xorist | 4137f8c196fdd99a5cd64c518ed27c466953e37b78887954ea192b5595a0a076

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
25/11/2024, 12:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
Size 39KB
Sample241125-pqanbasrhq
SHA256 4137f8c196fdd99a5cd64c518ed27c466953e37b78887954ea192b5595a0a076
MD5 9b7eaffe4dffcbd06445d0b32785cdc8
SHA1 af992e2e6c045137b8220c60f534f80da968dd38
SHA512 3639fc1b3ccd57b6a61acecfce8030a7c2c634deb44b75345b5c69eb5cad03a8aecae781b950c254e35f4db248b5e9113fd06412f14ca7a90596985a282e123f
SSDEEP 768:BPXsWRbrIA8vxG/VZ0xcv+n9DfUEGC4ZC:B/s+HUxSZOcvI9DsE4ZC
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xorist discovery persistence ransomware spyware stealer upx

Malware Config

Signatures

Detected Xorist Ransomware 10 IoCs

resource	yara_rule
behavioral2/memory/396-9-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral2/memory/396-5141-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral2/memory/396-5482-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral2/memory/396-5513-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral2/memory/396-10080-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral2/memory/396-10963-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral2/memory/396-11298-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral2/memory/396-11303-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral2/memory/396-11308-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral2/memory/396-11310-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist

Xorist Ransomware
Xorist is a ransomware first seen in 2020.
ransomware xorist
Xorist family
xorist
Renames multiple (2183) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Drivers directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\fr-FR\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers\gmreadme.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\it-IT\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\ja-JP\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\de-DE\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\en-US\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\es-ES\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\uk-UA\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\RYiGElV1ZFlQ3US.exe"	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\FileRepository\mdmpace.inf_amd64_5e0fbd01da4f7c7b\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetworkTransition\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\WindowsDeveloperLicense\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmhandy.inf_amd64_d2feb24c2d3b69d4\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\printqueue.inf_amd64_12d9f43eb5d02987\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnms003.inf_amd64_0e2452f597790e95\Amd64\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Speech\SpeechUX\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\MMAgent\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\es-ES\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\b57nd60a.inf_amd64_77a731ab08be20a5\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\xboxgipsynthetic.inf_amd64_9aa94bcf077169a1\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\InstallShield\setupdir\002d\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Nui\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\MsDtc\it\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\btampm.inf_amd64_445ffdc4132cbc59\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\fr-FR\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\InstallShield\setupdir\0008\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\acpitime.inf_amd64_e1498a974ab95ea7\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmjf56e.inf_amd64_07bca0bfd5173050\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\xboxgip.inf_amd64_90ed6b3fdc759a5b\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ProcessResource\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Configuration\BaseRegistration\uk-UA\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmcpv.inf_amd64_906547002cc7c58e\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\nulhprs8.inf_amd64_e65ae5a38cb839e5\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\smartsamd.inf_amd64_2238284d493e89f4\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\ras\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_UserResource\fr-FR\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_dot4.inf_amd64_55905bb33692cd84\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ialpss2i_i2c_skl.inf_amd64_9d9dbb01837eba23\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\whyperkbd.inf_amd64_6c54f73a58d5fb2c\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\wbem\xml\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Archive\fr-FR\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_fshsm.inf_amd64_48c6ccb73844d3bb\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_netclient.inf_amd64_b7f9bb71730aaf1a\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\basicrender.inf_amd64_df49c4daa6251397\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netr28x.inf_amd64_5d63c7bcbf29107f\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\InstallShield\setupdir\001e\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\uk-UA\Licenses\OEM\Professional\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\en-US\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmwhql0.inf_amd64_db80a6e1be3a2d08\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\nete1e3e.inf_amd64_895623810c19146a\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_EnvironmentResource\ja-JP\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WaitForAny\de-DE\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\de-DE\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Bthprops\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Com\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netvf63a.inf_amd64_a090e6cfaf18cb5c\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnms003.inf_x86_360f6f3a7c4b3433\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\usbxhci.inf_amd64_6e228bfaadb050c6\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WaitForAny\es-ES\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\flpydisk.inf_amd64_acb1691126c93472\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\halextintclpiodma.inf_amd64_7f59f2c73a7fab14\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\lsi_sas3i.inf_amd64_79c7a4d8be0a9744\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\urschipidea.inf_amd64_78ad1c14e33df968\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wvmic_kvpexchange.inf_amd64_b3c17aa69dce1e0c\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_EnvironmentResource\en-US\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_cdrom.inf_amd64_f08f2fe1cde58aef\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_floppydisk.inf_amd64_bc7bd9dca28933ec\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmhaeu.inf_amd64_e0c209c891e162a4\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmnokia.inf_amd64_9be5ff0f15b15eb7\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\nett4x64.inf_amd64_54eacac1858c78ab\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\WindowsOptionalFeatureSet\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\XPSViewer\it-IT\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2784 set thread context of 396	2784	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe	82

UPX packed file 12 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/396-3-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral2/memory/396-7-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral2/memory/396-9-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral2/memory/396-5141-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral2/memory/396-5482-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral2/memory/396-5513-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral2/memory/396-10080-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral2/memory/396-10963-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral2/memory/396-11298-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral2/memory/396-11303-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral2/memory/396-11308-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral2/memory/396-11310-0x0000000000400000-0x000000000040C000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\s_close_h.png	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AlarmsSmallTile.contrast-black_scale-125.png	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNotePageSmallTile.scale-400.png	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteNewNoteSmallTile.scale-125.png	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-24_altform-lightunplated.png	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\en-ae\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Collections\contrast-black\LargeTile.scale-125_contrast-black.png	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\MobileScanCard_Dark.pdf	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\nl-nl\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-60_contrast-black.png	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-40_altform-unplated_contrast-high.png	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\Movie-TVStoreLogo.scale-125_contrast-black.png	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\202.png	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_BeforeEach_AfterEach.help.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Media Player\Media Renderer\DMR_48.png	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\WideTile.scale-125_contrast-white.png	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\ko-kr\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\VisualElements\LogoCanary.png	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MediumTile.scale-200_contrast-black.png	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-48_contrast-black.png	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\BadgeLogo.scale-150_contrast-black.png	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.contrast-white_targetsize-96.png	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailLargeTile.scale-200.png	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\sl-si\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSectionGroupLargeTile.scale-150.png	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\ringless_calls\Ringlesscalling_25more_360x120_2x.png	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\Assets\AppTiles\StoreMedTile.scale-200.png	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-80_altform-fullcolor.png	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailAppList.targetsize-96_altform-lightunplated.png	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\apple-touch-icon-114x114-precomposed.png	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\images\themeless\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Lighting\Light\Default.png	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-20_contrast-black.png	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Assets\ImagePlaceholderWhite.png	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\images\themes\dark\rhp_world_icon_hover_2x.png	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-cn.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\santuario.md	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PeopleAppList.targetsize-32_altform-lightunplated.png	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-72_altform-unplated.png	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\BadgeLogo.scale-100_contrast-black.png	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\RTL\contrast-white\MedTile.scale-100.png	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_highlight-soft_100_eeeeee_1x100.png	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\AppPackageSmallTile.scale-150.png	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-16_altform-unplated_contrast-white.png	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarLargeTile.scale-150.png	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\zh-cn\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\LEVEL\THMBNAIL.PNG	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\5.png	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\423x173\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Win10\MicrosoftSolitaireAppList.targetsize-256_altform-unplated.png	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Assets\LockScreenLogo.scale-200.png	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-64_altform-colorize.png	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\iadata\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\AppIcon.targetsize-72.png	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsAppList.scale-125.png	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1808.3.0_x64__8wekyb3d8bbwe\Microsoft.Advertising\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\pl-pl\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-32.png	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarAppList.targetsize-30.png	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\WinSxS\amd64_microsoft-windows-d..rds-winrt.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_7420bb0b828f3f5c\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..defaultassociations_31bf3856ad364e35_10.0.19041.964_none_983b357fe6dfa2bf\r\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-wsp-spaces.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_fd958235e4149bd4\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\Ratings\RatingStars38.scale-200.png	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-c..ngshellapp.appxmain_31bf3856ad364e35_10.0.19041.84_none_24f8aafdaceaf0b5\Square44x44Logo.targetsize-20.png	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-deltapackageexpander_31bf3856ad364e35_10.0.19041.1_none_2a244e0508c623c1\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-xbox-auth..er-client-component_31bf3856ad364e35_10.0.19041.746_none_dce77f197a18c065\r\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-rmcast.resources_31bf3856ad364e35_10.0.19041.1_en-us_9d8a30bc70e7550c\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.19041.1266_none_fb76f6fb7e78a373\InputApp\Assets\WideLogo310x150.scale-100.png	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmms_31bf3856ad364e35_10.0.19041.264_none_1477a882bdce0df2\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-m..oundation.resources_31bf3856ad364e35_10.0.19041.1_it-it_d144eff82572d81c\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-rmapi.resources_31bf3856ad364e35_10.0.19041.1_es-es_0cff4445acd5d4e2\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.Transactions.Bridge.Dtc.Resources\3.0.0.0_fr_b03f5f7f11d50a3a\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\de-DE\assets\ErrorPages\pdferrorunknownerror.html	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\speech\0407\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-directx-xinput1_4_31bf3856ad364e35_10.0.19041.844_none_298659e19095b66b\r\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-tpm-driver-wmi_31bf3856ad364e35_10.0.19041.1_none_257e1be45fa14ced\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-v..cprovider.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_091a35b0395d78c8\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-cloudstore_31bf3856ad364e35_10.0.19041.746_none_9a83611ca3c54a51\f\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_b4fc93ef208f3edb\502.htm	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-usbconnectorapi_31bf3856ad364e35_10.0.19041.1_none_6ba46c062a2b4da2\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_wsdapi.resources_31bf3856ad364e35_10.0.19041.1_it-it_5dd5975bcef2f854\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\Assets\Square150x150Logo.contrast-white_scale-125.png	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-p..ityuxhost.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_9f0aa3cbf48ae6e3\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-d..nagement-dmcmnutils_31bf3856ad364e35_10.0.19041.1266_none_1638e81fc8fb6e7a\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-i..l-keyboard-00000454_31bf3856ad364e35_10.0.19041.1_none_a8dbffc3371b8fba\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-wlanmediamanager_31bf3856ad364e35_10.0.19041.746_none_7b704dfc45023538\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_windows-media-speech-winrt.resources_31bf3856ad364e35_10.0.19041.789_es-mx_43e5ab41f24b09f8\f\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\WinSxS\msil_microsoft.powershell.commands.management_31bf3856ad364e35_1.0.0.0_none_9fba00a194c2da2a\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File opened for modification	C:\Windows\SystemResources\Windows.UI.ShellCommon\Images\NearShare.contrast-black_scale-200.png	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-w..ure-ws232.resources_31bf3856ad364e35_10.0.19041.1_en-us_c4008a5924567538\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-errorreportingconsole_31bf3856ad364e35_10.0.19041.264_none_33eed25981c6dfd1\f\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_dual_netrtwlans.inf_31bf3856ad364e35_10.0.19041.1_none_4f974109745217b9\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-desktop-adm.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_4dacae094eee592f\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-p..leshooter.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_69b309d41ccf04b8\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-p..riencehost.appxmain_31bf3856ad364e35_10.0.19041.1_none_97b0a47239f6db64\PeopleLogo.targetsize-48_altform-unplated.png	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_netfx35linq-system.web.extensions.design_31bf3856ad364e35_10.0.19041.1_none_bbf615f2eacec631\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Tpm.Resources\v4.0_10.0.0.0_ja_31bf3856ad364e35\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-d..gement-vdsinterface_31bf3856ad364e35_10.0.19041.1_none_5b4913debe6044ba\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_uaspstor.inf.resources_31bf3856ad364e35_10.0.19041.1_en-us_40ef14beeef02bab\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\WinSxS\msil_microsoft.web.manag..davclient.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_a96d4eb01d2adb04\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.1266_none_777e4c5802d14c18\retailDemoSecurity.html	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-t..linetools.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_71c3acc15526cb26\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-raw-image-codec_31bf3856ad364e35_10.0.19041.746_none_5de782925eeebf9c\r\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-t..iprovider.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_9d3749bb1ca543e4\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-w..-provider.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_24f0658dbe28a9bb\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\WinSxS\msil_microsoft.applicationid.framework_31bf3856ad364e35_10.0.19041.1_none_a99777ef07681258\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_fdrespub.resources_31bf3856ad364e35_10.0.19041.1_it-it_9b953af071122c99\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-securestartup-core_31bf3856ad364e35_10.0.19041.1237_none_a99d61c8a7531c97\f\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft.windows.h..iverclass.resources_31bf3856ad364e35_10.0.19041.1151_en-us_ef30ed021326193e\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-netbt_31bf3856ad364e35_10.0.19041.746_none_48b2bd808a742e25\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-network-security_31bf3856ad364e35_10.0.19041.964_none_b55ac867bdccde4b\r\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-r..-platform.resources_31bf3856ad364e35_10.0.19041.1_es-es_2fade7009331ae07\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-r..tance-exe.resources_31bf3856ad364e35_10.0.19041.1_it-it_cedacf4a1a69975a\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-n..agerdesktopprovider_31bf3856ad364e35_10.0.19041.1_none_e885fe220ca0eae9\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_wsynth3dvsp.inf.resources_31bf3856ad364e35_10.0.19041.1_es-es_c3bf9933753e7a4a\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.Tpm.Commands.Resources\v4.0_10.0.0.0_it_31bf3856ad364e35\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-e..estorageengine-isam_31bf3856ad364e35_10.0.19041.1266_none_66aa1a66e13d1532\r\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-t..ormabstractionlayer_31bf3856ad364e35_10.0.19041.746_none_c3385cf17c33cd6e\r\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-w..-protocol-component_31bf3856ad364e35_10.0.19041.84_none_d91c285898d524d8\f\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-setup-cleanup_31bf3856ad364e35_10.0.19041.1_none_19dbd572fb07e566\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-setupcl.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_7a491decb470992b\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-snippingtool-app_31bf3856ad364e35_10.0.19041.746_none_77bd4cfbe87238a7\r\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-mountvol.resources_31bf3856ad364e35_10.0.19041.1_en-us_39638b526478ade4\HOW TO DECRYPT FILES.txt	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\RRAHKKYNJVTSHLG	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\RRAHKKYNJVTSHLG\DefaultIcon	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\RRAHKKYNJVTSHLG\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\RYiGElV1ZFlQ3US.exe,0"	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\RRAHKKYNJVTSHLG\shell	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\RRAHKKYNJVTSHLG\shell\open	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\RRAHKKYNJVTSHLG\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\RYiGElV1ZFlQ3US.exe"	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Bl9c98vcvv	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Bl9c98vcvv\ = "RRAHKKYNJVTSHLG"	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\RRAHKKYNJVTSHLG\ = "CRYPTED!"	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\RRAHKKYNJVTSHLG\shell\open\command	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2784	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2784 wrote to memory of 396	2784	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe	82
PID 2784 wrote to memory of 396	2784	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe	82
PID 2784 wrote to memory of 396	2784	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe	82
PID 2784 wrote to memory of 396	2784	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe	82
PID 2784 wrote to memory of 396	2784	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe	82
PID 2784 wrote to memory of 396	2784	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe	82
PID 2784 wrote to memory of 396	2784	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe	82
PID 2784 wrote to memory of 396	2784	9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe	82

C:\Users\Admin\AppData\Local\Temp\9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2784
- C:\Users\Admin\AppData\Local\Temp\9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\9b7eaffe4dffcbd06445d0b32785cdc8_JaffaCakes118.exe
  2⤵
  - Drops file in Drivers directory
  - Drops startup file
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

aic_file_icons.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\aic_file_icons.png
Size 50KB
SHA256 6ed87a04178a934bb6e314dffcec82aa1872338896aebccd027d0a4366bab842
MD5 c486e67e0e5e0731b50428dc7c562622
SHA1 c0152b8be06bf23903fefe9a9a475f6533beffef
SHA512 d84002f942262580a2ad48ba986780855a132fe2bc749ce8033db42d71c75b1de114c0038999b500ae455fcbb5b54eb0e0f00c884727b68c5b0c8bacc381dbe9
SSDEEP 1536:LJxH/1VCLkkoArs4b/G4JSqaF4WO3X1JIN:LOoArs4b/bu4Weo
MD5 SHA1 SHA512 SSDEEP

Submit Download

selection-actions.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions.png
Size 1KB
SHA256 9f40a8c1ec36cc82022443f680207524c839f979cbcd9c01f8802ac69ef22f93
MD5 9690520836bba662205baa7c9bab8a1f
SHA1 4b22f810e1b1a36c9de26c74f3d9145d6616c4f2
SHA512 ea6fbb7202c5abcf9bf9ad0e3832277ebb8da270de4ba05fff90033fc9ee51eb6cd6afffe10556f4b60fb2841015758ab792e2c5b9e6b52e7bd6dc7d6b3b2701
MD5 SHA1 SHA512

Submit Download

selection-actions2x.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions2x.png
Size 3KB
SHA256 3c97229963014bcf65c481b4e07baead91ba21a770978f95e405e246d6e09041
MD5 da29106db8c8034e72fcbd83474ce080
SHA1 507ccc49c420370a5fc50817fec14bddc58da812
SHA512 d15eaa55fa2e182e153d53136f5c7e7d7e5b5a1ac74ebad900569537315b1c6d0f8c40c1ce29dc18edd7dc28bb205fb95894bef0f636d3eaaaca344aa6a4e5f8
MD5 SHA1 SHA512

Submit Download

example_icons.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons.png
Size 683B
SHA256 36b019109cfccb75fdebf982d1aa8380c6f2871f529e6b99dbf74b50433aebe5
MD5 9f70478add08ed5e5a573f3a9d347499
SHA1 7b937202d07b5b69e5cf5db607b56a33421ba1d1
SHA512 56db005437c87c520ba073d2bc189c94bd25a9ad84689bb5ff178075e3fa2e635132b47bbee7cf1c40de82ca8cab4a930f9436a15c1e08d8311a256b72ebae34
MD5 SHA1 SHA512

Submit Download

example_icons2x.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons2x.png
Size 1KB
SHA256 d1919ed2861e781e94c344896d741690c7667802cc6d8d3084aa2a7601ea5ad8
MD5 2d352ad0eb2cb368b975f153e35659ff
SHA1 eb6ec680c9673163db31345fda0df24a21c3d37a
SHA512 5868506fbac05fde6a00aa4827b238f54a901f4414876729982006622fbc4b504e6c21163ee181b93317996294b8d35f8e50409e854533b473c9c4c5f45962c4
MD5 SHA1 SHA512

Submit Download

rhp_world_icon.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon.png
Size 445B
SHA256 28bb4a399cf1e6f5a65854b8810ecd9382f9311323124e596f899a3eb2a59f87
MD5 410ecaecbed60c0d69657a47ebf53cf9
SHA1 26d627c37e1937443916648d12eda2fd6a7bc655
SHA512 78b79b66632fa8819c0a5e13fd3fc658da8dd04e6a7f255e122bfc165609a870b11adc4f903fc2ec092f8c1d8ca094abe3a44de1478d5f3bd69d4d0b90985f93
MD5 SHA1 SHA512

Submit Download

rhp_world_icon_2x.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_2x.png
Size 611B
SHA256 06c2716cf62aa39a57ccf4b7ffc591c7f2ee72b3fa8b35f03da9ac10c5f73931
MD5 8d48b36fa2d2b194f0c54516d008e5ec
SHA1 4625e5c0636c0e626b2b8b9621cb7fbe4ed87d7a
SHA512 f225b5ba26baf8db408eb49a893244f4d2ba11460877bf6f377d59d0636cd9e565d89d19babbc08dc265f9bd84f1024f5baf9515eaa6705aa9e2da252efe216c
MD5 SHA1 SHA512

Submit Download

rhp_world_icon_hover.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover.png
Size 388B
SHA256 c5831954a9acabf5b4f9e9fcb00135cbf3e260db6ec2bef35bb2a6a77c8b3973
MD5 7f6afcc7069185487c4430fcf0a32807
SHA1 2cc15c4705ca949acc451bd7cf04209cf11a8bb3
SHA512 16f5f64e7d840befbe651849573d5ef3701ed39b3e77f13654266ac9ad104f785f6cea62079ed2c77fa0f8b14dd60e6cec9f133e81dacdc8c2af046cc6df433d
MD5 SHA1 SHA512

Submit Download

rhp_world_icon_hover_2x.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover_2x.png
Size 552B
SHA256 44a21013b67d84b04e4be15b9965d70549185e204d1c1618ae29b5567ed62124
MD5 3d8e940b55b854b5c6e31f44d8eb1995
SHA1 88ce302e6b8d8d2f6e15c3dfafacc3c48b1afc1c
SHA512 cab9ce2f2151e39bbcac6e24d189b13f41adbf31dd108af7fda366f142e44f146a2e7a36e6c64bfa4a329f82675089e1fffce1d09647b357518f53be57882983
MD5 SHA1 SHA512

Submit Download

rhp_world_icon.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon.png
Size 388B
SHA256 425419d9bde058718ed4c5c6d0ba55850edd2cafdd94a936da3e45363a229dd6
MD5 7b3cd5083d788faca3fc99a221968124
SHA1 dfda658c881ff4996b039914915cb19ad0bdb608
SHA512 1874f8c5ea791ee3e48fe692c9a5d6e82726ec3e63323eaf9bbb625905a3c34acd4491f3fede32e7784042618231d1df197a2a197fc279a96ddae5f232d69583
MD5 SHA1 SHA512

Submit Download

rhp_world_icon_2x.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png
Size 552B
SHA256 35a3deda177a5345a0236d29bc518353886e72df929118b34414add84d350576
MD5 95b1a3b87bb2e451a358344b0dd96e55
SHA1 004341d22bfa1a0e078e8c21389fa13682783917
SHA512 0eb11b5172063a14cf478132ed2e2465a7b575e6bde4b0df20852f1bf7baccaf22e4ae25d03fd7199ad4c03bfb5054a15d65ef4035185859d403ad6df6ef1665
MD5 SHA1 SHA512

Submit Download

rhp_world_icon_hover.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png
Size 388B
SHA256 8f5a6c44a3aa0653ea912af77714d5fc6b72d8771497eac64a8001e9c1f6c8d9
MD5 fe25e9a650e2716631324471af8d400f
SHA1 33b0b8b8cad78937126866b4b75757c8f725b16d
SHA512 48914cbc9e344b18cb332c2d68cb234a1c774a414e9e33b6231bb0cdde4241625c67c73c18ef29065d994799f4d16a6e2cfc910e3923e9020bbbd70c43136e48
MD5 SHA1 SHA512

Submit Download

rhp_world_icon_hover_2x.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover_2x.png
Size 552B
SHA256 58ef4c91757bf630e25293fb8c1560d9c1742991b9e5a5f2a1dd704a19eceafc
MD5 65feeced779242e6f6511ded49720475
SHA1 e0abb699a64893efa3e23b831bcf4311e3c01ae0
SHA512 afbf5aa5142dc7fac7789be7858d53639788cb7fe87f8393040c207372bb5365a326a252abfff0dab690567b780cccad78f73c8a696b9a648759933e9434bdbc
MD5 SHA1 SHA512

Submit Download

icons.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons.png
Size 7KB
SHA256 fa94d44657a8c74275e5c2770e67dc925cdf1cd6344a4b32f7ef22c27bcb097e
MD5 02720c5a7a4c68dbb46a68e04b07513c
SHA1 8cbbdba33b05904912582086bb4b6c743dd87e2a
SHA512 af397855cee2f0f0fb9f5ca75a45f0c44e5b145ceff0cdf5335342e1e9dfdbdc2153cdc7499c42721b2f5b1d14a99ccb14748203dcef05b6023356fbf44b65c9
SSDEEP 192:U7FlVngmHXOP+gdiosJU1LfinQw/mIfRd2dxfbMVtpjIvvFp:UfVngme0YmpmIf6xwVtRI3r
MD5 SHA1 SHA512 SSDEEP

Submit Download

icons_ie8.gif

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_ie8.gif
Size 7KB
SHA256 b90c42a456a5b37b54810488f525f63cdf2035b60c60f0c1d47509e9715549c3
MD5 122e87c702bce30e26ed05b93a09d4a0
SHA1 0db00e94e6c05d464a408d817b2d5dd49d7b8f95
SHA512 2b755615ec34ab3139fdac4ad7021c96763e7002865228fea41757879a7a6184ac6b9ac3fa1431d9439322957c3b9640d3f968c7c326a1b23a45160338fa2bfe
SSDEEP 192:j7nPNekfKnc9r6Y7AVP6F99vZJiKMyjijNYhPPyLO:j7PNLiAEP6F3p1j4i4O
MD5 SHA1 SHA512 SSDEEP

Submit Download

icons_retina.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_retina.png
Size 15KB
SHA256 7e1c9ad4d82881829c6ac5668af65bca5fc98d1b01b486222dba57b2e54f1a44
MD5 b2f0a8c33a177ef7dd0dedcfaa94d2c9
SHA1 07b9d4c3cd1f1a978ed9cce954dc856fbd1d23d7
SHA512 ad65b1fa2e4d075151f1538815e2d0fcf8c3dbbed490f11ccf33952e1f2aebafbbf3d426c0318786fcefab56b817c4ade976f36fcb19cc7cdff186629d8ad0c2
SSDEEP 384:q4ukMeU5h/ANeDCskAjv/PSrw5X3SpPIEoARYjqO47:qLxe2HceCrw5sPIqO47
MD5 SHA1 SHA512 SSDEEP

Submit Download

new_icons.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons.png
Size 8KB
SHA256 5359d1a66c25e5781f299df79f4e946958a7285900a3450c04e721bbbf0c9171
MD5 1c8260c09b9229ab92a9a3c1c03f66eb
SHA1 d4b055dd9f9753e79347246c4c8b08fb92955bd5
SHA512 a2b2df0f2d16212fbb087c0d8a21cd8e1f191ab824895d77cc4a5f3e4b3f66ca79300cbec213585131b122888ce36339ba6eb2a81d92efaae2e2915c17498d7a
SSDEEP 192:d8pHAHC5FjdlcMJT+YeLjogWu519wW0O5GEfbP:d8pqAVcMEogWuzF0+Gm
MD5 SHA1 SHA512 SSDEEP

Submit Download

new_icons_retina.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons_retina.png
Size 17KB
SHA256 8a2743bd6d71e843454ac0f02891780a89ea7ca39f2667548a921e0a5517756d
MD5 8a217343c64123d06fa9785f4505733a
SHA1 131ee5e2128cbf5a45b8d5a985fe499911931659
SHA512 8837830076c9b9da87b41f2259feaaf946c952bfd1c9dfaeb819bb828a0bcdfa0f5771fc978f342d5d144dc4bdcc4ad433be4df76db1069b6345799d019cdc0b
SSDEEP 384:QQXrQMWr5PzjJpjHglHbvpckbHlqd2rlvTur:/MMuNXjHglDZHl+ohG
MD5 SHA1 SHA512 SSDEEP

Submit Download

bg_pattern_RHP.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_pattern_RHP.png
Size 179B
SHA256 a6c65b97c70a20b7d507e719b98e4d0eb4ae85d57606f5127fe5e394ef1f4068
MD5 ad01e98a5bad59f12a9903ac51684804
SHA1 af575235eed587283440e63b8a6d9f5d02d842cd
SHA512 6d85975fe8e8ededdc5a35274d26a04f15f4efa071eb30d78cee0fb0434bd901c1851b1f348555a5d8b43d5c0a1a46c7e3dc0bcb71124d6fe0d4c24b1ce6f79b
MD5 SHA1 SHA512

Submit Download

bg_patterns_header.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_patterns_header.png
Size 703B
SHA256 268f4df039c0a9b405bb6af0b1cb1b272028eec8b4d87a1dd2aaaf07dec16245
MD5 d26237e084b0efa0ac2221752322b89c
SHA1 8e86bbad305a924d15cff0c9a9aa4655f91ea423
SHA512 86ac3c8db8b1f7465faa10b06c5d8f00d1477ffa6a4f1e33e2af1211aff1b99ac0f06ae329cfca528fdde5ab66fa8aba85e29ca28ce06d66f16f812c97981841
MD5 SHA1 SHA512

Submit Download

illustrations.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations.png
Size 8KB
SHA256 21c66390d8d10d60f3c590927c7a960f93caf2d339a4a6d107ffb2d8c9182484
MD5 414a471bcba5314217627660561e8866
SHA1 faaf1b92999bb6c3c7ea80a968e10fa3afa86be0
SHA512 8a4037390389c5eb89cf926198f87b7d5c73ee5a01af3873a0e4de9bf1a428385ad87981eb557f5fcf1ccc39a987b8cc8ef93e9c462de5b0d3b7e786dd7a90d3
SSDEEP 192:Dc7fGEe7l71BKzT5pwN4t7S6tmHPVh0rL9WZ6W7QVtu:DsGTREZKNcuOmHPf0rxxW7Q/u
MD5 SHA1 SHA512 SSDEEP

Submit Download

illustrations_retina.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations_retina.png
Size 19KB
SHA256 fa2a8da342afa08a63cd067c92d40c3820f9e89899c6a9ce9ab453528068b665
MD5 9891851ae178cd7c6158c35fe5a3c193
SHA1 61336ed229f442c0ef2ff95bc39839691c4bf8c8
SHA512 793b6847919c2a6a78e3d9fb4fc51bd8ac1a3b440afc56f8c2104f5e0fdd114b5b2849940822dbb61e900c042eb46d6231509b036997207c5ab5d6ce22105832
SSDEEP 384:++3+3B2MiINyryPhItZ3/5Qx1d5NXDvK4Sy8oVhGgwTozxSy:qNpywGtZ3/K1nZjK6hGgwk0y
MD5 SHA1 SHA512 SSDEEP

Submit Download

faf_icons.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\faf_icons.png
Size 6KB
SHA256 4773b01ab272cce93391643b1bddaee4ac223f018b24fe752e888365014343e5
MD5 7c6e794cfe0a7b4daed255857ff9b14d
SHA1 700ad12ac548e830dd3c19726db78a8f3be7ac8d
SHA512 98a4a59933844827d5d28e26c01b302ce95fd5a9e943004c315e70dd6e4bc1b86e0728061a1b9238447bcfbbdcae8ffd7d996717036bc411bafa6613b1adfc27
SSDEEP 96:zPn+/Sc9i3mhgER+N+R9eks4aq554T6DuXqB0FhVPfg0TWxkLdTruEZnqn/i0KF8:zPnqfhgEfFQ+4+2qKFrI0ldnn2/783M
MD5 SHA1 SHA512 SSDEEP

Submit Download

bun.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\bun.png
Size 2KB
SHA256 094279b650a0cc8436b7f6c253cac0edabcbe099825d854eb401e2b891b27b74
MD5 34d75f5b27c3c6c25d2cd9dfd0d1a6ac
SHA1 b4116bd104909a8c0d7d76ad5623b137e36fc694
SHA512 669bb255a06987ad2c73213bfd6640aea4a695db14aa1b7a27f25059cf03dcc115e3d57ab4f949e8e3a27561c6f0d7be8fe705ecc05a30a8d711aa8658974c60
MD5 SHA1 SHA512

Submit Download

cstm_brand_preview.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview.png
Size 2KB
SHA256 979716fb57090c64ab26cc9227bcfd18698b3c46c9732fc3a3eacbed3d4a5c35
MD5 eed44777be87c1f5851a5548cca6f551
SHA1 f53e9e1d67feeb6fc5b23d0d495789d402deff37
SHA512 b1f05256e4c88046e09c19c9f750d200b020022b592b589dfcc500700a81ac4fcdc8fc6a9f5c1a4e69e12109e936137914dce02c5106eb30a119fa9e848f73a1
MD5 SHA1 SHA512

Submit Download

cstm_brand_preview2x.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview2x.png
Size 4KB
SHA256 9752686ecc0ff621c93872a1ab139116ba9d5ab187123d55fe0665715ea09382
MD5 4cc9c03ad014298debc98db857fc7bad
SHA1 e341a3822206eded38dd2f4e89ea86254dff226c
SHA512 8f0579f5747bc2509d4ffdaaeebb230e1b117b908e5f0b8b076fc657f7ced3a43d4ec108281f2fe242d27a5fbcf082a485dbedf8590c900ebbc84d0103a0a955
SSDEEP 96:+A/XSNBePtcsnUlZOYSsunB7LMCh8PgHrkYH2r0oS7TzX8k8chW3z2ubEd:JPtbnUlbSn8PekZAo0zX/8zDDy
MD5 SHA1 SHA512 SSDEEP

Submit Download

dd_arrow_small.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small.png
Size 289B
SHA256 9036a3ef33d60789267102db589454511f75ecd46cf18d1c7171c1fb0af6ff30
MD5 dd7f14abded97eca8c4f05a1d00500a3
SHA1 7b97ed4065cc22c9827629ce4685f0622f08e8a1
SHA512 2b08b55f1134a46e2304c80a5a581aa889d2d9dcf3b44d6457c21b88a27fd0d06f88a8652f2251171d12b7866fffbb07528f155a15eab7884d4b8b5475b8323e
MD5 SHA1 SHA512

Submit Download

dd_arrow_small2x.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small2x.png
Size 385B
SHA256 03a91c4916f1a1cce94bfc1fdde2fde030ddee1b80d346b49355584866e143de
MD5 b39f720f1a08c45a001ae8857ac3ba4b
SHA1 cd679be598286b6d82e2dc1930908767bb3cfaed
SHA512 2d521568a8804aebd79d35fdb4c9e7c15b064ab66b7298ffc5ceb4561f708b1d95184f7e5bb8bf84b2e0abdee3c4ad9ad5413055957ac1b7d2b0a98aee44d736
MD5 SHA1 SHA512

Submit Download

illustrations.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\illustrations.png
Size 4KB
SHA256 86378a567828a538df66a2de563405a617dd8c20d07ee5418c19df6958f81918
MD5 627a9016067ba18477e75c89f34a15f5
SHA1 622c141a5b94fa0e510ea5fd5923e7884ef17e38
SHA512 d0ffd2c269a7cbee4fb0463dd3533417a365d28f7b60be9aa4ef651e82ce3a8b77d4e7c4e62acc706cd114a7e527be7d7da559845185b04d5ec87ad1d266cedd
SSDEEP 96:fgpYIwWnbTmq7UEGUDFcr7oI1fdw5NpwWor4M0Z9EAE+CLmt66Gab52e:4iIXbTmq7DGU27o0FW7u4Jjt66Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

nub.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\nub.png
Size 1003B
SHA256 58b6adfc8f2ab31dfc9e59faa6b370be392882e058e356a6a067c99eacb6d1c0
MD5 aa8a74d90d26fbf6473e24cd500a2a0c
SHA1 473ff20b61e6404a216ed1b15a5047f764fb0941
SHA512 edf57be569f82adb61354bf44a97afd717f559a08c887b9e3f8dc535c328bda3b99ded0b46bb203b0ef61b25190b1df3293df4c3858107ad9595f1be878f400a
MD5 SHA1 SHA512

Submit Download

share_icons.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons.png
Size 1KB
SHA256 9802606a3e491a8f8ce2d56aef2c1fea923a536c7db480f63fd2f441dac3da33
MD5 9c5c484ed2418dcba3b482d600a890e5
SHA1 e784fadf947ea2c16d08d4cac218f7167e3ff48f
SHA512 acc878d5e2e3f15111140fa08da0d3b9905c7065e17e5d59d8d6886c77b18d98c4691be4a3100334b285c36ad092ada56c5b33ef398f7c1797975272752672a3
MD5 SHA1 SHA512

Submit Download

share_icons2x.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons2x.png
Size 2KB
SHA256 c103e95f9a69fd89cafe3a6d20813ec13305379cb852ffed8c07332a9fee01fe
MD5 a1c088f92ec0b51fe47e3361a685c7c3
SHA1 bc751185890217b392cccefeaeb83dc7603079bf
SHA512 44d7cd1d935f5ffd7aa21174ff537bd348473d9b9e579da212cb63bc2c8800ac9bbd19f370a46bacc5285f90cf9305cc801f02035cddb405b78a15e424ddee78
MD5 SHA1 SHA512

Submit Download

adc_logo.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adc_logo.png
Size 3KB
SHA256 7d83391498653cdd2f1ec74b70bdb19df56a42e2f6275710f2647faf748899c6
MD5 e1623552db78036f49f76ff9718db7fb
SHA1 e64ed60c9836c600202d663a2b1843d01332de87
SHA512 fd3e6c52a5b85b225689e147f45f4cfa738bc3d753b9cd72db066adf595ab20db00b82350bbb6fcb6602d18ee599c04140f5889506b764485b24599f66ce516d
MD5 SHA1 SHA512

Submit Download

adobe_spinner.gif

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adobe_spinner.gif
Size 556B
SHA256 a8938fe35fe61a2e3d5d19c47e5c0f8d0c92f13ee08a51101c8c3c174f98c4a3
MD5 9fb50d424b31885bcc2d89113c0e5aad
SHA1 b889dcb78e161cc3aca30e48b6af64f9a0e744e5
SHA512 c700d4185024a8f6abd46a1fcfde141d0519a419893738ab42bd9606749c4dd670fcd95d314572e37396b70f4d2c7d0e475c4b3765ac12bff41a1e32fe659662
MD5 SHA1 SHA512

Submit Download

logo_retina.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\logo_retina.png
Size 6KB
SHA256 9a2e38fb0a8a8493a5707927e080953186a3fbf4d616ae30a1a478f8dc107d49
MD5 547eea0620c9b2e89cc632ad88e9a99a
SHA1 cd7032190b078626c950950111e993ec7c25b519
SHA512 e9b65e9297dfdb793a1fd832eb2288b2e88e5d80a8c569d0590db8ec42b72d7d4272bd5e044ce0d371627661cb41f7b39563ebe3aded99d3c74016a869cae600
SSDEEP 192:o2YhpEy8XzJXN/6ZaxOF8icego4+qtx7H5QVmapjn:oYRX9618Fv7H5QVmaJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

sat_logo.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo.png
Size 826B
SHA256 b7561ab328cb9b463e92be21a4afefa6edc7348bf78582087c21ee0eeb3bb398
MD5 3bd7360ea6a505ea88abb00863f9db4b
SHA1 c2eac4730f7612fa55f9255e00d4a0de6e545bcc
SHA512 13ee50d9bc99435f52e0b8ec04b1d9d8743b2396ab7762d8cac8b6988a12c734a6aaad60d3a5af62bf118bdbea29d20ef2b39c3b09fecec40220ad16242fd116
MD5 SHA1 SHA512

Submit Download

sat_logo_2x.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo_2x.png
Size 1KB
SHA256 2fbbbf499525527b89d9b55ef9bfc7f63af70ad2c7538500882d43de97ec06b9
MD5 31c5fa5b325357534387602fe784eb26
SHA1 1fb16f758cbc87fa27956dade1009c784e8aa26e
SHA512 6a35507076620a222bd3bcfd093702f0504bc0918f84b1e0483049d71826064d40a76569da02b0ba848dce4b02559efe6b50985edb35c59877cb4ce5313ac3f5
MD5 SHA1 SHA512

Submit Download

DisplayLanguageNames.en_GB_EURO.txt

Path C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB_EURO.txt
Size 32KB
SHA256 d0bdc5b9bb503badd39851a196e7fb90e1689ab1fe2c0e7e4ce7b43b10f046ec
MD5 c39ad1a7dd5c95973ce7bc484fbbbdd4
SHA1 e0e74b04d643236c72716341fad85690185f69f6
SHA512 7ab9992c48cf1df1f48125509913d4adc45d5ef5afd3cb6687cfbecb9347eba725b5a725d14f52923c29cd2bda4a3de2655e2a69ae35ce4f4965181855330795
SSDEEP 768:6fpZo7cM/46x+GfpzUrze1SfCCJZLe/Ic5T8+86lAyICd28/xNE4lIQBhZkNEu2p:6fpZo7cM/46x+GfpzUrze1SfCCJZLe/D
MD5 SHA1 SHA512 SSDEEP

Submit Download

HOW TO DECRYPT FILES.txt

Path C:\Program Files\7-Zip\Lang\HOW TO DECRYPT FILES.txt
Size 937B
SHA256 f78cde7119f31d0e3ba5aafd8b932c342f5e762c5f8a1a3c7b115133c1f9f1ec
MD5 88de38daafc64c8ec113507d490c9d7d
SHA1 a51b5c3ee4c306b1a3ec68c0cfaaf41bef29e1e4
SHA512 3e3b42d9c2b42a24fe753dd2e24df8405edcc0c89bdba78bd4e20e5f83faa372a23008d0e7f568f4210a4935a68a1a03eebeb4e30954e5cb56542016295ddb71
MD5 SHA1 SHA512

Submit Download

win32_MoveNoDrop32x32.gif

Path C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif
Size 153B
SHA256 2caa4056f47fe5029b33a4bd71fd871b453a2d9a1f6bf54080bcf96a1628161e
MD5 df04943e663f25cc1c915b6dcd28552f
SHA1 68cd5574c7e213f1ad89384d66fe673695eeaa01
SHA512 91848776349f491a40c3d906d60222d519a651be2e13686781ce186af0affd53cc06fb22e32d0f51e1d9dd02d1c5346cfd0c350711c2876af2412e9310102ab2
MD5 SHA1 SHA512

Submit Download

THIRDPARTYLICENSEREADME-JAVAFX.txt

Path C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt
Size 190B
SHA256 511556b7766434e063f40e8fb5a095d8a902dc64d2300a1c9a5657d5b194f311
MD5 dfac3205258ab328e13625fe28206073
SHA1 ddb0075ce6525e502fdfc591c90aa7325a2ec31f
SHA512 af38cdd645c5237fe7c7a7006ba3ae310346f026b8510ce119c463a57e62dc98c6493a46e2efca82f2a605c773657442d5fe2c5b2962faa4c368ab1f76651483
MD5 SHA1 SHA512

Submit Download

THIRDPARTYLICENSEREADME.txt

Path C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt
Size 190B
SHA256 5f9bbb4760e5cd5f36a80c8b1671f0cb03a9da18ee68298f8c4d1766c9a91103
MD5 bb2efe53f68427734b852a88cc0189f6
SHA1 4fd906236a5347cb14ac79d85824e9d0c4c60cd3
SHA512 7e7f2f77f0089bf3c06ef39f41fba78e3a9c555d779d95cc8cb97d0fc3344eac9193d79acf99d31591b4c2876c82dadf6531737f0f3942568280dd0e051a39ed
MD5 SHA1 SHA512

Submit Download

directshow.md

Path C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md
Size 1KB
SHA256 a7b8da6fb34a9c91bc4bc2d921c205dc4142ac7cbcf0e96845a7f8db4d4a7e1c
MD5 97d87f55b2d6d5c6ded5a16c09c86935
SHA1 631791c8a530b52a40b9b79333847c1cc87bbf72
SHA512 265acfbfddd051e016e78e88df6aadea461aa041ba6da7abfc2eebef9d04af4d9d0e53cace0d9b77981bde7617e74bafb180ec6134c3be388a775d39254fc0eb
MD5 SHA1 SHA512

Submit Download

glib.md

Path C:\Program Files\Java\jre-1.8\legal\javafx\glib.md
Size 31KB
SHA256 dcec6e866d227872a0b3e14ec4eed9b2f9928fa38a1d4ab56f7ca1923c3ff928
MD5 c506394aedbb4c2068ac6f4ad1b96f05
SHA1 29c7098dd7179ec409121f6bdcf9304196b878ae
SHA512 c42f8dc299fca268db5c9594959a5dad2338e91c46f41b53f710c08d59fc07b05a081b497e9f2c8f99ec64b7707a0d32e922894d0aeb8bc403b846829d976774
SSDEEP 768:MI/IcvNAnlcdXWyTqEqCRzqINBosbGAoSeV0hsqky0ytV:MfIenypWyTnJYsTr6aTkm
MD5 SHA1 SHA512 SSDEEP

Submit Download

gstreamer.md

Path C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md
Size 34KB
SHA256 b941b3801e657183e1895d7e517e5978d6f018ec23de41171c50735e04ed8858
MD5 446f8f0cd049abf36e00561937e57bf3
SHA1 7837fa3ccc557de9e13f46d9b3c4dbec7003fb45
SHA512 359c1339b554dfb5961fa1a45fd923ab1d2060c9176669893839d7ffbe71d70332dba4e8e2e94ed2fb296eeb4c36301586d396672bc4f163d3d2887d19dccc57
SSDEEP 768:4Kin94nlcdXWyTqEqCRzqINBosbGAoSeV0hsqkxOzGBS0:24nypWyTnJYsTr6aTkgKBS0
MD5 SHA1 SHA512 SSDEEP

Submit Download

icu_web.md

Path C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md
Size 23KB
SHA256 a20734a7d3353e640c2595ccced9e7a368304e8546c5583d8414967e3d75dafe
MD5 b09d99087c8a0506f1e03630c508041d
SHA1 2ad0ccac35ad29546bc1f9cb84c03241344b1919
SHA512 c2da83c3de16f42c49394f6ed5a4f3784b879d8268b774b7bc6b6d7c779345fb06eafab4921340c72aff5fa4b525c1f40fb6c5e432f6172fd4aa8915cf57223b
SSDEEP 384:IQSfKg+VXsjSpCS15x8zOihIpdNpzg1M8c8nF8yT0xRThle0goEGTIggFswJ:vR9XsYCS7OVudnzg08FZTiRt8rPGUP
MD5 SHA1 SHA512 SSDEEP

Submit Download

jpeg_fx.md

Path C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md
Size 2KB
SHA256 650dc8a4cfe7c66e66fbfa202f742fb3bb1986a70ce4432c140f878b2b4eb700
MD5 61eeb9425b7da188366e6a25013fc819
SHA1 32cef8f25adc39e46817dc9ce4c426548aece121
SHA512 1faf17a9ce674fa28c3c73345f810f1bf5115820885773d2ac068481e77426ff305be9f93a9694b3ef97edfb9ca948896a161e1d4f43464624cdf1d38160b74a
MD5 SHA1 SHA512

Submit Download

libffi.md

Path C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md
Size 1KB
SHA256 710f22bb1dc120d1a7c068e178e9ebb806cd748fbd3bacac72e1596784bcb9f3
MD5 ab6381b2667ba0be9c72f1fe558a2e71
SHA1 ee079e669121030e9de81801edff83a01ec2ae6e
SHA512 536b5075990ea37a0339eac8cbc57df32388e50b5005e02cabeeb2b414b3b8e7f1243b93563120e0ff29fb7e69145f2ef07f2bc88eb5277e68d062c353225ea7
MD5 SHA1 SHA512

Submit Download

libxml2.md

Path C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md
Size 3KB
SHA256 9d5fedb35e80f2ac0422ebcedd0414b5cce118a2457bf1b5dd53b6d952b200cd
MD5 109e4d7fdce991ffe6c4b04bcdea95c2
SHA1 4d98c0722f6375adb698cd662eb924a3f2cdf44d
SHA512 5a85be5c14aca73bd44999e5d76b5b4b712ac4bbdb0d6cbc7c5b2d396e326aa2e33405993dcf74df1e85d0739e360880c280b0b50d15c6b5b66e4bbaa4a85ed0
MD5 SHA1 SHA512

Submit Download

libxslt.md

Path C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md
Size 2KB
SHA256 669ede48203cc301d423ece2e14be218c8dc8384a8b0966a1fe104c64f3152ff
MD5 7264c3d087e1c02bdb140de3562f99ea
SHA1 fbeb6bf206a0e62807a78907a1d3fd89c5372201
SHA512 1987274d72b510e96eac58d061bcb8f681a60478e67dea9e5cc787e7e35688c8bfb48fc91f88c659b096ae99f8e9a7a00290cf3451e1ca6d39fba8e30619ccf7
MD5 SHA1 SHA512

Submit Download

mesa3d.md

Path C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md
Size 5KB
SHA256 ffdd6a2dfdf1c161f53a76cfd157c870339cfe258279d1feaed5054e5a41deb9
MD5 8359950229b3853bd3cc45a915b24462
SHA1 00eb57ef52dbf4091685253d628bf0030f067dc7
SHA512 d6ce19dbecdf9190dbc731e41c406b8e668c4bff23fe0ee0db5e3c4ceb0199032527b5bea42695f1cdb8286c6f87468a21c6588486d6ea67e45c56963f9f8e06
SSDEEP 96:NU+TpUGA7wx6e6EEEEEEq7usmQ5S1ACqvsc3QFLwzIZ937s+qYneswIcq/ucp:NrpVAA6EEEEEEq7jmQ0Tuj3QFcupsTV8
MD5 SHA1 SHA512 SSDEEP

Submit Download

public_suffix.md

Path C:\Program Files\Java\jre-1.8\legal\javafx\public_suffix.md
Size 17KB
SHA256 f6863d4de54e6642e4c974024faa45843284f9d2e4470220c88e74fdec283f90
MD5 8e9125f72a052a3952464486af6920bf
SHA1 db75c3313fbe1d51fd0a0b966e6cca6aed4204db
SHA512 1a7eb5ff830e3bfc2b2bf8c9f8524ea315cd753eb99fbbb99370f1284d416a266990eb32392bfb7b6ce73a7e84d8cfa9783ab3f60ac24e26388899efade44aba
SSDEEP 384:g2cd7Qio0MeWzYQp6Gf7MjCN+/RFGcJfcUforo:g2S7QfEhQYsMSQHJfcUfeo
MD5 SHA1 SHA512 SSDEEP

Submit Download

webkit.md

Path C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md
Size 320KB
SHA256 3b8cffcdf724a37d45104f03620f2a74549b5bfabf7d6f51f1d1e33d2876aa31
MD5 13c51a249e1306c6ca1fb9bfd16727f7
SHA1 405e8c58a7e8c04c201bb4bf1ef05cd793b807f6
SHA512 6c015667822063473f31467b9a592b2f002928f1d28a600ef810f76a4424b9cf354d3c8e9f736080cbe489e1b96a4aec33da04b6aeff5413c7b06612ce4b07c6
SSDEEP 6144:yXdg9m8fkf/R+R3TXQzcJNQR5AWxDTVNHtuRtlBe4WPReCxrYXfM:yX4mJ/R+V0cJNQjbB5mtlBe4W3xrY0
MD5 SHA1 SHA512 SSDEEP

Submit Download

asm.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\asm.md
Size 1KB
SHA256 daa85217c7ba56311f05ed93de1fd6b8fafa0be2e21ba724b452f231e27282d9
MD5 cd2ccf48cac19a208890c7b429dcda40
SHA1 08b7769c82a4338805aecf36b8e7872ef460c31e
SHA512 76a3c728f053d8cbd62ed4826442f60dc3a68a8e45c0b3fee1ebc5758b39436c3181c24d4edf06363056a4762c33ea46c3f624e8eb8d21d155e3c02ccb19d4a2
MD5 SHA1 SHA512

Submit Download

bcel.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md
Size 10KB
SHA256 32c6f5196ec41158416cb657a6f9314d9e725c1349e543e7b93b5199cee17e45
MD5 ddee5bb4b029a3707d4dbccc8891e191
SHA1 3949771bb968f9de173ce21a1199e15af194121a
SHA512 0d7128d7b455ae1270d996dc1a96e1254b8b737f907a91a1f035239703f8b7519a6c786770624cce56a14d30e1faf71edebeaed7b98cb14b12cc27e42932d68a
SSDEEP 192:TB4Q2Jsf26LXMptHqbjrxPY/HMDQ5V018MOO7uaQxKy6FkjKNGrF1w3gqM6ZDNbJ:TB4Q/26Xjx8gCVg83x56ejKNGrHT6nzh
MD5 SHA1 SHA512 SSDEEP

Submit Download

cldr.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md
Size 3KB
SHA256 aca7cb2fab20d35a1526819727fcb5278d73804bbf11bde250ea1fbba8d5746f
MD5 0c469dffa8dd91a4731f9e432422a30a
SHA1 794c2e24e4b8cb6e88d69dd2ee1763a3f1d0001a
SHA512 7182d9a84d7f047dafe18e351528ccc9103ee89579f2b2cf852b846647faa7af9eed574a6679bd8b183b447b592bfe80086ab2ae91920bf7f6538d216a4a7bd8
MD5 SHA1 SHA512

Submit Download

colorimaging.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md
Size 162B
SHA256 a14df0c1ed66dd5d65feda216af7b95020de6433bde20014adac4163470f5805
MD5 8906814dcbd0dfcda614e5abcd93294b
SHA1 a196e033b222f448a8a9f4a4059262a9477815b6
SHA512 74c12c2ddba1d171d2ef26284970c46590c7ea85ff0676dc03f8f885e2f0b483c43adeaf8c805b83df43054d4a34a4d61eb1f97c6c993efd4c0628bcebeee659
MD5 SHA1 SHA512

Submit Download

cryptix.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md
Size 1KB
SHA256 928a3c6cf008cd29f24af76c4dcea256c838c8ff38d9a70ed4db4362efa32536
MD5 eb63c2a8f753b444e57935c099c81f8c
SHA1 0f4d66dabcaa468dca3a20c22abab4d259ed106d
SHA512 3fae00a98664bba955d8f2d6e0cb925fefe9a512abb8f6fb75785b53b4d159b7a332b908fbb50815827f38294016f56fd4d67c9ec65d40abb566add9338af503
MD5 SHA1 SHA512

Submit Download

dom.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\dom.md
Size 3KB
SHA256 097e05e8018cea5f74b00ccd635147d1198617b180930a98a896cad38e73092e
MD5 223d588731b97cdb7969e9a66010c9e0
SHA1 def3a8dbfcc2f5e4c21eb02f90c12d135029a914
SHA512 65e08fdc27ce22acc7b3f2b4e24b4349bbcf13577c1ed4228836a1416fba00193adf8ec71dfd2172f084339c313a56799f4c6a768ab5f42dfce1e342377a7e44
MD5 SHA1 SHA512

Submit Download

dynalink.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md
Size 1KB
SHA256 f7e25852970b00e611fa561eaf21176664aba5ec6b1f8c3d405d46c0cc2f1ddf
MD5 fd5ae1f8b08dbeff61f4cabc7a9b217e
SHA1 be3190f827191cc8bdfc7f58ea2f46a0dff2f9bd
SHA512 e91cc39b687347bd9c7bc86e15a7132bea9481fc4a20232d05351d164d8c0ddc8f105c3345c87482d929423cd18d3b9dcac84a11116dc02391edb129636640b8
MD5 SHA1 SHA512

Submit Download

ecc.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md
Size 28KB
SHA256 1f3e77e735027a67b85eaafef6a8bc698ee9956aa24b43368729626df0b6cfbc
MD5 4b8a38dafb7b3c02683f1fa2cc46fb97
SHA1 fd7b23de46567320637ad1c349dbf171a9ded05e
SHA512 cd07a07a4bd0f13715381a0286cf8bc880351d9a261c78baebca101cda2d740a210013c943dbdae60f83e8e9467cf9813cffae643305ce5a6c370f696bed42ad
SSDEEP 768:zpJT+LA67G+nixY0nGC9KwHD+ZVW3YPndQMB2k/4O5etME5jO:/SLT7G+cYocwHsVyKB2k/zo+gO
MD5 SHA1 SHA512 SSDEEP

Submit Download

freebxml.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md
Size 2KB
SHA256 66abb187e2f4b5a8dde1326519656d0992ebe84566e57dc75cc971cbf2f5e8bb
MD5 4e46459eeab4d44a8065c5e72fbdca57
SHA1 4e1b983d64807a9f4dcdd15ed5507a2071e8f953
SHA512 737c55a17f4f64fe47e92165d09ab75687277e632ba57d86a0567b62a472540f26eaab76f0f45ac30f71e76e0c1637fc85c190357d0b345a99ee6515a00ecf04
MD5 SHA1 SHA512

Submit Download

giflib.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md
Size 1KB
SHA256 2cc9813576b7b030afb995365276b348e7821fe3efa0be062df5ac8a82023ab5
MD5 7a78299612fe1d798e7b6e5b04d15813
SHA1 f6d09e18dae81c77dd7c1e706f2556d1fca39169
SHA512 4efbb3f19e72caa16d6b3b437a08d2c4611418388f86c0e14dedeaefb44b8ec6f16cfecc0f1b3fcf328cc058b01d45e1cc4e8d4acb1944f61f143dfdf906b3f8
MD5 SHA1 SHA512

Submit Download

icu.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\icu.md
Size 2KB
SHA256 2e94763f1d844bb5a46aacc8a7d5b8f91f7448a57774267c0cec78596727d558
MD5 9c49b7b88e681453e8f708dfebec6568
SHA1 b52ec3e72b57ee50ac54b30cf0ebdf50204e9175
SHA512 ae15ff0da59411c20c640afcbc9186328361b6b9e9fb856aff75f12f055ec287a1cbbbba8af2e3dcee3675d2b84694b706fd5b9a2a93287eb8bfbf5df7fd1573
MD5 SHA1 SHA512

Submit Download

jcup.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md
Size 1KB
SHA256 8169402cbbf7236b7d9008795cb54e4c9c983aaab98db700d72e2520fdd31c67
MD5 7914f5a3c97ac0cdeb8047d156668937
SHA1 216bd5237a08bc335d7c99b3c50f8d14dfa3dfec
SHA512 b083178dbffa1f74fd27cb7ce3e74de04ff3c048314f0db0373621e1f97d4d6e741bdcdac45473de569c64606cf4408cd63caa348eeae4808de2fb264e4ed301
MD5 SHA1 SHA512

Submit Download

joni.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\joni.md
Size 1KB
SHA256 b1df93e630ff77523949b590a9e7c793bc143af893fe0dfcd52bad4c9201b54f
MD5 80ce78edf607dbb0cf9b2186252954f7
SHA1 974700382e5240c6b01118cbf1c64f515ac7591a
SHA512 ebbec40176bbbad00112bb2587ab38c15426c4509bee414835338e99e2704896467304be9f68ebd0183ab6055dafc50d0bd78fea1bd12d5cdfb37912db9f9b3e
MD5 SHA1 SHA512

Submit Download

jopt-simple.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md
Size 1KB
SHA256 d1a69d907f16e97ddbddfa71051afaeefac6a94a11474b0a29a7f4baf32af32e
MD5 82f5a14e31aaed8bab7043b02cd556a6
SHA1 2432d1735452e6c88dea8b870fc9775ede34d3fb
SHA512 f1303ebc7e39d6a67064b643c5e8bdc3ebb9243f4168762bef872454ab8a34c53a33f9b2ba81a45ff7658137056afdc21f956a4d0ab0c28d21ebc3c9bbf471da
MD5 SHA1 SHA512

Submit Download

jpeg.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md
Size 3KB
SHA256 cc2cddb4432ac25ff8a92e38fd0381ea3c77f617df7599cc74ede0339db533b3
MD5 397ab2a42f5699acc89aec8873f27f21
SHA1 1d126a2acb0bfaa5c0e32ce02da86d28ed733ab8
SHA512 8fcc4d601cbd47300e03d01d426fe7e47389312a1d8afdeb7b055c15cc7cd19b147f225b64774c0a3a1fbccd2f7ce3fe03f35a2942c66dc6d4e85f4ea226386b
MD5 SHA1 SHA512

Submit Download

lcms.md.Bl9c98vcvv

Path C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md.Bl9c98vcvv
Size 2KB
SHA256 64dc9d7ef8c8ff93fc9db7f4e2704ab3c6b78c17d771e70aceb5b15311741b9d
MD5 88b248e3daef6babae0d34c3417a2590
SHA1 2ac170b6fc62273642672ca7ff8ac12b9d04f7ad
SHA512 3cda46f255a49f9d6b1a45dd9197484da356dd097907beaeb95ee5469e6e35d0a90fb2e0d5cb1adbfb49340dddda337bde8e298df72df28e0b9c1859cc0d036a
MD5 SHA1 SHA512

Submit Download

libpng.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\libpng.md
Size 6KB
SHA256 5ed182c941ffb756004f64109f4d56ddb3ceef7dd9533fef0f97df6f7a916cc5
MD5 59c73f0010c59694440fc0e94986df6b
SHA1 63f6d5bba8d6b578f829d4cf754dd6aaf7c3da03
SHA512 8934016adae4bf7a938a0e55b25f73b1d6e25b76766e76f4a86331c6490a2be847d5361aaa0ef3b4d0cc17f558a458ec6bc07f84d7a7f3069e21e340df3b09be
SSDEEP 192:8sb4tQ1gG7oySCA3rMFeou20Fo6hj3UDI1:8ysyT7oy7FvOo6hjYI1
MD5 SHA1 SHA512 SSDEEP

Submit Download

mesa3d.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md
Size 5KB
SHA256 509dd41d23d930da87931717cc4921fd7f86d782ed7a4762c3c814ca5b04bc8a
MD5 900bb89adcad51c72fbf6a076dded38b
SHA1 da02d88beb476a59c5d09a167999abb1fcf07937
SHA512 f32ac3e72f46290954534b05d0601bd48b429288f9387315eceba88e12c8a69c4f8f0637c7db295e4992d82ebad1e98be6817620ac2a7b00c22ddc7231c63d39
SSDEEP 96:fU+TpUGA7wx6e6EEEEEEq7usmQ5S1ACqvsc3QFLwzIZ937s+qYneswIcq/ucp:frpVAA6EEEEEEq7jmQ0Tuj3QFcupsTV8
MD5 SHA1 SHA512 SSDEEP

Submit Download

pkcs11cryptotoken.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md
Size 3KB
SHA256 1aa2da4eea2b4ed42587281de716e6f63a2a4abc639da53732b0d76733216196
MD5 0d7563b7dc7e7819c9962ba4876489cb
SHA1 3a3144bcd4473665b9c72d43a2034739ea0ec588
SHA512 ee831a5100ebd9af7ab3938084ab5ad2b3557b8bc18c97c7144af5dcecd2923c2d795bb4c49bc71b5996b319e652ba40051562773c9baed0232918b5fca81bb9
MD5 SHA1 SHA512

Submit Download

pkcs11wrapper.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md
Size 2KB
SHA256 70e75e57bc8278154be88994cbd8ba48bf73d6aebb546a300789da29905c048c
MD5 a69da3806b4fa2185243fc44c18b9aab
SHA1 1e75aa466a0d9de1783e8de22c9815b20d3b81d8
SHA512 f3d7c454d6ffd3f3260b243ca843896bfd6389b784c6a20ba9a4660ad8c4b394dbb9f9df6c8df70e353761b7f36a640bc46eadf62fe1b4baba189abdfc2c7b0b
MD5 SHA1 SHA512

Submit Download

relaxngcc.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md
Size 2KB
SHA256 7eb6384ca6ea387153c70e15c6ce479230cc2ce382ed6163638d539bcb63b36c
MD5 88de0e272b0893cb60099d2491dde72b
SHA1 a355b577820fe87bcaca929580debf56deaaa786
SHA512 d6c3800708e815915894db2ff0249bbb105c2eacc0eb689c940fde3e7c4fe84368c75a648a748e68b7ecd16fac488d60842920ff6b98bf0dd68b505c4079fd74
MD5 SHA1 SHA512

Submit Download

relaxngdatatype.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md
Size 1KB
SHA256 234e049bddd3848cc5d05e96d1619ce0e8eeb28d48bc604a2758f9b9807f25f4
MD5 13205677879cc2248b73a4ed5fee007c
SHA1 b2618c1deaa5b7cae42209774ab1352ffabcd528
SHA512 42a31f174b66155fa6842e36582695c7663ea25bcd7de4a946d21d4c431945fb067f6c507160b71e51df5c67f95264c53cabce889e8312f9a1072086a75c2a00
MD5 SHA1 SHA512

Submit Download

relaxngom.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md
Size 1KB
SHA256 6630761bf06f687bb70566f5ea39cda90295ddb69f4d29c8aec77984ec34a47d
MD5 0a7f909d86e7328c3fb70d5d54554933
SHA1 7c55da98c2ef080c70d2710aa7ee75f5048eebb9
SHA512 896a4ec9b6ee951321400b65fca0e9f28d89634114048708f3a881e42816d410bd46f0381d4e09dcff47323a5aab64e6aeea20c86d05ed6bfdffdc73dce23726
MD5 SHA1 SHA512

Submit Download

santuario.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md
Size 11KB
SHA256 92900fa2ef628cf034d0e59239178afea0108faf3e6722581dd0b41dc3afa262
MD5 d1102344d3a60c2ab9ba689b9a79abe5
SHA1 b3cb2a9b2383e9d34c3fe311902db84c8481add1
SHA512 2a98d5b31f157b7d51276acf4cac802c4e81a7200c2075044704f040e2dab5464c8cad6be8cea3ebdda88877563a37b96d6750293e52dda1ae481d9a24b6b870
SSDEEP 192:x58myCvlTG7jQH08uLkn6kA9oaXfWshyb1b7QiNfcqqsQu2kTnDWtlZdZuoxWZsQ:z8jC3YQn89oaXesKb7ZjqyFDDw8oA2yV
MD5 SHA1 SHA512 SSDEEP

Submit Download

thaidict.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md
Size 1KB
SHA256 877423dcbfc11cdcb79622410310e8c2bf66b992abce6076fcf18e6f4f933a95
MD5 a9b6c48bae0c259911f4b6091a303f08
SHA1 c6f078da9a2ce4c925ab82df25a138a66bf1fdf3
SHA512 7f72b74ff6f005c31924136103bc210426564073dd6c4608d580fc5bf0dfdfa1d82207cd429e3f75517fa2f6cc267a18240b452a8e88d515790323c4dc9afb8d
MD5 SHA1 SHA512

Submit Download

unicode.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md
Size 2KB
SHA256 8aa154ca7a28878f6f540db3500137125db881f4deb2610056e17bcc6931e1e3
MD5 241d0eb25a46fc38ebc5581c2313b0d8
SHA1 b5186b75d266787f288c1dce705b19ffe38db782
SHA512 640ec9c8259e883c26ac4dc50deea04f0c1bf77a8577af74f7bca04a1898e276f06b08f71e8e98ab29ccedaa0dd1d98fc18a1bea8d8b3614583a9ab7189ffacb
MD5 SHA1 SHA512

Submit Download

xalan.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md
Size 11KB
SHA256 566b4a5b052a165dc53943b7eb7af75a07c8354e3b25445917993b2b1187c333
MD5 2555dbb6231633b8f7ca97657bcd2b65
SHA1 2834e993363d1779d78eba5c27060b82c7c6d901
SHA512 91ad29bbff0c454d72325269a6ac202e9f07093b15d0f1f973c6d7913dde3090e787dd9c0e6d2adcb21687bd5fecd4b3bc89f0170d3afec43b9380b80874fde4
SSDEEP 192:ILLLLLLLL9DZnLLLLLLLLqX9nJpoGn+FEgtisTlu36jPrP4k44A2Vn0NjMS0FCBU:kQJP+gw7bAY0f0AVpFtPr9uDsaqq
MD5 SHA1 SHA512 SSDEEP

Submit Download

xerces.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md
Size 11KB
SHA256 a479fa4fe62472c2e95e3670deeacfd9dd9842ba383498ae1cfe176196d810eb
MD5 e4b47d9b53deb0db4670190dda796963
SHA1 597128e9d45f4211c789299b8b562da953cf09f7
SHA512 4a99c6ac8b9dbe22850a1612fb28a5d31551ed17cc206325e016d9bcb0241cbf98143470909c77862fbccd0d0f654885d5ec8a937dfebd46862ac6554fd915ae
SSDEEP 192:aLLLLLLlLLLLLLLxODZuaAJFBlgKIwo4r0nGUJY0EUrfU86Xq9ZKHes0npDlNSZO:gTJFTM4rwGz0EYQeKt0npDOBYAjq5JdJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

xmlresolver.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md
Size 11KB
SHA256 3d4ac1b376eb57fec46f1042c1122bd8270e4b76701c0c3910559a32561c4373
MD5 072e9b31236e3c2fe9bed0de50dad181
SHA1 3962b7d9a9bc8c78d97c04bbd887814af2d0e573
SHA512 c7e1d7970a5a1f4779d7d7a7ce3456ba22abcb8ab8bd7369c56a4abb76c76b018f21df1c75a923e853bd005a09b4d6cbf8f1ea24457941526c764be38f71a181
SSDEEP 192:yGn+FEgtisTlu36jPrP4k44A2Vn0NjMS0FCBXGQDxJr+GtfV59uSoC1H6qU:X+gw7bAY0f0AVpFtPr9uDsaqU
MD5 SHA1 SHA512 SSDEEP

Submit Download

zlib.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md
Size 1011B
SHA256 deacc20f2314a3ab9032062a5ea61edec8369eab729d74d05dd33d72955bb90d
MD5 1fbfbbce09e5254aa05732984fad179d
SHA1 a4a0f532078b2631a645b105cacd54757f017527
SHA512 5fc00d038f2750d57d264bcd31f2f8dc1db5973f34c899f2e5551da42de3c02d69af5b4dd90e9a28711ff56d09b5a728f082996663f263ffaee2458d9c3978ea
MD5 SHA1 SHA512

Submit Download

AppCache133727656226049089.txt

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727656226049089.txt
Size 77KB
SHA256 3c00b1352e96bcc26f9b19031b8d05e18e60124034bc0d13e4a536950a4c7309
MD5 e976f7eb8902b36e5ce2429814296d72
SHA1 5d21a74fe0e7fe488cf7022e76f1df5abdefc554
SHA512 3f3289664ce2f0f8af4178b0e86b16e9bd4ffcf6d08db2df8d5278318f46cd697f7ff87d4c800a92d754c6aa27bd80184db1e64b3233ac798d30ed0cb6c834d4
SSDEEP 768:aNFtL2AVFH9kwep7MkLCMTgwZ/0xbPo2llPZPPABXUO42w0Q6G6FVX1To+YwvMcF:abPepHLpj0xlyE1h0XJ5SncHsbcx
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppCache133727656623420834.txt

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727656623420834.txt
Size 47KB
SHA256 3077486837a38cf78b1afa8e9c693573b1a6ef13c620fde46ae26a93900162a0
MD5 8ae5c17dac16f33d63d8d2e4092c26b3
SHA1 4a7a065e57c1a232970526081ba750d79fae39b6
SHA512 e3b1af91bf99c929af2263d3535f46593e275660c1c0ce4a80006a92b02d9dc8d29e0ae3d925598a70d0d09a94661b7187d265f4f60d97d1732ff6ac44524f4d
SSDEEP 768:IG9c/ucyrvYcJmcjjbIcU+4lDRIA/cjluxcFzcb9cgc+v+Dlhg3Ycq3o:Bc/uciYcJmcjvIcU+45n/cucFzcbLcfE
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppCache133727663536793873.txt

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727663536793873.txt
Size 63KB
SHA256 fd92da5c4659aead7c063b78f65988b94b8cdb0b5c1d24f04200cc30979dbfb3
MD5 0c640a3b6c61006fb0df7bb078d17a16
SHA1 23bd58f65c5b83da435ac208725199f950890774
SHA512 6492455eebc46f76a3d020262e32335097d0c73c5989077f9246237d9e37c316471b0659b5e30ca97fec4aa69462778ea2742343239a6db020c4b35dcdb30e8e
SSDEEP 768:9s4me/CWyfbcCcGeuSPo2llBcnuppZdF4cB3KvBtrT2vu8FNv2M:244cCcGe7lPcuHZccB39FBx
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppCache133727666235612999.txt

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727666235612999.txt
Size 74KB
SHA256 1c23a0b18bed4b670318c094b7302daa6b223d4ebcfba75fedcf3cf7332243e4
MD5 8062345892aae1a24db06d8db5221585
SHA1 b50398e6ad7813e08c17de0864723a8b29aaa739
SHA512 4b292d18f83f9cc629b995f9a735e3f3326d3359baa21fb099f1b329349df8f8a498c8b40eeec5a892c838acdd13c62de8a21f5d20698bc3ea79d0a8bcbb2a98
SSDEEP 1536:GI2IcocZEcGXzU3socG71vu/h2cucQUcUcFzcbLc82IcRN384B:o1ZBGI34GBG/pfEx+cnRN384B
MD5 SHA1 SHA512 SSDEEP

Submit Download

File Explorer.lnk

Path C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\File Explorer.lnk
Size 407B
SHA256 dc5164a80e1d65deaf078c4671c32cb0953ac1c4fd083ef6a5ec5be52c8ec76f
MD5 8701c431b11ace57ae6237b5095a2078
SHA1 c40d42c1d9f37692ec387715cd81c6b0c3326b31
SHA512 97fa328626e463da595ff556789ea4c804b4a839db4ea3a38f5a8499a7f5405202ce938e0f0fc3925b3416bab8a718b5cd7ddc7d41fa771600297e5c19bff91e
MD5 SHA1 SHA512

Submit Download

ASPdotNET_logo.jpg

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg
Size 21KB
SHA256 23476dc0cd1f84e63d058d48011f5a38cf490600f188cf030609780e28c75c65
MD5 5f66b98035345c741845d4df520ebee6
SHA1 c73371a35aefc26303b7a7e7be729714a5f5d1e9
SHA512 8c224f8cd32a0befc6bca9e8ac1b84dd13956998c1b188c70739c8a4eb326a51d3ace66fc508722978cbd59eb8631a23dc5a11c06328e576762c8c110fa784d5
SSDEEP 384:3KZMN7kpPtUPVr5zhGaZs2jBRIzy2M9tpSiIhrnQrLDANfkaT5O:3eWmUrzDZstwzsn1NfFTU
MD5 SHA1 SHA512 SSDEEP

Submit Download

HelpIcon_solid.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\HelpIcon_solid.gif
Size 1KB
SHA256 f675696fdc11ddc4a99fc45c82b70665def2cd9eb47feca3372ea36679d3253c
MD5 88c97f9ae243554565e8def5cab285c8
SHA1 d30a0eabb88af9ff4cd3554072675965b094304b
SHA512 d5a0bc47578f6d5df36654f33d3df293e52f1c6312583a273ff1746176a4507ba5cb4e0e7c237ab19ae2d0d8215c47907e2763422d42e52b35b1b9a52eef474a
MD5 SHA1 SHA512

Submit Download

alert_lrg.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\alert_lrg.gif
Size 952B
SHA256 e27925ab98cb485a948fdcca19a5916815874769b5af5d3d254b7085c9581835
MD5 fc18677ca4043b0d8a93d01d39063887
SHA1 3bbe3183e7c766be774f40c61f42ec19880cef4f
SHA512 73a4a24ffe48796d3db3ac761770fd81af89492bfd6e10e3b7a19838f9ae8f9da7c45902a350e8d83c55d8dad441a398a61b9b361785f37f0cbe896fe619c0bd
MD5 SHA1 SHA512

Submit Download

aspx_file.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\aspx_file.gif
Size 121B
SHA256 382f29a58f6673297b2578cbd4aec4b7b6f225af83f74faaf5983334a651f97d
MD5 b95280dc2d0f115eea4d02e5b67c3ed3
SHA1 bcf7fcaacb4ea2dbaf5f20f425fc2c58e0964d59
SHA512 ed98534e020ff950e56fb9074b8145a158d180fc9b46c1bd3ab27981ebfb8d5a84e805602c7cf409f963c9851421c88ea4277a07310b429ec0b7f360bc4008d6
MD5 SHA1 SHA512

Submit Download

branding_Full2.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\branding_Full2.gif
Size 1KB
SHA256 7ced6b3f05d22fb22e7a2c96df13d9e1f7d2297961a55dcd49205f43aef2f17e
MD5 a084499c4b14d106dc6ae542a55148e0
SHA1 817f92e0ad9704a62385b2737829fb86c2e123f0
SHA512 b5e42547152eb17e3dd60a10d04bcb8bbd9bcd96c9c02baf741aaba29b8990d7e0f0fa7738c7294cd0d19ccaacde66adf3ed1cc8ad74ee6c9930a01183e25e88
MD5 SHA1 SHA512

Submit Download

darkBlue_GRAD.jpg

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg
Size 8KB
SHA256 0bc62c17bbf1aee86137cd8d36804b3f2985240c91fcdae942f1a51dae696f95
MD5 0305f3935eb97f0e28576793fed2a454
SHA1 b6f32c3487aaa7bdd975fffdd7c97963c28b3e44
SHA512 b63c28fbca595ccaf7ba1a0462624970c214742ba60892c9c64674d6c6728398ef92a480a2d7e41b6fdaf9138574247caea959c006fe71e4a7466429d4b80a29
SSDEEP 96:yMlZSQUzBay3ML/dMF1Fz7vf9nEq++++aNn+qh:ywZfUzd8z67vRG+qh
MD5 SHA1 SHA512 SSDEEP

Submit Download

deselectedTab_1x1.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\deselectedTab_1x1.gif
Size 61B
SHA256 ff193e5888d94c897d36f0132433d46619a75c2d8b652b8cac61dc1919aceda6
MD5 b40036cff7a236be3c05c4ced98134fb
SHA1 d7156ce9dbe28ef15470d0ae556d9bb1c8706fcc
SHA512 f22b2956d7093b5e61eee47f75a27f52fc0f0963ad8786e24dae878969684aa6d15d5a39d042c2960b2a41f28c3581e57f043e43d926476cccb9136599b0f46b
MD5 SHA1 SHA512

Submit Download

folder.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\folder.gif
Size 914B
SHA256 28ca666cbdea89bd23c1262dfb262f6b171a462c50b4b6a2864a34a9f6124f29
MD5 537383f503195b2885e38cea448ed5f7
SHA1 73bad596c39249e5aceab4cc66ddf5c7e116858b
SHA512 8f39e25c5df04854a73f9c3625ecd06a17a3ec1c83a905a91af7d9ec3be20e61febaf1243f59b67d98bb32af4a9bf0186ed9788e4ee12cf8f2405dcb82775fbd
MD5 SHA1 SHA512

Submit Download

gradient_onBlue.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\gradient_onBlue.gif
Size 90B
SHA256 ef562177487f2e8375c153bda7afd567272aa3892b8db33ad6da1f1ec581eb6b
MD5 757b8dd52893816d18acd53747bfb0bc
SHA1 bac3e7b9b85b233e713b8dfbc5c3ad45c6d99d2c
SHA512 874700a1a4f8fc5a88209a9778bc2e0594742db9d88638b72228f75c01f6aad723568b3e59da8175253052d2cb9534a0f94689e02758598bb94c943fc3011a33
MD5 SHA1 SHA512

Submit Download

gradient_onWhite.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\gradient_onWhite.gif
Size 90B
SHA256 f87964bb48f948ed7fc49858a39a17ae0c7a8b55b0a4cc0037ec6f6b4d5ea335
MD5 7d79542dbeafaa523f55e565365e65d2
SHA1 448c53227bd2a68744801f4861dac88d58be27b3
SHA512 f0203bb57c1c36852b7ceb90c28310de4448a004b1ed784d37ab05f7e18886ece077886b50c6f7c2f250c0196df8cea92c3e84e577bc43bb494b121d2ba25795
MD5 SHA1 SHA512

Submit Download

headerGRADIENT_Tall.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\headerGRADIENT_Tall.gif
Size 328B
SHA256 c5240b6a850c5116fc7806e010930a63fa28f629ca363868dcad746dcc3c10ed
MD5 8961e7d295079a3da8de9c5aa4a819ba
SHA1 934731afc0065c164ab45335f216790b0ab119b0
SHA512 562b630c5d6df67711413001b6824a7a4bf8205a8b4e0562f249bbe02ca3eb170a9c75e4fd74cf1ab129d8942329a38b142f605d9f7a54fb7b07b3961068eb74
MD5 SHA1 SHA512

Submit Download

help.jpg

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\help.jpg
Size 1KB
SHA256 09a860d631b024dff2ee0286417757f888a21115221c1c7fa8b31cf22b0449e3
MD5 4bd333d90abaa611759c63702460a97e
SHA1 1bc0aa55c84b4cec249011659d1dd378e8827224
SHA512 40968cc945139f23e587c8b7990f036d3f61e385bd2eab1d8580ec4125ff30d2889dd5e45b8ad5df9c567e778b8d8d34e6b78d66dbf6b8050cbd9922bf08c439
MD5 SHA1 SHA512

Submit Download

image1.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\image1.gif
Size 162B
SHA256 7bff5df8f5c5e87bc4e4a9cee04de9d14c3e9e23b0f60563f2352a38c39b01ed
MD5 65ad39bf7b613ed2991b768c5a53a6bb
SHA1 f74e404612b32cef39de33727652708873d825ef
SHA512 18f22e62d8c7fe432aac8e26609c125ce5eba94889c8cf581311dccd7caa2f73d35f6825b39c05f16e131fd771d645eb79c06f4c279a4f0f51231567abf46ff3
MD5 SHA1 SHA512

Submit Download

image2.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\image2.gif
Size 586B
SHA256 478ae124c83ab5d9dcef2f90606e7f5614f1a72ac3509221ee456d6b38e47465
MD5 642a4f7bda16af066f503a5f102088dd
SHA1 e1536dfdfe9d1e6ed495d04ecdd3e9d1ba4dabc5
SHA512 078b0be1ee69cbcf320200640d8c66f2776e6065a866789ca7610f577df49748487ae0edd695820cddc22b8c79ef50fa57ef4f2fd4d4320e770716a2e2b8c880
MD5 SHA1 SHA512

Submit Download

requiredBang.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\requiredBang.gif
Size 124B
SHA256 b882c41e9a17264effae0a81103677a351248c3d9c9687b8f33b832428caaafb
MD5 c0a36b230311e53a684d35670a60d347
SHA1 3aef9426ceb9e6d32110a87e1a34382df520da4d
SHA512 cf3124b8e9a6e5f75a861522e47d56e21b07007e1819a8874938e0a6f2503478eae00cfb512d5a13977ba6136c61b5fcf00bb099751d130162d8a23a6b235be2
MD5 SHA1 SHA512

Submit Download

selectedTab_leftCorner.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\selectedTab_leftCorner.gif
Size 65B
SHA256 854a3d06095ceb965d0fd3c2b275e4b84cedc05f93c3abedcbbcf2afcf0c1348
MD5 e14c7cadfd93f3f1c3aeca220474adfd
SHA1 1d043b314289718d395f86016f5a56898b95b7b3
SHA512 a7633878c664da07c7bef1293e4ebfd185a1f4acdecf5ebc49b0a3ab103da16980427e17026920a5c3435c6793e02a32f358e99df14fb45ded2d0ca3edb5043d
MD5 SHA1 SHA512

Submit Download

selectedTab_rightCorner.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\selectedTab_rightCorner.gif
Size 65B
SHA256 2f40ad49d115567740919bfe99eb0e179d68ee53628b3aabcce265c355cffe53
MD5 26b44f78f18fc0b219e29871667efde5
SHA1 74746f735cfaa9c2b9e217821dc61a5ec0000433
SHA512 83eea8ab21a74333dbb2a5871ebcc45f4acaf21c3a1bb4ab3c5d5cc8888ba52fa08a131a123e3091e72160dff7ea51f3e66b76362ae268658123f20bff4eed3a
MD5 SHA1 SHA512

Submit Download

topGradRepeat.jpg

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg
Size 8KB
SHA256 b1eaf5fc907db4aee35549cac6866755cd51610a463abec89b4c62d2d781f760
MD5 ebf4afc630984bee8d56d68a63ca540b
SHA1 f415d41514c38f3bb1581c43f3ff5bc275870590
SHA512 f63a802ce39e4a25e1cff9de9212cd546df38c5d9f35ed69cc9025175c782546c3f0ccf4b8506a3d8e400f7e9f6a6a3990d7f6ae10d4b9a72ee862790b31d6f7
SSDEEP 96:Mz4Dzp9mJfX4dJjc2XWLWCJwnzexChLTCZ8zl0000jxQvUTSJEd3J:Cyy5X2J1iwaxMK8zwvASJ+Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

unSelectedTab_leftCorner.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\unSelectedTab_leftCorner.gif
Size 65B
SHA256 3528ecd2134a99c8ed567453257ea29504f1b96744546c339f622abf855b8074
MD5 69212e15dc2754acfb98f4fa6939a194
SHA1 4c4cac7d83176f40c2cee3dad96a41e7d306fdd8
SHA512 b4900e2c21dba35f5f4d3eeb5deaea4b2e7256b6cf84f2ebd34cc7fec19499dfe64f69002ebf970b7103d591aeec469be22d7970934892dcaf936c63618a640a
MD5 SHA1 SHA512

Submit Download

unSelectedTab_rightCorner.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\unSelectedTab_rightCorner.gif
Size 65B
SHA256 39772bc872af06c80efd8cc80a0023a02fa2a8532a9bd392b503501550e44918
MD5 feb5b28daa7551890e6a6397b7e93bde
SHA1 a7b20c3fb24cd64ecca2a4a1f43f4bcb184e8abf
SHA512 f35366347505f6fc856e61d2457ae63da08444ad0fc6f8d6ee0f21acca80f0abbf8d88147d18d6ed6138aa69cb7d001e7076fde0457a99b372d06a27cb2b654e
MD5 SHA1 SHA512

Submit Download

yellowCORNER.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\yellowCORNER.gif
Size 880B
SHA256 92d74e36a166d280fc2df176b0cbe38cac3346f84324df00922aa099d26d126f
MD5 3d8afe0e5ee0a2e3eca1f1ba36736578
SHA1 a2189ca542eef367336ef3fe6637c093f7f64a2d
SHA512 94db04e298ef1e796f793d2ee30dcd6baef04b4ec5a540ed2a23c5ca83c6f7ddf794f5aaf6d55a943de3d21e55bb3ff84e6bbaacda994cd14150c85f056088ad
MD5 SHA1 SHA512

Submit Download

1 - Desktop.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group1\1 - Desktop.lnk
Size 1KB
SHA256 87ef1861e499d5430672e1600b9745badd7c49495f12d3883e61cd0c6d6ecfd8
MD5 a824b12529ed935ac7677ee8cab75b6b
SHA1 4cdf566ecfa4fc721e493b607ebbd99aacd4a80f
SHA512 570f404ca9605952296b0f5ae2d024dc4bdabbd53d4106aea952277836762ab8279a30456796dc268184992e9dfffe6cea4431fd2a1f53e89f07c5160cd156fd
MD5 SHA1 SHA512

Submit Download

1 - Run.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\1 - Run.lnk
Size 1KB
SHA256 f7cf7ca8a19401718cd05167b0a052762e0b2e63e57dc109ffff21b271f2e5f4
MD5 be08c0f206f9b58055fe9deceb58c1d7
SHA1 24ab347239b1c78005984a083c2b0dd07798aed6
SHA512 8978c89b6c5fda76fe9c225d8d6bdefc8d815a690d703f1097610d46adb65217e2351e1c3f9acd811539fd6b15a0f9eaced6dcc02fc3be800fae1e61aa31e398
MD5 SHA1 SHA512

Submit Download

2 - Search.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\2 - Search.lnk
Size 1KB
SHA256 4d0c2e3dc0008c4b182f9f032b383a1efc6c073736487a79dcae0c6bb21f4a7e
MD5 801e211fbfff7d79acba416296aaf2a0
SHA1 c48e4c333afcd76569fc8a947821dfb089a60941
SHA512 c09f09c4fdaf7bb1686b28ccbccc801fe74d30aa744afd847a0cb52acded721f473785bae6b9df6966ebee5951ee0720159c7a47bfbcaeeabefda4ced630c62a
MD5 SHA1 SHA512

Submit Download

3 - Windows Explorer.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\3 - Windows Explorer.lnk
Size 1KB
SHA256 cce1c0c87f03da03397dabc0735013d54ddc27345f5c3127633ee495be0f63dd
MD5 37cebafa127d49d52736aab5b7f814e7
SHA1 e4b211f188ff4280aad3aad38ad16164a2238e30
SHA512 aab516d71b871e29f0d03c089dd1cfb0d49a1e7ff8158fadee8bd328328b3165a19004d31ce68d6159c7e18d9eb40b665f0841ccd0fb5e3843295358c5003dff
MD5 SHA1 SHA512

Submit Download

4 - Control Panel.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\4 - Control Panel.lnk
Size 1KB
SHA256 eb01af350d3c5d5429da2a04c51bd8cca343d6c578e7184a77ae53478eaa09fe
MD5 d514cba913bd9e02b412cf783eedd738
SHA1 7d90a71be6f8bd09836bbd7dd5a9a45afe395fd5
SHA512 f3cd33f5e3e010579972de618a15bf4371bccbf1b335ed08b9e3ccf74bfe1e6b8adfba08d6a8d7767bd0031439e86c8c93198746c0b3c8d9572735e7080ded92
MD5 SHA1 SHA512

Submit Download

5 - Task Manager.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\5 - Task Manager.lnk
Size 1021B
SHA256 0bb72c310a8473eefa2db2cdc776595e3e3247c806af8e58e3c4407fa654d8fa
MD5 b0f8055fa406e39fb675a8a2b6aafe0d
SHA1 a2680507362be708ccd09bb4c52d6130c7e508f2
SHA512 da75b80809271b838f847cbd6f2cfffcead90966067b2d81ccf0f944268982f2061f751c2e4b01517d77b0bb8aa28c4cd69d60604d0043244f16bb79cde5f094
MD5 SHA1 SHA512

Submit Download

01 - Command Prompt.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\01 - Command Prompt.lnk
Size 1015B
SHA256 326b4196223a591dd8b6626a0da7571e22cc4cc3642f6292c366d82ee77d8058
MD5 15b3dfd4952dcd83b700a50032a3d9b0
SHA1 9741ab9a5164024adf94f81e51c45874f61812a4
SHA512 98a156e641cf21d8dd2c9b44a45dbae2a75630d5fb641d23d7ff6bdfda0e05d025f858c7b6a0317f7b2f4395d0dad120f68042bd5585b392120dd429b63ae849
MD5 SHA1 SHA512

Submit Download

01a - Windows PowerShell.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\01a - Windows PowerShell.lnk
Size 1KB
SHA256 66a5e636ec551180feff8f023c2bef54be0a44c4c26a7362571c938dba541666
MD5 52eb1e6c341d492d6f4fbc0d1eca6918
SHA1 09226f86db935fdcb1fe4039869e73d48f0a64e6
SHA512 5251c2381cd51891ec675d01b15c5b4690fe7cf103dbe6db5c4a65a089836603b15eac6929f46343932b152919ce42e747d75a2a9bfb830361f2386e57598edb
MD5 SHA1 SHA512

Submit Download

02 - Command Prompt.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\02 - Command Prompt.lnk
Size 1KB
SHA256 fc546df56831d72e4727a6245b14b1670aa6d11ce16c244b1c3641cd2963350f
MD5 2e0d2e635971b26d8d168c53f7573822
SHA1 1e7bc7cfcecb8475cca4136dc19297fcab9ba0ec
SHA512 5986ee1a92185389128b6557e871277d421433c8c39dc36cc3ed95d4877b954a74e42431f691d16d9c7781d769ac348474a47c01deb5780064daa1a3408d9400
MD5 SHA1 SHA512

Submit Download

02a - Windows PowerShell.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\02a - Windows PowerShell.lnk
Size 1KB
SHA256 e5df877ec681fee35d81826ef84d179d23fef8d0fb45a68c74b58ce23b0c6996
MD5 c28f71237b96acb5158ca49c905f2c27
SHA1 033c6cdd169bd085debc184124d3466d6b30a19d
SHA512 10bca5fa5b8689ed259a7d78b4114162690f3944b22ab05d46d100319c6e92c1c7db0a3760f4e7eeae8c8d6030e1d5a096ccd42d631af7e214b32c4749777338
MD5 SHA1 SHA512

Submit Download

03 - Computer Management.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\03 - Computer Management.lnk
Size 1015B
SHA256 d593cd299db907457d036acba2c3003beec8a1885b90f317f2ffa550a5fad674
MD5 0fe86bf21018e0bcfc0cba17ab51fcfb
SHA1 e42600137853b3ffb848ec1d31e63bff20349795
SHA512 6397d56d8a9e466f5ff92827336e108a783b26225f2e04d6631b31b87583bc8920bd048a604250a8a90054678ea58e10bcf984c8aa1ddde8e92e3354393556fc
MD5 SHA1 SHA512

Submit Download

04 - Disk Management.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\04 - Disk Management.lnk
Size 1015B
SHA256 834dd93b98c3da2eb73402c406762b72e26264d02309aa4c65c91f28604ba6ae
MD5 d1a0a3745ee89ff6e22e8bb6e93fffee
SHA1 d969c93df99f47fa69bafc30a1c4e8370055c40f
SHA512 6e90d2399fee3f3b0a746ca386f38933e409a37ef5251c973eb56a9da6ed610404554a18272a720cd7ea489f68a9be2d18d81260ad483882250cb9d8e5ae398d
MD5 SHA1 SHA512

Submit Download

04-1 - NetworkStatus.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\04-1 - NetworkStatus.lnk
Size 1KB
SHA256 b8ebe96b7152e3778b97851962cec5fa9e398621526348cb1fc53769d0b1f823
MD5 c0296e5e6f0dd0689da739f359eaca4e
SHA1 c09ecbf9e1b11aafa1fae4a0651972ae26beed14
SHA512 3a4517b6ab7f19d2bf447ab9ec27b6cc29cdd5b2333f195b7acede2161940cbc2d4abc51e2d44acd359ee2cca63e965fa1b4962cf9a6b45be6291bfd4ce91ceb
MD5 SHA1 SHA512

Submit Download

05 - Device Manager.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\05 - Device Manager.lnk
Size 1KB
SHA256 3ecdf5241e30e9a57f21209a3901df430abdeb40f2acc5bbe207f664f440eeed
MD5 177745b10c7aa48586535ffbcb1615cb
SHA1 dd1edaf4abadd7efb1599c4df5c9085daa408bb4
SHA512 1278ba9889c59d6aed429f06ab9bcc66c845e3d5ec45523c23d22f24607c9ff82d5919b0e0dd02762f0d58b1f60de4015b7b1c2695502396d72e30e658a8833f
MD5 SHA1 SHA512

Submit Download

06 - SystemAbout.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\06 - SystemAbout.lnk
Size 1KB
SHA256 892b9b0be97d2c35373c5ec8a7668ca048512df4d66900b04555694dcceef17b
MD5 cd7bdb5bbf9907a6854c9cc0de8d96c9
SHA1 088fdc07b8a5f73d3eb0d6e94bb27a787504e303
SHA512 3dbae981a5dec9129a1c726589d63514126e5111f36651b8a8e14ac00129ff7f1be173199d453e9db0e9d106a68faa661fe9b8594529cc4033ec217148018a2f
MD5 SHA1 SHA512

Submit Download

07 - Event Viewer.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\07 - Event Viewer.lnk
Size 1015B
SHA256 b05bd16644443d3a1072f72a1681655eebb58ee244edb6c37c6dad5cd3554148
MD5 2796297089ff34b458fdeb6c55919c43
SHA1 40bc75e439f760624774f5119c8ecccac61e9257
SHA512 a9b1a5bab14e0df5c046580952d2eef7d28fabbe9620c6edff5cb7762cf2c7bbf726618f95394267146101e298dc85d8f2855c59f82830dba34f81a209ffdd6b
MD5 SHA1 SHA512

Submit Download

08 - PowerAndSleep.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\08 - PowerAndSleep.lnk
Size 1KB
SHA256 bc1ce2bc4dbfef0d09646b976fdfec3691c12647ac0fa619cbf08e4b3d72dedc
MD5 1cbe8e293aeeb9c8a0ab601eec9c5bb0
SHA1 12d9507d7049066c6535530484d58722ead01d08
SHA512 2a4d236f74560d15356cfceee94a1c0d8af18d3a442a5308896929db71c58c723b717f5d230a29ac6e06661fc0add4d55dc3848986ef2b0837e5a2a7c1e0bcb6
MD5 SHA1 SHA512

Submit Download

09 - Mobility Center.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\09 - Mobility Center.lnk
Size 1015B
SHA256 a59d324c2ccd09ae327ddfe83b2c927b6f9b429616471598ac9100a4845992ec
MD5 685e74367ff157b000bafb89004f8e38
SHA1 6b5d607122037d1148024b9aae50627941f83a6c
SHA512 60bc6ba63ae741570d0aa1f4cb406aeed513d3dc84b0bec4268cc93a25217d0e01d485accce1f1f9602322c9ddf085e169f2e68c321f1dd9a37b845e00cd102d
MD5 SHA1 SHA512

Submit Download

10 - AppsAndFeatures.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\10 - AppsAndFeatures.lnk
Size 1KB
SHA256 c5896f8522258f06396d6d83c478ab2f2c70f8284722a3e6cdd9a5409a911f73
MD5 b1512c6dff9594ca112453ffde723c49
SHA1 cf9b2e84b460e5bfecf88a25b2d814300c30414f
SHA512 63e45ec28741ccd7c501587dc0f6b6ccab5425fdd38df77a3f0d4a212c23e79b6489d0f497205d6755b9cd0e212e4a4cc37552ac1743b64fa732236b3451b53c
MD5 SHA1 SHA512

Submit Download

Shows Desktop.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk
Size 352B
SHA256 29cf41dc34391726285288b889adc44e8355775e1c326d462845b96126e2fa1a
MD5 cde4056dfc6f273e8790c8a06f44a8c4
SHA1 3a5f243ca512bcbd721875f79501ac478bdea5c3
SHA512 f5ad73b305d527d8ffe41149e3a5d971d57385123915e93980a318925474fa0501d73fb08965ac800f87dddb6cf179fc847768dd23b438631328e3dede2344e4
MD5 SHA1 SHA512

Submit Download

Window Switcher.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk
Size 334B
SHA256 c7b7457bfaa4c4177312a966846e690d29d010a9b7e3d7087bea302371cd62fc
MD5 b032dbc7a42d42b70ac666adff3f3552
SHA1 63843846433f8d85003421d66b5689eb3892d616
SHA512 8dbd10d2811737dec726fce1547543192c160742ef91e86ffc107b35c8a2e44f363e6fd55f4e3d4803b4dc844642233913dc0fb119c0a67c06c843f06217a749
MD5 SHA1 SHA512

Submit Download

Magnify.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Magnify.lnk
Size 1KB
SHA256 86405363a8808574686f2a06b794b1621459bf346ebafa025aff552868084f4b
MD5 1e3171a0bc67b74cb1daf101ac3697f5
SHA1 c4d4d612bc81c4b24758ecd2ebec21fdc44ccb64
SHA512 16a86d581f765f745bdffb7c05eff0290664521ded16bb500b3bd2b5958acd95275c0f785092a3f4f507a61402a481e018f1d19b7893ce761cb7f955617be61f
MD5 SHA1 SHA512

Submit Download

Narrator.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Narrator.lnk
Size 1KB
SHA256 e8066111e95d4199bd4080e15fca45beaed591665c0174a23d4631deeebfc473
MD5 73ff90c85c2a4f4259b175338aff2be7
SHA1 bbec18c4ed1137b39101b7501864eba2e0072cf9
SHA512 96b34da518ff26fbac59c163a14f6df7befc375881f9a3895660601329dabc653d2fe67525aa9b1556bd9feb4e59133938fee31e583780c6e16e00cd19111497
MD5 SHA1 SHA512

Submit Download

On-Screen Keyboard.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\On-Screen Keyboard.lnk
Size 1KB
SHA256 11a95c9103d6af28c2510fbfb07815ad0b5d55f043fb2db9efdf0b0e305ecf2f
MD5 1519a6a440aa1ba5ca35070b6a47e759
SHA1 2eb2ae6d792e52dd6648a8756bf52323b64b92c5
SHA512 d919808fac4763b740e286b59db2beac54b623b38c474edb42ccce4cf14e4753c7917521afd4fde3f637633daeea985089d8bc9e71d111ebb9f80a7e3d597842
MD5 SHA1 SHA512

Submit Download

Administrative Tools.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Administrative Tools.lnk
Size 1KB
SHA256 f007fa7bc3c69faeede20ebe4409278aa26835ed2b2ab6f3f018050a945c28bd
MD5 b2cbaf9aa921dd39042abffd505c2fc8
SHA1 3df7cea93d5a61693192e947573b8efd3682b9c1
SHA512 8cd8fb32dfc76df4812771cc8972621cbdf755108bfd7bd5c340a6b314c62c0270374e661607caa40fa2c20d9e9078f34d1815c64903e4c4bf6ceebe56be2734
MD5 SHA1 SHA512

Submit Download

Command Prompt.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Command Prompt.lnk
Size 1KB
SHA256 e32797bb74f4d4da92859f976c8557675b698caa3b51fc33f2a62b02f36bfa02
MD5 a2a39bc981c9d38377018476f09979f4
SHA1 35c91aa6932b5b8363ba1a7ff937665b45ccfd86
SHA512 b68d42c51d068425e0aed9c702cd0f61b5329ce5f38ab9d7f29688057ade60285a9181d7318397f2c4845df640bc1444ae96691f567ce01391b28dd6161103cc
MD5 SHA1 SHA512

Submit Download

Control Panel.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Control Panel.lnk
Size 405B
SHA256 e838b23e543a4db434dec79b5bdb2db88edbcda25b143432f5f4bf93bed94a78
MD5 c31695319e801ab59e9a6ddd76556090
SHA1 d69bf6fabb7710837302a0d327894d542f26ecc8
SHA512 85d832ae76ed20fd14fe16341cc20daa122911893353aacf898c69165fe4ddf5c51ad197c569047117e96f2db95f6cc393e30d775affdffdfcfca7f1bd59b8b8
MD5 SHA1 SHA512

Submit Download

Run.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Run.lnk
Size 409B
SHA256 b8260c096efb106aac4f2b978b9f31855faf6a9d9a992ca3cfa80ed1fe78228e
MD5 27acc3e8df44f6abf12977bb64a160c2
SHA1 0cd28631f107c6a33211cab859a013dcc4bb0bca
SHA512 1e9958e22fd9189b09177b6e7a9b7e933ecb75edf5a64c2484d27ec28fc04a035b8c67e6e1ffbd8c4afcca1b9c5e18ac1abf3b3057f4aa8d4c16dc517e30a2b0
MD5 SHA1 SHA512

Submit Download

computer.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\computer.lnk
Size 335B
SHA256 d336eb0647e805dd0db97af2adc1cbb043f23dbc11bd4e67c5f107ce585a3811
MD5 2479e78731b17f24b7b5958749f07b4b
SHA1 379e5d94475f8d8d8bcb6f346fb4aea54a7511c1
SHA512 de3f584ad1056058fd2ae6d560c841703d441b2b78094bbae7397fb8eaf69a63b4c7e9a8d8f02b5232ed6a531d693c81ae9b4a33c462112cdc475ea82cdfb5d6
MD5 SHA1 SHA512

Submit Download

Windows PowerShell (x86).lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell (x86).lnk
Size 2KB
SHA256 c8b48e494141d6dd1500c6aea0380e241f8042abfb170775986047cf61ee2a64
MD5 eb1835d55d2f928c4da36ff26e37aa59
SHA1 87bba452d8d82cb61c6acadda09a8c231db50682
SHA512 67f6de6ea705ade4632d131d44a2ffc9d8712015e960c354a9773c6ec84ab24b2b2b1e4bbd292313345ec0d565966475b3c5fac510f2e4751061515db67d3636
MD5 SHA1 SHA512

Submit Download

Windows PowerShell.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk
Size 2KB
SHA256 f4d062c80312ef7ebf7e7990c29931b8ac94618a5b39a4089e5dc42b99aeddb4
MD5 4db8b347bc9ae9a1d0b532460d976913
SHA1 13fa894250d23af232e92e2b530a9e8e5526369b
SHA512 b0554562b6909f1d6b0249627a22c10fe9c8af523c02cec617ea35128a0e0ca116e6a999692b53ce9d459105c2a62da402620189163fd2ad13699c6e18ca6557
MD5 SHA1 SHA512

Submit Download

Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png

Path C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png
Size 296B
SHA256 880422099bd744bc36bbe74dfc64f1f608bc92ae35cb0017359fc24c180a886f
MD5 4a30450d32bc8407341732553fbb0a50
SHA1 aae1c55b7e4a51817b9956e9b6d364aea54e8f39
SHA512 be947a06185a69b7033c999a09383672f213ab6434f55cd4f44b809e2abccc33714af18783ffd93bcf174d646ff365cec4e726280f33fe1fd5c87ef9444d14f2
MD5 SHA1 SHA512

Submit Download

Square44x44Logo.targetsize-44_contrast-white.png

Path C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_contrast-white.png
Size 276B
SHA256 78a601fd2d7499fda61c160e4141672017fd5019da36f1247a8fb1a4f77f09f1
MD5 2601fbe604adc00a3c283668c205d375
SHA1 92adbac0c21e7d510591dbbb55c5b065f55f6047
SHA512 3fb200a72bf9b957c33f9369c5fab52d82bb45a7e88fdc9d194d4dfbfe2e6c6a2cc49170a5dbd9c38f7c49db4210f687f1eabddc54569b9808b081bf0d4c0ff5
MD5 SHA1 SHA512

Submit Download

Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png

Path C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png
Size 296B
SHA256 1cd37b97f3ffd4af054c03366f10eb386704ddd037f8c52eb4ccf9c5327d937f
MD5 458cff5a7c5d1ee1c51156ebf11771c8
SHA1 1156a0ea90df555515f5eb8db5152eedaabdd96a
SHA512 04ea9033da7ea0f0450f82ab67385981cb87b8c0589fdb5af48eecb13935b61da37f85d1f50e6a01d934b1ba5b49c853fee7d1ef70b08456e111df3c944b6045
MD5 SHA1 SHA512

Submit Download

Square44x44Logo.targetsize-44_contrast-white.png

Path C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square44x44Logo.targetsize-44_contrast-white.png
Size 276B
SHA256 a23bb626c15e6399f57df5cb6538cec44345d08ecdf0bb6002cea1c473867015
MD5 8ff31026b019fcf278fe062ff42a1f9f
SHA1 c94de40bd7d745106c4d99d7740f2f3bfa885eb4
SHA512 df3213674a581daf4a46be1e71e946f2e06eb0f2eb92a023a3f86d949b040f548d18b18a514a73a624ee74f33f3e020a5b3b427d3f306bbce7254b327b21ae54
MD5 SHA1 SHA512

Submit Download

OneDrive.lnk

Path C:\Windows\WinSxS\wow64_microsoft-windows-onedrive-setup_31bf3856ad364e35_10.0.19041.1_none_e585f901f9ce93e6\OneDrive.lnk
Size 1KB
SHA256 fdfce2f5e42ed2b899cbb1d9f808b8584727e04967f1c8644a5f847708f6c598
MD5 057e34ab60d61f325982b48ebcad8831
SHA1 086cc1b0e7036202668bf5b7121c7c6fca93fd59
SHA512 fdf4fd37417ed7b8cffc02695347b6ab4392708fb66f5ab5d4306091fd9afaed8969773b9edebda5ba3f38a22dfa3e255176275e25abe99d08df8186d806f28d
MD5 SHA1 SHA512

Submit Download

memory/396-10080-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/396-3-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/396-7-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/396-5513-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/396-10963-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/396-11310-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/396-11308-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/396-9-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/396-5141-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/396-11298-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/396-11303-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/396-5482-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/2784-6-0x0000000000400000-0x0000000000427000-memory.dmp

Download

memory/2784-0-0x0000000000400000-0x0000000000427000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads