810535911f1639e0439ceb40b0e6ba4a26a9370dea266b04d925f0e5894ab435

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
27-11-2024 23:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
Size

12KB
MD5

aa11ff806d49e6095a7f980b0b16007a
SHA1

7aafd8bcad9d0b219e09a6336a220cc2736ce2eb
SHA256

810535911f1639e0439ceb40b0e6ba4a26a9370dea266b04d925f0e5894ab435
SHA512

05b66536b1e1ab96426b238a54bf5608bbb432ad2e6435983154a10342c77fcedc7b07ae384dd3731e25cfe6e9121be1dde37028cbb24d2da1837636b0ae4cac
SSDEEP

192:+/TrG62a6B10k3g4fXk1iTV3HGc7EkpAqEjvu2q9C/YpXnAITZfPtRMMzS:+ebFNw4Pk1itKkpAjjI2YpdmMW

Score

9^/10

discovery persistence ransomware spyware stealer

Malware Config

Signatures

Renames multiple (2194) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Drivers directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers\gmreadme.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\H8PvUr149gbK0x3.exe"	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\FileRepository\netimm.inf_amd64_8b2087393aaef952\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ProcessResource\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\hidbthle.inf_amd64_bfb3ee8e5a97c3be\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmcdp.inf_amd64_919b7beec2c70482\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmtexas.inf_amd64_ed0ab85128ed7a01\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wvmic_ext.inf_amd64_34d742f3550dabd2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Configuration\Registration\MSFT_FileDirectoryConfiguration\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ialpss2i_gpio2_skl.inf_amd64_b68199ad84607c21\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\fidohid.inf_amd64_c446be9403cdcdb1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\InstallShield\setupdir\0007\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Archive\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Archive\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WaitForAll\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Speech_OneCore\Common\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\XPSViewer\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\zh-CN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\amdi2c.inf_amd64_d7ae71f8eb52c084\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\net819xp.inf_amd64_ff7a5dd4f9b1ceba\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\IME\IMEKR\APPLETS\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Dism\es\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_RoleResource\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\iai2c.inf_amd64_a77c815b2999404d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\msgpiowin32.inf_amd64_46634fa071d1db0d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmetech.inf_amd64_bbd46500a9d0e020\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\en-US\Licenses\OEM\Professional\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\InstallShield\setupdir\0011\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_RoleResource\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_fsencryption.inf_amd64_b4b4845819a23338\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmcomp.inf_amd64_bf289615d063c627\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_fdc.inf_amd64_fe3599e7eac09e7f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_keyboard.inf_amd64_56ea9763e933f7c5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ndisimplatformmp.inf_amd64_8de1181bfd1f1628\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\usbhub3.inf_amd64_6a68abcc31aaa333\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\vhdmp.inf_amd64_aa94d04ecf56de1f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\ja-JP\Licenses\Volume\Professional\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCClassResources\WindowsPackageCab\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\XPSViewer\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_volsnap.inf_amd64_47e3741bbf4d6b06\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\msdri.inf_amd64_97bef65a8432edd4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmgl010.inf_amd64_b4f4b670a266fda5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\megasr.inf_amd64_72258921635be994\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\nete1g3e.inf_amd64_af58b4e19562a3f9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Configuration\BaseRegistration\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\bthmtpenum.inf_amd64_3abc48e730d08fde\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppLocker\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_RoleResource\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\basicrender.inf_amd64_df49c4daa6251397\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_swdevice.inf_amd64_12050f4158021fcb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Licenses\neutral\_Default\Professional\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\ja\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\XPSViewer\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mtconfig.inf_amd64_fe91941ed205cd9b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netrasa.inf_amd64_1bdf7a435cb3580d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\PerceptionSimulation\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_LogResource\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Configuration\Registration\MSFT_FileDirectoryConfiguration\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netl1c63x64.inf_amd64_4d6630ce07a4fb42\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\termkbd.inf_amd64_a0634dcf2da1127e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\InputMethod\CHS\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\wbem\fr\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\wbem\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Work\contrast-white\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\AppIcon.targetsize-16_altform-unplated_contrast-white.png	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\es-es\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sv\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2018.826.98.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraSplashScreen.scale-125.png	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-72_altform-unplated.png	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-30_contrast-black.png	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\ru-ru\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Program Files (x86)\Internet Explorer\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_2019.19071.12548.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\ShareProvider_CopyLink24x24.scale-125.png	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\15.png	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\Square150x150Logo.scale-100.png	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSectionLargeTile.scale-100.png	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-Yahoo-Light.scale-250.png	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Resources\RetailDemo\strings\en-us\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\ccloud_retina.png	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\icons.png	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\locale\lt\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-20_altform-unplated_contrast-black.png	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\bg7.jpg	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\placeholder.png	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\RTL\contrast-black\MedTile.scale-100.png	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Resources\RetailDemo\data\en-us\2.jpg	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\Background_Cliffhouse.jpg	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-36_altform-unplated_contrast-white.png	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\SmallTile.scale-150.png	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Thumbnails\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\RTL\contrast-white\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\ro-ro\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-white_scale-80.png	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\LiveTile\W3.png	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\AppPackageBadgeLogo.scale-125.png	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-white\MedTile.scale-100_contrast-white.png	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailAppList.targetsize-64_altform-lightunplated.png	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\RTL\contrast-white\LargeTile.scale-200.png	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\AppxMetadata\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\edit_pdf_poster.jpg	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\locale\bn\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageMedTile.scale-125_contrast-white.png	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\Square44x44\PaintAppList.targetsize-16.png	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\StoreAppList.targetsize-256_altform-lightunplated.png	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ko-kr\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\freebxml.md	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\TimerSmallTile.contrast-white_scale-125.png	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Win10\MicrosoftSolitaireAppList.targetsize-256_altform-unplated_devicefamily-colorfulunplated.png	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-black\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-96.png	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\new_icons.png	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-white_scale-100.png	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\assets\assets\images\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-125_kzf8qxf38zg5c\Assets\Images\SkypeWideTile.scale-125.png	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteNewNoteMedTile.scale-100.png	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-black_targetsize-32.png	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.513.0_neutral_~_8wekyb3d8bbwe\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\AppIcon.targetsize-96.png	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\da-dk\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File opened for modification	C:\Program Files\7-Zip\readme.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\cs-cz\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\sl-si\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\new_icons_retina.png	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\pt-br\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\nb-no\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\WinSxS\amd64_microsoft-windows-t..e-syncres.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_04dea1e60ef477f1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_wvmbushid.inf.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_df96678d768055d0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\msil_system.windows.presentation.resources_b77a5c561934e089_10.0.19041.1_ja-jp_5365731127a04e9c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.19041.1023_bg-bg_716e22d250901c5b\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\cache\Desktop\5.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-font-bitmap-oem_31bf3856ad364e35_10.0.19041.1_none_b3552a6f4dc424b4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-mobsync_31bf3856ad364e35_10.0.19041.423_none_ddd03567dc83b04f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-d..ager-udwm.resources_31bf3856ad364e35_10.0.19041.1_es-es_fe976f852fb04f06\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-flighting-settings_31bf3856ad364e35_10.0.19041.264_none_66b7f4dd4df876d6\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-mystify.resources_31bf3856ad364e35_10.0.19041.1_es-es_03a571b686371290\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..-desktoptaskfactory_31bf3856ad364e35_10.0.19041.1151_none_557e8a9a2302105b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-w..-system-diagnostics_31bf3856ad364e35_10.0.19041.746_none_067ab91a9944c3cd\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler.resources\v4.0_4.0.0.0_ja_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-kernel-appcore_31bf3856ad364e35_10.0.19041.1_none_8166005f4d2d63db\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-branding-engine_31bf3856ad364e35_10.0.19041.1202_none_687eafd94efb2680\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-c..ngshellapp.appxmain_31bf3856ad364e35_10.0.19041.84_none_24f8aafdaceaf0b5\Splashscreen.scale-400_contrast-black.png	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_netfx-aspnet_uninstallpersistsql_b03f5f7f11d50a3a_10.0.19041.1_none_57a5519767269a6b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..lers-siuf.resources_31bf3856ad364e35_10.0.19041.1_de-de_7e1d9eecc8e95892\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\msil_microsoft.virtualiz..3.wizards.resources_31bf3856ad364e35_10.0.19041.1_en-us_5e7f8f56457ecffd\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\msil_miguicontrols_31bf3856ad364e35_10.0.19041.488_none_2ffa4308e32b9199\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-wlan-dialog.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_e5c0ea6326c818ef\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-onecore-c..propsheet.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_e22d9be1120f7134\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-i..r_service.resources_31bf3856ad364e35_10.0.19041.1_en-us_68a68fbe4b19e7fb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-remoteattestation-rtpm_31bf3856ad364e35_10.0.19041.1_none_c1c79268d9ac9f69\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-stobject_31bf3856ad364e35_10.0.19041.964_none_2804a3f5b45d48ed\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_wvmic.inf.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_991dd7cdfe183c5d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_fusionv2.inf.resources_31bf3856ad364e35_10.0.19041.1_it-it_8b4c01daebfcd08d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-dafaspinfraprovider_31bf3856ad364e35_10.0.19041.1_none_652b746c40c6ae67\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-m..t-console.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_bdb708de862cea73\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-userdeviceregistration_31bf3856ad364e35_10.0.19041.1266_none_8e1f0f6959c36aa9\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_netrtwlans.inf.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_1a0e37a72bcbda34\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_v_mscdsc.inf.resources_31bf3856ad364e35_10.0.19041.1_en-us_37bb1575b71aa2ac\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.423_none_9de80b9d881a1ebd\diffTabIcon.png	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\x86_microsoft-windows-com-legacyole_31bf3856ad364e35_10.0.19041.1_none_98ee1707b9464d78\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\assembly\GAC_MSIL\System.ServiceModel.Install.Resources\3.0.0.0_fr_b77a5c561934e089\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-e..fiedwritefilter-csp_31bf3856ad364e35_10.0.19041.1266_none_d3c9a2335af9701a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-naturallanguage6-0022_31bf3856ad364e35_10.0.19041.1_none_f3b547db00e39b39\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..xtensions.resources_31bf3856ad364e35_10.0.19041.1_en-us_a143d994923cee7d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-p..ructureconsumercore_31bf3856ad364e35_10.0.19041.1_none_f990ec035e1e4c36\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-d..scannerpreview-host_31bf3856ad364e35_10.0.19041.1_none_484e61e96e69ac70\Digimarc-Logo.png	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-n..ork-setup.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_3558bb95e5ef7c8b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-security-webauth_31bf3856ad364e35_10.0.19041.746_none_099c40ad55bc5d6c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\SystemResources\Windows.UI.Logon\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-m..player-shellpreview_31bf3856ad364e35_10.0.19041.1266_none_3563a6b72868b6d9\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..ast-black.searchapp_31bf3856ad364e35_10.0.19041.1_none_e479c512c8bfeb66\AppListIcon.targetsize-40.png	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-fsrm-common_31bf3856ad364e35_10.0.19041.746_none_a7a7f673bf9f2fad\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-ui-shellcommon-core_31bf3856ad364e35_10.0.19041.1_none_91b1f58702057373\WiFiNetworkManagerWarningToast.scale-100.png	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\msil_microsoft.managemen..structure.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_3aa534a4f74affbc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\assembly\GAC_MSIL\System.Xml.Resources\2.0.0.0_it_b77a5c561934e089\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_msbuild.resources_b03f5f7f11d50a3a_4.0.15805.0_fr-fr_dff09797cd0fbd69\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-f..-settings.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_d9dac4ac68f5f6d8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-mfc42x.resources_31bf3856ad364e35_10.0.19041.1_en-us_7892c6682e6258c8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..lers-authentication_31bf3856ad364e35_10.0.19041.1081_none_c74e121d045d3bda\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-com-complus-ui_31bf3856ad364e35_10.0.19041.746_none_8ea10e81a707d623\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_es-es_a2ef4aab3bff561a\http_404.htm	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\msil_microsoft.hyperv.po..l.objects.resources_31bf3856ad364e35_10.0.19041.1_de-de_d7995fe625a455f0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-h..p-provsvc.resources_31bf3856ad364e35_10.0.19041.1_es-es_29361d4fb963a715\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.19041.906_ar-sa_90a6dad6f86cae6b\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-icsigd.resources_31bf3856ad364e35_10.0.19041.1_de-de_2183f148868241e2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-nat-wmiv2provider_31bf3856ad364e35_10.0.19041.1_none_cf396423c0041ea1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-usercpl_31bf3856ad364e35_10.0.19041.746_none_69c83f4facedf1b5\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-e..mgmt-mdmdiagnostics_31bf3856ad364e35_10.0.19041.153_none_c53a7431a32f351e\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-ecapp.appxmain_31bf3856ad364e35_10.0.19041.1_none_b30156e32b833fb0\Square44x44Logo.png	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ZBMHOQHKLIITQTL\shell	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ZBMHOQHKLIITQTL\shell\open	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ZBMHOQHKLIITQTL\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\H8PvUr149gbK0x3.exe"	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Opiwe\ = "ZBMHOQHKLIITQTL"	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ZBMHOQHKLIITQTL	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ZBMHOQHKLIITQTL\DefaultIcon	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ZBMHOQHKLIITQTL\shell\open\command	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Opiwe	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ZBMHOQHKLIITQTL\ = "CRYPTED!"	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ZBMHOQHKLIITQTL\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\H8PvUr149gbK0x3.exe,0"	aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\aa11ff806d49e6095a7f980b0b16007a_JaffaCakes118.exe"
1⤵
- Drops file in Drivers directory
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\aic_file_icons.png

Filesize
50KB

MD5
3c4e45ba1995c07bddd99fb415c09f82

SHA1
3f8f8e4a7692a1a2aa59e6d404ad01908a9a513d

SHA256
9efabda9aa2362dcb54a7059022c8366f2e6298ca3935a4956338c09612fd6c1

SHA512
05c5e93905f2b202e2c42d41ccd1948f26401ff85223188a44cfee4bce562ce0e9ce11d96505e4a25d6bf3f0469e860beb27ad493874b25ac349da7ceecfe2b9

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions.png

Filesize
1KB

MD5
c345ae00d4601df2265092757f3164be

SHA1
7a82549bcc7300de9962bbe63fa72a9e6936b2db

SHA256
9a6dfa62ab14228445c1aca4612b69c12772b760ed34ef29e149fcf6a10a9749

SHA512
8a1ea535b5ed1a8d1cdd7d56bdca954bb526108d68d1f18f8be872b43516cffa7212469b7d576981f66a3edafb691bbc0668a0f42ce6be1f87d9fb0e06afa46b

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions2x.png

Filesize
3KB

MD5
be2a6d7beb9a533fb10b2df9b966870c

SHA1
d5dbfa829df4e722dea134488cb88c28452b0064

SHA256
b5e2707ee49a4f65a6dbdae101f2611155a02501c0661cba5970120ca02e4ce7

SHA512
43f99deed89094e8a23258e60730855bfe6493a545ab9d27764b3a8a1210201d81eb177f62db709bdfcef843f5f63a6d7574d350f79d6f804713512eceef31e0

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons.png

Filesize
683B

MD5
2ca0aae11758d2847bcce20115741d3c

SHA1
44cae0973b0a52e4061f7e129ff1b32bdf1806ef

SHA256
f88d6e6aac5ebeb5e910d9a736aff98c181101fa716854275109e85dd369c8c4

SHA512
6f516763c9517e8749ac51185573875bedf28d2799aea4cd17d2fe785249f1181e85f0bef3c68fc88529ab918bc9a8f696b265a5bf1aa19b73ced00037e0e4d7

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons2x.png

Filesize
1KB

MD5
e9e3ed0b02645fb55b3a29f58fe5998a

SHA1
9b9245a13de3e63f7558241b03a633302fa2a232

SHA256
5f8f5d756fd9154b9573e9e2134225f8b80e9ef0beff33299dccfbd8530c75e4

SHA512
91cd92fc38c485d3be82e70c0c1fd1411640836ed760c707a35d86d5c9855995ebab379334d553d188abff3864184ae4531058062018c81f2cbf370325c57f0a

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon.png

Filesize
445B

MD5
49bcd27ac1249164d01856cddd94681c

SHA1
afd06e3d5b398bc1e32f25dcb70d6df62b12465d

SHA256
ee01c8d9cada4ad58b90a30d04fcb8a70725bea234feb67f4cbcbf6bc3fe1913

SHA512
705d31cf49e42497333408d15b5c49fd662f5f3b6acb05ebeea5cadcf4b7f03809b6e58c7eb1195275ce0f945e4b6826b03dfb9dec8505908a2442e7c68c5d97

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_2x.png

Filesize
611B

MD5
5f77a12a67a2fbb657be939fcfcb6004

SHA1
67ebf79b07ce05ff1aa8d0403a2c01afcfc630ef

SHA256
3e9e6c1158841fe9a0c0f06be9b47faa01d1e586c697675af9df4ca947f0222b

SHA512
af98fb358e01c9369c06f45e24338d2a6ddca7c81997eb58ced339aafdfe9b82099fb32010b8d6add7daae54cb92097d8fdb07bdecfc5e833c42966bedf30dc7

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover.png

Filesize
388B

MD5
b32a4a2766e85975281b05f9d8dcdd48

SHA1
0fbc4defc59920426409592a0ee0b809bcc1639e

SHA256
d536650e3b79f4d67a8766145b4ae367884c1681192888729fd9b2e3787055f3

SHA512
b77624fabed4f6958e6716fb73f16f761b1d0fa73e0e699e66049edcc5778eb41c749fa9d6bbe9c6d3d46e73ce346dca4687fdee53965dd66614c7fe4bc7035e

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover_2x.png

Filesize
552B

MD5
a6939275c70aa54bebf748841cbc6a8a

SHA1
20af6d3c378968af908382572fd85ef2f0a9d8c5

SHA256
33776a3c764a515a02bd4df621ea61c69a3b0d2925d0bf72d0c7a419b01e4202

SHA512
2d143ecda6db43b11357f5fedc1b9284819a44fc530d6723a29f13bd0ee55a86257f07ee362bd16c31e1d6b2a94abbfec32c8c7fb45fd43767fa5a52b44434ea

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon.png

Filesize
388B

MD5
bb5e8639deabb45d47c94f79d6b64b66

SHA1
aed8e76fe7b23c79a02a557e4cb0bcd78c9510c4

SHA256
09116fc24ee84a322668615cfd9a4bb2c4d31f3451822b26b4c987b43cd4604f

SHA512
6a557c39158c9dcb32ffbfc663163b7fb127194588a617f8b591470e6ed71d279e63b7aef161ba5ae5f7e6b2ccbca087288962a56d7a416e56a59c88966e4bfd

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png

Filesize
552B

MD5
9552e134e49486e424bf3fe23e4b91f9

SHA1
7939b7a1fd83d9f01e02c7fa70b57b65c5a301b7

SHA256
21d4a17e1593847a2671a39a73cd35090ca6cf6a41b9d8379546387b701ce436

SHA512
08186a3362c1cf765b05e35a1f8bac3d06aba34705ddf90ba9e3446fb6ab7f90bf326e40e597531c0d1aabfdcb7f8f6807b2f8f567f4f0e6693fba4df68c7183

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png

Filesize
388B

MD5
c4b67dce9682dd4869e14b5cc680c5d2

SHA1
11271c7a094eb0e0f01dec84a9e7ceff28463e93

SHA256
f29bb293752b694eeb7b3ffbf986e04074b714c9eaaa2ead02e31b706647c25d

SHA512
3c79945876309d4a86447bab58f33faa06dcd0d0b89598ec9204e5abcc978e310b1c5133afc059e8c8e5a72aef597f2b4977344cba18657b124a938bca341e2c

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover_2x.png

Filesize
552B

MD5
837cc1e7b1649f0d188f4949b89a0dfa

SHA1
1b7a6944f5aeef5dfb7f056990ad796701af1867

SHA256
48b307af6a44b33feffc708a45990effb70a832b40bee239bec71de9a57cad98

SHA512
941a8a1530b46a3891b981738bbd93330f9bf315a2508f73d69e7cb880ffa9e8c6bad4dc88cc6fa5b2dbff2fade19d57396d0b029d95dee08481ebbdd78b96a7

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons.png

Filesize
7KB

MD5
d93ee65551ab7cfd8fffd6f2c8f720cf

SHA1
21069ea6d97b7a4003fd847fd8984dc383e2c585

SHA256
d59d21c4a5534c7847198bd5d242f4ce1d05fe056d1380a36b6afb75e2729a71

SHA512
ab549c0717088d0e5bbdb32035d794459a5962ed9b6cf4164c51b734c59d45f9b7aa44c31b36e185ae675a7f7d2c8712ce671243aea98ee8dfc617b3ffc4d820

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_ie8.gif

Filesize
7KB

MD5
9fa77a0e7c0a7456faaeb1546b2b9b2e

SHA1
a6cd57ae3eb3e7bf207d2388c5084fd994d770ac

SHA256
3a5b9a6b79d6e86d8ee0899aef49fff80aaf4b0a343c059e87df20e49b388dae

SHA512
bc655a490807600f773e3ac2f32c0d83aff0c1952454949ce7aab5499d0b8f9df1921c11e050d41c1e565389a670982e7e054f7904df4aba336af0cb5871d830

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_retina.png

Filesize
15KB

MD5
855e3ce9a04f5e254b0eac6ac490ca90

SHA1
2ed8d9026726546b159a859dc5b7ce013e2a43be

SHA256
a54ab26fd4600c0b0324ebdc7dec0999c3b04109b14d2ee841d20021c88342ee

SHA512
40784a478310fba2f526383375f735d996e3fb045e6e7fb454fc999e823655caf7a89f947c9c12442f23447502c1465942de920a8c12042d7abc219ce26143b8

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons.png

Filesize
8KB

MD5
99a9388d78e942cbd5e4b69d089ba186

SHA1
0ebbd2a51622ea5dd70d9db374d00b858ab66159

SHA256
88a313cc368f03397dc83c533a8ecd0d7ab049a11e5e292678f4afe20e520482

SHA512
792eba53c9bfa8a32f82017b8258e68fd67b366415c50c5767738834dad4519953ea643b1a96c7d40df9cc1bec1571d91f5cd38475cb6a957df31e5b2964a315

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons_retina.png

Filesize
17KB

MD5
c16249acdcbd1b96bdce2298accc57b1

SHA1
4f59ada61692464d4fbfc1a0728d3f592d8a23cb

SHA256
2076dd00db3af55f6051d707d5784c37b6b6ed42c4e5fe67a49f3680b5228589

SHA512
646b8eee383c65fd07074030abf64fcd1736d47c70f31192bf60e001cc35e53a05b4deb97b17844f69ff1255669ad451475031799ce9629c0c6b3923c0b7f117

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_pattern_RHP.png

Filesize
179B

MD5
854e5e647202e888fe57c1c1d7fa9422

SHA1
dc8c8f6c57b8d58b52b37b19662bfed2ca58888c

SHA256
8d5dd57c3a07b0a436b8a40e54d61b350e249d41cedcdfec02783663a2ff8c8c

SHA512
fbe8b6eee8fdce857f6072ca28d61253001f6483a96db600aeb00ec9c6d47482c15f5164da7438d08fbefc16388aaa2bf32dd6991ad1747886211c3365a7e789

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_patterns_header.png

Filesize
703B

MD5
64b6da14297796d256dfa9cdf748aa53

SHA1
01d782fb6f69caf3aaa5f52234c6b0561d5e6721

SHA256
d714f7ac00646ba94fe45a24ccfe218bd44a29db3a18d33efbce004789f38433

SHA512
14276ec81b1d07164ab1752d5fc0c7265d84d7409659e8213f028ebf2c5dbfee4dc56d46a3c332f85638bf96efb75199b275801a2c72e594ca39c748773545cd

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations.png

Filesize
8KB

MD5
8dc94daa2d3818dc1f896c738d69a4c8

SHA1
e0f1a06fd789226057bd7a3b4c86bf01eacbf616

SHA256
d2f85f7331f1cc8283123aad60fb7729098c0482d642a6b4148368eadf665d00

SHA512
8cb578cd898ebd81542b3466b226eaf7084f5a3ef3349954f5b5e6e9a5f3506551fa87dbf09bd442255523d62fa4c5fd03e6ae09fe7240f1c1946b2a489e9468

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations_retina.png

Filesize
19KB

MD5
77b7cfbd602b5f451fb77b3d8e374e32

SHA1
29b8f473c70c9603651e1dde36e2ee4a34d44a86

SHA256
f6cde080823a327d26b65333abe5ed32da3811c05b27c36843de61dbb08dacd3

SHA512
94f6cf6695c395e11a234a6c6938505a0186aeed12f1f4154bf550af8f22638b0c04b406ccbe075a8defd7867f1f19823b8be9eaeb22b3b68f0cfe48ef9beef2

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\faf_icons.png

Filesize
6KB

MD5
0613bae907f9ee1c103190e8a4822b61

SHA1
a00dc2b4c04a3ec27f97829b92ab757c402238c1

SHA256
588ea3ebee7741c2711de69ca5f6645841c34e91a9e3e421c8ed756772323eba

SHA512
5889d284983150e317f208795f3ce3cbad1081a8d843c5fb56fcb1cca8aa113ba0c173023e08de986430ab8b2c8e70746944e48fb1d1575f71fef9c636cf23ec

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\bun.png

Filesize
2KB

MD5
17aec4389c101e5e05f17da2f90c9d68

SHA1
f2dfb0382712cb72f3269c58a91782ade88a5b8c

SHA256
ee10abe4e0114f1677254bb89d51339b4437d013024b283587e292bd71f0d59e

SHA512
c4bef51ce865882235826c847b95266dc4907066c5b7ef4bdb3abba99de3b8cfcde2f2e36f361f39e998e59d264c2544d041c5b8de6c4871b28ffd9bc363d256

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview.png

Filesize
2KB

MD5
0496a81db23299c9afb532a10b64b50a

SHA1
3468efb0d8aa1a11d091559265e5772949c26d2c

SHA256
eeb611693f8791cd7b7d7e48c85edddaae4076daec0b70d4ed95e415b0c2fdd9

SHA512
cbee7d1dd3b91c828f3f7b6df2e4013dc695a128aba8de7a79dbbde77c857251b90e64a3d13e986f1c8b7e2501e15334cd4925cca2767de298f745f01bf478ae

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview2x.png

Filesize
4KB

MD5
6513d3caf5653680a90048dd2d684653

SHA1
1c21d6208cb7d4fa55eed51af11958be591156a1

SHA256
bf361ccddfcc1eec3b964c18445859ede3a9eb14d1dc373df0c062f15efc3447

SHA512
8d2520577953e6b46e3cf4ba56130c135561096839d506b67784214ae2e12195d730d59f3574a095cb5a669a7712a707261ab31fa553527cc029e6cf933c4bcc

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small.png

Filesize
289B

MD5
f9e226f3a34b344763e2c5e11651735b

SHA1
5302d0e20bd506a9dbaa49e5f9a49fe062c4d9f6

SHA256
2004afc97376701e6f8859841e8574dd62cab0d2facd1567eb286f7485047632

SHA512
683f733879091d93f633834f9503d0acf84ea6148c5867a4df0df01c6322d4ec4a428cf2d060ec5648a8b82977b33af8a20caa24f5ba8ad4f02fe3da41ac7420

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small2x.png

Filesize
385B

MD5
833dce08a3cd54f9b0d91474b74dd852

SHA1
68bb0c9a016e73917cd3b8e93b52ff31489a925a

SHA256
b49a40a4000c88c9afcba03e244ecdf3b87281ae0ec07d5ae4610bee2a711c7c

SHA512
32c546527edae847e3ec44af0acf4226c5ba05ba65fb37d72de9e42a318a9e853baa2ec02796c431b8bb9b3135de69fd1c7ae377083766c5f4b142675a8d194d

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\illustrations.png

Filesize
4KB

MD5
d96b18500123d3431749a98d0f056e63

SHA1
a409169ac3e1f665978c389866c87623c91bf88c

SHA256
cd378891d7209d1829f10e01a8744212a68bfeded1f91e90ce6f21691cf1ce87

SHA512
0d4c202c93cdce6972a3bf7c7fbfcb2221bc41f9d2a6e20b81e7e5b993b146874e52c79c9ee11bb5e8ca7c6efc2a465a6c7998106346ca71f9a30ca4eb44a569

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\nub.png

Filesize
1003B

MD5
715183e2544590678a001d7ed39d9929

SHA1
b9515eea751fae5c35f8b00ba71b33baeb89ac72

SHA256
0b9334d0b8aa6da923a6d7827610268a3b66a2d32ea8aa69fe49e016014c35e6

SHA512
6ed3d5d1a3e8b9da5f6a6d1cfd5011be80c62b578a8efcc6048e52bf1ae2fb351dfbd33b3746d2d685ed96f820da2b94b994b932ba30fbdbf1d63a2bf623e965

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons.png

Filesize
1KB

MD5
9fc0cb54766d2ba7ce554281fe51daa8

SHA1
48ce088d03f5c1aefa9f2b8a84c0bcd80485916b

SHA256
ee75e6a49e4d32a5e464ab6eb8300295ab9e4bd94982ee646aa4de2abd2f09de

SHA512
fc32f84e7ed9c2ddab316e14624463b64a12bc45ad912e7937d34f582be8a6985a16a182cf61d363bdb5549053858610c9b97f5af99cff11289e5935a2292033

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons2x.png

Filesize
2KB

MD5
866746ee01d6888e76b96b1c50ed9966

SHA1
61aaf5fba4a21460d13af25ce63d0f47d1992b2f

SHA256
9c7cbecc0d97a1d82e4e32872f39af6eac2ab0931c541646a16b503b985419f1

SHA512
c6709e6695bb66e5ce1dba25e20fabaf53f9f09121f218b77f99cf1957f30a28804ab9de8f8e17af59c503a4737e1080f2a90e530bcf55cc3a276cdb5c2c104c

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adc_logo.png

Filesize
3KB

MD5
1be4df934ace7c3cda6afadfacb12af7

SHA1
45b3005e17ba14f672d1789c9f973eaece74c8f2

SHA256
b810f19ef1d2d7cbe0fdb5d54e2fa975de049e6bf2af2149a07cfc5a2c2799fb

SHA512
bdbc90b5144a7ba5a00d4dc5e4a6b755489e76d102258c9d356bd7d242e7eeace4953f5567a29afebb5e5c3590e94e122ee0757c7bde4831af936df0416be2b2

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adobe_spinner.gif

Filesize
556B

MD5
a77b128a00fd344ce36edbcac5e80e83

SHA1
47375de7160b97657670e4db9b33d6ebe5972dc4

SHA256
a0b690f88527a1505aa4a520673cde2abc8a0706c55c0acbbe177073c3a328ec

SHA512
9c8c2f52425fb786b187991934fd4e22d7efd7c6ec7dda1c3acf42043a83253b66383bbbd23ac1600a89b44953958b51fef49b4bf72f2c46d0c444199ecacf20

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\logo_retina.png

Filesize
6KB

MD5
c1cb31240638ac4287941d57e2361c04

SHA1
792d7dd749dc7256708ca7496d6cc8a35eb9837f

SHA256
86ae792815142a1707f7a23ccdeef3cee65465cf8e58adf12d7970e46efa2077

SHA512
0cc62c938183c71203d18613e234e75dddd250ce7acc84a197638948b3f12c9c32f925b04819d2872180fe5ad912bf4b229b59183bb4c7910cf8eca5b5484d48

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo.png

Filesize
826B

MD5
6af62694f5ae2411af2d5c7009feaffe

SHA1
581ac00056216ca2459b64e35e9f75a96a3a15d8

SHA256
25fc6f25c8291c639e9304d182e07b0bf149bd067cbad10692621635326b7586

SHA512
600811da0c2e30bb55c7e654cc928576daea7a96d56b96a5323c9be7a771e99fd09cd8a623d1d93dfb116fe4f56bd24821d085bf949240d49726a548a792688f

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo_2x.png

Filesize
1KB

MD5
b350182b119db7e82ef5c8c38a77a261

SHA1
59005335ed059a3cd77cc32d4713268a72476b9f

SHA256
af3b3b9c815c8b25b49c869001cb1e399338528e49b1b32e19b254debe2109e8

SHA512
26c3e5c5283b89baec1af1a7ba0cf723af9c712aed5a2eaefde07d31b8575ed2f9e2f755e4783f94e8e7827a749c5045d3a42480cc6455fbc673f8970d45b502

Download Submit
C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB_EURO.txt

Filesize
32KB

MD5
f8a2d6bd3ceef9f2f340f0de15ff6297

SHA1
d3a1c48a95eafd2c514b58b9dabc389a78721f60

SHA256
fe302575101a291720cf960e9371d7ee17faff2b257efc4804e196eeabbd9a51

SHA512
b40c0b17bdf56bee086e22c5bfab69bbd766b502c140ecf2e5c164d45d9c80c31680bb7873e2dcb8028aec1166b70fe3a40042914ecdd865c8ef380c75866e76

Download Submit
C:\Program Files\7-Zip\Lang\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt

Filesize
330B

MD5
5a703ae2e6deefb82cb979740399b42b

SHA1
f487db6b575be05cf13fd14ca84bd71a30d29678

SHA256
11973f804d51fb03df36d39c0d25c97c867ebd0db6d9f953fa49ac6a61b02576

SHA512
3b2853168fba54558ddf957b9b3ead44e50ef24d9ffd946acffb38f8e46373f14fa552b4e95748480570b7ec49bc6fd3fe99c8373431f7efe7e44ea0ea2e70c9

Download Submit
C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif

Filesize
153B

MD5
9e2789cc63eabe41c55080e512889d7b

SHA1
0ff28d866005509b371d354486783ff774bf19d3

SHA256
7510b755bfa40650f4cdd19229abf7c193fd753ba55b41cff65a220e262c51d4

SHA512
750432ddcfa8c2150380091a182bac7ee7571584e23e5ffaeccab315f8562613a316c626673110199659b8b484a75797200d1dcf480a2a02785306523d40a342

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt

Filesize
190B

MD5
156387b09b1cb05965ae146c026b6624

SHA1
734632f0e75df970a8e666744dc326a443dfd6ad

SHA256
5286b8ec66d4357b0c8bc40d54efb889a93d67c887ce47e4ef755f2173e2a165

SHA512
f7fd7c84ded3cac7b58cd7d1cd71147fce1813a6936b73a54ee346427b7fc2685a04540a74ecbcaaf0723990d1f395bd14e291645ad41b5939f6735201398f9f

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt

Filesize
190B

MD5
b3da68f9e0b6412ea8973d7443511d49

SHA1
edfcda297afc21b0038a20c21708cc0e0bee2d80

SHA256
9148731e1999d0c53f788042d909c6473a40549e94031d588c2d59abe0171d32

SHA512
04f3b5bb30bc3d667dcc976222bf3fa7d18729f53c7f270e2219e201052c0727a60132eccb2abfcd0b563155ee1f787aa417b805a73ee1c63ff1835fd9d01568

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md

Filesize
1KB

MD5
bbde966b2157f4f83f3ec2f453b11549

SHA1
cfca9fcf0103595cfd123ab1c917719c7d495ac8

SHA256
c4e317d6b8fc627afdd5422e5bd59347bbe1acd66be175a2a7ba381650997803

SHA512
1b05dd1639874e0ce8f1fae18e3b34adeb7f815d3d19c720a4fbd5dfb88a7b415cc236aa05341d7ea4a8d06a847e494f90e6c4cc8838e31f90270219992358e9

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\glib.md

Filesize
31KB

MD5
b9e8003404349f9c8e794e6396c7c538

SHA1
5b3a12396088571f87680dbd1663f6f34fc9c74a

SHA256
428e5988359a26da4dfc40b405a6615b16e99a06093c100bfd4d75a2491e330c

SHA512
c646d2bf8000ae6abf69f0ad788ce7502fcc12c8f8aff07b0430fbc6fb2a48587c6ea1c8ec8d7f7c06d90815b3121a1fe5d5cc94d709a62ef40342e904bd472d

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md

Filesize
34KB

MD5
9a52729c78a6f76bd0e33deabc620980

SHA1
27d5e8e4e9363cacd66be1ff8bc4ce85acdc58c6

SHA256
325ee9831c9764a25f547a1208ecac23bec01e0843339440934ed6895f949ba4

SHA512
8e50fccf3912445fd52b8c74f0f195c9e50515ec869eea8791885f8633a9f3cdefb80494665606a4b01a4f41cb963a19cbf8128616394813dd9c25908d9c5aae

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md

Filesize
23KB

MD5
59b1394dbb69fb2313865f6e94b2bef6

SHA1
9655eec2eca796eb97eddb0d058a1404437f5d95

SHA256
6618214f4379633a038bc38e7c55daab509c8f71c22f338cd53b89c06340c99f

SHA512
cb210b991b5300678e726ceb19e481b0cac14966e73f647433396896aa99ba0fdd881ac5a43d85a8b7e7ee307a01b0be627fa076b3851d24ee671635f692c082

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md

Filesize
2KB

MD5
0fef2abadabab756b53f7702f5122bf3

SHA1
a8bbb41ad022973c26a5a5ca2797c42565965195

SHA256
09c816581e8a6769f77aeef8440ea6585dfe351119c9212a73d41f4a78812784

SHA512
7ef0c5076d160e2923e37b759c1f9138d6fb8030ef2d5f0e310adca5c58c3071310a523489c2a0b284ffc63a8acab5acf9fde11a26a0705c2f3a105fbf27b349

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md

Filesize
1KB

MD5
11408c4feba119c0ee1561e1af2f22fb

SHA1
6a39cb09af12cea830ba746bacfd4e6a4eb3d83b

SHA256
f6e79c6b326eae46dd4e4f08eb13c687846a38797c2b06d1a16c6c4dddb5989d

SHA512
c503d3ebec416e9bfefdb244d1cfefc5d8d1e405161eb7245021eb258b4343c08e33122f42c0b68eadc17c154cd4cf8197a070d9bb5ad2cadd603a5a5912590d

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md

Filesize
3KB

MD5
4be1ae310edf49d164f9b8d0b86f46cc

SHA1
dd8c1a74f3c2ab27775635e4613637bfb9cd97de

SHA256
0f5edb54d9d21563371345c7b1a07b17c1db0cc555683794eb5ce96baaee2da2

SHA512
f8788a5b715a5416536e73e098b2e6d65c2131a6e5b3f739f4a8be96a83a45d784a0dbe0b87782247485ebff03026a7a7016b266b2d903b78e7c3f6f7c68d767

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md

Filesize
2KB

MD5
3486fae8a3322ecf13dbe081da93828f

SHA1
1405d22945ff4f30bad00fbba0b5d9b20f6fcbc8

SHA256
104ca0e24c04da5e5709a14431d5c07e9743dbc99f9a7a358c91f67d37c74622

SHA512
3886692f33e4dc7b95b556ea5b6e5c54f0dfcec5230ea2a501dab74a9dcf25f3eeed88f5d02210b8d9c8c9745657e910d2b3fd518d56d772ad545fb5682e8af3

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md

Filesize
5KB

MD5
2293d001496918d747142a601f8be9d8

SHA1
6be1a66bc50b3682cad9262c06ee710862732c3c

SHA256
e4e8fb8b8d122bb51a4ffc2cedbd3757287fb245c18d20213198dfaf05cea504

SHA512
bd31a0176ccba502016f31401790d4a4b52016d0b1918672df6175a47df2762bb69d5a5582fc4998bc89cb86e4d5c2cba6d55d434de06a145ae4004a39be893a

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\public_suffix.md

Filesize
17KB

MD5
63d3fee19207fff8d2504a4732e37cb5

SHA1
bc814063daec17aa15e9f72536e47a4dd7c193e3

SHA256
db0c47e0553e2bd950704760af2146b4386925b0e80335a15d322a128d737fc2

SHA512
0eb16f9689bdd8bcc5a3f5abf15b426ccc66bcbb7db3bd6b770f09f499927fc4facc087403fb9077787dd7fd53ae7b01a667dd0fe5fa7e794523f304e8f1a1a3

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md

Filesize
320KB

MD5
c3d08eb61e833fc866dd0b6cc92d99ec

SHA1
18b13894aabddc1b66f631f748ddba8084e05469

SHA256
2ec1cdb169584320aced5d7fa1925634fdee116db15de3f2833fdf93716d229b

SHA512
843e7ac80747e10653a51865bc81de09ff26957ac688f3de0618f811e8af90c20a433e1bfab84983930b3b3673474c8dc63dfa7f90b024ab40187ac866f7843b

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\asm.md

Filesize
1KB

MD5
678385d3e1d79ab40e4f25b6ddd738d8

SHA1
653299ad3919d20918d299265731d0d5c3131b67

SHA256
171ca735e8255b2d46f5a8daaac0c378de25f77fa1b590a55e07a03cefae8eda

SHA512
2b2effa365ed548a2102f6157e6ebdb78e23b98e7b646d7da1f3402beebc8e8e073ed7f5f2391f5c64be709a21516d692555b9305e08300a7f4f25a6c97322b4

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md

Filesize
10KB

MD5
b402cbea8936d2f6dffeeff219734c00

SHA1
6b279be60220e44b81931789ff05ddfdfaa95a2a

SHA256
ef57790fa9b3c5e49d78b45f1961c23e33af2bbc2b217da1e6af42aebfd9737b

SHA512
df1c3a54f7ba364a804d32555d051bd75c7e38fff1e464ac840f61628951ada9a4f1b7515bc0efba828a8a3c79d6bb671d5f43181468a980e078df8132c80777

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md

Filesize
3KB

MD5
9aa6a46c4d7c96fdbb63f1c43bf398d9

SHA1
dd65384ba76c934f483cf9f6fa96cea13c4eaf73

SHA256
bb98e5a326801a89b1f214c46ff051adfb92ceb64b1c45de08b5e5c71a6c9ebe

SHA512
4868a11e058655efb7a92d8bace4bb08e9010624c9b29a6938bf9fe742587cff204752874bb5eb48a8ccc30c9a37db38775458e6f207d4c7fbaa82d4a2323056

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md

Filesize
162B

MD5
c0ab2dc684f93c23372d5be237818afc

SHA1
f2803dfcbc143c07c6820e75b8332242df9e5e18

SHA256
8e2634ccdc64b3af3f5068ffffcbf017786e808ec2d7eaf6ec95ab18e0a884fb

SHA512
a3643109c9239ff11fe5e6c501d6ddf67943652c2c125742aa67387f213b8c509bc0c68534fdc24f5b9e5256d1573a61336635045d69e6ea20f9bfe0714bdc47

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md

Filesize
1KB

MD5
4ed8b212d133d899cebbd62cb178f7b5

SHA1
1ae28e244fd034184d61b64f817fb9083c4d9ee2

SHA256
b5dc2f46155a79dbeb5f813e8872e5b666845f67a47d85e6ed5d400a0eb19a1f

SHA512
21374ba072c3fedbd23878a3d8325e6f0a48f23ec5d3b0887de484a6fba6a780fcaa7ed9f3d63e27231b82f83ca0805b288d2b91c04e951d8a0d9f299be86e06

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\dom.md

Filesize
3KB

MD5
451fb91e37cd4b51837627754f6ad791

SHA1
642eb77ab6c92e5ae3717e7c82329ff7ed9d4152

SHA256
e03d00c1352a059933b4d22cc9fa21f13b390e4f5ff33d6aa19cae769cae3a7b

SHA512
dc8f3a8032c9e1cf466a5cd038dbfa3daaafe4f69aad689d0c202c2c297e9502123fbf38078411521979563a0cf4d19bca4ff02843c05726fb4842114a612828

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md

Filesize
1KB

MD5
4088c0eca69e938077dd1bf193ee8fea

SHA1
845d87b9251180589aacbf0a1cdaf5dccd5b075c

SHA256
ccb773759ed5ea61db69a0751c6b34eb77f2f68ff7b0b203972b3fd560fcfd3f

SHA512
03ea336e12043d230f83f136b68f141d6b6b1910faad65fdb51ec16ccbff9bb4f445109e146ee57b257ad90087e252ce3e9891e0ebbe86d82f5a7bc6f7f6c616

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md

Filesize
28KB

MD5
f196e7826ae6061d563d866db77b87eb

SHA1
a371a0b3497ed510431ac0a0af3699988c1f0650

SHA256
2584d9617b200c24757324e9f5194efdfc6d8f316c63f615a6d8915a235fd137

SHA512
88f3c6620256497b987b6f2757129b9ecff79492196be5b8e726af1335a61f2181e95699081991de7b296b0ac31ec5189e31290479cd152a1d3f6705d0aa9d4b

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md

Filesize
2KB

MD5
23e940246b34666e1801036fd9ac4820

SHA1
c6e21944963e6fe938dcd11b5c62ac3a375c35af

SHA256
d1c206c5ad142e2c5380711f288d3322e7c7bce948e83a6c229cac1922cf1a14

SHA512
cf4b60b180fbb938875a0097cd919cebf3ee3fe7ac45f48d1700ee39f6acd33b582e2f7fa8b4b818c03e23e58204df406c3e296c456e8ac7bd2b48f737e54812

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md

Filesize
1KB

MD5
177902de4c1e532a3790f7f911dfd14f

SHA1
c452682ce571e8268f54bae136fdac8dcb036b1d

SHA256
ff65189f35dd1c656b901b0198a0d8e25efefa873037c5e60b1e1d10584ea6de

SHA512
9399520fc65c50f66830cff9dbd42453bcaf2ca6e972169a121b2e14695fbedd24216f42ddb757cc50d26a4891ad5976d3f71bde480f6bf827e1ae556ef22269

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\icu.md

Filesize
2KB

MD5
1fa1266b9eced326e29878b1605f1e50

SHA1
02ff603030cd351e5d5d30e61c61d28c11d2d2e6

SHA256
3c3c83bc4b4b59868cba390be4f7780a3808a01f182ce96ee7c8b089a4032d6b

SHA512
b9c411bec91d58437e797ab95079bb8fe3565568e4e56e445f99b07754a8a696a89a9ee7aa504b55be7b39553049195742985246803d9ad2afbd1e5b825f79d9

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md

Filesize
1KB

MD5
c2f6a1f226299ef4a8a5cb0219a6e12d

SHA1
d486d322e3d0c1ed98af302cf044738a3348a884

SHA256
2a3f4de4b654a8177cde04d88334fb1a1fe2f241f0112c8d38fd656eb0477721

SHA512
282f2a36edb87adf48578ea1fe064745fea8e1fe64ad2bf6fbb7694046215e9fa5e15fa00a3fd4eb860874d87449fd03f3a2c7130a525a72e112df572c7484fe

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\joni.md

Filesize
1KB

MD5
28df09f46bd1fa6821975f6952a341f5

SHA1
cbf5cae460afc4d0c311398d7ad97c24b2180f87

SHA256
0b19a216f750c5d25d2ec77601d605994a6b180aec888757b71ad9b4497be03d

SHA512
8a0821164e1133d52f6f04b022c9e8cb905a66b56a1b1aa7a8f9eea2872f27078287d68823e420fbc5128ab577c55bcd58da0c9bcc6e81d1a772a4652bc812fc

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md

Filesize
1KB

MD5
59554c30998bb0f5024c971199b931e9

SHA1
1468dfdd6706e5646e0005a2851bc989d6dc838f

SHA256
90699c97c87459cbc89e0446bfad04317894d00daf709488dcc374f614abae51

SHA512
d55137c9270eb3ca7ff7c99591a658909b4a94303592111ae8c3c3e0517a3f87aee815e7c43fb82fd0b24ce621606f13d44ee75ab6eaf3572e86de440e217061

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md

Filesize
3KB

MD5
fb4ceeb8c19d06c980a15eba3f285750

SHA1
007ec38dbf0d67b4a6ca4a1edc572df66ecf7e8b

SHA256
97d4dc2b12586ebb8ab88e88163a53d51450122050323f58a9c6cc1ce1532f17

SHA512
cbcfca66018d10bfd44e90412d1ccc6104ad628e627ff28e5f302c98af40e622609949418c4953458d2e952ee42f5322fd6b3229121dba8f4579dce91554c81f

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md

Filesize
2KB

MD5
be2c22a1caf095cb482ddad574f0cd5f

SHA1
43a92cb07e2774186c17b78316200338bda0f6ae

SHA256
350bf5d63cb1789df4103812ac71a066ad10039aa77e7fea1dfa4c6f09d4e246

SHA512
094b0f65618aac76615ebca7fb6754fbb8a8fa98e7eb5dd06ff915c0dfcee275e145077183da162de21a42405ebe7b4bcbc16a1c9c42a6ddccbfbbdadedc98ed

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\libpng.md

Filesize
6KB

MD5
c982491a0f671fd240fcc30b180161be

SHA1
9d8caa84aaaccc62cddcc016762d48ec9acce6d5

SHA256
e0d7af4463b990c9f18587a7e03eabc9a8b4795e5b9a79e6171c99f35266ad1d

SHA512
675ee55fdf76a8b47966f32f44c782344d264a2de8c08cb10cdcac60dc97a42750c57cab11f736f1f65e1c76b2cdaedc58ca8825a5eda0bff7a3d39159292aea

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md

Filesize
5KB

MD5
0796968b1c46a8a33d9839753ed91e41

SHA1
1550855daca23f786af3e8f36c4b395cdce16d5a

SHA256
ff329d9e4066796d0ec4ad8f83a1e016a0fde0ca8dc3d51674e0b163a1102d7e

SHA512
146be761e9c85baa162cb613e24339d886aedf5f0d94d99baec0a9a68793302792084086327f5aaf6fdba67bf4c68c7ab1b8a93655f055a61ef3cb31c8913c84

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md

Filesize
3KB

MD5
e3cda95db7d5868cb0cdad1989b35655

SHA1
40f663e63b8cc6088b61b3400a1b8f8819e986d1

SHA256
02a869fbda3e901e2afe6d696f8abb5530b36e1b0217fdc057d7f27cc6ef202d

SHA512
459809954978c070af9f9d291dfe49029cc70a77c819da3c9efdf57ad1283cdbb61fd5b3b8e0bfca14995d185acceaa75842e8835146b5ab167f97729c53e3d1

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md

Filesize
2KB

MD5
482932fedd362fb1da9724ad765adbe6

SHA1
92673921b14f0e2db107d857351c7bc16729de1a

SHA256
556dea20ff8fcce4f16c00304fc59b29ae73f72559e8a080a0d87e1cbf3a468a

SHA512
591c5425ea9960eea0c4dc71768aed3885b30af27bad0d9d05cb67159ea44762bb6cf90b4ffbd682085182451d17d88428785483bb40d84907c30fab8dee93ba

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md

Filesize
2KB

MD5
fdccba04aa8f9bc43dd9a8db69fde56d

SHA1
2f76343ac1546313bb848feff53d330fe91f0ab2

SHA256
ae2fa59c3b6ce02b9fe6a30a0d5c207e81aa15ee42672afb23cfd25ade89ec16

SHA512
2ade0d4465f16cb924d44e3381cb85ba76312c8b56dbd3bc4168bd766a7429f2640a448bc28022f6dccb078b6fbc0899e63593629718704e1a8eb92d4b09a62b

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md

Filesize
1KB

MD5
ec4fecb4a0f8cb5a7a34f49723a4944b

SHA1
e89d6bb1c897d299a8bc54cee69a7aeb7e5cff15

SHA256
a915034ab83a31183f68e211148769f37ae183b67e764b41a93e5f64f089313a

SHA512
a680d57b30bc92f7e2a3bb1c5020adc7c1a2c47d60896f1c747a84debd58e047f4944e499f3dfb4e3829d82df977ed357c9248ca7dbaba3bc2de1b028b5940f1

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md

Filesize
1KB

MD5
49dc43a81a3d2ea781a362db4729c9e4

SHA1
8d0a66513c38fc7c1ff01dd0e6e9f1a8ec92f45e

SHA256
43bb7182178c9f787be930e37c753e611d342464b863dac631a022955e9c0336

SHA512
805725d01d83b63bb724a8c7d16b24b5b839c73a14c73cdfe689fcc149e956dcd77986dbe5739fece7f0e819d5798dd332a800c04675e0fe39304511029ca589

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md

Filesize
11KB

MD5
4f5b34563f5bf94ccfeede441a22d7b8

SHA1
2f66c65ad016cbabbdf0979963257c28abf9489f

SHA256
4fb64d5648d8ef1e62ac455e00f8395ed2b46eae7ce0c357c10948c7b9db2e24

SHA512
b4841c4a8d603b3d5b9fe5569851a6b8d0c048f4f12a9f43f8e75a25e6dfa8c285d5118c42c5ee6895bbe445ce0decfd5fa1e75fa36896d2b785cf0cc0c537a7

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md

Filesize
1KB

MD5
fec86bc059a65267be2e800a1f84413f

SHA1
89b8f241191013b5a965f3ec2baf1951d71c3b1b

SHA256
beed44dea45f4690f8c93cfb966764583898f7633bc9e6be545d7ea6ede9f11a

SHA512
28d33e18a289539173f24ead72ace43efb0306fc734b50d7998e89065953791bb0c6a7eda2d432d7fe140b6bb0a71db6d67971725fdafcc0bfcbe8a87f4cb3bb

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md

Filesize
2KB

MD5
f608b951e6fbf94e6e52f4c4d07c50bd

SHA1
992b7f5ffd67cd236a287f0002f25d859cbbc56c

SHA256
2bd03979e5239bf02ac37116a73d334b387ddb95870ff1e85f7711f1ca570ec8

SHA512
7675acbfbb52668224fca4350bfec38fbfbfeb25861a535f9f5d9c318338b502a35e48197ecb28fb461953ca97db62899235855a1e56aa1e68a3841a1e0ecca1

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md

Filesize
11KB

MD5
d6f8bc5c98dcc4f4e41c69e887103821

SHA1
5f2bb6cdd7191399561e19bcce8918fe01db7287

SHA256
3ef3e4bb83048bdcbbef2ea920d18f83943dea314f7202abad7417ba0e1e54ec

SHA512
4dd7553e57ef6c5d21a832bbaeecf839c79a1b362cc21ead0ce6f439dc5ee1c8526c059b127f5b8703779df0f586773b9a4005f2de611a3703f4380fb3b3ef6b

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md

Filesize
11KB

MD5
8f76d997bff4136d4e1cfe1067aa0edb

SHA1
c67db428ed1c599e8760a9a2ee7d57201071336c

SHA256
87fc2c71a2d12479362af13860681f2fc7ae088fe4f2db8d9ba824015a39ce58

SHA512
fa82ed92d8ce00e1bf63d3456d23a0659cae4fc55ba79e3fd7e2905d4b3375a643625daabdbc4843eb058a5e7d925f27568af5277ae190000a5414f080dd9cd3

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md

Filesize
11KB

MD5
06e6bb8c4412bd192b9ab90947bf8d78

SHA1
2fa2103ff24939498f2477586c2972b491c3c1a2

SHA256
9e8a75ca74623fd003c62b87edb314b7a451342701513a3ff001c47c6756551d

SHA512
9e9b4766ca335cfe7fdb65994f57f8522caeed33cfa6ab33d5bb2c8927482c5ae79aecabd1e19d78adba35a7e85dbcd806990976e0e3ccf41f950dd1b78dbde0

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md

Filesize
1011B

MD5
0a0b6179a0f9d6831a32c152728321f0

SHA1
bed43bd2dbeaeea4aabc2852066593914a82cf33

SHA256
53f583aeebf6c3403ddf5586a1702a02306304ceb0e17b504754069eaf7f50a9

SHA512
79e54dd7e0ed78e9da83e5cfbeb2684b135374836d559ddd923decced5322cd838124775413956779632e2b63915b47165bf61d974ed687c1bea398f2cd67cdc

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727658720680492.txt

Filesize
77KB

MD5
b17c7403734f3370cfbe6f79a9218cb3

SHA1
e98b6e5a8554db965ec8ff243af976c5c15331dd

SHA256
8b84488ab3b549b87eae4a14ab551b368e03e869f8d85e64efe34a43c88aa1b1

SHA512
16d6feefeadb47036ab7d3a78a9097e4d861c26a68aa8f2a16c322f6846e77336676ebb4da2686031e9fc0859f4061a9913b2359f55530809734ac131e95df52

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727659161166784.txt

Filesize
47KB

MD5
f2dc5659868001df691f9dbe2f4007cf

SHA1
e5d83d324bf5d88a028eb04eb5e04b6926e48127

SHA256
d056554fdbb3525a23ea3f88a1b5d40bc2d97aaf04e9dd0059a6f9cd8374fdd5

SHA512
b4e28666f7de7d3b8a8dd854ebeb80bccb468a7a1b9f890916303b7d4d403dcf235dfac3b6885e9adc5095f203fa00c3027519deb2ea3a5c6688d362ca4bd575

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727664493679931.txt.Opiwe

Filesize
53KB

MD5
9d37ab6ced31e70c9536d11e30a8201b

SHA1
e7606cb54450cc7f5a60198ef7f0d67f6b236b25

SHA256
afceaa57cfd43a3290dcf78885afa66709fbf24a4dc7465be830640956ab672a

SHA512
81ae642701cbc986d7ebb7848a849d0d3261700e229dcac711883e2ffe8bc25dd2eea93f75b979aa1fbe84e12cdfcd48993315bf39b7dd7d2e863d48dafdee5d

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727667861810871.txt

Filesize
74KB

MD5
bfd6f7c593f63f407a2d452ac459a809

SHA1
9df14e1045582cc5b868b39a1e6e3c642b66a2a1

SHA256
428803fd58449e1e83dd012343cbe14293eefb53afe973270bf21a3551f7ac8c

SHA512
f1dbabb31195ad152f3e6c567ab3ba77102949d1fe36040df431c032412f2486f614c0d5a50ca1fa2dccf4710d9f4a1853e6b035c8c8b0926eb29c2b40b8ac30

Download Submit
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\File Explorer.lnk

Filesize
407B

MD5
9afd3ce5ae157ae69c97911a5de8680b

SHA1
062beff650ace8eadbdd3370753369337285e2e5

SHA256
48c12748d251fc24d3376936194144e6e3dfc94a30f42ca6f3676c6f5eb68572

SHA512
778f6c80d7049f0381e9754d37c5c7ba39c86ea67762348395e96c9825fd2ae3377f27772a5df4c7dfeeaf8d61f907cc6337e1c656ccf861a4e2d918361b09dd

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg

Filesize
21KB

MD5
eecc7041cfa333012c1607bb73a0c66a

SHA1
d3e30c0e4d4079a3f3fc162eda1a1548fa6cfef8

SHA256
82aeab79eca6a952bfc7920b66350492644990eca4d8e3a8964f7ed777dd5779

SHA512
9a8ed27deb1499cb0b24b92e138833ea8c36dd0ae35e336bdd114230b2bc19db399262188d6b8a63efb2e866b8833efbc9ec4c77f094cc04b14218ac802684bf

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\HelpIcon_solid.gif

Filesize
1KB

MD5
8f5f70446c4ef773e5f9747a5fe81e60

SHA1
60e09fab6b56307c7de57f35cf0f9e639bbefcf3

SHA256
8dbab18f3aef912cb1ff70557c07356d0004d4990b5a42cfd386fc15de3a36cc

SHA512
c35b2e2a5845b7858522cd7611a81ee4541899fd47de48db408074591999a9503d40951c1722ebd952fd639f7028822b2f77398d9b6c90305423c68f1c0d74b4

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\alert_lrg.gif

Filesize
952B

MD5
fbebe17fe31f2dc8a645dabc9c976c69

SHA1
b26e3ef16ef8dc2d13001f7505571672761d90ba

SHA256
c51ad52f3667b8364da9dcfa96793bcfe3fe284ec75d8c2dd695e43fb3879b15

SHA512
ec5ead08322bd5cc65bdfef77ac9d68341b51be1a40709dd541434b240aeeef8559e2100996e00072e44ce1b430d9861a9ac29416902d86f67963e7fdb8b1ca1

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\aspx_file.gif

Filesize
121B

MD5
d449642291b179259b5e294067d835c6

SHA1
7e52e4928402e67e5ac2199549fb32ea9522db6f

SHA256
c6ebecb43d192ee0c6a1e4399ddfd37ab6a071c41ddaa1ae7d0f69d8e4c1f887

SHA512
b9904a9ef94fe67607bbff530c2ea296a45f3469f6d61c61890cbc4b19e5cf96a4b9a155559246d4c0b771ed053e11bf2d75d11bc615ab75ae6bafc6955693dd

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\branding_Full2.gif

Filesize
1KB

MD5
d2c0e5dd62843253272e90ba33df8185

SHA1
238d28920a3465fd5033fa2b547a83e1e148f0c3

SHA256
776e88a8b28bad5e0bef832d855a9565a5134f4ed0041610d3fc2fe31cc6d76d

SHA512
3a8a11b42224a9d8448d54f8aee7e515c2ec58ac0efc2dbb279518d1100b19402ebc409ea9aa222444e8abbf2ea186cefb0f308e38c0c2ff3cd6e8b7e953b566

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg.Opiwe

Filesize
8KB

MD5
17ad67d1985501e94cec6394f4a21dc2

SHA1
abf3344c96ab288efda68b3eb997d8651dcdbc39

SHA256
f75b142053ee21200d70dd683ef085e1b078ae3cc546168ae3dcb3789f87b951

SHA512
757b4734ebbfb6aa63e0cc97c6475a848c556c96d0dd7db81545c84d1af617c6c0bf670d8cb8d5948a1ed9e9e7d7f2f134b78e0b7c6b52bea1061ac2bed3b06a

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\folder.gif

Filesize
914B

MD5
5f3f91c680b6f633c953c31605831fe2

SHA1
5430d91cf3a29de734f4c115107fcca9922322b5

SHA256
b4bccbdf1afe96012a2674ea5b52d46eb89d5b442f845ce9bd0e5a7e5cc97779

SHA512
2d0a9f4cc422eca4596e4de95d8f0f4a896dc09da7c5083507b90460b80ce9b8d0c41ea1b0bdda77d4dfb26e0a04d4a3886652b2390649fac70b3f105b0424ef

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\gradient_onBlue.gif

Filesize
90B

MD5
44b54b71ebec5e1480f791f8b46fce60

SHA1
8852c17e1ef60d094718b4e9a4c9b6e2bdebecc3

SHA256
faa4f9e5f1523152b55759c277c356a687a38fba6ce033362877cbf7a7ff1a97

SHA512
77a61d499e8fdd958a2dad95ce5f5d11e3a448dc12983072bb9abd5626ceedc42193b425d1cfe40ffd1cce2577461885aff7baf017922408f365c93c9ba599b4

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\gradient_onWhite.gif

Filesize
90B

MD5
86d24fe196c45b536d8b90986abb9773

SHA1
cb6a3da11af882e9e9aaa236c68d064401fdd51a

SHA256
fc683f28079f16333a5cacf59dde8c237c3ea524a1bfc8075c07231a0e05d4ab

SHA512
43f6e9001316d19f53e24d8b8a09019bde0071a1e7808127cef63465a403bfc1bf83b84355f140e943b90fb7732c212d09e184c506b2d4e46656b936f700e310

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\headerGRADIENT_Tall.gif

Filesize
328B

MD5
7b0e540a7d6d5e120f48f6e9acf1f40b

SHA1
a6ab8cb52d2bbc8c03e1bd2203458cc3b2de25df

SHA256
b85349b7b3e634f9e8254d5d1b60a3b274a7e563c523dfea4479644bb8d82624

SHA512
6ef9f39b4f4b4be2060b13cce89af4928c338bcfc0cc82beb5817494523bfcdfe0ec31f6b0293e8f5400ea3e2f3b09f192d0b09f5355e1cf1aa74658d0ad3117

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\help.jpg

Filesize
1KB

MD5
cb95644b2ac229d8cc81966ac8e73e94

SHA1
1dbc2a74e222d7db43ed01a708fcbe075a667a3e

SHA256
eb07a9e5b1316a77387b06bdab222d8015b14fbdee5ecc70e636354f4666537f

SHA512
5043c8b4c635a65a582ed7fb7d3416841b6a6ffee9026474a207f41556162048856a250269c264ec630bb63cb1635c842693422472a28666ce185c4311f815a8

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\image1.gif

Filesize
162B

MD5
df1b80dc937584ef39aca206f36ebe0c

SHA1
63ddb17169c3c47b9e0aa10d84db76d1ce4d2e6a

SHA256
ba93f63b5675a0050a6912963eb7d833e3b46e01723d1cf023f396ff06322493

SHA512
5f0b64dda5163c6058bce3168f89227af20a2cc5ee5e2871c47cd454c03fbfb97d1a481e1df4fa2ac9428d49cea818840a136aa32f6bbc73eee60e6811845933

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\image2.gif

Filesize
586B

MD5
5792a608b1320f18a85bcba5779c65f6

SHA1
dfde1b3970643a9a6b5e2bf06112c26615760e6b

SHA256
3096a66859b2b9c0ff250d867011464ba7a3f73ab2be4784d71910b70c8c6150

SHA512
81bb26eab77e58b895799ca3d78e53dadf896b5fc54c6c3954a2c1d75c854ee5fea7e0e43b0a8d54e8627130b5edcdf1534a4c40e417f0431a5740c1d1300162

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\requiredBang.gif

Filesize
124B

MD5
0a64a973bc55ffd02c7c5d8b84dddd21

SHA1
49e96b981a637167d38f6ddfd58ee4049827dfb5

SHA256
1e31057dfe6d1b410cc2a9ea1354bbd079927bcb4ce27058bc5a9f80abe80c18

SHA512
7736f9f121a9a61926b12404189b1b9b17aaca834ea011fd811b6e1e9aa34f0ad9671c10e1acd61d79123925350b1ff9f5e652b4d485a320a611429de550a50f

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg

Filesize
8KB

MD5
b92e8e6355a7f4321ec412dd07a337b4

SHA1
81e2cebb30fa69e85dc6496fbc2e387f1116bfea

SHA256
03740453540a5a7876c57e88303669ac8f4f3cc700e04d34a6387b09bd18aa9a

SHA512
9113ffa558f8c96cf48e4a3ef73b513dadd471b7d5e3f1874afbf772dc94c9715311ed3ef8e2c57a35aab3852625dc9c086de35fa96f5b1301fdd81c1ee77a64

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\yellowCORNER.gif

Filesize
880B

MD5
5e97dac33f223ea9bc02f32e015fe223

SHA1
0883317ce1162e863c5c6fa76f4a27afbc981651

SHA256
6c951fe2536bda8c5a0051d7e4b14a3542a3d946232f54ed01adff7361a9480c

SHA512
079cf36716fb742d96d9031a7be637e2a3d448bd9bf2dc56de8c76cfe6a2420e7601d307e5dcaf97999a4312872a52b078b17178f142b0ba83e7707ac6317400

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group1\1 - Desktop.lnk

Filesize
1KB

MD5
5e93ee44e346cfe6de9759d7f7f33a95

SHA1
157b37efc1165bfc2159b1b8d9daaa8aa3a8d23f

SHA256
3d933076f38e43f152a801d9d05152067dfb623182c94c09b805da3237ad06a7

SHA512
8ea6f247f7b86e52d0afb62dac68ee9001030dd16fdcc3c1bd8eb9ae51097a6dc0cf2f669ae74bfed2a27bd5d324c4e527aaff7f0d7db25f26c56779f6906e09

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\1 - Run.lnk

Filesize
1KB

MD5
3b6c76a56f7ed88c6f1866c7c4ad4356

SHA1
bc64f6f73d694429eb720eb26bc801388c883ae4

SHA256
1aea3823dafa88c750f9ee606063a577849970e55bc64b9aaa439bf42e200eb9

SHA512
fa290c7377b7106b439ee00f5b2ca8e18553b66f93d292829c10fb36986eb9f61dda54d97ed4213d9f52c5883af64b44eb9c2995c8a6f5662bd4976612e47e6f

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\2 - Search.lnk

Filesize
1KB

MD5
9a2ccfe3a48fe28629777cd96096564d

SHA1
9993bf116a490888d83af2b70b718843104831bf

SHA256
be03fadf50d8ce6273dc446196ade3c1e416faba9f45247807927612bb6258ea

SHA512
62aa44e9ffd619a7e6ef1863f37e715247fff0c3283af0dad4e18bb52d81dc0f1f4c64d58edde0062801bbe7cb616895028c58fc5103fbe355546d269030a48e

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\3 - Windows Explorer.lnk

Filesize
1KB

MD5
8827e11b89a42c7a886ff008b9688dc3

SHA1
75458785892c119a86daa1799323eef8ab94a99f

SHA256
7464b17d89ffb6e6cf0f061fae6218b10924d03a015435fec0e89591be9ec443

SHA512
07668ea1efb0d4c37d48ad828f8d9fdcb6a93cb9a5c8544e326dcc88233a7da3660d821ed16f5d54e17897df0f7700c4ea1b4e71d68aa69fca3f3f62f6011a5e

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\4 - Control Panel.lnk

Filesize
1KB

MD5
d7043ed4f384b8e3dc0fd90a3c5dc78d

SHA1
05e93db5616447f43ac94efd47a1a2742bca15ad

SHA256
3815474723a31b2f2a93b084df3615a2a92d265f54ecb491373c5fdfd5828b4a

SHA512
8b8ae449febf81ae7bb6b262046229f57316194d6123f94d2079cf2d26caf980a386797d7c448892579ef91643fc5f154bad48a03a189f1f978acccdc8a7a84f

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\5 - Task Manager.lnk

Filesize
1021B

MD5
0db2040816fc34c48838d9c179a28551

SHA1
91747cc99209919df9740d151d07392b65d1af58

SHA256
401266fe7295382507ec058ad764a9b0c052dfd2e5b405899ffa4386f184924f

SHA512
e437c895d03878d153083756054cc949ec7f2356d0d6ab2556c28d880b69d1218095c46c3aa9708d1bfbc15159b4589dd7788ee7e0927313684d9007aed63f19

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\01 - Command Prompt.lnk

Filesize
1015B

MD5
c1725c0505ce51139190d763355a3828

SHA1
081b92dfddc0932dfb5adc5737d90daff54a1389

SHA256
4ab99a87598ec2472eb2afdbd6ed0ed3c4238f1b5ff5aefedbdc8271c21b19da

SHA512
4b59bd6817d337ecd8721c7583339979e3483a3d56dcd1fc9396fda3830804c659de36a4b58cc4f016e0f1dc06c89af0ed51b9868d66ed36415adfb5b4b8fda0

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\01a - Windows PowerShell.lnk

Filesize
1KB

MD5
4fa1572734652563b3289297c1e9426c

SHA1
24396deb7ba3e215a8adfed1de939062d3043670

SHA256
9ac84c4452a573b7b1a2a94ec83ff2bf270724de7a97935cbe461953d66cd21d

SHA512
588e95b65b93a23bb893bbd6b98cf386a6d4551756647df9501b744ba0f6dfbe1b4e8380650218853a882b2bf31a0fe285fde7f1dc064422882c68326cc8f1d7

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\02 - Command Prompt.lnk

Filesize
1KB

MD5
65a6be9b5445f2f15c5f01a00487f250

SHA1
d17aed64281e85c60652f98b97608e0a96cb9a5a

SHA256
e628e76041ca82d4f67b3d82e57dfc8e3f8a2cc8c399bbde07abd862cbf0a111

SHA512
fb3e46694c554e30504ce184964715601f4ae334de88152ecb70246a112272be53d76da3967ae9331694a47638fb0b397734c0cb2117cd701a26bbe17e096243

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\02a - Windows PowerShell.lnk

Filesize
1KB

MD5
f5787e8bccb783d653cf9d22caa523bc

SHA1
6b31562b7f92dbf0dd5d2536d46d6e25d4fed555

SHA256
27e63ef8a8e0280976b0033635a5cbe9b30287862ded310c8a89e783a665af10

SHA512
27069fc36a9c6894b3cd999a6388173ad0c8cb5ebcab0181e5adf14b78e843cbed3a501b5096323215fce76b5101ffb7a41f27b4c039d4331aac5d9cf25829a9

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\03 - Computer Management.lnk

Filesize
1015B

MD5
5aa43af41cee0453b8f9169b4e838d47

SHA1
b80b2d0226545abba2fec50d86200dac1fd6c7de

SHA256
74b372b2f61cc48874295715e8e08124f474aa3df1335ab66f7674d552d1f46c

SHA512
df8a78c2c8dd4ac3ec847a62b7a7fdd98f7318fdbf48d4367e37ceb493700228ac6f98c67f44fc49a4d484ef4860dd7fa973e7470ad72e9258af81e0136a9d04

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\04 - Disk Management.lnk

Filesize
1015B

MD5
26528e6d44ba92f67af63625f7a8fa11

SHA1
4d9a90228a80e849db2ac9bdbf3171aa33c624dd

SHA256
e136ffbc525f4f31bfae2300304881fa07bb5168f4a9b35f896a3baf0e580e4e

SHA512
60e2394fb8b20bff8a294f4126db81681e166cf3df7687d7c595a2a7412959cb9e513bad2fd808d2a2ba4f4e9063f94d835ab5a41486aaca23df8e1f3ba5ee3b

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\04-1 - NetworkStatus.lnk

Filesize
1KB

MD5
aaff0d3a742a7943b750427d21df4317

SHA1
6e81063d23cef6b7593e8080f7dfce66807b541a

SHA256
36a373927862b8a4d8686a37bb116f8a45f6f560d0c86b957380dcf76e7c595d

SHA512
c5c34c6cb3eb4f1ff36af7d330b4aa8971240da952b4614b310689544ab779474b1bedb98ae5a54c9216188d72bcb960b313635e76af0787caf0e18e2b0f022c

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\05 - Device Manager.lnk

Filesize
1KB

MD5
8672152622372e5e316bcb7e0b8e7924

SHA1
0d6c1698e421947fb93dcd8b41f659fdb1f8b303

SHA256
8fa5c111d44444a624990065907e2a1846e48a7a35fe2107a22474b58207c30d

SHA512
a76596a20e0436b33627419f5ceef4b463fbe141406fea24c98ff68608a7787375b0ac52aa78d803fe2353e1b476ddecf1bc4b09bd255bb33ddaa57e777bc750

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\06 - SystemAbout.lnk

Filesize
1KB

MD5
e5677b33f5f707c4aa87ae73da96b682

SHA1
aeaa9c379abbb2bfcb0276ff93f07ef8170d3f5c

SHA256
5a44a0d38f57d20df084d0d7d3a81f767001696c311ee694f98194b6009c3696

SHA512
062b0e89552bb5bd56201a7703ef52790067edf077cd471bca639655c3dcd805e15421f7b530d1a0620106a736fb29ec7d89bdd2427bbece6d38302c0cd10385

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\07 - Event Viewer.lnk

Filesize
1015B

MD5
187383af61fb53647d3cb7c1088cc084

SHA1
5555115d7641aa637ae0a8fcdd534d84236125c5

SHA256
e5cfe9e1000c978936fbf39a2db21fb1899a50a98af37bc6fca69698ecaa7f0c

SHA512
762e3bece49e5c5fa994169c4e3236112df6ffa153fc3a6d323ea98af00fe03bcea1587608352d73cef26016dd0c660c5c147e3afd8fd4c4840571d1b0d4ace4

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\08 - PowerAndSleep.lnk

Filesize
1KB

MD5
6d0a7938c227add736de860f38ce88ca

SHA1
ccdfc236fa07b924493e20eaccd3c7af740546f6

SHA256
16bda5bf2a5426b7d16051d01ce66639625d9abe8552b3beb4d190f03bf388dd

SHA512
8fb7d4021af09a696b3f2b46338550f71ab83ac800afa262d281c4585aa56fcd077e42c21c983e09561742f588bf3f23a710e0f44cc1291b81cd871c2fa9d62d

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\09 - Mobility Center.lnk

Filesize
1015B

MD5
32473fa5be9b6f9c34e33b557735f9b5

SHA1
2503a9c37d889aba9bb187fa23fcc461bd7aaff0

SHA256
467753d248859d304cf98c649773c24681ae3e34be10bc1785a1089b989b92a1

SHA512
ae534c04d0d25d32113ee6a78b2a2917aee36983aca385695a64e007af60b145e9868bb37cb6e9a0a06124069d45db7df6080d3e5d50c33e500cba57495090fb

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\10 - AppsAndFeatures.lnk

Filesize
1KB

MD5
5bff61993dc4718eebd3b5ffb2cf498c

SHA1
71521114ba3a3cfd1090a49133e38f95e83c325c

SHA256
fc0a68a8b4655b6c732b1a64ea68f3170ca1189e91f3eac547b1582776f4a39d

SHA512
47962b8e99f3c2130dac2da6009641256f8f5405aa1e40203502d6ea3a27669d77001e42e3c7559e9e8af1dfece4072bb7ef04f5e3ec11c85d9aabd5e4df50c1

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk

Filesize
352B

MD5
b32c1cac79b4616e76cdaba82e58c430

SHA1
7cef9589d6aa35e0587425081ab47e1924bae2b6

SHA256
d925d7d7fcdd56398902d33dfc1994a046df71f7aea5edcd51c83802a2aa519d

SHA512
e1c6e86369c2176497390516fa6af561c3563a2bdce5924b3899808a7e9c9be70c3c29100a35f940c656567f60675c2547040cb8d89ba771a59c4e1d60fadf20

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk

Filesize
334B

MD5
13f3a09673ec8da650574aff18e5c581

SHA1
4d5edced3d6ffa44bd0745c8afb0b7b4a02bf942

SHA256
3f1b3733dfbd8340ec9af9f5e3d1f4d8bedd6218f716654effecfcb942c3332e

SHA512
174b60f5c36d4b170597cb428e3cb00af2dd8d993e3e73f5af1886cfdb3ed89d832e18937f30d94973777998df8e93c11740f4629b776ef6c64603f8ead3e11a

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Magnify.lnk

Filesize
1KB

MD5
193f6fb705cef44a09da1681e80960fb

SHA1
e75e82ea92b1533950c7f95d1736847d5e2aed43

SHA256
32edb4b8fc0f0d8d7d85f9eb6eb0f5b5227c483f2d0558cf58a6a8ed44802160

SHA512
df1ec33ea93bcb85732a7202d19bf02fc5e4d184c8258014b7b16c35af16b2a5f37c33965f67817d7ca81cfe6d1d32a8d8b85de5c8ffb262fe660539960e2801

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Narrator.lnk

Filesize
1KB

MD5
2518f447fbcd6b72fe25b88ba1cc6a16

SHA1
6d73a2ffc84d292d52c0e2214e6e646c51ad0c3a

SHA256
d83e12b6d1fb4ef3787ed36c485a90935e557c845cf52432227f67f7e8817890

SHA512
ec10e825c121349c5ec805fbadc371cc7dd955e1400d6f6c6ac00f4102ec9f73eb2573aa607b6ab43d78463551440fcc312c8d7af177cc90478e8dc5adc76fe5

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\On-Screen Keyboard.lnk

Filesize
1KB

MD5
d32f21448fa3455b2003793a24809f32

SHA1
ef62023505226665aaa4b14e42c2ff9c78c97fe7

SHA256
06ae12b3329049067d88dd98f01387be23bab19f507a4514a50a2dd906aba1ae

SHA512
b0270c0e61753a572f38decc7288588ea03bf134ca9df70878522e219d4ee9593adc7fbd75469a245a39f04038f33fd59026668d04bc2902055f046849f2e728

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Administrative Tools.lnk

Filesize
1KB

MD5
2784bbcc6a4a081d96be0aec60cbb2fc

SHA1
d5ba0af0a7dfd8ce4d95c05b4a9e26604d423c45

SHA256
9f5b080a523826abe99f355814ae3d69145f3781d09e83347491c8a6af4a2af4

SHA512
c4bc4b34fd0b0c05eeac7b5ad45eefc869b36e19d9d4e647e2be643ec737f1823c11e57925afdcf9b665f7d06cf09d12fc3cd7f9b5d4528d798e69f88cacbb36

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Command Prompt.lnk

Filesize
1KB

MD5
541ab78681fbe36aa71578591e480c8e

SHA1
aa820e41bf16a4f31870d99b5f7eb58eb7bbf964

SHA256
354f7fce031c01deaddad123c6822b950714eb188f364cc318f04a836d90a2e9

SHA512
383c959cef78aa35b2e35474ff6bda312dae6a93c9a0e286629719e969916baaec0ec9b5f3fecf2a331e5f6094376e60b7bf88b71f736296344d82e23089750e

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Control Panel.lnk

Filesize
405B

MD5
d9a7187c57716c35380054d001bf31fd

SHA1
a99b2af45019865d0efdba7bb7499f51bf0d817e

SHA256
456be1d252ba0dc58f30a054e2eff2aa7e7e84a806030933250db68a0257df8b

SHA512
298173453115367a35d5fe769f086fe8af1beff98dd0025ccac5063305e7795219b24c785c93a79fe810b0a747df0f00c6e02b1f24bb8788bbcd52aab1ce3fb4

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Run.lnk

Filesize
409B

MD5
5febcf418cb9616c7d5839298b08dd19

SHA1
0cd46e3b5beaa9ad1dcf7c3c9152d5bff7a9476b

SHA256
7c5e998934c26cb3dfb21a4c41813a57e41e455fcb415762433cb761f2ce7f79

SHA512
48fbd934b9dba75ef02a2c69e353fdd7d9a46d175677a592ef9d054a41e0b9666c7cb87eab7b391f14829a7261c1a3848f9c588b8e5fcbe60d140531f3d63b2d

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\computer.lnk

Filesize
335B

MD5
576aa8babd6423abf33d11b25898270e

SHA1
668ddbbde65a49a6fbc4792c4ed83ff05f44bf7f

SHA256
3700a3c310358e45b0a00af38277874f900c79f0bf08e69dc3ba2bd57d2df758

SHA512
584f196abba726d9c68974bffe642d37bb56f0348cd7a72564b2b87368a45f3a9ae63f7f0cf28a5be38876317612c849f2ff013efdf5b70aeda534ead46c493a

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell (x86).lnk

Filesize
2KB

MD5
8b6b8b87a47ed309a9df706d385836b6

SHA1
29f65346c1e29674f65b3f16818ce559d462a8b1

SHA256
dc2350db115f351280af80abbf4144d1caeb6c8411838f56f5617238dc0b6d42

SHA512
68e6e2d072ebfe55ac90faf4356fe9c1357d2a0c1bbdfe3b6be248a6d0d25745f4ee45c1022391c25bd9a98820cc71d54cf5d4f58cf8e1eaafcce16b17112f2e

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk

Filesize
2KB

MD5
a4876eefa04375f1cbdde040232dd698

SHA1
e90dd7e4a7bd12d688c496242acde654a19678a5

SHA256
296e1fdb184883e398ff3b059499404dfcf3836ad001df5d818aea363c2e7c4f

SHA512
a7c3332e0bfe48589615c532777217171af5011bd618d8d952d23c37a92978155f56b55cb88dac9b5459e60b747d64ab20625ae805dd26385f114ecb1966bf38

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png

Filesize
296B

MD5
def6d7e958b211efe64a86854fb70fd1

SHA1
adcbb04f948cded75cf874a77df3ea363684804d

SHA256
5d746389f564b78dde1d14969f8c5f22ae48bfd39e84c3a27be65cb69a30e280

SHA512
2559ecd609a496260c5c9be8628742be66709e3467758e3c9b828c67a9186af37971c5d98fa0543364f9a47fb82d2396d21d2b2db948720d3d51fb7ad74ddc6d

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_theme-light.png

Filesize
276B

MD5
cde1cdbcc5b012ee3f5be57c5c38a47b

SHA1
de1afc115eb35362139408d351dc00ff6f53806a

SHA256
22cfa7a993d7356a1ec111518b9904aa6c31bbed9f860cd1c3c90ba19663f424

SHA512
9ba157bf58beac0da4250a8fc44d24456a4b4e4eaf70035ed41be99bbfbb75c2302469008338b215fd0851eabee8a96962e113825b468e4536c680a644326e0d

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png

Filesize
296B

MD5
f52f35419912d53bc0f655dc7894a69a

SHA1
192f39727d77510f05961bf00aee36c584f011cb

SHA256
2ed13c0aa96626b3da64e8a781877b886a87a8a79e2ae6770a84a4af70da026f

SHA512
72a14dc3da616feab60f51eb7f8e99fa0536f309fe0bdeb824e5cb5b5e3d6f679d930b657b584496082c6d5ac5c37b007a5cce1d6428c36cea656c8a587428e7

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square44x44Logo.targetsize-44_contrast-white.png

Filesize
276B

MD5
883efe35a3414fded743739d3397870e

SHA1
9142868e4e84b24ced4d43818a5ef2ea317cb2dc

SHA256
7fe957777c76c5226391dad9d958f8aa18bbc2b5298faedb890c101163b3508a

SHA512
7dfa612b454f3e1b4451aa0513d98260d6f3c000ef31b99d38e5d0ad4df8b7d352f10c7b90fc1c59f44e5a4e052618e91010765f8183fa0b883a4599f86d5f6f

Download Submit
C:\Windows\WinSxS\wow64_microsoft-windows-onedrive-setup_31bf3856ad364e35_10.0.19041.1_none_e585f901f9ce93e6\OneDrive.lnk

Filesize
1KB

MD5
74c756f3f81614287d547a39f1ccec4f

SHA1
ac99c85a0df75a97ba4b5770bb31764f5caa6fd1

SHA256
bb0496557a9c875c3dbcb472e05a9ab9966e009ad262080f09fc31d5f39fb6ef

SHA512
7cf2d098e1ec106c12ceea75cd70553742150c8a7ea962fb165d617c08fe0b4d87f5d1119c86bf27953d5148003fad8d7f32b3d0a4828656d4fde6845471e284

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads