efbce4ee31209150bb8947ba3452051b0e0611c3b99d74add93e1dbc6151abbc

Analysis

max time kernel
94s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
05-12-2024 02:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
Size

18KB
MD5

c5685f5fa36e213ec544afe808a5c387
SHA1

4fbe82fb179833630c34f1581ccc40d1973513ae
SHA256

efbce4ee31209150bb8947ba3452051b0e0611c3b99d74add93e1dbc6151abbc
SHA512

cb4c11070a0d14f6785b07bf081acca5ebf972218c199cb8127ff8a8e3e59026b6485d4c2c40e1072f8dcb85496448b480a1cab4db007affbee38be4b4ff0845
SSDEEP

384:aebFNw4Pk1itKkpAjjI2YpdmLx00naNZW:a0FmBkpKjPYpMruZW

Score

9^/10

discovery persistence ransomware spyware stealer

Malware Config

Signatures

Renames multiple (2179) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Drivers directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers\gmreadme.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Ia1lo4q9htaIVqA.exe"	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\FileRepository\mdmbsb.inf_amd64_0e44beb9cebe5a1e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\F12\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetEventPacketCapture\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\kdnic.inf_amd64_6649425cdcae9b5f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmcodex.inf_amd64_f5594a2af66d11ab\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wdmvsc.inf_amd64_8666ee4da6ad6325\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WaitForAny\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_UserResource\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ks.inf_amd64_9fac168e1cbea90c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmmc288.inf_amd64_3e3f05a8a446e75f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netbc64.inf_amd64_b96cdf411c43c00c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\rtvdevx64.inf_amd64_7b972df4e09f9463\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Speech_OneCore\Common\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Dism\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netl160a.inf_amd64_e4cbe375963a69e9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Configuration\BaseRegistration\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_mcx.inf_amd64_fcbcc3807cbf63ec\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_monitor.inf_amd64_f02375bf47a4adb2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\hidcfu.inf_amd64_409fe85a7af72672\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmnttme.inf_amd64_edc94fc65bef3d27\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmnttp.inf_amd64_527c415254a7e378\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\net8185.inf_amd64_7a30f5a9441cd55b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wvmic_shutdown.inf_amd64_bce6891915e70bbf\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\MailContactsCalendarSync\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DnsClient\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetLbfo\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WaitForSome\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Configuration\BaseRegistration\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\acpidev.inf_amd64_0f7f041f33bd01cc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\bcmdhd64.inf_amd64_e0bae6831f60ea5f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmmct.inf_amd64_0f3268711a5b2622\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\spaceport.inf_amd64_6383331cfa0a32be\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Speech\Common\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_UserResource\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmetech.inf_amd64_bbd46500a9d0e020\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmnis3t.inf_amd64_9f214efed426c12a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmnis5t.inf_amd64_c6e181de81a59b54\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\net44amd.inf_amd64_450d4b1e35cc8e0d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_fscopyprotection.inf_amd64_9c108d8ac558a80d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\net1yx64.inf_amd64_8604d8a50804b9c1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Diagnostics\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.ODataUtils\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\usbstor.inf_amd64_2be0e52237040d42\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ArchiveResource\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_EnvironmentResource\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_pcmcia.inf_amd64_92be188847324ddb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmmcd.inf_amd64_43b149b35876b241\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wudfusbcciddriver.inf_amd64_a084e687a06b255f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCClassResources\WindowsPackageCab\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_GroupResource\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\TrustedPlatformModule\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\it-IT\Licenses\OEM\Professional\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Speech\Engines\TTS\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.ODataUtils\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmtdk.inf_amd64_9e49da794995b361\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\MMAgent\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCClassResources\WindowsPackageCab\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\F12\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Licenses\neutral\OEM\Professional\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_UserResource\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\heat.inf_amd64_b73306c081719f1f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Speech_OneCore\Common\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\MedTile.scale-150_contrast-black.png	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarAppList.targetsize-16.png	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\GenericMailWideTile.scale-150.png	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsAppList.targetsize-64_altform-unplated.png	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color48.png	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSplashScreen.scale-200_contrast-white.png	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Images\SkypeAppList.targetsize-16_altform-unplated_contrast-black.png	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\StoreLogo.scale-200.png	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\VisualElements\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows Defender\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\MixedRealityPortalAppList.scale-125_contrast-black.png	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\423x173\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\FileAssociation\FileAssociation.targetsize-64.png	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\ExchangeWideTile.scale-400.png	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\SmallLogo.scale-125_contrast-white.png	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-Exchange.scale-125.png	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\AppIcon.targetsize-24_altform-unplated_contrast-white.png	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\chrome-ext.png	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Viewpoints\Dark\IsoLeft.png	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNotePageMedTile.scale-125.png	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-256_altform-fullcolor.png	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-48_altform-unplated_contrast-black.png	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\BadgeLogo.scale-100_contrast-black.png	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\LTR\contrast-white\LargeTile.scale-200.png	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderLogoExtensions.targetsize-32.png	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\zh-tw\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\StopwatchSmallTile.contrast-black_scale-125.png	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteAppList.targetsize-24.png	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-40_altform-unplated.png	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Exchange.scale-125.png	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\images\themes\dark\rhp_world_icon_2x.png	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\themes\dark\Info2x.png	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_2019.19071.12548.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\PhotosLargeTile.scale-100.png	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\AppIcon.targetsize-20_altform-unplated.png	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File opened for modification	C:\Program Files\7-Zip\History.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_MoveDrop32x32.gif	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\AppPackageAppList.scale-100_contrast-black.png	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\Office.png	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Collections\contrast-black\MedTile.scale-100_contrast-black.png	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\reduced_mode-2x.png	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-CA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarLargeTile.scale-200.png	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-72.png	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\AppIcon.targetsize-20_contrast-white.png	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\uk-ua\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Locales\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\node_modules\reactxp-experimental-navigation\NavigationExperimental\assets\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\RTL\contrast-black\SmallTile.scale-125.png	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-80_altform-unplated_contrast-black.png	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailSplashLogo.scale-100.png	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-48_contrast-black.png	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\hu-hu\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\Programmer.targetsize-20_contrast-black.png	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\Blank_PhotosSplashWideTile.png	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Google.scale-150.png	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-Yahoo-Light.scale-125.png	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\Glyph_0xecd1.png	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-125_kzf8qxf38zg5c\Assets\Images\SkypeLargeTile.scale-125.png	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-72_contrast-black.png	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\WinSxS\amd64_microsoft-windows-pktmon-setup.resources_31bf3856ad364e35_10.0.19041.906_en-us_ca7e56b472110487\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\ImmersiveControlPanel\microsoft.system.package.metadata\Autogen\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-d..dateagent.resources_31bf3856ad364e35_10.0.19041.1202_en-us_bbedfdfa3e939ea4\n\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-x...appxmain.resources_31bf3856ad364e35_10.0.19041.1_it-it_243282bb8b9d0cae\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_netfx4-globalserifcf_b03f5f7f11d50a3a_4.0.15805.110_none_d855bf5f765bbfa4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-textshaping_31bf3856ad364e35_10.0.19041.264_none_034dd448b05af73d\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-virtualdiskapilibrary_31bf3856ad364e35_10.0.19041.1266_none_622873cfbda33994\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-rastapi_31bf3856ad364e35_10.0.19041.1110_none_8e04ff5b636ae4fe\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_windows-media-speech-winrt_31bf3856ad364e35_10.0.19041.264_none_fbb15bbadd313556\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-m..agnostics.resources_31bf3856ad364e35_10.0.19041.1_en-us_e308aacf5028c5bc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-n..lperclass.resources_31bf3856ad364e35_10.0.19041.1_it-it_d625a751877c3fe9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-pktmon-setup.resources_31bf3856ad364e35_10.0.19041.1_de-de_f959fff6c3e1afee\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-mmcss_31bf3856ad364e35_10.0.19041.546_none_3fe6283b76ba3929\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\Framework64\v3.5\de\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\WinSxS\msil_system.servicemodel.install.resources_b77a5c561934e089_10.0.19041.1_it-it_b372539d3949fc74\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\wow64_microsoft-windows-miracast-receiver-api_31bf3856ad364e35_10.0.19041.746_none_f0f047a9abed5c0d\@WirelessDisplayToast.png	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-c..ngshellapp.appxmain_31bf3856ad364e35_10.0.19041.84_none_24f8aafdaceaf0b5\Square44x44Logo.targetsize-24_altform-unplated.png	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_es-es_12451df02dbd2879\403-19.htm	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-m..ds-ce-rll.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_668cc68db3b29f61\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_pcmcia.inf.resources_31bf3856ad364e35_10.0.19041.1_en-us_de7e3bb1542b73c9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.Resources\v4.0_10.0.0.0_fr_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\Framework\v3.5\1031\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-eapteap.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_26f54c743866e1dd\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-n..orkbridge.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_3479a33a02882d80\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-textshaping_31bf3856ad364e35_10.0.19041.264_none_0da27e9ae4bbb938\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\it-IT\assets\ErrorPages\PhishSiteEdge.htm	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-netcfg.resources_31bf3856ad364e35_10.0.19041.1_it-it_7a8f57b98acf2246\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-ui-shell-component_31bf3856ad364e35_10.0.19041.746_none_2b9acc2d69574796\Icon_MMXresume.contrast-white_scale-125.png	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-security-spp-tools_31bf3856ad364e35_10.0.19041.789_none_2dbefc6b526e20cf\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\INF\.NETFramework\0000\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..ylistener.resources_31bf3856ad364e35_10.0.19041.1_it-it_aadd57ad4ec24504\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-dpapi-dll_31bf3856ad364e35_10.0.19041.546_none_60324d60a5ae9b6f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-onecoreuap-wlansvc_31bf3856ad364e35_10.0.19041.1237_none_c1f72037dbe6e58a\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\diagnostics\system\Power\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework.resources\v4.0_4.0.0.0_it_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack-onecore_31bf3856ad364e35_10.0.19041.1220_none_b3135167d481ef01\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_netfx4-legacy_web_hightrust_config_b03f5f7f11d50a3a_4.0.15805.0_none_49a4a0799311c22b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-onecore-e..taprotectioncleanup_31bf3856ad364e35_10.0.19041.789_none_b38221af158e5881\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\WinSxS\msil_microsoft.jscript.resources_b03f5f7f11d50a3a_10.0.19041.1_de-de_d0c717e4b8f798b5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\WinSxS\x86_microsoft.web.administration-nonmsil_31bf3856ad364e35_10.0.19041.964_none_4a33e5ca375ada21\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-m..nts-mdac-rds-ce-jvs_31bf3856ad364e35_10.0.19041.1_none_17aa85fae1450ea4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-volsnap_31bf3856ad364e35_10.0.19041.1_none_151b030c40cdc642\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-tunnel.resources_31bf3856ad364e35_10.0.19041.1_en-us_2ca672ad082808e6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-ui-shell-component_31bf3856ad364e35_10.0.19041.1_none_03928ee4a9e5894c\RequestedDownloadsLargeCloudIcon.contrast-black_scale-200.png	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_windows-gaming-prev..esenumeration-winrt_31bf3856ad364e35_10.0.19041.264_none_35f854e9a12ee0d6\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_c_fsinfrastructure.inf.resources_31bf3856ad364e35_10.0.19041.1_es-es_59c13f1a509a2763\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-onecore-audio-rdscrossvmaudio_31bf3856ad364e35_10.0.19041.746_none_32acd44767b3fca0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-m..nsettings.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_3dc0a71069392b70\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-ui-shellcommon-core_31bf3856ad364e35_10.0.19041.1_none_91b1f58702057373\SIMLockToast.scale-100.png	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-o..euapcommonproxystub_31bf3856ad364e35_10.0.19041.1266_none_11d8442069dbdc04\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..xperience.resources_31bf3856ad364e35_10.0.19041.1_it-it_e1f063e51d144821\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-m..-comm-dll.resources_31bf3856ad364e35_10.0.19041.1_de-de_d504cc4406eb6c49\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-n..s-package.resources_31bf3856ad364e35_10.0.19041.1_de-de_a929b7a9500e8590\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_system.data.sqlxml.resources_b77a5c561934e089_4.0.15805.0_de-de_609d19f444289605\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_system.diagnostics.contracts_b03f5f7f11d50a3a_4.0.15805.0_none_92c3aef55272b339\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_wsynth3dvsp.inf.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_66770f32681090ac\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File opened for modification	C:\Windows\Media\Windows Default.wav	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-onecore-u..itefilter.resources_31bf3856ad364e35_10.0.19041.1266_en-us_b648a623c9262c3b\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.19041.1_pt-br_a28372437bff6cf6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_it-it_2fceb6f1060351fa\needie.html	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\WinSxS\x86_microsoft-windows-photoacquire.resources_31bf3856ad364e35_10.0.19041.1_it-it_c8b69cfab86bd47d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..mcomputer.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_3b21483effdddb5c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_multipoint-wms.controls_31bf3856ad364e35_10.0.19041.1_none_d3dfd4d2962fd541\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_system.servicemodel.activation.resources_31bf3856ad364e35_4.0.15805.0_de-de_b57ea66ba07b1d1e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe

Modifies registry class 10 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QZQVAWHZBPQSJAP\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Ia1lo4q9htaIVqA.exe"	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd\ = "QZQVAWHZBPQSJAP"	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QZQVAWHZBPQSJAP\ = "CRYPTED!"	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QZQVAWHZBPQSJAP\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Ia1lo4q9htaIVqA.exe,0"	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QZQVAWHZBPQSJAP\shell\open\command	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QZQVAWHZBPQSJAP	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QZQVAWHZBPQSJAP\DefaultIcon	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QZQVAWHZBPQSJAP\shell	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QZQVAWHZBPQSJAP\shell\open	c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c5685f5fa36e213ec544afe808a5c387_JaffaCakes118.exe"
1⤵
- Drops file in Drivers directory
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\aic_file_icons.png

Filesize
50KB

MD5
8eccf454bcf0a6225797fa2563b852db

SHA1
3456f190cb4d8d782d96fc72f6de97016dbce6b2

SHA256
85055e786ef1a219041f235bf223051f871824b5c9639d181c0888fc10f50839

SHA512
d8f8f7501c1e7089d12aab8c1eae22cebc7f3d271ac57388f1f12fe1856b90b200cb1fbfaa5470d34c6c296e814881a016de9ff53ede7aebaad38e7a651a6589

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions.png

Filesize
1KB

MD5
03ed1818c9add97cc0744dc2d5e885d8

SHA1
452c2681ec03c2046213aa9cb48e0304a59e5ae0

SHA256
01755d4ee479d7dbe72eb994a59385728166cb2d0931812c6180d6791f123af5

SHA512
ee6fb037b69fbcb0e62164a74e9a8fc19d7396a2b89aeae97b4e9241d8d34875607e6a667d8874644951e41065c0113dd7ec76259a136b5055b1fc4676c9f8b2

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions2x.png

Filesize
3KB

MD5
12cf24cecb687d8daf068a4f7e801cde

SHA1
fc99aa8e415ab7049440717e7d9fbcb4aa3b787d

SHA256
cebba24adcc65763ef4bb4b1f11a06830cd9640589fcdcc729e33287ec410cad

SHA512
09ab58aae66831815d22c7799aaf9f7e0a3182f3101d11e0e9046fc691acf6d6003e575b39791d1c5cf5173db0fe41a10ce9e410d62d970693001fd084880c1d

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons.png

Filesize
683B

MD5
28979764b645d6be93b23d8750e1d958

SHA1
095aacd17e95f30f2765c2eee1848d80839286f5

SHA256
f024bb141b2a7ce63644f89becd233a6e244a2cb934918d3105ad4ac28e2710a

SHA512
a07a32f50706155a4f2bdc51e1dac45f162d5a2424f142fef1fbf87fcc80cafa0c37119dcb1c858f6f461bf44cdde7cee8aaddaa3482e304237967f0d2cb8f5f

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons2x.png

Filesize
1KB

MD5
e247e9871af04810a40be9fd989ef7f2

SHA1
ad07871212c5f62958815b141705ae655fe57279

SHA256
0ab4c3db3f0fe5d8a20ffb9f16077dacb274c53caed175a89f0dc6a1537c5c85

SHA512
fb03a1682821239fe098d8371e7624f26d30fd19fa581eedbee953640e72382e986d334e23a52bdfe275cb521f8286f4b9b3c3c1f600b5975801c1dea56a0bf6

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon.png

Filesize
445B

MD5
1c06dcd350bb629f074af158d307e3ff

SHA1
30d8915abb916529a9752a187e7c98eac9b19434

SHA256
0248bf247369ec4623e8e49fb54260ba80eae36ca78dc2ceae38c089ba6afc9c

SHA512
0906023c823f30b16b731381465b68f091e5661872eb4a0c29009984e62c42c6ddf9c8c50bc482c4127085a08f1de3ad48372925c32047e5a8d71de063a1223e

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_2x.png

Filesize
611B

MD5
cb91f8e6b0e71fdd3173a7d976158b13

SHA1
00f3640ff18bab51b03f5c26fec9068cf5c231b7

SHA256
cb62edb0d89455dcf4c8652931bf26b78d9ea557433cf44e3836331dbaadd957

SHA512
eb61f0f4f85e33fe3172966577c88c2e7de619f8e88f57bf724b868ffc0782665338860bc3a7402e6839f34d114705f9a91312c03d4b05d3d04edef626d8f2c9

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover.png

Filesize
388B

MD5
ff92cdab4302c748d0a7bd480533b202

SHA1
23e085f23153111df2f2e9b34ea59ba8e79c1350

SHA256
69c90aa1333e834488afc6376e09332a3a2b8d1d66d057edfb2527abd86e404a

SHA512
5d84c3ccb7061a592618a672e83943e184c50f6c7f7c06585a52a9f1d1639049bbf8246f954f5b4072feb136c2cd2ad37da57a4d80d21832b8342dbfdb4d961d

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover_2x.png

Filesize
552B

MD5
9b7b9924864162be98d76ec7cc1607f5

SHA1
48aa67532a028ad6c033f038269f90950cd3c020

SHA256
e775e0d0a6cee0a1eb9f3326d9cc83d287746bea96fb469d1d68f4adcfd2df97

SHA512
92f6071700968ac5eb94807f07bd2441a34d58d35e54e30360503c3594e612cb4d8709d62e4c93d053ae5ecfd25422ae0d97c30ed09236f8d8cf03139dc4e9b7

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon.png

Filesize
388B

MD5
f04cb27db70385aaabe6bccaa9c56b48

SHA1
7b36b711034e827b4756e3a9ae2276d046775d33

SHA256
32898b62f712aa1625f183813439a72cc6a7249df57fde5cb269b45e9e95aba0

SHA512
c1809f6a29e643aefce902726147395a93165e93ea6a398e5e16c23ebc0224a192708edbc58b6974c3b31e394f77a020a746d89d314846ef6bbcc53939181b51

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png

Filesize
552B

MD5
2b37cd8b00a8229aca8e3f15eb9e2b4d

SHA1
67b1958fa1aaf7bdfcc91d492dcaa1d704e102dd

SHA256
4bc36d00b137e27cab07dd540c3d98f8ae0de5d6e4355a5cdaa0cee4603712ff

SHA512
ddbf3ddae6846e3c063d405b0d67eaf1e2727a4b370bc6cfb302f8d567263ea23f3cda8fc1810a53df47acd5192b22034942c31427bae370872f17c030c41fc8

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png

Filesize
388B

MD5
e07da5125a623b91398e0f3bea4c7f1a

SHA1
d1150e3fa27f3faa11bd12a8009881e3ca9e45c2

SHA256
c4e865287c1b6cba473f729036cb04c609c636a44202f90a95de3cf03c036f28

SHA512
47909ed1c0edfafd9492f9d971ac3ba71048f5b2159e0a4dab3f4bcdd9321648945bcd9c43affa0d1d68381f068c1bb688a19a6ae355bf2cafedc944e3303772

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover_2x.png

Filesize
552B

MD5
ca9c994a25b50d8b249c02197c4f5f67

SHA1
3efbba358c7e71942e3e1479a76a43bf416cb13b

SHA256
13e108f8a328765c0a893a0e86a79370312965d54a026279944641114cb62162

SHA512
783261cc8d49cd5571cda3ef05b47530ac0fd40e277ad104e9c55ca37a0cd82068ebab4cb05259724b8b7f120bcbdb3ec79dfc447f187ab5f9463d77250cee61

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons.png

Filesize
7KB

MD5
929ee4745808d082231d03f79c642bad

SHA1
bb53b31f02679885dde96f5b0f2b8e43898ab917

SHA256
894a6218da0cbed1a9d87a6c49d556927b0f7093dd14dcc6e36b236051a2878e

SHA512
7f14cd9a84ce589a7ee1492e454cccafc79719a78dcfbca975b2d033bddb47c81aaf6c11ae43c3ba76b4605c059670f4ff41bdc52f5428a6616901ec2768cdeb

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_ie8.gif

Filesize
7KB

MD5
738b064ac39e1c0112f874af492689e5

SHA1
4ee59b6b0acb1c05aafc2c9bf7a4bd4e9f190774

SHA256
5ea79b2b88127aaa06e7b8cb9eb690ab613900956002858a5e07ff00c2bad449

SHA512
73e95310cd8a2ff1e92431d8fcba5c33095d1866730baaf240a88898c080abb332412ed316c4a02953f940d8931f6e65fbbaee178b2325192db815eaf2c995be

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_retina.png

Filesize
15KB

MD5
7ba5d293ecd6fa1c82f183bbce255894

SHA1
55010346602721587a0add778f0593464a4e09ab

SHA256
b863e9d86eb793838adf373a963b306beb30aca4ff1d3d7fbd457f5ffc283582

SHA512
13b989e0114682eb7b44a975e90b422f7b497d6b8bd989f7d658cdebe2fc889813840aefeb849842577e3936b64fbe341a94c358ee3313919224f6e9c407365f

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons.png

Filesize
8KB

MD5
18fe601d58756cf01b2635ed4a6ef339

SHA1
fbad1ef4186f671c4632b13eeb0b5310430c8f63

SHA256
7d63d7253f0e4c1f2b7ffb5389441f1b6168bb9f374bebf6666e27a8ce722676

SHA512
dbc7d738acdf63ff4eb91858b4adc566e82daf902b384db7707eb5520c4dce6942cb948d2e8de165e9e85bf02ccaaaddd1d0a382a527f7fd644fd262fcac096f

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons_retina.png

Filesize
17KB

MD5
dc63c99dc296566718717bb2657bb887

SHA1
c1d1bc18edead8a6960eff54f4bb45b81bd8d319

SHA256
68c108ed6d930b7b3b534cf82abd57ef4237dc5ed91dded8400ec4effa6de033

SHA512
1339db528eb5c0c2ad852d662fab6d5ec54799c500b21b699ccf5dc5d35d4990892aeb4cec1718d32fbe3b5903dc65f92a03da46273db024e2a1cd579fe0e44f

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_pattern_RHP.png.EnCiPhErEd

Filesize
179B

MD5
819c3acb788dc77f6259f9aa8321960a

SHA1
5347cd7f86d2ffc86227e9a1a58c164ffa5c87fa

SHA256
8a378e388a539ede9e511d383c226af2198d79e526bb8921d0a10dd30dec856b

SHA512
b54f1e60fc2aebea9a36e664e75a9c44c143e78a30534c43200f705b4c590f43d062ab65f7e738bd7ed3d4e514d8a588e182f34d67f39f16fd403cb58d7b065e

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_patterns_header.png

Filesize
703B

MD5
09543a08e4c845c84e00f533f3466902

SHA1
cfccb2bc55911051d512600ea8fbedd58f8e946c

SHA256
8b99d1fed26da5c3691373b230450c6b134132af6bde4d63011bb6c48ea804ce

SHA512
fe32778eaf2b778b664b6587890812e615468b45a5f8178c9b68b432e8869004debe822f819c72bfbc3447a1122186054dceefc7b04ee4b067a6b1544408be5e

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations.png

Filesize
8KB

MD5
c780089ec824a27cfe00f77d2cc964a3

SHA1
9a22cf075c9b0e15b9e20537697ee5f8bb4cc83b

SHA256
e84eb81adaa41e40b5bf931008570459b273eb4863e893a6f9c40120368a4385

SHA512
174183f2699452fca3a061a5362b7022fabb2e748e8312597b1b9d4bef09baa8709d18309bd5b0eb036cfb1c564dd1d97bf24315d2872279ff47fc6fab6d3bb1

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations_retina.png

Filesize
19KB

MD5
cfca1928a28a6b80d4b0af21e5372a8d

SHA1
9982198afd297155b2ff0413749556a487806065

SHA256
fcff8bff7e7848a640f7371aac8334f97a0bdfbeaad54655fd9560ff9ad4898a

SHA512
6c7f837b34f4a2169b2d92be658de0d1844f7a0f002432c9dfdd040f1f99733ce4fc779bc5b31584fc4e6386d415f6b646941790cef586d6a1f7034a7d8059e1

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\faf_icons.png

Filesize
6KB

MD5
2a152a9449aebc73083ce7457ba4101b

SHA1
c318333d69f8d2ad8ea20027d6a20b5316b587b5

SHA256
e7e6a55b8b98252c8227a76d4af0c733099a504ebf745b16cbfd0a8e531a825e

SHA512
de8b2f48e269da7ee2b153c97b6ccd9812152af967ce6ad3a503cc426209616869f0b1311eb4806b20ebd5cb484ee29c8f3c1294b10b1ef78bc58969497c2685

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\bun.png

Filesize
2KB

MD5
f3a0122d116b5f39db5ba331d2c30fa7

SHA1
9bc76ad1baa880c2763018418db209fcda6c2252

SHA256
2e8a9e9e8735bf07cc514a19a422f9b287287133cf837189b1c454f5b0f3b425

SHA512
03193a8f9f899a5a0f230bda05eb896dcbb9d9c239c558d643a65472b2df745c1ee98914c3a6c24d13994f0ed553b6f7e2dcadd2080af8caa0960b43f6ae36eb

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview.png

Filesize
2KB

MD5
58166a13cfeb77edc5941b073b94c6de

SHA1
5d30a7c36891ebcef7ea69e3b4c3f89405cb4265

SHA256
a0f4d5ca4e316dd6931e411b410c30e858ab0d7761061654332dc860e8e03d7c

SHA512
94d5155ada5523e64c171d11fb29749c77c8c14827041315eb0712df5e59322402ddd023f7343418747d13f4288e0e3ece81417b407e3475ddba881d11cb0fe4

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview2x.png

Filesize
4KB

MD5
af19bb3b209bf71ce41391f18988d6e0

SHA1
9026f53e78d1195e8536d9cf9f21f788bece1932

SHA256
a28c0cf2d0edbcd3f5e5f52617dd5c96ce821d40fd17d698d2d95af8a0b67814

SHA512
a646734618b1746afe62c9aaed192b7006ad857440623a40a6a9d904d3f13ebfbf45b33a9a0ca5c1ba5efa6c3e7b016812fe0da5e3fd641a85186871b224f8f5

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small.png

Filesize
289B

MD5
ef1abd514ca194a847167706d42a428f

SHA1
86202fd67e2054b56bc5be5d60a6349d39928ff9

SHA256
0da3f2e8a629918ff2d12f4d42f0dd98e75251283dac580d72b56658490c933c

SHA512
1b863d955a5eff7b5b40e0c038678d5db30c037dbd264394442d39213515a25b3ef1dac4d7198ea28a21b19470a36aff831f34a28bde415babe933872567e244

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small2x.png

Filesize
385B

MD5
5b37c0b789143556c3c6c380bdee0658

SHA1
bdae4c9d5223b09c9a2e8f89dce59ff45e615b6a

SHA256
b069e91b5ef7615494abf548287b2cf544f52093ed2c5991d2ba1e8a4414e3c9

SHA512
8790d7236be0e27fd852bdc212c237aa547a1e11cb65a1389c2a2e7a828711584fbbca28ba2b3b4011c3b233fbcd85d92f5793fc05114c9c4b7b1a0d2cdce640

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\illustrations.png

Filesize
4KB

MD5
1886f3087cb046c14ddc047e7dd3dd99

SHA1
d40f56c77124c90dd653cead1179184ea8142b39

SHA256
cf1959bc386d76ae60cce17b53a6001a82cb1f349687504c3b777e73b251139f

SHA512
51606061432a8b2fc2099093b59576423d582518d363f574191451ece94b898be36f4bc4dc2021d22add56e3c26892eaef4c6e960d1df75ed850bfdd3f0d306a

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\nub.png

Filesize
1003B

MD5
1e5da890ed24cf0ed88f825ea0076648

SHA1
3b1fdc6ff61be29650902bb83d919406019dacb0

SHA256
5384e7c2ba524badeee07c01e428d62ffe2ee4ea67c8ad18c01596f02cbf0ad0

SHA512
384f3955f2a47fb20efa8749b9068cfe0bf996226a5894d06de7bf8635735b395addcc69514b6b49b33306e1f1a11933243f1e15da53bf715a8b6d36f9daa7ab

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons.png

Filesize
1KB

MD5
251bf7aabbab3ab29ee06d04f0c290d2

SHA1
1fe2c19d3b95ddd24691d09aeb5dee6fc27c0f6d

SHA256
e932ac46e2795cc6f873d038031c1920e86bdf2992f4211ba2a4414c6e8f9a54

SHA512
62f44181a9ea79c596bebd82dfbebdc9d66d90b1e05560325f8a37c66384655eb42b3dec92ac3aec736c6af15f2eb9e314b0a31d0514f767498bdcef59c9f460

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons2x.png

Filesize
2KB

MD5
a532c79c137c0dda2f46deac931ee02b

SHA1
342a89a7663d9abb9ada17d097dfc70093418a71

SHA256
162a61fe4ed140c8e475c2e9aa01c1514d6019639c7ba89adfe7abf124688a7d

SHA512
91c784fa7b8cde99837c889f3d85c20af899483d2a179c7d0b6877be2cd29b9a3239a6069ee1341330acd6ac4d0c81698e2f7c1b5368e8f5865ad79b3702ddb3

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adc_logo.png

Filesize
3KB

MD5
cc8441dc3dcb241e5c6b35eb01ceef90

SHA1
be9c87fb1488a4da481046284cdc762274db5885

SHA256
eb809d330c7484e3376150bf4557c5b3a2061c3156c04c5efd16c7cc47d36f14

SHA512
2f6eada5ed5debe25aad3e69c9f63b3946eb5d948c21943476e8484c0d27e656922c6049c4068690f3a7e7673cb075ef2d4375cf944772c32435b7ffc5365bc9

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adobe_spinner.gif

Filesize
556B

MD5
16db6e3c30bbb5acf4d53cf63670e80d

SHA1
d9bc374aadb52131d1d590fa68da2833ae056454

SHA256
e08187e282e6b2c6d7a4c3988a3693400b8b2570424a24745110f99f6618f16f

SHA512
2c3e6508cad4a4e9e560b52c66dc28d463fa91b016e563da32fde187477ddeaeb788f5cb2cb4eea8a21c756937f8f4f132db3d09331ddfc89156b092e1f3a211

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\logo_retina.png

Filesize
6KB

MD5
09ecc67da119f9aa1530001f818ae084

SHA1
1a5dd17d8eada2ecde91e9aacf62eed051a788c8

SHA256
c04458320a661de914226c3a8e8341d2db4903a4187ec259b2b30f3ded1d8617

SHA512
6029f00767974438872c60e4230c3dd5fc7c0bb28f41e0643bdc88898ae8aa96d328054de41c61aacc9cf6e43c3f89169b9ef27207925973d03cb524393cdc9b

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo.png

Filesize
826B

MD5
a57a871432b2d099d0e20f1c7e201d2a

SHA1
5a191848011db39731c0027986cdd1b4ed23e6e7

SHA256
26d20479a349a9a5197987a8d8886d3b184d09b55e1489fc9083c782e696dafd

SHA512
91113fbf4682ac211ecdc1b6e9f88d96a582ed19c0b1c9c87ecb55a3e76cfdaf34411d0d092f3c102c364cb8500366b7d826b3a9aea9c824b72fc4bf87d834ee

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo_2x.png

Filesize
1KB

MD5
77f01829d52a7d8d788ac59ded0e0e0e

SHA1
22e1ce8c7c30c5eef163c456b5bf928e1ae7e578

SHA256
030383bf79aa5c1ff123c41ecbbc565c11bd0369ffcae3df3ad39acf2cc8b02f

SHA512
31c049514c6d2421cd71fbf879f7042e955556585b45697f72885b7af7e15fdd4dc229abd98bc29aca3853f9da651c3effa56dd40d5a303f58426ff4d3f88080

Download Submit
C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB_EURO.txt

Filesize
32KB

MD5
a1ece3d757f36d5c631ebcddeddcacb6

SHA1
50b740d4dc597ad945ef8025607d2ef0c42dabdb

SHA256
63f53612b86538cdc41aec681877b2cabd3ca5bbf592f209dad9cfcef42178ef

SHA512
aa2c846b59546c06a8f84d30d1b3838c823461e572314bb191e82ff5538c19bac03d25d0cb2453b709a75a1f7276e10ee1859aec3c01e7c1eba1da2b782b29fa

Download Submit
C:\Program Files\7-Zip\Lang\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt

Filesize
298B

MD5
6c176bc43468e6a76016bf3048cf380d

SHA1
4bdb98e2e0c4dbdbf272fd042214c9b9344cf271

SHA256
72a527578ad30c229e28007a2fd017fd9e0a486b96817f823073dec895d038f1

SHA512
1ed9603b56913c85168f536af5c0941363b479af24856c8c84bc036c92348cee1b213aca76531f26b29cccff4124f312fc30d9772d208678e568d5a803c4dd28

Download Submit
C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif

Filesize
153B

MD5
b12f2d1baf1286b5948f9a2b007449fd

SHA1
2dbd647806eee50053103f50534ee55b42ba7cb1

SHA256
2897922edfbe123ed3055f2929e1be8d16989b79860768444bbe044d13b5afb3

SHA512
6a8d6fa9390ce7df4b2a5b8fc0578eb4ddb04c98f4cec4a0cd88a9c4c53f53825ecead47c2a7f4b4f4f008b0d709e035c771eeafdbbbd578d1fd36873636cef3

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt

Filesize
190B

MD5
799dc2240e3e9739152c29bccd4a25d6

SHA1
b945d3f8a4cc66ea9f2b4fc7da998f31a550c791

SHA256
eba073c8002a4b53e49f2cb04422e1c7d7bd6f16fda240e8e26caf5b5f37de88

SHA512
8773020df2da25172f0cfab1dbe9db8a5b61db04df62964a8aa5188a930b9d664b5c8c96e9a8606240b94d3fe7d46b74ea8ec6be690a53e0d6de754cbad2da47

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt

Filesize
190B

MD5
82583d7b03551ad8f9974cbecf62b0a7

SHA1
7d0a16dd7c36673ca7c026dc7181e2a5d9bcae6a

SHA256
65e2098fea0114661ebbf3e78bea102b99319ee5e51a2911737e7347c3e34394

SHA512
fee589c2d7c45487a2a894d79153c648c87ed673e6d45b97b9c872833f3853fd817f41904fbfd94fc09c187dbac813774cb846c04f253baf43ba506be3ecee9d

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md

Filesize
1KB

MD5
0c4be8735298aed0f7b7af2485b9dbbe

SHA1
8c0470fa066718a20a4f2f4387a04ec3f0cd2903

SHA256
162aca02d3eda36c54a7e02f7a69139d0bbceeceeebe2e6d74d59d33420cadb4

SHA512
d12ca1c7efc6a910a5e9261118be46840e8cd0a3c7ee1e6ae505ad5c25ee01fd84e3cc3d4be7fafd93da6f7c661b125823442650f8e869d0517c0c7a358a79c0

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\glib.md

Filesize
31KB

MD5
c2274a2967af0023e6c857720dde2e54

SHA1
0adefc1d6a456af5f24d93a76e1003f2af7bded4

SHA256
cb0a7d4ae7e9f1fd4ff3bf885300dafc2c303b03b1d93ca5af125f51c2641422

SHA512
9dd2838e39f9fad5df8498e129d487561a0eb318e41d008738a6b5e7544baf34341d764e8b60601b62366e697293225a8cdee2a3adac0003fc1146b255184e94

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md

Filesize
34KB

MD5
8ded85e178d593e4f2b44d1038afb199

SHA1
3a8753fedead018ff6aa54a4a867e27bddc2d7e4

SHA256
6f79090de2a3caa139e2de351045010ce5f6590169de2571302f73c39f0ab7bd

SHA512
1293c888a808cdd5a624816ca0155dadafdadf2c6e7da2743c1209ef058c3bf44bb15b2a00e7c1e0575b495ccde01c658dcd4fb30bcd211f1ebcb02409535350

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md

Filesize
23KB

MD5
63e16126b3100022f3aa8d7ffcb552e4

SHA1
8d9fb42fd2a01c465b3d7dc8c68c51a9ed63b262

SHA256
9e41cfe9f2ad501ee1ca50c201a169852c9b3ee6d6001d6d06fd521f97f28110

SHA512
d1a501b11fdcedf121ae482cca9b85950d04ac3b514e8473dd78df49be18541cbf2ee1be15a5ca70a13cf65b38cd2243e1e6ea95dea67f4b68e2fc0677b32267

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md

Filesize
2KB

MD5
8f0ce7048c86559ee883ed30db719590

SHA1
22eafd48b67c2d10879b0f5a6bcb355e5e7479d5

SHA256
2e75cb4d61b315f796d7ea53d520224aa83633e509f08010ebededae4f7a93d7

SHA512
80a9b65d4fe40949ac980fea74a7b8e8fb0931601cb4e7f9e085e419bae8385cae14a476a308db7dd2e1c250b24db225caae76c24393b186f860744d3d8c39b8

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md

Filesize
1KB

MD5
421d04c3be83415f3c0cf74be3b1355e

SHA1
f16690dc42e2e11256f7b443c61fb4eeca5d3451

SHA256
aad7707d7cf5009251305bfd47609536f1df9bc99e67b06030354a5983ff9a71

SHA512
a3d94ab80f9d595b1e983fd02d1d3ebb3fc8c3303e9f2c74aeaa9b82d6dfdca0fcf2639c73f08a901f29bfed46f20c7077f660977447d0419880d175d2ba1490

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md

Filesize
3KB

MD5
a1effce0b581fd6821500f3e77e39604

SHA1
98b6fa301025bd30110ee860e6bf587505c761be

SHA256
9a1eb17c1d65bfc4d9acca61c434bcbfe49267c91fbfc7a791c06edb42ebffc0

SHA512
9908d5af850df84c20bccd4daed708d2b9e2cd484d2362344b86a675cbb24b989c10c4b2e5ecb12bf76d3299059fd5b905b16f68d1fb4e463669b0ee5605d2b4

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md

Filesize
2KB

MD5
94e3897c25b48511d9d79a687da89eb4

SHA1
63a8519ad5fb46959b2b6d0e5049b80e8e020f0c

SHA256
a98c81de5606839a0120a430d3ed2cb93c1c74756ae2455fe905d7644ebc7e0d

SHA512
ecede7f3dc1a7cd5e561d22c1cd5fe03c63ae07399c67f08a6a9ba8727578dc579176d998b903e58acb6536e8ad1223213f9abbe740e2e18a6ff7da02eda34b1

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md

Filesize
5KB

MD5
ee905f43e45a6e9233d8123817eab416

SHA1
86e22af791a5977d1d3b5aba68739403b8b996e0

SHA256
5056de066c550e846dcede8cc039ae1b1712a8cc31e0f036e3872dc897043934

SHA512
23b1b7111760251a6f8db33dfe9e95e575d01069478f21b5e694a5c41a838d67f7b2e00eef8da30ff2d7b2e88bd814f1b20f4e16949923e1df61d040cec6d2bc

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\public_suffix.md

Filesize
17KB

MD5
c7e777031c3ba350112d2a52d271f590

SHA1
2ad2c26eb59e7d37962c61cadc3e1745db630926

SHA256
53bc954acd2bd8295674f1a22d07ecb0b5a292247ba71bdc7c8bc3ab90597286

SHA512
fb25befb3988c62a01344c14e7bbefda24de1660db2d99aebedc1f0af7302411c59c4638808cd577f04961468c0dba6b4e14975755d6c2d9b3d7c10b38bf0bbb

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md

Filesize
320KB

MD5
f40f6901f87892e2b2769ea9964ae445

SHA1
3379ba8b98f04c7b717ce376b9a4c33365cd7665

SHA256
7e9661ea0edb2adf71f9ee133a44f06a15016faa8f7f2b245a58517691df2b76

SHA512
b9507f31686a7944b2d3875bfe1b83976f8bf623a078615106b613e202c64009d4ca88e44aaf2c6445d50429edd092173df676083562eb5bc8b9ef14aaf02e9a

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\asm.md

Filesize
1KB

MD5
e047b2ff711cb7777fb7afb205e28f78

SHA1
f86fa368a5d3be299eae69cddfc5eae7a3784f73

SHA256
54a3fb01fd5eb581e1497f5feb37188d605afef0b306fb82e8c0f08d89e2f6ad

SHA512
af993fe29934c33efa7bb0f79e2adeff9ff5ff640520aab1b5b22aebf46122dc6788b161dbfa699386842a69c40d269ef936b66f42d01f0225a3266993111dc1

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md

Filesize
10KB

MD5
19a83ea48030cce011e3dbbc0b708a61

SHA1
f201cf355353c4558398d6ca1e568e45c6d897ba

SHA256
9cebc93542254d4f74984dc05dd32453fdc27a5d9ff12ac5d15e0d9ffba59985

SHA512
fb7a4df029d4123de1332e7f958646877f5f3823fffa6ef30b2a9c9260bf7261043e19295cdea0d411b4454f750ad8b4aa21277030f8f34db20076d6e0b99834

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md

Filesize
3KB

MD5
73f33a4398e714ce950568fb8001250a

SHA1
5d1a43e24e2abac06cc53224af2f7567105b7b40

SHA256
9fcf0621c1a84265e8185179c16a1773b4bae8dbd103b8fb93ea4399e14997ba

SHA512
79456a584073abe6a848a86a061d187d18a64930a40846a6166c07b1d170a2c3315cc036c0e74c900822aa3f6e89c77a88d0b5bd52bc356d62e7c02aa2471a78

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md

Filesize
162B

MD5
0a50f03bdf5d98c10416b3bcb8422be2

SHA1
9adf3627a5893206aa821e946ae871f436942cc8

SHA256
8f7599b9ba3ccb5d6d9046ddc3b88c4d63ae5b96060b04da7583637354426204

SHA512
b54f694c8130c254592b7301c36bbf274c63e2f11991a6b13fbf9010a9c44df6cbeb53b415e42303b35817c96679a15ed81e40f5bfd57db466036f2649c78230

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md

Filesize
1KB

MD5
0c861e16439bd6bed855ee0d3f9bd2e0

SHA1
fcaa0b55263025675ae9d433a231645bba16883f

SHA256
b2039874418fd52bd1c75dacd059ce9081aaaba0649c3c423309558b951a6cde

SHA512
e5737fdb5f9f9b9340921d9092100d4e7a36ed6efca834cd4d8ec9fa96c052c93bb9d725dd540c83a9930415724c1393e179682f6deb63d4f11420cc2df69162

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\dom.md

Filesize
3KB

MD5
60112ea516e41e45bdb0fe2b3011e7d9

SHA1
cc1be35d4168ba2abfdb4b7ab3f90ae237234895

SHA256
d22d6fd735f8421485d054b2c05e1993aec4ff62c4ae7ef4d403e0ab5991832a

SHA512
1bffcca612aaf2150c40306b2c71c9ef2a83027e70b734cad54ac5681205bb8e00f721d3b5478fd509408e251436218ba0e015b90caf70d2de047e17d3b15931

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md

Filesize
1KB

MD5
b5f69d2d9d1bc9dc15a1afcd62d013ec

SHA1
ffa4c504fda355f7b04de00a43dc4384c4c66972

SHA256
a4c61b88a5db0a0ee759a7ad3cf4a6d73204f846c01f960f25fb26eff81ce632

SHA512
c9bac10c2bc408be0bf43d61503c6f3b96cd346fa29930a8831fe3ad1477fc392b7bcbe71d0d0c7bb66d28cd4e87bbe8c26b0b14d52ec7b13255284edf7d57cb

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md

Filesize
28KB

MD5
b2dbb9c10416c06bbbd3d94eedffd292

SHA1
09f6e4cec81b0db925b60f82063e73e329244f4b

SHA256
16e8d1313c143a76efc3dfe3c67a96395b8b113e72404e8aff8f3c3b331d7eba

SHA512
cdcd5a01742d9fd38220151085a1c8cdd53a146005bf2f1164b17a09127e03f59ef38afda7e3e3df5485dc2db9139b04f807577cd80d837361734a0df2aab1b9

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md

Filesize
2KB

MD5
6b43c3144fdb9113ddb62dc31ccfe9e2

SHA1
8990cf5c5a1eba3e4fe5896dfbab79351c7e55d7

SHA256
49ee539033a88ab507e479791d7cb83791f5082762d4ba252d5b6c76bd090cc7

SHA512
664eb7a2694c69628cbef274c611ce5b18edd06d23fe18e8c0a3589a5f7353af4ace6969acbeae474e10f89e0359c3ce8e679299bf383b5ef7da02715f223fc1

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md

Filesize
1KB

MD5
565a81cfb46ede8d5275d30e570c02ea

SHA1
4735c34e1c7223d124742f48a2921cce56892cd8

SHA256
9d73b36e16ab7cd86312739654e36c6b13447ce5ddf500fdcd938532519f8568

SHA512
ee1cbc0db2af30841246d8e03cfb04fdd0605f5524cfcd2881c92e77ebd38909d8466daf25110b534eff5075172f1ce21548ed9f2bb64f0ab8120babb193be29

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\icu.md

Filesize
2KB

MD5
e796b59c5742afc00cf4649bea943caa

SHA1
a74d962ddcec7a80ab5d1d3275ab1d297cbfc00b

SHA256
7b2ca46b0fa206b5e3aff64c3ae593c88bfa44954787b223774470a070740ae1

SHA512
be9bf62200b8ef8cab13160d113feb98d57819c5af7d89780bf270172980b0a73a6d45dbaced880d241ca8365793cb16bdc8fb48393964ae178fc4839622dada

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md

Filesize
1KB

MD5
fcebf8235089ef78dd5f9e9bdd0deafa

SHA1
71c01b1bce6754b6a8d96bfffb075eca5f818f21

SHA256
20d6c37bf5ad30c4f17694b99a9da862a045330b6e45a82dffd986b2cae1c436

SHA512
f962d50e2aa4d83885f4abfcd6876bd38e00d74145ce1dd0a1e5e947102e89f072866375b2e538253d17d6de709eab13aeffc2a450f3967cf24d888ebcf3d591

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\joni.md

Filesize
1KB

MD5
cc9d5b0999c7a69bc9d7ff81511177ae

SHA1
4cf1f7965d04fb5c11250ae73fdbbb3727d25a1f

SHA256
61cbf18c95f5bd95df0afd2822f4f9bf08cfc76b2e0588414eb74eff9a1cd0ef

SHA512
9f901aefb3710b1def450b918f57aa6b645311921d7ff38182200610dc921ed43502b0b3a09f7de5c3e957b2a03a6db2d2b739ae03a9e118e925d3c2f167eac7

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md

Filesize
1KB

MD5
ed93f760620db41c16c42bc2a202562a

SHA1
27625451e384a24c66434c238b293d9f8e874234

SHA256
8e1f437e81da3d5aacdfa5439bd0d1fca9024d4e2679653c51b321d7d79ab62c

SHA512
3e87a8c380714b83f91e0bb80d67e564022f812dad46ade39f7bda2225b14024bc60b9672c01c3e20d45e82d756dcba12cb2a710a127686499ddbada4a59a424

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md

Filesize
3KB

MD5
3c33b76976e9e543c32a90fea0baf8c5

SHA1
f9ae3a21b493ab43a3c32bdfcd90cc0010228d2d

SHA256
8b23fa13896631af2f9647476a598e0a3dedf6209fd6ff50e911adc1ad504cf0

SHA512
47b25f40e6c7949a6fc88bb32328a656f7946e9fb23acdee3696b627e9c1539b5b410ff0aa28b8535487ad4c50383acddb61af7d573a655f025387ee552485eb

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md

Filesize
2KB

MD5
512dd44252c0faf51b5eba3a552e2b0d

SHA1
6260785d59cd8dab989bde59784f9bb0da59d856

SHA256
0adb6722c0e3ed16ab82837c6dcff56ad899e8fa98d357263903ba1177611ab7

SHA512
0813b55b042b0e1293d41fd826ab3e367b5ef216109929f16d3b9a495f9cedc67ca117e252ac8060c14c5be29c794c0d33bd54df4569403b2b8a6628eee293c1

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\libpng.md

Filesize
6KB

MD5
990df80ee245f35d4e0b99d2a7961d67

SHA1
f07d4a817fcc0d31c189819a9fcd43e756fd1a00

SHA256
362f7e5154ba03aab017a48c95f938c455cbd475898a3476fd143a2be90dea16

SHA512
232f458d047161f982329974c0582cc1cbefb3742f6ac6b93bba7502b015de1488f5cd5082c5541564c255f7023028880115dc4c897175f73a3bb713b6aa33eb

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md

Filesize
5KB

MD5
f80742b9e1c1c896f9686bb59dd3bb3c

SHA1
f69dc9b3fbf3a9606ef191013c866024c6a6e11c

SHA256
fdbc69aa14fa79e35a23a894651adb16abf691ea26095e3a3b078839595b50ca

SHA512
1eb00788fd9941de35b5e859fb5e9360c669a4eefc3b096353c94c3e24b4d23357809741fd91b098cfa594dde0e572aabb4458b901fec7ace51e210d0dcb51ca

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md

Filesize
3KB

MD5
c48d3375236dbcfc7508ada040f7b0b6

SHA1
3d370ea289a614b33b1d8e597d4d36dee3e98e02

SHA256
a0cede3a97ef33ee52292b7da7f57c849fd3a54bac102526b936da4110c1b5d3

SHA512
eaee7eff958db18b36edab67ceb1a576017c48fe1e55082b1920acc4da1d8c91127f88a6c4c9b481136f875f882314b5437b75362bdf9ff4ca1cb4535877878d

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md

Filesize
2KB

MD5
c4e0cebe1faf7917680b2b55b6a7d51a

SHA1
8285f1cfa56480418bf216a1d4cb8fef18ae2b72

SHA256
7f08c1888c8bbdbe9c695e8e5e82ad70e8c00cb3fbb81dc779392a0e6540d11f

SHA512
d40fe0d15b479602d64f334b74e29c5ef666f87fb565d5283a3652c94ee924789426766efce29605f67111a1d739f337e594f62e226eb34a57beac3dcd8553e6

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md

Filesize
2KB

MD5
4a900aaa73d440e174007ab829d15b9e

SHA1
466a0b6b1bd7f546fc274fb194d729e178779121

SHA256
f60dc81507c5254eba1a686c63ae0fc4d209a6d93879a353fa35285706bf7881

SHA512
b9ec80af5f36ad91b45c793f9e49a21bd46362b40b562d284350eacae7fb9bd0c9237087a39d8e5059c24981f3f1e7021c240db4c49ec3839926632d75f348c5

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md

Filesize
1KB

MD5
5675fb745e2861e2a21beed23a609756

SHA1
c939c5f0770e1311511c3de78d040acec58f41de

SHA256
e1b1f0cad2671cb6dd6ded67b3793050456a2187067d3ccaf7fe7b7fb6c9d247

SHA512
7c21797181cb8c34543eb5eb2b9d68da65aca05a428e4c167a2d11260038dec1b0f1a6bdf5798647c8773a168594e62c735949af3ffa71d4176fc2326dedf777

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md

Filesize
1KB

MD5
bbc7a3b857d1845be976119101f90b57

SHA1
ebdf45b33a5d1ab3ca5d9d712710aa51d23ef70a

SHA256
f0e6c2ac705a53c5187308b828885a680639df3c1a6bb83c9b3b33d29491e2cc

SHA512
8bb2667ca2c4916e8bbbac69bd1dbaa8cc030de93748aa06e3977fbb918d877687ab2c231ad33347c06bee719830c41408eb5f8ad4083714b7719914d2d7c2e1

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md

Filesize
11KB

MD5
a9176f84e0eaa6a03304f59e1d4fb128

SHA1
223f28e15149a926f14bbcb848b37b755bedc710

SHA256
1e5c6f70ed754cc87646fed591f802843507c19c4fb824848109abcd08a2ffea

SHA512
565c6a728f4c7f7c23b28ba10fe49aa9102519bd3a4b7b72f12ffb825e55ac1c3e1520630d20b95d2e6db7b798847c161d89cbd24bcb7d21f7cbf9be9299885f

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md.EnCiPhErEd

Filesize
1KB

MD5
d8d20fb809a5434952c8cf46f798be99

SHA1
92c35065a00ae3cad69974969dff2051a7da7ecd

SHA256
20cd7d663c81cecfb9c672983395a150a264dbdcd13572e6b8e68c5baea0e238

SHA512
e7ff939dde52071006ab1d856fc1f5e506adbe0e95204ff413d9ba1dd65542451afcc1a76bdaa70b12555f82d642d75b4f8661ccf38bb37dbbc4b4f5718fa33c

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md

Filesize
2KB

MD5
ced16eb729253c5d2fdacb5cf7572295

SHA1
665c885ec4a4f0b39b54474312d7d78cb2dacb95

SHA256
931b323a79c5ab653e3c0a2186e6bce7ef0d5ac26e025d6e9688aa8b16259af8

SHA512
e1dc316e2664f60f17bb064325d367f2a2b4e4cd5263c0331b8f43621d42bb12cf75e245a4db10ffbfa7ebba59e0ab7ddd76401bbde14acd5643c8234772d69c

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md

Filesize
11KB

MD5
2d687ea29ef67f3e0cc309ae56fc48db

SHA1
05178da06935caf627a3558d9ec8f36e7714b1c9

SHA256
fab579487fc3a908c8427f9999f5c8ce012722f8a4952c16799d68999ca43a14

SHA512
265368c2f454438111258fe57f5940c4bdf125f8e64f15c47c8d57467da2c3c18da7f06e766534fa584fdd71bb51350848ec1a9e007e0132569e4352cc35a1f8

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md

Filesize
11KB

MD5
d47d719285e5d8549bf294a494559b0c

SHA1
a3d1e196ad7742d20a369b294bc6c500c2067259

SHA256
60ad86801a417a474ba7ee5e7c87eac4b3c53e3c17f1e7146251f0e577849e8f

SHA512
67c0aa1655c8ff11a091ae9a787bde4b4df4092e881eee12cb381c07c225d615f32b0e87163e7fb16344ae5cc5dcc407b481caf8e5b186c6f1cbd114321444d2

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md

Filesize
11KB

MD5
a722e0530e8afc9650414d109d7e256f

SHA1
28d92b1ee04c13658cdd3f28c02adc1a7d53491a

SHA256
1321e7c4ba389738507b6d5028eabb6b5dd0c6be57bd4eb48e025bd08e1770c7

SHA512
800c2bcf76caa25b96f236a4325fcb57bb018e08c2d0817346fb0624d636b360f50d45623c9827720dfce0ccba110bc0a90a199fda5d5550e9212c02c52d73d7

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md

Filesize
1011B

MD5
33fdcd3a9cc6c2c5246ffaded5839791

SHA1
fa412bacdf926b6c5704bc8a2e8fcc51829b1775

SHA256
4d57e93d5293316c89f08df6e73dee637fca27863c1eaf1f30f73862f473865b

SHA512
f5e6234052081c9881d48d74a3f20a3fa6643762c2a1abeb14139dac3a311f2377862012bdd27a85bfdf4abbb9300b4bc08d20db5b16435f8af635a17b2f13bb

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727661992394667.txt

Filesize
77KB

MD5
7e119444f4330bf9a8bad09436e751f5

SHA1
313b1763000c53ac05b692b5effee745322dd2c7

SHA256
764e3befc4455a5f9c54cf6da292d89fec6e708f404f44e828433a7bca6bed87

SHA512
43b6326f97f03fdb8d4b6ddc09940473497cc9c316ad74b127e0e49f95394dae49a79b7a5330365224a79ef57c6851e2855c7e12df1ba486518019b6af1df69b

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727662487357744.txt

Filesize
47KB

MD5
a3d5acf6328f9291f654d04152545d57

SHA1
df1e2efce83a1e56c67877c2dc1ccba259b12914

SHA256
f9da767afd2cfa5dc54c0085a3178b5589f968c576b45202d3a73d45e1a82395

SHA512
bcc85a2cfbd062a8fb0418c3522838bdbdedd4de71492841d630f99d47c2a551e4aef5b47da00e37e270100cd88f58bd3784cbf70b9bbdb7bf93ebcf7a436226

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727667722373689.txt

Filesize
63KB

MD5
02cb8408be04c80dd5f672b9003a9cc1

SHA1
0c8c4f7435c2dc8e170db86a80238c06698ee246

SHA256
300083de1cd8adfd00d172c977c5bdacd59802e24ea36134b4b50a21dbfdcf41

SHA512
52d1e9d5248ab3596625884021438e9df7ceb4f8b432bfa1c04a2e76315228742e0ce4b6e70a9a1a66f5ed31f5647d0c3996f27e3386ec41ac1ee6ca584fdcc9

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727670771168387.txt

Filesize
74KB

MD5
e4dd24a64224908944a0d7d94f3eaf1a

SHA1
5bca30a6740f3ff457d4c2db6bb2ec27f3313a52

SHA256
3d1cf59634cae58ad33eb318a77ec33dfd3c4ec3263b3c8d946a634ba6424451

SHA512
0d4036b0c19eebc68bc15a9c32a233d8965b8369676d8525429e13cf8e8e0d1c22f8deba48dd14dea94f46cd6689b85d21c427204084eb26c657f3b26945d676

Download Submit
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\File Explorer.lnk

Filesize
407B

MD5
d191c1061cb81a42d5b7da6402c19fb2

SHA1
64f2adc0e9e2fdd2a8d2faad850e259bad91adeb

SHA256
3b15cdb9d1ef51d6d32291520e3c874e32eade1bba7ee1837b08f8f7e16e4fb4

SHA512
e14627e7d3846c2d03de24fee29932f2320cc40a7ba419dda70c31b2cee1b6e33a566e1292b456f5565f1103b199f160ed229354f3233c858ff77a49f2d2968a

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg

Filesize
21KB

MD5
67d6e37b1a33b03d5e0b4893170d7d48

SHA1
554970b2f6210c132a4035324c1bbac40c1ed85a

SHA256
c942243cabb15f135dec5c8468baf537ed02ec022234524e03713565542a82c1

SHA512
e98bd5c88092677f55bf740608df236c059c230990ce73ed9f617c13015288d233b703e90a85b63bd965726b0fd23bacd7ac98b6e3bba7498bb54d727b8a68ab

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\HelpIcon_solid.gif

Filesize
1KB

MD5
ca8959a130e36628f5a9bd1d71c67b65

SHA1
ca597387226cfa10dce5265fab22c7e62d02c3b0

SHA256
8ba6a0a6a16b22e4cf3fa0363befc223e723699e7b945bf999efeb7d6ecb878f

SHA512
91c641ca6a14382cff6449e429e8fde37f9b2ee1c4d208dc32953f65d95bb4629b9789330a8dc06c45c119def23f95e0bdbeb49ce944625619b71e3ef419a3c8

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\alert_lrg.gif

Filesize
952B

MD5
e4f44cf132f57bd3e6e3b57cc736b653

SHA1
e5f6315f593e27da3cae9b0b9f1ecaa67f239a66

SHA256
61e30abc4922f85343adba1b6ad2190e2e2c369ddb593c1d80e4ce43ab7879c9

SHA512
5a46f1b2e00a61cd9f17255ae04becc7d1e26c11868f747de38e45a367d7b19d96f1b11d90f371bc0b0a6e004f17a86196d5d340aee88fca00ffa76bfb616d14

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\aspx_file.gif

Filesize
121B

MD5
ebe871e58c820c1d23088370225564c5

SHA1
cf3e179085132fd9c1bd5509bc5c96589a712dcc

SHA256
f0778afab13e5c5285d979cc04e47a8c2f7d2eb26e5eb3ceccbcf7a7a87b0ef9

SHA512
39c4dd4b386a4d66d0430ffc8a4dd906e853926a21c25e64eb832ab4176eab460f6c9fd71081b98999eb30b8fc47e5f4737d79fcb64e1c4531a74d0618033c11

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\branding_Full2.gif

Filesize
1KB

MD5
89e873281a504e9e5e5ec9c15a1ceb5f

SHA1
ddde9e68f814912415f60fb93b4c886f2e9fce39

SHA256
22f0c2c8ea21c938555f90f68f58d9b70e26adb5efadc6993920f4c05fc171a4

SHA512
2e5fc350aa16f9d7f6a1a013d79cbe30b3b6dc863f5dc2ef9b2dada3584d8df27293d60fafb8daf96766cc2f71dc58fa694d29a7d033bf7f64fe44d09420ab00

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg

Filesize
8KB

MD5
ac9a7e0507f8b5b6de838da3f1829cd3

SHA1
d7e2a592ed862aec8c5c43aacd1ddd10f094079b

SHA256
ed9bd05cb2f543d4624b6e23a46137046dbe3af1711d27b595f8bd1c41e12e69

SHA512
9afb513cb8b1f1b284b2dc4cda42af3f9c7f602ab525fed2b1c64d961aabe758549696137b9255e0e43d512db7afd1dced9a7fc069b5dc48ab0b164a809e4956

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\deselectedTab_1x1.gif

Filesize
61B

MD5
72046d9ce2b319185af8e439624582f6

SHA1
46fbb2926f66469ae85f39082fb46dc868dbedfb

SHA256
fb5859c33f7084e9209e94206f2a1354c4c466e56b9c8bdca668229b2fc713dd

SHA512
17724e6706666ff62dbe233e05b299e52e96ee83685934702204a80c582df11fd18857adb2621f6933104c791450348d358b77150ce739cdd3010f0a4017585d

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\folder.gif

Filesize
914B

MD5
13eaa67f6fbc17a414ad257b1f99b248

SHA1
9cc5ef9337dda4a5ac22b7ffc6be53eb457d7bd7

SHA256
0952ebcac27ed018c65455971732a05631ffb7af4d220baa5f580899ec5c964a

SHA512
53233d201035ba24b2226b01af2e6e68d5f2567a3a6c08edfafa5ffb2f5d7b5fd6b992adcf810f6152b7a699cb074b1ce758bf3d75bedc501115c1b4c54a804a

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\gradient_onBlue.gif

Filesize
90B

MD5
9902de682556bf1f9969a6bb10712254

SHA1
11bce971681887d596f290b5e1b1547bc16588bc

SHA256
d5929cb8fc4dac64f710003ae8cedfe96cab665f38d15abe6994b1b9445fdba3

SHA512
5222c176941bd9c23cd49fe6e6b09f33c67d686e0d1fab8c06d50a6e598e108b41bad85c944bf06d71bdaead6c6df058834d1f50585f020fb5eee545b1038dd1

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\gradient_onWhite.gif

Filesize
90B

MD5
562427f3ce441108239e60812fbc6949

SHA1
6faf1ad32d97c283380c2b6b9cd1d268d5f8028d

SHA256
c77a62d9ea892ae86f8fbaa4e8bdcfb4c852baacba5abf5dc935b3eb218f79fe

SHA512
fe0b477401c7579d8c5b85ce9277a3d777e31672dc69747bb5a2dbc3c6aac4de65e9b230387534f6b703e8af9326100911c9cc3ff269d8c9d15b62117c7d82f7

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\headerGRADIENT_Tall.gif

Filesize
328B

MD5
b688e4bf9fdc9a675b553128998902fd

SHA1
4fbc1fc3827fda07a29bb4e3a47399f6665f7ca6

SHA256
ec292978854a76fc5254d34aa484b43eac08a68b836a8243fff43c91a43bcf8c

SHA512
d2f824b1068d097cd2ff2f5a54070f894de0d96506806006ca290ae5d7b4a6178abf93afa09faebf5cd26312246dc96ee9632820e344de3c9dae9f61e265574b

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\help.jpg

Filesize
1KB

MD5
f6a3a9cc5d5104a85177cdc609f6cab3

SHA1
69d3c95bb41e178b753f9a95c7cb9c499ecfaf8b

SHA256
face3139bb8b5dbf4c13e9128a462e2199b16da2c70d13137fd8c4e50b5f8c3f

SHA512
4656766e01e07fac455b4ac69d65f52f359c52787443fb8e44573b9bcf064ecd10d9298e7de5039f490ef5caa7d1dcd6940d07d7b097ca4e7df73f09db57cb9c

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\image1.gif

Filesize
162B

MD5
179edf0fd944014a91984eb56c66093c

SHA1
ca286205381ca13c85c318dfde1916c2242468c6

SHA256
1520fc2f604d54e0666cbe4c41b3cf4b427e7651a63e0c1359fb0639b3deaa4f

SHA512
98ab0d2b0f347ee8c9a1b58092f3adde7f3486f999c031d2ac225dd2e67f1570273ae554e5311360d6925125b550e78adc4697e621c1d73356e74e2b4862830e

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\image2.gif

Filesize
586B

MD5
12c78636409db92f39578b0743d69eb8

SHA1
ab1a0bbfdf97a61727643847d35a88aaefb8a048

SHA256
8842e3e2019c9b95018dc9cc350e9a09b0abeba4805bb63cd869df8b1b7faf8b

SHA512
7f70e03f5f37e9c5fca42686f08765b4314ff052219d8be51a6be199cdd0f3a560ef801da5efff3ce20ae02cdcefca16a9263f509755796143471d259e222cbb

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\requiredBang.gif

Filesize
124B

MD5
1f87ca4c0f92752bd8c75c0ce1033a0a

SHA1
a9c7f36dffd34fe4738ec4209124232ad08acf16

SHA256
4ec53e7e4f1b50cdd142e7fd1124e5a0d5648750e5674becf072351b7c8f287e

SHA512
d472971be12d284210694e585b301027b1bab3cd5bdb5a6213852c7ef5a6a802a320782a73794b27c23fc4ae801a6be4af0f723c2724a6ce7a3756ef9fa9eecc

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg

Filesize
8KB

MD5
8b8d3684466101c4202746d12072ea5a

SHA1
f506a750eec30ecc6d9a76d72d2044f35932db97

SHA256
0994c4b7314c4978048ec1bff878d311a19a0403322d9cc6640bf038617111e8

SHA512
45f1af1ec6c196c92dac90f027d4d27a983385b188fa0039dda482d7292a2cf3a145f4cdd279901e5e220d6a4756331500771db5b567a3f286a9805aa258bd7e

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\yellowCORNER.gif

Filesize
880B

MD5
c14b8498c99bb98f61422f033988c889

SHA1
1749937a397253e7bceb902a211a1fce841031d2

SHA256
2ec3d3675e954c1ede67c6d1a7cb1ab04c73efce9991e52d3c784841ad16cc06

SHA512
1a0ffaa94e4a56c8eb89c5ec4dadfb1bad3e0141737b4486f0398b23e476f7ad5ebc61e922096665dff490beaf4be40c552aa92d20a77e33b5110aa0e592d9f6

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\selectedTab_leftCorner.gif

Filesize
65B

MD5
cd43f10f293437ed98b69feed71d30ef

SHA1
16c84001f49586daab1eb7042bf2c74755c77183

SHA256
9c41c70255e2eb65dd4f0f1d7452da3b621b856bd49aa56f6fe0b0a4ea80fe91

SHA512
fef0c266717c493c5132e97976d276b3b101000cc0e1a241045e833c5db1ae99fe4b03c3336873d28e18d378efe3c047c27b0d8ddbb9b536bf9725be4343d1e7

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\selectedTab_rightCorner.gif

Filesize
65B

MD5
0bb6bc70fefb5d6ef27e28664b39b1dd

SHA1
511f31e41e564f6220b8a332654010bc96c4d5eb

SHA256
d244035662ba0c12d001fbf619bdf30ec4569c264b99e9804e02339942a13ebf

SHA512
25362f4a6a0fd36aaaa4e779c8fee68b2c114c96e593f2cf2657531de39362d63730c43678582be05cf3d41b0e6901fe6bb23fce52735f66655f0b1c84ce02df

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group1\1 - Desktop.lnk

Filesize
1KB

MD5
1e068d6f086797001ed91a96e96c007f

SHA1
1fb523fe8fd5dc0272149f47454848c3e814522c

SHA256
2347ef9425dc1e0347f58b7aed17a843bb3e52c65689388357cee9359d47d5eb

SHA512
24ece06a3b6d7e9ef616c2501e3d07fa52c1f630aa5d11bfbe5840a7136a59adbb77ff976febd3d9cf39e25e3d39cb3eaf409ed3029e6f7c1708bced438abfa5

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\1 - Run.lnk

Filesize
1KB

MD5
62102280dd26203a1a403fc10bedfced

SHA1
dd81c46a4cc10d939a726f75990f156899fd48b5

SHA256
d545d2c311b9663730a7a5c8c8693903fe32163b05a99d9c95736a728aff047f

SHA512
d49915ca7b7768e27ba51995f843bac5dd19ed736b4f7391f438b252637f893eab25ee86750b119a76c1410d34e26c80e9d0b3798f6ea773e6476aa8ee77dc53

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\2 - Search.lnk

Filesize
1KB

MD5
6ca71b17b577e27b960ec0cbd8a3af7e

SHA1
3a180782757bfe60602cbe80a63abec127a2bf92

SHA256
f1b65ebc7640f011581dd977b65e47e4e41afb74a0cb9cef0c1b0c1b23994893

SHA512
a09ec6816203ce2bc5c4a5a33a868a8417b1cfc9a8fa70cc4497bca03e8b72b7edaed98a59d6217a1061e5c6d317925d15138fd2b1a0c3e12f9132c6438f2880

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\3 - Windows Explorer.lnk

Filesize
1KB

MD5
2523738d6a743acb48e0eda54e0358c2

SHA1
4468b4c36f8d63368e7708239ab5f67dc207caf8

SHA256
77b191afd44bc0a34ed7de786a4c5de02b58c30f0f246a994fd4860f5d3a79bf

SHA512
ed71af3df357fa88cfde064d28226a4939349bcbd28c8f04d0a2e0957cf34febc76f02c69e27f4377a5104a4f71bf89e55df1da2adbc9a37a07e13a2b65322ff

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\4 - Control Panel.lnk

Filesize
1KB

MD5
b258e81dca1dde42a6f457ce4b61d626

SHA1
d5a6a60f99c74be353fc357327429d6851a508e9

SHA256
26c24eff02114d4b401b4007b7090ec8cdc43516ff54ac6df3339010f6e8a8e9

SHA512
e17ddc6426ba23f93af13e3419587bc581135ae32a0664cef28662fddbca5b71d8612ad2c47bae0173ecad527f26a582999266c87291d8341f3c8e9a81d20350

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\5 - Task Manager.lnk

Filesize
1021B

MD5
ff7f40ad8f8fa3dd31b22272655ed1e6

SHA1
be67246bebb9e724b51e0d48a406fbb84f5f9551

SHA256
0d13c228f03c5f43c294f153912c105fcf9841c8cd8ced69d81f7cd1c1331b28

SHA512
60f7f47abd84b69e6ccc34ef6251190f78ffe40456ea8deb3a4248f8596c395ed46d5621639715489d08ed201b83839235f2ba07034264cf1d11061abf6fa7c1

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\01 - Command Prompt.lnk

Filesize
1015B

MD5
faa64f9eb7af83456deb24c89c3b062d

SHA1
e5af7e95f0e2cb1b2e9221a2e922b409664eebe1

SHA256
c909e2e47cd29d8371da44ac939609b538126d288b55c05d38443e47121a8a12

SHA512
762862c6c7d17532c917a22d389e43ffd47668717e352f0222612074a70cb24796e4d636bb05ed545570102ac8179a0b1099a9a85e3faa3509fe3312563e652a

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\01a - Windows PowerShell.lnk

Filesize
1KB

MD5
8bce1d5326628dc58271a1331a96da4b

SHA1
69360968260823c251959abd3dd2bdab88911d25

SHA256
db34a5a6e6b00dc4c0994317c9e78553a00ed9ccf680fff994bbab89b79bfb63

SHA512
9dc7ac331d569538a432ec5966fd131b93839d13f3b95fa5d7934ca6d9bd90281cc70d434264237ae2c28d5a5371209cb6dcdbeb0dccd9e605be294544264afc

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\02 - Command Prompt.lnk

Filesize
1KB

MD5
d45847bf817ea577d61bfb1acf998db6

SHA1
dac03061a53997af6bdfa8bb11145cbdbd6eafc1

SHA256
a3c36e01bb28f42fca0f777b5ff886d9d02d160699d930372e3406de1f26cb50

SHA512
c59a56f587a04dc4f4eb3dfa4634df4667e0380e14ce127c4e34da4d86020f1eccbb94c0cb0e6a6276a691fd25f9115a12144d29960efcc9c6cdcae063b3981b

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\02a - Windows PowerShell.lnk

Filesize
1KB

MD5
6b38d4cd614b234cc1a1e6d738f93ba4

SHA1
a63871d2667560886f6251c8a851df690b94c3f9

SHA256
77713a3b17904fc3acf7db6e44d29e4223095a5d2d80708cc608b731235a71aa

SHA512
8df269ed6a224b703a7d145acab4e4926954c4c536a3162c68e8cf156a3c96aa05c65263af1072d055fab164d51483f8681ed33a196666928c02cecfa56efd4d

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\03 - Computer Management.lnk

Filesize
1015B

MD5
e70433c4ea29a16ee7530e516ca2fc59

SHA1
99e6350b1d293f018021b1a4776d516d2f93ac6f

SHA256
dfc9ba228a172a29bede70bcdf7dccf669b24783107336f7ccb8da3b58721fa9

SHA512
1488fc63a45e225e135f7d63aed381db09b6b990407799793737fc9a731d66cbb44b6506fe930b66943bb69fb376e66330927515a3fb1b287ee83aa7e1232196

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\04 - Disk Management.lnk

Filesize
1015B

MD5
797b7705a598a185b041f3c544bc047e

SHA1
04e812fc77bd5f5b641a90f90f6af8987f549b85

SHA256
9e2cf2b22d0160a43d719a6680b332180ec793b1830601e92176d3acce9b8f9d

SHA512
36e2165612d35307bb8152aaa88a63fb941557fe58437a5ae9f0efb173e8b771fac34d14d68dd2e20dda8a332003189a5a3b32356a99ab30801132b4e60ee9d3

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\04-1 - NetworkStatus.lnk

Filesize
1KB

MD5
7a93ee8449f67203f5b57e54e474c44a

SHA1
5cf3ea3fa138de83ae676efb652ea82db48dba35

SHA256
80d67838352cc18f1774006f412c2a9adeeca3014d631ba910e121380c1d968a

SHA512
235c69c1a85362f57873b306c0af3c67c280af9d8075c7761ace01e75acca57e9770e06385223d703190eaa7f4fa65a0d4ead4d38b5acff2069b616697e5f721

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\05 - Device Manager.lnk

Filesize
1KB

MD5
605c619c4c6faaf06209eea6b68cc813

SHA1
447c1f921f06446d375d85792a97e5bcd7b033b6

SHA256
4e719c26b8a2b00c88becf3ff95d2eb906e43bfa639525e42e4915dcdb1211d7

SHA512
e99afbab5c440961c1e8095f9b47bc3a3eba7f25d4015686a580ad79978edf2db366abd0d0687bb93bd490eca6eb9c240e8d5a60a81922442a31ac64bcea8817

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\06 - SystemAbout.lnk

Filesize
1KB

MD5
9260d161beb788e9513dd9beb47d2d42

SHA1
fbf4954791b4e7757f10d69665eb9fe92fd3d2de

SHA256
be5855ffd81aafdeda50e2d7500763d117301a5a678f5fabdf711186c8209ca2

SHA512
dafe1d16d3165845d816a2ef1bd342241e79d79ce93fc010e1c6b4ed7e6866054656c1f34cbb4c284a9542da9fc4f4061edd2c221163fb3202d2c51923bf342a

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\07 - Event Viewer.lnk

Filesize
1015B

MD5
f61152052af657e132e6bfe1e725b74e

SHA1
e159bce584bac7e0173739a2b90a34b48e09297d

SHA256
7f3fc7cdaead763e1e978ea67dc2788c1ca73d2271d2abc4365443d727a5e3e8

SHA512
22c92df6a1615c8ddf714694d7118fd13aa0aefd420488b79a4e13e0055c0ca6d03543b7a2c0a63f2b5347f857ef9aed16de07b9d8a91b016b5194ec51ee4291

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\08 - PowerAndSleep.lnk

Filesize
1KB

MD5
3d7c30db78526b621f34493801f6a07f

SHA1
90d310b3cf538fcd850716904cfc3a8ae81979f2

SHA256
fde6e5641e54640cc78476ae744e7ca3e97e1a4d771ebd11da3a2f54d00be9dd

SHA512
e819fb5e1e3ce37a8e5fa74c0581ec1d912f2b5c7a187cad4fda56ad9e14c8ae7c5e8a5054a10006513de017c80eb285cc9267bc90f24e55a508351ae78216a8

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\09 - Mobility Center.lnk

Filesize
1015B

MD5
a95cb7e88aa5ab016d21d1043e3fa4ba

SHA1
aaa6e7f4e63c2bfa3f88e1cb37a9f4cbd0829d7e

SHA256
67c224a9c80f8af84f7d705980dd3a79d0cb3cc59cb4013f61f0658df48c3e8a

SHA512
bd2abaf1ffb0d8c2c21ddbb9d270def9a8cf2f15367ddfc4abe89714c4c82ba8ecfca8aba8a230a84405b1f6a6d09909a33ef5d84a586fce7453ea85d1ce59ad

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\10 - AppsAndFeatures.lnk

Filesize
1KB

MD5
7f8aee1ba5eadfe87943b44e65e97689

SHA1
e79588a639cebdc4f848a1b7252edc1ab4c9c2ee

SHA256
2817e10f9a5de38f8c6491cf7ad9fe3c84906b1ddb09f1b9e4f0e3308e9f71a1

SHA512
ec651a6dbeb0a8e133f52bce929acffa0fc665c99449679465aa1efa33ea3ceda48596ef45161dd3c0bc9ec126c6c3f0847c3a5bc09fff5881a2a8f3fc65afa8

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk

Filesize
352B

MD5
b6bc81122902289c1ca3eb8fc2b36b14

SHA1
962ccbf6394b4d02123e44d85779eb9f08a475bf

SHA256
9fb68d932654fdf2f5e02164e4fd7dcb1a2f50370cd08e12eef59453ce7a7a3a

SHA512
09ab2e102af03215a01696aa4b9f37ba3fbb54a2ebb3dad965a3a080d9822e0ba842a675c9a3244cc71fa27e7da179650067b8733ecb3730507637daab033fce

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk

Filesize
334B

MD5
e1baef104f273a7d8bc8215cf7b5bc3b

SHA1
57f32135c61516a3b8975dc4f4de6ec0b0fffc6f

SHA256
3645fe34d12f17bce2712a8e3ca9a1cf76dba5992ab893f89f2d0780b36c7d4e

SHA512
da5477518839430903a19e098622c29a467da6351b940cbfbec9f9c5b476e121f7b3cc5944dceea4a5ce33d241ebf4a5ff218f56e8c2503762b8de7a04bc5e31

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Magnify.lnk

Filesize
1KB

MD5
3cc6ace63b25f169c4b83173f6869498

SHA1
2ce5bccfc647cf9eaef88777106513dc8995e5ec

SHA256
60d12f71b918b855c1eda1e8a9545a39aa50b8f7774d92bccd0cf29a84c5a0ba

SHA512
a18d94701398f55fccf4c49467e157dde52e4df3e6ab343e39c23610088720e01ca9cd834508bb9a9689418ac16dae471da350a2a1737e9319f32c1a7b0675bf

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Narrator.lnk

Filesize
1KB

MD5
7cbbe6d6d8135ebfa64f9849b082543f

SHA1
c8c93c6c2bd17db73bb50454be939a8bf488a179

SHA256
4eda0c6c026b2b1df3a4d3890663f14f92d927dd26b03863453b20e148af9a80

SHA512
ff6b14eab08483a0f855664a4c26bfa807884dd5c64713416537f1234bf74e6894f65b0007b2a99b7a491ada32606cb38e235a8df34c7766b5efcbd2ff822103

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\On-Screen Keyboard.lnk

Filesize
1KB

MD5
0f1d1fc90cb41ce746aab10964aea94e

SHA1
09caa3427218b72581fadd9143af95d52efe6471

SHA256
b1f2a265fa6155b80ed4506bb36f5a6e8ebed1f710584237ba3712fcd9586f9a

SHA512
9bb9eb090cf0c3dcb391f5b43fbb812f9b37804cd19747270b1620ad95ab7b65dac5a2875949bd74922148d0d51e10a78f10a257a1b1965826a2facd83881ebf

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Administrative Tools.lnk

Filesize
1KB

MD5
08c96e7ee74996472abbd4e21681a9fa

SHA1
e6a7beaf9ace670a6fd9ec4b997e6e6bc1f1045f

SHA256
9c96e0192011d36350386480a3eec5712180283a0689a662f93141f2d108846c

SHA512
86dea4d4ac1add88b05781a44b11f6fd35ac8a6b8c0149c5b25455f92308c8ca406a4d05d901969da6dde158225f4df55219cbc6bab70b3bbe152d86bf332336

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Command Prompt.lnk

Filesize
1KB

MD5
c0dc364b1886d8f9624d116d1614c4ca

SHA1
2602f532ffc041d92ccd6002f76e51c71f331415

SHA256
d14ff28faa44717d98e41bcc60099b069fa717aede8badbf5c4d241002305441

SHA512
ce63e4f1924f5eebb980111b22d136814d99be06cff35daf10fd09485c1168b4a92eac7348a420141b80bb6729821454a2e7fa18b2e91fb53b0f9a58e74403c8

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Control Panel.lnk

Filesize
405B

MD5
863cdbec9d85dfec6c3cfaa3f5883fd2

SHA1
b1d1733ecf577cfc7d2d03c62a0bf369647153e4

SHA256
096ce2dce4a12d7660b5f89f73b2ebcfe7335cc72cd5eaf1a2a03c975f7eb5a8

SHA512
f42a2e72b57dfbba1eaa0c8d6649fe76276c26c757c8483b87d5487df91b2ba6b59d5fbd02422a155a7a5fd9a404970b69819f2ba1ce8be2a2651f77424b1112

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Run.lnk

Filesize
409B

MD5
45c6fa5cb06f4e303c94f27821cb5885

SHA1
fc3a6a2d62b82425fef7181e9471c9ae928fcf7f

SHA256
c3b7ba87776a75a0d7e3a32b4849497d84a10ff6f8d21673c4dbd96fef83c3be

SHA512
653ca91b14d2e3e4a07c1493735c2b009b7f7e309b60b45c3e092136ff19a345cf6da794c6c8b6ad25292836aaee2967644fa57a763e9a7adfefede913f23c5e

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\computer.lnk

Filesize
335B

MD5
c36e82894167f5db76f86242efbdf8fd

SHA1
764d87510ad956518e5c785889d74ce7470d4648

SHA256
f67a608d889239c34ffbf94083660624ef2787a93e0117b5a74fcfa88a1d9294

SHA512
8464cbcbbae0aab57160032d9e70fa73c8752263f8d3f458234b50dcf9b309f27906caecd7d9776bc66d2ce55e27e8921f37638bff0bbf2f11e8b3f61d97fbe9

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell (x86).lnk

Filesize
2KB

MD5
9151e8227beb89d5c3f4a089359c5948

SHA1
08f2e870c0a0c8b490a1f939bdd711401e3c3349

SHA256
a7805a521bf4140c606f85ffe9f0cdf2c8a9aa22df9ee8955aca6bc4d9a6ba74

SHA512
652932f1484c2911462352509ec8a4b4ca32ce835ecdf6febd0a1620010405fc66bf49ffa4f46ebc1b595edc4df2dabff03ea2e46e9160f17f543d6ec49ee817

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk

Filesize
2KB

MD5
6c4baabf61f8822494e4d116cb7098d3

SHA1
66e05a4a942cc30ab02facae335903b3dd97becd

SHA256
396f653697c691815362ac97c484e4c570efb4a570dbfb805bafa47d88ed0370

SHA512
6b8d8f143cf4a5db41c691b1cd689ada3a0713292d0bb68e67b3d9296d5ed59304e6a82589e67c650fc56bbfa91badf7ee0d8d8dc2ae193f6d253b9b645b2da7

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png

Filesize
296B

MD5
ef567a22a954044b37c723443c39e261

SHA1
1680f16eefc5ed204922efff65493942ed5b5a88

SHA256
c07ccc1a84d682f4b1199614f96440cd0a3328266c0200b49d10f5fc851cc036

SHA512
49c2d59e3df1691654f9d3658e4fdc196538d4daa140bc295d5505486973467e84b46e0618078a74235100dc6d7ec65fb027c3706cb5942fd6a3a9edd5c37744

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_contrast-white.png

Filesize
276B

MD5
6b62d1c7081ff609c4577b7e4ebd78e0

SHA1
cef1dc18b949146e9780a56454b77ed6ca420b63

SHA256
ea609f9a9921e65a38b3844fcbe35d64036a27e319f2affbb9906ef785b00149

SHA512
ebb5cdfde32f568c7a6fa4007af81c627b0052e9f88125b123e24a97fd068141d4368f11d82288e351d98f358259ed594612968b3176ae75de883111a033a76e

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png

Filesize
296B

MD5
93830dd638f5b10427038f029d1a0544

SHA1
5ec2177ffebb63db647c296caeb7093541e8635a

SHA256
d611fb3db9c92bb200c7e7fa528abbef56fdf2dba347f059d651cfd804519c8c

SHA512
d08bfe28efb5ebca0bfa836fcbcf807b8faf6fadee47084790d22dd8e06faf55433af999c19ba81afce839ee0d22ca5953dec4509a16c69b3af6a24467cdb255

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square44x44Logo.targetsize-44_contrast-white.png

Filesize
276B

MD5
15f423f66ccef42a80367867ac89456b

SHA1
74fdcaa3cd837992dd4e3299031dbc4d59384491

SHA256
885426721affb88e61596fdf93bf641a6fd7fbc79778328af4badefe19d2832a

SHA512
0e25a5dc78d6cbce234d3d7e5a06761bb5e370467134e45cabe906ec3d08ec70c933983364cbaa59a7abc4758fb0b388b7b94077930bc1004a6a5d16307d8064

Download Submit
C:\Windows\WinSxS\wow64_microsoft-windows-onedrive-setup_31bf3856ad364e35_10.0.19041.1_none_e585f901f9ce93e6\OneDrive.lnk

Filesize
1KB

MD5
3b031f4954cc7c90854c8eea78fb123c

SHA1
64f9aad79899e20d8706f1da297eeeb1463b11be

SHA256
c8d1d5ccadb1f4b5978ba21314327c03ebf8f8df73225b2904775f65ecb22efa

SHA512
4acd9ace15856db5da69a345c0282c7a3a6778625c800e5f52944bcd10d7892a09b3b1f1f04eba5d6c9ab8ae45d398e9dd3eb2e197b7024c6ee3805f496994a9

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads