c0b62f0a6a1d95428e61904efe29489d97c2b5770d940b483d8c6cd0a14cd7a3

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
05-12-2024 06:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
Size

12KB
MD5

c669e64cd1558151caa3c12989496da1
SHA1

563b485a0c41f1f9db94002170eb5f38b4297eef
SHA256

c0b62f0a6a1d95428e61904efe29489d97c2b5770d940b483d8c6cd0a14cd7a3
SHA512

70e30fceeabf662ec8df91bcef0fb0117c2939c53099595457298d0a721ddee3a071a7f48c925ca939f371e981a929efd84342154856702f81932777c4a049cd
SSDEEP

192:+/TrG62a6B10k3g4fXk1iTV3HGc7EkpAqEjvu2q9C/YpXnAITZfPtRMv37Dc:+ebFNw4Pk1itKkpAjjI2YpdmvLD

Score

9^/10

discovery persistence ransomware spyware stealer

Malware Config

Signatures

Renames multiple (2173) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Drivers directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers\gmreadme.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1uoBPi166dn60J2.exe"	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Speech\SpeechUX\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Dism\it\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\MsDtc\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\bcmfn2.inf_amd64_5ebadf201c5b5845\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmzyxlg.inf_amd64_c5ee07feb8dae038\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netnb.inf_amd64_0dc913ad00b14824\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\InstallShield\setupdir\000b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmpp.inf_amd64_e196624c9ed43e83\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmtdkj3.inf_amd64_9658f2eb83f061c9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Configuration\BaseRegistration\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_netclient.inf_amd64_b7f9bb71730aaf1a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_processor.inf_amd64_4431cc603de6e020\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmdgitn.inf_amd64_6360d736a6f64e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\migration\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SecureBoot\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmgl005.inf_amd64_d9886a7bbe9e55ca\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wgencounter.inf_amd64_f496147578cad554\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ScriptResource\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\wbem\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\cs-CZ\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmtkr.inf_amd64_a8a4ecec7082e1aa\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ts_generic.inf_amd64_b6cb67052996a0bf\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\ras\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmcpv.inf_amd64_906547002cc7c58e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\microsoft_bluetooth_hfp.inf_amd64_9effd93a75bc489e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnms005.inf_amd64_add71423ba73e797\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Speech\Common\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_RoleResource\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netbxnda.inf_amd64_1fff3bc87a99b0f1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netwns64.inf_amd64_162bb49f925c6463\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\F12\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\migration\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_multiportserial.inf_amd64_e92b6921fca885d5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmntt1.inf_amd64_263b3076d78209be\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\IME\IMEJP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\wbem\xml\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\default.help.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.ODataUtils\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\MsDtc\ja\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmaiwa5.inf_amd64_8416dd97e1ecb6dc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmdcm6.inf_amd64_8b49cb79b258e1ab\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ndiscap.inf_amd64_a009d240f9b4a192\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netl1c63x64.inf_amd64_4d6630ce07a4fb42\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\MsDtc\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\adp80xx.inf_amd64_efb36fdc260e8bc8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netwew01.inf_amd64_153e01d761813df2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WaitForAll\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\intelta.inf_amd64_ba962d801a22973c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\sdbus.inf_amd64_55c0c78952233d0c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Speech\Engines\SR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netr28x.inf_amd64_5d63c7bcbf29107f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\perceptionsimulationsixdof.inf_amd64_3ff016f4df6d2b8a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\F12\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Archive\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mchgr.inf_amd64_399f04975a0af112\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\net9500-x64-n650f.inf_amd64_e92c5a65e41993f9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\IME\IMEKR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\oobe\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmtdkj7.inf_amd64_161e1375bcff85d9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AssignedAccess\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_GroupResource\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\InstallShield\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\VideoLAN\VLC\locale\hu\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-60.png	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Thumbnails\Sticker_Icon_Ear.png	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\AppCS\Assets\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\210x173\31.jpg	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\ringless_calls\Ringlesscalling_25more_360x120_2x.png	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-60_altform-lightunplated.png	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\zh-tw\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\fr-fr\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Edit.png	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Program Files\Windows Defender\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\RTL\contrast-white\MedTile.scale-125.png	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\ca-ES\View3d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\AppxMetadata\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\en-ae\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\pt-br\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_GB\WordNet_license.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\th\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\FileIcons\FileLogoExtensions.targetsize-64.png	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-60_contrast-white.png	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\contrast-black\MixedRealityPortalAppList.targetsize-36_altform-unplated_contrast-black.png	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\images\avatar.jpg	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\no\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\AppPackageAppList.targetsize-40_altform-unplated.png	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\images\FileText32x32.png	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\TimerMedTile.contrast-white_scale-100.png	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\AppxMetadata\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\SmartSelect\RemoveStroke_Illustration.png	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsAppList.targetsize-30_altform-unplated.png	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\OrientationControlMiddleCircle.png	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageWideTile.scale-150_contrast-white.png	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\Square44x44\PaintAppList.targetsize-24.png	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-40_altform-unplated.png	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MEDIA\LASER.WAV	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Latn-RS\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\close_x.png	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\it-it\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\FlagToastQuickAction.scale-80.png	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\pt-br\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Program Files\Windows Defender\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\WorldClockLargeTile.contrast-white_scale-125.png	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\LiveTile\2px.png	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\20.png	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSectionSmallTile.scale-150.png	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-80_altform-unplated.png	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\SwipeTeachingCalloutArchiveImage.layoutdir-RTL.gif	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.YourPhone_2019.430.2026.0_neutral_~_8wekyb3d8bbwe\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-32_contrast-black.png	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\MixedRealityPortalAppList.scale-100_contrast-white.png	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\jscripts\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\StoreLogo.scale-200_contrast-black.png	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\StoreLogo.scale-150.png	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-64_altform-fullcolor.png	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubGameBar.png	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\lets-get-started-2x.png	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteNotebookSmallTile.scale-100.png	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailMediumTile.scale-100.png	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00000411_31bf3856ad364e35_10.0.19041.662_none_c521b569c31aed4f\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-kdc-adm_31bf3856ad364e35_10.0.19041.1_none_4f8f7ebe89e617e6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.1_none_75cd350cc8b5dbcf\filepicker.png	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-wlanpref.resources_31bf3856ad364e35_10.0.19041.1_es-es_b4dd029ebb557d69\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.19041.906_sl-si_0c94bc70042838ff\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-x..ectdialog.appxsetup_31bf3856ad364e35_10.0.19041.1023_none_fe2a3fc32038c1d1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_netfx35linq-addinutil_31bf3856ad364e35_10.0.19041.1_none_810f46ab82b9619e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-cryptsp-dll_31bf3856ad364e35_10.0.19041.546_none_11ab5f5f99fc8eda\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-i..thorizationbinaries_31bf3856ad364e35_10.0.19041.1_none_0bb7827b84fc755a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_dual_npsvctrig.inf_31bf3856ad364e35_10.0.19041.1_none_36b54dea8a6d735b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-printing-winrt-core_31bf3856ad364e35_10.0.19041.264_none_d252b0986a673938\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-r..ckgroundmediapolicy_31bf3856ad364e35_10.0.19041.746_none_20fd7dc0637d60d3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_networking-mpssvc-ui.resources_31bf3856ad364e35_10.0.19041.1_de-de_f33e78823325be10\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-devices-midi_31bf3856ad364e35_10.0.19041.264_none_d3106e972ee929f2\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_wfcvsc.inf.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_24b4263934e4a6f8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Assets\PasswordExpiry.scale-100.png	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_dual_monitor.inf_31bf3856ad364e35_10.0.19041.1151_none_3b3b282f3a407044\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_dual_netrasa.inf_31bf3856ad364e35_10.0.19041.1_none_099c220a1124cba9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..tingshandlers-about_31bf3856ad364e35_10.0.19041.746_none_cb156de688b76372\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_system.data.services.client.resources_b77a5c561934e089_4.0.15805.0_fr-fr_57a69845a971f6bb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-c..mplus-runtime-mtxdm_31bf3856ad364e35_10.0.19041.1_none_d835cfb6a72ad4a3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.GPowerShell.Resources\v4.0_3.0.0.0_fr_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-wmerror_31bf3856ad364e35_10.0.19041.1_none_ed4600715653f40d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_windows-media-speech-winrt.resources_31bf3856ad364e35_10.0.19041.1_zh-tw_7d860a0518937117\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-security-spp-tools_31bf3856ad364e35_10.0.19041.789_none_2dbefc6b526e20cf\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\WinSxS\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.19041.1_de-de_0001043e8ed2b2d9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevagent_31bf3856ad364e35_10.0.19041.1288_none_71734bf99a2a6955\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-e..filterwmi.resources_31bf3856ad364e35_10.0.19041.1_de-de_418587a0cfb9f87a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-mfh264enc_31bf3856ad364e35_10.0.19041.964_none_684359d4932909e0\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-p..ooler-networkclient_31bf3856ad364e35_10.0.19041.1288_none_ae3ae1432619c00b\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-quickassist.resources_31bf3856ad364e35_10.0.19041.1_it-it_4f3dfceb6758f834\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\WinSxS\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.19041.1_pt-br_aa8e10bbea64bc3d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\XamlViewer\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File opened for modification	C:\Windows\SystemResources\Windows.SystemToast.Calling\Images\TextReply.scale-150.png	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-font-fms.resources_31bf3856ad364e35_10.0.19041.1_fi-fi_575c0d2f9b49c0af\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-g..policy-cmdlinetools_31bf3856ad364e35_10.0.19041.1_none_f15a0c837b51c5fc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-notepad_31bf3856ad364e35_10.0.19041.117_none_4d353cf1ceb5d6d2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-ui-shellcommon-core_31bf3856ad364e35_10.0.19041.1_none_91b1f58702057373\WiFiNetworkManagerWarningToast.scale-200_contrast-black.png	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-microsoftedge_31bf3856ad364e35_10.0.19041.264_none_ef195f564f00d259\MicrosoftEdgeSquare310x310.scale-150_contrast-white.png	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..ouppolicy.resources_31bf3856ad364e35_10.0.19041.1_de-de_f38a90bc4c1d767d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management.Resources\1.0.0.0_fr_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File opened for modification	C:\Windows\Media\Windows Navigation Start.wav	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-international-els-core_31bf3856ad364e35_10.0.19041.1_none_485cb50a08462193\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-a..ntscontrol.appxmain_31bf3856ad364e35_10.0.19041.1_none_44197b0fdd55f562\Logo.Theme-Light_Scale-100.png	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-m..nt-browser.appxmain_31bf3856ad364e35_10.0.19041.844_none_d9eb415c5b9dbe4e\Square150x150Logo.contrast-black_scale-200.png	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-ui-cred-library_31bf3856ad364e35_10.0.19041.746_none_a79d3a9825973adb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\Ratings\RatingStars40.scale-200.png	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-getmac_31bf3856ad364e35_10.0.19041.1_none_c1efa43e415898e4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-help-adm.resources_31bf3856ad364e35_10.0.19041.1_en-us_73dcae80d46b6afa\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-i..iagnostic.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_4a28da81e0977e26\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-microsoftedge_31bf3856ad364e35_10.0.19041.264_none_ef195f564f00d259\MicrosoftEdgeSquare310x310.scale-400.png	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-sort.resources_31bf3856ad364e35_10.0.19041.1_es-es_9b663c6466fa8ec5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\WinSxS\msil_system.directoryservices.resources_b03f5f7f11d50a3a_10.0.19041.1_es-es_fa4779bd64928a02\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-mpr-extension_31bf3856ad364e35_10.0.19041.1_none_5d0cb97cc8af9b89\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-unix-socket-provider_31bf3856ad364e35_10.0.19041.1_none_0dfb3c80b23a2506\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\WinSxS\x86_microsoft-windows-f12-f12appframe2_31bf3856ad364e35_11.0.19041.746_none_c28b19177861072f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-directwrite_31bf3856ad364e35_10.0.19041.1165_none_51c2d3ade8f8f246\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_networking-mpssvc-ui.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_4906cbb0495d93d7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-i..ltinstall.resources_31bf3856ad364e35_10.0.19041.1_de-de_bddcf38022196a2a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-t..linetools.resources_31bf3856ad364e35_10.0.19041.1_es-es_3a8effd9560a36de\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-wlanmediamanager_31bf3856ad364e35_10.0.19041.1_none_536810b3859076ee\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File opened for modification	C:\Windows\SystemResources\Windows.SystemToast.Calling\Images\YourPhoneCallingToast.scale-125_contrast-white.png	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-i..gbinaries.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_184f492c9cdb3270\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-microsoftedge_31bf3856ad364e35_10.0.19041.264_none_ef195f564f00d259\MicrosoftEdgeSquare44x44.targetsize-32_altform-unplated.png	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\YAUJXFSNEZZYCNE	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\YAUJXFSNEZZYCNE\DefaultIcon	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\YAUJXFSNEZZYCNE\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1uoBPi166dn60J2.exe,0"	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\YAUJXFSNEZZYCNE\shell	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\YAUJXFSNEZZYCNE\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1uoBPi166dn60J2.exe"	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd\ = "YAUJXFSNEZZYCNE"	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\YAUJXFSNEZZYCNE\ = "CRYPTED!"	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\YAUJXFSNEZZYCNE\shell\open\command	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\YAUJXFSNEZZYCNE\shell\open	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd	c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c669e64cd1558151caa3c12989496da1_JaffaCakes118.exe"
1⤵
- Drops file in Drivers directory
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\aic_file_icons.png

Filesize
50KB

MD5
10e997152f8e72c815f952dcdf2012c3

SHA1
90aed80f7fa40a5b81eea8c22abf8f0f2cc8b528

SHA256
feb8f533de95242e8b40bbeb94576efc09a9942bfd352568166409664e24491a

SHA512
c1c2a55ef8a59b71d97dc215770cc9a46753e7a71453f1c8ff3bc2397d70a2469c310e9a0292f466049dba7212fa5edd9b7987de85901e18e3ff10a0b229f6ae

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions.png

Filesize
1KB

MD5
a2e96d43f2e3c0c67e7de1ed9630634e

SHA1
859b0b55b52508be15ad793307dfa5a41aabd9dc

SHA256
6e89b9792c1fdea85bee0baaa8fba3bf2398c5b93f0dd8908b7544e41d896626

SHA512
ae0f1b0df5d75e9a49c4f3c8db07b21a95385d20bcfd40beb01d78d3e9771d30fddd2abd8251726e366eed3a2d915be1867260cd93ba88f2385ee15025628db1

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions2x.png

Filesize
3KB

MD5
68dbfb5ddd60bfb807535069da7faf78

SHA1
7b4b5796414dbdf6c8b967b8c448bef53da2937f

SHA256
28c22de42f4eac3f83b7550f786cb09131e4b9d1721a3ccb45fde121ae7665c1

SHA512
7a9a90cbb9d527f16dd9de5a8d5adf057eadcd20e45e5d4244a7ffc5c3f17b15fa6f009996799759dc16724fd31df7675bd796d461f0e9c04df17e41967e94ca

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons.png

Filesize
683B

MD5
a148b144826ab026a91abde32c97388c

SHA1
a00024bfba06c9b542723659959cfa6687fa4f2e

SHA256
6289c5d893f6e14b76d446a75f4427ea71fbda9d36bdfe1205f256f94ea91db8

SHA512
6a72ed0f021fc74da9305e917c548a434e794f0b817a92891e9b13bf5c61b6ad3465daabaf2d9ff7286509ce34669dfb9f16d8789e852d7aab2c418f27b83958

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons2x.png

Filesize
1KB

MD5
2f236ee36ac8cb0ed5374b3b010e1862

SHA1
33903c712c85db4d3869033720a4880628fc2756

SHA256
3ee267e7a3c4f05c11f1a17b0b7567ece6ee01c1988a407bdfd47c1ab34643c2

SHA512
3c2cb4a7d7ea5009dc8121aaa7705e17f69014eff43ec4be12f7b31c54954f5e31dea0c1b8ba8013a1d97d9eb9ea175480ddbdc18dc01715169d6d91d1ebeb30

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon.png

Filesize
445B

MD5
e3eb4e2e87004491b11c9ef6a3bd0424

SHA1
8b9be147c50ed7a00c1c20f685427d7122204630

SHA256
4c76d47653f719d112b3456f4d0f1bedc323d50529ccbcb172e41f52f3a323df

SHA512
00c63fb88a3b2be26fed19f1df25a8c6d4a71b1ca59933782d6df84460d34a77542689c5870dbe9bde4b1d4c26edb079edad0db6101777a7ce22ce5986756169

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_2x.png

Filesize
611B

MD5
86057d43966cde14c0eb5389099428c3

SHA1
88d21796fb6ff46ba6d75a7ca74b8f9cf201e3bd

SHA256
57552183216e3e8b67c8aac77cd45fb74ed0597dced5a13d969466696ec6480d

SHA512
2b2dce5a4f630dd62049d0d4ff3eb6cfba5198d7428b0bcf278811aae0eee02c5fcd4508f92e8f7b897a1528fb5a07ceb828bed5cec81a0a65c2c8636b1ff76f

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover.png

Filesize
388B

MD5
231ca683c0d7a87f30d0a273f8592f5c

SHA1
dd8c8ac04e68ceebeff66375419710a8305d303e

SHA256
703be5d4f62bd8b03fd05c131bdecf3a4c269ca87ff8f91b779b72f68b31d7ed

SHA512
117219844663f85fc405287813003b3cdbe73f4819a4bc6ac85ecdf00c4ca483b8a7f040785747a7e77a3fb28f155347f6f79bbb0c6b64b6f061323d654db883

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover_2x.png

Filesize
552B

MD5
3740bfe760a5b05f3e6e9e84966fee1f

SHA1
4dbec0ee74ea235b3985436cd3c61178b62ce380

SHA256
23a92ac9b47c04e16e3568b54de82756fe7971f90fec24ec33139bd07f77c649

SHA512
a5a33b47d0f5845fa473e2ce2f9801fd2e68b8ae0ed150748b1101e1da6d0f4494721c60923045de2383174c66d79e5314062a2af2d8fc0b930a0d3658040d8c

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon.png

Filesize
388B

MD5
9dca0536d60ca8ba345655c6b6f46bef

SHA1
76873199e79d8a6ed46ae9316d4c1ec8f9557afe

SHA256
1b7d63caf406e035416e788a0dd65f4d2de8f22e64ec1d92732c5fedcc054cb3

SHA512
2cf561f99000312e3d1876c91f2f13455ee9e20d56ee0018342fd990e45acec6f4db6bc9a667e65c3dbaaf57d559fa14896816c40a5cd7b6baf07bc0e2ba971d

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png

Filesize
552B

MD5
7721e33d854aebbbb690a6c6d66ca83d

SHA1
1d9bc4ee7221f1eddfa5743a8ff8e6cfe5a8cc5d

SHA256
bdfa81d4dbe1e163646cd77cd6d048ca8d522394a74650eb3ce597bf9484fc22

SHA512
6525f04983ef8c9796f5eff760c0acf6c0caa7534802c1387b52ac395ff51d1906715e24b9a43ca23435e3297af946848aa8f3e10bad9975484125cb16d374fe

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png

Filesize
388B

MD5
bb46206aad846e03824455648028245b

SHA1
268594ddf328167e07fc1a9d97ca0ddaed0333ab

SHA256
511750c2762d05c326485386e516df4fda1ed207c1b2bcefc7154b0fe7d9a9fc

SHA512
c7023511df6f8a3227905b01ea63ec3d6a613ea22a928007b46610ed86fa6d02bbb8c5785dbd6ea6ef7ec749c9898855d6cf527054406e1f1167c0e49903cad6

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover_2x.png

Filesize
552B

MD5
05cc71974086c2db6062e51d0acf2f9b

SHA1
c34765236874b551d0947733e3dc16be5aa7ef22

SHA256
2949d6ce9dc9a8260b233bdb35fc6e2c2163df4d13d8d4fcd7bba9dd37e67aa2

SHA512
6be261d2c83ce664fe4e3d75135276a56514b987375aa209b3e3e3bc9939485b1920d1d30a2464fc00409146f01f99c3e059243eedb735a850ed2b348c5e34cc

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons.png

Filesize
7KB

MD5
1baffd8544071c05e67ea6df1113d8e9

SHA1
fadafa6919e12ff8be451118f4dffde2a45eeae9

SHA256
dab2c7afeed74cb93daf6283b0448c1eccc55b76165b8d9bb94ce01b9a33f176

SHA512
dd298efcd98a1e9804c6f27c4a33d5c32c0fdbe66584f73d85d66f61df1d400b37fc769b81229574345c1a1cd99f0a45a638c9ac1855b72286133e1173850e1c

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_ie8.gif

Filesize
7KB

MD5
570c52630dd53839c4348ed3697b6baa

SHA1
e078a7b7816797934bccb6c30a6482b1499738ff

SHA256
18d4c5e8b0d467c3fe4e66b802ecdf42ceb6f388381685567160948fa366e3de

SHA512
d81b2ddb4374c0876483978d3d102e6b78d79366cc7932b527ac9d68c0e0a7f09fad124e958d55a3c052cc7365e344f95be43d92a698dc8070d09e000a89472a

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_retina.png

Filesize
15KB

MD5
1a8cc44452cdb026d135147f3379abb8

SHA1
6f096a94d16cdb03bc2c91098a0fc2d43eaec950

SHA256
e01ad5b460c73f7a4221b5f4488822758cceca004caa8151b047be1f51e06dbd

SHA512
642974dcaca710f16a57415cefd0de49542ef3b906169aabea99e0fb6aadbdadadff30f2b641bc8f01a38d9baaa4044f5cbfdc55aec4146eca40f68b43b3ed00

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons.png

Filesize
8KB

MD5
b6b8b8aa272b8a0650bb076d0f6772b2

SHA1
445b9e6c6008d0b32a906b490d012fc94957b532

SHA256
80621e0397527c07ae3bdcbf164af30283165f655b6398b13b8e135d477859f0

SHA512
bf54615fd7a0eb496acce47262fcac6f7fd01fe85b6ac382bb38231f694c9fccde84c8c7c7f1f68fe5d13ea560274f159a4f8ad21c449f17276f20135c877434

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons_retina.png

Filesize
17KB

MD5
db2e43259f33d292ef918a92430a77e1

SHA1
a88fc65495f6929728a2e769a128fd7a22e56903

SHA256
5d53ca418c4a715283d4e72a58c0f3d3de4091c20151731f3210e8be1e64ee0a

SHA512
70d7ec582bf1248779b58f579d867d33f4ee49555e5a24233612f1962571bde6e13a39dfc6f4281aa995f30bfb8ca2e8bf83f52ca2ac27dfd6cf4579de44afca

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_pattern_RHP.png

Filesize
179B

MD5
5305665a36a65e8957c33f73ef54fd08

SHA1
69241377d92dcadd4c62cac54ad1f35569e2c31b

SHA256
66c9eb84428d2886c90ebcdd63e6ab93eb5f005da4241be286a9775b4662df16

SHA512
169bfded1e27f61de6b0af9bc160ea7ca9e29e7ccdb744d279e4ea4cf7f5ef52fe5c6e26bae14260739a39cdb4d077aa860522fd4fac7f1aa20b7f7ff35f31c8

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_patterns_header.png

Filesize
703B

MD5
22e45a14e33be5003228c8df5c748e75

SHA1
7ed27d766c94b1a4a1b03f1c04789b3b837bb4cd

SHA256
06bccc49184f860563ee0fde4b1a01caff56aadb3286d8b130d5c420b1ef9fb0

SHA512
9579a516330ab0abd0f14fb46d78b868f9a0a13a8961d0b4b408d9b3ee154abcc5c3df39afc844760bd8dbbf759eff7807dd9d50d30e1c79b69e3308d1e9aac3

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations.png

Filesize
8KB

MD5
e1155ff887563ca093767a439bef2f97

SHA1
606a1eaa6bc14d2745ccd318baf3db3e7cc723d2

SHA256
37062c21ca6cd5682945e4a05175e43be908c6b66bb224288850fd816d9ab24d

SHA512
6f319ec4506799ab588b8a636f412d9f705b64da28bfb44d9d058df14fe90596a34709cb34b75cf1f870b2d1bb623113ddcc66389e3bc5ca37aa432b351c31c8

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations_retina.png

Filesize
19KB

MD5
1b3ed62d9e8bd398639861c6ae9a597c

SHA1
fcca3f9151f415f3ceac4bff6fcd1a0499a58b67

SHA256
39cbd5b20a1c7420e8bf5e35ba44b10c1efca801a2d2cb90eb5d6102bb9b7d6d

SHA512
e6ad147e9d86311076cb6c109cd5f5138c5702c0d3cc463ba107b6de0b08ecec982b9a1e38560c05648438d589ad93e34b01f3edf4c8e1218c473c9eb42ff278

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\faf_icons.png

Filesize
6KB

MD5
a1dfaba96283a7cd5d70be916cc31efe

SHA1
12cd1f265977e8ff02c3c732262d529297198728

SHA256
2fd74d6d85fbc080b4f8040c52538020e3b8c1fb3e245972bca46ae230df6e86

SHA512
b898993fb28823269bdf79bbddf7b375c058c02567cdd8e19f37bf909be2debf9943c0f9d5c31ec89f7acde3239b864bb38530cb41cf630683372599cf321817

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\bun.png

Filesize
2KB

MD5
4ee9e3f5af7d2b4e01d453fb342dd4a4

SHA1
e5b0512e9a91a555f0cc095af4b46f5a7348afb6

SHA256
47995807ed2efaa2d66b439accea13e9f95335340154ffd1fec3c756989c3b51

SHA512
02bcea79b7d988096d79a5d1f060aca387c9c85cfe34dc318b58732165dc674e741ffae492856b64cd5335ad1b65b9fde9b26d6a859d1d9ccfee12d3f045221f

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview.png

Filesize
2KB

MD5
489bab9ce7400a97b5a29062f19002ad

SHA1
b663fb0fcb48b31702b7f50cb6c2ae806c827b65

SHA256
14a0fcd96f639d7bf24841f4fd5df4fc50d8b209fc0eaae83067b6e24c92194a

SHA512
9283084d46555819430da02cdad4af56eeb9e22367ab1bdc044fcd9c87be97c1d5c6e8eaa1ee2c965d6af7214b2f10da9b86f553464dd2c57067e00f4e7e51af

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview2x.png

Filesize
4KB

MD5
a525e7eeffc86a8159aa6d792b1a3e14

SHA1
fd4dcc55a95ac69f154925c0a721358cb9576971

SHA256
2c13990dd5ab883cfb31f04528b38206a594be67ff4493ad3c7049705c6c2aab

SHA512
3f034de59524f9929f95cf8f0e5f17d9529c94f2679ad8403fa55b89c05c8aee81bc042f922c8b0aa55016d98159564bd6959de329ef241b9bd651f59a8c2b45

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small.png

Filesize
289B

MD5
f9a030b2aa9a229c81f9b88a0120e9dd

SHA1
c677bf1e908822572d4d26c7f1261896a254f1b4

SHA256
3e4aa2938bce521be3eae4791fd249899b8df6f500c7e0588711e3f1c3c8435b

SHA512
760a63cd89d2a8475e62b2d2d4e80c36a5660fd0529d57abd4f73c0312043d6e20260aae4b1c5a3a86aca76f29d252ea6da00c88dbfe54d40f9e2451db23f7c8

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small2x.png

Filesize
385B

MD5
02c0474f918f273be520e8cf49947dbc

SHA1
9edddb59533e78ab9eeba1062375f790a09a89fa

SHA256
6a99206a37777a1cdbc5557a44116d9504fd58cdb6ca8277f9c2811863cafa3f

SHA512
87826c5468febcb14e67d7eea460361da859868fc0cb572620bb2a4d45e60b9dbfccaf4a684dfe0ee0f7e47b07c566adc9d413416c29d62ad0d405597e5daa31

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\illustrations.png

Filesize
4KB

MD5
58b2044341b49d6d540050aa21a1003d

SHA1
f592e2bba715095c1baa550a6b33bfe596358212

SHA256
218315b9ea1057222bca3d2f9476cb3a9eedd1b351087e5dbab961a82474102f

SHA512
aae39b33de075e3bed993e1f0d3a59c088d455b53e0cbb67cb01562851a2d25e154e0bc45e28d6f6c7958e451dff0115d2596449ec01884e84a8da68b26c06cc

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\nub.png

Filesize
1003B

MD5
1fb872efb255c0c512396e575d320ff3

SHA1
9f8d8b983ca2eaf5593c672ea446cee85202af2d

SHA256
e261623cd9c79eb048994a1b4f8af54da9ad9bd1259a5148b8ba38612810ea2d

SHA512
571d57570353207b1d8bd30966bd4188f840719f994c8f67220fedbe4ea768624bcbebda00468e881d38383fe170f5604bf58dc1d53b60adf4d330ee3bb699b6

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons.png

Filesize
1KB

MD5
29bb626f26c6375d81cfc885dfeec184

SHA1
521768e8e017b6936c8c24815b3744c32a83401e

SHA256
435c771e5dac11e6a8b1c75291bac55835f70e8cd3e823519ca3af9c3fb9b90d

SHA512
6d614e4ffb10a3b96c428c733aa61126bfa0181ffe156cef4bbd00bff6964f56db107f01c88675718821f341871a2dbd1039a3097267869bf7fbefd05a7f4baf

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons2x.png

Filesize
2KB

MD5
ad624203f075caa4f953ed6fe5caebfe

SHA1
279bfb91f195336795d29c7b733ab4db7800df6b

SHA256
7760181fad7578e741e893e7974b83093e9240906fe1e17968ba8d1dc3b29300

SHA512
a2d7067212b1699e1232eb947d878fa2f910af803c6d3f0018dc76cc0b0a045051d69f19b0db529a5811568627ed86039aa2a1aaeaed0c11aa9c7ed51fe4f8fe

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adc_logo.png

Filesize
3KB

MD5
25b38c93ffd0f106bb7b86126780493b

SHA1
b3b89a842f15ba0e9cfba19591f5c9aa795e0253

SHA256
48383217d10b7b7219331e9bbec65d72481be147c5e9a84ac34f627f7582a58a

SHA512
e528e912a8d5f98938983eccb01e33e31e29eaacf9184378926e4c9e04457005f07cfc377123fd6d0e73d9d1f0bb93912c2eeef79b4ed7cff88bdeef634636e0

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adobe_spinner.gif

Filesize
556B

MD5
2b0b3f1522d79bad006cc933089afa3e

SHA1
750b5d5e336a09b80b5c94b9ce7b9addd32c3e5d

SHA256
e2902ae27759feb1933b75c1c76a4456368ff60e09d5cc7b15262412e50296cb

SHA512
edbfdb3129f5402c793ad681077b285725bbe46c56655b8f928637a52dc27881a5d5c13af749ae2c6b5aa636b933461ec591a2a8852094c92a1e01c1db8acb19

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\logo_retina.png

Filesize
6KB

MD5
c692b6eefb1fd6e6948c09557a5fa9d1

SHA1
4170c8548bc25c470f81536f019739bf1f3e9694

SHA256
62346667be851f67c0cbfc7d787ffb4be8cdeeb4960c41c7f726c5dbb9cba3bd

SHA512
991ec4af1e2dabb96c420c37247536725f87e1ad809f44df27530f6c3b29dc741c56ebfb22fa6e8b2e5b16145b410d43abc8a81bdf20df21c796f6b56b7186d5

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo.png

Filesize
826B

MD5
a33ec91b181f43efe33cbac6380927c3

SHA1
99ef90a2025f8d731f7edf39f08e8aaa717f25c9

SHA256
419393a50ec92ce2c24eb81f6f5e57c69cda3c67f18b9efa373581bbe1d9eac7

SHA512
cbd6f5d9893a0d6a5ddd377d1717aa0f9c839d82bb97c20f3099fcd1d3a10282c9872a59944cf986025bb590646efb38647698ecca2e99ae469e678f1244e7c8

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo_2x.png

Filesize
1KB

MD5
7687b54cbd50265e92d8e7b07b27b145

SHA1
2e8f2a2a996f6a40ccfeacf967257d4541d457a1

SHA256
94eacaad59ef6783930e570f80c1c426783cbebb40efe799530f6a05a27fface

SHA512
74e8b26b0bf4ed97d8a83cb36d30daef544b3823c6bbcf1ca9bc6c20181e6aa011c4cad2a391f90acebbfff60273fc9cd2037240bb98eda9d5af338b68c11544

Download Submit
C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB_EURO.txt

Filesize
32KB

MD5
972e68f3aeac437b52123fae1065a39d

SHA1
456273c406cb475c07ad6b4eb267fd324da55bc8

SHA256
b04595bccb11aa7e19281fb379c005fabae3a9bd07a3275490d2badfc4ad0ea3

SHA512
f11595bffbe9ffc9d59caa375b66ce661bc9bde089fea35cb1ab7951e8841dc7da3b45f59d90d61a1fe7d16d6da918b23e73c03ac15a9bc06e5f06555ed43da4

Download Submit
C:\Program Files\7-Zip\Lang\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt

Filesize
289B

MD5
56b24ec340b599eb5173f8c1076d3f6d

SHA1
b73f4496b91fb34a22b16d928270ed9a59ab2e5b

SHA256
31e6a56c128df5b8113499e003685a7fc3142fb528a4bd89c59ef30d968ec438

SHA512
64decb283b94443d2ce2e046b26914a45f20ed5b87a2beb47da709fb1166c48be392f1cef965504bad78ae0c65d6d3161bfbdf776b5bd9bf9c71d610b68906ed

Download Submit
C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif

Filesize
153B

MD5
a8964dc7d77815a9b88021ac0a67d246

SHA1
4f5dd6d0860e75ca2f4dedf6d9782ebcca87dac2

SHA256
623fc85e097be08d2569810804883c0ed0d1502eeff77f2bc4534544e8974d44

SHA512
c8c11a835e53fa15508bb651802076886c967091e3cc7e8826b1d1b70be89b383a50f8ffa835f19dc2a8c105e47f195db3e7dcdc2eee24e38178eb3f4d0e1fd5

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt

Filesize
190B

MD5
1d225d3e9835f4264fafdbed29db2901

SHA1
11ac70458fd920534394089c1cee5761d0f99aa9

SHA256
7f50d243ece70f9a0b5bb4ac84e3cd6ecd767c08dfbfc60860e0bdb4d5aad9b3

SHA512
416c6b10ac586f4da936d49c6bbca915ed7df80e25fdc4bdfe0a403010800a38ddc66dd39561aaad510c2ef721cffc5eceac8ff9ab8daf50e09721d9ba5b7f8e

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt

Filesize
190B

MD5
acf895797b24a543ea2194be1030e0f5

SHA1
33e1863f473447ffd666dfd270fc67b2ca9d8c1c

SHA256
027c03286e8060a7f41062b425a0cd71152529f410fc09dfc9585391f917522f

SHA512
48ddbc4018b2dbd9a1ccd35b0ac80cebc3d27c52becf20dfeef0fe5e69b3a3272bc679f7a0f2aec952fb0b22bbb78c09641db3e6688bea03fb50c899a1c18636

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md

Filesize
1KB

MD5
8361929590e3da6d43ffb9e9e8a0920d

SHA1
60668fbe4f1d3653bb34c85ce957157e8f829826

SHA256
6044a1350dde5ce223580e1505b1230be3c92cf6ea43964f1b5aad5b7d9e6e3d

SHA512
20519f4e43de909cc8d709944d4dc5e4c7f01b5a019c1ffd99b183b0027d2f8b8ad0785262107217a408586029675b71cf9322f408f449d6fc55d177a329367f

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\glib.md

Filesize
31KB

MD5
78e816c0a0b94bbf9cbf0f10057e8397

SHA1
b6f7ca3ed3388562393d9159dd75cb6265164f7c

SHA256
24f1edc9365d070ded38b8735cc411b6a79bea98ca02043f57341d02eff1d7a1

SHA512
f3ad5fdca9c136ee72580431e41095e567f0f3275be2ec92e5a04d158c13e0ba67e6235bf6a9dfd9ec0ff61df58d956e8dc8d11fda28ab21d5195db1cf064c57

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md

Filesize
34KB

MD5
71eba15f06ca0c3eadd878989fc7703b

SHA1
a547acff33f8c4d3fb4dbfc476e5c300bedf5540

SHA256
3f71dc3abc5d47bf5d833823f23e284274f2051f3ef845f8cd2622931475b2e6

SHA512
74d8a18b6c5b2242310c512ed368a35d5d3a1f6dc6a78cfc0cb7b747046c3cd6ff4e6bc1422d0540963035fcff03bd59fe1840a79da1579a1e68a91dbdd68b78

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md

Filesize
23KB

MD5
5a1fa595aff50263a07d4d35547b12b1

SHA1
cef7ff817153231b13dff39a5e96503ac5b24130

SHA256
03747e80491d6a69a708cd27a1bdc8a98da3d45b29bf031f7e2547a34cf1f4d4

SHA512
6f77b5373f210c65d79d3fb02dcd7ae28de8df82c2f35ce308a9b0e6da374d13ca855f49d32c9ad7df9bfe1efd8bfa3d87320431048a1dd0bbfe06074561a899

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md

Filesize
2KB

MD5
953c1b5389d826848db846ceaff2df10

SHA1
a8d8028abef83622146e81c6c13f51e65370d5b3

SHA256
86b9925ed01abe20ae7f4fab11c691b771c50894b810e7a46bffc06154d23944

SHA512
26406beee481a14cf3776230ab7b0c2b228720c6ca7b796d8cc3fbd2b37e13f13a2ac561e895dbd36dfde2985c4b7e474b577b6b4f5608685082b89cff4b1199

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md

Filesize
1KB

MD5
a102dcd0bb4c71ba8a6021a39736ebdc

SHA1
941bc458da617c4194eaa195ab532e143c90790e

SHA256
c4fb77acb24b739355b987b2deb9fd7ad29a7d462cfa8d497e50de545786b38d

SHA512
b7b0254e965b46a3110e23a38411af454db8c0f7d18093243b35456a69d23f66bd0aebc72fceb1cdc9cbd50a676ee32c1ff372ae63dd0ec349fc810953fdc045

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md

Filesize
3KB

MD5
d97e5b5f4dd25708d07abc298ac3c4e4

SHA1
96cf189becf31b798370b1674a0c39d829e7f05d

SHA256
1336d2a265eb16f5bb130fe6181dcba293b93b0b6fe8083ed3de837dad924e44

SHA512
ffabd26df31486731138a89eb13f5fd256cfbed080c29c0a3e39b271c9abe3c12d74f823fc469630dc3ffa30115043dec852976a6145ca08a277f4cd21a8c52d

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md

Filesize
2KB

MD5
5c36eb8e1e3c51a274dd33726c9ce2ed

SHA1
3e27098284de75c4abc6c150856d59d0e81e4749

SHA256
445425f8b2f1c0b4a430c5f7b5cda0bf034cb5d5d40d2ea71ee6132be15b67c2

SHA512
51e1078028e2257454c1d428a7fdca04202907b19ed7cce27d464a1295cd2ce9f1f41a5526e564148ff1eaf1a752659df303be34ee4f1ac6e9fd78f02a1eebbc

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md

Filesize
5KB

MD5
b823bc7713f8bc85cabedaed10b69df1

SHA1
3c500b975775c54455493366c528ac0d3052b5ab

SHA256
7c98fbede4cf6fe3e67bd491eb3ee0ac52b1ebc86d2e364d51f00c80c9b01701

SHA512
9ef1ed5656048d075a610e544c85faa69c2e9edad46ea405bc9a0b6b8d09454ec8115c57d12aa8e5e0403e56f4d20caaaac455d9704e9725e34cf96bab1ad591

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\public_suffix.md

Filesize
17KB

MD5
18a1859a3645ee2afc3c8424aef5c461

SHA1
db873e012315f4be043f81d4b2eb4384ef1ca1bf

SHA256
87a96fe60d32d389144bdd4cecb4f46652edb16150c0ad668e4e5935b3423706

SHA512
490c2e721fb77f5d1913c8711bfd19fc93ac26e06901d16304a00653bf53680e0e9246b83de704c45d37d736b3cdba857eed9f2d51ae218d28d8e4cd541b1c40

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md

Filesize
320KB

MD5
dc421225f1d8046d140b2b752e101a35

SHA1
b8da9a39e0c72b81223edfb1bb29df639945ada3

SHA256
85773c0027127cac95b1585c4e599a591dee5984d51e505e8e1e6c6bee8d2306

SHA512
dba2de1be803b30ee03dfc92b6707001d340915db1046d7003c453bb55f32104a392c732f1bfe7613cd8628039c11dcb10689d5f9fc394b73c8562d49a9a4002

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\asm.md

Filesize
1KB

MD5
5e90cd797860b05f9c20e69b7a9fabb1

SHA1
96a241140e5e8a7337b974b46945aa965dc00a43

SHA256
511a01d0c32ec09feb63acd5686e6f08b2dee6ca449c1019bae973a28a405e77

SHA512
b5d06bd0fa0a2cddfa7ca97949420624d1170c6267d63bff96e29f520150d5aa866faf91d69a803534f05c2a526099eadbe9419349c6ddf4f4999b05bf4d8221

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md

Filesize
10KB

MD5
d6b8311eb8e880f92782a98038291af3

SHA1
019defc81853ff7c2c3306da0a351537f3e1739e

SHA256
981cd1ddd553e0360ea59eba2c77e29d91773077cfe18bb1249d0738c75b9a2f

SHA512
c9a330895607d1326330dc280dc6f3f794f5cf7182ae9b04a7544aadd620a497ccc90177e5fee6a024f401ff23f5a1e723d7c9ad7643a4f46ea5ce531f5e2a66

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md

Filesize
3KB

MD5
18bec145936e95982af81be238b5805e

SHA1
f4242e4048b9f947de7aae41617149a33f0149b3

SHA256
15dfffb2a1fbfd946be39b854d8022450a131b144b15176e9fe8595f76b68fbb

SHA512
fbd1439d099b2d095c18899895ee1a84e5967d555d66b384bcffaa869a58f671d95bdf46a6bc6bf3d80f4a753d016fe0e93bc857b0dd2bc49b006a2aad824ce1

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md

Filesize
162B

MD5
ddb45f7ee436b94fbe74740fef2ebc9a

SHA1
c5a8f2bf9ac5c95d1dbbb636e3ba08bff6585198

SHA256
86d8bd053f75f4feaf7a89a1a32cfedceee727257dd2e26e508e761ab9cf0f71

SHA512
cfb5fa9bc8147142e69a89ee1e957fbb5ee27a31e941f60ffb60b22ef1569ab3ecb7a12e18bd4a36b8216cb45e26ef6de7554847b370b60f1a934172177d1139

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md

Filesize
1KB

MD5
0af68ee7e1063e727784b4acff5cc75d

SHA1
d9296e5806cf367405cf61dd0c48aa573519fbff

SHA256
302d9d665ad515ca8cdc3843ad747bb4c2b8d6dd007af0fbd8ff0a4fa3ee724a

SHA512
9e638f71316148ac34b54be48f41242cd4f32b3c6ef5bee2532718a390f2b563554d75fe4c6d39ee6c57329a7a9fdb7f298d00182f7e50832a2a2a2c23a68042

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\dom.md

Filesize
3KB

MD5
4252602a4490d129c6a133f98c0487bf

SHA1
4c394c40f09b0439773503e5b38756752f6ea257

SHA256
b89c230f1786bdda8fb3a27f50d6e8a46188d725378f9d05133b8235a31de066

SHA512
53cc2af0750f42066bef2382d439b239aa555c2ddfdc1d1119682ed2f9dc9e342b4d96bbff0afa4e99d3c45d589e21d1f357576e17d7939dad10248b21da86f2

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md

Filesize
1KB

MD5
6102bdca90f523768eb9693c82297fad

SHA1
4d01cf3d9bda61d756ebd66d53b2dd08d5f046d3

SHA256
f3f86791d0b81391123356d68ff914374a03f67b88e139c83a99823444d276ec

SHA512
9183b801bb91cc70d453b297f2dfaa604c468d2fe8bb2ff87a55d50af9413af9aa60ba793dae4d09faf53159253518f65cc955dd4a7e906a528e2875df86b99a

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md

Filesize
28KB

MD5
44cf12385c144ac211598e5f23bbee86

SHA1
dd123a678ad0b6a96cab21f0783a00c33f39a601

SHA256
495ca5b5f29921e262a82ebbd7ba78dc0e15e793a707ffd99345f230774c2447

SHA512
32d583d79a06a5f178e61ed769977d4dd0fdf0307117c7cd4ba632179f05b1510f0be3b108e09da462dde2a33be0502a0ca8cd6aa002475684113bfcd9d30898

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md

Filesize
2KB

MD5
bf8832b43dbef65ccde88d1f6aedd120

SHA1
41911006d8d8b1d705e383bd5d785a0832302781

SHA256
41fa6d80fcd5ad5963ffd5295d6f53bcd5b641d2e7dd2d4d40d7c95c47595e38

SHA512
1c7f93aa2fdb989eb31abe49a60af0faa723ee352ceb078b81624318578af69d9096307a824feb26af66ca8eb9a06a6f3e4885c2e7f0c9339362a7967953643d

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md

Filesize
1KB

MD5
9d522b1a7f3729b1ba81d4b031580591

SHA1
f7c5ecd95317436873862ef77b5034b85363d17c

SHA256
aecd43b4c7b6e558595b5132a10a33017ec57a29a27589d8203105566da65c70

SHA512
0e92784a82844172df2174595ed228785ffafeddeb3238cacbdbf9ecd35730841130ef165b95c09c083e174f1af85a6900764b9439310bcbb6b504b55fe3382a

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\icu.md

Filesize
2KB

MD5
0af5371405283336585157d93d0f1721

SHA1
0d369fdf1ec81f4e09859c1a8f15ec3944d2560b

SHA256
b3bc3c83d33940a920b62887e5f107718f905f94f44a55bd567b2d7562d2abc7

SHA512
a81b893f7aba7463fbf28135760bc9eda2bd92307155d3e9ac9d2c25627386cec66307d1f866209940541c4f09943899fa93abd8ab466fed154df52edd3dd2b9

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md

Filesize
1KB

MD5
3955f60d3736eee15e7d021b60dbc153

SHA1
ac348f46fca43c8ac8a23b74b06f21c9aedf03ff

SHA256
c88af592c5f3f819ccd68941c7fc2c7f0842b7a4a4b91a4152823f1c021f07ed

SHA512
59ed06f9f5a3071d406c234d6084362f457b503c61bd1051d2b9d667c44d1c870de4bd7e34ca0782ae82fb66f15acad4ebb7596258b4d38958e2ecb954a85da1

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\joni.md

Filesize
1KB

MD5
381a73920985bd4e23cc6b994f171470

SHA1
5bafa4a58468da9d960ab46ea290f485e65b9cfb

SHA256
4564f64d1e6e646a5ffe7b945937dc1b3cefeb5682c61b001302b2240dd11504

SHA512
7a2f911c1172c11f78fd4112dfd11ff2986de23f39753faae0f55299ae2974e53a4096a9dc1daab76d7dacdd77629e7c191090c9e8cfc83a944cfc8ac71d3245

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md

Filesize
1KB

MD5
9c031914d661971452adeb99afde9bd6

SHA1
83af72241246c3ece7639fdc51a2fa5b1d847907

SHA256
6c04e0b99cbd5d5167eb7822a71a83b2635143d35c69814f076d423e0e221301

SHA512
8091faf7eafa0cd880bb5425444d9e264f0e3ea807c65d869f7f799fbe7d7a993cece40485dad2048a119bde5635301a8239738f876befeb2cba5f9d568005b0

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md

Filesize
3KB

MD5
8b607d04ec145a11ef1aba172138a647

SHA1
1ad839a97fe29fe9d790126fcd86c022d021ecd4

SHA256
33c0dd1de70328c7cb79624f5dc9f11b542121ddd01a20e0ca9dfcbe5e3cdac8

SHA512
b9ebea64f559add6452a531fb7bdfdd441540865212ee6eda32314d31a73c18b72fee1eae19715aa2d82cca03ef8ffc94733b563fe617b5463bf998f741a353c

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md

Filesize
2KB

MD5
88be8eeba8328bf5a158819602327d6d

SHA1
2f95e87f477ada8fd17dd34d7ff2e1026485059b

SHA256
11d87ea9a3f57a1927bb35881490ec617f068a2ed7d6178a3845c78c3e82f17d

SHA512
73768e2fc75250e99fb40e5c63d69ba1fa088bfe94b8810baf5b57238bcdff99f296486b8013fc7b97aab9cbe8122cdc95395a0ec0043777c94b5136dc7fe746

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\libpng.md

Filesize
6KB

MD5
eabcf18e6cee3ad79e6914fbf21b3df3

SHA1
77f8fb0f0d436f00c40046beafcafbfb1b52cc34

SHA256
317eb46ba786d5e3e650d267d6555570203da1fe40fbc4a4ee2fdff8215b990b

SHA512
b9ef103181b081f7ddf51078ef1592dd98af352523d30f60aece9cc36c7a0818cdf8f9c6564f84f505fd99ef15a98405ebd88980464b2e8ee6d5f80a88e24fc9

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md

Filesize
5KB

MD5
d7610408be3ecbd0418465e11e6e45a1

SHA1
5d3c481018bc3fb97de28e9e0f2d85f713828a35

SHA256
c58792d51a8bf0a43414c3d443cd03a746098417cdf8c9e3a3dde243e7af6dd1

SHA512
f40dab3b435d06aed488d958d9c3fc1d6f89be9164f2cf836bb24147c1dd821d226a77ee71e7450f8141acd844d3c42a93901473fba5e8002c2314937803c9ad

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md

Filesize
3KB

MD5
7627b7c116574646db3d255e360960d8

SHA1
57578b31e16173dfd27c2720afc07f70e8aca834

SHA256
4bb0c9f27432e65614d563a7756cd370c8d60a82285bf62f77c90f57e2a4d314

SHA512
48b53af22a26047c6c210804eed49861e3fb50eb6ced0e76843f2116bc8fcb1abcb94f53830ac60369d4d5ea363aff7c60800e983b27b095a54aa00eaa3bf64f

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md

Filesize
2KB

MD5
850fa37f0f4f656473242705de1a67dd

SHA1
460dbf755e68a16ce6e64379308bd8a7c755d3e2

SHA256
43ed60d2c6063eafbda6af82fcd3312ec1b32be88ab5eb625a292330550536e2

SHA512
d2639c184c86fc3775b8ffca25351e296e9fba080e349b739df2f5db9564eff9b5be3cb098f04c7cdc6d38b1dece977c24d5bff5b3b62351e896fbb5aa32971f

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md

Filesize
2KB

MD5
7933f8efd9e8fc1161e7be4b7b4a59d9

SHA1
59b2cf145ab8d93dea0d170ebfb4ef942a28fe37

SHA256
071d83492f73d89fcf20ca661cc0c06f7894457bf8d1ba4c65424d526f0fd52b

SHA512
43de6b6f13c7e174e081f3da49948ab95b657c4a890aa3384b6c0db7a5ad470eca08b1f248a015777b6e680b1aefa867824cbf81051bce24391d2476dea484f2

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md

Filesize
1KB

MD5
551b7643e2313da9418fb7d5c28cee13

SHA1
4f0b29c067031a0981c8bd11693a4fd0f99ce153

SHA256
4b7262baebdf262cc044a1c32ccc3d16b2f14aab38bcb7bfcba8a477cca342c4

SHA512
4c7579115794015fbab6a8d37480017d153a5d355789516fefe12c64ca7c1e000553558ef8cd879230dba3cf5004908e238054cbf2169e21e906062776bc32cd

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md

Filesize
1KB

MD5
c189d4c9996bb91603caba9138bb2291

SHA1
6e433e6dc99c503f0341ad37d4275c8a19a57fed

SHA256
8d5355bbfd6beb763162ee9317be9d65434a3a4f4c5e09c4888a11b2ff20038c

SHA512
daa6f25f32a0591cef27b537f031c3bd900e9556c15c9fbefa69fa49c7f00613d874b59fb0902cdbbbc4a1f9c541c02a490394645f2c42a5686c3e600fc02ea3

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md

Filesize
11KB

MD5
0bb5f20d3363d912d4b65f0a5c1d26ce

SHA1
6a3e325ec63118838faed09d31918b24539c798e

SHA256
a806b3abca50e17ef28b224bc53eeffb14d4e5d4c1eddce3f7ad93c3db40f1ff

SHA512
f653ecaa50f5d117575d814b56a8e03fe1c94df48ea64452cc2e590a4e69fe49ba7570a20b7755e1ad7a4b32386ccbe47ab6d3f45b6f80a598b33cb89636dfa3

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md

Filesize
1KB

MD5
ef2684fd36084582de803a2c53557a2b

SHA1
8f3211c4960447e3d2445d14eeeebaf19cd949ba

SHA256
206374c5bfd1a51964fb28b40765535ba93f548d3f6ebf9a87424adb3c49ce0c

SHA512
bfff61d2e50d4237c535d26e39ef1ea6cbbc15a1a8abaca095acaab495fc234edab6c44ffbce066404f37cfb57ddfe2e743adc0ff04f8c09ded5e6f6d3bcb531

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md

Filesize
2KB

MD5
35fa54d167a87e67a9ec4f665d10e659

SHA1
972c0976b5c4afe03ae31f755bc848d72e1d33a2

SHA256
76433fe5557fbf8d8bb2930d7c04944a46acca628732f66ca59c79400354bcb5

SHA512
bc8f71c6649446b99d2251d454c7199c203a9f7ced030b4cc4afe76f85c4228d4beda303edae5be1af4784fe8ff4226abb9cf7b365f5abe4af9609bd8d28694b

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md

Filesize
11KB

MD5
7f95d43f4752175b40107050c451c468

SHA1
8fdd965449684e2ecf810d2e1e91e4a7b8cad122

SHA256
694ed7f197668a4c1398d8692f24708584050f9bcc5af93f56a10b5017ce5f49

SHA512
900e03f87d143ee81a8c7e6a82f53042796e39c26f49c174f22a41ddd3ad5ff3f1bf366ccc65f362c6358126710f2226bbaf53a9d3b985d5db8d5ff82095f634

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md

Filesize
11KB

MD5
e026ba73b224656205f47563b67d3b17

SHA1
3030b379c360a58fc30a4be73172c8f02304b937

SHA256
06ccd846cf256851eba072a97041c62463f0ec3ff842adef7810b8b302146bfe

SHA512
8cecdb69c09b3362f822b4c93015cb4bfe44b61bd5ad267b0f0a0f60a79f782e8f7139b309bb858933ab2edef9dc143df48f117d3b7576ca06d5f3e98c84e894

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md

Filesize
11KB

MD5
5b707ef20f65974c042cdef299c4d8db

SHA1
18dda92ef6865ac86369fe25ad0290cf91048d93

SHA256
88cd19bfb83fe7c522284baebe49086c3f8a1651805cc40218fd1df45638d095

SHA512
8ed4b50528f757df50697888c60551a592fec50367cce9b3ab4d2dbdcd607846fb632273120d75c28042eeb8b87df3aacd02b5b8c759b0dc9e4228f3d66f1345

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md

Filesize
1011B

MD5
9763f1de8a9a9afaf376ec3a87a183cb

SHA1
d8a6e45dd891c550406100b51020d3c15cb977bf

SHA256
434b3dc18e3ce2f315b6ed78f2859e3a25da62739210b8229513e0fd4183bb53

SHA512
7403dfbec9093c2b96c981dd098ce869c9604fd398491d5bbe11055c036a70516c2f4f8d0d51c639ad9646417c5faca3e406f5c9f0a8da64186c946cf0beb7b5

Download Submit
C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt

Filesize
42B

MD5
8c76de4c97fd2c789e35ea2a4fe052ad

SHA1
23937c8e668ee907a665893b72fd5c7edec0cdc5

SHA256
9c4599c3b6019d0fcc12ca6a98d08f5885dbc6b6cf7ced431ef3446bd7a8b7f5

SHA512
e4639efdbbe178079f947fa5f0e5a46d5f39191b1004745d544a034f2e34fb81ebda5c210f23a31ed89b37da9c0f45ce3adbff4c30428c678499fcc29eb4afb5

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727655840085328.txt

Filesize
77KB

MD5
79cda236628e1f42ac6f6ec7993ca855

SHA1
6c18291d4a681934622ab02d1dbaaee4844f41bd

SHA256
8e0c537671d959c9dfd6a58d76ea3f0810db8616129766e49c39a206f2bf1fea

SHA512
d52577334f0e382dd8003fd20b75c73bf633208596e6e076fe7aaedf1cd9807ac01ec650185fcbbfdc43b91399dd5d60dc07a2a184750da72b703270a436a14f

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727656363999749.txt

Filesize
47KB

MD5
53c711a8273baa211c4f562b5084c152

SHA1
01bd7fd0a088363d1bc319dea97a0849178f5e5a

SHA256
9e8cc2fb1aa3499c784eecb81517417d2762ae6102760c3b43b729f3e4d96dae

SHA512
aa7bb3ee903334d3a6b9e9997325f7e97270ab43b8c91fbb7e9c411591c4ee7ae496efecfaf84c48fa92f98fd3644fdaa456cabc40a7a4aa52d9f939540f1e32

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727662640605367.txt

Filesize
63KB

MD5
7a2ab80284ace20b2a094d6c755aaafd

SHA1
a3b8012aa110422537b49ccf150aac74809a067d

SHA256
f50de385f4c3b815d66aea35427c72a424ba7004d57a7a2acfc06e036c554e76

SHA512
aba425f8b05ab5c4dbe7beb83523c0cabae229601fe2b5025600163dcc80f943cfe24eed68a550a52dfa07bab701bca05fe39633207bcfeaa272feaab6c8dc91

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727665714398674.txt

Filesize
74KB

MD5
7357b238a7a080e829a2b9491486a167

SHA1
7c3947a665a93452b8fa79c76e80b3c75bb791e2

SHA256
819cc3e4bcc776c99c9cfb1ac7364cea8c8c85d9045dfe2f199adbed42311102

SHA512
2870cf3df7a4dd4b6b41828392d56cc0831def8741c79deca0b7fff7a006ff90726c4bd64bcc86612838af7a6588ae0df032b1a162f3c5fa9caade7e0e0c750a

Download Submit
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\File Explorer.lnk

Filesize
407B

MD5
1ce24b70a53243c06ab3f0e15fac1d86

SHA1
e3837974421fc7038aa610a83d703d4c12a76b53

SHA256
96493a45c11604075c1164018e6cd949d59ed6679b42c9b41d8ea86392a9cfcd

SHA512
9355fad48319388e7ab6c8084c088b2ebf5cc4c0c6adcbd6af09fb0b769684b7e5387043447811920350f997dff1fc3fa786a27250c7bfa69cb8710974066c12

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg

Filesize
21KB

MD5
10647c42ccad32b98abdde7f2c3e2e1d

SHA1
b8bd97aa9a32a253d8aee4d6a26e49afc9a01b5c

SHA256
68eb3e410399590ac06cac2df2de357fe582ece04d33cdf554256157a73556e8

SHA512
80b3c7d1063e30a6c4c9b69ded3de30a02190066553096e492164024831836a0cf226f0f3afb174dd870a421b0b810a2e9e113a5cbf0292afc3e71ca8beb185c

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\HelpIcon_solid.gif

Filesize
1KB

MD5
6a087d2768b22a79d83d4e02d4a6347d

SHA1
b0245daf68b939ca67d9dda005139c53d2fc8408

SHA256
27d6e66c51f17256899a951d59f5b830f07943ce7207111dfe2e72753f32068e

SHA512
17d670a882016ffbf6320291b9e35ae335eabb17163951f533f7c73377e5f1789b264f79271bb17390df4d08594fb294f0a71d6d74f09aa8cd977da6e2750aa7

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\alert_lrg.gif

Filesize
952B

MD5
074cf875f5a13034f323c50331100cb8

SHA1
f2d4fcc732cb49774fc7cdaf7d46963df505ff7f

SHA256
e06b9770bac42777430af86b313b3570522ceedbfc602c4d2af0f511fc96d2c3

SHA512
6e2409f906c6558690d4c9ca2839e62fb33f0c435a4011e3849bba2f3052623a48c0e8ebef0b3496e39f017f87f1c4696ded0f4deebad6660ca419afad4cc942

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\aspx_file.gif

Filesize
121B

MD5
2881ff84c2106d4bf9f316d3a9fcf6a5

SHA1
60db9fe3906c9cd03d189a0af9222771458aef5a

SHA256
555c79b951c598176705eafe49062576b976fea88324449027de5a6228587728

SHA512
de7c14bd9a113e9ac8de5c3dd3b617b6f4e115080e584e59b578ebe5e1df68de63259917d7c5121dda134e93dad8bf70fb61731a481d08e981899f5872df3170

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\branding_Full2.gif

Filesize
1KB

MD5
bb84c9237fb2d742484ddfb12435ddf0

SHA1
40261156cfcabe7b2fe9aa01e30e3662de182c19

SHA256
a5a883e51fba8d979b9df07f752928027a98334ffa4cccb97f8ce5a123f893e4

SHA512
d688cabe519eba38027e32315c8021ca4dc19bf858a112e2d522766d897986de3bfdb591a67f6b23d7f79ed988296aae63b0e572f25848812b76ab7aed02e4b7

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg

Filesize
8KB

MD5
13d2ed4461591e2bf3d2468bbacec0bb

SHA1
7955060aebe6489def22b40126f1981657fe28af

SHA256
7ca84120708b1471fa59cd6ea5f380cbd2a68c70050caac9746fccf9eab1e0c8

SHA512
0266eac9d17416bddd737bb00f7448f463bce00c9261965a10c64797c445dcc5c4cacbf80ac1abf0a2fe0a7f78bf99078855bf9f8a2a220ea3b30cc61ee988bc

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\deselectedTab_1x1.gif

Filesize
61B

MD5
8bfaee9a92b9adee93011123b6053d7e

SHA1
c561ac7777d6bb6bdb8b192dc16a982754b2544f

SHA256
bd8cd78ef55735e7581b77b6420e547bfe164c76677ceb6802bf65db20d8080f

SHA512
4c6bdc4301217f311437a5fc0726bb4a6413bd7dd5518c85e422a0e33973bf11f8b31a76441f89203ae81287b51bebb6865a962a39971666b6824a5456f98b85

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\folder.gif

Filesize
914B

MD5
a5978275fcd1e73b2551b12d412f5f36

SHA1
6a4e5d4442cd792ff4878bda6f176e53ac3c12ad

SHA256
82a5d49a4921bf6d514d4152922a58cf366c789b6220ed04785812ac5bdef849

SHA512
9d5912eb6ea18af1a8f24849f0bee3076fe109ecdd92ea7e8b4256fb99dc072e30fce8291e2f36e74ee275e48b3fd3a58339593929deea9173d7f5d7c68459c9

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\gradient_onBlue.gif

Filesize
90B

MD5
589dad413fe18c4fc83aed51be27419d

SHA1
6a1e3ba4de34432bf7a724890937c12bb35d5577

SHA256
a9b568e854845776fd727107e98ec0759c8ad519e5d8dcfcd2dec36288fcf99b

SHA512
98315a8b6be00deb97e96bc62e49b88075b3c94433159197e8dec6f967cc0bb5e0ad250240a6c760d5ea912e2556ae3cf484f414a6a8c2aafb8c48a8066e665d

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\gradient_onWhite.gif

Filesize
90B

MD5
70834545f35c89299f35866ca5d06c74

SHA1
788014ddf8199b1ca0494db252350561b7df1e61

SHA256
9e250a4185c97f2ca887ac130f76336367c1c4f97cea789b2c00a42120a5b433

SHA512
67cad31d45a0be59e32984ebd9ab488ca7bc7f6fa0a33df1a8a80b8a8601cfd1104e37f7f1979fa2c2c5a9ef6d197c10bc73b5891a512e488d50256312a8a983

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\headerGRADIENT_Tall.gif

Filesize
328B

MD5
3d2bd36e4b5eacd311784b263bfad2d0

SHA1
5ef7fac83f3e3171f9c5091bfa011a4c17f02ba1

SHA256
bb9cb48db83f101eb8e42999fe10c483ddd937225080098c3ed6dba3a8b64b74

SHA512
08fc97537ddefa80fe1615950969c0774cd8bb7ad7ada3f45ed9c226c390a972f8b58a081d26aaf5a8faa48e691a3b2fdf68a897437077fede3196aed8d630d5

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\help.jpg

Filesize
1KB

MD5
a95d634483bb07ce59bbc9b366e3d5b5

SHA1
62087319500ab9a6456943b137db01f961e104a5

SHA256
7d5d9dcbb8c4abe8e1b93934f72e9099854e0abe5625fc77fc12c596362b3945

SHA512
4b36c349a06921fe4774821f6c639174a86d0aba51d64522e46d1f088541744d68ec37ff79984829083fce5badb0f8ce3924dcd90b037911b746c5b395851b9f

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\image1.gif

Filesize
162B

MD5
060190848ae3385c809a04b6e23631c2

SHA1
7ce5a1c963a906fc430b543ba269c8f2a549b7fb

SHA256
c5cbb1e00571f70102d3c26271732117b2f8af8b03ab8d82b66eb6d782f3c54d

SHA512
1dc327cfc5e4a91666c40e0dbe1f29ee60854c0b457b68b5e4aba397fec85651aa610971b97154720d2ca7d0771e59a4ee1faed0d112ce14db3ff4cc82fc73a8

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\image2.gif

Filesize
586B

MD5
a812e6c9024a016fff2eaf0b52977497

SHA1
36bede67deea9505fe23a4ff5dbb05210bb8c0ac

SHA256
015ce02b75b140ba1a55374924914339a8695983398aacb93db1fc81b2f24c2e

SHA512
fdc44e50c6e54e85f63f4ac00e2b650b1fd26efa0910a53f54820c1627fcfbb607726a9f0dcd3c6d3862ec3ce5fadb3db1be62acf208b7ba6fdc98ecd4f5838c

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\requiredBang.gif

Filesize
124B

MD5
639bf073b6c3d3c7a731f81147f79ab5

SHA1
91c4f909e83586b7ecb4d179baf7bb6fbe24b02b

SHA256
dd6bc779eff348df3b8b21a25de2c6a2e09fd78d11f88ce1058b50b8eedd1602

SHA512
96a6b3e45eb008a860459846f3eadc349c7a9e30910c95baf367cb2a748d1a180ae2fb7908b0b70b063276c2147f5c9fd2b3dd084c5d381f209631d7f5f43a43

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\selectedTab_leftCorner.gif

Filesize
65B

MD5
0df8bb82b920ca406867e6f7f2d07ba5

SHA1
31c889e02cfe7a00c19328f7da03f97cb31f5611

SHA256
ad118ecd5512186671a4219457a997d3b246d27a3f921004db75cce8fded9e62

SHA512
910ba746e0831ffcd6882155c3353399470da17d6553938aef804dcc37d572db380337e3cc5f083aad7c50e1ec5224ec3e85918fa32acb37027c0f1ced43f7b3

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\selectedTab_rightCorner.gif

Filesize
65B

MD5
b386d9ef3afc1b0d87fb111288f0a588

SHA1
f79158197943aca05a935e656a8dfe223b3e148f

SHA256
ea076e16d729ed55ae99fd35b73b707aefafbd42d2de72ad49d5ca3222ffd212

SHA512
a3e4c4540e2cc3104ad6f7ae6dfe019a373db084c8e8d89fe9859f50d5aa7c88927c661bcd2106dc70cfd146f6343c9a2cecf3b6a869a9494ec14217e043a21d

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg

Filesize
8KB

MD5
d7110f8795641860687aad9dd1d08405

SHA1
4c24cf6a75d0a54276b14bc0d8e361f0301ecafd

SHA256
fafe4f51509a5f8b859e39a738f3949fa4baec2f816827aa816984d5e05d781a

SHA512
b3e5bdb3cb179a800fd7a5aa26f195699730b0fa4708c61a03cb095ba23518dfc1a1a953e89aa8a3bdf092f5a4e525566b0886711af9b0baa8e8b59e4ffbdb18

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\unSelectedTab_leftCorner.gif

Filesize
65B

MD5
1fda1663952614686eadaa284703b633

SHA1
511f067073f2cd76bb5c213d0d30398aa056d8c4

SHA256
2c6ad24bf5bfc377dee4f1b3c351cb329f53f64c86448049dce9841fed28954b

SHA512
b5ee7641802041cdd818ca7e6a0b3a8983322e2120df551037e1719f955b4e719c317be05a0575f8ef2f3f11f44842df070b8111d5021c1f34fae6ad7d85fefe

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\unSelectedTab_rightCorner.gif

Filesize
65B

MD5
4f9308f9733089f569d1d9c05c9b98c4

SHA1
085559e194b96be85ed6caaf6f973ad4924741d6

SHA256
fb3d6eb935bb884245ecc852fa03f64c1bcee703bcbb05077fb6d974f51219e1

SHA512
11808ecefafc9eb59cade71a674f39d77c7e8fb57024dc9bc8834f2504d4945780f9e764ce38ddb3cbff53a1148a6918dad6d302048c18db1b74c723c424f36e

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\yellowCORNER.gif

Filesize
880B

MD5
0a49713cfca3b65ac60f07188fac998d

SHA1
3df0f9247dff907abb266e0c9be638e99b2993f4

SHA256
927374e40bb72e4fce3ad7b80b37f00a955a2c275616f8017eca84c590d0c506

SHA512
abff0c0da03deef25a9a858dbe983944729697a995fad9cff21f37158a145e3921299c2a8f57ed528521209b4bae631493c5ed5436ded63345f004bc142ec368

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\security_watermark.jpg

Filesize
49B

MD5
32bc12fb1a2a746e3a10c76c464176af

SHA1
5a1582fcb66b21ba1b62f62f8e2971e7608f37f5

SHA256
5236968035aeeaf5b575819b2c94aec8af098f686b80339e530f2d2fb84a8b03

SHA512
fe249080dcd56aa51dd5eb26f930fc5559beea0186ed2235d3005e6b5ac0869a1237c211be31435d8d56f42ff41cb384367a37d7417f4ffa40ca13ffcf016890

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group1\1 - Desktop.lnk

Filesize
1KB

MD5
3ca9dbd5fd320cec08fe9d2d99d42471

SHA1
032b295a405fbc831cd7db3828ed64c5f73626c9

SHA256
852caaa2fba241715605c30f6006dddcbb8da874315442cc5d5139117680ce40

SHA512
3fc6c0d5640d806ddce9c2c44ed8d67c56aa607fabc962e6c2b882b23f7e1613156637c0d1edfc3d8c257cfe5c6913a6012f0b43b0545e63428eea72b5df5934

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\1 - Run.lnk

Filesize
1KB

MD5
222406beb8b0eac4ca75156a9c0cd013

SHA1
74ccf7e388f94e0b93d605093d894ad20cbf862e

SHA256
a1dd8dee724a50896030e9fa056bf7c223951fd61eeef251c6167dfd941922b3

SHA512
13c0bc3759f34731e12907049efd1d2c1e0c52b68b655811e2ff83b9f6859445e89b3d8238455adfab02b9efca33dfe0351d1e493c2ac902e115fd6770401b2c

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\2 - Search.lnk

Filesize
1KB

MD5
40fbe330ae841e11dc7393e3af106f3d

SHA1
a578eea0b33c6373c28f4e42819788d16cbc95ae

SHA256
1d0e9e7af9b20956752ff83d4c8fcbbfff367f1872f2f58e80fd0e9bfc6653d1

SHA512
e1a7478138ffe526285ccaa2c1b50cd7e35a529e5fb3e10ba874a0131ac916b1493f0f00a263d478784b3460ebc8a426b10fd6d8b39f542a6e37533a9daa6068

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\3 - Windows Explorer.lnk

Filesize
1KB

MD5
4ff726e869506484fc248b8682ba5030

SHA1
323444331aaa5616fcf4a7fa3538af6de1726552

SHA256
e40563535add0c600d0af4f5d7be1866a75c953d8774d4f350591f89847cc9a5

SHA512
a01255bb210b5387b9298e3d0c91afa1ac5294e55a34f30152998a38288ca2b796b6ccd003a473806ad36c404c8f5940a293e43350193e19feba1de77c43c4d0

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\4 - Control Panel.lnk

Filesize
1KB

MD5
2352de953d3b6bb063f918ab01c92417

SHA1
eead07073d85397aeb39d65138ddb34cb4ce93a7

SHA256
6f22dd2da4524ed9d482a0e76f33e8ac77f65b6d0a97ef90400b25ee641b74af

SHA512
58b74584bad6c4fb459f810ab62cf41b20b1559b60fd4d4ba6d4aa2976e770e535b854490491960ce5019375a73a8fad1814dd5e803fa0c3e55c3a9ff62073d1

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\5 - Task Manager.lnk

Filesize
1021B

MD5
33a7716ae6ab523120e431189dbbb7eb

SHA1
9859439271221375efdb4eee348fa629ed8dffa7

SHA256
e8aa40eb9e74017891813d5425e4a10e8c34a7578c17d618b3ce3e65e5866fd0

SHA512
773d5b7e1a62fc43a2939a6deafdbc7739a90f9c1eb91341739ac902bd3735466f58c656c7fc1624054c339dc7927bc7bb4c37c58ab9eb111aeff82ba02d46e9

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\01 - Command Prompt.lnk

Filesize
1015B

MD5
f12423dc77cfe3f5b9a29d636823a840

SHA1
7056c83dc7b04a28e3d9940adbd7f43b06a70145

SHA256
df180789f1a0c782ee31000807f0f68c815fb9ea4d34962a3faf49b13f64bd82

SHA512
76d1b56d7e52fb41a2ff8b327bd6d46d1cffe164a3d56b272aeef5116961561a8b8406bb8eb20f81ab58387ee3b5e50935d5c1aa1ff5d1e9505937668ccc4144

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\01a - Windows PowerShell.lnk

Filesize
1KB

MD5
71994f71a9ad35ba6939e97599fa04d5

SHA1
2aa5d89c1acebd2ceef5553689e00e54d2f8e326

SHA256
f270902ae00ec91b26bf50dd9c5aec96d2089815c9c1ed0b4d61f5f3bd028823

SHA512
099ab6317a75e256ca9f18ff4afda1b1431fd00a74a2a25bf5c57a9f326cc21019b63d666cce41e6ba57b535d07851192c53d3246dd56afab95ca31dbf415d20

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\02 - Command Prompt.lnk

Filesize
1KB

MD5
1393bde73f7ff58c13c77d506be071d6

SHA1
d514f569ebd298b65d6c9baa183aa236e73cff6a

SHA256
45c60eb4ef880cd581489f3ea6d21f4fc4b726f5b8c801ceab181b0621e4d446

SHA512
30b7e1b40ba7da19167c606b35299d48f92db2a622af8d145661edefaf8cd9467545070c797fc2740233e357ca976026462f8336bc22b55f66111ebdff02ab03

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\02a - Windows PowerShell.lnk

Filesize
1KB

MD5
983e938d5b23b37b70d3adcc422b6e21

SHA1
987b771304e0d449d54b7e2f04291c9aa5dde1cc

SHA256
05973dc112f0b431b68b82dd375feb8aeb5a2c87d44a7d481e29ccf525f640f9

SHA512
7dd70dfb368c2fd444b33747304a053989b1027df389aedcee64d0ac680c432f5cca1ae1a0af854e3bbf904581ca1265c789f7e862c0f857ffea5d92653d7f0c

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\03 - Computer Management.lnk

Filesize
1015B

MD5
c0a90ae137cbe413136f31bb04c7f4e7

SHA1
bf1cb25aeb7e785fd5e2c4e35cdf67b46fe0a942

SHA256
9a5e42031232990050d806e70bc9d6f1d2626a66074f6d6dbaed33345a7aaf53

SHA512
12f01d52588f3864a6cb90abe6acc13aa13b6da8c7cb9624a181671b2925229a4f13a1ca3a103844d092f1d0f7d17065059268e9fb01a4d944eaa10e64062d3c

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\04 - Disk Management.lnk

Filesize
1015B

MD5
8962e5cea52bae6d9d670a67c92d167d

SHA1
330862154bb1b42b4660fcce904af3a5d9ed7ec0

SHA256
2a5dd021f32f46a63b30473fbea7a1cd394c8cfe50ffa94fe8010150b07be79c

SHA512
f836dfcb0c1052dcd2ab9ecf4e4e8203c2791a4d6dcc31a5c47c444e4ba8ef0b45e76aada68a1f66eaad3ddfb9cf37bb9dc3432c2316fdcd786b29d73ebdb5da

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\04-1 - NetworkStatus.lnk

Filesize
1KB

MD5
ebf4d4c346601d0dcf51f7117b5d20f8

SHA1
12bbbb583939e22c3c1d8d7b98a0b2b5f7147914

SHA256
1c45ea4f1671356a276b290cc21a9e6ff001dcf519d2c7eb7199d6d1840137df

SHA512
3cf0b1226f36253cd7c67ba8827c2d7fd63e7e09fb140def6fa56597e0dcefd6102d2612e2ddafb9f1c3175a0046c8bc988208c307acf1f13a4c30d7831009be

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\05 - Device Manager.lnk

Filesize
1KB

MD5
6a180d94f26072ccc1f414f81624cfef

SHA1
b4f591e1843cfb46ed3bd777c06c71a170045481

SHA256
40c9a817c70ec44fafaee919803eabe8d2ec0fa95aabc5fbd5e0f04e1a7ec9e6

SHA512
e714bd2a1ee472edf024ed98e7178b20ac0a9a9ebf4bce4c5d31f1c354b061c2cb6ce40bd9ca795d9fe748bfe0e3bd62fd82228d3564067496b0d3382307a500

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\06 - SystemAbout.lnk

Filesize
1KB

MD5
51544b81064a9ec3c9bcb2e0d3c3e505

SHA1
9d6861a98137d14b968699fe6b182a8841df5410

SHA256
e0eac713b703071407ac16c43de8e7243e9fea97cec9605e8755ec93a3b89d98

SHA512
009618a5e88ecbe336cf0492c8f2db54820c53f5dc9cdba8eb6c384b9eb8f6aa63b892f153f50f4c500c256713b199af843f69f85572be0701934b6ccf546fec

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\07 - Event Viewer.lnk

Filesize
1015B

MD5
dafd0e212655328023ddc22f5adad7c6

SHA1
224494df302d0ab5a1b9361161b40313fb4de73c

SHA256
1f36632ceb5ba875bf978aa7477155302466437cface76c9b6ecb882a74b3416

SHA512
405be74faf241074aaaefe750437ce3c83d03d787599ceee7eff3bac1d85316b6c0058ce9524c5172249f9e086cfad8a57ce19a5e030f12bf2221757781c65c2

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\08 - PowerAndSleep.lnk

Filesize
1KB

MD5
bbaf5ba38904b72990a8f09bff07b1f3

SHA1
208d967e467f20fc1dd0299f9393f28c4a3fba27

SHA256
a49fb94ea31f4bd2ba4689c2f90fff5a3352b901393bf3099df8568f7e4ca65d

SHA512
2b04c1082b79c57c65611f8bdf9b41288a2ca978fbead71c57f7127013dd0beeb1d71bcfcf894a61da709c831f01f30107415c9431348855616a3f68f64bf6b0

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\09 - Mobility Center.lnk

Filesize
1015B

MD5
a746fb60635e8935e80083f2a78e9810

SHA1
a4636516e95c1e5c7a9f2ec81f5ef132358da615

SHA256
0320653f9e55160198e92300c8cc5da3b876b6020f858217e30ad24ce9baa869

SHA512
b91924c1cb98797d2feed02e01a1bc3a6fbea424b4543a5e8609d3aaca7c65bad5ec7c5b5c7144b16154ebd321893b187d97f522207daf3b4f5d7fae96b5251e

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\10 - AppsAndFeatures.lnk

Filesize
1KB

MD5
c9be3d041253bed5f80ecd42a50bc6e1

SHA1
2a48fbfcea636aa644c0137c94d8f07522ae8cc3

SHA256
658f1fc011c857a19903788194f80d927f15b73cb7e65e7102ff9ea2739e9eb4

SHA512
48864e86e4e3ae4941b5f95b0ee5cca01fae882f52a42d4103351665e48a35524f59bfafab93b57f5920162e549fb67cd089981c0219aae10bdd9a3468b4a3df

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk

Filesize
352B

MD5
b3b176b3b58e68a355464eebbb989a92

SHA1
cefb6da6a56aa06daed240161d0e5faef43404ba

SHA256
18ab3ee65adfb932c20025b3af72126092fbe2df9c85b7c1833fcb90557cdbf9

SHA512
901f6396d33d874a0aa79e7ea38a2386901215dfe02c99b139dbc03fc5334a08190c252a8ed7f0317da8a8a473835acc5d2bea64cf55a91fc4449002469691f0

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk

Filesize
334B

MD5
1fe1abfd69d2f06d09bf8837fef45476

SHA1
0b5d0d2ce0db7cd48d83d58523ef0bcf3ccc7b84

SHA256
892a0a1affd469dace082ee3891715a49f4c6bc6cc6990a15e3502be50168766

SHA512
96ab9376fcfd3c27daf047b52874881ae975e4ce758d685c79ffd0b9204391c32da6993fff7a4dbec2a089f0b7816bb6a560d65fa5f2ef265f982053eb0c7a5c

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Magnify.lnk

Filesize
1KB

MD5
4c5c064d383a235f338d85848bb5e6f5

SHA1
ebad6d88259e97845ec682868043e25232649633

SHA256
369762e41cada9067fa2a7eb43b0d2479ebf53db61c9c9e81a5e871fba530273

SHA512
f2ed3b0c3c6378b0782992b77467a3fc0367e7204b2780c17a63859135750fad53116e31436b96838032a953729e10c2349f31478c7032925c7ce769bcbb2755

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Narrator.lnk

Filesize
1KB

MD5
0e5fbd8b873f35160263bd7f6a9b5ba4

SHA1
651ef301d9621afb6490e2986ccba82bad84a615

SHA256
755c4d62054f86fdebaa3bdd5d105c4264ce729470461cfa98a916e69984aaab

SHA512
213fc2d8041ad746a8b9f402f1b96999b7378b675c6555386798fffb9890c43d44da903e71f3edc6805f186714fbc559156e0b5d7bdaa570b8a7df8f58a7be87

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\On-Screen Keyboard.lnk

Filesize
1KB

MD5
ea5751253f695ced432f8664118b5416

SHA1
899bc80baf796a125a5835677c92baffab37bef8

SHA256
6b322c37087880fa3df6cd9b33298cd3c66dec77eea3dd831dc037281488ceb8

SHA512
0bc100faf4ed745c90331f343ce6000a449ddd2f85dfdbddd1f00dedda9328667de25359ae454446a374b84f85331aed7f7bd1082c3ebb2e474058136f8311af

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Administrative Tools.lnk

Filesize
1KB

MD5
c15efad0b14e313967a03f13c3d4fb09

SHA1
cc52d2163f39e4fc7208ff3e8bc793309666977c

SHA256
9488cad588b1fc45702a1c76da5461de8b2d80b94d731b767448a1ce5443c473

SHA512
d9f79912349147feb4b6362a86775a8fa462f5fd1e039ec1f247f9ae5d74d3cd521380808f73f244f51e53b00ee0e98fb9345f19657a5c535474f595157a7092

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Command Prompt.lnk

Filesize
1KB

MD5
b7a2161881fceea80ccfe5855ebe092d

SHA1
ebf8d4e59e4542c25a4d829e400030450a7dfbb6

SHA256
b514e7f6c35bb63d83d1dd35abfd1ba022ae3b1b455331a0328e6b1388f4ea52

SHA512
ae7d1e045d18db461296703e2377f8c2e3b09fd5ab201d36e721b41588385f1a664dc1717e837400312237cba9e42342405522debae54861cbb98805bff98f67

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Control Panel.lnk

Filesize
405B

MD5
f577d6f36c0b82fc08bc4a998a323553

SHA1
c8440ded6679661e56eba5b354235421aad8df43

SHA256
2020c8fed6230740ff3864ece8c3bae4af4e0063a0c03deef091504784dc9c3e

SHA512
6efc22b565c338803b2ded4d2d18bd4bd5c8503fa56b35016ab2bedbecc074e249e2751d3c6626cec7e1d1abbc5540fae8bcf5811918fcf256dfab5e5e47cbb2

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Run.lnk

Filesize
409B

MD5
e03f3abce94c35a758c13f41cbfae07e

SHA1
3051d3ce988b7c30cd9151a14709936ed979ab5b

SHA256
b322b9b4466699e726609572ed75a9a498b4cf67a4de66be3bcf83aaef2435b6

SHA512
c31759c7e5908868355f2fd7410c6a23e5174e4e0ee97a373d13e6f09bc2c15cdd6690a4e68c061a85dce9dabb21386931f212067737c285d987ab40f9d5320d

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\computer.lnk

Filesize
335B

MD5
cad512bd3dcf4a88fb9b38e914584e89

SHA1
0a82c2ce6cbcc234f3b2b91e2cbadcc6fe24682c

SHA256
b5cbf7054c0a09944b08709113299c252788c28471bf36988fdbca8334659846

SHA512
31fe25ee614d94cac4f5ef3e02d8039bb45a1ebf6d8ed9b6b183cff70a5bb2a77e84f9edba7d81d3413f9d9387d62365c067e48900e261681de6c5a90b664b21

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell (x86).lnk

Filesize
2KB

MD5
bb3060fd4634e9dbafcc6247e4bcb1dc

SHA1
d77ee71c27f4ad6cbe467cba619a0e3b1bc61d3e

SHA256
68020ee6b35423e01046953310fbe0bc3629f931ed2766fb947584a1428adbf1

SHA512
f872c1c55d2b4f2df9f6bb5d796598c1719a29038af5c2607169f1617569c61069ee615634a35b2c913c93a878bd4a0ee7b17142e4f8e60d5a5e6efaaf23395e

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk

Filesize
2KB

MD5
9dbd1685d87db96dd342af33f045160e

SHA1
42dd532ac4b3b51f5b3fb146002a7ffb94b4946a

SHA256
2ab378786e728b614f8e810ae36c1709ab22af9565886275be2e5db995cd3fa0

SHA512
62c202ae0d9d922dc42d2021ff4519a3fdf47dd763192a8bb4a7375e36ad4fc2965f3be9cd9ef8d95299cb779e1f698c752e48eca211c301ad63a37277be3bcf

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png

Filesize
296B

MD5
29a38dab6c7d928f98302bbe492a434a

SHA1
03b3c81b98a887669340f4d263a500fd926df5e2

SHA256
139f21a06de2a77b67ba8d518b3fd560e7416edc206c14f6b0700a37572af002

SHA512
4dbd2b992305c6edd85baa5e0e08ed131063f8ee5dbfad0a096aaebf139ea38816793c342e72d342612bc62081a3f9efddf4afd13023d632aa77a7a74bc722ef

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_contrast-white.png

Filesize
276B

MD5
84ee4d5e737d96495d4edbfc6dd0b114

SHA1
ebd3049b5a90e32e63121d2eb1d1ee8915fc829e

SHA256
489dea93d18ea7ee5dc1055dccf95b3b6901322269b2c6e8f4d7fe5e2c791f43

SHA512
61e5265969e4e7f7841a089c18c804bf22977cba848b27ea4d3357056de09e04b7a2cd590bdca75ac0e9dfbace3d1900b43cb1dfc726af6e3112d0baac5150f3

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png

Filesize
296B

MD5
1e499b716513df7d754937ba3197d9f3

SHA1
ce528f47e2f1e80d50d0cde0ee145241a93bd19b

SHA256
6aeb21aca60b17707e169f770d715d4e867fd0292a907ee01045846830f12e3e

SHA512
8b5139661479f9a84796e1c3aab51c021d886d49bcc22794e21cfa8cd181abb0fcb5aefceaa08e4c5a3d3a6266cbb34381f3833869747362b12e7e4b886e21b1

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square44x44Logo.targetsize-44_contrast-white.png

Filesize
276B

MD5
7c113325d568b82353068c3f103a2390

SHA1
78d8522bf5693b00f0741d2feaa1ddb7aacb805c

SHA256
d90d7ab9da7283bf76ff36961977c2ad7385d60588853544da72c2c15ec98d1a

SHA512
4f11900bb132f96ff13eedb5704153f258d8e48a553c02a0f6226f137695c4044afecb9df98a1d27c6185a62332c1ea4b01fa7f1a3254e292abfa19c6da5fa2f

Download Submit
C:\Windows\WinSxS\wow64_microsoft-windows-onedrive-setup_31bf3856ad364e35_10.0.19041.1_none_e585f901f9ce93e6\OneDrive.lnk

Filesize
1KB

MD5
88a78e92eb4eef9b7819e1293a505a96

SHA1
8b1f10a51c949768989572452224ef9a7008324d

SHA256
30ef2cf2b120f9117bb3aec04aee2d85b4ff8cdc193b9032d0525d233d2b8e7a

SHA512
16daeb2b0b6ad94303ad379ec79abc8fa1214659ce19db39b43cb8c7911e822ebef8a093bd2c9f4a783c5418cee9e747c6d4259410d5d55a32bb98ae1877d85d

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads