xorist | 397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c

Analysis

max time kernel
93s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
07-12-2024 00:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
Size

7KB
MD5

cfbc736d5a16198f13e7bf360e5004be
SHA1

4aea5ace463590c5c2bd1cc571851e5e630d9331
SHA256

397009cf4ffa0f080835f9f2a43e50fbd91bd57763851a280a75aff029a7034c
SHA512

59a51ab1bcc070ae20e385e56ba2d0afe9e4ee6088cfe06e1de9c0d33cb4afe6ca55a92f6d137209b0cbf4a19eb2601ea4085e40e0a5d1e224e1993350d604ab
SSDEEP

192:Gzdrr1FG1WDCgmjPZPx2ds9ct1X0utLRMUA:Gprr1gkDCgSCd6ct+gFMB

Score

10^/10

xorist discovery persistence ransomware spyware stealer upx

Malware Config

Signatures

Detected Xorist Ransomware 7 IoCs

resource	yara_rule
behavioral2/memory/4308-7221-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral2/memory/4308-7225-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral2/memory/4308-10901-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral2/memory/4308-11044-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral2/memory/4308-11323-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral2/memory/4308-11328-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral2/memory/4308-11329-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist

Xorist Ransomware
Xorist is a ransomware first seen in 2020.
ransomware xorist
Xorist family
xorist
Renames multiple (2182) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Drivers directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers\gmreadme.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0OBBDSsH5F8mq7J.exe"	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\cpu.inf_amd64_0abeab1ee6572232\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_scmvolume.inf_amd64_de693592afe8a496\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\System32\LogFiles\Scm\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\pl-PL\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\slmgr\0407\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmati.inf_amd64_16fbf6520a254fad\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ProcessResource\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WindowsOptionalFeature\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WaitForAll\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\@AppHelpToast.png	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_netclient.inf_amd64_b7f9bb71730aaf1a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmke.inf_amd64_b83f029888180def\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\scrawpdo.inf_amd64_466615aad3be8e26\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Speech\Engines\SR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mtconfig.inf_amd64_fe91941ed205cd9b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCClassResources\WindowsPackageCab\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\basicrender.inf_amd64_df49c4daa6251397\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnge001.inf_amd64_1daeee8f3aa30fcb\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\uk-UA\Licenses\Volume\Professional\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\MsDtc\es\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\DriverStore\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\amdsbs.inf_amd64_e2a1e49127fb17ef\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_barcodescanner.inf_amd64_266a07997c075b30\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmtron.inf_amd64_0b075e1cb11005f4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mf.inf_amd64_e3c6d8265de5138c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\scmbus.inf_amd64_c78fd781987c1675\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnms011.inf_amd64_f83138380f5fb6ab\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\xusb22.inf_amd64_d0f2fd4c931f4672\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\migration\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCClassResources\WindowsPackageCab\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmrock3.inf_amd64_9977beff54a96490\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\oobe\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_UserResource\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Bthprops\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_fscontinuousbackup.inf_amd64_4db9ca877f67dd36\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmcodex.inf_amd64_f5594a2af66d11ab\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netl1c63x64.inf_amd64_4d6630ce07a4fb42\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppLocker\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_LogResource\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Dism\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\msmouse.inf_amd64_1793a485b491b199\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netv1x64.inf_amd64_30040c3eb9d7ade4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netwtw02.inf_amd64_42e02bae858d0fbd\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Configuration\Schema\MSFT_FileDirectoryConfiguration\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\net819xp.inf_amd64_ff7a5dd4f9b1ceba\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\bg-BG\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Configuration\BaseRegistration\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netvwifibus.inf_amd64_f52d5ad58116f6f0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\kdnic.inf_amd64_6649425cdcae9b5f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\sti.inf_amd64_096c9e42fe4749d2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\urschipidea.inf_amd64_78ad1c14e33df968\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\usbcir.inf_amd64_a19f675674962ae4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Speech\Engines\SR\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Com\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wsynth3dvsc.inf_amd64_1a08a3b6cd493e1f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ykinx64.inf_amd64_0bbd8466b526ef26\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmc26a.inf_amd64_dd85a83bc442ed33\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wdma_usb.inf_amd64_e879d41db6fd1ab8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\wbem\ja\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4308-0-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral2/memory/4308-7221-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral2/memory/4308-7225-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral2/memory/4308-10901-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral2/memory/4308-11044-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral2/memory/4308-11323-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral2/memory/4308-11328-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral2/memory/4308-11329-0x0000000000400000-0x000000000040C000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PeopleAppList.targetsize-96.png	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\AppCS\Assets\EmptyAlbumList.png	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\LinkedInboxSmallTile.scale-125.png	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\adobe_spinner.gif	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\sl-si\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientLangPack_eula.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\Glyph_0xe7db.png	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-72_contrast-black.png	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AlarmsSmallTile.contrast-white_scale-100.png	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\Weather_BadgeLogo.scale-100.png	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Square44x44Logo.targetsize-36_altform-unplated.png	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Generic-Light.scale-125.png	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\Ratings\Yelp4.scale-200.png	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Store\AppIcon.altform-unplated_targetsize-48.png	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-30.png	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-36_altform-unplated_contrast-high.png	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-48_altform-lightunplated_devicefamily-colorfulunplated.png	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GamesXboxHubSmallTile.scale-200_contrast-high.png	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.UI.Xaml.2.0_2.1810.18004.0_x64__8wekyb3d8bbwe\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-80_altform-unplated_contrast-white.png	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\YahooPromoTile.scale-100.png	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Work\contrast-white\SmallTile.scale-200.png	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\WidevineCdm\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.123\WidevineCdm\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\MedTile.scale-200_contrast-white.png	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-256_contrast-white.png	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosWideTile.contrast-black_scale-200.png	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\Icons\icon_rotate.png	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\themes\dark\rhp_world_icon_hover.png	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\nb-no\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ga.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-40.png	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\SmallLogo.scale-100_contrast-black.png	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\images\themes\dark\rhp_world_icon_hover.png	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\Weather_TileWide.scale-100.png	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\et\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\MedTile.scale-200.png	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.contrast-white_targetsize-20.png	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarSplashLogo.scale-125.png	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\root\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\id-ID\View3d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\WideLogo.scale-100_contrast-white.png	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\legal\jdk\xmlresolver.md	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\sk-SK\View3d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\dictation\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.27323.0_x64__8wekyb3d8bbwe\AppxMetadata\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\ExchangeBadge.scale-150.png	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1808.3.0_x64__8wekyb3d8bbwe\Microsoft.Advertising\bootstrap.html	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\themes\dark\example_icons.png	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\css\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\fi-fi\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\hscroll-thumb.png	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\CortanaApp.ViewElements\Assets\[email protected]	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\MixedRealityPortalStoreLogo.scale-200.png	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\GenericMailLargeTile.scale-100.png	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\Images\Ratings\Yelp7.scale-100.png	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\nb-no\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\StoreLogo.scale-100.png	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\hi_contrast\aic_file_icons_retina_thumb_highContrast_bow.png	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\WinSxS\amd64_ykinx64.inf.resources_31bf3856ad364e35_10.0.19041.1_it-it_30b01fb186157f18\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-s..nnectedaccountstate_31bf3856ad364e35_10.0.19041.746_none_d79dc91ea424c11c\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_iastorv.inf.resources_31bf3856ad364e35_10.0.19041.1_it-it_2b8fd220eb863bc7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-smbhelperclasses_31bf3856ad364e35_10.0.19041.1_none_a02e3303758007d5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-textshaping_31bf3856ad364e35_10.0.19041.1288_none_9a33d9f006a95b20\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_wfcvsc.inf.resources_31bf3856ad364e35_10.0.19041.1_it-it_828ea72c41c9951d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\WinSxS\x86_microsoft-windows-ie-iexpress.resources_31bf3856ad364e35_11.0.19041.1_en-us_b149728b76ad2c71\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-mfmpeg2srcsnk_31bf3856ad364e35_10.0.19041.1266_none_c06d6bff83884f57\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-d..cemanagement-dmcsps_31bf3856ad364e35_10.0.19041.423_none_57997e21a0e0b67b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-wmiv2-mi-dll_31bf3856ad364e35_10.0.19041.546_none_683a88876ebd7c0a\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_net8192se64.inf.resources_31bf3856ad364e35_10.0.19041.1_de-de_e9aef86836947700\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-p..worker-v2.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_77da0af32856c5a2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_dual_mdmtdkj3.inf_31bf3856ad364e35_10.0.19041.1_none_cfe3a5fe151abe4f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-brokerinfrastructure_31bf3856ad364e35_10.0.19041.117_none_3c1920f753190d57\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.117_none_e0d32848ac56114e\oobefeatureupdate-main.html	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-rotmgr_31bf3856ad364e35_10.0.19041.746_none_0bd845a4159c1a60\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..kenbroker.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_32a47bf029da10b4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-waitfor.resources_31bf3856ad364e35_10.0.19041.1_es-es_e32bafd79f020607\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File opened for modification	C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\Assets\SquareLogo71x71.scale-100.png	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-msinfo32-exe-common_31bf3856ad364e35_10.0.19041.1_none_468ab6f0be9f26c6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-expand.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_6faeedda59ebc5ba\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-intl_31bf3856ad364e35_10.0.19041.746_none_8ae70fbf778841aa\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-n..henabledapplication_31bf3856ad364e35_10.0.19041.746_none_47ba8771f946a14e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-smbserver_31bf3856ad364e35_10.0.19041.1151_none_6dc4fe08a0051e4d\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\WinSxS\msil_microsoft.virtualiz..t.wizards.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_39be396c9d8cc55c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-d..e-eashared-kjshared_31bf3856ad364e35_10.0.19041.746_none_2610450c30b37cc4\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_windows-system-launcher.resources_31bf3856ad364e35_10.0.19041.1_de-de_24f575d3b3a669ca\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.ApplicationServices.resources\v4.0_4.0.0.0_es_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.19041.906_fr-ca_c03f9b83b540a678\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-m..nt-browser.appxmain_31bf3856ad364e35_10.0.19041.844_none_d9eb415c5b9dbe4e\Square71x71Logo.contrast-white_scale-400.png	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-ncsiuwpapp.appxmain_31bf3856ad364e35_10.0.19041.1_none_a5a5fe7757df26e3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-p..-printbrm.resources_31bf3856ad364e35_10.0.19041.1_es-es_ff01197594327eb9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..ers-about.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_a2f86942a81ce19a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_hdaudio.inf.resources_31bf3856ad364e35_10.0.19041.1_en-us_979015a3cb75e148\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_wwf-system.workflow.componentmodel_31bf3856ad364e35_10.0.19200.101_none_b79c204dd637ebbb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\fr-FR\assets\ErrorPages\pdferrorunknownerror.html	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.423_none_9de80b9d881a1ebd\i_warning.png	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-c..mplus-runtime-mtxdm_31bf3856ad364e35_10.0.19041.1_none_d835cfb6a72ad4a3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-g..in-appmgr.resources_31bf3856ad364e35_10.0.19041.1_en-us_a1d139fe8827931c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-onecore-xamltilerender_31bf3856ad364e35_10.0.19041.746_none_3adb7004c4fdba03\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-d..aanalyzer.resources_31bf3856ad364e35_10.0.19041.1_it-it_663a7e304ddb86fc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.DynamicData.resources\v4.0_4.0.0.0_es_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-ui-shell-component_31bf3856ad364e35_10.0.19041.746_none_2b9acc2d69574796\Icon_MMXresume.contrast-white_scale-125.png	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_wcf-system.runtime.serialization.ref_b03f5f7f11d50a3a_10.0.19200.110_none_a3033a85284637a8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_dual_xboxgip.inf_31bf3856ad364e35_10.0.19041.844_none_49f2d32fe6da9b8d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..ionflyout.resources_31bf3856ad364e35_10.0.19041.1_it-it_e7319d27932b61bd\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-textshaping_31bf3856ad364e35_10.0.19041.1288_none_a48884423b0a1d1b\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-windowui_31bf3856ad364e35_10.0.19041.264_none_ef8072da76d7bd33\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-a..iagnostic.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_b9b75da268bb072a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-peertopeergraphing_31bf3856ad364e35_10.0.19041.1_none_18b3e858891c1084\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..in.assets.searchapp_31bf3856ad364e35_10.0.19041.1_none_501fda1ac26a3cf4\dismiss.png	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\Help\mui\0422\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_dual_dc1-controller.inf_31bf3856ad364e35_10.0.19041.1_none_853d221fc52f54d4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-cttune.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_8cd13b8b6097ef66\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-pcwdiagnostic_31bf3856ad364e35_10.0.19041.1266_none_69f1a169b4d96a7c\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-s..mpropertieshardware_31bf3856ad364e35_10.0.19041.1_none_01403d15a6b8a2fe\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\23\common\images\colorPicker\lightnessColorBar.png	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_netfx-mscorld_dll_b03f5f7f11d50a3a_10.0.19041.1_none_3c1a7a93c632b056\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-p..owershell.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_da474530474d77ec\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-coresystem-smsrouter_31bf3856ad364e35_10.0.19041.1_none_cc99327a4ba24f7a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-p..riencehost.appxmain_31bf3856ad364e35_10.0.19041.423_none_bfcb7b02f95b1e52\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-w..inter-mof.resources_31bf3856ad364e35_10.0.19041.1_es-es_1f4405f510e564ee\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-onecore-onlinesetup-component_31bf3856ad364e35_10.0.19041.1_none_23025624c75c162f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-g..licymaker.resources_31bf3856ad364e35_10.0.19041.1_es-es_197e2d469b031a1a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe

Modifies registry class 10 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.hfi\ = "IOQPRVJIYYXVXAQ"	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IOQPRVJIYYXVXAQ	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IOQPRVJIYYXVXAQ\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0OBBDSsH5F8mq7J.exe,0"	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IOQPRVJIYYXVXAQ\shell\open\command	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.hfi	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IOQPRVJIYYXVXAQ\DefaultIcon	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IOQPRVJIYYXVXAQ\shell	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IOQPRVJIYYXVXAQ\shell\open	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IOQPRVJIYYXVXAQ\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0OBBDSsH5F8mq7J.exe"	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IOQPRVJIYYXVXAQ\ = "CRYPTED!"	cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\cfbc736d5a16198f13e7bf360e5004be_JaffaCakes118.exe"
1⤵
- Drops file in Drivers directory
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\aic_file_icons.png

Filesize
50KB

MD5
3285a2ee1cf7bb22ac89daf3ffaada87

SHA1
073e4d9f5d1a5387f67e01d4f92e09e87c7b27ee

SHA256
219604ba02adb50e068d064a6d7d2958750e0dbef5023c488a2063bc4cb81969

SHA512
ffeb7dfeed08e298b38c20ecc58b340db4087f022c238d808ef98c3a829d56d3fc546791dda4a12d4a9ced605d22d121d00c7198d4ca20b702e176ca9ed5435b

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions.png

Filesize
1KB

MD5
4c154f9eecf0d3770e22a2264b8fe805

SHA1
9db3d97dc4b966e548e04f0a26cfbe940bb299e5

SHA256
11b055d904bd1a419a486968bd87a491971b8f4eeff68f0170872a5bdfdf6437

SHA512
0b9e208b399d85aac032479ff47e55a75446284cbb318d687f4ac67b7e2f909fafdda53f29ee31d4092dfd993343552fafe5897269a458c20e4a116235927ab0

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions2x.png

Filesize
3KB

MD5
234ec4e105f70d8bcfe339189e554689

SHA1
b7c735ae80c2926c4d959ba21e472ed25e1140ef

SHA256
3fbaae136ea53462638bbf78ab725bab0cd1907d533b2aef487546b985da4c1f

SHA512
cc4697ffbe75b7feac80b8abf1a814f4586559e624a53b95e574a821cf0c68924f4d0c9f40338767d44680d42a05c8d5492dc61e855c176583b9668b4d2d0f72

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons.png

Filesize
683B

MD5
ce74b4eba035c6ca7bf08a76b6ad06c9

SHA1
0f1aba65c7bd5f9ab2cac4bf67ee6f921ae77766

SHA256
4cd6da1d3d9b20cabdcb9ca50f7780a7ffd61346aefcb4203ee28372b50b6c4f

SHA512
fdd14911f1e236b7ae776d70231d0fcc7475959425f36d0e2fd88579954beaa14b166def6905213eb0c3451e4643a6c5aef7077c3b35fade93324e52adfb4bba

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons2x.png

Filesize
1KB

MD5
40f54f91a6fe0fea9d5a9783ca2013a9

SHA1
ecb6e06e9e13b1bc3beac196388614b92b097eac

SHA256
9aac94140d7d28cbe9eae132c439e64d1621b3594876e1f005ad144584d2f96e

SHA512
4401bba2e63987405b65d9cbdb8b5f0e957082dcc4f33fa0381508140a74d9cbe62d465f61b5d964ba627905aaacb5b9a204c034a4745ed4109c4a2bbd4a89b3

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon.png

Filesize
445B

MD5
21b9b46d1a8c0f3865f9c6eb19ceadcc

SHA1
c3fc53bc510c6a460420521aef03949d355a5d8a

SHA256
b2e8af8f52651d29134592d71899103c07220cf677e2eef41ccd82addd5f3821

SHA512
584325139329b0ea8593b9e6576476586d13901d118b3925b509dd6c0243587304de61a47a669d28c6add6d4362bbe57024876fd5105aa3fa8924cdd7dac908d

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_2x.png

Filesize
611B

MD5
9c702e5e983e895737ae4204d93663e4

SHA1
bd1e9291c4052c8d09d2e7cb4900faae15272d37

SHA256
aebd595fc38b6d0da08477f76bf9dec8e476d043c2fd57276227bafc3f715665

SHA512
8a1871f65baa91ad4bad52277887f21e7ebbd15e11f76bbe46359a75ac8de6061b2a6b6aa31248855616d7552cb7e05f5608bfb5c6a4ad70a00a45307aa98fcb

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover.png

Filesize
388B

MD5
4872ae09537e3236b028efb3c298cffb

SHA1
1800a94f8c4d60bc40855d78f6ac9b44472852fc

SHA256
e333a4de4870fbe88c56356eb083cb3fadc5ff498eb26982567d0309743f15b9

SHA512
4a98f507d6703b9c684cdf00b7a2025c91f6b2fcd6593a41496cec3ee83eaa6925650de128593c51e6e138e947baf5101ce05965604b13f2e4218115cd9dad54

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover_2x.png

Filesize
552B

MD5
ccb082e55c5a3eed89cd829a317e5792

SHA1
deba396e4d34c568f1ecfa4409465a2fa2df7c1a

SHA256
94a129edd81c0eaf9a38620e3185d2e1b8f8d54a8a1b89c026a10efd6f2da19f

SHA512
ba27f65078dd20248d3d6b2cf5628534b8b555f06adc6bd713c457f147b2c8e95af6cc6efdb2b1ce034459abc3fe58bf8112b44e7cfbd89a37b1b0facfce55d2

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon.png

Filesize
388B

MD5
57b5a4bc85d978bd10bd56380966505a

SHA1
81a04efb00eedbd5a51968344f8655eb2b210555

SHA256
63e1ca0fa836a092a725912c72d66868d01a199039020df15f2c8ab11444c0b9

SHA512
f3329a53f857d5f098adae36bff135a455a27e1a5049f935e931c41fd4b67b8d220344268ea57a08fef5a150aef5bb4a8e71b94030b1e2f38bb083643f328e48

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png

Filesize
552B

MD5
0948922df665dbd0dd28d6c08f5d5d61

SHA1
904632ea6c8dff7f67c77339e0ce3ab69adbcc4d

SHA256
096330daa6449485b4e9c7344c06de15c3e2d0af8378e73048926f9c06f7bb41

SHA512
4edd8292a2bb91f7eec859f57a19f642a9ff54447cb4014bb0e58c6845a8e2a541463ddfe51a30d1eba89df01b39456e833eea12329a4687672c0b7c045748f5

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png

Filesize
388B

MD5
123fa9f6e0a19aa119b80beb8ee7e4c4

SHA1
a98ac6c38657ed907ca98f7cfd2d8bcba7d629a9

SHA256
b64ebd21f1bfc838f189deb4962d5c03013f7f5089c4d79a225cd054408f80ef

SHA512
f84cf04b643e712cb2107eaa3128a7dcba87fc0e27859b194c450da257961211af2b7ee7e751914bee7d615b35e88bb64765f66b8b78c25800395c422d3f3f6f

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover_2x.png

Filesize
552B

MD5
53bc3eb0a867c4f4e1b51521e7dbdd10

SHA1
6d5a384432a6e343ca227facc590fbceda8fd4a9

SHA256
2e8fbd07ac2f40cfbdd4357e654ca7e1ec6927b809b42892ea8314d7f81cc5fc

SHA512
dd3b76da36a573e122d73f5b103d4302508da460e60c197390481ca747a135d3db26aab380903c56af4976dd884d8442f7c4fd77f5b224120120a8cf0e4549d7

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons.png

Filesize
7KB

MD5
88b100a887e1837b38701339b0b62cda

SHA1
4b1108ee4dbc357feecc5a9bcaf1e249e70ca881

SHA256
5fa7383e6335439ad3d05aebec006b53c10e68fe7bf95983cd5c5a13e6b441bf

SHA512
d15c3494c9b37c24c7cebe008967c81d29721e63fe3932db1a24d7b1554c9cd3e5db3bbb38d32b3e1c8feede204fb0ee31cb1f200350e8ebbd1eaf505db3c93c

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_ie8.gif

Filesize
7KB

MD5
73b20aa58fbcdc089ee2839a08f50fee

SHA1
81a0931f11e6a79051a6b16894880bbdddc1645c

SHA256
688e834334886bddd5cc95ae16766eb282695921dca19c35ebfe1e28ea884526

SHA512
e3acf9e1c114c36d68abb60390a5b0325c5cb1e8644141f17dcb63a210e3a1d21835ded2db579736cb4c43f9b894c7f1ae3129b079f060af5d13f72972e072b8

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_retina.png

Filesize
15KB

MD5
a0dbe6b26f13f3b5e248d1959b0409f7

SHA1
7b83d7dbc16cef1a5a83213f6b8d1b6b745e1675

SHA256
2393b79d6034e737f55085861461cd5747d4cd786898b05a827c2cb23b2cd0e1

SHA512
f9460854c4809ff3583d1af587676040c75a75e88d3831c89ff1c1a717222b6e245afb66d172bf797a0d6d2ead5e5b84f6bb43be9e02c2fbdbe57756abd0cd06

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons.png

Filesize
8KB

MD5
abe60f42158dd4577f06c97aa13a924a

SHA1
f4842e9fe9f7efd0b52eed0929fc334b84727ad1

SHA256
87ddb2a3afbe868e8f01b4b3ccb14b7431382903501116f4b5e99828571d99f4

SHA512
3dc2467d966a74c7833b8c80f8fc4ca898d23d4ea822423dfdab2de5dab7048331196af5adb07ace17bde0214a94f3451928cb74d65356355f298f3be8f03083

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons_retina.png

Filesize
17KB

MD5
7d6f3564a95d9a0d9d70b13deb9475b8

SHA1
c4ab5e9f6297170b0fc7454cf7fe288fd7dfe81e

SHA256
e045e3ce6d16b2ef8b9a2d5cbd358e2f8e35237b0d82cab90b230b49553525c8

SHA512
80aa6d23fa67224ff5a2ecda06b6d46d0b949181d285ac1ab34e804d048125eba3e180fd51e9501131a62cf818ba917f2186f59d354a1cccbe3fd2ad3dd87243

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_pattern_RHP.png

Filesize
179B

MD5
3da4c36ceedf330fe2f5d769cd959123

SHA1
a319bb35b256f1a3017babe71cc01262730d09b3

SHA256
800b2b93cf4b8700720ae8161950eb6ea220bd50f82375e4a232068c36fc04e3

SHA512
c38032afbd46f23f6c4d2757c3a150be4ca5405dee78ebb2442d226695fbf4772d2041c6803290e04e5fc2c3b55bbea006692e8d7d59d354d352eb4335865759

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_patterns_header.png

Filesize
703B

MD5
40f0a4c5856cf1f90354d9a4b689a262

SHA1
3cd867b991bd486e591f53a32e7d126aece75026

SHA256
34d747a24fc7f488b246d7f40f8dbe999e09a52f0a609e4e7f03a8a290fb5818

SHA512
d26ec422bf97453edae1e8d2260fc67a34646eaa7b4de8d1d12f2355e45234b636c19b13acb4ab165edd90df038637fe5cc7765b32218a67a63382dda1e19303

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations.png

Filesize
8KB

MD5
7422cff2c07a76289a1ce07b2a483ed9

SHA1
2809b2f2d9869ae91d34ebb5a42d85f97495077b

SHA256
a4f918670fef68c0a38d21d4428f5b32b408d832a5777e968d929de7dfbb2af7

SHA512
a7606d189e8c53defd3bcfdfbbdc148049ec2d7015b7e6df8c0f09f7c829884b15214d80926abe6980a3c24056946fb234a91deff4733a4ccae628e8e667c618

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations_retina.png.hfi

Filesize
19KB

MD5
b3c4f9764847a1c5225ee031ba24beb9

SHA1
b26832942a9d5453f145e5ad158bcf73200f0470

SHA256
176069db7bd4450b851cced1998ba67b70378d1ed4367e4c8a6d4c63b249898b

SHA512
0b77472d0e95863dd98c124496a3c4eb83997a42bd9548d6707216c0fc6115e9828272689c1302d3698a3b2c010003d43073bea689ddefe69239e59803b9806b

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\progress.gif

Filesize
19KB

MD5
008145c93e942855525421268f5647b1

SHA1
6dc47c8ce0c5438e98e43896b312dde154460e48

SHA256
5e36feb078bf4eff4d931ebca89a7594020a370162e8ca5f2db57211b6667cf8

SHA512
7ef6dd70f600674ce42e8901fbaeb0c3772246fdeedaae98b4df4206ecea2ba50c8da758c647b99bfd8b7a5cb108888df0b9aedf71bab68bd0197fc10b334d5a

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\faf_icons.png

Filesize
6KB

MD5
6bd861032eb6bf34ab4fa54632f0f572

SHA1
e46137de5819174dad1a570cf8483053eed86573

SHA256
bdb9bb8620b9c5c1e93ae025bdd4ca7e353a014d30dc6682c6edc37d1e3b1359

SHA512
0d6ec8f63f5c46314b26da63cc034dc95f6b2df4ff976f844d791f52ac97fac52660cd3dec31959a43e52a25686974d023f3edba5e47d4d9300e16974e13d738

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\bun.png

Filesize
2KB

MD5
2a451bed8144c483df89b68282b2d055

SHA1
6ff961291edd0870da4f839ddeabae50e32aa012

SHA256
90ef490ffa7011250f99cb6f9a348b4329d972b44da35bfafcaa79d21ae8256a

SHA512
e3babed5395b056eda7b3555cb7d4c3d7c9ba214e63bfc733a68bd7a828450ebdefe802287430e5dd09ed0e17aec356205112c014c79fcfeb69313be1d74ee10

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview.png

Filesize
2KB

MD5
df20f33e7019dfe3f543ca98c0e68d61

SHA1
81248f82c0e76d7683a20cfa3f968db201c665f0

SHA256
eb6f4eb910fd800480b169d130e7567afaea64ef80408dde6bd2ca3d8d135ff6

SHA512
19516f686f1619212b54b628b5108e6df03dfb286617d4379d3a7fdf816a9543ac13398c073d991216c0d87e923a234f1cdd1874e35904c197e10ab8496d1c87

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview2x.png

Filesize
4KB

MD5
1f86bec1b8439f07f6c445fa8dc91c96

SHA1
fdacf261b295afe3e37d6291171597b650281dcb

SHA256
1b047725027b93a085e545c50559fd2039cfd5d6c5a651102ff614de70a6aae5

SHA512
f6ed49df9ec7e3766b408bbaf324008a3b14ec14f8c9b7b05c10621b766e21473ae540ef58a1453ed21593445c04a91d366bd3f842a9fb3f67628ceea10bc9cd

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small.png

Filesize
289B

MD5
d4d78c7333c0bfa13ae3a0ad3c7c8dc7

SHA1
c214603ff59b1963cace21df6d2e6c1dc8e8bca8

SHA256
baf286712216f18bca5cd47b1e766cdd5fd2632ddde85288158cb57b9ca03305

SHA512
c9803fe7bd21cb8a9ddd2d7f89da120e610372e5fb77446e69ca105299f72904629173a85dd336e4ca478273deb648329d3b2fd299a7b7fa0d7903ef25b5b4ff

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small2x.png

Filesize
385B

MD5
a87cbf07fd28a614df0008b2f009905a

SHA1
40d0110d3559cb1739f2f6dd1db9564bb41bfd0f

SHA256
cc35b0dbd383214e3f5c725ec9366e19fb8102cbc84d3b1c6ef6c2bbaafcd872

SHA512
960a8b8c01a02947737b7b9e661abc37d3b6153283356ecf8d0193189f4d7637a8618f206670d4c55d0acc08e08558bae2255a9990935f11a9a86f6b2328fd93

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\illustrations.png

Filesize
4KB

MD5
2d655b5a75bf5a812ce1b30b1b34fc96

SHA1
5826ca03b81df165e799401dc5fdd7a5a65ed520

SHA256
183cd803f078da2d728b45e90001719076024183ff38d44524c023ed21e584b0

SHA512
b5247397620d261a75eb5332aef7a538dad997526cd9bda92cc524a7536abf31dcfe8d760f0331f0d874a4a9e3a647cf530ec2e6f6f2ac5e09dcd5e06aab555e

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\nub.png

Filesize
1003B

MD5
bbeae9cd9d1c28fb5f55a7dbeb14dbd1

SHA1
d42cc1d7f571a9e058645247dda4c07ebeca4cca

SHA256
6070488cdd4a117d1fd95abda167cbc4c5f4796e89e617f8c46b0a9ac7b500cf

SHA512
d337e667023aad2bbe935c30cda30eae08a82702336e76116f215d39efc102c484878ebacfa7ad2cfef14254351b247eba1b9550f082136601ed0b6cd486fc5f

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons.png

Filesize
1KB

MD5
6aac663c1988c36965214721c0045128

SHA1
4135b06064414d1ce6e1f78c4cc25917650c1486

SHA256
23cdae389ffc8525fa76df39ce1703d85234d77d8bac70f0a380ebe0a913be2d

SHA512
1dc0053ee3a4443968f7c4f8214caea1cd4806115de1fbe29dd28807d4c06145c3acefbbc49ee316744d06c83b43e71b39704e7204a703a72541954f2d0ee50c

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons2x.png

Filesize
2KB

MD5
cf786925cedec6def803ce19730f8af5

SHA1
1785418e96eb21a066d4d3ef6596306663cb6270

SHA256
fff6019ea3fc9b14aed78860df6f743b6e2a312acfea3c04c3c2382aa0227c01

SHA512
1ab373f67f72a984c765937db249e221d85a2ac02c03b662b845864171b0832de6b5a7aacfc3ddb9a806e61bfd6b5ae46ed02cb36de55baaad9ca8c009e413f0

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adc_logo.png

Filesize
3KB

MD5
f899f68afce7c079a23983a4d6a847a2

SHA1
eae64f7ae49db326f33fd9540e28186f611411a6

SHA256
75440728726c96ff118edf22d0da13841c04cc7e7e81870cc441ffbc3a2e2d2a

SHA512
b75b69cc80e4054513a1837e99f2f3a2646780f051806bbba3c9443b4277c055175c14b63735f0aebda5f4ffca6bf4f1c527f6f052adfc25c04f7ac4904c66e4

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adobe_spinner.gif

Filesize
556B

MD5
d34b3a8e8e7f5c2f8ca8c30b5cf55d64

SHA1
260d8a2c1a6d88c7801706c13ef41fd99d782ec6

SHA256
29fa1de10808de8115b27ddea7725a266c175b79b98904098c4c70cb966265fa

SHA512
d254e1054aa4fd20e53f039023c727642908574441e2ef543ac64e26183258111e5205fc004d57ce63d7cb7b501087845d6c88c1b74743bd858a8fdeb7fb7f6b

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\logo_retina.png

Filesize
6KB

MD5
ee68d7bb4d2d762e7ba34b2fdec6f095

SHA1
9a778e6e2e8c498c71133599aacfcd2e07b9c2f3

SHA256
2cfa9f82ef4b944ab1cbf2c8c019552f0d805fb5a55ed7c366daad63f489f9bc

SHA512
2e41a39cc54d39ef40b891caa0ae3c7ac0375a2c9f00d8b34d962c919e0ac602328cb2529b4df195a7321cd0f2060e97abce031754958db10da9d2ccf24bfc13

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo.png

Filesize
826B

MD5
aa5fcdcca73d87a244a070f1e96ea436

SHA1
dc173c46de068e840e1b58ffcfdab0a5fe9bcbf5

SHA256
f848c5f04f7fbd4a5002806412648de2d191b95930d293fd8259cc8415ba9dd4

SHA512
1921df26b22046b9877dffcd6011034c20a3e99140b46c80b60a6647741e98bf1145cc2f63cb7c64041b49599e2f2eb52acdf118cf903e98b77393db477e10d4

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo_2x.png

Filesize
1KB

MD5
3092240789432f221b7a48b0e74326ae

SHA1
18b521aba59a5091af66449c5cec6b454d4e9230

SHA256
1544b07c57b94f894c0f9bd46f8896d67707463902953e74d03aa51b5cdd8448

SHA512
c35f6defe71787e907062af207499560e9757299a0a04236d268d7af53e72b50b4dc70dbb6884857f2c61ce02efd3789752a160d95a770fe4043bcd3ac4d7599

Download Submit
C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB_EURO.txt

Filesize
32KB

MD5
af4a6c4d2baf565beb88e6d26689de6e

SHA1
b056e41de51ce16229715d2e102931a1c90da983

SHA256
2de53c8566ffe98e9ba9bedeb77484eed5a77314460b9f6abce8fab54d5e7be5

SHA512
9945ff15264cecf4dc2647f20bfcf6610bd9dc92b5b479025a0e707aefd5a198018dc5ede442d0eed8e10ae0eac071bf93ac77d923038444e6749d47ad3a4541

Download Submit
C:\Program Files\7-Zip\Lang\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt

Filesize
282B

MD5
af5a2a58a49793554f291a2939ede100

SHA1
637eb13f507da0c87433cff0990ae0b3238d070d

SHA256
b952cf8cb5c00487de38ed2f9f657f135200f61bb01173d2010cc61f15c43d02

SHA512
1168043a186b73c1ea43cd1228c530033728d68e34824b91018cc88bf8d56102367f2b1535ab3b23c90177d7b9bf03f3ff11135301f4bb5f05401ab0661668ca

Download Submit
C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif

Filesize
153B

MD5
9e9f7efbf93167744a255fbe155cd518

SHA1
ebfd7a5069904df07821203c5ba3a27842672c5c

SHA256
24a46d586c5c9170d46fc63527c02ef81361b92889378f1b7c24fdb898c1b8e1

SHA512
7f05bf2eade7eecadf8096ffb98df9e1d3d8f4bda8dc39d66a68545621a77e53e4fda4ac34e3fe63981110acfdc98f781e079844e38c195f0f30f205b439f407

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt

Filesize
190B

MD5
7cebc9d2eb8b42fa04beccfb3c4052e4

SHA1
bd69dc7a608d3807f7ce6d2a70d1c369cb0c1e14

SHA256
140a011486ba7f23077502d796a3f8b06e6d3f665cd2c57549719984ae4a1dec

SHA512
f028f077e8499c3ace6808361da0a912057b835738a216e341bca24c7731271bf3c2f85d6aeedc98c3d023d3be5314338dc05a715b58e96fa022889651bd8096

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt

Filesize
190B

MD5
f38d286102c15e008133dba948b96917

SHA1
a4c40d7e78106c1b8c2b733279e07933d37e9767

SHA256
6d478ce97c5422a665a8972735af491ec1da1db8f9bb7173c0fa486382d6909b

SHA512
49f35eb9cd5d0ee02c1abfd1b1f02b93c4c694ceccbc2d8fe0035804db9abb04babc597669eb47932948717b8a37edfccf263a313f2dd8f1e0d9138f5741d6fd

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md

Filesize
1KB

MD5
376dee4c67971e7c6c50a0d0f2b2d96c

SHA1
7927fbe26903f66156a82d0acfa9e2ad96c61ec4

SHA256
99634d3649468241dde769f234cc9858e015f7d19bb4e3056ec3c491dd723e4a

SHA512
b842958ec68e1eb77fba862a48a3dc2261a8aa1c1116de0882807f9a52597a1f727c6db4001b297c7b78c417188feb303f5b543e2fdd10c6b05914d484783880

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\glib.md

Filesize
31KB

MD5
9584261ddd5e856cd18f1f4b0bb62c00

SHA1
3d5c1ba01d4a01e79e9e31a17280132891b1acf5

SHA256
b0c5158fcbfd57235ba4b2f8b588425760950ffa043d1a5d1f101d4a4f7b96d9

SHA512
703d99c988bc7c9337235dab76f34fa9a92c5d133194a17f1bbcc95efdaf844cec8dc7c20cfa4bca533ce389049053001e7f95ea7bc02e09b399a90bd1cf6f63

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md

Filesize
34KB

MD5
73fa6ec328cc67a82a2d41b00c1dbb73

SHA1
0869d48e6bf66b8b2427b96eba11cd6703c84746

SHA256
16c91cbf1473d55d6ae02718f082dca09ca05ea5ff28dd8c9d2a6f1fa1a3b9b9

SHA512
b8e72c4041ef95b688d97553701c6b6902d04484cd5bed2834d3316ebf03fb1dd53555e27acfa4c3804c28f00631e05edb9c2e9f4eec2da3794e81f88b1bdde7

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md

Filesize
23KB

MD5
dee4c4097e29b70c4ca284dad7084a53

SHA1
4b4a85645bfb098d113b7cb4afdb137a192d5e3d

SHA256
f2f3f34084eddf4dfb131832937d1d0c78832d63564993a25941352f10fa506d

SHA512
ad63081c3881aea901219c623b4dd587004a4bbfd469a8852f94573fbeee1d80e72ced251ca31b59ae61823de06eca72948b117bebc70daa6696b4cf9d04b18a

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md

Filesize
2KB

MD5
44758d7f386b51f36b57720f3ce8c5bb

SHA1
6ad138062c4af8f70228d30e25e9b3c31b4dee9c

SHA256
22d0c0083ab9ed83b4c8dbe8148883a71147a03bc2109a84c2f0b700416768fb

SHA512
fb26658afc93ecbfbc29f7fbef4a824cded6b2aae9f91ae7d3bac7ef35bddc70995927a569ce988678387b7ccf092354a1d5ba9519f173bd4b3601470c62f7f6

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md

Filesize
1KB

MD5
03a9ca96ccc0182f3beecd31f5852eef

SHA1
8f2ad925ad4c877994cbc9b2169e7121039cd17c

SHA256
063607f035daa50b18b0c2ab79dd32205ce8a87ee9124d883053435b56e20085

SHA512
8e55cadbc898c2b9485a88e7df5c15649d288e51291cc4f22a9b5403c6810d4fedc4d8ef9a43c053c5c2d85bac395d77b8700380d817dfdeadfd352c48b9419b

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md

Filesize
3KB

MD5
333ee3e3e32cea0bb302e1068b9e5ca6

SHA1
f7063fd3a65c9dc7246f3f151e8bda726d810a9f

SHA256
11aa32736223c79de2fb3a52ce64022ff78460dae71c670257b6bcb3bcc6fbb4

SHA512
6a3d8a30199a804d61ab1bfd57cac328b75cdddefe0323e3547e598cda9f1b132fc850523d12fec004d53c6f2f2b5491f79aec0de7d1ed4501a5c5f1f8a3258e

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md

Filesize
2KB

MD5
e4d76a69995eb65ec3295969202fa2cc

SHA1
3262359df352c31312793e0720ced207be52bbdb

SHA256
e81dd0f81d9da737ac44aa5e0ba623491d59a7c43d326b4c929dcd652ed70344

SHA512
5d44aad3de25c50e05885e4c396dd3227a333e4b5f9ee763687a479189bfceb5d5d371b4bd2b2edabf479d640c71ae02e403aff469ac2d7ca2a4fa9a89f2e8a0

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md

Filesize
5KB

MD5
5d87bfcd8ff58a3f39a74369fb317970

SHA1
80f68294eab9625d781ef8167b2ebb5bb3e99657

SHA256
0d6d128cf24011b4ed173ede2dd1228a67da169f1ef2ab0702f85463c5fc0478

SHA512
4fafd96191376c55c7fd9a5566596df2006cfdd3d42471b0e06dcb12d45194f74a23165efaac7961c539d314ef7a4bda011481c49b982169a3dbbf6be9d3c230

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\public_suffix.md

Filesize
17KB

MD5
b75e8c19933b1119333eb1866ae48223

SHA1
3451740185c8914fb14b03b69bc1b2c4a4afa692

SHA256
93116942f647bd85018ca0ee08b5e280c31ebeb14356c134f267acf872d4bf2e

SHA512
e43a710fac960c44847c8b7b873d49df6bdf07df56c989df59de907f0b21364f709ac14564c9b2cb75e4d5a769e943114962b11881c945f890d557d4d01d4f3b

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md

Filesize
320KB

MD5
7c5b20ec8ac32cb4570e355756d306d5

SHA1
b8d35d85225910e1e1d65ffb17d6d5a05c234ffb

SHA256
3efd96557f2e1e1bb251ae548491ae29c83e6f0e7c19db2ef13d87189621ceed

SHA512
58d49ede3bb447c3bbfd7462772666b894699dbdf0e097bb6483dd66de1d7c855ed75faa1b333f48a7db050c04f1fcf8a0ab1a4ac046fb502ff56039d2458ab2

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\asm.md

Filesize
1KB

MD5
9a37abb32fed9ac5459f5df015c8b289

SHA1
cea69b7fed1c544e606b526b37d3d9a0e270b2ab

SHA256
a4cefc484ae97d918524313afda431189eb1d95b95f7c12e9be47eda481cf1e5

SHA512
23f5fda0885658f0599bbdabf59d9defd222f1658647541c20c2edf89f69883fdd386a99eda4ab8a726254a5faf0f21a20885f613108d6499d7b54b50ac809a7

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md

Filesize
10KB

MD5
9dc420a0e852b7fa9f925ba2b43a3787

SHA1
3e78439d0c9b24cf800719b70a4a8572f12a6dea

SHA256
36b2db4991f102d29ef72f9a7659e3e16340c4b610e8dac0f1ad5852807d2312

SHA512
48cf136053d2fef0f3574e3f753f628403f7fb75e52645c2d1b7b840d42f71f3e9a5a98da66ae60c6fc62e737f8010ae39d2d4e5da8bdfb9afd743e6f8ab6234

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md

Filesize
3KB

MD5
46f3969fd01b146b0466764f482575c1

SHA1
3f2122f14239a386c524c0057ff33b3b8e2a64f7

SHA256
f57fa36f5e8883f49826533b333d46e66d2acf628d43193a4dcf6389cabb2a59

SHA512
246f63c5291c508e6fdf0ae5957ddb2c0ea4d5861c62c022f8d284e13c8058167b497a112da527169f249230fbd599b5ce9195adb2d4f07c9a417b3ec3af1191

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md

Filesize
162B

MD5
7fba8b0bb61dfac81a0a33b6b3456ebb

SHA1
09585d98b59a58c5d484f471813b3a68a9f6542d

SHA256
793405a9ec818dc8377997a8d5ef87902f7e375a01cecc6f3495b2e81db218c6

SHA512
e76aff1e459b1dba3093180e81767a18de9a82fb7cad31d78b1593e9be645bb0ef9a6fd4da6654161f1ee99ac5090c5e82a0e421c3fc3d3821e8ca38d9dba392

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md

Filesize
1KB

MD5
f7e28281de9e721875eba7a464b11436

SHA1
5af75d6e690e2d575c725445d5903e924aae5d1a

SHA256
b42dc4eaba566befc766859f00a8e929ba82e56e86116f3382093c78f3bbfb87

SHA512
931bbbdf71e07a8941dfe07c4023e13715bb871ac8d42162c52bfac3d69478a53634ebc02ba5b41002ab3d95673a0eaad9244df96a68f7e872f0a84a501a3581

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\dom.md

Filesize
3KB

MD5
9bb6c873c1096ad6a79f2cd691c389ef

SHA1
85b163769d3af2308d25d0d8b71ba27492cc43af

SHA256
592f3a089a89bdbcde70b5d649a1b496de5d20075152d5553bd1d087b5881ab0

SHA512
05a362d4369a60d14254b38d43b7689b43ad6e3c3921b3a899675b1dbdd7c2f797ac537b8ded256b23dae6d12e5a13a9a8e17bdca740d5e2db3f7e9e0a14dca2

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md

Filesize
1KB

MD5
48c5686c2063d14cb537e0e3cca6a5f6

SHA1
37a430018957dd7549f00f22e5bc966ca2f4886b

SHA256
4c01769bbb12be1b84ebfd2776377f4c16e0aac57efa8954c129bfec01da1007

SHA512
783c271a983884157e19d10ba3fb9a0586a86a4217331603b6bc0fd888c1d8b8431ab8fa65bfdfe66744e4d62b1059e5f5efdef06ff812ed0f80605f407f6b85

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md

Filesize
28KB

MD5
94f7d04886c8325c7221f83d4520690e

SHA1
ea86f37b28e8d06e7a2c1f5c15cc334c18c63968

SHA256
996822e907e9b2caff48461eb8cb90552b1ee7e33af5f0740d8ebc64e8f4fe28

SHA512
11ea234b91d99e5b2abaefc2acb68a5c3612b73cf4663a0460a6b78b7413ca9b53fabf9a35fcd4700279831f09d5d9bd29ac3d987e82ad640a0bfc785c1ebaf8

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md

Filesize
2KB

MD5
96efcf4c4b5f69d65c2e5274fff47b3e

SHA1
1091722a3a76f3fb3960fbf33efb8c1fac9f265c

SHA256
efb1d92d544ef4c1adb272da24890fec5ce126e144032f99fb368f6384b193bd

SHA512
8a6254d2a4b376efb37bcd7c7d5bfeaf0d114e4563d3bd61e8f7bcf665342e5bbef2506ad1315099d3ea4431b677586b73a25d1212c25c5413f7c4c1eb8c84f3

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md

Filesize
1KB

MD5
fd8492f5e590081fffdf7c63c49f0d2e

SHA1
df9af5a2aa334c66d1ba7999fe2b0d38f7ac074d

SHA256
6aafa3c7ad4f1ecf9a8b22eb207813e20d046250076713cfc7f773e7327872cb

SHA512
c105f075ab1f04f0dd5065bda7a6618323765062efa7446de9f76f1e80845723ef9c7bda7ae580b019cd99a01382ec80aa1c1a1c46399a40c29ad894a0848472

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\icu.md

Filesize
2KB

MD5
13f428ccad78db364cade1463c7f16a8

SHA1
4546281b178e0d065f822e7987f8570f555f8f00

SHA256
dc27ccef13331be51d58c071b20bd56a23a52d63e436de16089ad09a69753394

SHA512
ee30f22b1654c3d8fa7d74f1314492911916a09730244fa20df6906d83e107146ffe0bc40d19b529010fd1ecc150d275fd940e95c6058cf0e3fb89ce7163983a

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md

Filesize
1KB

MD5
9c72d4b377d24166da38f0c01c3adc66

SHA1
6a2896227f399e1d055be5ed12cacf78b328466f

SHA256
ee681d0f71c7d6acbb1efa3481983e36c76d1a89ec1879ac27b40732125b841f

SHA512
3c2be3d6e817e90eb4d38b1992231e97962c2db3a5d3ffe3b21fd2e907859d8d6152c88573aeb12721912c38fecff792c9426765793aeffe095acfc181b3e930

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\joni.md

Filesize
1KB

MD5
43279fbf8a135b20eca59f0fc74c5914

SHA1
aef0e0bb8c38c417d6dafd25e94486b49eee5981

SHA256
ca34eb1937e568e59f6ea8f8001f8e98651d15ed65ab59425274e5d03ec180fd

SHA512
cd117918c48d6f8550a3aebe8b61a4038fe9aa6e74b34d880f3702f745db9f56a212014644381515751c60fe9b7d3f20350d3878cbccdc292023a6465eeba052

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md

Filesize
1KB

MD5
57759e1ed0de91f6dad764b8de617305

SHA1
7b014b5a0c90e0f294c42e06e9014a4e583669a9

SHA256
7d391f8014d324ee61d42998d816b2bdc3ea144f79aae2852117a260d054f3d4

SHA512
96d8bde7b55424e7b5cf570f2646d7ec651e2143fe6ad2b63e955a7085f84f3cbd5a9c6b553c8790dc2e059fa02b0bb363e31bcdf6d4897e2001b27720ef5cde

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md

Filesize
3KB

MD5
40b6300178d6c0ea8b53792ad287b77a

SHA1
d5f047dc3bc765e94d1481957a301286d9120c6f

SHA256
5405175a1e0a641064691434a28eb178cb1b0926c9029cf3b7b3e7349b15cf78

SHA512
bbf3fb3d3439c49fe46a03266c0a337760f25b0390dc5331841bdb1fed40930f944d688d1737402ee529274c7ffd7f27f64df5a60937f3bb9ab12e5b05f71f7c

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md

Filesize
2KB

MD5
601ff416882b37f596a01f6ebdd4c365

SHA1
0a0a3735f4be17651e6e18db17e63b9d84356bbd

SHA256
150fa48458cc17b5e3c8669e5bd70a4ed41fddcd1d8925d9e150f4a652ab4bcb

SHA512
5dc238b00589b4aff62a8f64eee50c307b404e7a3c4730bf6a51e2935bd0aa25e528a3077886d9282384d62548d0d6dc38c9773673fa3d4f46b539b58097b94e

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\libpng.md

Filesize
6KB

MD5
0530271fa765fa6ddaabfcfaf2eb09ec

SHA1
5adbb0a85b9a9945d6f094b63c898b85f59835a3

SHA256
7b66b5eebe45f8ffbdc1af288b9215d9d4b7fe13999591f5dd82d910f82319a9

SHA512
16eca04b1ff8c917a196022524a9d3375247596f345d7b8d90d448aa7d07df0dac66ecafc3c189e6d691932b2b7433d648adee5cfb19c942ba984427b45b148b

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md

Filesize
5KB

MD5
35bb962b58642cc9f304c0f300590b1e

SHA1
39db33f0d392fe35cd6b5b74da8ab940bf069a6c

SHA256
b21e7a4ecdfaf41cc4a00d833db3e0c4856f9b1ea5fc94a898e1c44774a62c5f

SHA512
d617845d686e3db2ce6e9ea85e1062543ad8fa3e30fa710e75c4c09b626cdde14bd1a81383e526ad332a452a98e21be91bf1bee8b1516216ef34118adeafcdea

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md

Filesize
3KB

MD5
76fe5c47316f2c4a2b5324ba9497790c

SHA1
c9e4fa771af634e111dcdee615ae56ac5f31f822

SHA256
050c7ebcda1d4a61a6ed2a4fad277afb632a4bfa5929968080644ee2afae6a87

SHA512
3ce7e34b87f0be7554ab58f398805ccf37e273fa5aca4f076bc3e710eca15db182cbb264dd31841132cdd01f247d42fa86f743b7b949662331fff99ea5923ee7

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md

Filesize
2KB

MD5
a08298043746cb6c2d7cd1dc37614a18

SHA1
e6512748bed27ecc6901259478636809cadf6cf6

SHA256
6efa8c5515164d492b4207dbc1354f70e2444dcc7ecba016e422ec8126dec3b8

SHA512
ca1af795229d70b1dad3b9d397cef9122108ce5153ab798126fa1223f9cf7b978612fed92433ac4a6bb17625053fbb114245bb3a406529dbf2cbf574a33d7648

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md

Filesize
2KB

MD5
f827f49a9d7ee8a47a7e6ec35d953bb5

SHA1
add0ae004d59cf97fbcda4ec8e11fabaa069b06e

SHA256
91a7b75c26576b7e815a05adb4c5a8b9ae6a5a885e4a04365053ab94fda9e07c

SHA512
b6bc264fa9269dcf4cf0cc033841487b87fbf67d2b093cf46b5de8ab63c2842540b45ff0c0496837b080495560c28de9db828322f1f9c7d3cd4e8b1c7a2c18a3

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md

Filesize
1KB

MD5
34ffb42b74d065b64353c152b754229a

SHA1
49f4ed5dc0436bb6ce65d61f30edb5d000342526

SHA256
b1fa92367f2c003e3ed05b52079dbd1f84dbe1f232ff63fe3586223fd7333698

SHA512
8f2b3c45303603721e8bab7d8d3257582fbb4bf9ba0f6aa20e98331d9254929785aa4b71cd7d9244e0b6df10d6ee591f8d9e008f8958ff756f740d762ec377d8

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md

Filesize
1KB

MD5
4d6a45b196cb3f2a6faa2e4fcf11cef8

SHA1
c1f02b34d6b45058fae7d9ba9ab1dcbbdda928da

SHA256
5a831a40a4463873acb81baa25fc3a61dd21436967bb5beb5a699f4f44a3e18f

SHA512
f4d7a7ecb21ad0021f3f48aa7b88dcb3eb9d00db4490a65bab87562bf9f61ea0a43a44b6c3ed94d018742e543585954b9e07dfded26ea65c577bbfb1c147a18f

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md

Filesize
11KB

MD5
bb5cff5fdf43dd7747fc30795a883a66

SHA1
1884ed07a343350778f1a2c448c4b2b2c8d39b4c

SHA256
af5ec7a9758edf6ac4f38b8dcde3b48d44deb1ccf5147f7824c621ea7fae7da0

SHA512
c88c6223b34c5da8fd60204550e9bbda37860f439baf07896de89ee6b6c656d45960c51f91ac392521ea3857f0a88dbfe5242d4b7c69fc1eb3c25978c18bba46

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md

Filesize
1KB

MD5
b7ee7174166d89682ca9952e0092e491

SHA1
a8b861c3e53b18fecbf8e3aa638e24fb85d389b1

SHA256
c7ee6a4eb362f6e045e5fd89a992eb49279d685a212c87ffb4929b88548d449b

SHA512
72e6c48b43dd5534214b7cfc6cd8aaef9b9bbc36f5aec56311b30097dcc8ef28e60f35779361b2c5fd28b585ff7c810853a8e167c3217241b315c3df7f6f6c01

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md

Filesize
2KB

MD5
195fce3e8d878fbf1a026ed0250c5088

SHA1
6545e06205f1fdb6c4c3ba33e730ecd5e3b93c55

SHA256
2fbe65289ea27321b52445232ad40923fcbdfe0c7657e2e9f046e06d38bb6631

SHA512
3f5ac6b6825d2e65531726a99711071b9e9d63e1748b4224303f9ce0d8a150531ba6f7c577ae7db5fb0c95d579fa38bbe80431e5b3f6c2cc7086a8ab0111bf97

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md

Filesize
11KB

MD5
8e8adbe7b4c89e9fe397db7b72b9510f

SHA1
b52744fc810ce3effffd52ff2976869e04f1af8b

SHA256
bb7f00d9a4419e804e2a6c576293c2f1b663772fbd186753659184e7f6618ce4

SHA512
ca404f1084c67ab8ac4dbc813c5c5e744f2ab551b5584986d46a929f406a0a52496fe69fea566a67953bbfe02e15a035c703fe3a6529f81986598e7b3a776b48

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md

Filesize
11KB

MD5
a5a9b125e8d0c91717593bd3b3780011

SHA1
4a580c3af03b37df8e1b3e845874f4076fe5d055

SHA256
d3af7bd5c7debcf2c7468393a15b8ef7e26d8d7bff1a2bcd23ccbd071a49eb26

SHA512
9190533cb630176a07ce0f35c9c77b3dab17d3df848d458c0bd67e19c8a7bd007d6a2da3ac3fafffa9e3142719575c264ac831c22843592d5081756c0bb1977c

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md

Filesize
11KB

MD5
4fb62be2e18f88c9c80c00b10e162d79

SHA1
d0ddebfa0f9815f3e83bcf639f1943a296c70baa

SHA256
69c4a73eca4faf0cae5407b0bf94f83991e873c92358c7fa802304ce69a5dbc7

SHA512
4d95ea0f8d91120ad85ecdedcf3e67db1aa3d4cae053c608c826be39633d1ad21a6cffbeff890f72b5855796e07c94e18a70d4f588495fb98f744d324e6c837c

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md

Filesize
1011B

MD5
ba09582338674cb2d780f0f571fc667f

SHA1
9114cc06b7be30dfc7a624822cd108990ea70dc7

SHA256
a92720e9b31b419e8fa85de951447e3e5f263e8d3f0ea22e8b0ee2c1a01f8e21

SHA512
0a525993b7f02739969d194cffb31d66fb07cb2f7ce1f08278480979c9dd15969337d292a7cc13d8f1f88a3949e5e5787adc4352e0aeb991f8e646bac0a12fe2

Download Submit
C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt

Filesize
42B

MD5
29e556bd8ca1280c8f18cd11b1441d03

SHA1
03e002191e157e51de3aa40f8c89807d6b05ac9b

SHA256
41202d02d4701effef8e26274e3fa10215ceb563547853d7079c46049a64fa7d

SHA512
054a1715479f242f2da4c9a079fe2ab2ca7827ad60683747ec7faf796d18212dae804215f64560e494a8ea022cca704a5f16f5d6e9f7123cb324b155c9427741

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727661992394667.txt

Filesize
77KB

MD5
669916980323a9e79c7c276bbb24b299

SHA1
8fa1eef444a31bb1084841e8dec080a90ab64f3d

SHA256
abd97e1f6b88ff7393ee67f2fb3fd7b63819ce41b578bde583c3b9c425ff6e01

SHA512
6635b324057c453c6233c4ac3f64ad3d4a48dcc0858747cb573d41a24919959c88805780892775acc732b787a420899b604810276a90e18fb3c9c3cf6a48aa29

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727662487357744.txt

Filesize
47KB

MD5
c710a56193649f16eaffcf35a1061efc

SHA1
a0343c043873a9eb20c3f7e7dba5f5d15dea8297

SHA256
42e2c5464225ec3234d7668158bc8ced0861ee8e4158d08db26fc9c1c155dec7

SHA512
a980d93d0ec24d9e8286537dd972b4a4094746875223e4f0835f9ce2f838468adb68efd74cc497aec945b12d3698de219929a808903b182f38e030172c2701dc

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727667722373689.txt

Filesize
63KB

MD5
3496754b8122b3a08284988b0d0126cc

SHA1
3703987d67f960e6e202e86d8bb5067214385b0b

SHA256
41b7d3fc835820a76c0ce055406e6d885899f99602667eac2137aa9054363f56

SHA512
3b34657cd1cfc78f4f970c0aabc09004c9d461697a597c98d8b76569da846307545dc54b93773d4c32aa988486b747207aba7b9820c11d515a6a8be1ad9d31b9

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727670771168387.txt.hfi

Filesize
74KB

MD5
b183dc4b14168fa1584bb7e741b18d6c

SHA1
1d20d91d613ad70f7398257558e889d57d1b0ab8

SHA256
046ec29f49ac56fd22b313df7620ded59b820d1341bc1e4553654eb8b833fb7d

SHA512
dc690ff456a510c48e62305ffe27589e9993baea945f976b1e0b24a4d33edff15e1988d5aa992126b01bdac41c66e6ea539b955729e149730c04e21636d982d5

Download Submit
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\File Explorer.lnk

Filesize
407B

MD5
69f26f356bcc4074c124e43a22ac06c5

SHA1
9d64e6dc0f7c80118c36beb1f8e50cb7de2b0d8b

SHA256
9056640c0cdcdc0c08306c3f77123b29a7da8640c4e5bc9e682b9297d408d665

SHA512
9b4d45510d456d39f5726b505a597d2d41c4d60e83c9990edef073abbaa70949f484db801fc6c052a29469bdd838ccaf5b92e10d519a496c57092af5c22d9a21

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg

Filesize
21KB

MD5
d25df18a7af3f0ead48c9f3f1834894f

SHA1
dfcf02030105532681234936a75108d3bcd1f8ef

SHA256
a7f5090e64d89ee9de8e11c81b8364c6be43f6a8f51284cf8446ad7916139c53

SHA512
59a29fa7638fdd03d6a1f1ec35da338505ba28d9361d6dc6631fe7c781b1a5e1213e52b37320fae4c6e8b2f334691bd3bcb0a1da1c8ab7a09d7db2a52309e171

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\HelpIcon_solid.gif

Filesize
1KB

MD5
f0c7df353876c597f9a17d68444d998b

SHA1
7669d74fd49e2a1ab87fcc27b6a4507aebd5cab8

SHA256
d2f3d573fe2e144e627dcc395daa3878a97d8e11e392e078cfb6338eae3b8c24

SHA512
172d0822d96f1e1f7f13aa8723bac3cca55a5d1794c9bcdcf37249ce979abff7fb631e14a153a2d8133366842b017347f5d0cb0a010f140f13a98eaae2b4e7ce

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\alert_lrg.gif

Filesize
952B

MD5
fbc941160d74136a823ec92ffda1ed95

SHA1
987bafa3dbd788a09fc9479610b67022316a5e67

SHA256
0b2b1471385637ef2f877a6165eabfdd4472998acb5972ce086983943c99ea6e

SHA512
6c034933d0302cb68204817514ec00a79bcb24efcc5e08b562df23baaf0499572538f031149639f6752aea77587a47a42f98a9b9061b1ead814a7b4b70684398

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\aspx_file.gif

Filesize
121B

MD5
e7de7f7e6ef687c7d381d5ca1ffb32b9

SHA1
f5bb25b19991378aab6f4b6970c3d8ddee9d4f9c

SHA256
7a2310b5a3f55c443585ba15ec7dba0288ba1ab39df4ffa504c7205818f12af9

SHA512
d3dacb8b30fceb8a149d547f06ab7ae13ddf3df5b2a5c0ccc7073c4abb7c58bf2767d6f29c8b245ff5ff2c1aa588aecde763a30b1f34f1967650806f5d56f47f

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\branding_Full2.gif

Filesize
1KB

MD5
acad3e5fa9a1ce0039efd8acedd278cd

SHA1
3902f7d7439325eceee818cfb5ceeb2efdcf78d8

SHA256
2d2a7b60a31c665dfbaf6333a01f16c5926c9be91b9fbd95ca7c0ce7df760b6d

SHA512
e65daca78f8108c6a57fbdf7fed14d833ee219b4f013ba2d220d41a1ea07f000dbb5b9a88e7f869e3fd33b00932aad7ff127122e5fea185d4fedc9da2eae86d3

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg

Filesize
8KB

MD5
ba88bf7a9d6785fa71889a57dcb64016

SHA1
93a85ec4d353de6eae9f96ba30817107a520f750

SHA256
3e5c69d5e0afc31e53cce60833ca80319216c9c264b76ecaf45e9c7b0563222b

SHA512
3d53b4148d1e1b63e5a096f5ebe8fd3d7e9271284124628c3d6a82a5d06e57c0678b792d9f51214a453a240070e680eb36fdf745ae814380f1ae41e6512c407f

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\deselectedTab_1x1.gif

Filesize
61B

MD5
92b3bf8c42f09e3235b34356381df8d5

SHA1
2ff324d59349a2f58e463e6e0e0b5381052f2070

SHA256
63ab651e5c4b4a0fcb4e8babb79c1343d72396a8835c133a9f82fc789d7be372

SHA512
dcda29be995430689532e67343f9844b05b170e2d427c2894730a90115ce6bd91435bf79484abffbe74638c7f1cf22f401312015e10af23e562a0f19cb72dcfb

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\folder.gif

Filesize
914B

MD5
a769f7054ba5615b2ab0d37df49950b3

SHA1
97a18d06cc64183e7c22888ef1a5808610a2b14f

SHA256
a06c06b71aa4f3b7aed2fb81f89767c1bfed36dffa274f6d7735d680d866307c

SHA512
8a88c3122b4b492e245ff88d3245f3cd4a44ac8af4ac414205c7a08d2ac18ceafaad08761711150ac058f158956c343a744c08f4c27201edb3f8531a2c471eec

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\gradient_onBlue.gif

Filesize
90B

MD5
1cd5b8df2030f763dcafe61798d43a8f

SHA1
7362eb15b3963109fef3330cbae2a0d22ae3e99c

SHA256
26300cbaa06b01d74a73490487c4bd23937cc569329a14d40a99041e17a6b013

SHA512
69e88154f7751def41750921b6bbdfe59c84aee97aed46bd89a7c590a63145235b3e55e3bbfc1e35a4b286678e3619c193e2b39f2e031a15ad9c6c58d6cd1993

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\gradient_onWhite.gif

Filesize
90B

MD5
97c64eb75e1fd0581917afaec633ae53

SHA1
1214b041868ddd81c34284b02688040ba6bf6fbf

SHA256
25b5162ed3b8dc60fc115c9e3f714f9253f27b42cdb08bccb590b02d076a0ded

SHA512
07d22100080536694974e986c7e55054713e6f964af2d8a15348975fef819f8d3c85f3542231081a4948ffdb92bb044f9f691e5e2d7b7ec21009adabbd38f60f

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\headerGRADIENT_Tall.gif

Filesize
328B

MD5
36c38aa4429e3447d4dd48f167075184

SHA1
3096d9f8ce4c67cdcd05921d1c255b71b1a038ca

SHA256
dcf3e23bab171e8f4ecd1ca7704516df5d404a3046fc8c8705fdf1e5120969f2

SHA512
9f53d3800ef7e55a57276ed05611715decfe3e9d4f4e4d58bf2d1eb46eecc10bd87b962249c1d90d03e1de20c2450dc20e4027652bb44ee01baf6cc7b8d67f38

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\help.jpg

Filesize
1KB

MD5
92011617f1712b1e62335c6962794d33

SHA1
92a5d2b396d56c57718ef0239fe92583dddcc64e

SHA256
a62b32572a55050a4f51606f0ac13ea6315ca32959a9acc5048b3789e595aee9

SHA512
d2436cb08ce93f8556de785d9a106aa3e36439727b881d964597c4cb8e0bec4975b41921fa2bc4fdde1f2b43e8aab65e8dbddab065c675566ad68ec6ceaa9a6e

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\image1.gif

Filesize
162B

MD5
80763720a68ae876a8426f14717651ee

SHA1
af6cd7f97cc265fa9842974098f59f25cdf4da56

SHA256
bdcd72e9e0f2c1930ae94e77145b2825022686edb42dd2a4d828a7fef0ae6a48

SHA512
2d1ba00d7b0c0437565f4760c97491bbadac37966b2591857a71ef3361d35537cd958d7bb255b0aa14add5b702ce5104a97f945ae4588032f93457f7cd9579c9

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\image2.gif

Filesize
586B

MD5
ccf370973143e9c0fecc45410af659c1

SHA1
df33c9b3f50e7856488156c2ad165560ba4216fc

SHA256
cc693e7009d11c24943e7a3d2e932088e698055142f608daca5ade73160be7cb

SHA512
893bc919cc33694ae9bc2fadaa513e4c00fc6d697b8e52d2d0ed619678b15eb896d13680f018cd11274e6d1255d6c212bbf44642cc55a8e1027b8dad67b2cc0e

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\requiredBang.gif

Filesize
124B

MD5
bd9447c60f16271319bd1e250a5dda8c

SHA1
7ea42467b0028f561779ea3fea110d91bb46448e

SHA256
4c017c3ead55f17bb605438576f11380257db9aa8f7958594ca66e3cf8d10fa5

SHA512
44e95fa70de79d1a0f2f32522c4ac7b98ea189ecae5b9e5727bfdc673c685963c782bba75fef69cabbe4f3179072c9c24b7111c36a07c95ad20ae96a2be316d4

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg

Filesize
8KB

MD5
9fd7a7e94ea3916c418b69c2b7842733

SHA1
88e021ebfbcd9f7e72b878569990e7fb508ab250

SHA256
7e5ade2dcc8fe688efa468b5efe8294dfe9a89287b7cd90cd09003dd306673ba

SHA512
e9c44f74895b31761a9f537082814de3b811b98ee5a23aa4510187dc580a155af14bd2cc9aab9a949f8e7caf4f071ddb2a405b4c89e8e80f9c20ee41cd3725a5

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\yellowCORNER.gif

Filesize
880B

MD5
539c34597f57bbc1749dcdb6b916f8eb

SHA1
768c27cb5f000f7af25a1d9ee20ee84cbead2017

SHA256
21c6b2b85b06059ae8d8e802a1e5d09f792eac0254375b8bc283ca2b966df2bf

SHA512
95073c340e6a0ec208f70deb5638355383ffa1bca5239a7657c1419b8ca4a22811edf93365cba2dd9fc2fd079bc830d26f2c4110fb9100e9a4843a852494cef4

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\security_watermark.jpg

Filesize
49B

MD5
5e322b53a8b9c575501abb4b6967f006

SHA1
9bc8adb015397cf4dc2127c129feebea0eace0b1

SHA256
156dfaae4f44beb6aea474ecd02d9897e97c10c6ad55cc58286f50347bd2bc02

SHA512
e4797029a965caa162b0312a2346ee8be172fbc97efa296c6eb4e0e22d475ab1a522b9ec7378cf2f5836790d5cd9b2cc3c4887686607ad1890df3866e47f8b98

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\selectedTab_leftCorner.gif

Filesize
65B

MD5
7839fbdead8663d56461e3c706f6cfb5

SHA1
be08d84badf119b0bc0af045023d1a71b299305e

SHA256
07f6cf97fff4b2611bad3673ea623de39801c115839c951259fb967b2e1e9662

SHA512
087316e60eb73f2105d0ed90948726ce4f2c6de4c582f1496013199d63b4c2d294d5c3fb4f9fec4e5fecc80d5c237e5ea8c18b6d8b83fcd43f28f2c324e510d0

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\selectedTab_rightCorner.gif

Filesize
65B

MD5
5e14b149c6cdce31f959c5cf7adcb2c5

SHA1
2c89df3022317829009cc82da53b3d7212c2885f

SHA256
d2f53a0baeb2035ff50efcb5e23bdc86828b7053132425336f896e6f7bdaa6f6

SHA512
547b294e9477201df7779b05079afff398c1c29a66d56e27873deacd93ecf563de4925a9ead1672d44d4d39b818f14ef4e6f508ecf654ef800a49d191fb0b08a

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group1\1 - Desktop.lnk

Filesize
1KB

MD5
7bcb921c32cb0424c7d850bc2d89cc52

SHA1
f216b767017a7d19454e8ee6a588978b165e4abd

SHA256
64e3604399ad586ac50a671ea2de46b64acfd7f38aae273b6cb1ea50bd5efcc5

SHA512
5c1f279e8e5db43e5b8ca8662dee15fb2d5a81ca95074c0995a99b5898cc4c36700a2107ffb8f8391c84dac3fc729b1e0e16781d8f8aecace79f9d746d57a457

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\1 - Run.lnk

Filesize
1KB

MD5
66aa0a80b3424f930d7a6008b81882ac

SHA1
6cecc2796445fad46f1204f54c4341ded41b1c71

SHA256
418889727d53e20d833dcdfde293f8cc6927409382fd426288b2534613433524

SHA512
08243b027e02f9c039831522ddd95bda16bc3cc0553211863e10de45b4bc26ad43ab8fa410b0869393d48301408fc6ec149a904f7f1f03ed380a41a4a585e1fd

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\2 - Search.lnk

Filesize
1KB

MD5
28e19a72b41d874a008b230f0dbd2398

SHA1
97e043e39bb2cf6df9ec2b8e47266388cc9ad500

SHA256
525fe556d469d11a4db513939d1dc3187a8c3e6bf125e27d75ab3ee2ba53d5ce

SHA512
992c594e446120c1e9f8a99ea8ad680ed0763ddbc2f603e43d20926262f48e7c123647ec7e3b0d0be0f3e91d92c4faed559cd18c676033af2b2f7af2e22ef016

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\3 - Windows Explorer.lnk

Filesize
1KB

MD5
fabc8355df532b6cbacadcdc18c7828d

SHA1
45248e9abeea45a35b3a010c548831ce5afd8750

SHA256
1b4b258a571383709d9f7cd1f588a7ddae5aab3e510ee600277747f62ef5547b

SHA512
eb5bda07fa5c20fc766ac52b696034aab762b7c92e5ec6ae0346f1a2d2a565cd87404fe4c41f19d9a09bc4c31b3db66c474df4b415894bbc980d21b5886367ec

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\4 - Control Panel.lnk

Filesize
1KB

MD5
5dc48103a3227a57a80fb1202455044d

SHA1
ae3f7a3b3868f7e5c77a4333cb53b8aeda57ac7d

SHA256
2fc8d468ff3df6b10d98a4b309c1ee9a4efef877f88351582dc2d0cb7d768cb6

SHA512
747cfa162528331e4c5197a8c97c3d595e1339d5033fa6b03f76205221c01baefab5882d5360b410a2d68b38c1bdbacdc0a16d085d7adf76f675ededfbc025a3

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\5 - Task Manager.lnk

Filesize
1021B

MD5
2fca5df17538c1d818bfa28832dfa684

SHA1
f01aa0e62466cb979105ba938c7b915ccfc97149

SHA256
273662e0a4a1da0e28e278aa150ff2223ec5e81937a348240cb8f3593f533a6a

SHA512
68786a624ac8b15f59b70661bfa0e452162441740af309c27a9b2adcabb5178b87880571a454b1b529b66c75315abcb14a17eb57fb879b9f8763f3a2824fcecd

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\01 - Command Prompt.lnk

Filesize
1015B

MD5
95bffdee2a2582abcb14d46882769b0d

SHA1
2d4dbb773005d329015582ca63d9885b0bbd3d8a

SHA256
0f89cfb70692f6af567754aa326a57c2a6861767833c19d7c79c4361673d6755

SHA512
894efef55df28156f970408055953cadc88b1f5d1d9159b430717a10e3854552a00eca55e2acdde8d426f851ca35b1fb03efd782136ca02a1216f1c29229d7b8

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\01a - Windows PowerShell.lnk

Filesize
1KB

MD5
b774065675f4f100a541d558b69b13d8

SHA1
d917933ad354491e52aa9cf8b1cb1dc359fe36d6

SHA256
db173d8785a26186e513803ef3c84ad7cf2f12e60cfd41307693a7edf84e5e0a

SHA512
bc4bd300541e4bdcbea2022a18d40a22cbb72fce65680ab4c64f60d1858a2fafcceea3bf7a94ea93f871debd8f431991244f3645bd67f8f40f5c85d53f13324b

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\02 - Command Prompt.lnk

Filesize
1KB

MD5
5d014ff682484fa96faf9abffb0ef075

SHA1
c2d177431a1c4be49ec98fa08e9658c2ad422061

SHA256
8186ce0fb9cb8b3e988e36bd80b608a60eb1ea8a8fff11161d3a9de79a8e0e62

SHA512
3e8b93b2bf83e59d8f6c414fa41d04044679dc8968fc95a876a4fd37831ec9e919417f3b264a6a1e7ee3eb8b6a1f63e4796e89f94bd23e054012291331fc9f26

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\02a - Windows PowerShell.lnk

Filesize
1KB

MD5
a83a2da5df4c964c4e6c1d7a79bfbd76

SHA1
217e454e5a72d65de734ba149c48e7535e09d407

SHA256
e703807dfbfe33fccbdfdad93a128effda69a5d9668faadc646ae0b488d9439f

SHA512
5d1945006464237ee1f818800e83af4af5c3884c3576cd8649a4ed213f964c687a41e3d12e8647e2d316dd137c96ce2af9d74f20b27a6051ef9bfa7221410005

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\03 - Computer Management.lnk

Filesize
1015B

MD5
a82c2e663dc7a4a6e1bead21788b0790

SHA1
0f25219ea4e950f4e1edc50190061b194229ea70

SHA256
ed7ac81947e1ab009f87d36a05e4bed676aab1620303b820b6da7ead567ce01d

SHA512
62338a8dcd78826a08d4dafb23bb4477448d89e0dadc1a8d70321fba54a3eadf63356728653b338d18a680d99356026037674ecf6cce6776d07a1401b3ece252

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\04 - Disk Management.lnk

Filesize
1015B

MD5
858a48fddc692638f6fe76bf9b617cf1

SHA1
998ee43e53a74e072e04969f617ebe4498228403

SHA256
71a1e386896e45a124a341e06b05b9dc9f7fc46b1a1c868ee3c472968ccc20d3

SHA512
c4f2b032b7d8af345ac968d8136b84a9866edf246a5e94df1784d2364d1d20d4e012b10e2b25007ba1f7c9205f4d3f0070338e58d098989754183d71b1bc07ec

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\04-1 - NetworkStatus.lnk

Filesize
1KB

MD5
d7d48037a366a34a12850b5468ad80f2

SHA1
7d2965899787d44a12263d1a8c79a94cf4c2ab80

SHA256
d42b206bd7347915f23556c2b33b642d8f970c25989f6b83c11340f775b28593

SHA512
b90a51e02e93f643a70220ca01a0d9da28a24998a9414a7cf230c7286194f7d8914e3c7c4ddca044b07cba29179b5efbfd8aebcd43430308abc51d89530dea78

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\05 - Device Manager.lnk

Filesize
1KB

MD5
3b4055c244cda9380b6415d501f5fce5

SHA1
3791e4742329300d0f8477752bd53de32c3a9de9

SHA256
015247d0602ec42075bd10a9d632b51f0aad912b9bc61b45a262d6ec72a2ac63

SHA512
60f42c3f019ee27f66881981ccbcb61117740df84120c174d974c287b1b14a00559c0c926233641d4c842237a69041c304c3bb1eae3d117b8d7f0d5034363ba6

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\06 - SystemAbout.lnk

Filesize
1KB

MD5
352c3ccb46ef1a3654e9fa253ff5a4c3

SHA1
3ae1241794aa7a02dd6963e1c3b8619cdd75ed2f

SHA256
15c2b2581d4f53cc4e1c47aba424c087cda8feb87702cadfdb8de940d6af6bad

SHA512
41376893cd040ad345ad06800c5955fbc6612853acbf1e6d59320a7bd4b46e33a1f45f871f3b51afd7cf7af1dfd9339187b8933d63a11d27572054c451a6846e

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\07 - Event Viewer.lnk

Filesize
1015B

MD5
2c2d94776f7ce356424af70d4442efd6

SHA1
248586610fe1fe527818c82be52078f345cf5a3c

SHA256
cb7ba2961e3228a21cccada92977737b3279f3cf56225264244f449e3c66a03e

SHA512
82aa18d9f92ffce011f04a7cea680ef049fde09aa4f40bf836fe147031419a4a07d453af18258b03870d1faa01c64bb399f0e60802bccc5cf4158d4c09719dd9

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\08 - PowerAndSleep.lnk

Filesize
1KB

MD5
47dbb9322a2d046f8c3daa615ed1a4db

SHA1
13b3feb1ce7383822b8635c764dd3aad23239412

SHA256
1f076a5a2d953da27425d55470e4a4d136b73dac1882e4997adb992100477d00

SHA512
9671bed25c8a60f0c7e552224bf57c821f1e14934755a8e2d793154195cb291f8292c526574bcc3b5777967d011241a8572cdc4454564e66295f5573cc2ce687

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\09 - Mobility Center.lnk

Filesize
1015B

MD5
855bc7e59b9be18ba7c4d524e558fc16

SHA1
27f02dc48e40e8b4ba46cd8972041eb303a5c632

SHA256
5597bf76a3ce763e92a2dece00ee5cf3e6307ee091e8a5a8bc0a935763844240

SHA512
9a06c7f9b309e4fad7ba60ab87648043c157262ec3effb02c80db14d3b4c643b6b6db4ebc983dc8322fdc50c5ec4c2b40548467a19e55958ab4cfaef36bf4702

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\10 - AppsAndFeatures.lnk

Filesize
1KB

MD5
ca97185c51d859a24729a1107225dedf

SHA1
ced40a67cdc731f74ebb91e77df9cd539ca624a5

SHA256
0e7229b15f1cad440571a2babd5de89f6fd849244e7b74154c94dde17b95641d

SHA512
f06ed6d8ca969014013a43e48e5c24cd18ad519f54c80553d06d829a41d66166bc7ce812ffcdfa1495156f77be618c48205a0c3327737b25dd727cb61044eb73

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk

Filesize
352B

MD5
d6d000fbec7d8a91492ea1f4ac2e43ab

SHA1
f54c5ca247d63601e4a54f83a24f3b922104dfc5

SHA256
2799eddada042436f7ef811c7eafeba9d8462025c8a7c350a59b3329f0285909

SHA512
66015d07b02ec2426967bb161764aeb666ba69714bff587e29fb4538aed0db3ce741789f3622ffd00579639b1b74a44ee5ea664b1c6cc4ecffc790487debdcb1

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk

Filesize
334B

MD5
242487d5bbf259445a7da1da7825992f

SHA1
95147d8c5bce5e28aace4946ae4bab64eda1fec9

SHA256
779bd22d43999e5eac00cd1ed65cf8c10a0c1d9ae0a2778c5a59327dbd8e4069

SHA512
37f6808a7ed6813eef37da7d77d19c5781d28e82857a1ca1a826e3a24d913c862023b44e0886857e92dc76451fd0644115b723d7dbe672c0ce4f56526addee82

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Magnify.lnk

Filesize
1KB

MD5
ed83ae0313c02e6d8330f8efcd516e2f

SHA1
6f1ec04062dd6ea73ffa5d514a2b81bd203fa721

SHA256
2536f94b0c0e4b57315dcde729e77f19fb9b5e3fad4d7af8697cc7238e2eea67

SHA512
844cd75bbc13e09b2a18ebd5fc6761777ac1e3da5c1a18765273829bcecfaefcac9a294f35d94f89cb99f07b335c9ce5d21e8a8d1d88c8a684d36ef7d8194695

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Narrator.lnk

Filesize
1KB

MD5
ba46957d08836c113b5b22f7e2a812ff

SHA1
7309571195bf7bf6c3241b7708cd2bf628fa0029

SHA256
d1920adaa474192bc83435e2033cbe0460542931c9e23dc932ab8700e750617c

SHA512
65054d40bacdf1fb177f5650357eaf8a8b57077828fe8546b9ffe37f456e65e8f337e3c9e4280c45a802047e80a71b531d1772b8399e32d5782aa07466be03b1

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\On-Screen Keyboard.lnk

Filesize
1KB

MD5
0bccff290d6941a8535208384678f9c7

SHA1
0745ebe8c780d0c35947063d2a2d664f0e792923

SHA256
2d133049c9219256a9e63ff28dd0b47ea8fa9265457bdd9b0ac1891e87e33b14

SHA512
2898880abfd2557e539bfe34cf6ab6c8193f6df8de8520e64445557de00683b7ffefa6956d20e2002215f60b540427cfc21257e5059c3231254682c82dcf6c26

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Administrative Tools.lnk

Filesize
1KB

MD5
37145ddd3fcd92ebd29ebb94fa94b5af

SHA1
c33e9e75d0fe2b06e0093d36fa47d0dc3bd20f9a

SHA256
7340684c60ff05b99549a883ae36f1134c29d3e5a0ab7f96329e0c20ad6272f9

SHA512
728ee57daec4d6328b1f1a10f366dcf731d79b764a41ea0b6dcb349489e3b307f82596ee57841ce8fdc1a1ba080c609869ea5a9590a397bb325ee06e33b85535

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Command Prompt.lnk

Filesize
1KB

MD5
dd603775f2791a5d33bb06bddbbf9eb5

SHA1
2d32db3bd0962f73ab77bc455149966b0681861b

SHA256
6b800e94fd0adbfcf5e1015da2f0c89bf068d6bad35f0ee3e02cdde5668f0d7d

SHA512
fb150d99b406255ba25737759643cbe6832297760777f22b631f3133c508a43dec0fe153c06127bb7885f9e16fa58a41872ae74b45ff129eeeff1bd255dddb39

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Control Panel.lnk

Filesize
405B

MD5
85f21ff92180f727a82ec275a1ae7400

SHA1
25ef2e735f03be7fdeca04a520f63f74b61a101c

SHA256
53ad9654ffd1cb0fde756bcf3a6fa2354fd06bf0caf0bbb86a46189f0533c904

SHA512
64f4d54c3dc66c4fbf8158da991fd3e9c4e297f42d11057d223346b5e5110c66da5b473a4944264c7c9cb46218d03deb4838c38154017525daf6d68d384ed850

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Run.lnk

Filesize
409B

MD5
1d4fb45b2bb3e9ef97bd43a36ffd9fc9

SHA1
b92a29028edeea153f68a45f4f63a14ad792770c

SHA256
de596b053b9f7e6dc832e94528da648af58067b9cadd29570ccdfd8a4ece9c8c

SHA512
0dadff11029991cf7725f82a1b51da038c7dd545560c568bb615d20debc2194bb23019e83ca56500cbea7a8afeab2874751cec74c209839139d481133cfdb9b3

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\computer.lnk

Filesize
335B

MD5
18c44fec9f623af4989e5dea3be40d9d

SHA1
2afdca2fdb57f1fa027447bc2812a295388d4f60

SHA256
d1ab5621a5d3eda410d16431fade4fb82c3cc4baf63785aa0cda3b57e4f62351

SHA512
95e9415837639e8f510cf7a6c35041b03fee91c42e1c9c27f7bb0784d5af39a0ac67f45addc6af9fa27c0bf661576f697b201f03b0bfe3a0f2234bbfe98e80c7

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell (x86).lnk

Filesize
2KB

MD5
c8c394bbbcb2f351b88a825297871849

SHA1
0f7520ac41ddb5b779e2df4f675619aa2dc407f0

SHA256
e790679b7e7dc84536af223b9d2e435985d0ace4dcb7d3f77f0276427eb44c18

SHA512
49636abb408f5352b70d7bbcb429d6d7d5acccf22c44f5ecab0b4d39b2b0af51bc22d12f069776d37e013bd7596fb803bd7158ed09d24e5a8372e8437ff84251

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk

Filesize
2KB

MD5
3b02de87b240fad92bd5fcd18792e70a

SHA1
2605a1cbbe4d798829b6cb775ba02c8021a952b8

SHA256
a9ba3c1b72aed146448f07c6062c171f914db72c865586b0cf3c447b5faa6e76

SHA512
860f47bc69202189f84a3ed0645ffe93d1689072d2b5294738ea3d469d09806350cf59ec6c02682f407a4f7e43c87191e037ae108c1080cd0f9aba0f94518ab0

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.19041.84_none_a689f818199cbaf8\Task Manager.lnk

Filesize
1KB

MD5
7d7fe4c52dfd9b9a5a821956fbbdfb60

SHA1
cdc6f65548ef206fbfca57d0c860e56357842409

SHA256
a7a55748954f8c9bb439c5b71a011e0b4b6716aa9a715fdeeffba1fca9cc2f07

SHA512
2353e9f16e458528ff6f6e2e52f42a0122d4919bedbe32b08ade3cd0da0d6fd55437f282f7488b721518be70f6de58906d4e2f18950094afa4f02e21c2ec795d

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-recoverydrive_31bf3856ad364e35_10.0.19041.1_none_de83be952b0afb6a\RecoveryDrive.lnk

Filesize
1KB

MD5
1da68fa1a05a89834fddd7cf5f67c0a1

SHA1
c30ad68b1c39c45edcb60f8786f708bd8921e09c

SHA256
0e0ff707118fda3a65432a1fd8418ded830976d93bc212cb4e74e1a15fa824ed

SHA512
7a423cd3294e9c0bc2ce0bcf4f1727780da25cf7161760c5cdf5e8e50cd435f89940524fdefce12f15b220155ee8523c89665334e63cb5ae9f4c3fdcfca25900

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-registry-editor_31bf3856ad364e35_10.0.19041.746_none_d22800313aa7eb5c\Registry Editor.lnk

Filesize
1KB

MD5
a46083ee7380f46bd6135049a6c83d61

SHA1
91ffecfb3802dd2c32e63b0390bd0112eab0ab85

SHA256
9eaa4db69c1ee43b3630e579e663bfa805262e9a467bb4364b959fc62775f913

SHA512
a58e40de993bbe9981ca5d555f008350e2c57ede897197819336c125aad2a7246892633738112f96e0354cc1da7a6bcb9fa2ba04c3f164599eadbd9f0cd2a3f3

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png

Filesize
296B

MD5
2f78ff181c1a1acf13bd8ed546952287

SHA1
1ff361834ce283f935b7224f8ca00e85bbdf908f

SHA256
8354bf138eead3d23680caa24872a674ae71cd3ac1c8ad70d4e942840101cf57

SHA512
0aca78bccd5d4d55d017aaa2002c5d23112100b8a7e615407cf3c8ea76238c445aa51dd31fd002de08e07d3d45648a469c93823a7ca882034fd12d2309803561

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_contrast-white.png

Filesize
276B

MD5
18c604f41c64056851b6c080b80b355a

SHA1
1ae635e7018c3d03e0a3d5c097c6b41480760c79

SHA256
d855027b04facc60d5c33661eab1be5a08ed5edc46b7b8ba4ec10694436b1be2

SHA512
767cd207c831f6528ab00bd0c0b81e2acc01f74dd17dddf965a179b2ea8249593cf6e8022e71a4f6601e7edb93afd49cb4544bd7667a3c3c7cde5d972217a50a

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\squaretile-sdk.png

Filesize
501B

MD5
56767a29a42ce71902aac15f777dd057

SHA1
9df75929e64b938e8520d2e3c334bfdf939a1978

SHA256
b2ef2567ca46a1813f0fd4364522d6fe041af12264d7b30094ceb6cdd813b819

SHA512
3ee216757852b38f8e6c8e4ade9451cc5ad2c866c6d29870f29d19fc54c5d480f31357f7c253b81ecb306f7b2579474711a21c2ca20de16727f41decc39a7578

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png

Filesize
296B

MD5
55c082e5c753a3be7704ddf066d0e895

SHA1
ced13c44a19f82b143b033378d601f93b1de3388

SHA256
e45f697a81e1cbd46046a50597ba9af08e1d8311647d62a17402cc418b0f63e8

SHA512
8a7dff042cf53601adb5212f9bc6a21e48de61faf38096def0a733188e22b57d0141a7b2885ab426f76c40c73ed92fb0ef80abf0e469c83a7c14166a6830a0eb

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square44x44Logo.targetsize-44_contrast-white.png

Filesize
276B

MD5
c4be1ce9dc39fb83fd5a2d617c2a4837

SHA1
eca34cd429eaf350804bce704d19ea61c74fd54a

SHA256
403a36ada7f7579d09670f9b98e7dafec1c2e1beecc5fd26ee6b5fd0b4f2505c

SHA512
3e736e36954c970143a82baa806fa88a36db812d09c08a6ab4d19a78e6d0fd2c42c6b8e59b62f7f4c3fc7806f5b1d9f30e934b404de6465e9280300b034fd64e

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\squaretile-sdk.png

Filesize
501B

MD5
cc732d0bd874a5559714f32366affe1a

SHA1
b1b7b5585059d53f44d8e0dbfc260472ab658c71

SHA256
a836ae986ad1fdf66b57b8f55eac652b146a474835c2c0ee3a6afc945bd60bed

SHA512
3d9324b6ff7f7db2248f609f2364c515e39985e7db154df70926194ea141cc67a8283b8ec91b0c0f71b97476755cd272ab6af1d5b44c37f1b5821c91d18d4890

Download Submit
C:\Windows\WinSxS\wow64_microsoft-windows-onedrive-setup_31bf3856ad364e35_10.0.19041.1_none_e585f901f9ce93e6\OneDrive.lnk

Filesize
1KB

MD5
9215a99d7703108ee4ea5f654285ce00

SHA1
8561e3ff496a895f3da49f72b921a1ba3a130cbb

SHA256
48cdd4014bf1f79244c40e66e6e2f5a63332328ba2e4bc3414c173d064aac009

SHA512
7eb0b00f6c27e5b970d6ceaa8cd84e78ae425444cf98ad1138d278f7742ffd0b1b74e4bb5a729bf6f844fb49b4fe4855e36b85cd4ec5838b13aea6c1f29b8f5e

Download Submit
C:\vcredist2010_x86.log.html

Filesize
81KB

MD5
2e3bc5487b51ec023f38494fa069838f

SHA1
fb004e2b1cc49566d3b2f01c8c9816780c87a07f

SHA256
98ef8d12a52b3dfacc5ea83163ca97235c32300e7979d85428e43f16ff375a05

SHA512
ce5e96777647c36f8782d92464216fc9ac83137c761b79ea7134a6a80ad2f5cddf7eaa3903dcab83fa2f9237522d96b6c8ffc3589a0956552670b6abbc0e98a7

Download Submit
memory/4308-7225-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/4308-7221-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/4308-10901-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/4308-11044-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/4308-11323-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/4308-0-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/4308-11328-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/4308-11329-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads