xorist | 1293a6ef273eb551dc2a634ff8bb6723fd4fdcf4a0c8d88a9825bf65405b448d

Analysis

max time kernel
94s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
02/12/2024, 01:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
Size 7KB
Sample241202-ccnlsstkex
SHA256 1293a6ef273eb551dc2a634ff8bb6723fd4fdcf4a0c8d88a9825bf65405b448d
MD5 b639ed6b63209bf0ab2a5b144f3fcd30
SHA1 cb5b7f4e3be0d8f9078845dd4b3cfef17e252432
SHA512 c4efd3478f7ad2cc4db4457bd0a92d2186ee875bd61ee80547b6ed990ed3f50b988fe058320c7a17c9a058f1d427fa5e23ca5b54886112050be9efce8a59d7d5
SSDEEP 96:1AZhl8wdS+r3yOYW189fTwUVF0CWHyjk8P1LOmjXfihExAQbodG7GqqKZMUA:uzdrr1FG1WDCgmjPZA2ZpZMUA
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xorist discovery persistence ransomware spyware stealer upx

Malware Config

Signatures

Detected Xorist Ransomware 7 IoCs

resource	yara_rule
behavioral2/memory/4392-6625-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral2/memory/4392-6630-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral2/memory/4392-10822-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral2/memory/4392-10959-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral2/memory/4392-11250-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral2/memory/4392-11255-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral2/memory/4392-11256-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist

Xorist Ransomware
Xorist is a ransomware first seen in 2020.
ransomware xorist
Xorist family
xorist
Renames multiple (2204) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Drivers directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\drivers\gmreadme.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\KYiWj5yFXd01P6p.exe"	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Speech\Common\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppBackgroundTask\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\TLS\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_a7412a554c9bc1fd\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\InstallShield\setupdir\0006\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\hdaudbus.inf_amd64_533c8d455025cc59\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\nulhpopr.inf_amd64_9839c838c72c0594\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\System32\LogFiles\Scm\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_scmdisk.inf_amd64_d8f75a9c87c2f7c4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Configuration\Schema\MSFT_FileDirectoryConfiguration\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\cht4vx64.inf_amd64_b03448ba0b72ec47\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmarch.inf_amd64_1ae6ea0bf54c0f5c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmzyp.inf_amd64_19eb30e94285f2a6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\multiprt.inf_amd64_a9b96d6c7813082a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netwtw02.inf_amd64_42e02bae858d0fbd\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Com\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\wbem\it\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ialpss2i_gpio2_cnl.inf_amd64_a60833fda31e9831\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\idtsec.inf_amd64_9321d33f1997dbfd\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmgl001.inf_amd64_e09ac82d497a19c5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnms007.inf_amd64_8bbf44975c626ac5\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Dism\it\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\MsDtc\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_computer.inf_amd64_aa72c8894a821b32\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ehstortcgdrv.inf_amd64_5cb0c23f45dac01c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WaitForSome\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\InstallShield\setupdir\0416\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Speech\Engines\SR\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCClassResources\WindowsPackageCab\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_GroupResource\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\DriverStore\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\hidbth.inf_amd64_76fb27776958e530\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netathrx.inf_amd64_220db23f5419ea8d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\migration\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_61883.inf_amd64_2c1769df23d261a5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmgl003.inf_amd64_6b639ff361f628eb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\oposdrv.inf_amd64_9090a824ce0d0e68\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Licenses\neutral\_Default\Professional\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Speech\Engines\TTS\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Speech_OneCore\Common\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netrasa.inf_amd64_1bdf7a435cb3580d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\IME\SHARED\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\fr-FR\Licenses\_Default\Professional\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ScriptResource\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\msports.inf_amd64_f2e8231e8b60f214\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netl160a.inf_amd64_e4cbe375963a69e9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_amd64_144351277838b429\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\MUI\0409\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\61883.inf_amd64_789f35bee584a939\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmboca.inf_amd64_c4ed3602d3c754f2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_securitydevices.inf_amd64_f10a5650b96630b9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\gameport.inf_amd64_edfd5301fe3972d5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\lsi_sas3i.inf_amd64_79c7a4d8be0a9744\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmsii64.inf_amd64_0f02175b17cd3f66\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ntprint4.inf_amd64_0958c7cad3cd6075\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\nvdimm.inf_amd64_9bb46b0de5ea33cd\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\acpidev.inf_amd64_0f7f041f33bd01cc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_extension.inf_amd64_7891c7d003f5e96b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\wbem\ja\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\pci.inf_amd64_66614bed5c0a20d8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\InstallShield\setupdir\040c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netl1e64.inf_amd64_8d5ca5ab1472fc44\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4392-0-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral2/memory/4392-6625-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral2/memory/4392-6630-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral2/memory/4392-10822-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral2/memory/4392-10959-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral2/memory/4392-11250-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral2/memory/4392-11255-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral2/memory/4392-11256-0x0000000000400000-0x000000000040C000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Lang\ka.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\TimerLargeTile.contrast-black_scale-125.png	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\EmptyView.scale-100.png	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\themes\dark\[email protected]	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Yahoo-Light.scale-250.png	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\SpotlightCalendar_2017-03.gif	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon.png	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.scale-100.png	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-black_targetsize-30.png	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\AboutAdsGenericBackgroundImage.jpg	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubBadgeLogo.scale-100_contrast-high.png	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\illustrations.png	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\locale\as_IN\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\Weather_LogoSmall.targetsize-32.png	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageAppList.targetsize-96_altform-unplated_contrast-black.png	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-96_altform-unplated_contrast-black.png	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarSplashLogo.scale-250.png	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarAppList.targetsize-40.png	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\AppPackageAppList.targetsize-40_altform-unplated.png	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubStoreLogo.scale-100.png	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\new_icons_retina.png	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\scanAppLogo.png	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\identity_proxy\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\Weather_SplashScreen.scale-100.png	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Images\hero.jpg	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailMediumTile.scale-400.png	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\new_icons_retina.png	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\pl-pl\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\LinkedInboxSmallTile.scale-200.png	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-20_contrast-white.png	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Cyrl-RS\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\AppxMetadata\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\SplashScreen.scale-150.png	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-white_targetsize-24.png	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-80_altform-lightunplated.png	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Yahoo-Dark.scale-150.png	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSplashLogo.scale-125.png	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover_2x.png	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\sample-thumb.png	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ECLIPSE\PREVIEW.GIF	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Collections\contrast-white\SmallTile.scale-125_contrast-white.png	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNotePageMedTile.scale-150.png	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\bg2.jpg	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailAppList.scale-200.png	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-20.png	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\RTL\contrast-black\MedTile.scale-125.png	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\423x173\19.jpg	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarLogoExtensions.scale-256.png	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\ko-kr\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Outlook.scale-400.png	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\nl-nl\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AlarmsSplashScreen.contrast-white_scale-125.png	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageLargeTile.scale-200_contrast-black.png	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteNewNoteMedTile.scale-150.png	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-96_altform-lightunplated.png	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\2876_24x24x32.png	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\EmptyShare.scale-150.png	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\WinSxS\amd64_microsoft-windows-miracast-receiver-ext_31bf3856ad364e35_10.0.19041.746_none_e8163ddd769fa273\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..oothdesktophandlers_31bf3856ad364e35_10.0.19041.1_none_3e629b45e7b5bd96\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.19041.173_none_6486f23c2831aaf3\InputApp\InputApp\Assets\BadgeLogo.scale-150.png	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-wsp-spaces.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_89e2f789ae61932d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\23\header\Images\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-d..-japanese-lmprofile_31bf3856ad364e35_10.0.19041.844_none_26577970b5a6f858\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-network-eqos-snapin_31bf3856ad364e35_10.0.19041.1_none_264d560ebdcc1f85\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-cleanmgr_31bf3856ad364e35_10.0.19041.1266_none_e20a09e712bd275c\Disk Cleanup.lnk	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_32\MMCFxCommon\1d25d8b0bf637772f4ef5fc0a6ea4c1e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-p..talcontrolssettings_31bf3856ad364e35_10.0.19041.964_none_d1ce1ea46e50a943\MicrosoftFamily.scale-400_contrast-black.png	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-a..cationmodel-daxexec_31bf3856ad364e35_10.0.19041.153_none_9dac6c01b3f3e7d4\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-f..rant-heap.resources_31bf3856ad364e35_10.0.19041.1_en-us_c181cfb777f3d08d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-findstr.resources_31bf3856ad364e35_10.0.19041.1_de-de_2d150dc7af867985\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Net.NameResolution\v4.0_4.0.0.0__b03f5f7f11d50a3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-magnify.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_d5873d60ba1bbb08\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-media-audio_31bf3856ad364e35_10.0.19041.1266_none_5108d2722b4d8167\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\WinSxS\x86_microsoft-windows-m..cconf-exe.resources_31bf3856ad364e35_10.0.19041.1_es-es_c2e199849f487ef7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-keymgr_31bf3856ad364e35_10.0.19041.1_none_c6503cfca460b9a4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..ty-kerbclientshared_31bf3856ad364e35_10.0.19041.1288_none_56c05939711f0938\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-i..raries-servercommon_31bf3856ad364e35_10.0.19041.264_none_876d2c71ceefefbb\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_windows-shield-provider.resources_31bf3856ad364e35_10.0.19041.1_en-us_f6ab78659d84d90c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-p..st-common.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_59a7a6a76ca29db9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-iis-logginglibraries_31bf3856ad364e35_10.0.19041.1_none_cd218334697b3441\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-n..qos-pacer.resources_31bf3856ad364e35_10.0.19041.1_it-it_2de71ee47d307931\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-xbox-gipmanagement-component_31bf3856ad364e35_10.0.19041.844_none_c0e349333849b53f\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_windows-applicationmodel-clipboardserver_31bf3856ad364e35_10.0.19041.746_none_76cd36fa759df814\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\WinSxS\x86_microsoft-windows-d..tx-xinput.resources_31bf3856ad364e35_10.0.19041.1_en-us_5c1fa01464f50584\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\fonts\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-onecore-c..propsheet.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_e22d9be1120f7134\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-m..drivercompatibility_31bf3856ad364e35_10.0.19041.1_none_a1c96a9486a9c2ac\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-m..remote-provider-dll_31bf3856ad364e35_10.0.19041.1_none_5e15133d3ed2582b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-w..-installer-provider_31bf3856ad364e35_10.0.19041.844_none_0880636839022e5a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-m..ditevtlog.resources_31bf3856ad364e35_10.0.19041.1_it-it_9ca17aa0c364dacd\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-m..nt-browser.appxmain_31bf3856ad364e35_10.0.19041.844_none_d9eb415c5b9dbe4e\Square310x310Logo.scale-400.png	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-ui-shell-component_31bf3856ad364e35_10.0.19041.746_none_2b9acc2d69574796\RequestedDownloadsLargeCloudIcon.contrast-black_scale-150.png	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-ole-automation_31bf3856ad364e35_10.0.19041.985_none_a521e37e8ecb8aa3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.1266_none_777e4c5802d14c18\oobeprovisioningentry-main.html	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File opened for modification	C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\InputApp\Assets\StoreLogo.scale-400.png	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\23\dom\images\BreadcrumbScrollRightHover.png	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-activationclient_31bf3856ad364e35_10.0.19041.746_none_d8afe614e9b5f989\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-w..t-snapins.resources_31bf3856ad364e35_10.0.19041.1_de-de_e5e0fa2af98330d3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-wlan-dialog_31bf3856ad364e35_10.0.19041.746_none_eda7bfe24c7430da\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-wmiv2-miutils-dll_31bf3856ad364e35_10.0.19041.1_none_2135df93bd1c37f3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-smbhelperclasses_31bf3856ad364e35_10.0.19041.746_none_d28b1a9e6952881a\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-ui-xaml-maps.resources_31bf3856ad364e35_10.0.19041.1_es-es_f76ee2789fd2cf7a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-blb-cli-main_31bf3856ad364e35_10.0.19041.1202_none_c0150a0a443c0ffc\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-f..mutilityrefslibrary_31bf3856ad364e35_10.0.19041.1202_none_70b9022a044d0797\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-n..s-package.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_f49d608531e5995c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-secinit.resources_31bf3856ad364e35_10.0.19041.1_it-it_c9bb75eb338667c5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_dual_audioendpoint.inf_31bf3856ad364e35_10.0.19041.1_none_fe8f20ca00d33e2a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-i..iagnostic.resources_31bf3856ad364e35_10.0.19041.1_es-es_1feb084eb2a3418c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-t..nputpanel.resources_31bf3856ad364e35_10.0.19041.1_en-us_b30606e73c3e9798\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_netjme.inf.resources_31bf3856ad364e35_10.0.19041.1_de-de_024ea33f8bfc1c68\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.Resources\v4.0_10.0.0.0_ja_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_serviceinitiatedhealing-client_31bf3856ad364e35_10.0.19041.1288_none_91a5fb477b6af5a0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-rdc_31bf3856ad364e35_10.0.19041.1_none_677aa8682ff0a155\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-e..2provider.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_37344f8fdac62aa6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..tenanceservice-core_31bf3856ad364e35_10.0.19041.1202_none_44c81ab3ca6defc8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-o..ct-picker.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_bf46e2392224d34d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_monitor.inf.resources_31bf3856ad364e35_10.0.19041.1_es-es_04a52703f8f44eb1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-iis-websockets_31bf3856ad364e35_10.0.19041.1_none_708c3c1af3943b36\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-p..opeerpnrp.resources_31bf3856ad364e35_10.0.19041.1_it-it_e7ebc91c3e26cebb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\WinSxS\x86_microsoft-windows-m..-components-jettext_31bf3856ad364e35_10.0.19041.1_none_607a12958d667e45\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-n..ork-setup.resources_31bf3856ad364e35_10.0.19041.1_de-de_e9e512ba041868bf\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\EGPKZMQGRDBQZSH\shell\open	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\EGPKZMQGRDBQZSH\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\KYiWj5yFXd01P6p.exe"	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd\ = "EGPKZMQGRDBQZSH"	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\EGPKZMQGRDBQZSH\ = "CRYPTED!"	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\EGPKZMQGRDBQZSH\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\KYiWj5yFXd01P6p.exe,0"	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\EGPKZMQGRDBQZSH\shell\open\command	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\EGPKZMQGRDBQZSH	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\EGPKZMQGRDBQZSH\DefaultIcon	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\EGPKZMQGRDBQZSH\shell	b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b639ed6b63209bf0ab2a5b144f3fcd30_JaffaCakes118.exe"
1⤵
- Drops file in Drivers directory
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

aic_file_icons.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\aic_file_icons.png
Size 50KB
SHA256 94537fce208a84fb0c5e77d12af811a1cb698cfd57e0e7112ff40dd2c3e5f20d
MD5 d65d54f98e8eb235879550e82505a1e6
SHA1 cce984fd30d92219004c63da4fb4009ef5e03038
SHA512 9a4642fad3ca30d8dacd0f25bc6782c9ace4352b0ad93fdd8b8a350920e78c7a2ae59b52f765a96aac36f89f77c00796a94579baadefde9d7ac4448a0494f8dc
SSDEEP 1536:xmkwnw0lxRpZf13xag8NPjCvgXrGyBH7BcKnsPixYMyyd7KN3/D+xfx3pT:0NnwgxRpZdn8NPuvgXLDKNO
MD5 SHA1 SHA512 SSDEEP

Submit Download

selection-actions.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions.png
Size 1KB
SHA256 426349fd044aa1fb239f43347e610403f5feea4c22b8f99025add1c06025dba5
MD5 5fa1bdee6a9f8000b6a347cef16f76ed
SHA1 1fc30d5d1cb5591ae330308f7708e7d66f203488
SHA512 28070d69d94005551da0d6eec9ef17c05b0cdde885a4cf45590f72a10470f38830f2ef13f3604b379c5ccdc9b34d82ec17776aeff1ef1340c4dc6f9e6b85743a
MD5 SHA1 SHA512

Submit Download

selection-actions2x.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions2x.png
Size 3KB
SHA256 fa7f2130f1cbd6aa017d38c92bf32d86bf1c64aff6285b82b5d2724c50d9c92e
MD5 d2e00ca0c2975077757a2d5a97ad698e
SHA1 352f66d24a4a804e4ec9083b86f17f5bac30be31
SHA512 0d11fc92a8035deae9b0513cb16f45b0878129a14948b3841b84bb03f307ef61bb27b1a1ad060e15d6829596eb7eed47a10e5354c62fbae90188619a346f7c8c
MD5 SHA1 SHA512

Submit Download

example_icons.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons.png
Size 683B
SHA256 6dc16d0b0e61389bb03ab10d528768af663875a30f9857f4ae141f9e317b3af6
MD5 d4b72e97cd63864b10964a7e28bbd51c
SHA1 f28b81b85a345b4f0850b627d9fccd1b4b21c0bd
SHA512 002151531f7dc387494a73bfabc315db89d2774e5c9e00bf06eeb5ad7bac45831cbb82add7829a4e1a7c503ce6f6543fb91113f2ef522ac7e5570cc0817d8547
MD5 SHA1 SHA512

Submit Download

example_icons2x.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons2x.png
Size 1KB
SHA256 e10d4c56e497d3ca8a34f18315fbc53fbc64ee91abccb527246ad6db948d8b39
MD5 c55fe55297352f23ac37dd0577ad1180
SHA1 643e2972a72d523c63a9cc616beb6a7e18171243
SHA512 459fb7baad651d81064e9f0ea2b75848a7fa838195f169372b66e920ad8aefc764186dde28cb0429cc442dbde65201598e58dc4832155d1a92e55d162ed81ad9
MD5 SHA1 SHA512

Submit Download

rhp_world_icon.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon.png
Size 445B
SHA256 2d0ac2b07d0aa8456bed5986d4598ef0ce0c46088c757220a34eaa12ccc4dddb
MD5 5e320a7ff8f4f3cb0c824796a756fb72
SHA1 04c598502b4d35a4b1d85cadb7e4302ef659ffb6
SHA512 45b3766c192c846e6a8cb8f9c1556c0a72e0deb5e79b04fe228fcbd2e129e830f8f3b6dd1e17527097418504bfeca74cb89479107fef667e925727748aa9bc0e
MD5 SHA1 SHA512

Submit Download

rhp_world_icon_2x.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_2x.png
Size 611B
SHA256 c612900aa76872f35dc643029747a21ab5adaca9e13d9a9a05c08442d466179c
MD5 05c5943c83ea138f3aa029d25fb65825
SHA1 0fa44ac0464e2f75005caabc7482301816cf0b58
SHA512 149427703c45b51a4feaaeee887cc839e4f8979ee1f534ddcbe3ca3348a7f896692228b1fa2e114adacd8467db22a4dbddba8492dbce774e119b9de102f0724c
MD5 SHA1 SHA512

Submit Download

rhp_world_icon_hover.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover.png
Size 388B
SHA256 673a21e31091df4aadf8fec3f6c7d453288dd306fea3a70b9d5b967b0dfec8af
MD5 679462615f34ba5b34e59fd1238ba737
SHA1 6812f63fc218ce948c040f04794d9e8c386f2bb0
SHA512 bc674b91759950bde00fb84176417f4971e104088a2ffc7821d3b5400c7e55dcb9b832edb26f9fa66040e82abfddcd3ea3e297e2cea058262a15543e8db5eca5
MD5 SHA1 SHA512

Submit Download

rhp_world_icon_hover_2x.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover_2x.png
Size 552B
SHA256 835a8b580459fe1b19a9dc1efd7bbc6003086614b7048952948e6e6c4a41f31f
MD5 4c7e5c7bf7de4fbd4e4fde6d91b89649
SHA1 4a089c3843e5bbd8143de9b9df7babad2131cf9b
SHA512 0200bc6728252a5358511a87fcc70085caedc18f06b6968c3a2552304ab1ad5939572b1aea0a09282eee21dedb1effadcd84cf4c7276cc524ef66cffa0f9042a
MD5 SHA1 SHA512

Submit Download

rhp_world_icon.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon.png
Size 388B
SHA256 ff1f7b75b5a63dbc5e913ba45b8b1b22e7173443e357933fabfdd2519cfacf04
MD5 9ac8fd4c4a245353892cf13146eb41d6
SHA1 8753a5ac27cc1d62980f7f6b2f5e2f427155c3d6
SHA512 08be94c6a83681a5749f0f5582e012368c8884a829e06b861f6871c80b6529adf237c645fd9f02dbfbec09b6eedabe7e10dee129dd78ff362d7621c6ab37390d
MD5 SHA1 SHA512

Submit Download

rhp_world_icon_2x.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png
Size 552B
SHA256 7b66ece93a24b665af0263291782b3a8cd91e81fbdbd67c28bba5981b82351b8
MD5 c40c8520ca78dc42e3c0eefc2738ff7b
SHA1 c8a608fad3a0d82ec2a784d80c925d04ba433b1a
SHA512 a2b156997441defbbb802a88731d340260a3faccdd1ce7732ba897a51f63efeea8f35f40ab5750c07254f5dede83a690e99d90b1a5745f94f2ea942bcdf75958
MD5 SHA1 SHA512

Submit Download

rhp_world_icon_hover.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png
Size 388B
SHA256 187e82abb533f6f550c0fa8a888c254ff55a3994e2c55da10cfee71df3da655f
MD5 a96673054253eef1ea1c89ca58f45318
SHA1 54fb60f8f2ad1aac12550b517e5c92ef5070af05
SHA512 630c650f7c8786f255f5d3d46a418e2abf3275c55a6b0c8f877e4ed225f662f5ebb5b222a6a58887a67bdc4de32f9eaa77a78add0bc5cd8c8fcb205144c19878
MD5 SHA1 SHA512

Submit Download

rhp_world_icon_hover_2x.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover_2x.png
Size 552B
SHA256 ae500e1356059f5276b3a77df6591418506f0ed530fc0a20e8c35c62d0fcfe3c
MD5 010f950d261b03a8675cc73526ae8b61
SHA1 80a72230ca4a59a89d50c312549b698a5b3eda12
SHA512 ec609d152a010c00a104a1e1332c7f03862270290e70f0cb36d021ec651168cec14fa8d16928cd6d9676e926024fdac423c972426a1c76c26eaab664aad8d9da
MD5 SHA1 SHA512

Submit Download

icons.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons.png
Size 7KB
SHA256 5e1ae300a6b3b7fec798a9584e0a1d037ca3fd96e06d34cdde6bcd919a8ac686
MD5 bf59819bdaf990f29dc9f81e7dae60a1
SHA1 1343b014c737ebcc3525243b0bae38fbe3a3b4a4
SHA512 4d0c5d36725f7651be648a4ee5d8c3d5fc6e364595134dbbb96c5f198e28b14e25c0fb0156a8593affc7f222adda54140e2315b7dec841f720c3b5e683661733
SSDEEP 192:SG91kco7PJAJdLmAtKicM0M5qPfCSWT+1RHRTp/hn398Fkm/J:SE1kcWP8cM0l3CL6RxTdp98FV/J
MD5 SHA1 SHA512 SSDEEP

Submit Download

icons_ie8.gif

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_ie8.gif
Size 7KB
SHA256 15a8e64a6a887833d8fcf56ac26d62122d4b290b2ad547037665d639fe73ed01
MD5 4aa2671ec8a7a5f739a8968495eb78cf
SHA1 6aa181397afee807a68053a37be954299e9a1b92
SHA512 c2ba77445c90f89d321292ebdf5e4c369c99a2d68fea14a853bd6b78c51247d7350509cbb58d16473a106a378c274f18424b0f3384ab8728ed01c6a0fd76cca7
SSDEEP 192:RxfCbDr+U66hjjmJ/9+ZXtmuPNcHS62Y6qQdrjfwJK4tm:/qbDrPhjjP95NfvqQhfwU4tm
MD5 SHA1 SHA512 SSDEEP

Submit Download

icons_retina.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_retina.png
Size 15KB
SHA256 06f7044a312a8cc20d7f394097df5390a4ef4c36f4b4ca6e56babdc8ced748be
MD5 0af11e6514152dda6d9ecc764b0bb112
SHA1 e7bd04c6d83a4c952b39b4ba3d9711b15b8e0c00
SHA512 66013d8f49e50b583b1790ff247d4735b146f5bcfeb41ef20e77b7eed4d632cf55240f8d1bb8b7a18e81fd016b6f2b494ef58b9ecb6b5ff85283587810dda8c4
SSDEEP 192:SOvJ3o6yHcJzX5+AHpxAjjLiT7u/YJgAm3T/+2ZoPjkVic5mqpmpLrm/:p8AHpHkogAmj/+2ZKjks64W/
MD5 SHA1 SHA512 SSDEEP

Submit Download

new_icons.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons.png
Size 8KB
SHA256 6baac410b211e5f8b7b6147cb899a15236094bb5e2fbcdaa6f0dd374cb81b75a
MD5 aa55ebc904e5f5a5fd44375431582788
SHA1 d37154a6ed3b37729ce7e105bb5b853ad558dfd1
SHA512 14ed1eba5e91f63c89225a0c9605a2910753a4b64357fad51c1fd87ec6e572f40e325cd2f6c1e09ca9c3243d0d5adc2cfe9d6e90dd0ab24707a1c8d6f5248105
SSDEEP 192:zacAdJK+3+RVlD6mTJzG0Z4bU3/TQ3zSGGL:zacAdJKCEPV4wU27L
MD5 SHA1 SHA512 SSDEEP

Submit Download

new_icons_retina.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons_retina.png
Size 17KB
SHA256 f40fbe5268fbead2949e7f095b4e33a46cce9c2105aec1dbba627b0d97518a6d
MD5 05a8b88b36fb5b6e5116707a597c499f
SHA1 2e3084d2c4209da9bb35c0ea0603edb6b4eeb452
SHA512 45f78dd831fad878825f027329edbbc94884a62af97732498194dbe0d6027b0445a873b855c083ae5ed20fe0b3f389ddffd719c619534c3c07e45d99e70fd230
SSDEEP 384:zlsHsIC5Y/Igjm5Oy6wH3pgMEU7dK9kGJB3DagXLfHREagImTH8fsd:BKBC5Y/Ig65OBwXiPU7dvh0LGadmTc2
MD5 SHA1 SHA512 SSDEEP

Submit Download

bg_pattern_RHP.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_pattern_RHP.png
Size 179B
SHA256 50bca4529b1268fad836feb2c6c8dd9095acf5fcb9de412c6bec7bde3d102d02
MD5 f10c4945dff4e2f3cf9380584c869280
SHA1 48747ea2bff757fd235e3601b09a9a09153aecad
SHA512 f939c2c6c91d54273057399e2063b3ef86dea3a73e3fd675c3b09fa2e77370f0420b9b8a265ba79f081e9ac19807a5804e7d6d6e8ae17a933cc35f8966fa21ea
MD5 SHA1 SHA512

Submit Download

bg_patterns_header.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_patterns_header.png
Size 703B
SHA256 8622348bf084a09f2f46a8fa79c9c3546b0346d861fd3da8d5861c4bc799c953
MD5 526603807c853ab6afc8493110f30fb0
SHA1 516cf196685ba646c6c8ee1aba6c1a8241544b21
SHA512 b224eef87b0601d965b5181ff174965f05150881a701c1a92ea20f5e7d2fcfbfb6a6100334927b41c4af3c67109353e6b46a026dbc23c0ae80f7dbf8b5e50dbe
MD5 SHA1 SHA512

Submit Download

illustrations.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations.png
Size 8KB
SHA256 12df0009168235b38cdaf4a978087dc5cdaaf972cd29fd54bff0e3d523ca681a
MD5 d4d26e0293b9717bbd3cb77be8aec87d
SHA1 c2ac29f28db998aee9b59002a1dc1643f51eb0f7
SHA512 b03df6615985cb4ef787884efcba0faffd1d3bbb8d48a74dfc7c5bac78de1a6086d8b2c19d94b544441420aa0a48f2858fa55b8ab9fe5dc3619560386a0a5311
SSDEEP 192:5eIXkjfuOswp+3Dc2PD8NshfeBZLBvwwlCbgEAzh7zxdt0cDQ0uNw:XXkKOCrThfoNtlogzh7zWc80mw
MD5 SHA1 SHA512 SSDEEP

Submit Download

illustrations_retina.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations_retina.png
Size 19KB
SHA256 49b6cd748c10e6437dccbe9f1cc080fb9632dfb7ae1aa6706ec9b8aaf12dcdde
MD5 494801992617b179527c7ad905c77823
SHA1 d87c3bcbfe61d8abc1b4798237db4aa469154ffa
SHA512 5705a493a9cce26db8deb6581a1b4bdb562dfe3d735d436c36c83ddf06cfb5421653d88447a410638def5f01d8ce92b1a316419686cab63bdfddfd0648b4b144
SSDEEP 384:u1oi2TdXE5zweEHV2WGgdjvowqguRDetYNBOjMvcL2681ovN4qmiFq9q9qri:u1oi2hXUVEHV2IHqgus2IjM0SrANnmq
MD5 SHA1 SHA512 SSDEEP

Submit Download

faf_icons.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\faf_icons.png
Size 6KB
SHA256 176cae6ec83c8022be263f610074d136ccadbecba8d2e7dab2b5c20a36156abf
MD5 617792ebac4447fee64807aeae4aee60
SHA1 4c69f7d73498ed4a665c10ccdb36f5c85781ae58
SHA512 07e16b53940289b911cafec4044bb5ed07e6b1773bf6a95cd5268b887ebc4a251b0734527d2db5a9134a10aff93d621ef3b08d4162006df349b98f5c62264240
SSDEEP 96:ENItg275OWInK2ytOn2vbbciPOOOOOQB2hIsauwCU2iGQDOOOOOqctqWLRcOc:LV7DrtjbIiR0hIJ25QKpY
MD5 SHA1 SHA512 SSDEEP

Submit Download

bun.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\bun.png
Size 2KB
SHA256 824aa42d6d73a7a89fb6308e34719d420e92168650475a8748b91fcf66b8c676
MD5 045cd635e6e372a624de76172464d19c
SHA1 8d1caf8e572be690617480944d3b7317f86f1489
SHA512 680a1f62719ac46830b529d5f695de458e67791e87473cb77100a957125591ed8db6df7af7be5f4ab8e7305d0799982a52d3f90eb80e4a8004ce3415d46b6409
MD5 SHA1 SHA512

Submit Download

cstm_brand_preview.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview.png
Size 2KB
SHA256 71679be4b3cda15009966fa7ef004b557b2c6e9e0f0baafed9f4a72d9e3afe71
MD5 938e4a30075ee0863b52e52dc8b3e83e
SHA1 80fdf2d4d820651705aa3e92f958b7ba8d03599a
SHA512 916b29b9eefda5d592a1b31635ffea5901d8a50dc6c6e8c0d92306e9e58fee65e774779b2a047671d4e334b9a69cfa60017867ec7a07e25c13d5179616e17e03
MD5 SHA1 SHA512

Submit Download

cstm_brand_preview2x.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview2x.png
Size 4KB
SHA256 05a7edbbbb4a29e6db9c0f70ca2248e1cfa5a4e689b82f76f71aa66b2f9f8f4b
MD5 efdb15070097a0f6763f9d8cf2cba347
SHA1 f2f1d561e596a26078c9feb5fe839852c5f1dc77
SHA512 acd257db865b6e5194dc50f2aa3af4c90de7219824e8ac509b5d5feb00b730b14f30b1845712d83fc1516201583457d1276be7ad3ec6cb2e6acb7cbe2d952e23
SSDEEP 96:hAIEvx/FVFSPeTeMifXXeh43InSyOTdvLobU8TSZGOH:hy1PWTnfiSPvLou7H
MD5 SHA1 SHA512 SSDEEP

Submit Download

dd_arrow_small.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small.png
Size 289B
SHA256 6c3de54bb848d2ca67d172d381d3ffa7fff60fd982b019532e6d9f0886fb612c
MD5 5c1b8265f8602cd1edc9fe5ae7b98ee6
SHA1 a8a64bb9bf0f93fc4cc36754b79597e41f6b1d73
SHA512 3353c81cff709df5e2a103c441a7b12f05bb85ea9a9320862ffd3fae92f180f31c02b7b1f5d598a36bd112fc889d16eedd2db69ccfd328688cbc5e4095e35387
MD5 SHA1 SHA512

Submit Download

dd_arrow_small2x.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small2x.png
Size 385B
SHA256 f6c173f531190fe3aab89154639111f3897a6d1fda4bbda18a391a6177f081f3
MD5 b861d6734878db9906903a396592d63d
SHA1 2d8e5ea9f00d9073c69de9e5b935c030f368b9f3
SHA512 535fd478870d0a89731153b4ecd9ff4e1d00d0b252315e18df3101c48fbea05f101c1a2623a731a33c9a7b0bee539976b789e121f07483616bcfe01b2000b762
MD5 SHA1 SHA512

Submit Download

illustrations.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\illustrations.png
Size 4KB
SHA256 30556f35e2cff1a3d04173c240f5b439473d4e62812430c2caa301aa9feaa390
MD5 33007f3e25f43c986f9756d3e3d82214
SHA1 7d488958e633cbe4ba1c1cb2646db2b3dd689922
SHA512 728b68be74668578b0389aca3f31de35f0d2462c6547ddff54b7cb151537f45bf084c8e336eb8a7dd7a4a097e01bdbbebcff9568a48026a352e0443c3e0ee1d5
SSDEEP 96:fIgzECn4pjx+jOfxklNCah/llAvxxsR/orJ+Ykau04J6sR/Jbwes2fRCz8:ggnIjx+yklNJh/lup6PY80w6Ktw6fR48
MD5 SHA1 SHA512 SSDEEP

Submit Download

nub.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\nub.png
Size 1003B
SHA256 ecbd78868d45d71a10e116b7f1a741601fb9a01b80e5e0d5064bf69b39d393c5
MD5 9799ea1a799657be154ec755af9dab07
SHA1 ed4b39b4d36b8c6724e0c8987b2a9c33a636807e
SHA512 229230f45e1db869ccec57621aa5fb32a242ad1bd63f50aaf08b46fdcd3e46f1365a857f61ce9f73c547055ec52aacc941fd9ba0f0ba6b79bbafdb384b3c2345
MD5 SHA1 SHA512

Submit Download

share_icons.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons.png
Size 1KB
SHA256 bc98492fc614337331799e6c1468801698353a0e8ae8f8f2a48ce1819bdfb0fc
MD5 6153bcb2e83dc5c66442a9faa1d0ef1d
SHA1 30983f8d306e458057a5708880a42f8d9c9be917
SHA512 709333107fd9ec0563791a109e40ac18978a126b8bc90dfa6ff7a6274d117cee377af31167c22d46cc6f545fd0ed093358e499dd540d1309ab76fcc60e545b3d
MD5 SHA1 SHA512

Submit Download

share_icons2x.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons2x.png
Size 2KB
SHA256 691c2456774cd8c9f7ffbae2c20756b96a9c56a82cecca6640a690daa0aba36c
MD5 d88325d98c2e77134c3d7cf7fc0910de
SHA1 f28b570cf3fccc7514e79b5b68b0ab982edee937
SHA512 21a830fb2df7b172faf8b299f81c584929c8cd2b904fc198d2f150ade5c28e166589829399181e88c482d4b6e0dffbe6b6e7342cc281eecc16aa1679010e3c6c
MD5 SHA1 SHA512

Submit Download

adc_logo.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adc_logo.png
Size 3KB
SHA256 a54197b1b6152ce8ae269a7cc95138c6b2de71321f48fdcf032403a0dce1b971
MD5 a064a5db769dada413e9b16d4704105a
SHA1 3d2747f487854119eb0f655ea960696beb084ec2
SHA512 87b5d0764b95cbfbf28e5d927aa04f7088d23c2512e762b144b9d5e4585b788fcc17989ad0abc0b34f664cc76a9254351fd589cc9bcbd80e07b0200d51d35672
MD5 SHA1 SHA512

Submit Download

adobe_spinner.gif

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adobe_spinner.gif
Size 556B
SHA256 6f32ec39b32499416266a0ee1f75b970f02dcf69cbc2ae23e754f8fb2c26cc42
MD5 4b1f1073d1e85a35a766b42a28d44a8b
SHA1 435fab273c952a08abe4b01e9375e1a3eed38e06
SHA512 ead57c953cdd4f2902dfc5589939c432d0a82a0c092b9274a7a246e25a0819a35b4996cf3ad02669bd8716444ed0aa5b2d8afd295155030abdfa6fff04e1f599
MD5 SHA1 SHA512

Submit Download

logo_retina.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\logo_retina.png
Size 6KB
SHA256 4c80a4a6bd3a1a8242afdc0083c9734fca4358a0e7bbcf7db41a2df90a2ac87e
MD5 78be5353f5f594487b901035b472b268
SHA1 a2a5e92034c4d50ab47cb1d7df609d2863213fd3
SHA512 bd836656d1a054c081c023695e7a63fbd5ffca282f78bfefb7059d9404470cf3c16ce809ed7757e05bd2e0226648d4e8c7fd25caf860cfbbf995d38913a4df4a
SSDEEP 192:Cj/uZDIbvJIFkLerUq/WgaDOf81Byw1ge+9:C7HTJUZugdGBywix
MD5 SHA1 SHA512 SSDEEP

Submit Download

sat_logo.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo.png
Size 826B
SHA256 9baba575e88a00e4664d649dc07b279dc70ca06b098f3036d5a309ea5f177eed
MD5 b7476582017c67d4855146eae80eb507
SHA1 a4094bb060b6b90c7d6ca53808602c196d343686
SHA512 9656ff9d11c25781bc714f9223425b245774d9a3269f56640077c2e2c22f01ce0ffe39f4748c9b7a69678a31f75e4ebdf1ce67bdde6810dc917fcfa08a7e9d89
MD5 SHA1 SHA512

Submit Download

sat_logo_2x.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo_2x.png
Size 1KB
SHA256 15e9ed49c17def52748ce3b3b5705ecec6684bb9995cef7c2c4a2562f3768073
MD5 94af0e31d7e5dcbd9160d2ddbd822b21
SHA1 cebd67e9ed7c47cfea7f1572f9017324f805060d
SHA512 6c6706b6e4d323554033ce5c9bebed2c62e22206a775cb0e0f89be959c2152a0d09062dbb0bbf32f345afa8516c24439b7da915ff2b4f7201c74e58ffb7e54a4
MD5 SHA1 SHA512

Submit Download

DisplayLanguageNames.en_GB_EURO.txt

Path C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB_EURO.txt
Size 32KB
SHA256 ddc27f07a57287e219a78475e3e0bc150ff5237214f2a3529e2345d4b23565a5
MD5 59616ad5226c1ad7eff6e3a70385587b
SHA1 925d5703602f2c2be574a0a233ea5fd3d75cdb2b
SHA512 51e8b3d5512ed20c74676ffc4c1ff7b83c87f50139987cd7675a6b8579ebed179f96209ef33a140a058fb330775c01727f64858def09a64c8d999c4db6da76f6
SSDEEP 768:gSuSkMPNTMQI3mfmfKnjFc4Nz8M6f0uMYbMcjxMD2q46H/:HrKgBesJ6c/YS5
MD5 SHA1 SHA512 SSDEEP

Submit Download

ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt

Path C:\Program Files\7-Zip\Lang\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt
Size 299B
SHA256 b0ab3473bb61bf150b9112814c51895be2cdc6284a1a0f9e8c04ab62367755a6
MD5 b28829aa51a24c0452689df2364c7430
SHA1 1765a7cdd572757ec40616946ec022e75ca77c7e
SHA512 57e6c8f60dbe1c0e2124f918bff16c5b9809be0163cc646f86336f612fc087e70f300e3c80bc3ce2f81c00037cf1bf47ac24f2172110e1b20cb104a645f1caff
MD5 SHA1 SHA512

Submit Download

win32_MoveNoDrop32x32.gif

Path C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif
Size 153B
SHA256 8b46f27c26058882537eb34553d3d54c7a8c31c960286c16c95b6d90fa81aeee
MD5 c41678dd684bf06e53a6245b53968128
SHA1 2a027bf562fec840a1254e9ba4c48029ac7879ba
SHA512 31016a9419edd42cc14d1f4e002380ac65c6d686e62ded7ad1e61dd507ef81930ccd2946f3bb54d0b2de16722e6b707043cc7fa8cc4f7b9aba93ad0f6c92de9d
MD5 SHA1 SHA512

Submit Download

THIRDPARTYLICENSEREADME-JAVAFX.txt

Path C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt
Size 190B
SHA256 d25afd5673543fe366e41e0fb9266cb19273d69376166c34333b61eb92496e76
MD5 9bfa586b05c289e4bd89fd6187b97477
SHA1 bd1ac61ea3280670dfbc7e128cd8c960dee92aaa
SHA512 60b7a6ee279ad5058fcc924fdaa76bf2ca4637e394edfe2ef3ce28f14ae2d051de804ef3fe520a12a0d7a3e9d406843c47a236806e1eda97250acafdf1085f86
MD5 SHA1 SHA512

Submit Download

THIRDPARTYLICENSEREADME.txt

Path C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt
Size 190B
SHA256 9f0cb784ef48ad2ce4107b5d052c34d9fc3a3d30a64d3949bd1ec36691236472
MD5 7b0928fd776037983263908b7a28bab9
SHA1 c99bdb01cde5281e2b4e0edeae59c6259305e451
SHA512 ac093364743078e35033fa5b373d778110777774ef13151a81e8ca2b7f412961542b6cf2ce704c6062c9f3093ed0d283f1bdd375e04423f68a3ef74950497211
MD5 SHA1 SHA512

Submit Download

directshow.md

Path C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md
Size 1KB
SHA256 c5a87dd949287ac9a6752ecd5cc43ce6fcac11a2a5b91a7cd24c828cd41bbb8e
MD5 1dcfc3fa961184bb7a78e0cfcf1f0e87
SHA1 7e89cc6f800cb7365a4162f78652c33e0ffa0be7
SHA512 e128a2838de2283cadd59a8445acf17f909818502817be2ed94db5620942a8e1ea3a16f7ee3dbce6d201798be6aa8dbb543c8946512a2470bb9de1009c8bc2c0
MD5 SHA1 SHA512

Submit Download

glib.md

Path C:\Program Files\Java\jre-1.8\legal\javafx\glib.md
Size 31KB
SHA256 3a6d61b276a3724e929ab2140f4c2fc435ce9f4552840aa857e4c7dbcb562d5d
MD5 cd69f12ff5ab2aae7cbc52fe67348c74
SHA1 b9b745eeb3c0f44b7cba3e374a7750ad83b2d0f8
SHA512 ff4cb13a4af948cc2051091e5b15ab9d0fbf38b1328451eff661117cbc470d4d24bd013800a0a98dedabd81cae14f37cb264dac1cea77952d2915f197b9a2836
SSDEEP 768:4GDZhL97uDU80ylhulp9Y5Czuxc0x9js4xxozKALPG3j:jDBl8wL9YUzu2YXHpALPG3j
MD5 SHA1 SHA512 SSDEEP

Submit Download

gstreamer.md

Path C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md
Size 34KB
SHA256 824ab515be1c643cf15c4067883a471795e6ec1b15c1b187dc7ed4093018845c
MD5 2b2fb3cbb3c4a44e4fe076e0dfa8d833
SHA1 0f6a768c780998d33e36647b823436608de4ab00
SHA512 cfb5a8b956ec5c37b3787da6a553cd18f4b65a3a1610a2725ba0e92ed2c4dfd84da2da3b923cb62fce54f3fc6c8dd35ca3b432e975de3db9b787069a4eef26bf
SSDEEP 768:t63j82LipztL97uDU80ylhulp9Y5Czuxc0x9js4xxozKALp3WXrCDp:Mjr6l8wL9YUzu2YXHpALpmYp
MD5 SHA1 SHA512 SSDEEP

Submit Download

icu_web.md

Path C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md
Size 23KB
SHA256 6a762938542548c9ab4feee67a1c661553dbe7f214361e28849f5bfc486136ff
MD5 18deb01769cd0d87038d6b11205dbb00
SHA1 fe8cecd94d6c641b95744429875ce7c5bb370fbe
SHA512 84aef2c7b8f9017dbbfd61b79cc6aa359357053b5560bf43cb6a8774b25b0838f75b563482a035725571c1ac3a47d7df9fda001114554e11fb0bce10195ec0e0
SSDEEP 384:IQFCHWCgOwkCtOZpuraV3xaLRLMQZJjNbQoWE0nLMIW/VDAA+39nVF9h5Iqo1v6L:vFC2hkCtWs+cRLMmDkokzW/VDl+39f9B
MD5 SHA1 SHA512 SSDEEP

Submit Download

jpeg_fx.md

Path C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md
Size 2KB
SHA256 756473d5a2641f5e6501ebafcebedbb1eac88361e178b8185888f8940265d1d3
MD5 3e9eb6791a16d9fcbbde27330f810360
SHA1 ffcfa429f3d71274f2e318b15270cbf1a7c61faf
SHA512 ba98461664ec0f20e92056a86c322b1c5cb0ef00046cfc4a64230f74ab9b71474bbc928d356fab322a2c6d7cc96d2067557bdea29b13d0160cca2a6e41e47191
MD5 SHA1 SHA512

Submit Download

libffi.md

Path C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md
Size 1KB
SHA256 1682f8400f94640bb31da0ea6ebba53dcc12a0cf1b06283fe87b240ee1814890
MD5 e21a69c25feb81b9b909ea133f34bed8
SHA1 c7c99781bce576649a384dbe2c6abc46bb82b07e
SHA512 148e7dab7c5d2228a5fcba47c55a10ad1d211e2608475c64baba9a0aff8e2e6abe3f630935f2b09b22ab63168e510f514fac0f414e9d3885b971ad3b9e355c8d
MD5 SHA1 SHA512

Submit Download

libxml2.md

Path C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md
Size 3KB
SHA256 aa5559c38de91859f0f52a915c5cb7e5034ecaecc7e8577cf6bab50e03a16574
MD5 0979ec92e3f17b172df8903bb7424211
SHA1 fb1c8aeea1f06598124d4a778d96f444ae4d9e28
SHA512 aefa34186589417db3925d2461f9615e28f20b5eec7a6c9e380cc682482ed313bf222733ca644dff8f7fc00335b76ef69c63cafb48f634622aebde6efe677057
MD5 SHA1 SHA512

Submit Download

libxslt.md

Path C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md
Size 2KB
SHA256 968bb45bd5519b043a0b691914df11ed3e9e88b581836602da4bccd212feedaa
MD5 41c052088431367430fa2b583b04e008
SHA1 0339347db80eb27d378bc40b6195036a8a46f4ff
SHA512 c259eb7f2e342b2ae321141c31f77f83ded3515c4c732f49462be9c94f647a18e5a68a33cd8f5b959213a5c0273c8b31e466afa72e49409d761527593a55644e
MD5 SHA1 SHA512

Submit Download

mesa3d.md

Path C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md
Size 5KB
SHA256 99d29f97a9230f03be8de5f79ff3d96141664abf9478620811635013437674db
MD5 d35bcf86f09ec70e759a1fb71efc60c7
SHA1 83198bc523a13794387737d0062fd92c3a94c782
SHA512 f7dd9f3d6937dc74a4176a0b3212e4c7e64007cac9f9280b6328c4bb1285443fa5fc326ceb07c6829ef2e0f756b1021755503343a64279b001e2871756d851b2
SSDEEP 96:jiHXmhvJmBTx+gYn1dV/wLQuiOyFs/IFp1lqKZW7chIXI3K4pR8Co:j+ggBTIgg1PwLTiOOV1ltW7cw478T
MD5 SHA1 SHA512 SSDEEP

Submit Download

public_suffix.md

Path C:\Program Files\Java\jre-1.8\legal\javafx\public_suffix.md
Size 17KB
SHA256 027c46bee3bb3df267a7bb5e03fabd0af97206db5072466a54f2581c5c58afad
MD5 74a6571cec5571c8e23bc258af4af803
SHA1 d2ade6e6f341a975c3138927d44ab584135d707e
SHA512 14e20ac20330143a1074409e4191674f0f933031c953d72b8cf617b296bba78b92b0d28c831b7cffeea5d4da7cad305af9c21cee2c99601244516897c98e5181
SSDEEP 384:gMEf6dbWo4PaUAi0qQa+Q9YToHLtGrde8zw5iYe:gMEfqBkNJEkHBGxEiYe
MD5 SHA1 SHA512 SSDEEP

Submit Download

webkit.md

Path C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md
Size 320KB
SHA256 32453cc3a871d7325065688d1f158b820c871adceb7034551f9ee3bb6fc57626
MD5 164f23ca48a11840aeb1c5d1f2f68360
SHA1 b5cf4aea2a363e2f76822a25667798d076274ad7
SHA512 9561ed3686784c55ebc6a1b970599c7311e0d0911b0f2724985517dbb62d5946205fbc916c828e8e2eaaba743e115f6152abc9c19d9ed7267e828f169c16254b
SSDEEP 3072:TroA0bS3eTwTlvLARDLUoCiynPVutnsZflWv0NYdAP1NYhEAFSvmu2:TDufTIpEDwnP6nYUWYdAP1NYhfFSvm7
MD5 SHA1 SHA512 SSDEEP

Submit Download

asm.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\asm.md
Size 1KB
SHA256 88ef31b9a2d40738be672cd58d66a303154aace464a9fa0afba5334d83e0640d
MD5 116305eaf305b60931be52ac7012221a
SHA1 5dfc3f783c6823ab0fd240fbf92b8b347cc1e02f
SHA512 66684d982583780bace6a283fafa332dd90b41e09eacdc434d94bf664e20b98ea2519e1bbf7addaffecc45f3eae83a2b77545f458de107ef8e75799eaa6e79de
MD5 SHA1 SHA512

Submit Download

bcel.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md
Size 10KB
SHA256 8f0ea4bc855d969f458a86ea4cc46a3850ac7220145cab59355a0047c4666407
MD5 91d77ab9c693803647adca4d6b666eb3
SHA1 4c95449b0ab58044b4b49d2238b261b5bd5f29e2
SHA512 7c2e0a1588cca1d8235b6cda7d556494ff2c290523363507514aefb030e2f99c2ffb3097aaa7b5739df0d8fca12306fd5e656744bc281d376cb9cd43ce0e0c43
SSDEEP 192:osco8GdEopM8iXlUk9gK7go+aseNomP25cb7ss/v48wDfWogkP5rZbaholX79:oi8mnKv9frh25cPss/vFYfRn5rZ+ho3
MD5 SHA1 SHA512 SSDEEP

Submit Download

cldr.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md
Size 3KB
SHA256 c31f703329249d2f3e4745638864b1f06866b97db2e76a1ab1b1166cc3624e5d
MD5 7749c8f18bc81f0fc5aed71cb645bd2f
SHA1 3964eb5c505e97069090f8ea765bb7186c77d8c4
SHA512 4e0781451b101e867fcce7142b96cd6dab81f7323fc09bd693bb297b347198aa027dd01fb88884bee9b225cfd5448e7319698625a41dd0349aebc32582f08b33
MD5 SHA1 SHA512

Submit Download

colorimaging.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md
Size 162B
SHA256 1917826ad226c47fba3d735b6558dbd6f9026c3badbbb5a394d49709d088930d
MD5 9a54ef67551e6071fbf294efe8ed21c8
SHA1 e1c675797de1fef5ee5d25148fb33e36b954f1cb
SHA512 373630ca5952475cbd6853ce8c41c0206ac4da674750ab9ea5912537e66b0241e4eec4110ff4864cfbcc940bd9c6532919ffd45151ec09cd0b42a4a0c80974a0
MD5 SHA1 SHA512

Submit Download

cryptix.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md
Size 1KB
SHA256 0a7886f6cc5dedb8cb57b1d43e1e0950c5b3d53e380e16f1ef2487c9371d9387
MD5 da0899df0fb11c125d3928029344ae00
SHA1 feb609e9bf51cba79370b623e59c32fe1c21adc3
SHA512 4f437bc9bf46b2a5fdb597cb31f53216ed8fdd20bd2bfd5d60677ebf4f3b8d7459ed320fd04c8be9a5d3fe1369312242782d304e56e87c89b59b160c9ea0bcc6
MD5 SHA1 SHA512

Submit Download

dom.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\dom.md
Size 3KB
SHA256 4cc7f51fbdc1ee34a95f34ff7ca4a9a29214d073baddf66efeafc123e8153612
MD5 a435cb0138c40f7d932b83f6fda2eae0
SHA1 801f74b06ed80615322cb834a47db84a37d449a2
SHA512 07655fa2313a952ac3f4265ac431f0f1cd0315facadd17038e2e79cec016ddcf8ac5c2b2d37c7b2cba92a626eb31e980813a57a46afcbf624e19db12d016edaa
MD5 SHA1 SHA512

Submit Download

dynalink.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md
Size 1KB
SHA256 adc70bb18ede2e05ddbe6b80b15683b124e921dcee9d5d5be75b083d37556f6e
MD5 fb6b12b130573b1788ae99bb4f67a9e9
SHA1 5d1891dd4d9617280bebc586b708324724740ada
SHA512 ff5cf7b41020cebbab191b4c6487483c211078293bc0433be679c61feae1fc5fa3b56cc1bb74bf1c5efc854a1b62e51b0e1b6d69f0e4cc124e3b5c87657876c9
MD5 SHA1 SHA512

Submit Download

ecc.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md
Size 28KB
SHA256 3024dd9f170889348674624815224a7bf1305884abcbaf4466eef24ee59c95b0
MD5 a86261513de1611de0069ad26580a15b
SHA1 7c91810441b11888a2e09689fb6159410041536a
SHA512 2741750af64971aef230797b680c4c461fab7101635f25145813d56255d8a6f120d1251399b4f5c9508adc518455b0ffe916ecbed22827be50bac211c76dd55a
SSDEEP 384:fwkJkn45I8RlPn7RzRw4zQCkURwjMRIb+817DRaGRkz5vtqi6IgP+lJch+0IGL:fbS9a1O+aM617kGRkzNJMt+0F
MD5 SHA1 SHA512 SSDEEP

Submit Download

freebxml.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md
Size 2KB
SHA256 b101831e3ea455cff2fd22c23d901fc5641baf945f0ae04f6811c59dd79febce
MD5 23945b49eafa249c396070f96c11bdfa
SHA1 bc1b463a618c92d931b63f944d5a784f06c442ea
SHA512 bed99a82c86305e787d2dc9b41e408d5b92d1a23a0170137a0787960d07fa1327094475bf2b0023d4c0d7982c45cba1debe4d4583f28f7b4932bc23358aa5e14
MD5 SHA1 SHA512

Submit Download

giflib.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md
Size 1KB
SHA256 7e0a463fbf9169f66cb6238a26984a4f49f335fadb863406e770bc7ae3111097
MD5 2b902c14b1638a0d1ddd0fd6ae951e80
SHA1 06adeeca63f5e3a06f82258ffe92dd7dde47a33c
SHA512 58462a36396ad46542239ffc9f53af098abc5c7eb0715aa845b6ba93a8c17f4e96024d4d2d3eafd46842b1ec2ac5e367bad6c45291a392171ba524487215c119
MD5 SHA1 SHA512

Submit Download

icu.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\icu.md
Size 2KB
SHA256 07addd7103d76b2bccbd40149adb8f69bab18c20032f35fe0614d5ffd4c06b7e
MD5 73c669e39144a92428111637a6919718
SHA1 7744b177d3153a32240180166c7e01b55b30b4e3
SHA512 577deed428d3099029977b74d8658534221d7efb63725975988876cc16ad6ff8f931305061ae56992e08e96164d99868500013f184e3f965f1bc2b4c5f7bacb4
MD5 SHA1 SHA512

Submit Download

jcup.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md
Size 1KB
SHA256 197bdb2ddf1f64b26d420083c3df4f47a0bbbe496507292df98b68ab445d4d74
MD5 37140374ea72adf361b938e13539ff70
SHA1 4123bf1bd4de7fcb31a830088783c3ea28e1855c
SHA512 f5122dc67d1fc2ebfe7938d9dedfa71d1e5b4bb28103521bc73919eb395f6c55e1556236663ae4a31a4e7953ee6aac0746e858cf2b61fe4662c8e63775fe97a5
MD5 SHA1 SHA512

Submit Download

joni.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\joni.md
Size 1KB
SHA256 ea762162db04a8e79e8fd6269437c7e43d2c24d8880985fdaa6df3696b96945b
MD5 524f4f3c90223125a934c140db1bd4cb
SHA1 2507c31306a394855a360d4294a17c02a8c3bc5c
SHA512 1324547fdd48147f3cef7f220b6cba4d81365ce944229d26db3aec08e0ee372882582331ed1593a1d71e2cb0fa60e8b3ec33e152c8ec2577046e2409705e5b16
MD5 SHA1 SHA512

Submit Download

jopt-simple.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md
Size 1KB
SHA256 10a29752df987a575136706bcef9bf62e6a64f84fcd56357678948c1d68b50dd
MD5 97c3e335b6c2472214a54bd30ee7780b
SHA1 17925c26a031df90bcfa112603775df23f737a01
SHA512 a2de61c278e68bc6db0055cadd6da58f79c23913d444ef12791a104d3c4c38eafc8d3cd73b7f2bccb79b214a67db1f334ee4b24d94c06196611b8963f59452ab
MD5 SHA1 SHA512

Submit Download

jpeg.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md
Size 3KB
SHA256 60812dc3ea69adf7a5f82481b818bdf834e9b866978af5c9e60ecc1ae81a75f2
MD5 b077876cd032788fd466b9d3a792c0ca
SHA1 870d7f547efb8ad14d9e163da6eb174fae77ae62
SHA512 5401fca236e898eab784f0a0ec28c71e8d929fe3d237574b6254ab110ac672a3b12f8d14bbc1a102a99a903a1d02b2fb1304c7fe9cf3b35ff26ececda3370593
MD5 SHA1 SHA512

Submit Download

lcms.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md
Size 2KB
SHA256 5b839013c1bc2a4a24f4e5587833ceb09b3a7d45c93abf4d2b2f9d37014115d3
MD5 ca47f259a1d4c6684ff83410432618b2
SHA1 66da06b5a8caf9544bade5a9bcfe99a646003da4
SHA512 226f9d6aa5bae2f8e7d7f6b6b8dc183ef86ab69bc63744f9b9aab0d5cd202b24a0a1b6c9eeb7c79c944af7603e8a7a28a018db8f9ce06fafa30b2c284f935579
MD5 SHA1 SHA512

Submit Download

libpng.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\libpng.md
Size 6KB
SHA256 a967a64eb565310084129163ef988a61468a6c71b59579383b499d729df26258
MD5 3039ee7c958e68131ba1097746c3e1a1
SHA1 8edad278bc3954f19877e4914d454118aaaadc78
SHA512 1000855c3e22784d3f523076aac611c8cfe20b1d1d2de6b7ade4e6cb7c23aebadfccae2d24fd7bd854228c539ef8d4bcdc5ec6731ab705b615fcc496ba9d5880
SSDEEP 192:8xzKscLa0eAGMDAzb76PDMPglJXifQFOOlODf:8xzK60CMDAzeMPwXiYQEOb
MD5 SHA1 SHA512 SSDEEP

Submit Download

mesa3d.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md
Size 5KB
SHA256 08d9cd331bc0a8592843b8e7b00e6da660a8114cc11e8b3ca26da4d71fdf7845
MD5 a94ef89a5258b227aa1520f0505fcd39
SHA1 0466197c633b6dcd6ec2aa25e1692c79fe5f472a
SHA512 6bda7658af734906157822d69cf4fe103cb008653e374bba8526d201d04359ee09bb5be3ff81350bb49b2a23f7950f7c2e21d8707fefa0dff8a2db014df29510
SSDEEP 96:7iHXmhvJmBTx+gYn1dV/wLQuiOyFs/IFp1lqKZW7chIXI3K4pR8Co:7+ggBTIgg1PwLTiOOV1ltW7cw478T
MD5 SHA1 SHA512 SSDEEP

Submit Download

pkcs11cryptotoken.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md
Size 3KB
SHA256 bec7a88ed64356697dc539a1a38e5ecc51f4b739dfcf99213babbb9cbf335978
MD5 f82b2c03e0629824e4839ad65f16946c
SHA1 bba2c14303e6f51a15288d5cf8eacd985cf50809
SHA512 3fa79ed8ded925af652935653b004a37aca4e5face960449c43ec56dc8a41e97693124ed4ad36a69cf064bf1bd6c2de00b95e22822cdc4cb7c5edb614c51399d
MD5 SHA1 SHA512

Submit Download

pkcs11wrapper.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md
Size 2KB
SHA256 1e741c864782d109f508f9c72cd10b7bdd851f77010b3e0420217c3054412a11
MD5 2678330b22dc201defb9f037191f7bab
SHA1 a26c6200e309f6816ac40c0b859e0123ba5a2126
SHA512 9c122e40f398c9efce586bfed1794be2af911558620691f1ff6a9d62af826c68a8b49247ca6b2cf83858da2599114a32c4fe228cf222e671c190cab7d65be42d
MD5 SHA1 SHA512

Submit Download

relaxngcc.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md
Size 2KB
SHA256 62927ec2fe4199fbc4d7c9c5fcee970933b0c9b88d17d3ec7202e09d23679e4f
MD5 37e9a2495c0815f2c345272eb60690c6
SHA1 480bdb98fbe7aed13855b96bbd6ccb51f2c0d2ef
SHA512 40b420d7e911b6d04bf39ea1c19a312c57a70f0358ca2c5f32dcc6eddec7265436abb19761ae1862d68197cbbfb9aa9333b680c149c84d0a0e37cf8ce71ff290
MD5 SHA1 SHA512

Submit Download

relaxngdatatype.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md
Size 1KB
SHA256 514c6f9d6fe1ebeda5be212acefec5859b91c250d28751ff377369de788a77a6
MD5 5fdb9a5b933462d3844e55fcb90e6c72
SHA1 fbbd4b84005fa42f91de1a20bc0c02c13933fcfa
SHA512 8c35f638ae25bd60052dad16f9f511406e5b64fcbfa321faee9595ffaf48bb5803b8a01321f7ed04cccf73581efe64809009cb9537b5e6b450043561b0bda697
MD5 SHA1 SHA512

Submit Download

relaxngom.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md
Size 1KB
SHA256 ebfe54d0f3cadfacc07641cbb4191cfff81cf04fcafff50acc94cec89aba1898
MD5 4d2dd2df509fdc918746ae3e1d7a83c3
SHA1 348c03eca5fc5fe84a7d309e9030bf7341cd251d
SHA512 40697672b84b834d3bc3cbf7fd67f88843bae86668c9b55385ce1ec10b9dab288f00608fbd2ea213fda7cdf1c63777d054c2cd7f9668d3003b59508676d1bf47
MD5 SHA1 SHA512

Submit Download

santuario.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md
Size 11KB
SHA256 6f0dc47ffd443c6bf5d798208d6e8c4497ba4163f3edec5260fc524aea76c56a
MD5 dbd61b1f72433181de79284e9f0bbf45
SHA1 bb4d13bc13db34700f75839162c77bc00fe68443
SHA512 4adcfc36d7c1c223c2b07a3b75daf512bb35ab8bdb82a2b5108b04687a62200012f66ad1db1019a0f3924576dea30ef31153e0b42e1beaa4e3c8a61e3f5b368a
SSDEEP 192:ol2L5ZUGSrHPb1nuQl4VymBbm6SwR0YN0EnSTyy75+AyzBMLh30baGoYEfVTpKvf:ol2lZPmj1nt4QmBbJVxnWyRACQV0GfY5
MD5 SHA1 SHA512 SSDEEP

Submit Download

thaidict.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md
Size 1KB
SHA256 72a37a6ea82e1e51898cf8297d7de6a6b4e58a4e22974aee94713cdeb971e158
MD5 5f5e88098583ceb0a309edbea0703620
SHA1 4b82a56e707c12356928315436ba215427f07c87
SHA512 3aa6b4b298579c0dccaee355d06b6a049ea6f575ef1d51cf449d719a328d015fa54d406fb035dbfa27b6fc8b39822c87094177082f4cdf0efac7a2d41c781470
MD5 SHA1 SHA512

Submit Download

unicode.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md
Size 2KB
SHA256 bd637c9da7d67c080f70258da9c9c6f117ef78dff911fa0d9cf22e2187e7ebee
MD5 b98baaa9d8b46082cb8252b6ddf9363b
SHA1 6b1d0b2dd32ed35f329ff003c02279e8be09456b
SHA512 e95964e5ee8a730a883c27108b5f8d3a4490382f6f3128533496c9eb8cd9816eb7b4e0b49f18c36b029b272242e02bf5ba4781ec1bed59a8bf1a0d06e3f9588d
MD5 SHA1 SHA512

Submit Download

xalan.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md
Size 11KB
SHA256 e2f50e63ec1c92168218d56b41897d416cfeb2788698de8c0d984563565f7ce2
MD5 ad675e7ed2ec72c1906fa587d53bf14e
SHA1 552d91633c7e11a3bf4fe9403027a8d07d92058b
SHA512 da7d7f47ce308c0d782e4abd4a036195bfbe9d44566bbc178cce28c534aa87ff69ab920ef2d6549605f4ed92b95533ce627ea85767a9ec832c604668b7f3252a
SSDEEP 192:pdfYOBqKuignpBPjWRzvQ5RDTVfjU7PgGh8QoReAi9/ZvdC8Zdm+J+e2rNEiQKGu:qHiKp5ilvQr14dhqeth0sdJMe2rN7Au
MD5 SHA1 SHA512 SSDEEP

Submit Download

xerces.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md
Size 11KB
SHA256 7e63744805dd8462351a5469ba379a2f0ceb9cb9a1ba2577a4f291651348c1db
MD5 d9d7228d0922be95d9adeb3f24ec0b8c
SHA1 340fac34e7e3816dba960f06f2abc7c4d91d4a81
SHA512 cee4cc64de9e9e761a7510eaec932a512925920ace521da0f8fa63a63bc5b57144b5a4b8dd55adfa5d4f02dc8e518d77e36c676e36029b2712a3094b65fde714
SSDEEP 192:+ro/XEAEw0OQI5PPkMRkFVdPZFLcOYxOmioCP3T3x+kTbngQvqRX:+k/0A5XkMRkD6OcOm3K3ThLbnTIX
MD5 SHA1 SHA512 SSDEEP

Submit Download

xmlresolver.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md
Size 11KB
SHA256 c1899b6d481fb18e82ad975fbc13502b802273a183f852271ab63a0198326230
MD5 9fd515b6401a71b546a0b2e3ebbf95d9
SHA1 7f2d98b4bf362d6110ef7857711f17b2bd12e66b
SHA512 cd27ace2a9cc8ebbeaa68bb09502a50b2381d8ceef57289daae66b108b0ba8da705595ff445ba2e2e6ff4ae3f92a8ca43f88dddea453507276a0b86807dfdc6c
SSDEEP 192:nKuignpBPjWRzvQ5RDTVfjU7PgGh8QoReAi9/ZvdC8Zdm+J+e2rNEiQKGf4:nHiKp5ilvQr14dhqeth0sdJMe2rN7AQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

zlib.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md
Size 1011B
SHA256 741dd73cb736eb6c73dddc8b062bc9856cea0f12e2ea1af16dec3343b429d9b1
MD5 bce3a1ac650bb4c551ee5984de07b67b
SHA1 18a833bcdf04cbdc497950a8e4d5455d50c3cff9
SHA512 6b0a6742dd23daa3733d8ede9e2c1ff003e5b2d970bd2812787691329641e868351e09d20b41c4c609e7c02914efebbd0d4b4f402b1bc6aa9678b9b059ecef8c
MD5 SHA1 SHA512

Submit Download

AppCache133727662610078916.txt

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727662610078916.txt
Size 77KB
SHA256 0b99d257b223a5691c25f5b8ce27e6bc6e08468408438a240b43ca22555c7e82
MD5 32f003851182625d0a9711a091a204f9
SHA1 7937b16396fdcda48bf6fc8fde002c1a16e5fdf5
SHA512 032558c9ab83a446e33bf281d027f20bb285a4eef33709c3a443efbf5cb5edef8034acaff3a1cb510e9b431a97f6f68ab95a55bdfa1f7da923182b095a9335e6
SSDEEP 768:CBHBkaAaeNNOLezpjCO/wu63KlaYK17tDF/G2rnoYm269atpLsWdnwMn0/5v:wUUL/PLyh
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppCache133727663116015387.txt

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727663116015387.txt
Size 48KB
SHA256 b89e4b4e9e36e081a9b974827732eea5d8ac9cb550542c1df11ba478ddafebdb
MD5 b0cf901f3554a63450ffcbd6ef53f3cd
SHA1 bafdb5fec61ac069c177c2dedb6f9a4fd82dec8d
SHA512 aabdd4965daa2abe916abd4d5150d94ca8252be3acb4937f1870fa28752a636c457558e29c4f710656f197db7890700ff34e2ffb82eb0f82b813cca93eec6753
SSDEEP 768:Zk5EvRQJMYZyvglKKZDX4wN4itolha2kdf3lAN:QjFosOpJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppCache133727669820222616.txt

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727669820222616.txt
Size 64KB
SHA256 7eabf8d003d872e05ba212cf44ecd6ea2c618d56863fcf8404c6f90299bfde2b
MD5 1297bc2c46a97dd8fdd75d388535ab91
SHA1 5983cab6b02dd1dea5b12ad501d0b04b6c566ec5
SHA512 6a1e14e4590d08fb71bb9d711f4529ef829177c3ac89e45ddeac4469f250ddcb48bbe812a863c6285bdae4d2c9b74e7315db1fbd024372deace3ae6ba50a1d10
SSDEEP 768:9bKpzeqOXVvztabvflNbn+PAomfTMqyCy2yxg14CteJ8641AjYEs8:4+cyAxu
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppCache133727672589120253.txt

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727672589120253.txt
Size 75KB
SHA256 89dd47ba918998d9c3c72bdb5feb69f5193ea14edc2fb98da8c10ad8094f9e7c
MD5 66e9a81f499b147d3b8dc2b98a155693
SHA1 38cdfa9550d523196d4e0e17c7a906dbf44494e6
SHA512 76cd8edde676958b124f37b49907d6f0b8f04328c06f10f5d33b4e5fb1f63918e42ab40d3c28d566418946151b619581104a925ef82d787bd3962e5a14c13f95
SSDEEP 768:mw4RSbAZ2NII9vDb/ok+e1et1VLo9L269atpLsWka2kdf3lzyl2sNnV:6hR2Fr
MD5 SHA1 SHA512 SSDEEP

Submit Download

File Explorer.lnk

Path C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\File Explorer.lnk
Size 407B
SHA256 1ba66ad37c86c36b8f4c71010203f14bd894edc9e6f77186d2911a217e6c922a
MD5 5cff226b0890ec2fb977c7ceef2d1154
SHA1 88249b74e08422f2fd6cec55b11fc9a4d9519695
SHA512 54abe92d06ccf8259450b1e6b6aa852fd5c41357f97baf8ade78904db6082d89f1d8f89150dddf31098e6aaced5a314440933043c85b5e031535891caeb7ff1e
MD5 SHA1 SHA512

Submit Download

ASPdotNET_logo.jpg

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg
Size 21KB
SHA256 abb6067afa90ff3508cabd61f9ca121d0f9c90507fab1b76d10f6331999d5e12
MD5 215a0341a30a24fe9212d079a9b771f6
SHA1 9f3b1f436d9dec24586ea21eb8104d4619107e64
SHA512 dacd58c8c6736618e535e38d2e7161ffa010263fc1431626abab931623a5b203a1a0540afb0ef30bec06d88d3693d5602fe6f798b77100c24c0a80495e4a19ef
SSDEEP 384:M0k03FzQeGF6o+IEvTRtPRlzkkORpNBdE8+we5HyUY:Tk01zQAo+/TRXlyNswe5FY
MD5 SHA1 SHA512 SSDEEP

Submit Download

HelpIcon_solid.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\HelpIcon_solid.gif
Size 1KB
SHA256 0c05e957dd1849724941a1e1e19b200de91dffae39a65eac2ee5a2da648646fd
MD5 7601755b5dc9a5fdd884aaf45b1153d5
SHA1 98cda7b989d5807347f654ad8cea8761531b5b7d
SHA512 29504f0c4cfd106625367d401ebce2238b2e7083546e667627dac42bc3b41ed326f5389ad2137821a62fe02fcffeccf856515cfeb6f4eabd05196c36393db477
MD5 SHA1 SHA512

Submit Download

alert_lrg.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\alert_lrg.gif
Size 952B
SHA256 7b834141748e5b88b22e7481b2a02058875a3e784e20f773e04c676ac88223cb
MD5 958ea0e3c3e4d9d1d0b14347588ad087
SHA1 3cac504e31e2873705bdf0ce0d2a037a3f842195
SHA512 84cad66f93a1fe6464b40afd3f6a5be62342e123e43e85cda773a8362594a7c6d0395eaed80fe3ef9c7e2aa807d4bb9539c273ea2aafb2266239e3ef97dd982d
MD5 SHA1 SHA512

Submit Download

aspx_file.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\aspx_file.gif
Size 121B
SHA256 a7c8a59ea1a7b08496b9214a33c28177f6f7c7e9749fbf0660527f72382f443c
MD5 a5b2a9795e86ed6a3d1e0609abd402af
SHA1 c4c26660daf86eb2fa74af68fde94acefcac13cc
SHA512 45d8c2f92a62eabc76f5bb30da5b36ada7ad2374aa0971ec38b87488e9fa986ee1b61c18998015775df88048bf673e94fe74dca3a1cefa8e4ca6a9817a79c513
MD5 SHA1 SHA512

Submit Download

branding_Full2.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\branding_Full2.gif
Size 1KB
SHA256 076acf7238d73824dbe55ab10e2ff8916a4e03c5205f46e59905524fa1650641
MD5 5cf7971f5124a38214350c465cd3aace
SHA1 cd4e0f6ff4e19d2475b303d8f9c5a186237b8af4
SHA512 735fe04c4e0d436e36255b5f399f66db807d280d627e55ec931da7f022136b3f6cc8ea56102e46a674baf0d2b6844409bc06edb092128cc43f91bc4ddf89ef1f
MD5 SHA1 SHA512

Submit Download

darkBlue_GRAD.jpg

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg
Size 8KB
SHA256 5b6af7e20b6b90c44413900234e9ebb461679e9017c2b52f2f063c416bfbb96d
MD5 9a21d6541be97f6ae6b0ddbf5a39fe88
SHA1 500855f31b919d5f10b46b2a3807c022e147b9ef
SHA512 eda142a3042cec239453f653f92d3a9131ef1de39a6fcca641a6480c92e1a056f2fd47d3c89ca2892fdbf3558425917b3746b25056cb77bad71eb80c547e5c07
SSDEEP 96:wQteTgvQNdQVGyuL06H93emDgeme6r4H16OOxWzvEu70KSde4e4e4e4eomSSSxcp:/efwYxZxgI6+spkjE2imSSSepxp
MD5 SHA1 SHA512 SSDEEP

Submit Download

folder.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\folder.gif
Size 914B
SHA256 2c2636a6c3c53631a37e5aee914478ac6a224187ac6d48be5a9b9baa7c6e5fcd
MD5 722240bab399566bc270306f9df8600b
SHA1 9132894ed87ceda4a1f66e6d89ee502d57bdfb08
SHA512 fe79a9826ded6be6ed8d848884dbe46b7402567794159b8112a549ff6a59869afd5ea19d7cf5a39b8423bc3ca57d31ad6f2a5ca4f72acaac7dfb60b8f9e627de
MD5 SHA1 SHA512

Submit Download

gradient_onBlue.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\gradient_onBlue.gif
Size 90B
SHA256 eb363739f1a3552750c219cce7c3412ab5f437ae1ed6cac3b53adf5b0620a232
MD5 435a7d0a8ffb995138b68ae1b83b0103
SHA1 6d58d94d2588688f35c0eb74c4f5ba7efc50c091
SHA512 1921f0b80bbcc5019cfc4993072bc7878d9399e84cb20614f807e18f45221c7d44d21fdbee1e30df8cceb0d0f68f0091e49bf1865eebb575ed757d820326757d
MD5 SHA1 SHA512

Submit Download

gradient_onWhite.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\gradient_onWhite.gif
Size 90B
SHA256 524d28a45b8635deaef0e96cbeb656e30e3c2a3089519d3c0b87ebfe1960c4de
MD5 a4858bdfc6a8c2f77c7666b9cba76f0c
SHA1 3d6bc50e18d155c41261435546c028e9bfac5d9d
SHA512 92d56756f47453801b0645769a4590fcf2e03847f054f65d875c2c6e891c34b7b379719e8096a804a41bb5e9697fa19dd7e2af79ec1430430db5ae9214140b66
MD5 SHA1 SHA512

Submit Download

headerGRADIENT_Tall.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\headerGRADIENT_Tall.gif
Size 328B
SHA256 b4e2bcce0b715f490ad5977f0bcffafebc9c1558c42a6577d2baa074498ffdcf
MD5 15d544996cb9c3a47615f5de052ed8ff
SHA1 33e535373ccd36515bf12e566df82c477e413db7
SHA512 4a66a869ca1fac68aab8730f2bc559468db138204a4dfdc1be760960fe5d5a1fb755ffdde9510f748820b9878ddbe54be3c56365191a3cd7d4e374ba5cf4c846
MD5 SHA1 SHA512

Submit Download

help.jpg

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\help.jpg
Size 1KB
SHA256 c43e561058463f7264a3859e4a700bedef54dec862ac1d264082736d6327d933
MD5 fb15ada5b4f7cd0bcc8d0af4d0d7ef7b
SHA1 253aaf914b4c6a5219e7ba6575731d6358cad098
SHA512 fe1c7ebe96a5d65cc25c3fd2ae4ab311115c076c770cad3cd9cc25e9f7b294fc4ca4b2d7481f4516cc6b76be0b7ed71059be07694a4506f9665ef7dd41ee1867
MD5 SHA1 SHA512

Submit Download

image1.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\image1.gif
Size 162B
SHA256 83a5ca5ac43f9ccd9c705802d8134cdb31f6095a903d4b7b03381279c0c542ba
MD5 567ba6759c00c7773e2a2423da61089e
SHA1 cf4272372a4c1337abd399f17f051f9b6e20d846
SHA512 cd13dbbb01b5468a0634f1bd406fe65643dde862259d7008433894275d64da1985c9bea6f69656611a17e5cba0694e336be84bf43ede1ea1a38ee0f78454aca2
MD5 SHA1 SHA512

Submit Download

image2.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\image2.gif
Size 586B
SHA256 03d00a628dbbe8a63f9948ecc618928cdc37fe818b9b2208fafc6cee31e191d7
MD5 fd41b5253c55d14fd75253b1e2639e88
SHA1 9fe76ee44322b2ab4908ba50a286fa3baf2b27fc
SHA512 4a8d49245bb7dc3b86ee52bb0ec9fd4435150d44700e94d650f574a77857a91f4af95d734ccb3bbbfc54fadd0c0bd76960599213441bbb3e57daeb3cc26794b4
MD5 SHA1 SHA512

Submit Download

requiredBang.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\requiredBang.gif
Size 124B
SHA256 7bc1e27c44ed401fddf1b63799e45107c830ba8bf39d0eb953614a0c4991b47e
MD5 171a23b90edbbbc9781182967397e2c6
SHA1 5b0f85aa42410d06e375888ede0c335deb8f2c7b
SHA512 16fa5d38732019292a329ced8b136f30b482c449fd2c28b8519dbd848d12bef66cc5abf6e8f30c1c65f9fa86447a41a92e10d6c6e04ac7631e8997f1acadbf68
MD5 SHA1 SHA512

Submit Download

topGradRepeat.jpg

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg
Size 8KB
SHA256 7094c18efe63460741857977ee74b454a0d7eb7238d9f1761a9880f9313cabd0
MD5 80fd59f8c4eea72d54b11547efc6fd88
SHA1 21149de9c5e9b6187de1a66b7de1c8670ad0904c
SHA512 dab9abebae58b1e55e6b083cc0d471cf07e57fbad7f033a5bf62796d5921c1fa0d8d3ca863c12983c7fdbd00a4681eed6b9dd08de79bbf9e914cc2d8b49fc300
SSDEEP 96:P8rQyMnMvaFjfcdjEUfLIydoFnBN8UmjTc7JV0rtOOOONKo34VcCiCg:BFYdtcxBN8Umj+0rGhif
MD5 SHA1 SHA512 SSDEEP

Submit Download

yellowCORNER.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\yellowCORNER.gif
Size 880B
SHA256 9477a12bc94c0e94a243db6d5de6328d3112759ce45b10ff7ac34ab0fb67441f
MD5 699f2fe8a792fa2ab89e49233d47875c
SHA1 ddb5d48ccfca7b02203038c68db3e3e50d66d655
SHA512 3e2d15ec534cf8e1e4ce2c7a4ee01b0e7c18b6f6ce0901e59aaef3ff9bcdc70516f25672007e919464c7285a47efbe2c8a25bf3538f9ce0645ad53233a4e8804
MD5 SHA1 SHA512

Submit Download

1 - Desktop.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group1\1 - Desktop.lnk
Size 1KB
SHA256 cac410164eb80a26c02b7553dc80af2b5fdee7f3ffdeb75f9834bb9b6cbd0742
MD5 c33f3baf00dcbe6dbe06bb56c74e8342
SHA1 f09ce7f5f9265fe43fbaf49dd67bea725c0d09c3
SHA512 9f4ac57c69ea30199a9e08925333beefa7963959c477427851e0e51fe2003f9c5988aef336cddf93e34a381bfd708583781e198b44f3963176dabda0d5f5ba39
MD5 SHA1 SHA512

Submit Download

1 - Run.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\1 - Run.lnk
Size 1KB
SHA256 23d7667b68b6c79b630784950e7fa796a47b9fbd02c154448164a090b2635756
MD5 aedc8615d16bc3dd4aa38ec5fe56765f
SHA1 e4151e733a0810622f56157c5c65a32c70343423
SHA512 84e704730a674670777d66846b21b30955798ddbfe39207ae3f924d4cc0e972b37634eb9f870005748a7ba5d93caa494f1e751a57b9070537ce40b27126b88d7
MD5 SHA1 SHA512

Submit Download

2 - Search.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\2 - Search.lnk
Size 1KB
SHA256 e37edc607abb0b2f5c1052f240e5f693b65ed6ef3ccfb52d190991490abb42ed
MD5 52ca14f6c72d55839c7426d8f0100969
SHA1 5b78ae0b47747a24dd95f801d23061fd109e54a4
SHA512 bb67eb100946e9a6b4abe1713ef45400bc661a076bd0467408defeb4069f6bc5f78437842a4691ff4bcd726814dbdba2543e9f9ad60e682b2bfbcf7c2b64a115
MD5 SHA1 SHA512

Submit Download

3 - Windows Explorer.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\3 - Windows Explorer.lnk
Size 1KB
SHA256 9b01d197f037a2a1d0fad35940eb11b636b73e0de763431b1ea5798a27828298
MD5 331bf478145159e38c6101ddf954c80c
SHA1 c6a162d8fb3f9d71b47466ee8337a095c10eec2d
SHA512 0fd993cee69611b45abfaebaca5c1d13196450b4ba0f8ab69a2d0352aaf20d82d38275afe94f9febb668f9ff4a1a664b5258cef1352adad500eef9516b42ce69
MD5 SHA1 SHA512

Submit Download

4 - Control Panel.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\4 - Control Panel.lnk
Size 1KB
SHA256 6284574f712e23eb1fc6b296913f892862e8e5be51bca037369fdbf56c03d24c
MD5 cee4323a18e591dd6f80a831f626feb3
SHA1 41842c1391f298d71466ebd51cdcc9b376c62fa3
SHA512 7d99a964d5b930773583973baafc0f91029c529cbd84a06ead381fe5598c346753f961f2ef7bdc82f2cf200a39d51c0368d12651297a02655fa9afc7f146bfc1
MD5 SHA1 SHA512

Submit Download

5 - Task Manager.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\5 - Task Manager.lnk
Size 1021B
SHA256 aa9b499f6cc1963ca88406b899aa9f39fb5d695351818dc7dd72ff9a482913b1
MD5 1698b6b7520593e0016c32d228eb6ba1
SHA1 a33462f875591b2ff7e3ae4c3084719cc43f23b0
SHA512 08e82e6b744f029d2207bf89a9063e409967087cc6efa1ea2ae6b39522356a0ca0fb4d98576de18c2fbc9ec45e342a69af8d21fb1db9f999741c3794bd638356
MD5 SHA1 SHA512

Submit Download

01 - Command Prompt.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\01 - Command Prompt.lnk
Size 1015B
SHA256 00435c9ce5cf31800e5e2a61d71a32168ca008c0f813c926771d5c86243a058c
MD5 0211117477a4e292d995ac147848b2e5
SHA1 05fb3691ed9d043d599d5b3d36408e3d3e3f0120
SHA512 e878c530560a7226954b592d21f549367fe438abd6204777985eaa2ac3010c0b147021773d03016bac97c918adfe8fe3d33a841d9ec752917e36c9c9b529d290
MD5 SHA1 SHA512

Submit Download

01a - Windows PowerShell.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\01a - Windows PowerShell.lnk
Size 1KB
SHA256 49f73cce1f98a9870d83fea3475413e5708c381b57de0277122f02f133ff4431
MD5 537a39661d556b9c5c83df1b40f2a2c8
SHA1 3dae2714e1f771e2d48de9d45a8400b96a0e672f
SHA512 f093c8088710c5bd22b171000e344ae89229be906e528ee7e325b0bf6ee6cc5c3b2a67ae51c1afaf0c881d1e4a4b62705e98b7f7bb682288d25eef1f6cd5f9d0
MD5 SHA1 SHA512

Submit Download

02 - Command Prompt.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\02 - Command Prompt.lnk
Size 1KB
SHA256 d40bbcb8b5162793463ae7321712d9501c5e1a8e5e1007148b25f55ec1330152
MD5 864ef3eaa0b72299d2e3d8cc2826b6c3
SHA1 a5313d65992b3fb708832313b9cf56f34baabf8e
SHA512 d817c724e20dabafa357ba8171b13264c594735e9e7b66753e24104e773b00e08fa431bd28a132b67d9094fb7661f9593c40256f0bef6ee5d92054f6c8e13817
MD5 SHA1 SHA512

Submit Download

02a - Windows PowerShell.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\02a - Windows PowerShell.lnk
Size 1KB
SHA256 5d84cc43956c329ce78c3d70ec49144c66cac51b7e404e507f0c26671c819ba4
MD5 f999bfe1583e6b7e341afb5b1a07fcf3
SHA1 a62ca12916833055487befa17b26520e22656449
SHA512 529eeb0131529179659008a4fec6d508d6db1b0ee60c84cb300ba7d2c9d05f5a3210e8bc2b75ea1928421010b6fad4002bc2cb495b71e5c959a19fc84e6a272e
MD5 SHA1 SHA512

Submit Download

03 - Computer Management.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\03 - Computer Management.lnk
Size 1015B
SHA256 c7cd24cd954467bddf82c6bbe907656c30d804452dc4aaebc5c188dfc58443da
MD5 86372a36bede652e5c00644be3a44c3f
SHA1 359ca0a2f8efbe25d46cc604906e02baead2ac49
SHA512 9bc869a1543c170cfbb83306563fb3072d07b6c3296b789df91ce6b51e787b3e605bf353287da60ab7b36064bcc3abe09d97ff0c373cf9d65aa1219be7e1d4f5
MD5 SHA1 SHA512

Submit Download

04 - Disk Management.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\04 - Disk Management.lnk
Size 1015B
SHA256 e9d3825c9db2cd50d3fb5437ff4aec78ea5252cd98efc1e53b88c5a9b26cad3a
MD5 dcdb3c9297b4dcdd8099afa55c35bf92
SHA1 70c5316c10b479723996b5bec13cfe7691be104d
SHA512 435bc4e0dec24f2fbb7b6c520c62a7cfa9f1d199224df0779cf2a66e43c7a89f4b287e52b1067ff7739ea0b34c9a815619112b91dbd4e67cdadd551c8a74dda9
MD5 SHA1 SHA512

Submit Download

04-1 - NetworkStatus.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\04-1 - NetworkStatus.lnk
Size 1KB
SHA256 4519e9cf14218c5c429e5d67bfdb41ee96fb1437beec48068a1e4f12a7e3ce8d
MD5 8158641425c48687ef62d3571c010633
SHA1 1b3029f6303656dbde1261382d1ef4315e497be5
SHA512 052e5f963510cb2dfa3ebb668f22287b105fb7cde946549953c74b2b08f4b24fae6782752a3dfcff22a3cbe0be280f730a2abd60e201b460a84ef466f2000f9c
MD5 SHA1 SHA512

Submit Download

05 - Device Manager.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\05 - Device Manager.lnk
Size 1KB
SHA256 0903d0208108a1d0921b8c2ed0d41303b4138e95582c00a45525dd8380dd9e92
MD5 3b73deef2db58d1b113ff6790e923def
SHA1 06162356ed8a217cf008601c202d4297269d048b
SHA512 66b320fd0ed6ed5ed97324aeee0b9b3902df6b5a35012c5b6c2d765609cc90908d5de0ccaa8407c2629912f9476b58612529441d1ba8e080e4f542f43c3f26b7
MD5 SHA1 SHA512

Submit Download

06 - SystemAbout.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\06 - SystemAbout.lnk
Size 1KB
SHA256 38813bb5aba709a23ce12eab5ee872f7f69b81d041d50104e789e91cbe50c177
MD5 5f56928a3234523a6ad04a828768fbbe
SHA1 76cc34121d0ad5a23e669d6170f3471b97c204de
SHA512 6c0f667c1a8e5c236e335630f2bd7591dc1e95bf0a87cc0782fc968cfbf31f59b6ad73270b7a663e54855bab1799d58738a3cffd710840513d6480eb1dc24f90
MD5 SHA1 SHA512

Submit Download

07 - Event Viewer.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\07 - Event Viewer.lnk
Size 1015B
SHA256 d221e81fff63cbcaa5724dda9e0a9c778432cf29e5cfd45f817061eea2ade936
MD5 44cff927f549e011f43881969e319316
SHA1 b7447cbb6fe7f711908d49f8333fc6168f4f51a5
SHA512 705ea9de3d4756b536f8f10405b303536387ce4ed5cd726358d0de0b47ff618d7f0d589fea4c45eb16d35316cfd33a0127a88d8b7627eccfe1a5b50fac22c95a
MD5 SHA1 SHA512

Submit Download

08 - PowerAndSleep.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\08 - PowerAndSleep.lnk
Size 1KB
SHA256 512342c6b3e0321c3db67e487e9afc110b40ce5fb0c212f7c7ea392513d20ba5
MD5 9966421fbd53342b04fae851105a1532
SHA1 3ba2d7c44263f7f724f3bf8d3fbd093ac47e894e
SHA512 cc6f24efb394a592c8824cd46dcec2024cca7cbe6eb8292aefe571bb249d95633c62f9736a9db4021efa6228d682d4dcce2342a18ee2c88cc59bec7ace931849
MD5 SHA1 SHA512

Submit Download

09 - Mobility Center.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\09 - Mobility Center.lnk
Size 1015B
SHA256 dd61604495421d9da15ddf0d4f757e9c51b5184bcf8c56fc9beddf552f11163b
MD5 1245a7ce9c25bcb51851a9ad1bb74c52
SHA1 d09b6cf56538fe46bb1350e13140fda78924bf7a
SHA512 659b8a56fc21a031fb1bdcb770812a35de0c0ade9feb712a76c8ca2c7c1d2edc0fb29b5422ab9349df374221d1a3ae1253a1a61b521d903f7a68f7eac36d944d
MD5 SHA1 SHA512

Submit Download

10 - AppsAndFeatures.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\10 - AppsAndFeatures.lnk
Size 1KB
SHA256 95279c01f3aa85814e26fb2489c5febdbd4c2582208272d4a1ae5037ec7ac695
MD5 dc3ec6e83a0a8c34d1a81394bdd397fe
SHA1 164962e779740198bba71532b7391ff34658322d
SHA512 a940a3fc1ead46f7e2077edf8fdab78fe1750d8ddeb898fe0560228afccc632e265e0e6e4213ab2e4a737efbdac8e2f93c0e3361f542b592e7bf7f534876827d
MD5 SHA1 SHA512

Submit Download

Shows Desktop.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk
Size 352B
SHA256 b613b78428944ce862996efa8cf2c0c1ae8c1ddcca0170245baf28135694ce30
MD5 7bfdad03631a32a93ec9cfeb29bb52ab
SHA1 e84906fb48c7074bd609d78539d4180d62943da0
SHA512 7a9940b35382a46c3f9ed3c4680183d06cda42d10c90da85608f46106d876cca9fe9531659e16fb1321bd5f77faf9e17c38202d58e8bf8b625a68dc9d50632c4
MD5 SHA1 SHA512

Submit Download

Window Switcher.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk
Size 334B
SHA256 e1c4a01ada19fb6cd1c3c18bf6a14d0984358d5a1ae1827665f6c28f1a4e00dc
MD5 db4585b7253f88cddc44688060afe1ab
SHA1 c1514ce08c04c94b93c7d3173cd7b0790d33bd69
SHA512 73e1a3c96903e0e97638fc39a040280ce0ec67b42fac0af6b28674607fb8874c906418917276e86473eca106c27bb3b08f052bb4d31d5879b18af8d9a2c22730
MD5 SHA1 SHA512

Submit Download

Magnify.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Magnify.lnk
Size 1KB
SHA256 6ec7c521468586192cbe2adc161e4c94dd3f2199c22ab7f24fd036d59b9ddcb3
MD5 5edd74ef14e683342f8ea644116072d1
SHA1 d6c489ad8a301845aef5104b42ec067ad3aafb1a
SHA512 eb07fb5b9f0d67c2ad7e8e2b5cea117e78dfad61cbb35b80782725215f720659466784ca4ce38e08728d7128c08c573652fe5822a46bfcc022ff9ce312c02253
MD5 SHA1 SHA512

Submit Download

Narrator.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Narrator.lnk
Size 1KB
SHA256 04a7c279c1b4c0eec3a40fcaa7692856e97c23172190088c89315cec80f62576
MD5 68f3aacaa662377b62fb54f4d7850739
SHA1 00b34c21c9ca52660c73f7d600fb23695d28a1cb
SHA512 c7a97119cf49d2ab006e6c0ddcbb8f99c1a65a2880a1856b2f5f9bbfd6a7a4fa5646285301999710b0ed8cb1926c57aeec0a3fafdbf584ccc44d7efc0c96970a
MD5 SHA1 SHA512

Submit Download

On-Screen Keyboard.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\On-Screen Keyboard.lnk
Size 1KB
SHA256 3e2391cc91c167337886766446c874df6dd3367c2196caddfc6831a36966dbed
MD5 dae9c786aa0fe7b4eb3061c93d30e957
SHA1 9b03d81a2651a4dfe38c9c478fd734e02ba64f2e
SHA512 ec7f480d2563ef2c3cf5667d47acb7270fd0cb45384badb2d61e8c37fdd3a2ef7dcae624844fb0c87b54c52e6d13c178b1fd1e1dc0085672bfe4cd706ca9a520
MD5 SHA1 SHA512

Submit Download

Administrative Tools.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Administrative Tools.lnk
Size 1KB
SHA256 18fc79afc6c2ca415936b9d63b5ce355ca0dab3391d539a84a9b48d80d7d4be0
MD5 19b196fde0c3a4631e70abddf899e764
SHA1 31ec44a39899f30880e367cf03c3214c87c8a444
SHA512 c5d44575c4745701d902d48175e8657fa624ba08929a91747c5985e66d2df53910b3c95d5f3454b6e9b7e6e896ecfa060154aa9b9c452dbde2fde235792d62fe
MD5 SHA1 SHA512

Submit Download

Command Prompt.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Command Prompt.lnk
Size 1KB
SHA256 d6b5eed56eb13d6d1d7b259795d4ac178123b552cd60443d7190d6861cbfe139
MD5 dafb0c51184745f6574f2ddfad83ab19
SHA1 717fcfe8c7285b99ccb425903469317a3067c80f
SHA512 dffc68520482a0ad3b72ac5f68b7ea5981a02b0fb4bd9e27bbf5358b08187d411092bf50c40a8f42763009331adcfde4d2d7a2efaca7c557163e018002daac06
MD5 SHA1 SHA512

Submit Download

Control Panel.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Control Panel.lnk
Size 405B
SHA256 ccea27744de7f0244401e37825ca82c242d277d89a190c28ecf876993ff5c7b4
MD5 10c8dc3687296e9daa9934ea7cd2c7a3
SHA1 4d7d131906b4e9ea89eb1df16a026f652ecf8715
SHA512 c46cecd3ac512b886424c6ae17c878fe9efe48b3ae63e6fb77d9abe9f334bac9ab99ec739b05a9501269687ff717b5b8a586c2edc08b366a08906a72e773e780
MD5 SHA1 SHA512

Submit Download

Run.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Run.lnk
Size 409B
SHA256 38f3cda839b9da80d51dcd67aa85c4da958354a9d4d5ac0eea9c001584718f7d
MD5 6560acd737e677d5ad7c98a36704f9aa
SHA1 f32db55987f58e5c65adf7b68acc36a500386eea
SHA512 59ccbb6d5d1d3767018e10cd6c08550692dc3562d29f314899affb972001c17ad553c4f36d7938a49469a15b3006f309d2c6c98a224215403b63c40e8c1e77c8
MD5 SHA1 SHA512

Submit Download

computer.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\computer.lnk
Size 335B
SHA256 33a2c79ee12beb8ba54e52b2e15b50bd90aa29606967bb67f3e2b9e5d0c08a09
MD5 1550921e8ae643fee99b7f9f0178f288
SHA1 623521c41d9921ff558728e8305d29d4a446dd5e
SHA512 b2eb096fbee8d30bc715b5f37f09556fdf4db6fc4725d9dd8a91e3193256bbdc4fc0f2732dd4e3c9d89071024b2470834fe860c95d47244a098374a9689dafcc
MD5 SHA1 SHA512

Submit Download

Windows PowerShell (x86).lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell (x86).lnk
Size 2KB
SHA256 e030e7ea0b241831cb5235e2e66c907238eddf102bf151b3b324244f69012203
MD5 148cc1c79e132be581e88deec3ea8c4f
SHA1 bfed8a513cc06e2a402e527b4e257abbbd8fe34f
SHA512 16f49aa7ce0a97bbe371b6ebe0e2a70b3eb338c9f4aebb0e5afdd0e5c645a2e6e1496608f7488bdf7aab2c3920c4a435335379bf050818e3fe8dcf78f475ac07
MD5 SHA1 SHA512

Submit Download

Windows PowerShell.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk
Size 2KB
SHA256 73d0257a3c7527f3efcc68ca901ebd61329a034165c17e00bb954828b7615143
MD5 85d6bea4cc03d439f5d6aa1cc53c9ef7
SHA1 74c7e9fb96b0716529912a59cf642f259ba02a36
SHA512 bf629a3f0d4bffe47bbf97336a8fc1a3c11fd541b2140f62e06a4b4ccafec13f3b0cd786ad05de9ce6324544b1128f4db9edc555a562f614b021726e1b598895
MD5 SHA1 SHA512

Submit Download

Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png

Path C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png
Size 296B
SHA256 eeb0dfb5cbfa114f7a5df530250173b51de6d0c85658fa0a14086292f95d8a6b
MD5 5d572ffcaa443966deb92d0c69450d79
SHA1 3fb606e9b6faa544c7d0a2b11ca56f82202ce6f6
SHA512 ae27f92e087be5693a7608e32373d3fe8a50255d60b4f245c458dc556152256226bdae70ba792e534500fceb943795986686c067b601954734c2be96609d8fdd
MD5 SHA1 SHA512

Submit Download

Square44x44Logo.targetsize-44_contrast-white.png

Path C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_contrast-white.png
Size 276B
SHA256 29c8e1789a47ecd2848aaf4f3e2d36ea2e4a0116d097ae9d9e2cdfe5cc3ee171
MD5 a059bfc78ab352c123d3502ac2223944
SHA1 28c19b005ec89760736164fa6022ac2ab3dbba16
SHA512 a6517aff09020fcd6a5299269f38e617e7fde4ebf6b97e674cec697b1df2ac955891f445c8a6195f2f43a5e6b6fa69b83a50bb01d8f9ac02bad89cf5b5a82f5a
MD5 SHA1 SHA512

Submit Download

Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png

Path C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png
Size 296B
SHA256 ffbc7f5ffd680b72b4c7ffe7f16dfc13dacd40c279d881e0c38ee34db4f046ba
MD5 d0c7c73eae30ec93c268755695eeeb73
SHA1 08612c06e9f288ccfad6e4122ae8287fb8f8c68c
SHA512 9f88db71aa535a81571c53e16d63ba9aff96ae38a77fdbf64009849b109c8de182728a686ec23528462dc6503940eaaa5dd70af7d45758e6cc1cda8520d295f3
MD5 SHA1 SHA512

Submit Download

Square44x44Logo.targetsize-44_contrast-white.png

Path C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square44x44Logo.targetsize-44_contrast-white.png
Size 276B
SHA256 02c97cce992133b60115cfc1b740eed852f33b85e3ae0a9f23c7703fc219160b
MD5 7a2d10f86f20c7bd79c9473aa2bc3d97
SHA1 5e321968bccccd08e48fc9ed930eeb412787b163
SHA512 bef5425b42de012f48480948746eda02d4997b22cda07e3c727eefd8cd88a597b9475b6b116142f93a95727f687fb2982080e0146a831cb906e6f96d8d05e2d3
MD5 SHA1 SHA512

Submit Download

OneDrive.lnk

Path C:\Windows\WinSxS\wow64_microsoft-windows-onedrive-setup_31bf3856ad364e35_10.0.19041.1_none_e585f901f9ce93e6\OneDrive.lnk
Size 1KB
SHA256 b863149dbaf7aee48216fe00dbbb709535fad30f6cacd655f777723b4b3c9de4
MD5 cf1e9fc41467c687c1b7597dbab56c93
SHA1 4c4be43c0d046eff78d9d35dbad3ba632539f1f0
SHA512 ad6a074bff32247d91398ecd61efd11cc76809a6aa1a7e8aa37878e48d7ceb9d6490e186e4b6845ed17232110acd877c5f10e2a30cfd29a6a17aeea9746f3268
MD5 SHA1 SHA512

Submit Download

memory/4392-0-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/4392-10822-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/4392-10959-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/4392-6625-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/4392-6630-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/4392-11250-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/4392-11255-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/4392-11256-0x0000000000400000-0x000000000040C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads