xorist | 4d22f80ca7593631a896d476bdadc16eab274a2c5f9aab0a8bfb5558a340056d

Analysis

max time kernel
93s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08-12-2024 08:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d6074e163ab2938305579363b202499d_JaffaCakes118.exe
Size

7KB
MD5

d6074e163ab2938305579363b202499d
SHA1

59f9a32fe01e3466c91c936e63aff98579b21d05
SHA256

4d22f80ca7593631a896d476bdadc16eab274a2c5f9aab0a8bfb5558a340056d
SHA512

23ea0d3f0daed7f1b79d50624ee3f4a0214c2df0dbc83f3ca5b656df46aac83cbd2b7add6eb0b352092076f6df98c60fb370ad9c23ab70804fe459586bf5cf8c
SSDEEP

96:lXu4uuo88mSnfA0AmUWDCP5a3dkDDEyIyQjwBhEgbjDjRmW+atMUA:Buuo00AmUW+P8t2DEpxjiGcPMctMUA

Score

10^/10

xorist discovery persistence ransomware spyware stealer upx

Malware Config

Signatures

Detected Xorist Ransomware 5 IoCs

resource	yara_rule
behavioral2/memory/4544-3959-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral2/memory/4544-3960-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral2/memory/4544-4111-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral2/memory/4544-4388-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral2/memory/4544-4393-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist

Xorist Ransomware
Xorist is a ransomware first seen in 2020.
ransomware xorist
Xorist family
xorist
Renames multiple (2195) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\drivers\gmreadme.txt	d6074e163ab2938305579363b202499d_JaffaCakes118.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\9e6T6YF2PiNP46m.exe"	d6074e163ab2938305579363b202499d_JaffaCakes118.exe

Drops file in System32 directory 21 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\@WirelessDisplayToast.png	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\SecurityAndMaintenance.png	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\SecurityAndMaintenance_Alert.png	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\default.help.txt	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\default.help.txt	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\default.help.txt	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\@EnrollmentToastIcon.png	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\MSDRM\MsoIrmProtector.ppt	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\MSDRM\MsoIrmProtector.xls	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\default.help.txt	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\default.help.txt	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\Bthprops\@BthpropsNotificationLogo.png	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\MailContactsCalendarSync\LiveDomainList.txt	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\SecurityAndMaintenance_Error.png	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\@AppHelpToast.png	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\@AudioToastIcon.png	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\@VpnToastIcon.png	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\DefaultAccountTile.png	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsCodecsRaw.txt	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\default.help.txt	d6074e163ab2938305579363b202499d_JaffaCakes118.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4544-0-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral2/memory/4544-3959-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral2/memory/4544-3960-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral2/memory/4544-4111-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral2/memory/4544-4388-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral2/memory/4544-4393-0x0000000000400000-0x000000000040C000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-100_kzf8qxf38zg5c\Assets\Images\SkypeAppList.scale-100_contrast-black.png	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Google.scale-100.png	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-40_altform-unplated.png	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailMediumTile.scale-200.png	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-white_scale-180.png	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageAppList.targetsize-24_altform-unplated_contrast-black.png	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-32_contrast-black.png	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteSplashLogo.scale-100.png	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-20_altform-unplated.png	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\legal\jdk\relaxngcc.md	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteNewNoteLargeTile.scale-150.png	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\images\file_icons.png	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PIXEL\PREVIEW.GIF	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-100_kzf8qxf38zg5c\Assets\Images\LockScreenBadgeLogo.scale-100.png	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\SmallTile.scale-100_contrast-white.png	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\FetchingMail.scale-200.png	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailAppList.targetsize-32_altform-unplated.png	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\SmallTile.scale-100.png	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_Pester.help.txt	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\MixedRealityPortalSplashScreen.scale-125_contrast-white.png	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\contrast-white\MixedRealityPortalStoreLogo.scale-200_contrast-white.png	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\3039_32x32x32.png	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteNotebookSmallTile.scale-125.png	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubSplashWideTile.scale-200_contrast-black.png	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-white_targetsize-256.png	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSectionGroupMedTile.scale-125.png	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\LinkedInboxBadge.scale-125.png	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\LinkedInboxWideTile.scale-100.png	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\StoreAppList.targetsize-256.png	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-30_altform-unplated_contrast-black.png	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\contrast-white\MixedRealityPortalAppList.targetsize-256_altform-unplated_contrast-white.png	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraWideTile.contrast-black_scale-100.png	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailBadge.scale-400.png	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-Advanced-Dark.scale-400.png	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Program Files\dotnet\LICENSE.txt	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-48_altform-lightunplated.png	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\GenericMailLargeTile.scale-400.png	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Yahoo-Light.scale-250.png	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailLargeTile.scale-150.png	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarSmallTile.scale-200.png	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\LyncVDI_Eula.txt	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\SmallLogo.scale-125_contrast-white.png	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNotePageLargeTile.scale-200.png	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-72_altform-lightunplated.png	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\LTR\contrast-white\WideTile.scale-100.png	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Store\LargeTile.scale-125.png	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Win10\MicrosoftSolitaireAppList.targetsize-256_altform-unplated_devicefamily-colorfulunplated.png	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sa.txt	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\AppPackageSmallTile.scale-100_contrast-white.png	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2018.826.98.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraSmallTile.contrast-black_scale-125.png	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteAppList.targetsize-64_altform-unplated.png	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\ScreenSketchSplashScreen.scale-100_contrast-white.png	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB.txt	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_glass_100_f6f6f6_1x400.png	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppPackageLargeTile.scale-100.png	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\Assets\AgentPlaceholder.png	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\LinkedInboxBadge.scale-400.png	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\ExchangeSmallTile.scale-200.png	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\LTR\contrast-black\MedTile.scale-200.png	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\10.png	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteNotebookMedTile.scale-150.png	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.contrast-black_targetsize-256.png	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarSmallTile.scale-400.png	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\SwipeTeachingCalloutArchiveImage.layoutdir-RTL.gif	d6074e163ab2938305579363b202499d_JaffaCakes118.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.19041.1_none_ff46bbc9afee54c5\RatingStars32.contrast-black_scale-200.png	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Windows\SystemResources\Windows.SystemToast.Calling\Images\SendPhone.scale-200.png	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.1_none_75cd350cc8b5dbcf\dom.html	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-p..talcontrolssettings_31bf3856ad364e35_10.0.19041.964_none_d1ce1ea46e50a943\MicrosoftFamily.scale-200.png	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.Windows.CallingShellApp_cw5n1h2txyewy\Assets\square44x44logo.scale-125_contrast-white.png	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\Assets\Icons\contrast-black\AppListIcon.targetsize-32.png	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\Assets\SmallLogo.scale-100.png	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-p..riencehost.appxmain_31bf3856ad364e35_10.0.19041.1_none_97b0a47239f6db64\PeopleLogo.targetsize-40_altform-unplated.png	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-p..riencehost.appxmain_31bf3856ad364e35_10.0.19041.1_none_97b0a47239f6db64\PeopleLogo.targetsize-96_altform-unplated_contrast-black.png	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.AccountsControl_cw5n1h2txyewy\Assets\SmallLogo.Theme-Dark_Scale-100.png	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\es-ES\assets\ApplicationGuard\LearnMore.html	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-a..ntscontrol.appxmain_31bf3856ad364e35_10.0.19041.1_none_44197b0fdd55f562\SplashScreen.Theme-Dark_Scale-140.png	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-n..quickstart.appxmain_31bf3856ad364e35_10.0.19041.423_none_72535ca9b59a9515\NarratorUWPSquare44x44Logo.scale-125_contrast-black.png	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-p..riencehost.appxmain_31bf3856ad364e35_10.0.19041.423_none_bfcb7b02f95b1e52\PeopleLogo.targetsize-32_altform-unplated_contrast-white.png	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Windows\Media\Alarm03.wav	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.19041.1266_none_fb76f6fb7e78a373\InputApp\InputApp\Assets\SquareLogo310x310.scale-200.png	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-ui-shell-component_31bf3856ad364e35_10.0.19041.746_none_2b9acc2d69574796\Icon_MMXresume.scale-200.png	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\surfaceHubDeviceUser\view\main.html	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Windows\SystemApps\microsoft.windows.narratorquickstart_8wekyb3d8bbwe\assets\NarratorUWPStoreLogo.scale-150_contrast-white.png	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-c..ngshellapp.appxmain_31bf3856ad364e35_10.0.19041.746_none_0b4ed891dd9ccbc8\square44x44logo.scale-100.png	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-n..quickstart.appxmain_31bf3856ad364e35_10.0.19041.423_none_72535ca9b59a9515\NarratorUWPSquare44x44Logo.targetsize-24.png	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..riencehost.appxmain_31bf3856ad364e35_10.0.19041.153_none_dac5d96a5dc8a9ab\Logo.scale-100.png	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-i..ntrolpanel.appxmain_31bf3856ad364e35_10.0.19041.1202_none_8f7e37524c3e1a13\logo.contrast-black_scale-150.png	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_45a6c0aa2ed16c7c\PhishSite_Iframe.htm	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-shell-sounds_31bf3856ad364e35_10.0.19041.1_none_cd0389b654e71da2\Ring10.wav	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\images\logo.contrast-black_scale-200.png	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\images\ProvisionedCertificatesWhite.png	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.19041.1266_none_fb76f6fb7e78a373\InputApp\Assets\BadgeLogo.scale-125.png	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Windows\SystemResources\Windows.UI.Shell\Images\TabletMode.scale-200.png	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-m..nt-browser.appxmain_31bf3856ad364e35_10.0.19041.1_none_b1e502c19c2a358b\SplashScreen.scale-100.png	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-microsoftedge_31bf3856ad364e35_10.0.19041.264_none_ef195f564f00d259\MicrosoftEdgeSquare310x310.scale-200.png	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Wide310x150Logo.scale-125.png	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-ui-shellcommon-core_31bf3856ad364e35_10.0.19041.1_none_91b1f58702057373\CellularToast.scale-150.png	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\alert_sml.gif	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\cache\Desktop\11.txt	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.1266_none_777e4c5802d14c18\oobe-retaildemo-dialog-template.html	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-m..nt-browser.appxmain_31bf3856ad364e35_10.0.19041.1_none_b1e502c19c2a358b\Wide310x150Logo.contrast-black_scale-150.png	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.Windows.CallingShellApp_cw5n1h2txyewy\Assets\square150x150logo.scale-150_contrast-white.png	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-n..quickstart.appxmain_31bf3856ad364e35_10.0.19041.1_none_4a388618f6365227\NarratorUWPSquare44x44Logo.targetsize-72_altform-unplated_contrast-black.png	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-n..quickstart.appxmain_31bf3856ad364e35_10.0.19041.423_none_72535ca9b59a9515\NarratorUWPSquare44x44Logo.targetsize-80_contrast-white.png	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-shell-sounds_31bf3856ad364e35_10.0.19041.1_none_cd0389b654e71da2\Alarm06.wav	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.19041.1266_none_fb76f6fb7e78a373\Assets\LockScreenLogo.scale-200.png	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.Windows.CallingShellApp_cw5n1h2txyewy\Assets\wide310x150logo.scale-100_contrast-white.png	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Windows\SystemApps\microsoft.windows.narratorquickstart_8wekyb3d8bbwe\assets\NarratorUWPSquare44x44Logo.targetsize-36_contrast-white.png	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.117_none_e0d32848ac56114e\oobezdp-main.html	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..ast-white.searchapp_31bf3856ad364e35_10.0.19041.1_none_2f147508fcb33106\MediumTile.scale-100.png	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-microsoftedge_31bf3856ad364e35_10.0.19041.264_none_ef195f564f00d259\MicrosoftEdgeSquare44x44.targetsize-64.png	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..okerplugin.appxmain_31bf3856ad364e35_10.0.19041.1_none_11b2da2074e7d6e4\PasswordExpiry.contrast-white_scale-400.png	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-ui-shell-component_31bf3856ad364e35_10.0.19041.1_none_03928ee4a9e5894c\LocationIcon.contrast-black_scale-150.png	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\de-DE\assets\OfflineTabs\OfflineTabs.html	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.Windows.CallingShellApp_cw5n1h2txyewy\Assets\wide310x150logo.scale-125.png	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Windows\SystemApps\microsoft.windows.narratorquickstart_8wekyb3d8bbwe\assets\NarratorUWPStoreLogo.scale-400.png	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\Assets\Icons\SmallTile.scale-125.png	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Windows\SystemResources\Windows.UI.Shell\Images\RequestedDownloadsLargeCloudIcon.scale-400.png	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\unSelectedTab_rightCorner.gif	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.1_none_75cd350cc8b5dbcf\filesnodeicon.png	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.423_none_9de80b9d881a1ebd\badgeBreak.png	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_systemresource-wind..-ui-accountscontrol_31bf3856ad364e35_10.0.19041.1_none_8805ef3af31f4b8c\Exchange.Theme-Light_Scale-400.png	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Windows\SystemResources\Windows.UI.ShellCommon\Images\DefaultSystemNotification.contrast-white_scale-150.png	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.1266_none_777e4c5802d14c18\unifiedEnrollmentDiscoveryError.html	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.1_none_75cd350cc8b5dbcf\i_sort_up.png	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.423_none_9de80b9d881a1ebd\tabclose.png	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..in.assets.searchapp_31bf3856ad364e35_10.0.19041.1_none_501fda1ac26a3cf4\store.contrast-black.png	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk	d6074e163ab2938305579363b202499d_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d6074e163ab2938305579363b202499d_JaffaCakes118.exe

Modifies registry class 10 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\YPKPICSDDQDFBPQ\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\9e6T6YF2PiNP46m.exe,0"	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.crypted	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.crypted\ = "YPKPICSDDQDFBPQ"	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\YPKPICSDDQDFBPQ\DefaultIcon	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\YPKPICSDDQDFBPQ\shell	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\YPKPICSDDQDFBPQ\shell\open	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\YPKPICSDDQDFBPQ\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\9e6T6YF2PiNP46m.exe"	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\YPKPICSDDQDFBPQ	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\YPKPICSDDQDFBPQ\ = "CRYPTED!"	d6074e163ab2938305579363b202499d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\YPKPICSDDQDFBPQ\shell\open\command	d6074e163ab2938305579363b202499d_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\d6074e163ab2938305579363b202499d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d6074e163ab2938305579363b202499d_JaffaCakes118.exe"
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\aic_file_icons.png

Filesize
50KB

MD5
9e26a60e9204c30dbde6d8ec0b4055ab

SHA1
22a060ef72be7c4214634f249b71c7a349e0e020

SHA256
128c875ccf975ba078c2e149b57ac3491a86a4e0e5318212f0db8e27f2048b25

SHA512
e0a38f81327318e83addd08f115befd108f2dcbd32134faa4b9f5c9d2ba2fac7f0bd820718f14d7de0ec85ba11e4d57ddadfc370f128c8ac71376e99e373ba52

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions.png

Filesize
1KB

MD5
0b9faaa09aaef4c07a1b935f4770b4e2

SHA1
80d36ef6b4091ce780745dfbd888c3cceb557433

SHA256
e598887a9f887ff01e6b2d6119478cbb323e7e4ad079d8295929e944e9917c67

SHA512
1481867402db803e2bf6816a89ab3204a13f200437c482bc995194f7ed5bfee676c6c2fd4ee0d263c1aa08fe936f398d13ad79556d78e0bc006247e3669339a9

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions2x.png

Filesize
3KB

MD5
21a0c8957d8306e758fa1337bd106803

SHA1
0ccb8ec9c788f6125b41c0abe76d2b1b1b5dcc27

SHA256
32db3315ad6763200300716650056abbc298b03b49dddc34a8695cdb0ba94c17

SHA512
8d76f5b461d06b443800f25665654557d07c75e89c221a79fc6b6ea5a0ba97164f8dd5062195e963ddf01e8e6c3225ec988b29cc11fbd4d784afc128f2fed1a5

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons.png

Filesize
683B

MD5
c0a8e3aaae898117d8308f3457b84202

SHA1
c7452e639fbf96c31ad24f34ddc55438af138bef

SHA256
78341c907532618c67f2570c2735c28cdf9e3d6c4cfbcc72b1028856f73be840

SHA512
9cfb03aaca9344d7c43fffea975fda3395592a1945561de888c3b0e7b60b95a7716c833f25dc6070449d439f2095f12f5f118281563273e08f60b7540995ea1b

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons2x.png

Filesize
1KB

MD5
8d556085a2da4ede8e1cb19cc65d270b

SHA1
381ac5561a817bfbde79bc4543ccdd90c2e0c11c

SHA256
f29853ce313682d31ace45f54b235efa03743f49e84d2782c3e11e2415446662

SHA512
4f3b2f0540a17500d704fff20fe8a0bb581cedc36b075d2f432a79c1fe1e1736dccfc134cb98a6b459a41f8542a82907e30471e7242f12b5935db36676fd07d9

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon.png

Filesize
445B

MD5
434cf560b1e3ff65e374336e4d31ea01

SHA1
490a8ff10fed22ef38fefa2786200a921f176e27

SHA256
ad4846cc41946967c725c183bad6d23e80ece1dd4c3c11571c8cc832e3ff33fb

SHA512
2ed74ec9ad12ca2a7ac27831738bc1ecfb511aeccfb229e78ec6e3d684a0e9bd6e7012283e634057633972bc5798c79173dafb0d0098a64411186855584e8466

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_2x.png

Filesize
611B

MD5
ee402ad1133ded7880ed94f7fdf3f019

SHA1
46b4c56ebb3f2e73601b9e9f1a8831ebfbadf3a5

SHA256
6fbcb55afefe7b3f96fe03155f6b7c724319970c1896bfb65fd1cfad822ab667

SHA512
337190a2ffb7a19cb8672652912ae72c021649d0b5b842be13f474bc65bf9164fd6ed1ce2442051020e446ce41c0994550251440322871e874c530d31552a932

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover.png

Filesize
388B

MD5
793ace7006846349044432592d4acdb2

SHA1
2020c6cdfb5d4a9ca994e3516d461dfb4e1d9b9f

SHA256
a2029d5fba4012b46e94d5c7d1b769383e3b293c497a9471f7d47645d090bb37

SHA512
68981848e17dc926fe82860c949edcdaf27e276be3a68528689383bbc5a500a39632fd09f3691c1c6f8ba399ce1a81cdaf2f6dc84e2b854bb9e85cb00878448e

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover_2x.png

Filesize
552B

MD5
4bd1bfb9adbccfc412488bb08d6c9055

SHA1
8a3937ec56d21c3594140914c045a8ec111688e2

SHA256
fcee391ad0e7760bd6dcf157c9ae8416f1e4c6f2a51eef3d8790b87e658b3059

SHA512
07f71ff5cdd5fb5650cd869c72064a9b796e5b9f1880eda7203373ab45955c0fb3d0a793e8193ff084a846ab73fb37bad7995fb4c46ab28b0b7386dfb5387974

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon.png

Filesize
388B

MD5
8afd7c62f7a91d11827a00df8011f52e

SHA1
545db6cbe297d78b166c72c674026eca030bf763

SHA256
1201affe8fe1c46de3e5df3b31d508aa3065cf6aff87188822eb6074b4df96f8

SHA512
1063ba4fd179046c1feb455c997e7bca7817975cfb8162eaf3227942807c8caf4369ed9fbaac26b54cabd3cb458298f802239019a43f1bd5227bdd33aed0840e

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png

Filesize
552B

MD5
ac342c668ab112333d5905e46b80cf35

SHA1
d45364d6f3e05770287f844843c3b41b497d1d05

SHA256
3f282052bf9467eb7ed0d79072dc85c31eefd4ebbd0830b3ca20f307dddbef2c

SHA512
5882f1d393c31e350796e5f126487130e8275a482159db2887decddeb86015ae19e9e11ecbcefa6bd4b831ab9062b39982f33dcf66f769d5ed49cd34c509371b

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png

Filesize
388B

MD5
47ebd6e1673a45d062956e23f9a05614

SHA1
0bd325998cc6d523ee901d49aa622a747e15270d

SHA256
403476aa4d7f4c495a22ee517c4be5f2994d7a359e8569aa20a2dbd15bbe3477

SHA512
1f4d77e0b94d7fedfa63b0d4beba736700c43f9c3aa134cae21a801fc87feeabe1b6c62558265de31975f39995017772a1d9a779b3ef23261fcd795c6a063219

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover_2x.png

Filesize
552B

MD5
2e1d555b8601056125c739690b0f1280

SHA1
73518565f4e8352cfe8c3ab76d6cb06d6e2e7cc5

SHA256
943f52c8cf6f86e66b5507e3007ee5173fb640fc26669f5835b63264dbd3dfca

SHA512
9f42b16a48469477c692dd4e037c3ae38afb3abd0443008ff6b35a89c40e9c2ef3cda2f40ba8771fea46859514445987fdf8657ffe414cb18e801572918bdf3f

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons.png

Filesize
7KB

MD5
91f62155f488d4f773048a9a7d708de6

SHA1
ae33c694f37e59e0662556877b7a41e6e5fdb16e

SHA256
fd7eca75950cc9430dfedcd272675a3a55f0bea5a11f244c1632f5b53186eac3

SHA512
afb61f46779f7d056e0a89f50d2a846615c3a1429e57ce62f2684c48510067cc7ec3f8feef0a1092fdfb6b26d48b79e9f0abc1f1bb4af81723703471a570e114

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_ie8.gif

Filesize
7KB

MD5
26c74a3baec65a7058c3fa6f59ca509d

SHA1
0359db1228b6b8bd4116373f74379864c44ac9dd

SHA256
7a7345f2e5c30a1b60b5f796aefd62b08afcb454c0d9384d1e7da3fafd09d362

SHA512
75fc777ed5c9a9aa207ebf95cf2d351d4e33a54c312cde85bbdd180a2ff645cca9967654e720dc3f7387c22ded64ab6d2f00d495bd5a29591e0f4a0f13af2fbd

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_retina.png

Filesize
15KB

MD5
bc37395f1de3276481791de350188955

SHA1
e9f5f4a777265645174a90e005d10c7a2e9abd87

SHA256
317564c55e7a24e9783cf07d106c77145eedf89538814a717965b8d05aef8736

SHA512
47c6d6897763cd47c41d779e46f4a56e50cb898a9c08f313dd4b88ad6964646eb97ed551d6da18121cac8fa20f71a8ccb33438a8903e36b4ad03864ec1fad708

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons.png

Filesize
8KB

MD5
f714d8084046b362a4afb666cf74e730

SHA1
4c1c26ee796c1282fa8eff7b760b508c25a72187

SHA256
ebee1a835886e55da10590a38d648b1a63e8efd939d33b3a724c92f5e9ae751a

SHA512
8d4bed8490d8bd19cb195143af214c2225ef30bc5a4d6642544667b6e909a10082287aa796d08a221c3ccd0c4e5bb0be1cbb8b33a3f9e5e0cb946c0bd9b05d14

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons_retina.png

Filesize
17KB

MD5
f7cd2c05649b2e96763d7ead054593a3

SHA1
00abc47b104bcebc42270359dbb36726f06968fe

SHA256
ccac1d0ce33b93f4f7430c15d1c042791dcfe875e1b1b6a2e24b8dcdf0f99210

SHA512
9402039460410a36d562040bce0bc5fe1f1cdd7f67908b33420d0ff8fbb61be079ef6c518f845063d226f21030f04602964313eaaa216a44f6c226f6fbf49767

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_pattern_RHP.png

Filesize
179B

MD5
c110597d43d5fc1f60fc3fb699e74ea2

SHA1
e1c12bd59ec029171dbaadb65afbab313701bc36

SHA256
9510bc98c5884c3f8e59cb4f606da5463b2de02f746858231f300d5b493b1184

SHA512
1760626c84d1991fde94f00ad901c6d0e36db243c3f2978174ef079f01c3bb19e6ecd94b49b84274dfcf12c67a8fa9ee0d440e1b3f8b14c0ff0378865024e105

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_patterns_header.png

Filesize
703B

MD5
eb62b61c75ee041444cd309b2fc1524e

SHA1
c8a1a9af9deaab7fadc0bd45e91028a806cebc11

SHA256
4b117488f82d7323af2f20d883b51699c1e08b0cb6368133c76c6288ec4a2fd7

SHA512
b13db28cb11bf2eb72a5c465c0eb0beb6f9d6f8e28d473628248c2637b251a77ac00423b9ea3448c0f3ce024893331e9fdf9f389352882c6c204d6a9ae22c921

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations.png

Filesize
8KB

MD5
86ef4b6a96b0eaefa3fa30da8f58ec26

SHA1
0e3d6b6f1e32142e29e6fb965f1c2a02d16f2dbc

SHA256
d5e3e6f78114fb0e4dd50a3d3c9658202e52d51dd90111d3c98063a4ebfc6185

SHA512
0a3e8cd1d4eac1f63bcbeb1ea103fd415acdd80fbb655f8e8dc9320e69dc85a37754f9b46209654d43130fef181a9e73e873ae6c8c967ca2fb96abb3520afe28

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations_retina.png

Filesize
19KB

MD5
83b8c5bbf490462e03ca39bc18a49ee1

SHA1
a5cf3d0e447b324d2abcee7425af49bcb63202f0

SHA256
7e05515e89ed84941a4dbe1fa0df42566ff30e6b8996484d74cbfa7df516fe69

SHA512
9bc6054ca16a8e4969f124e03b98bdd47ce773f6bed82dd8d050e24528ec9880e00c2a01573de62596837882f609cb4dee880b500a935408932345e0c4bdfda7

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\faf_icons.png

Filesize
6KB

MD5
eaa95b85b3c1a6ebd9d3b086a9cee2ce

SHA1
041e5111a3773881984a5599ff73acdac45ef579

SHA256
918e5b8f176575528049f25ad2dbeff5a49870299e6003de36b60538c4da4ff5

SHA512
b2a202ed6fd7bc9b25025460321aea5354f70ca55b891b5f2ca2b7bbda153336f414ff8912ab05e8030a924d3e62a45813a255debdcca6f8d248d79b08344a7b

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\bun.png

Filesize
2KB

MD5
2e7955562590a1d4edc637163ec391f4

SHA1
4ce6530bfad899b9d660a5ea5033cb72c814c8e6

SHA256
6e246dbd0f1754d19d071395adfd31ca493cbf73217b8890a17b7d361ac15d09

SHA512
2a556ab00f354b69bbc142a94064b7edc7806559c8a4642bf949199794dc5c57e70094aca914acba0e6c5796ba0b9fda1c00efe1a277f70ce22d613d9b31b4b8

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview.png

Filesize
2KB

MD5
6282f04296cc89b03baab9009fad36cf

SHA1
e97d4e50f8f2082febcacbc5c94d4583e663f4b6

SHA256
3277db22c5ac858e4ac335b04c85d6c7e86400c8e8b8754c64dbeadccd0de712

SHA512
2fd1b46b7d2615952f466f8aa1378b2cda07c5ce7e1ba936fffe2ce0461ffdf29f1f01177d5029dcc55f6c17a184845f588826eddf73fa27827c7874b5f80f72

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview2x.png

Filesize
4KB

MD5
df5d89ee782b4e0c2d8bf389508d77fd

SHA1
5d5b0b4e7b7d79d2b1f50539b879096b15454247

SHA256
f3119d482db3d902a852e9bbd923471b1082d79e1146bd11c306d531addd39f9

SHA512
48a0bebed2a6b106651aecb65f9478186cbcc768b7a6a888220ba479f1799abfd77a98a6bc54b38f0fe79664b69e0165ffc5a19219e5ee591278c264c851b756

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small.png

Filesize
289B

MD5
b032eaf5bcb0e0abc9eb1c896b1bf502

SHA1
7e889b0c7f23b164ab43220835b3d5783c28ef59

SHA256
f2e051fddfb097a5cae72bb2f9ed14367621de5a55d5b66193646d6b7dd8f8f3

SHA512
51790130840026bb411c6cafb84ab138a1007a06bdb1b8eaa19ee805cd0ed596de5f2b122dacd79d5c4b5ff8a2e059a6642199cede81619febad1a15d068b6fb

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small2x.png

Filesize
385B

MD5
48bd68c6de228a46d0cdff100dc17ab5

SHA1
1f228d502252e4f02d39f50a75edcb0d257b9d4e

SHA256
536fbcb89738b3057e95fccc0ca05f55c6317a95394503785c3c67a1261e08f7

SHA512
53f6d07cfc6a510aec39ece4f0e6472a4e6cfee48a926213a0ef0ea236907c6a80980700241b374f22b9c88dec9b912349319da71f3f0a03849667ff70d6ff16

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\illustrations.png

Filesize
4KB

MD5
b8d31c102926ecdb4a4e2290f25e9167

SHA1
85062c2e2c309db2bce5ed5882e4a1448c3608cd

SHA256
d7c2838cacf7d277c6fab7d18df7cca480954000caaa0e8f414991c71640bc2c

SHA512
88eb58de9500ce9942b2c7eef466e9be70f0d01c0db9440ed6fb9583d89e6046637dbf5768a936349e0de188aa9f78d67f85c6bdbb1eea1b8e3012390fc365c8

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\nub.png.crypted

Filesize
1003B

MD5
34dbf21aa25db8e0b5162f0dc964737a

SHA1
92b4af5dc4f9a7910d141cfcd9e98f8090c61fea

SHA256
77d318b17fe63299f92ff8361d057510484f4b993e5cf21f4296326c1a3ee354

SHA512
1e447aa73bbc17ab052d516208fe5a735a736becb1c8de9b720388d147842dd1d79d25332fccd5ac81cb3cc1a131522c174effa2eddd33c20d2b26a75aabb2ee

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons.png

Filesize
1KB

MD5
8f414b4ce8ae43f8dceff29b5bc5cc36

SHA1
d22db04a7b72116fcc0d5557dd2f2a7fb8ed69e7

SHA256
9c40d71900669365e955b2e0b7c65e32df5277178660d2104800b8e5152244f5

SHA512
78a6ae1c5cdbba6bebd7d5280452cad69fcf57fd36d52db615736e3d42ce7040aa5e93aa24a904da25a651fcfa87e9d5bb0bfe1f07b59ad1ecec771a6fcbcc15

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons2x.png

Filesize
2KB

MD5
9cbf4ac575e23e41c987d22f7b11b192

SHA1
9ca311a7483a1eb26f8ec766953d77f019ef8c29

SHA256
3f9d18e2d0236a3c36dd0afcf347e9bdaf0cbd194ab580f3e6fc26d1e119d45b

SHA512
05076dd7ac78f4fcf00c92511fc82eeaf82c4c531c285dfc7127b10a422215d4c615cae205a437bda18f9d4173df5289b4220924e12770d58eae33072979e987

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adc_logo.png

Filesize
3KB

MD5
15e43a24042b49610ef81664b0489d23

SHA1
b63771ac20ea8519c4367bbc29ce0895526078dc

SHA256
1ff8ebc48333b0454f4e69544dbfb02c4326d5be3491a2200e324e87f1034aaf

SHA512
48c6d499fbde20bab964fa471b20ada3eb00a1068e7bb0358c8de9696697faae57333492c9f2ae59eaf1a1023d70fd8ab84a74f3c2a120a2136e833b594b5bcd

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adobe_spinner.gif

Filesize
556B

MD5
e500215e4805912f0ae861905b42dac3

SHA1
f6ed92ed357c4168322ae6a46f8567d00c089141

SHA256
cc84a2ccbb981cc6d9034f7b8ee665362f616aad1bb37c615c4f793ca404390a

SHA512
a7ff533ca650401b2fb95ba41fb994268c2ea033f0adbb9d62092c7083ac58b163f3acc544ca2489e7b74f8ba561fe6b320442f852364c6fa7820133036fcf4c

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\logo_retina.png

Filesize
6KB

MD5
e50d4e0578bce7d4a7d01d78dc50f7e0

SHA1
782cb407a015689901490db6b031e4703b101b6b

SHA256
62960cc966b84878adc7c759cd5b5fefa0f6bba2ad3253b00f99253bf945b6ce

SHA512
cfd918568e205ed0af6cf578ae4468870602ec1d5f52a589cf1ea00cb4187dd13acf8fe94d3518cd9ae761e97980756a4e8e97eb53d7bf4f167534a0204e9dd4

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo.png

Filesize
826B

MD5
02c6471641b50f9fb02edbe491c0b034

SHA1
3bf5731f4e31291e41f8c303e1467952312ed4ab

SHA256
eceeb6c1a805f7a2a9c64026dc501b27978004b945763c28c4ba327facb7a51d

SHA512
b65898b773665eb88aed75734b797a12ece2e8f21f48dbe55f2d737af82b85936e931c8d2fa74ea953ee96f648646079e245b51b72483f34729928d2e43b6e0c

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo_2x.png

Filesize
1KB

MD5
f479b18542547f44e69a172540a75131

SHA1
4a76e9b4f2058c839ff9b37f04ad3582851e4ff8

SHA256
6a82149ea6a346086d19617ed9388387498dacfe71d09b45fa98a29e937a2bdb

SHA512
0f6b8f506c4dfcb2572f95036d7fd31a9182cf0b51150d63d7e130c3ecae1a2b4e52ec216d48215f9ccc2203138f1ea0730c4de4c1aa0dc478a6d477574b921d

Download Submit
C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB_EURO.txt

Filesize
32KB

MD5
c551aa4fdba4e81a2a50d49c1afa7440

SHA1
25833eb1ce1387deff07dc04aac1d29e53dab31e

SHA256
7b65655fa233f0f9d213d401e8805409abc15d3cca8d4dd9eec7d95fa1e6194c

SHA512
a709a1d666297ec71630fe8146fa6eb6fa68dd599fa7e0d94a42bfa71cd43515fea562f5702bc5bea6e8d9bda239472aa601a313dd74fdc2949b5761029c5864

Download Submit
C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif

Filesize
153B

MD5
548d07f91519739ff3cf3c67dd57c2c0

SHA1
c0846fb632806f93f3f1c1c0ea4bd259ccd31c69

SHA256
53e267f53ec8d5a24310077d23d9002724c2316c92c70bf012bf96803b3c15d7

SHA512
80486d32ad36447c4447d48544ca1e00a777fad9d949576fc571b47dd7b1488406e303df2c5b11302b51ea2d3417dfadd46f9b6fba29d4e9de148fbad727c7d2

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt

Filesize
190B

MD5
3f744d4b34ca511e28b0560f8be3dc77

SHA1
7f72d9c40ffd94547cd90f66a5d4f27ee03ff2ad

SHA256
89e99b3642a7404df4c80f4ebcc6089efa857f23633933b621e8e4fb8f4c62e5

SHA512
609bbe3321cfc6640ce15332bbcddb6847b60ef1456ae993ab3b3ca2ebd096c3d0fd9ade633ea1851ce32b5ae8f11436cd0758f50691e0bb9be41a2cde4546ea

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt

Filesize
190B

MD5
221cc86cfb8b99d52c3349a29a70e053

SHA1
d9e9f0f35d3c9067c691ae4c5f0543756dba4d23

SHA256
a290c19a1f685b865cea12849e73dbbb14429eaf8dc04f6d0c6ae759fcc31c4d

SHA512
2a6663df30e28bffb693809c46a692d103c8b8b8951573c208e49010289f779258858eb9cc9d71a4d8d9c01eceac89b94981ddf870b9b823ce11ad25fe8fb0fc

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md

Filesize
1KB

MD5
0a975e59908941c496035185c1d47a54

SHA1
5ff7c45e066ebf4866fe91fc8978f0d6269a04ef

SHA256
63c411223b7893a7385073c8124d57b07c35e55e8ff3f4a29c62ee0c027a83c4

SHA512
fc8597d22a7383ce33788f22430b7b835f1fcfe341fb415218d637992ee9afc600b97b6c293f8194be340eb3156efbdbbbff3ecb1cbd23a7e3dc6f9bf4fc3c85

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\glib.md

Filesize
31KB

MD5
41bf4a733dd9e89c1bd8134c0214a428

SHA1
78f91d0a1652f934e9df23adc868691b1d321ef1

SHA256
7eeb9e0cae9507631cbd4b26b95f402a134c9841ed244dad6e169650d1683cd9

SHA512
dafd4b0a8a4a0716a5b44c35745df658a8f26f7b6751f888470b2566ab6743e099512d782a60db7c4e1e96dba95f49149570af5495b058b7365de18955c36146

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md

Filesize
34KB

MD5
4a1d5479605065e7fd9197bac3a6202a

SHA1
87e44941b7689146baf2e5f6be2b9b427b5f673f

SHA256
6a9f8e349e092bd5146adbbac72d8577fd8b6f5adffc9c67ff90ad75579883ba

SHA512
31c3164d563cd547c7696a9bf2cbbb72008be97268590367c5caa8dc9381d37f747c2625a93465e0f97f92904b95f55edb4d0f7c88e79449ddd850e5b2987dd7

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md

Filesize
23KB

MD5
e47a181aad70aff04c46f9bc4f26181a

SHA1
b26bf67bf4b7fcbedf527de23d469745584f82f7

SHA256
2291dd7fd311c7700e562f2af941094a3592552fca5954ec611e4531eab512ab

SHA512
13887ac5a2a1c2f3fba09eef122546de2ebaf58299dc74534593c5a5d395ddf5079bb59e6cddc5b0b1e1695d43ffa97c40d94b24b2960b064719359c37ea1216

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md.crypted

Filesize
2KB

MD5
dda189647a166373db80c666a0eb82a8

SHA1
e7446656146a6c3965350cc3dfac918f221ce6de

SHA256
fdf1ffd3a499b583658aabc6a0e4b8999d0b001d239297b33e9880788471c1b6

SHA512
d4d8065dc7b083ebd7d5e2ed168ec9a7bd71338729bdb0829ca41de35737e1be6be33ec0c49245e3199a7b7cfd87b7492e14c854c860ffacc171073ca3646c81

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md

Filesize
1KB

MD5
66916e982173fb2f085a9b3d821d5a31

SHA1
9aa4d587e869946dbb5cfc28a71bdffee7e4d0e7

SHA256
3908c23f5e603136264b3d54882120d963a8122d93aee49110acf836f895a3c5

SHA512
ba0630cb682752717bab113d7cbec9358731b965f7757711e3824f39e839eb1733330d6d23c8c3b76c5ee3487fce21f49301039e6653c6a4c89602cb2768f754

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md

Filesize
3KB

MD5
35a59d345cc1143050154d7241e20886

SHA1
0c0fb15fc3346948019cd4704c7a955e2fcd78c8

SHA256
ee4987f71fbc7a16c0ae9f4b202383475e7630510ed1dc1143d073fceb963269

SHA512
361887d12adf67ab06830d63dcf203cb70b09bb1cbea7def0039223bef14378138c9b7ea1a6805255f8426586757253a069ebff9ed5fbd352cff8ee7dc7a0440

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md

Filesize
2KB

MD5
89efd69835d4edd5736a392b850a9401

SHA1
89c5e84fecd5a40ce00e39a2a45502af1ccceb71

SHA256
976466c70b41253e9ce6bb74a3f4373df2032dcccde4f13ec77a031cc10e8cf9

SHA512
ac449be1447506f6611b3a4abb37a0ed11bdd68f10e9bf2415909d3e379ebd3abd103e3516672b14885527bc5f8f87b2afa5cb76b42540384f67117c77bc31ce

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md

Filesize
5KB

MD5
fa087609416c88d9b35d05b3cb4505d1

SHA1
cd469349a8cabb8e07e134aacce0cc932144a178

SHA256
14bfa156f54d438ac682112071bd7f19d8769e28f6899bc9b1ea9f6b4c3ca3b9

SHA512
0029c0ec84d24da05f01f246a41aa39dc613611db18e6bcb1dbbfd945119206712be7dd2397f2e5c7ff730eca1b1debb44363a325dcd98d646c0c39d597b03c8

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\public_suffix.md

Filesize
17KB

MD5
eeedffcca03be7aa89970454e07336f6

SHA1
2a362005441475dec4f2de7c6bb8251fd9cbda0d

SHA256
724dd85a216a681de588a3fdf56eb346d4af53ed98122840785c8569f2a7fd9e

SHA512
8ed2e979524d6e24e307bb2809ce935525d18a4dbf5935af19c8b3ba450fcd2631d2d64c9de06c2b73137731f177903aea3a61bf3a1b4669198d1889512d1b08

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md

Filesize
320KB

MD5
8a2e7335f6ad817daab90f120acac7a1

SHA1
71e1e57612a89d849887b626b5c8661d18c1e91d

SHA256
d6ebe4f9ebd76fd231edab4b0af21fcf30560fc8016c7e958b89541ec42894c6

SHA512
650d50356c591e7544dcfac189ce76a172a00ae23f709905ed7171d997951f216dd9ed88a7bdef1d00770671416b2c5dda70cce2757b1bee29c13069e4d6ac30

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\asm.md

Filesize
1KB

MD5
837a72488dcca5c9f657bf177f328500

SHA1
9bafdc50e9a93ca086efd786574d1ba76d7a25df

SHA256
c897fda76ecf8bef9f33f08a70fa0d50ebbb6116693867f40589bea61d531fb4

SHA512
7dd3b280af7aad850e4b90bb80877dd112ecf1f8ec098ee127d8703e2e2a03e72fbb3830ab8a255c23430d802f5f2f6574665d3b03a1e7ff95100edeed018716

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md

Filesize
10KB

MD5
f9b23c7948bb898fd64e3378d24653f2

SHA1
9ce409e730617d2246059c8a9451187014bd871c

SHA256
aa5fd055be27325ff77a42e8871f2c3ef885ed3f3b3cadb1779c55a386131eb8

SHA512
c7f429f4ec8c7720ebb5f803bc4ea2821928fbb6ec15ac2af2d64e94fefe466727586cd79964441ea89d5beafb14cb947b66ee15e63a3300adadecf43ac48e52

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md

Filesize
3KB

MD5
2310e3a3572fde6036d8664e5065b2f5

SHA1
8a957cbe5db01bfe99cc7b4784946be11e276420

SHA256
5361ebd3032b44dc30247cb9cdbb952148cb60d702b08236b25cf566dc53769a

SHA512
3c91799c331fad603034e6225ccfb1103bd3f756e4b89f8f446779e882a6f83e0834c3376b61d0cd4f4c262372e54b2ffe84836468ac6aef3300b0c699c4bde2

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md

Filesize
162B

MD5
b31cc21f9be79586e2c30ceeebebcbe3

SHA1
53af6789e6732a4fe494178f12005dacd8f41f36

SHA256
dc8f2d4a7aec54e5701368956a665215bfd3a04a5a3a3360e4e8162c4af6fe95

SHA512
4756a06a2f045afff36726694aee0d96b13d8d55c34dbe8ddd28193c78b8f10950e9a64377951d28bfe45049c30cd1dd674d62427ce22e351685caa561ba4a80

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md

Filesize
1KB

MD5
3ee68a9fd61fd856ce9d371b3abc5b89

SHA1
d601c300110443576100920398dbc4a239f852b4

SHA256
a2ab576fc23c8c9816134a21d6ed45e0a0814b5d28fb21fb1bea851ec6bb41dc

SHA512
41420d5b9d8d53f711f77df10875dcd3c7604e5bb56a413c9772fc5b0932c3cc46ea787102120266265fd9e54f4a4a9397a4b598b1a8293b3c48f5030218fdc2

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\dom.md

Filesize
3KB

MD5
c10667f7d45ac8eb3191e061ecc3123f

SHA1
315fac269c55fa1711abbc826308130e2d52df1b

SHA256
52473a448b9bacc672ff86cadee612d762b356fa3a81aab53f17a34f63fc6346

SHA512
2b6f1ebea07daf8d4adea32c92b397a1067bc4933cbb5fb832443ec78e690213f71c4caa15e4753f3063682716718240650237e65fd6427033115980ca97289d

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md

Filesize
1KB

MD5
0b52c583e18ce10a467eebb740bc33b7

SHA1
eb4a549b9b981c56fd9448b8981a9064f5f21f50

SHA256
c1b2bfc7de9a5627fd271d6904ecb139f5d4256798d16dc7177364e873bf50b9

SHA512
0cd5d5333b79be596902463ae204b163d9535cab810ff3a39bd5856ee3e1d57a6b635a147e3163d7cadd0713a121e31f0878186bc6a6a094985d23118421279b

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md

Filesize
28KB

MD5
69399c38732b68ffc84ccdb18b275557

SHA1
fc7ced6e14aced2c78bae53a4770ebb2cfc4498e

SHA256
13ae41522a730787dab20c49ca7945e107c058c8d2c289faeb1a79539a1364bf

SHA512
d92ea85238a1b22018a5a5519bdb6fd7af856633d9f1138998c2be5892e1fa4c19eebf6f7e0d721dccbc2b133f8e5a6d0941c29333217da158411a31d239ee8c

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md

Filesize
2KB

MD5
5e08ba886a192cc3f49d7fb18ea9066d

SHA1
911f4e06381b3b4e1c7ca8f7d118f442ecf791c5

SHA256
59be736dcc3946597ce2f6f6eec5b15a4ce3b9fa357bf56f696ff112ec8fd964

SHA512
4ed052c592718808f5d50c29f0ea016742868e9cebd7667eee4c049a03aa0d9a89305661c8d46b9b246af8dcacbbbe92f92b1aee237423d576b336495e3c9bdf

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md

Filesize
1KB

MD5
1a1b8efe5bf37f9bfa84c3e480bd054e

SHA1
92a595d5673dfad8d5f30745ed7eeafacbdcd664

SHA256
502aa4808e4b917dce68a8de9e0e72001f0085fce5f6d3de9f2b48b7b0f34740

SHA512
299be9f6918ff597abd25c8b8b114750ea2ef5d6059af53101cf1862fd16126a76c043b9f649c761a72eb54f21155b48591236385d1e3a7c86cfc99a927ab69e

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\icu.md

Filesize
2KB

MD5
b600df5dcacd2f7c44575a53c76bd6d1

SHA1
3658972967af80c28c61d30f84e70a954d27a425

SHA256
e3378622ae65081c9ba6eacda0eeac34830750c21d9f71faa90ac86287387c14

SHA512
911699f77f313ecd9ae65be6a188e19130e4934ec4a77f479b9a155982a054e67e139619787760006451c2636a1c930c64401448cfbf0c68d59a7dd819e80520

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md

Filesize
1KB

MD5
c14e825161dd17cbae79e366b62acdc5

SHA1
870d4acf478c5dc395f7a476cda198b97b8d149d

SHA256
7cbd1695344e44130c8fcd5b650abbeb051c9f17bf2c580b81d5c019125be83f

SHA512
9a20feae9e4a6387933b22fc1e72a523a9980b8a0fb8354fc30b34e92580d240823dee4243d4daa135a7c0278f181a2faa5b5bd9eeed7ba496a19239aea54dcb

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\joni.md

Filesize
1KB

MD5
a373bf630dccdc6ece41aaa3834f62f7

SHA1
fde87857af217560c24bc88db380b3bed190d6fb

SHA256
2d8d281bba406eab530c93c55edb388deaf063f7f6d6ebadaa1860f0e2508f02

SHA512
21fb285fd2bf26e1c310855975800671d76300d69bdce66163d5b44ea0f33c3f6d89c4104273c1c1afafdf154379f1ef3da4ff82dec4485ee26ef9cf97c6f5d8

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md

Filesize
1KB

MD5
01cde8cac68cca9418d0ffd602469757

SHA1
d908613e778e5573dda942a046d0e07d5cd7ae5b

SHA256
100af9be1023c8f290eee35cc6ab9e55da2ee64095e2c6d20c2b30b19fb722f5

SHA512
941ff6ac18c7c0fd297fbe7e6ae8ebfa9c6d3515867f70751b74add65993d20f7cabf8529bed8bd50fe665866a0e7de6fd715b082f6f56d29616a42f8827b0b1

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md

Filesize
3KB

MD5
1d9f68e0912efea4d152e8f1afadae57

SHA1
b15e0ed87fcd2ae47f82736325223fe010288f5e

SHA256
1f331be862c3a8aeb7ba6fd532fe7c39f8e03a5a55c4030afd3567b6f11bc89c

SHA512
b666236e3256d2996c9df32bee7510c2fa6c2b9b36b9949b67a42daa727e503bb3c885264e56748c390e44abc38a55b10d05811978aa6dc87d13928cc32a5af0

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md

Filesize
2KB

MD5
adf42fe7ad05fca11b33c1e27fd3e705

SHA1
73edfda9782d0d96d55be4d448f4fa85bdce2c6d

SHA256
700bd024ae829eea369ae1ac855457ac704b2b8bbddb6f2bc51b2e218d465f32

SHA512
4f4708db3bde796024e63be3da290db5cffde9ada13cc8e9a38f13cb3f6c7fa500340dffc8ed952706ffad01c29a6a9033baecc0b9404f516b89463a8d8291bd

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\libpng.md

Filesize
6KB

MD5
86a5657dbcf5e06a7ca0cf03f67f254c

SHA1
ec86af69ccf255377700c80bdf0403adee047d30

SHA256
4885311276b86c44f78a3c1def52e73816dbd02fa17356b12918178b6e1f8bd2

SHA512
e64b9bc67c3eb81b0f7bb8f2bdfd7e1243aa5efc9d4f4c2d03f9bcb1d5e3c2bde67dbf83eeda7229e8d276653a88a1350090439157945dc2d5d4e8082c0fd998

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md

Filesize
5KB

MD5
6773103979f345bec2a007944694b28c

SHA1
48e82df5e9eb27e0954604e6a1a3a5f55b1e3bb4

SHA256
2fac7222d25721244b1e776fe717a56ca7f3c89bb99138cd46a62a31d04ba44f

SHA512
0d6361e980cf4d411916d7a33b63af2e38ecc8a3be2e2671aef012f89c5c5856a40f9205ae9871f6eaff79d15eb8d3354eddb284fa2acc0bf5870922b55cd231

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md

Filesize
3KB

MD5
5ee5fa9734f504325e5b4ea31049f928

SHA1
ab6d4e0bc400d5ece515524dd9d7236cabe7fef0

SHA256
027bfc84cb34f25ebecd8146cd1ae09e55ac4884800f06bb82d26c1c87f947c8

SHA512
f2f8eaa2c1a1c9b84865041a772f336417da4ae4a2cfdae890a9ff38d28c9c426a66cb75f34ee8a596c761e496dee8f3e8436911401e973902ba588aeb9bc384

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md

Filesize
2KB

MD5
a1c8e5253d98310c701c016c55477d96

SHA1
287eb92dc90dcffdc857cb0c4c09e48c5e98a8d4

SHA256
a5f55ede28e734443c6ba5d1de703f105b9b4ee203b987144feb9a24de883490

SHA512
29dfc9224ea8aa40c5c41579dcba2295639298b19496fbaf553dc8c2c1b66acf38b11b985cab6fe95e41d415a17686ba0ae23771f9ad451b9c5ff5ae401d8f03

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md

Filesize
2KB

MD5
72de39ba201dd1ff11369ef17e28dd5d

SHA1
ae5e849d1daaaa7674332d8c902bc57977631e76

SHA256
d1ea9d45215ab6f95296f7bec5ede887ef07393accf5236d70c27ddc3cabce7c

SHA512
ca92aa7970d783ee1bc3f386950656ae9277ba4acd920f803335657eefcd0fdba2ae676357f6b6294ec5d6c4065accc973237631b547948661671d39b2605634

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md

Filesize
1KB

MD5
e6be516d922fda90f0bd25c48d48d651

SHA1
3e31fafc0e49dc11391cb3150761951ad6a027fc

SHA256
671e1524d3c74ab7ef024a97e70e71eaf801efa1177d7529af7db3fa2f8f384a

SHA512
40a50590d644a0a79a45b0a27b8a6018ed17b32910bf726f5eb08f326c47321e514defdfc724d19af289887dc6b9444ba3f10f2a4285dbd6004d1d05bcb762b5

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md

Filesize
1KB

MD5
aaa20d8a8f1b8c559237a8b095451529

SHA1
44142ed21f0c25e622fbc83f9b72e2cdb3f79b8b

SHA256
d7da768a1abaeea947a82ce39e818bbdefd663a20b9f3925701a52a64b08c726

SHA512
438fee454573de17508d135e854dd55ce18b4de4b1e46f4609588eeb3b86569f89ebf4071f6ef01dbba6f6098a64d043e59078a5991c4b9b29e55e5f6d21387c

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md

Filesize
11KB

MD5
6915ebd95aae578b88cb412fae2e8888

SHA1
c9fe42057106856e76a4468c6b646ffe3e27ec0a

SHA256
6ae1b5b7cf961c95e136c8b9b992ee8010f7fe64a93662fec698796ffda8abfb

SHA512
c6f85e20eb4b2303078761c21452523059510286aef9641d7338f5ef34c31f5624c275442307316b0ba8631bd2069db0017cc1a90330493276259f8ff91a9da5

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md

Filesize
1KB

MD5
4692d89d942471d67bb23e9306198066

SHA1
1dd0057037e12463bbc2a20e5e12a33a2145a4be

SHA256
3e96ce3d03c869471f3edb7faa0c9e6c057193fb66f87aa427055e42c926af2d

SHA512
aae289a243652ab0f85071406a975f5188c73ba927c6167f0b9146bc0935895cdbcf263bfc3dc20098ae719f64d0f612328e67be04d85ef31b026a8f17000cf4

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md

Filesize
2KB

MD5
8a0e846e684ea1f6e5daca7f4ad16e62

SHA1
968487f82a412f1205738d57fa690afd946a588a

SHA256
ead76343567e8b9a52dc3d66abf946e9e7f76fe1e904b0825c97e6fd691f031c

SHA512
bac3972f447aef79362fd94fd0e0345d94c44408a14cc2544e53df1ed08160db1645f03c6e770c92fca329f2cc95b6279464d8362de511a534e40c0d30baea8c

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md

Filesize
11KB

MD5
2e70dbd79d95c1a703a6c97d766a8298

SHA1
69b4305a46413bc94983f47eba308fe0bdffa3dc

SHA256
ffd881fcea5bbfffa5117553a7554d65c72f5975017debd66d768a5a399c568a

SHA512
449993ae18e611522afd3b1605622da3169a4f8321663ac1ea6f5020b486fc10a9205dd4c79765abc8c09d465b8f5ac7897e5ae8fc581a74d9e59239d51b936e

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md

Filesize
11KB

MD5
c528fa998592dc9e8dc03841150c83ca

SHA1
6b7e16cf7d114b4e698f72e8a3366f1251b3dc2f

SHA256
7f61cfc332ffe3ad4712ac729c9d0e13feda9a605472ad14a08b86f58d7781e3

SHA512
561c4ca90322e029e9e8cb63df3935e76c59c82f72377acc2127a24d9b9c2af493dd4aaafca3509be3b5b7ee91f159f509880d5ece361c931646bb686bc9843c

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md

Filesize
11KB

MD5
35e36123e2f2f2f4055d43cabaae109a

SHA1
aeccc304c061675e3f41d6b43289b6b726f2a473

SHA256
068b18dda881921f6fb964450c52cecddfdf412f053aedbf792da0f3b930550a

SHA512
541a324781dbc1ae4c1a8684fc327d75b4186cc21c49d58d7a5076f1b9e5d55fddf742595fa304bbfaa327ae7e4bd33c778cb785496eecebbbe929d6cb01c881

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md

Filesize
1011B

MD5
602ab4ab37b51dce29ebe34a8ece05d5

SHA1
fd288e6cca29874a3d18e825103db2e992fa7d32

SHA256
ba716da9aa487d3db35f018735b730cdf485287fbf2c918c62d12068b337726c

SHA512
a6f978c97e0c9d8932ca898b59d82904ef1095591a2dd649e3f96c19ceb6af4308fa32cdc9369e5572708ee239e36584d90cc7a9f1488a37aee3494c5edf17aa

Download Submit
C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt

Filesize
42B

MD5
e61a90532a0eed76e42da52444fa34ee

SHA1
91527388d6875769c577bfb2c9c147a8229465eb

SHA256
8d54274cfc4ba0f61f13b438a135677710872b22a9f76a46b3bfe019bd365f8c

SHA512
1a67ee54b01d9aa6050978753b6dd5f81c064e21a60dea3a2c0d52fa4b07b132a7476492adb51f8f2467831afdc1fb3f9bfe32ac2efed3a12de2a588ffddfed3

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727656226049089.txt

Filesize
77KB

MD5
d2dfe2cb0fcea7c9ea741c5b361f1024

SHA1
c782f8a1f47cb47130c85168110049f4603cd9e4

SHA256
152042b1964a7fa73f9eb3249732eb2aa0f1cf62d2cc9a10eca44ff91f5dc619

SHA512
8561b88c2dbb36ff242d1c679c64dc3da64393ba8db7011f185b100b73f1ae580fba21e6824f41994843090257188fd7bb833953be48a47ba728b2cc84e1940d

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727656623420834.txt

Filesize
47KB

MD5
8820276da4dc9c7f8278e6c0a150427c

SHA1
5adbf85e9d6cffdb043fadb758ec40eaa362947a

SHA256
15920487315326f8b64e4288a26181b5ceade3657c10cab82131960bfda8974e

SHA512
8f8663ee6b444386f2bfcee947e5681a1e192558ffa171f3f789f55f1f22a92044866ea1b7295093c98ddef8cfcfeb5a7231593b3aacc1d452e3b57b574b9af9

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727663536793873.txt

Filesize
63KB

MD5
3c09be2f4571da355578bbec86f385a6

SHA1
207253ef9944bf944132a7c524ab2cb600c549e8

SHA256
ac6ee96cf1730292b687f150e17c82c6c00e574bc4d5dbc5fe8844b6dd07ced3

SHA512
bf5e0056e71de05b4d77b215ce4bf2df07d75057276cc5397bc0d60fcdebf97651e59fadd12453ca34848747fa47e64f0e7724c5c676f800d2a629fb7de19fca

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727666235612999.txt

Filesize
74KB

MD5
ab7aea97fa1b44129da457dc5aa47fa2

SHA1
9c07f129d4689b2174bbbda41106b75c042439c4

SHA256
9df353a833d08621a955b8552e8bcfdb8dd235eea1a3120126965615fc9ef50d

SHA512
10dcf91fd084640f34b6722efd9dc2bc81f0aef1fdb8f5758471a89f29c10ce53166aacc7650aaf480d6e27bae98ed6fdc2ae9f98f0112b84ac82b4d15b9dadf

Download Submit
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\File Explorer.lnk

Filesize
407B

MD5
6bc05b788959d10044152e1f3c9ad704

SHA1
ecfc404079683085d9da1ab29a5d2f671be477e8

SHA256
2b62fc6776e1b3803beacd56c35a62e6c3a5ebf181a9b2b4ac328b47d39e4ef0

SHA512
a8bf9fefb1d4a0c8b6084a78ef81fe92349cb6c9d25dafb1460ff9a0c1286db7393719d0762475e6fdd84670ed10c58f1324c7c625467335ded4ca62928e0a23

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg

Filesize
21KB

MD5
a28306ba4e3f74f736fd79e7a8db08c0

SHA1
1644dd4bb464e440393494ac4eecbe1f4b1e0564

SHA256
629fe7af73a76d68b2734a3c14b9861a0568907dbf9c521f3d02830c60b011be

SHA512
33740d7bee9940e6ab2dbe5a58facb281dbb18f0515cd588c382cb1b23bcc98ed526aaa48ea79fb105a390813742b592e8255cbeed555dbd1d3e95d4dd2c6cc7

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\HelpIcon_solid.gif

Filesize
1KB

MD5
cf12675f50d724353846363ac965d8f6

SHA1
bc1f37ea81ddc995ece2e47eb28dff6707a4d4e9

SHA256
ab09a97815949e4c52944deec82f52cf06fe1410444d8178ac6bffb5b9bcee8d

SHA512
1442e6331be0083483f1306191a601e17b8cd9ae48ec097b158defcc05dc98d24f3400e1e96ecc042c374f11c2c80672c9e88df79083191aaacc3fb76572a09d

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\alert_lrg.gif

Filesize
952B

MD5
6d6aacf0c45d5606dbece38a9464aa48

SHA1
4d6e4c23eb82e681998242f57219526e211330ad

SHA256
ffe15a9a01d7469a394e174c9848924c732c2fda57382f565ee1df9eb110f8ab

SHA512
427dad1c8df6aa44ecac360e01ce2c72b4f34af583d09a7cdf5b005551fa0beeb94a7ac882fe077c2d4b90e8cf1bb39ef5f76e4a69336008a04ccc62995fc04f

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\aspx_file.gif

Filesize
121B

MD5
52d504e47abdf0b0d0ba72640227b5f2

SHA1
31cb3f623ca44e4561e3caf480b67e87066d0faa

SHA256
8b59358ab208f9f0268d24fd94d29d83e360036033795e65aea5ed348b3abe16

SHA512
bce5d6b636075dbfdbb26677795295a4a2fcb81a93bf5421b726ff187eed28bbb03651d1340d0e2024985d73651ec5e231f574b3ad930b31fdf3e1ed472c7475

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\branding_Full2.gif

Filesize
1KB

MD5
9de492c294892052e542c3e01361585a

SHA1
1edd2f761acd55976c816ffa085d114dd0257fb2

SHA256
6ab9c67fa623aeb9bb4aa4f0f410816945087ca09dee016fdc81e8051fdbefb3

SHA512
acec55ec9883426edec90921bd0384551892d99d8d444c2b95ae0e1cae6f77d8f626b6a235ab5f81263d421f319e1a06e1b521629b1a06bc9e4d567e0c501658

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg

Filesize
8KB

MD5
1b6f96986d788823530d4e061f82b194

SHA1
0b86f0391c0a8ca3c375b3d53a0b3a6ae0fcb36c

SHA256
de26a2d7f9e08fd57d394cbb91397445c5bbd2e6b2c4a55e7cff15d841b527a7

SHA512
3fd4d6faedac2126c9a4c749bc511ecb2361fc842b2fd3963dbe5a720734a370cbc705ca2988e9c289b1c3aeb22e06400a503e05920b9d7b5b5641737a27ffa8

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\deselectedTab_1x1.gif

Filesize
61B

MD5
8551280aee5ba468ba8a2a25fca9b0bd

SHA1
a380a1cccaf7dbfbc6476c7cff75bb333ba62553

SHA256
23deb6535b16d9a94f0258085a3de54f53015316b033dffe731e47e75f0b2235

SHA512
146b1def16baa963a3750ba31e4d114d2a00b81ba1c8d43274f21e84035affb9a72e5bcd94cbfbcccbef216acd68b11fa3c08f78490f8d0743daeeaf7d83afca

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\folder.gif

Filesize
914B

MD5
69f3a274d68acae95123d74849e7ffe1

SHA1
f207ab35dd5baaeb50e237103a36036a73c746dd

SHA256
f43661039a169f42d190b795c204119dc745a783f54f030b1bd6c9afe85f7d50

SHA512
94556d63ae6281f100e4915fc2018d884b9e7d308e8bbe3afa9af139337a643fcaf30ae42e7f8473d890c12bc9a1057a4db624546aa4269fd16f1ae3dffd7bb7

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\gradient_onBlue.gif

Filesize
90B

MD5
c7523e44e18902a9bba92e7177e87a8d

SHA1
2e6915c9eeeb2a1f73d5056b19d76b161ec31ad6

SHA256
ea34819f0f99d42a6852bc575a45128f6b07e173389483b01a8b486fb8a1058d

SHA512
748bf55273abdd6d77d1e0cdf334f3f2fdccbc511f43951eafd2a4fc29652b06044e54113e7a41197b937d8c06b5b19a322dad155c7483378cb32f333ba545ff

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\gradient_onWhite.gif

Filesize
90B

MD5
b9209f415a8a2e168a58092d48d34ef4

SHA1
1389c610dd59ee317655d2d8db74fb42131149ba

SHA256
de1d15d7f39fe09c8e8af567cb0ed1237b9a99efa44c892685a93550d215d20e

SHA512
404dc07904103a5e8bebca0c4f1a8aa1add2430d6c0c33b585fde59e79a07b89124b3351958875e0921fc6f2ca000ebbef0cd8f34fc2d770c9001bc1e7037f0c

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\headerGRADIENT_Tall.gif

Filesize
328B

MD5
fe1513bbae26c783deb5f18d29ca909f

SHA1
62627645352ed75eea6be75a182a31a1269fdd11

SHA256
1e28cc52cee10ae543c5ac06e7ff886b3a2bc2dea5f5e1d795397527a3cfe84b

SHA512
88388ef94f2c559a0e448425a4581666d186849f34067ec84bce115cc2c8c468965602bcad534af64ef759e8e4f6b708d0f942826dde77062649ca5030fcb9b5

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\help.jpg

Filesize
1KB

MD5
8b64057f8c022f6a5cbfec80fb9502d9

SHA1
8968c4546c82841454f529c2e8d320417b012e73

SHA256
fd1d8ad83a3b14e2dc376a39501a6261e56d3358b64f57aa313f7ac212982ba7

SHA512
2a270beab4941a64b16ac10bc6531cbe428f573c7a9be66330fb239b7e37bad242eab18a524ffe57beac0d711ded584ed7a676d459f44ad6948d5d0f030f33a1

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\image1.gif

Filesize
162B

MD5
ada5c508c353b01bcf7ddd666b3bfe7c

SHA1
119a980d36b197c35304b7e294722cd374f76ee5

SHA256
5ac2d6be000ea72476a0a73e0a2434fc7ea3f74538c48e47bb21dce34ee4b873

SHA512
feb7c30c41aed8a7844c6ca3628131717fd53f8eb01a24ac8adcd33cd3355b55a44d2a7c3b53e3cfe68fdff728f9033fa5e2bc254a3e61d09ddba55feb16585b

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\image2.gif

Filesize
586B

MD5
a4fedaf691989338913d9325516d69c6

SHA1
cdad3e997ef788a7bb4ab4f34c88ff25fc83bf84

SHA256
198680b6b0c72dc40f6688e6c89c20563c19bb533bc442eb674391ce939f566e

SHA512
5016ea58d25710f538294da3377459d6661ff869b0cc8c9dd15772a55e9ad3f68a864a300e5a2f053cf67a9768c7bd44e04af8a761443d02c1e48125e6185c65

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\requiredBang.gif

Filesize
124B

MD5
39c287c5040641fc77ddb7f592847a22

SHA1
4136c22f039dcd82eb4605e7b75d95ebd5d080ee

SHA256
098a5c7c213a3c86c916a6533dd5c00fd4ba8bbf235dd7a9e06bd41ae0ffa585

SHA512
9f4c14bcc5d1c4fbc03e44c106fe10fb93b4b2d3715e2f7f240db81677a754ad1ee0773d758fae7da3647dd20d98ab8beac215b0bf93aa83ac292932f4300e0f

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\selectedTab_leftCorner.gif

Filesize
65B

MD5
33fec273eeae968c3bde4fe0769e5451

SHA1
e1c5724fb353f549ee4df20f4170e7c4df1efb91

SHA256
1494ee5ff99831425810012d5a09311f7fbc36b4eecd2c0f5389ba2a9a247dab

SHA512
7b6837a9880212320e1f30fd439ea1e5b45ef6f924ceb2abc57b99019dcf1530524625f8e18485f55e583384140a7a620ede8a2b846afe394bf3410bf8ba6321

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\selectedTab_rightCorner.gif

Filesize
65B

MD5
8179b5d7e6ee7d6ef15224a823cc1640

SHA1
0fa6fb8f3e5eb7ae048133b1708811b3ac059042

SHA256
baf7ae20fe504248b41e7ee63467bcf6abb7e7470ce009bf1adcc611b94ca173

SHA512
a85e2c904072597aebd58803ffa83e0a948724e26ff80f03d7ec1b38b9ab31a20de46d3ae1cbb1f0b431db5505c7a329ecde28012d15f4bbb1680b96cdd62dca

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg

Filesize
8KB

MD5
5b388239dde0b1edae34c5e55ace1f2a

SHA1
fb45095fc3823b241b6cf5409fc31023a07c2647

SHA256
3237d2a7732a266fc440623f92f15ba33855792996a4060be79bb6baeb71bf24

SHA512
62b3ef25fdbc1215d3443c3787c0a3043b579246fe3427429f0ca921808460a01b944e70e800c73170846962c484332f2d2f090e484e456363f16a3544ed7b12

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\unSelectedTab_leftCorner.gif

Filesize
65B

MD5
f4e9f6ed12fbd52c3abb947d89a2685c

SHA1
5eaea2ca9903df660616752f4ba14833a21bec35

SHA256
954a25dc7471e0a94f51579ecfbc65c6a1a90c1aafe9cd35b1af197dc64787e6

SHA512
704c487558855f500bcfe787850684771522efae6e7650e087abcc85391ce0a4c2d8db1acfc49c5d2fd42454a78e76f115b6dc712e472e2e91e69239c7a9b3e8

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\unSelectedTab_rightCorner.gif

Filesize
65B

MD5
0a09d169495b9d1380e9ebc92e528ec7

SHA1
807fa5b9f4c409fe0c528f968b5a4fdfc191ba97

SHA256
2076ef257b14c91c02e149871b09f3aee1f11340009d7c3ef3404693c1f6e224

SHA512
904b2e3b7261dd9258547202d2b760ed721f6391e3deea074dc4db2848cee1d8c74c82621e6452860e92b295438707255fccbf376d835019d0c10ecb276d8334

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\yellowCORNER.gif

Filesize
880B

MD5
1712e563955ce5e81cfbead54611033d

SHA1
f86d457942870e0462003ac85667c6d97a11a7ad

SHA256
e919f1c63ac7d89ec9c4a085b8f321e953babdd786d3ccaf85f131e78db9ee0d

SHA512
0592930afbc0d4f4b801f8fe86c60d84f038eaf171785a4380c7355c45e9698badac768cbe1d4fa1d83fd1979b92d17362ab3b50c0c5abdb856e782a59b96d22

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\security_watermark.jpg

Filesize
49B

MD5
c23d361aeacefcf5ccf21ea1b94de7a2

SHA1
c5d12ab768fad9e348f152eb11f3ee4bdab7c6f4

SHA256
5e45ab3ce95d94638f81ac84bf834f71a21a753847008a1672c574d9d449829f

SHA512
13e67cb0690aa599927490ca3fabb6cc16e16bafcc593f3606de35abef83242421c9d29ffdec573462a2d3028f96d5e10de2016ad9e4cd918d15ae8d5fc2d761

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group1\1 - Desktop.lnk

Filesize
1KB

MD5
58ae14e606dc3d43b29d889f6bd1f77d

SHA1
0a1d9c93765eef3ecabf10b09519df066e95089a

SHA256
212d4873331d1b68543f0c7c4f2df3ade0c4ddea96b8c89dd9b21a0aea00129a

SHA512
cf7d33eb832228c29e84c0c9910593667f0ae67130684df311c546600be87a17178445125d48fc39aaef2800c31ef9b61ee8a72ce3e68384e83f276a43dab511

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\1 - Run.lnk

Filesize
1KB

MD5
5d472219cc7df97b8a1c9e3a04d771df

SHA1
207a88f715f1323df30b48c9b69fe9325e0e0d63

SHA256
47396e485fbd9432263f9ffb1bd847965c3ddffb9f1e7bd37c863ada0bab81c8

SHA512
1b4f3854704265574c392478b67f7709a82934f4ca8aca83657c902e244fa199bd132b2f709cc6fd9eb066afc4ae8d6e64145096cdbebde8c2ee44b4d12f8a56

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\2 - Search.lnk

Filesize
1KB

MD5
1d33eba9d599bc750aa44880846f00cb

SHA1
7b9b9940f8b789cbe03e0d04164f1d5bc395e656

SHA256
5c020ac198ee7c251522e776b7b3cd8753efd03716dfc3209ec85306794059bd

SHA512
0d38ee26928a6345403f6a74c364295a165c5123ecbe30fab430a5de66ac93f8ef71a61cdb86ea87e2a8c3247e053f313c339fe496848c8e7daf7b6ee9354152

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\3 - Windows Explorer.lnk

Filesize
1KB

MD5
7ec2a14508d14f9edacaa370649b44dc

SHA1
2eb0d3ebe93165151c52eaa6fa177cdd9c85656a

SHA256
7c8cc1a19039a874cd56f7caa6b068e0c01ecda3dc8bb48c41a5336c820fd271

SHA512
e917e3459da1680fb4310e6ea1a111c3b1c65c03ceba8417dba4b44cf319bff3e29fa5be970eb63746ffc8fc1a3600ca93045fbedbd138b606082d6376db5b82

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\4 - Control Panel.lnk

Filesize
1KB

MD5
c147cf191c2286c55cca4efab7321fee

SHA1
db282e347b98175da2a21267b6947fc5f0d0f5c3

SHA256
502bc5463eaa3d1ad438a3ed4bdcae05e887dd0bba03b80e0477b93762336c06

SHA512
9ffdbabdb2233b2076cf47daac34240e827bd0d1b3a057cd7216ae4cd44418ada7e4dee15c79fc83bd724af89ea6938a0ac0ccbce22af8d8659826913e5ea6ae

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\5 - Task Manager.lnk

Filesize
1021B

MD5
55e030702050a416599a687e819fbc1c

SHA1
4e72e4c7dfb42c05fd9d276f978c83c3643bfeab

SHA256
761ffd17ae45b86e87299304e575426b6440550267002e0dbe1a87f7da45dbb9

SHA512
0a86b69d2e90e3c20894aeff7dd36a9a3adde7e8101e7d8118e8acff587b3e915602d627f7aed43a5fe3db6ad837ba53315fb39a0cd86cdffa7f0f8ecc7cb17b

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\01 - Command Prompt.lnk

Filesize
1015B

MD5
6df0c09b34dc57609a53a4b456ea8ee0

SHA1
6dbaf603f9f1a0115ebcc994e0f3707b3f873754

SHA256
3a39b8031bbedb4cd5a1a5b2be5a22c3f1347359121efba29ed7291c0e1729f5

SHA512
4f564c90e6675cd894de33b384f52e06790d78409a14da26af6ea38798ef75d23ef01b97bc7bb3576663c3f20ef90bcd23b569e473a4dff246c6b96da9344e10

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\01a - Windows PowerShell.lnk

Filesize
1KB

MD5
ba7c2d76d08b825939b69aaa99f52ef5

SHA1
683653ef9b7b4859c6a3a635e62ae02cbb055d95

SHA256
65509ed1cc0bf08a9f4e874dc2b12ef526191490c6e75daa474cb356d1a2676e

SHA512
966320143aa50277c828dbaaf2084903e227ce8431ea7369527408bcb84e24a65501f514f3d19d05e7bbcbfeae4014fb317549b6609474357a80084dcdbffe86

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\02 - Command Prompt.lnk

Filesize
1KB

MD5
0418b3907b67f771d9ab80b66b44e3d5

SHA1
c77336a2f88ec1b2b8ec00492aab0b48c8fca078

SHA256
7e5d232e5995495c335f427dee8ebc35194dfc48fcd81f547126ec9d69c2b96a

SHA512
8a71aa392b8b49047c162f36c85f1cf2109d8ea2fbcc2ec33da8aeb1ed51dae46372aac0086fd81028251d4d52019fe8b187fc9a921e1f16927c7e23eed2c3bd

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\02a - Windows PowerShell.lnk

Filesize
1KB

MD5
6576257ef62b8ccfa81bbdd9f1c61d6f

SHA1
b2355c1cff78b1b593afa27dca05f703787ae017

SHA256
271a147356585332c22483033c67234118645978209b993112d2ac6e6fe6e6b7

SHA512
38353aa63d9d1f762db05a32aed8fd6298a5ac7d3e5bb81a06484a63d81ad5895f0a2731729dece6461d91d5f90bac25bfdeea1a215dd7528f3f096aa282dc01

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\03 - Computer Management.lnk

Filesize
1015B

MD5
2cc7012610b594fec4a72f72c8f400ee

SHA1
c6ba2e3f93cf6a212e02c558b7174bfb00641b53

SHA256
5368a72ebe0249efadec63ff4bbeadcf67b6950bb5cd9fba9190099a62c4a77a

SHA512
8b1db7b54d3066b181721a4b85631eaec1712fd9e23a2bb3a67506fb70f5f14d2752d8ffc25547feb1edb4df88c38ecb066428309fbe70d2a5ee995ab85d8f58

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\04 - Disk Management.lnk

Filesize
1015B

MD5
52f5c251eea6a6f51cac57d17f90ce49

SHA1
5934179b39fe3b6c40a60abbda2cc62d6fddd38f

SHA256
a998afa0588f654aae6ad965d91c5aec27decd9080add7a97a10a8fd8683cc8c

SHA512
849d552325fd90fd69f6f53c6c37574e419a30a1e7ce71a13e4053f4c3c8417b9fc783c1300af621b46e61fa6ff1b9ae2e9ede628befc6243e9c5b04c9094fd1

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\04-1 - NetworkStatus.lnk

Filesize
1KB

MD5
7531a508509c487ad838c3f9f32fcb2c

SHA1
30b33f773667ca806aa1b3ad195596f811fdb2e0

SHA256
4097382e1a8a0dd8c0f3e0c219b186b7e804e1f14e9f685eb6851da28358d752

SHA512
7bbb3557a66423228088621e5c594a8aedac5ddf77cb8329e044acbabeb09c4cbb7c51bd71080e19773f922cde77624a6d14be9f80f711277a103bd74da00006

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\05 - Device Manager.lnk

Filesize
1KB

MD5
21ebe009856680a2c3f5765c142c6e89

SHA1
084ace1d49a30d1b58ee691375db3bf520e39003

SHA256
a6be18888b2bf2dc70736a9e6f475723f99b9f7e0e58cff7a2ff3527ca0caf9e

SHA512
2d82b814c0c1f10975c2b066cf0df3f4a262e4a4641fe39feed3c5be3b7ae83965c47e4b40c246cefd161decc208298fb0593dc37d6a84406cbffe3ba01f1677

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\06 - SystemAbout.lnk

Filesize
1KB

MD5
ef0416c71b70dc70140a9276b2597362

SHA1
8aa672778f51e81ff6f02978f02370430845be03

SHA256
9cc6183b8e88e9a68d8320f60601c6363cc48829440c01ddd7ac8a99e92d681f

SHA512
f12372ff6db0712f9b75d5fe1da432ea34c98a52e4f5b43680e89f88c098d62e72527ead94ca0843f2c8ca97585efa3536fcb3f54f6ab824e6b283a1863c806f

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\07 - Event Viewer.lnk

Filesize
1015B

MD5
47d611cff211862f28bc7a9141a3cc7a

SHA1
306147297c40ab1803e59707ea45c6b8a5a6b387

SHA256
0d8c711b800f6e4e4652571d63774e9c12b8522be309326a951edf7442f3bbec

SHA512
02388e4ba8f6a45eba754a70c7993fc4e0c06bc0900f006fe66dfd866fc03f2eb84094970d6accd31200e270841ea4d05c47b727e58f52ea4f466d88ab0031d6

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\08 - PowerAndSleep.lnk

Filesize
1KB

MD5
a77befd2adfba2d26e26b58f0d893207

SHA1
4ac6bf879510a5e5c10bd1bbe36c8002897b99d4

SHA256
2ff5f87df5ccebec5374e4239c4d2878dd82690ce8dd875d1b0e20ed92d47a57

SHA512
a44fb4c9388af67141332f8e3225eececd8d17856b924fa17daa9b8354c3104c940cb3c211b33830a0a954017d6857da4a59f74e46ebf581a8e3cb966bee4bfc

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\09 - Mobility Center.lnk

Filesize
1015B

MD5
7dc4dfc6064b524ebe763c04f8315d88

SHA1
60221a1198df0acfb6f436230b0d3883314aa377

SHA256
31554f6d76875a7fcce4b71a2510bae472d8178c9f39cd67fc6a5dc8774f9329

SHA512
389605025aaff4dda4ff989f56645ffb02383a3b5a0f58be252ffbd38243eb079d627794fc2756d809c8cd962836deef905b5bdc4f986c0c8b3697720761d84c

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\10 - AppsAndFeatures.lnk

Filesize
1KB

MD5
fcd4664f0e82db8e848f471fedbe21e6

SHA1
162492890965a237ec215748f23d43839e5f2c75

SHA256
d481b5f78d5862ce63978672c732b2f7205245f70365dd8ef5a5242064b61885

SHA512
eeb873324ce5f98a8ecf639cb7424f189d0790d25434aa3ad760ab1337665df0c1d60038508ed4b871df9b806033d3a59b152988c62b3dc7a154f94ed0f2fded

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk

Filesize
352B

MD5
8420513bc01fed5115498278f8851f5e

SHA1
117a7e1fcdddcebd665ef1afe86bfff314242b10

SHA256
6de8aaedb9f3d94d68bd41651060570cb71ada8919ec4aea4af5d8a3e730e6c8

SHA512
2af251087b12f8bcb09d9f4c05af38e0fb0ba1aa850d5c8cb0ed5fb24a2742ee0c817f02cf0d36ce1ed1312b37f0093e1e2ef3033e36fe4defaa8cb16c28c16b

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk

Filesize
334B

MD5
d9851848f09ce74bf4044c3fe39b3133

SHA1
6f1ef60b79d7dd4c3de9d44209071e99a9783300

SHA256
149e585d64f719cd91057752109c8ea152d2e4aa17c24d0dcb84d94703fa148a

SHA512
4dae3f5fe444a498c75959a734f64a406a1c0afdaea746440f24efcce5c74917a940ea1054c2f285bb3928a31070ce79a353e035bc3d962bd3cb930811ee6ada

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Magnify.lnk

Filesize
1KB

MD5
1e73e07ff9e59fdffd4fe85dc1336e6b

SHA1
25553a72798076d4ee67e458a21b977313ba8125

SHA256
cf9564042890ccf65e366362bbeda590c7f6e4bba2d1e3e1e552706eeae2e2fd

SHA512
ade651695108854fedcd80b3919f2ba6b59802a0503b8fd40d246647b88e3bb89c0cb14b4a889b93899768c36abdb6018dcb19518e0cf59951b012eb037bb9a3

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Narrator.lnk

Filesize
1KB

MD5
3537608cb51d8e2e1b72047833124b40

SHA1
ec0ec100031318c4cbb27f3b487b2c4ba2b8eadf

SHA256
829b39398b72c3500bc9a40b584eaed03c5378bdd29311a43472c198791a5369

SHA512
1bc2fb951637fbdbae0185ef62d88a6f3d42776a0cbfc6b3f1e7b8a6007eeede026e8bfae66a55c98567b589db43f2c2beda23bbd3ff8ca18908e24cd1e7f65f

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\On-Screen Keyboard.lnk

Filesize
1KB

MD5
eb1d8c626e33936a02b5aa71d74084a5

SHA1
0fb2359881e08d3e0f7886d105e539ad8201595f

SHA256
d225da1f7b50f5de4ae2569f02472b98028942605fba45599b289e5db089c80e

SHA512
5f596c624b5fa9744c7054660eae1e9ab7279c4ac9f2bc6a455a46be5c5e185f8d816f3662a9d7a7fb30721fe268abc36a2459cc4c6853dd7b71efa479b21f39

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Administrative Tools.lnk

Filesize
1KB

MD5
cdbf73af833e69bd9819c1cc27088ecc

SHA1
fbc8cea19c4b38e8be53e1ac2a85e2fda536b29c

SHA256
878f2ce0023afc2e151a9d3159c9c45a0b32cda4013400c9dfd4a4572709c568

SHA512
a6f0856ab8a0983f733d328f654f7c095b975dc9261bbce28087eda61a136ba087d0158fd842643f255d3bbcac20d81ecc4c717f11f6e7c463d45be78999ee20

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Command Prompt.lnk

Filesize
1KB

MD5
af905c24f9c851449dd732c2d1858eaf

SHA1
f0400a21b82d7f845f224d9ee7989b20dbf3f013

SHA256
474e25420b573c94ed3836ffb86f9f68b4ddca908beab3058a525dfa18dcdf5e

SHA512
f0a49c2b005352feb17b7743d19e614e05e80d4b60ad598b51e4399a9402182e68601c7c2d77a5e387b2eb3cad42feef5ccd7fe3ea8279ae00b0ac5b37d09ffc

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Control Panel.lnk

Filesize
405B

MD5
933f20106bbe4543b6e6dc70e986a7ab

SHA1
71823a7f8ae026b2ce0199a1381e8682eac86501

SHA256
d11179d8ad452479672bd2e6b7b87f41f2a9f7f37b41ba9b36c1fa09561c85da

SHA512
0f61924cc18e3779a0767b12e0274bb1d115dd7bfe5d4195a318d4299f7951cc31e7bfab9da813663d788450c27548470c079b6de236249768da0a4634ef19c3

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Run.lnk

Filesize
409B

MD5
50b85ddebf34846f336b13e22751d3a4

SHA1
5b375618d2b9007c3109d4b67746c3bfbde73240

SHA256
fd6e7933cee49df754c4131007a61f42322a3fdc6df79b45348663d323bb3c13

SHA512
ceba0f5c40bf65fdc7d108d096bc9268284236936abd32ff05529848644bc282105b62c970ac924a9442f6112e1d8de8043d285a7173774fcaf0fa1aada5daaa

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\computer.lnk

Filesize
335B

MD5
0b13b489f8d22f1e7189a73be3dcdbcb

SHA1
05d5d0552167a8cd9d5a47823f019bf69edeaf3a

SHA256
a015a2d1a68ce81efb1122eae218256589268338a765a6b825cbf452112aa79b

SHA512
ceaee17cce4e9daf73d729f75c0990994d23e9664d564187c1a56de340f886681bb7dbf86b9c41889a64480aae551fd31f1ac0c5917b46d7872d89d236d297e4

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell (x86).lnk

Filesize
2KB

MD5
66785a2349a57312e1da99ccab94bf69

SHA1
a1ecb3fce7e1223ef1a33b679b502859ac260e4d

SHA256
9ba9e1e13664a680e2596298f6c1f760e99fafa632d732c5af4fbd5b11cc49f7

SHA512
eda6f81fa2b64421e82537966ed076ae35d79f8a4fdb20a12136fec97aca1dd26b015a9fb37cdec89479426551e503c77cf8e36ead0dce0a17057ffbae6a2429

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk

Filesize
2KB

MD5
5d18b066c9a311be3c66138724367457

SHA1
b887da1d93e7c8839a881bd1f6d09e7d35f22cc3

SHA256
85c0c39de0deb4470b2509b756eafe9035dc2c2325066a5be974b7b72e644afc

SHA512
b59d1417aa28d05f81e032a6c516475ce696424b459babbe06ae0b923cbae862ffcbcc1f6750c8394240c5217d2595844c1203298fbb98258c889be981e99284

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png

Filesize
296B

MD5
39a873526a113643033b8c9034cd7a4b

SHA1
7723f16bb8cb659413e6f06ae654b1da6d5f554c

SHA256
75ff7af528ec9d61b53845cbf09e3cc01f1502b03284a492fc03800f4eb57d3b

SHA512
3e215a8df942d777c1daed26604a7bd932b9a1a25696803afa919653099a9622806fb3b12b7fa07a235e34ff0284ae1de8277ca887c9d9d257c384530b40d84e

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_contrast-white.png

Filesize
276B

MD5
a7d5480f6666f37b0980623155588769

SHA1
cfdad27c31555e6276bbdd8316868e19334a17e5

SHA256
4559aeef91de69d15d1e3dbe849f023c26bacb130b0bcd46f0c728549624c06d

SHA512
67c83c201d994fa320a37044ca41a586855188da2c179df947b004d9845d6f4da0714c74ff55e7fedbc9f3703079a0d497b171ebfadd290aaaa54dcc6b3c8d07

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png

Filesize
296B

MD5
e97a9425f2fbcd4cd6a4a8b48e369a7d

SHA1
a907adc6fc17b5faecbd2fec532274d6c5a578c8

SHA256
82ba73a9ea2cf887e0838ebd13c43952a79fbc3ad0896daf573a2fb9084c8d1d

SHA512
69b214530398af309e195743cf1b69fa71f9c17f660e76e515821cbf13cc1fcd2a39d3c65d727224c27f95e9a782e86e624cfa6b3210bc3177fd4e995ee8df94

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square44x44Logo.targetsize-44_contrast-white.png

Filesize
276B

MD5
29ca247722ab88587975f7496ed9b177

SHA1
40dd402971a1c9e2e34de409832bc505ad61aab6

SHA256
eada01e9bf373e966c3d8494b5788ee7dea2b4266267422b45713e6821adfa7f

SHA512
99f201dbab7d2bb1091ee80a841efe1bd0e6aa40839b1b9dcf8f85b62160ef229e4f12fe3d42704590206ebf276b55b3a883044aabe8f80a707959e9b87fc8a0

Download Submit
C:\Windows\WinSxS\wow64_microsoft-windows-onedrive-setup_31bf3856ad364e35_10.0.19041.1_none_e585f901f9ce93e6\OneDrive.lnk

Filesize
1KB

MD5
9faed832428d9ba120f4987ebe4b93fa

SHA1
8c3baabec67d24979e839340024c4ba0982479e8

SHA256
9e5e57db1fb38e41e86dd6ab11c87f5c5738a8f88181a6e943278692c9897b1d

SHA512
6497e3b5561e88c39317650b035e7f697ff3e60db8138307a03e4d4ddb81efdd13e3765b0b9f76eab619699b1f5d711136ca2e0c594746c66daf1ae0baa3de78

Download Submit
memory/4544-3960-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/4544-4111-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/4544-3959-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/4544-0-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/4544-4388-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/4544-4393-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads