189585

SHA256
6c538380b5e6e7f58144fbba9b518d712e9dcdd9aa701d909621c19be8c8980f

SHA512
ee3c6b4990fb1c12016fc312561dc31c264338e3cc50f8aa536ed07f69d0f254a0ff8c51015ae60c1dedabec83d98f8887c43eb527adca35e91406b64f782d62

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg

Filesize
21KB

MD5
377c90c351e6ea949a9981bef4965117

SHA1
eb2c3c7cebf6adf9a81b8b39d444506ca9cd6d17

SHA256
0f73c91b0a4f0285b94ad4a5ef0cba0a7780d93110a24ca9d01e1826a6ba55ea

SHA512
db36eb4522c7509ac6ef4d2162b02052261c0b098c477d9a674801f80f27b6c6b3b4d43b47cde5f08cf83fcb4bd204446eab71ed9845ce38faf0da23fa099e37

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\HelpIcon_solid.gif

Filesize
1KB

MD5
89bf51228fc64ed6fc6000b289719702

SHA1
78e86fab6c0f927a9b67f0d46a8967098ee632de

SHA256
701f638f6cba6999f971940f110f04c584970e6c315ffd6704fdb3a8cd7a21ee

SHA512
2eaa05cefe54b7118b7f74f65dd1e664c75c42eda4ff931047eeb2153b4ca907b1f881c27c455817e9812ac6aab98606e934b02e0f1053db2161bb0e156c1642

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\alert_lrg.gif

Filesize
952B

MD5
7d6a9fef61f06c0cf1f96a5009f84a8d

SHA1
80498d6b18071bf6546242a074e676df1860a064

SHA256
9d93e4432470269198ab7987f0a1fcbeceedbcbea435837d1eabde12aba691c4

SHA512
ba5fce9ef98b5573c0e6600faff8d5eea88d545158eb6289ee5df1dfd4400b3ba964b8a7b2ab999d50a77f8c63125158f41f89c28e27f4efb0368ba4fae72ec3

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\aspx_file.gif

Filesize
121B

MD5
f666960b7da305adfaf6de0ace2c4eba

SHA1
92c8085f36a8db2a9b8ac9522772e89bf013f2b1

SHA256
ff4169fd3f604d60eeeed3df3699ac9997b34faa5fed7e3e2c963307686d052a

SHA512
edda18e4c2dbf2683c518c0558a46bbd937309daacc4af426f7303df0ae6cf52c7e384187d74ea6d4f768cb125258b455743d0c5e12f0934abec16f0622fb722

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\branding_Full2.gif

Filesize
1KB

MD5
b30d4c8c65a8ee3b11abc62f6c99fcb7

SHA1
5f455cb96350d075890fb5f4b9ec2afee5900f3e

SHA256
04043aa01ae454fb4d20ae750b264265ece239bd9b6c0e46d23e0c86edb850cf

SHA512
bb4951334c1a311d7b7c27a1ad2eb4d244ebd753ee0f61d0250fa5cd1b96b681b7cd5f086d87badade5364375ab4267ddfe7b8c4617f790108123bcdc3fde406

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg

Filesize
8KB

MD5
de7fa27933bfa601bd542d2f101e81c5

SHA1
6c194249bb9815665c1a8b32073e103457faaf03

SHA256
3733ee81f43ec757b5c5ba385d14fb22091f9c9fc3c30152cb5017c35464d135

SHA512
f1e0992f93e7ded8220d4b569c3bb56ad3d39c6c1098f1229cbe0c7eebfed9b1e0b0ef9e9125887ce8ee24334571dac89056365e49385b9de1d6f4a19f298f9b

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\folder.gif

Filesize
914B

MD5
aeeeb7baf8594dac21acdc5872db2027

SHA1
43d1b8accefbee26197297bb2dd88c2b88f0ac49

SHA256
098ab36a93d71f2249bb6a51486d0c3e367e73fc1ce9265fd22819422167a898

SHA512
52dcfb509885c70261dd31e40ef3ca5b52e333dbeb0c995e626fb02c242c483bafaf600832b9e9a67242f075a6a5dbe8a08dd2c3b554c2c8999f38dc63099396

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\headerGRADIENT_Tall.gif

Filesize
328B

MD5
9744532d9694d5cdc77094a2cf42176c

SHA1
c7ff4db996f660f21702927f5aa4074d985b72b5

SHA256
077a33a01fcb9fa2d6884258fbbe9a5e5664d0de11d276585e8ea48ce53e837e

SHA512
dd63b1f6c61007b0f598d3c66e296eebd6092161ed75b69a6a9996ffa743db1ac50e75a327970225d0913f7d7408e64ec5c20d2795195b1f274532284d6123af

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\help.jpg

Filesize
1KB

MD5
555af5cef5d1d1011c7e4752a68acf08

SHA1
ea56e08af12163005c434ed2c2a9786f3416ac5c

SHA256
7e82b1ab43e578a8085876af971de066157f44bef7cab75d67c133739fbb222e

SHA512
6f4a9fea2e26746357b643875c7b6061bd62523ec2aa721468a5ff89b7a244b0b7c516e3f575e0965a51f6e31f19783ff9bf0d0265f546ae77e1ae5e8b771bf3

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\image1.gif

Filesize
162B

MD5
600169bec81ce830cfff940083032e22

SHA1
0f35c61322ab78d0ce520f58f02e6434ca730d9e

SHA256
1c7ac6281548f57a28f3aa55aaff75027f7a50f92c4d63cd3a6ade6c4e55fd88

SHA512
1b76b59fb6abd6ede628d0956ea3413266e8c086185b698a365f75a155577adcf48b08a13f7fab5c3f2291a89da64fcd2ccf0b5b58a0599b10e8e46937f0a3a7

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\image2.gif

Filesize
586B

MD5
0d66c68e4e7131a0f34a8f4a93cdcf6a

SHA1
47a3fee349f0db5ef1ed685e291308e68d8fcda8

SHA256
e0424b47f0c1cb516f6d64e24b6e1be6b0efa80e732068ed88f54b37575f758b

SHA512
dcd760b7518a2810431a1a8b29b415d19918deaa73a14a63716befbec550f32d08dcf6812501b4ffcd3be65775732cacd5c0bd4224842c554ebf33a5ecee3bb3

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\requiredBang.gif

Filesize
124B

MD5
98f96bcf98cf38198b4255be7003df21

SHA1
5d702439236ad37520f31e2ffa99c5720a828067

SHA256
41202b996ef4bc28e1850fb4d83bd7203cb32820c9e7df352acdb6fd7536c6c6

SHA512
46fa74c12dcb7387fddf6e6318d6582ca031e8edb790588fdd4da91ac71bffe5fe827c116a25e445f8fec89451b5214f769a64820aba9d63482a8682ffada68b

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg

Filesize
8KB

MD5
f065f64fd4be5e145297a7e9f38acfa9

SHA1
40b183bd63d9e566192e9d16a6d587599d59295b

SHA256
4068a45c950a6d44cf7f337d8dd2ca05ec786d7e4103ced1a4771eda2b56f997

SHA512
88452f43b400da8204d824f3c47106abb96ca3fafde08ec6ab8d5709a3bc1e1bd96afce21fbcd7ac475107a73bf7d8f4b0c0c33dc7155983c0b82069c9aa5f0b

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\yellowCORNER.gif

Filesize
880B

MD5
0751d2ad31bd973f4a2a212f6b3bf7a9

SHA1
eddbeb8b315924d121bdc2f467bdbfaa43effdd9

SHA256
f71562650c21c8e8a2548efb2dd7fc6de4edae41f4538f9f226af9273a41946f

SHA512
bff0663cbf015ec42604c0924e569cc9f05ceaec117dc0c6af977e8bd4a6d49ffaab0d3840e6e3f18ea8cd663d8c8b38d8c8d4973ea51edd9967d1c5330d569d

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group1\1 - Desktop.lnk

Filesize
1KB

MD5
8ac12d5c2dc2a60c8777b1aa3ae49c61

SHA1
92fcef260ce91e731be00054d6162c129cb329d7

SHA256
97ce1126b299b3c1b0bcc89568d9c1f548605ee7904acabf1154ebd1f9d83208

SHA512
dda8721236eb15c81322e6b54bd78400ca3fe77453929422319e753ff61bfb2917a5b84d287f23c688ae2346345cd59118277ddae8905eb31a45d58a16abfeaf

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\1 - Run.lnk

Filesize
1KB

MD5
91d69f4d0c2d27d8b7c3bef5b0d4b782

SHA1
36e9c8bd228fe8baae315d32d6476e8b33be772c

SHA256
2cecd86e9b11ce0450e1ef84bd6354ba8ee2b28556bb8ca4f731ae5b32e4f65c

SHA512
c63692659d42819c5262a0cb532eda0c639ab372e11e904fee991a753adc5075a4abd9c247f8e34a52a170c880d9cb77c6744852e29aebbfcd6f0f079d527153

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\2 - Search.lnk

Filesize
1KB

MD5
004dcc9bc7e2ed06a600f0d3c2f67577

SHA1
a6953816e16569a95f050051e95e6d03729b834e

SHA256
87c2c01a9bfb3fb3c48318bdd6a31a9ed750a27cfc0de93bebfdab96ae4b9a4f

SHA512
142b8777501d4bcec3cc9207482b56b1e15ffa20fb68c56a68006088738463e1337f43ed88484dcaa9d279404d27c068c0caa38265326f8161fea0059c6a5a95

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\3 - Windows Explorer.lnk

Filesize
1KB

MD5
81a58782c83e2cba1727ff7124a1f2ed

SHA1
120fa4eca8378c720b0857bdd1e1c573cf3a4703

SHA256
110c02a10bb10fdd1641f4039246b030e1cbef9164c9a309547ada7325ca5519

SHA512
55366e055b244d8e3c57598cd210832a8d9e582936cf69ba5fbd1e09e5d80e5986dd87bcbbbc52b5eec03e89273859c13608a96ce1c32db006f1fb4ba3791ebc

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\4 - Control Panel.lnk

Filesize
1KB

MD5
64ffb8aa0f8c3a23ddd8bc2bd658568e

SHA1
3d41283f7ca5be7e2a96724d0616ff3765f4201c

SHA256
ae3961872d416d5663332c8927b18719850167191adb5755d5d113e0e9d098b3

SHA512
c149282030dc9963d8915825abebe97e6fe07edd664ce643299d6ed5e1b7e4c7d0392d76a620ee58068782019ba4187eee4ad5d85991f0496e8390c59e9a054c

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\5 - Task Manager.lnk

Filesize
1021B

MD5
8cf96c6377a7aad5496eb6e7b136fe8b

SHA1
d337aceb837f1fb5c1e3cb26a711301d95190676

SHA256
5928ca9a464112e698065ca9efdf96fbe1c09d7359e7c19ae133a53017d65166

SHA512
cdfac8019d16cf9884dd3b0f210df25ec2252c2147f4f387201bd58c92d06869be5e8ab6d73f3b865d01d7ff0a9053b96158aa29a047c2c6995a8ab7fb6a35ae

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\01 - Command Prompt.lnk

Filesize
1015B

MD5
dcc806f47801c5fc7e3fb946a9b0c000

SHA1
2ae6bd324c1f87628731bddaebcadb8dcc597609

SHA256
cac31467690bcd7b73697a883ff4eb0c7b1a1141f76582a1074d8d8f8dca57ac

SHA512
b6a5995b832bdde45941777cc4e9b95e911694c9f22e1ef2e9f62e4d517ab3cb6eb5313432253092c59c979f7af8b21dbbc030ef4354168725b4b8d02db6f17e

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\01a - Windows PowerShell.lnk

Filesize
1KB

MD5
f23da7359ce1298a471c7e2eaf5c5e72

SHA1
2c18456351ce131f8b493b6354879c9d4f1db983

SHA256
dccc7d1856184c9348389644ec28e25dd9b07d8d5baaac31ef44d5beed7cd85e

SHA512
44884dbe906c87c58fd816d7f53b23b3e4b2926f3c4f3f4368679fa20060a2ec851144238e0d06f6dfc16d740c983fba96499b061c57855a45187f0199733da1

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\02 - Command Prompt.lnk

Filesize
1KB

MD5
7792b1f23e5049050415f254512db9c8

SHA1
16314a47cb80a5490af396214ff9544f56e0b7a9

SHA256
38e4b7111fef6261584c7c168ce9436d5633aa7e628d28b67bd3ba428b44c13d

SHA512
d41cda024031e6234ccddcefbc678f0d306c7ae29cc93eff46ef4ac371963cc1f77304e509bce00ef3c567a9c6c9d7e6d26e7c963d53c3177fd0dc61ca57d1a5

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\02a - Windows PowerShell.lnk

Filesize
1KB

MD5
351bc80605549903661254229e104db7

SHA1
baea6d00ad6a7c8d7203ec2bec86765e91540675

SHA256
13a8fb7df79454051e6aa901e550adc453d492e0b5dc9dd631d15ada78f47d5b

SHA512
f8f124e20fdd618fea1bc228c4b2ef650131778aab6101f9b43caae05f114fc4dcdbe5be8cb93fb3d7ec47d1966df65f14763df4c3241c9660906edc6d1eb07b

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\03 - Computer Management.lnk

Filesize
1015B

MD5
0008d6a02c936b2a83d6751c97d4f064

SHA1
2c89d198f2de03cb2a05804318a5e64c50a14798

SHA256
70656f0364b2f7ae2e47d083d168de4a31288f4487414f631042690ebb9bc931

SHA512
a19554ad02e6876faff29d5733e4b7986e1d2a0d750bfad4b2632ca2509dd8a66ed5598dfe3397e66b1e15f1aafa8e2ac9ae5652e922ce743a872211ab6d8abb

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\04 - Disk Management.lnk

Filesize
1015B

MD5
be786f068d60f11619ac0953ea51ebb4

SHA1
c30d34225c385e04ec3cb4e2f475c29dc999094b

SHA256
8577a7266d57e9bcaed34cd63107b2eeb31e207c17aba63aa3150f20cc0d3ccf

SHA512
9fec6cf9c1ccbac07c435e42dd98a2645c436e31288f0ee2ec93ae61d5822ee881b27651b8d9231d312b5363dd66c51c522974b061cef8ed49e662d070551daf

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\04-1 - NetworkStatus.lnk

Filesize
1KB

MD5
03522e7c03db4233be8635a9186f74dd

SHA1
97a1fdca82570b8d22719be3e7ef29db56e6b0ab

SHA256
8a7b28e6ea720fe5b05596793d4be6f87b96c843dfebdd67462fb2318fbb9636

SHA512
94421f98c53e96ff28528f330a4603165c5e35417a114434b44d000d9dcdf47b5a857c52ccb8ee2a2bffad81476fa3dfa2a6d8fc9ccb48b4d6f3c995b709b380

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\05 - Device Manager.lnk

Filesize
1KB

MD5
831fc73b2da09e470973745dd981fea2

SHA1
621d91fb368d5a1fd14af50a843b166f94ae38c5

SHA256
810590558b125d84a546c089ab9c6a66ad84d193ae90d8bdb9ea0ba07f67d22a

SHA512
e60d38817f3a79fa63505390a2e192d5d9ae596fc2abbd814308dca1335b2b6f97767783c194d1797dfa5357708eeee8036bdbaef3e547b1f3aeb8a98b36f0be

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\06 - SystemAbout.lnk

Filesize
1KB

MD5
c74519c17b9b96eb6327ad02055fe2b1

SHA1
00f4d0d3c321753b5b6cc4bd3b04a89c77fd263c

SHA256
954681d912efaa807f3f3464853996cce1b03b3e8c83610e06d9259ba443581d

SHA512
1580204ad450813ce20b3a22c5a87c1847e6525b9e28e0f6430e0865dd76b0a33fd7a72d31d67ea1d28cff390fcc4d0f86f5f24ce55db94bc2adb3704d4275ab

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\07 - Event Viewer.lnk

Filesize
1015B

MD5
f3b84fa55f31872613e59a8b85771b5f

SHA1
788c221f831b6f1049d5f3543948a28d840e2125

SHA256
5b990600892edc1734ffb1c7d6924dee7c54ca822b9d2691db622ed27590e8cd

SHA512
2671d41b269128c164c0fda2fc5342bc643294003cc917956552c3b66469b4a6977251c16e318170395d21534e9eb84100446ca65cc15e660755f03624152007

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\08 - PowerAndSleep.lnk

Filesize
1KB

MD5
95f02788b3b4cf0c84f43f16d5fe2754

SHA1
e64ddae14e93af9967459f42131176f1786ac41d

SHA256
393f09c75b357705208af34804fceac002720781437b9b7674d8028ac0a975bb

SHA512
f8884a131b1e7d0cec79a5a7087267651c12ea69a0f0523ca61c33459f4af48f0c242b91f47aa80a83ac15f40f5b8d5b3da2e448158d45aab5da72a56204a6ff

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\09 - Mobility Center.lnk

Filesize
1015B

MD5
d434c1ce5931c54e03a6c03d6150b6c9

SHA1
183643ece02098089dea9b158aeafb4a99ad0160

SHA256
2586734ca83a522ae6649ec98277b508b2ca4c1261addb46df6b3c7d92d4dff0

SHA512
ab790fa2218931f2ea22ec6084e8f0bac19492d34fd00886a99bff8da9967b3c3726888ff0abe7aff09230af523e43f3c76518c0020afe71177cb35fb834035c

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\10 - AppsAndFeatures.lnk

Filesize
1KB

MD5
5cde789e20e8a4c1752f5b32f371e802

SHA1
3414f4d5d78d687431fe2d475b83dd93e0bad1fd

SHA256
6834a62291ae264c698e2425a5ed1a363b6d06623e58c039bf8160becfcedefd

SHA512
cd48f2684db8021cdf33a8e38a001262a2a27af23820cd5654899fd2daa50af021c4ba2ab029f1d59f393702df74d6dd06bab152247a6edd0f70f781b3a7aa9b

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk

Filesize
352B

MD5
dfa2eeeb827d4342dafd08f378ad7966

SHA1
912e53ff700175fad8b14c03c5cc98c9bac5b510

SHA256
50641a1f9dd04b666c7e28b9ed354e7cc47f7548cf9c5f3282e1a97fdb878b81

SHA512
87d4d3878274bff03daac397919d5a6a97aa0d9e2f5ed20523ef9756d799fb2199a30420f042b5a2048d5dbfa7fbe338380804f4f9eb688d8765101edf8b227e

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk

Filesize
334B

MD5
d5b402fe5be182616aa2ce78b19a7602

SHA1
ce38043dabe16d5728080d0459d56421946fbf59

SHA256
9913d689801e2dcfa53f1936936fd4b41aa34ae9f4ba820e9e683ccbf9c73955

SHA512
8e046f1edc26fcb2020f82c0da40c09ce4ff14f23727465632469de617428d0c9c8b81380c8345bdb30328af3d92867e927d5bb640987e6a9ab1ea42dfbfebd6

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Magnify.lnk

Filesize
1KB

MD5
43003f07b810ef00fecd930e1d5c36f1

SHA1
2124104f6bcbf4b583172f2bb33a31dd58210179

SHA256
4d0686dc36b6f5bd2ca7db2950cf2b01fb49cde09e1e197bf4e29e12c8a2d41b

SHA512
b86387f098ee8ce44afe779faf4e8aec7c8237b10d26b2c307a8a4db886847404c859c4a83aa44bf23e47c90a571df2dc9d4f5405fcb1a35332093157773f066

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Narrator.lnk

Filesize
1KB

MD5
924c6b295a9ad6537cc295b94a07aaa7

SHA1
b575c3456b9c752fac951cb95bf11df66a5a52b9

SHA256
6b758a1607eb24a7bd7415a60e8d6650493a1d1015cf88d2cc6d7002869e3540

SHA512
b2343b6e3b5ca90d08b482dab48fe23bd90c25be6b63276f428a565dadb9307e56433d40dd589fb33682457b940076934a010cefefed4e2fa12b5876139514a5

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\On-Screen Keyboard.lnk

Filesize
1KB

MD5
c784faa65d5ce3cb28ae9de28f3f310e

SHA1
06cb1f087a2c53562f5f74ab942f10476ec33f1c

SHA256
46bc4911645fda978056b89d1344bd2af9c60ebabce083109521d2df630d2c8b

SHA512
bc7cf06d30f8fe6928a03b3bd5071b448c95e87519acce7989bdec07e355ab8a27bd0c5cdb2f7af96e487f300553642b56084c77637099cd48310efc10150d29

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Administrative Tools.lnk

Filesize
1KB

MD5
9dd98ab0942e7ce5e453abde9de37477

SHA1
125d09c1eeabec6783c2ba7bd2cbd0aa41aaffdf

SHA256
cb5e44627d530a359bced9b38d39d27442b2b36a3f14bc7ebf65a8cd0ac65c40

SHA512
d30213319aa04e6479cc4729faba9b836405623931f63ae4130163cc4d4f55a6409a4d08e21e19dab7f156e126f08ffb33dc9d89575af98d1e7284b1b06a1170

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Command Prompt.lnk

Filesize
1KB

MD5
3811b31ed4e3d9cbbfb26a47a7fad6cf

SHA1
9079b1d6ed657ec0b33d0a81f53082fb41baca71

SHA256
ca4d77d7e94d4a3e8dd2272238a142279857c7aa480a494e4611822564794d6b

SHA512
6a0959b5a9f766aa97e13d7012be14fcdf8ae4e2bbadcc59acf3948038f7bf366c8d4ede29508c7190e9fe96f51f557414b37726b680a074fcc9a8f8e895471c

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Control Panel.lnk

Filesize
405B

MD5
82e193b50dde09d4747197d366a62a90

SHA1
ee0fde3cb6786fe27c1326b66fae35259da86c55

SHA256
34c14399df8634644a286233f46b3453f24e5aa00b86f44835c36fff51e8a60b

SHA512
0e91b5f1eac28f05780f3a9dbbab41b2d5cc7e7a4e4ea0ea7059d4f8ff103636e8415e922d8cea70010337fac4b352b2b4db893b5ad70bfbea4c6f2bdf41d9b4

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Run.lnk

Filesize
409B

MD5
b16858d6944654c7b9a85c45d4ba7662

SHA1
83eaa55eacc6ff0f78c94f3cf0a8e56ed619a19b

SHA256
407d7d3ac18ec4905dad3e5fd3c2c3ca71fa4d6dc13adb8491836f1312c918e0

SHA512
7c124102b5ea81673625f533ce15734f2e9b13dbbf4f9c5a35b320ca7e303a614c79b410151efc272b15a4e30f76a5355ca05a09b7cf04e30597b8d951ffbf04

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\computer.lnk

Filesize
335B

MD5
bbac98716b9b8426e457d998eeead80d

SHA1
a16df5881078bd7206608ab0c6d44e30f8c6ed4a

SHA256
d54b58a5fe041640940fd36eb1c6ef099faf7f5e6469718c7408d813f1d22e17

SHA512
33a5221a87ea4eb843369ac92b31615c9a4aba9c6605346ae3b948de7af5726e1e8e6ae7fd2e39ee3a1997fcda79788fedcb33c0281a689a8f4efec2cd49adf1

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell (x86).lnk

Filesize
2KB

MD5
c528dbedd8b7754b5bc09f6e21dc6d29

SHA1
a3db8c3dac95971dda37288ff67d51f393a8f14c

SHA256
9467f8f16104a1613227ff32f66ff240150af75115b91fd2f10f918acfea31a0

SHA512
3ed3288dac845c3783c3f1fad551d6a1f75187a53b1f995b26c4718759c2ecf780de568da8e83d83507a793c31419dfbd3ee05021ebf470374881697e6657711

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk

Filesize
2KB

MD5
14ba428556167967452ea6275281eec8

SHA1
05c5e0e7fbf569d74b3e0b2980379081448c37d6

SHA256
905c0e38cb484c4956ee9d82f9984b7f44b6999485bb0428c931b47e1f436479

SHA512
02c26d5599e30a82b45b20fdac12bc1d5a0e538802902b52fe55548fe9a41a3d6b8e6b20ce96f04e24a36ce869375427230ffa08294eeb5de96d6bd3d045996f

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png

Filesize
296B

MD5
c30c0ec737f7d32f4c5991b0563b1d16

SHA1
cd6c6ce665690316d599d7bf4316552187b977ba

SHA256
bb6c764fc6e620d7f86489833d3c63943ca0ad0f9e3457cfdae6494ae5832cd8

SHA512
5a672fc6640679f40e31f3ee4f561ed9c9998dcd182e97e8ba199caa597ff661c6241dc7239dda906366df1c24989f18734ab59a76d151484a38bf931a06c9e5

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_contrast-white.png

Filesize
276B

MD5
7b23ffc76fb43a3d7c712984870600c0

SHA1
e604f3ed914b2035cd315a894cf039f8e0eaa2d7

SHA256
d6a74b1d166237b38236ac827a94d65d4f2c86f7298128c636b8b1c477b36f75

SHA512
ce4c1d484d140324d5c5e49e535c07abc06deb80078bd17332e765c3b3392452365a0d663d3fbd41053876fb4304a279205bb2a9ca93369ed0ac4d6af061c75f

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png

Filesize
296B

MD5
e6fc0a5375883c0040f886dc25826142

SHA1
3fef268b70e0d72bd49b364d3a77dcd00e99f16a

SHA256
6c2b3654648f30fadbec7c498b2e49c568999b032adc86918ccaf55e4a4db286

SHA512
93a09ee8679f746e600b1e8a48ffaf62587564cffd1eeae2b94bcd25f7f25679cffcd5227416d5875de1618dfea79ceef77e91ef7050a5294922f60af61f1328

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square44x44Logo.targetsize-44_contrast-white.png

Filesize
276B

MD5
c7e791263daeab6835e3f71b856f81f7

SHA1
882203b42d47b272d448d0ce9939ef45a7cb7abb

SHA256
da58583a197c7404e80fb6acc8be1164ad1b38135d2b150ef11ccef1719b8c4d

SHA512
19d9d0ada966e58b31ade5bfac46448af311104b400c60a28a9e8b729ec3a101ee898fd343fe8583e26cc9470c6a85f88b8fcd11cb6fd06c6f61c0345334fc10

Download Submit
C:\Windows\WinSxS\wow64_microsoft-windows-onedrive-setup_31bf3856ad364e35_10.0.19041.1_none_e585f901f9ce93e6\OneDrive.lnk

Filesize
1KB

MD5
ef1bfd0701bd92d87632734152fa381d

SHA1
4d7c790c320114bfb6e371910dfb8cd23a32e520

SHA256
acc2afed2e6657cd3e5896b3b8e25818e3bcef2e827eb27a908716614413b5e9

SHA512
ab31cc354a9773add66735836177fa2ea3008e46c6c009527c6435c205107d4ac21eab877a3277bd27006db35106e6cc8fbea351d1befce8af964b5bcb41cc05

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads