xorist | d76220046401f64fdbcf2bf1ef34a808cea41ef5c8cf2f3f2fc3be3b38ee126b

Analysis

max time kernel
94s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09/12/2024, 09:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
Size 8KB
Sample241209-l1kpgstpew
SHA256 d76220046401f64fdbcf2bf1ef34a808cea41ef5c8cf2f3f2fc3be3b38ee126b
MD5 d90f48cd7167e4a86a1ab254cbc690a0
SHA1 9f27823dd35ada75d185df5ea642a36e0a0626f8
SHA512 826cff6288e405715b3288d0fd9f86fed5a1dbe35fa9bef05094919747e113dcfb66d1c06c0df39e666222db6ab0abb50faa9d51034a0d66ae37518d0669edf0
SSDEEP 192:Wzdrr1FG1WDCgmjPZ8yOqVylUKz3ZrXnUA:Wprr1gkDCgSatEyl7ZrXnB
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xorist discovery persistence ransomware spyware stealer upx

Malware Config

Signatures

Detected Xorist Ransomware 7 IoCs

resource	yara_rule
behavioral2/memory/4936-5566-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral2/memory/4936-5568-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral2/memory/4936-10110-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral2/memory/4936-11017-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral2/memory/4936-11338-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral2/memory/4936-11355-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral2/memory/4936-11360-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist

Xorist Ransomware
Xorist is a ransomware first seen in 2020.
ransomware xorist
Xorist family
xorist
Renames multiple (2197) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Drivers directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers\gmreadme.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\c9SZc694s77NPdL.exe"	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\FileRepository\c_smartcardfilter.inf_amd64_3573afe136371e51\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmminij.inf_amd64_a85c8e1fe15a9532\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnms003.inf_x86_360f6f3a7c4b3433\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DirectAccessClientComponents\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_LogResource\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WaitForAll\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\arcsas.inf_amd64_b3d75f82c617ac6a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\InstallShield\setupdir\001e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\System32\LogFiles\WMI\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\InstallShield\setupdir\0011\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmolic.inf_amd64_7f84203a67c210e4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\vstxraid.inf_amd64_300cb04282659e6d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\MUI\0411\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PKI\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_camera.inf_amd64_7b52a9607d24ece6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netbrdg.inf_amd64_8a737d38f201aeb1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netr28ux.inf_amd64_d5996f2a9d9aa9e3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\es-ES\Licenses\Volume\Professional\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\XPSViewer\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_fscopyprotection.inf_amd64_9c108d8ac558a80d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\et-EE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Speech\Engines\SR\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_GroupResource\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\winrm\0409\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_fscompression.inf_amd64_2aa5f249d7ee104a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\bcmfn2.inf_amd64_5ebadf201c5b5845\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmlasat.inf_amd64_36a71a022d8bb0bb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\net1ic64.inf_amd64_5f033e913d34d111\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wvmic.inf_amd64_ae02676ac3e3c474\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCClassResources\WindowsPackageCab\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_UserResource\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Configuration\BaseRegistration\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\hal.inf_amd64_fd0ae947345ac7bf\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmbw561.inf_amd64_0406b31e81bea0d1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnms008.inf_amd64_69b5e0c918eab9a6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\smrvolume.inf_amd64_9a3d52a168ca8fee\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\MailContactsCalendarSync\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\fusionv2.inf_amd64_a47d9636ce0d7dab\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\msdri.inf_amd64_97bef65a8432edd4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnms003.inf_x86_360f6f3a7c4b3433\I386\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\ja-JP\Licenses\Volume\Professional\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Speech\SpeechUX\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_RoleResource\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_RoleResource\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmcrtix.inf_amd64_e3ded2b26d662526\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netax88772.inf_amd64_5d1c92f42d958529\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netk57a.inf_amd64_d823e3edc27ae17c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\uiccspb.inf_amd64_18454ae612999870\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\MUI\040C\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\spp\tokens\pkeyconfig\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\image.inf_amd64_d2006c0517ddc60c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmaiwa.inf_amd64_7cfab61cbab23e11\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmaiwat.inf_amd64_3bb2e5702f25a518\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmnttp2.inf_amd64_8c1e04ee38482578\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wpdfs.inf_amd64_1183fd0f13045f2e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\hr-HR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\amdi2c.inf_amd64_d7ae71f8eb52c084\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmsun1.inf_amd64_5b6db32fd04403a3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ProcessResource\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_RegistryResource\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Configuration\BaseRegistration\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4936-0-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral2/memory/4936-5566-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral2/memory/4936-5568-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral2/memory/4936-10110-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral2/memory/4936-11017-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral2/memory/4936-11338-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral2/memory/4936-11355-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral2/memory/4936-11360-0x0000000000400000-0x000000000040C000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\10.png	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\ExchangeLargeTile.scale-150.png	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\iheart-radio.scale-100_contrast-black.png	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\sk-sk\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\core_icons.png	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Place\contrast-black\SmallTile.scale-125.png	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\bg3_thumb.png	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\root\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\SubsetList\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsAppList.targetsize-256_altform-unplated_contrast-white.png	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\offset_window.html	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2018.826.98.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\WindowsIcons\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\typing\bubble\light.gif	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-Yahoo-Dark.scale-100.png	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-96_contrast-white.png	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\tl.gif	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Program Files\dotnet\host\fxr\6.0.27\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\StoreBadgeLogo.scale-100.png	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\SplashScreen.scale-125_contrast-black.png	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Viewpoints\Light\IsoLeft.png	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\StopwatchMedTile.contrast-black_scale-200.png	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-32_altform-unplated_contrast-black.png	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Assets\Square44x44Logo.targetsize-24_altform-lightunplated.png	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare310x310Logo.scale-200_contrast-white.png	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-20_contrast-white.png	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-white\LargeTile.scale-125_contrast-white.png	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\Scientific.targetsize-16_contrast-black.png	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarAppList.targetsize-20_altform-unplated.png	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\pt-br\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\zh-tw\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsAppList.scale-125.png	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\WideTile.scale-150_contrast-black.png	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\SlowMotionEditor\Views\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\RunningLate.scale-80.png	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_ie8.gif	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\it\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\fi\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsSoundRecorder_10.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\VoiceRecorderLargeTile.contrast-black_scale-125.png	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\contrast-black\MixedRealityPortalAppList.targetsize-24_altform-unplated_contrast-black.png	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_CA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\ro-ro\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_GB\List.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File opened for modification	C:\Program Files\dotnet\ThirdPartyNotices.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\Weather_LogoSmall.targetsize-32.png	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\AppPackageStoreLogo.scale-200.png	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteMediumTile.scale-100.png	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosLargeTile.scale-200.png	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\PhotosApp\Assets\ThirdPartyNotices\ThirdPartyNotices.html	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarAppList.scale-125.png	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\NavigationIcons\nav_icons_store.targetsize-48.png	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\sl-sl\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\css\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-16.png	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\LAYERS\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2018.826.98.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraSplashScreen.contrast-black_scale-125.png	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\LTR\contrast-white\SmallTile.scale-125.png	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageAppList.targetsize-64_contrast-black.png	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\tr-TR\View3d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteNotebookMedTile.scale-150.png	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ne.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Assets\SearchPlaceholder-light.png	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\WinSxS\amd64_microsoft-windows-wininit_31bf3856ad364e35_10.0.19041.1_none_e6e3c652a3ae2d1d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_networking-mpssvc_31bf3856ad364e35_10.0.19041.1_none_cabf3eaf8ce8eaf0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-wmi-wmiclnt_31bf3856ad364e35_10.0.19041.546_none_d3eefbf5eecbb6e3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_netfx-system.configuration.install_b03f5f7f11d50a3a_10.0.19041.1_none_e76884dfd0faa7b7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_netfx4-microsoft_build_xsd_b03f5f7f11d50a3a_4.0.15805.0_none_9181b2b402e54930\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-tapi2xclient_31bf3856ad364e35_10.0.19041.423_none_b0d6f99ed2b9283d\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-i..timezones.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_dbe93271141d1422\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..monnoia64.resources_31bf3856ad364e35_10.0.19041.1_en-us_0b018d9a63164212\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-webapi_31bf3856ad364e35_10.0.19041.746_none_eb1dbe52976192d3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-imapiv2-base_31bf3856ad364e35_10.0.19041.746_none_ab586504a5d1bf2c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\WinSxS\x86_microsoft-windows-crtdll_31bf3856ad364e35_10.0.19041.1_none_3ba7638171af360a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-eappcfgui_31bf3856ad364e35_10.0.19041.1266_none_032284d250fde56f\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-security-tokenbroker_31bf3856ad364e35_10.0.19041.1266_none_18784aba5fcd68cc\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-t..ork-msctf.resources_31bf3856ad364e35_10.0.19041.1_de-de_b465665769c4d842\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_system.runtime.seri..ion.formatters.soap_b03f5f7f11d50a3a_4.0.15805.0_none_a3187ab90ef96584\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-robocopy_31bf3856ad364e35_10.0.19041.1266_none_4621ad58d5f654dd\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\WinSxS\x86_microsoft-windows-i..workcollectionagent_31bf3856ad364e35_11.0.19041.1_none_03ba65b32c555332\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-onecore-a..nmodel-datatransfer_31bf3856ad364e35_10.0.19041.746_none_fd8e61597ba0bc62\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-i..lperclass.resources_31bf3856ad364e35_10.0.19041.1_es-es_a8fd118b344d889d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..t-tracker.resources_31bf3856ad364e35_10.0.19041.1_de-de_32f4f055121bc93d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.DataSetExtensions.resources\v4.0_4.0.0.0_fr_b77a5c561934e089\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_fdproxy_31bf3856ad364e35_10.0.19041.1_none_31575f740deee58a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_dual_heat.inf_31bf3856ad364e35_10.0.19041.1_none_a2121d6132a8796f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-h..trolpanel.resources_31bf3856ad364e35_10.0.19041.1_it-it_faf54ad709861c02\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s...appxmain.resources_31bf3856ad364e35_10.0.19041.1_de-de_78e34d6c233e4a6c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-w..nttoolapi.resources_31bf3856ad364e35_10.0.19041.1_es-es_3ee6b10edac2e19b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-btpanui_31bf3856ad364e35_10.0.19041.1_none_2cd56dfacac9b7f9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-d..japanese-customizer_31bf3856ad364e35_10.0.19041.662_none_4b1d718aea4457d6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-s..rationmanagement-ui_31bf3856ad364e35_10.0.19041.153_none_4a47e47159ed1ada\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-a..ence-mitigations-c4_31bf3856ad364e35_10.0.19041.423_none_ea311d1c510b813b\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-d..memanager.resources_31bf3856ad364e35_10.0.19041.1_es-es_5a4ff6b3276fd74f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-i..ntrolpanel.appxmain_31bf3856ad364e35_10.0.19041.1202_none_8f7e37524c3e1a13\splashscreen.contrast-black.png	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-w..lient-aux.resources_31bf3856ad364e35_10.0.19041.1266_en-us_2d9ea7f6426cfa21\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\WinSxS\x86_netfx-shared_netfx_20_mscorlib_b03f5f7f11d50a3a_10.0.19041.1_none_15ba23b7f1e2b81b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_netvwififlt.inf.resources_31bf3856ad364e35_10.0.19041.1_it-it_4a1df14f403f9b57\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-f..mutilityrefslibrary_31bf3856ad364e35_10.0.19041.1202_none_7b0dac7c38adc992\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-onexui_31bf3856ad364e35_10.0.19041.1_none_fc480d842a1b85c2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-a..mmability.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_d23c47f1570967d9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-d..adercache.resources_31bf3856ad364e35_10.0.19041.1_en-us_0380073191187c8d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-u..e-ux-musscnhandlers_31bf3856ad364e35_10.0.19041.153_none_48909151fa03356f\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-p...appxmain.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_fbddab4a330c2f8e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..handlers-workaccess_31bf3856ad364e35_10.0.19041.844_none_bb95ef9dc6bda693\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\WinSxS\x86_netfx-eventlogmessages_dll_b03f5f7f11d50a3a_10.0.19041.1_none_904cfa3c83f962f2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\diagnostics\system\Power\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.19041.1_none_ff46bbc9afee54c5\RatingStars39.contrast-white_scale-200.png	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square44x44Logo.targetsize-44_contrast-black.png	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\assembly\GAC_MSIL\System.ServiceModel.Resources\3.0.0.0_fr_b77a5c561934e089\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.19041.153_none_e95531bdadf3df5c\DMR_120.jpg	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..c-keyenum.resources_31bf3856ad364e35_10.0.19041.1_it-it_afe76ba4c4c8efdd\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\WinSxS\x86_microsoft-windows-shell-comctl32-v5_31bf3856ad364e35_10.0.19041.1110_none_5249ae2cd4c73403\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Security\Roles\App_LocalResources\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-lua.resources_31bf3856ad364e35_10.0.19041.1_de-de_fb8b018d1cce8d8b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.19041.1266_none_802f96a5044b0fbe\DMR_120.png	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-w..cationcompatibility_31bf3856ad364e35_10.0.19041.746_none_567822cb71b23197\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-l..erdiscoveryprotocol_31bf3856ad364e35_10.0.19041.1_none_62f1a2641655cb38\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-sysclass.resources_31bf3856ad364e35_10.0.19041.1_de-de_16f98a98196fe5da\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-audio-audiocore-client_31bf3856ad364e35_10.0.19041.1023_none_48dc45a54052906d\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-w..codec-dll.resources_31bf3856ad364e35_10.0.19041.1_de-de_ea9285ec7d68a672\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-i..raries-servercommon_31bf3856ad364e35_10.0.19041.264_none_91c1d6c40350b1b6\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_aspnet_regsql.resources_b03f5f7f11d50a3a_4.0.15805.0_de-de_c30c435aae667cdf\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-eventviewer.resources_31bf3856ad364e35_10.0.19041.1_it-it_6741e22cd3519035\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-r..sisengine.resources_31bf3856ad364e35_10.0.19041.1_de-de_629a5c882659e9b7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-n..orkbridge.resources_31bf3856ad364e35_10.0.19041.1_en-us_91f6d0570f8f2579\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-s..onsbroker.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_6d33290137e4946d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PEAQJXWDQGDNISU\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\c9SZc694s77NPdL.exe,0"	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PEAQJXWDQGDNISU\shell\open\command	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PEAQJXWDQGDNISU\shell\open	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd\ = "PEAQJXWDQGDNISU"	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PEAQJXWDQGDNISU	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PEAQJXWDQGDNISU\ = "CRYPTED!"	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PEAQJXWDQGDNISU\DefaultIcon	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PEAQJXWDQGDNISU\shell	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PEAQJXWDQGDNISU\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\c9SZc694s77NPdL.exe"	d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d90f48cd7167e4a86a1ab254cbc690a0_JaffaCakes118.exe"
1⤵
- Drops file in Drivers directory
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

aic_file_icons.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\aic_file_icons.png
Size 50KB
SHA256 c22d65e64c220b1e4d4ea41fb0d0b7ad6a3211c5a637c2458c7401f35357b072
MD5 67dbaf4efcc7650ea246653b21ce17af
SHA1 7706d1c71de5ae114114ece600d19d0023b91b0a
SHA512 f2744a04ce167ed22389a8d0d687b455aacef87edcccce4df5369867397070a766026614de36eb2183c8aafeb9ac8d5fcab35f8955789e067faa0548531d30fb
SSDEEP 768:ohpKZ79v+4uF1DBdd8NEtLNERviLwxH1dezo0aZfAOr744Mz6xfmicQYOWXpT:icaNtdd82NE/xH1dzX7kGdXYpT
MD5 SHA1 SHA512 SSDEEP

Submit Download

selection-actions.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions.png
Size 1KB
SHA256 8fb373fc18ee18ef1eb37f4e5789969802a9d384194c32ced0c40a5b6ecf76db
MD5 41f2520a73954ba6427d518009caec69
SHA1 55e8a085596afe32104ddf647d94d3d7227cbb59
SHA512 31e8c29544e7df101dc06d83dcaef7c6ca5ee631383745b37d98e0469a0a5aef83eadbbf37d247d0d3d19046ec2b4ebdd01527bccabca7dde2f6897c508c5ae5
MD5 SHA1 SHA512

Submit Download

selection-actions2x.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions2x.png
Size 3KB
SHA256 d4caebe2c1a14682f85b5b0619da5981f8e9a206c83335d79f98c27d6f37f56c
MD5 66cb5801a3299d2162994c7a9ac7a7a3
SHA1 a68335236e0f56ca8963d546e57b656573c98342
SHA512 180bc2fb357e9c713f6f6651c76f86e8b3b9f94d3ee9bd1ce1abcf39e60eb1e0c5ea74b31fedaa6eacd5954d4fc547cb4278e8a888663b1459e4af514c39afad
MD5 SHA1 SHA512

Submit Download

example_icons.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons.png
Size 683B
SHA256 36da07890bb01ae60b134b67b223a550a4be581192d66631252dc595ff43af62
MD5 773b48ddb4afd08737f69531d48b1059
SHA1 1fcb19abab76d9ad20c4f59db4a5a0dd92285070
SHA512 d1f9ed12b3986bdfa96b71af27b2ccc856c65989ae986f4f1dd3735dcca54e57e9bb4b8702a638b2cc8571fc09efd0e10aef6cb53b66f65f720ea78fc00fa824
MD5 SHA1 SHA512

Submit Download

example_icons2x.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons2x.png
Size 1KB
SHA256 34eb664036170815b31488d4153a78c4a41c9b99ab5733f791c60afc90db6333
MD5 090a41715b49b67a297b593f7089e88a
SHA1 aae53586e77afbdadd179664ebb3653b808761df
SHA512 5b14ecb934d04d43d2d87144dec567654b387e77bebebd7a9377f2e200018ce2a5a3eb6511ab85651bd55afb219dd28b8c053f18dfd60e7f02e56b5380d46ff5
MD5 SHA1 SHA512

Submit Download

rhp_world_icon.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon.png
Size 445B
SHA256 6ba15b92094adf936bbb732e0c0b9cdafd6138e9d463973629b07e5a1077761a
MD5 2fd27c78e372670a0bbb707788b661bc
SHA1 c3649cbecb2934b578b6377174396ee5066933ee
SHA512 48b46266310c4fc112169c3eebd191cb14d13a9161e25b5345590ad4c0b0c8321a84b4e96ec822c9f0de7becb15b9ef33e2259fd937a06cf80eb12676a5bcd52
MD5 SHA1 SHA512

Submit Download

rhp_world_icon_2x.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_2x.png
Size 611B
SHA256 7421ba7a14b65c10428dc413b94a1d17903781feced5319a207c62e388ab392e
MD5 ca45e011d24802dd2c17957416de064a
SHA1 0348a590f40c42840bdbf61360896172921bf0cf
SHA512 5a02e8b7bf8f20fe3f9f4021a42a9976b21df68a9ae7b7ce0664379f1007157c6e79a28d4b6330123a2b35dc9d0c430bcc49237be175010e052bf5f76c4039fa
MD5 SHA1 SHA512

Submit Download

rhp_world_icon_hover.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover.png
Size 388B
SHA256 f66735f85222ad4488f09752dd0941e1433b1401943a59cefed1fc9d816c0614
MD5 fd5cfaecad5baa2561d2cc30e6e16295
SHA1 219f86ee647f3ff3d17819dca12d8822dbe5a0e4
SHA512 0dbc33ffad82131e189ef22e50ab3613312e2b94ba2051dcd5f64f528e061784d35e1f62030d59816574fa9bbd2f9dc88018c367ddd5248dc583d6b3fc2ab47c
MD5 SHA1 SHA512

Submit Download

rhp_world_icon_hover_2x.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover_2x.png
Size 552B
SHA256 5ea2984eae80f813befa258cf0609f0c9ca0597d1a4cf80906ab8f132b0661c0
MD5 fc38ada53e74d80efd7c7dcc6794a66b
SHA1 9a48d44ae381c459335e1ba35fb0baf852aec13b
SHA512 2e4bcd1f92e755636a88f820d9e5a49ef51688235b651dfd21be6a0ac0cd3f0cc81ec36a484c5f0d67706917604eef76f6f9957b5944faddfbe4eec51be8247c
MD5 SHA1 SHA512

Submit Download

rhp_world_icon.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon.png
Size 388B
SHA256 e7a250180c86d6d442d81e0417bb6dad108ce7d03222a2cac12ed4817df02dd9
MD5 3eaa54f7219860bd3fe49897e41f78a8
SHA1 1172185eb9901e2faedd38c2ac9cc9d49212b3f8
SHA512 dce1cdff732796abdd8b8dfc7c47443b7e9b76d30605befe2f4bfe899c11575b50a5c06a58db5356bb99fbba9ce722a7124dd15d972bbdd88d5fef5aea1d145b
MD5 SHA1 SHA512

Submit Download

rhp_world_icon_2x.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png
Size 552B
SHA256 04a6813e79378604f4a9758ae98b93a02b159229ddf0a05b05a63806116a6fe4
MD5 3caf92913cc013b1a8de9438dfa7e285
SHA1 239ae5f16f6f0115064faf69d2a5e5be3c33c06c
SHA512 ef1e808763576d5f635cfbb9de236a44dffc3c79a74420f9d00c055e7efe3e5275e3a02991aca9ce3de2e05612db581381177eb431988a888eeb268a78409d46
MD5 SHA1 SHA512

Submit Download

rhp_world_icon_hover.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png
Size 388B
SHA256 619d89cda670b75585876b58c6ceb39afa3b3c1d519c2a570a4966e4c2ed0ea2
MD5 115cab52f9a3c5d15e988eb32b70dcef
SHA1 81f2e2a4dd096b8b693a5c220e59fba4d46b31b2
SHA512 f3f2be0c574666660f908f7ee33e27eb2049babfa273589a0f95db1cbd0bd802970cea43f441aef8608739a8faee7b9b6f1dc233711d74d641b59777c754be41
MD5 SHA1 SHA512

Submit Download

rhp_world_icon_hover_2x.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover_2x.png
Size 552B
SHA256 a888137eae7147ecc94570b3f18c8ab8e514585a4a317034c6594f52fb443afe
MD5 b92f183b25b5dbe63e5c0bb29c82ba5e
SHA1 8c9f2f36a754983b67dc47a0289f027b1dd27a34
SHA512 f98114043f14f97c8ef54d4227a5d63e21f89c71d85689f4da56a0303b852f05092c4f79b2e4e0656737af107ad40b64b1fb9893a996f7e0b372883c0da20747
MD5 SHA1 SHA512

Submit Download

icons.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons.png
Size 7KB
SHA256 6b2edff8447a2d487a254903a83137cceb3e673b607616b4dd5e3c308063246b
MD5 cdb2f0b88d8d33f33e88397743a16659
SHA1 51a69c27936a40eb4242a15b249f4cfb5254ef83
SHA512 956cbfbc5fe164ef977ae0b00a340ab0dea6e2726dad96b39be2501d15191ff12e61a259c487f192216ec35eb1842da95a8a61a27ade67dde7c53677197a1a57
SSDEEP 192:fziXgRCfx22jfDO0En78LCpIOeos2+enSJ3eBaTwGkgt:fWXgR+xRA78dos2oJ3zwyt
MD5 SHA1 SHA512 SSDEEP

Submit Download

icons_ie8.gif

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_ie8.gif
Size 7KB
SHA256 48bef6c22b81a89898ae16237c512c48fb77830a4f19e54cdde65b07084834d0
MD5 a9a94ebcfeb99a9707b0aff70b73d17e
SHA1 f2df49795f502ae4cba365d5e6e34e3f2f0a69d7
SHA512 b924d1563252fae28494b7e66b2c58701be83b1a00f110b05b07a289b58e72c352616cd236aba428fb02ed08b54dcb9989680888b16e4d31e9248e7f01e3155c
SSDEEP 192:dHz/0Lx7eToUT8FWsNG3TEh69xhaX5DbK0d:pe7UKm3YhPB
MD5 SHA1 SHA512 SSDEEP

Submit Download

icons_retina.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_retina.png
Size 15KB
SHA256 3b0a59fec9470de923d4a8b1d7159f19968f1d61148d5ac5808301a77b96754f
MD5 5433498553d961749ea31afa95642cee
SHA1 cb6e01b638165bfcf40d383d9edc1d4ed101b25b
SHA512 5e95709bad6443e80f103b3a4c66b1abdf6cceb474f16564d49a15a9cefa6182e2b92ad8bd2f26951e2b7f966de3c64ea5ed9391c5a10d4aa50c1cd4490b7e10
SSDEEP 384:TpeSbQ5oC39Guj+txEt+EJJbwFgeUblXlRm4hOAZYVro:TuoC39GuKAtr/bu1YRy48AKBo
MD5 SHA1 SHA512 SSDEEP

Submit Download

new_icons.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons.png
Size 8KB
SHA256 c6a140d88cb979a7418345591e3e78bff7e75cc8e6cee6df5fe085131e208551
MD5 4c6187577cda37cb1e0e9b02a4bb4a3d
SHA1 213185e8b41aab40b2c8fc62136de71270fec45d
SHA512 f25904c08452ae3537f2d188d4454111354c5ecf0d9a006cedc99f44ae8530763212fbe007f92effe2044a14b942dc2253d24e452c08a047bb5caea2c3a3d6b9
SSDEEP 192:7dPacIdcK/SdbqOtBoGFUDL2uIR6XzhiK8KHoY:RguKqbIo+J
MD5 SHA1 SHA512 SSDEEP

Submit Download

new_icons_retina.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons_retina.png
Size 17KB
SHA256 ce4d04b35198effdd0b2fbb7277d70f272609390b03a576019c8dd1b074eca40
MD5 833630444e15fff8aeb5c059947de3f6
SHA1 a7ba88f76c29d303ac95fdbe40e1f5c6f3fb08d6
SHA512 5384f8e7c6395770955aafa16ce253db1940ef29be2d0c15fe5428cb0c43f5b1c631a9e422bdad9ceb4c25266703294d030d6c5dfa6ddf4042aa11860e3ccb0b
SSDEEP 384:Tlo4M8/OHoV6Rcqk7gpxixIpRXs0keUYIsc:5H6oV6Rzz4RL
MD5 SHA1 SHA512 SSDEEP

Submit Download

bg_pattern_RHP.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_pattern_RHP.png
Size 179B
SHA256 65f36f60eb084d9e48ff86c19d70072a2f7a42fd7236e1f48618d9da6233535f
MD5 72205b6b59a01d46b015997bd95a8fde
SHA1 e1747334be752cc132acda601e2999e40206f446
SHA512 0b9b46b731c5f39aa89d5f383f36e8f547d2f22512e9a83f593b122afc39742b5e4b8492eebfe0ceab5b5aeb8ed04b4f79c253f8c817461a150e22a39787f27b
MD5 SHA1 SHA512

Submit Download

bg_patterns_header.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_patterns_header.png
Size 703B
SHA256 01323ffcbfbf5a707e2ff41626b5e204a5ccfc349fcb82c01ab32daf62357780
MD5 55c36e39e76ae90f72071ac312e9c3e0
SHA1 91a183dc648357d430b974725e704e866f7f66cf
SHA512 2648d8d0f6f3e4c9a497ec6d00c53eed22c332b49638ba8c1d3e0df86a1e3665337358b6441edc46bdd4158b377422e63582375f6395910a51b84c5f16135989
MD5 SHA1 SHA512

Submit Download

illustrations.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations.png
Size 8KB
SHA256 637594d86ba8932f36c398ec5961edf6ddb05bebf31dc3c779c792a21d2b6b79
MD5 6a86eb8e669900087fe12bddd7f180f0
SHA1 70780d730fb125731ce81a32bc2f26aaaacd1773
SHA512 0a5848d0bd7e4f39f753df7dcb36491eb6f4ae083cce916724b799c10815f366b845fe33b5b9e40f42b2b7ba23c097eb0dc411c286cab2ad2402482633113974
SSDEEP 192:rWZhpT2neoksbWChDpk6jkZ7TrCx0+UZVGEf30m2w+:gjTEbWCBpk63yTVJkmH+
MD5 SHA1 SHA512 SSDEEP

Submit Download

illustrations_retina.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations_retina.png
Size 19KB
SHA256 d44e8004172be167d991a8e87c2d0e4b3c7cd27d18b3890aedf92282b8ebaec9
MD5 8caed08d01df4da439502e1c7b4d2063
SHA1 7e3349fca88010d28cbf97e7bc211c0424125f11
SHA512 80c65f26c91ea83a33cf472769c677af76adf28dc8298125d37f61595c69f9e70098131a7ed3991879f5238c7baa6d2d0ee3b07670782d6c0663d6148eb6b5ed
SSDEEP 384:/iFCrE1N7vODGOQHMh8wjHm1dsSsX44qObhUE3UxCSUd6+oF3xWmoEElG:63N7kFQ+HJ9XNqOqEkx4MfF3Ym4G
MD5 SHA1 SHA512 SSDEEP

Submit Download

faf_icons.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\faf_icons.png
Size 6KB
SHA256 4e82c8566c2b923ad297c96b589c867cc1b10348306372a8b52d8d605e762274
MD5 3927c7ee398425302c1390ecc6630e9a
SHA1 d6414cd810f7b11c3d17c9ad2c8cf715b529c454
SHA512 3ecebba5f0ef45cbdb3773dcc9d5e5552fd65fba7b3774510264795e465249bed062f18a2f84e5eb1acd639d7a8dea8673734c8fef2e6d84823ea57291d0afc6
SSDEEP 96:JwxQANMhqgw5LGwc/xEXOdv/iMVAuYt2RetgiCgBfz0WcN05w+OTD:oNLmw+xUDMCztQetgiBfPo0zOTD
MD5 SHA1 SHA512 SSDEEP

Submit Download

bun.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\bun.png
Size 2KB
SHA256 e67bdf38734b99ed5efe3fdfe5e5e2e15e1c925363f8be6b326cb6ac8d6c897c
MD5 08f27da2d57324a30c36ad93a16dc31c
SHA1 1b5215b4e3e0ec24e08847543c949ab97523095b
SHA512 f1c723c9aa88335e9768d0bece207257061bfcd7b2607998942d7f82c81e0020ad14d31c43561961b5d20f32c8d7099f5a19d79615f1fb1d9e57c40e9d990fd6
MD5 SHA1 SHA512

Submit Download

cstm_brand_preview.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview.png
Size 2KB
SHA256 b3b6bb2fc8d398bd8737239e3e4b0fccb0d85bdf5b89cf2fa27b4eb40c083c19
MD5 685ebaad42af8104f37d42ccd9ee13d1
SHA1 c20d06639887af086fd38ea27f2dbdab26ce4f5e
SHA512 dbae07387f102da0dcfadbcdf64d0bf19987776a02e5362783750533b70a82268bb002e06e1c7f4bce759eef7a809c58c01882d34ffbc233c57b8d83800860eb
MD5 SHA1 SHA512

Submit Download

cstm_brand_preview2x.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview2x.png
Size 4KB
SHA256 c1ec0abbe587eaecbb47b02fd91ffb6ca6a439afe6e7e33f438c9fd0041d49b2
MD5 432567f9685007a97361a1dbab9ec3e7
SHA1 48970ca6b3b44dfdf4b365de80dd5040e0e4c13f
SHA512 91561df374d495bfbedf91029d6d158510de19c7ee0a7a81b3cbfe1cf143cb9a52d32a2b5608c0a272e015af30994010309b0800cc768e3d6bd4a9a5c6a57081
SSDEEP 96:r/K+U0f/su8tm4UMRdV/XlM9S1SiwSKmD2EIpYAkr4:zKF0f0uim4ZpXlMG/ofYLk
MD5 SHA1 SHA512 SSDEEP

Submit Download

dd_arrow_small.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small.png
Size 289B
SHA256 d6641f8e0eb0503a7f0b35b80bed41fc4dc9acd2e062f0d3b9605c00b2fa2ca3
MD5 ad54b31ea4927df0bf637c17fa233101
SHA1 1ff1ac76a40ad0884779f2b057bd71e249e805f3
SHA512 04a2eeedafe23af4fd4065d3f3818c59af7378995ac38e7a6fff1eb0f257788d9370d108bd4dea580655516660782a452e78de9406bcb9d4f6e6565f522c8cdb
MD5 SHA1 SHA512

Submit Download

dd_arrow_small2x.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small2x.png
Size 385B
SHA256 43171472fd86a23acddbc4e32b0bf5ef7e3033ace7bc850c4a36bd4403e6ba99
MD5 9168e5415ec731c416db96cd47f77dab
SHA1 294dbc527f6792dc8e0ae35b1670191c623bf901
SHA512 e15d5ead1a8190974a35983719e3ca65fe1ebda640344c151fa907c194ba1ae9ec2b63993241c09049cecbf2e601a5087c5fdb5022ff5b0f8d9c27e8354cc33f
MD5 SHA1 SHA512

Submit Download

illustrations.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\illustrations.png
Size 4KB
SHA256 bc0b232692887b73c028e78dd68c5bd1720cdd332a565d3b222f6da1e9992ec1
MD5 1f57aee3ae6b7c0184bb3cf69a436aa3
SHA1 b114eb1ef389aef9582ccf17114b5c03bbd65bf5
SHA512 3b99ef71a593ad2203c23738ee17bbee59368e2221827b9b0ea43265df2c3f66ad351c9152b79af9a22cc3625a36460489ee89c670c4c85692f29bed80ddee54
SSDEEP 96:f44R6wTQOJtlrl95JlbbSQegnSk1GJQXNl1NmAP:Q4eOZrl9R+Q7SLJkNlPm+
MD5 SHA1 SHA512 SSDEEP

Submit Download

nub.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\nub.png
Size 1003B
SHA256 3cb07497127110138b2aba081b1124f2ada0bfb71f99b0fdb72bd07dae4a347a
MD5 d622398318e26af9db6a269b6e889360
SHA1 c250c73305b6138cee50b5c83f671940fc66c931
SHA512 2e40e4625e004a831e953aa5291838156397ebb129d1fa0959f2ee83e67f41e2b46b4f6f764a9fd3dfb3c3ed2f3cdfeb71cc9c2b76a813fc0214c251e0caa312
MD5 SHA1 SHA512

Submit Download

share_icons.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons.png
Size 1KB
SHA256 e4f8b8616dc6aac513b2a86a2248af8e4f3240a8adb3bf129967f68dbf233036
MD5 22bca8218364d72e9418021e197775e5
SHA1 bee5669c232de35e4c4ef474c06678bc38993b7e
SHA512 3fd69045f68fda6498ff7a259a97459b7c3296cf214077f6364c247f581423d2ec08c8b43ef63e464efa0d045a7dfc7ab976e2e28934442eedb4153473193293
MD5 SHA1 SHA512

Submit Download

share_icons2x.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons2x.png
Size 2KB
SHA256 01db3fcff1f1bd4e5b64d4da3f187e515f48296fbf155d5f0e3da171ceed2d14
MD5 377765af49ceef0140604c4f8688291b
SHA1 c6fbe50d44a3412577de601ffe56f02f42c9e31e
SHA512 fbe862abb0bdcef8b7c761729aa1b3070430c4854d6e19665b9f60a587ee765d3e84b04c12621d2acfe2906a4866411d9136c2f46aa6bd5e172fe291f1a38200
MD5 SHA1 SHA512

Submit Download

adc_logo.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adc_logo.png
Size 3KB
SHA256 02ed7b3e343174d1f0b449dca9a56adcc472824e164bdd2a65cc62f3de97a69e
MD5 6c1a76e2ebd3d3bc847b2fa86a510cd5
SHA1 61d9b44520a079d9f331171927896482c768ca97
SHA512 b99c334189aea5913f592647174f0e2d4fc3e5a0e9850bffc4f004b32555aebd6f005dd24efc482811083babce79967ae83e6e58d8b249e9e5dc0a9f2f183f6f
MD5 SHA1 SHA512

Submit Download

adobe_spinner.gif

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adobe_spinner.gif
Size 556B
SHA256 6982af8b0f3c32a1f9b2d7b65d569dcf4b76b8a3d361b405e47142c134d06e82
MD5 59101e15d9bae97a6816a444465fe13c
SHA1 76079b934d6e6b1d8613455ee899028dd24ea171
SHA512 64ad3b78ffeea94754428bbf0031cd2b32758d1683e91770f1579b9f44b7d47e746c200aa62a495f6246e8bfb620be92c572528875c9b25c36404eb3a9931b5a
MD5 SHA1 SHA512

Submit Download

logo_retina.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\logo_retina.png
Size 6KB
SHA256 81d84cbed3e80ddf044f14fe29d2bae0eb5b7b4d68fc60f12ae47f8d88f3feff
MD5 7838019c0e7e9537e69f47563ca7572b
SHA1 89b51da3dab1680c7b049327d029cad175cd678a
SHA512 06ff83592231098fd9991424a9f4c0ac115ddc897f3d07844b1399bf171c0eb8f41b01de2946f1bc32817d09e0af1e91bb8a8bc5868117aa741dc791a4fee06a
SSDEEP 192:iBJlKpc5XLEECYenA5i7y8JgFlz9RcHNSjCtDwvOu:qH5oEDNR8+lrzWSH
MD5 SHA1 SHA512 SSDEEP

Submit Download

sat_logo.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo.png
Size 826B
SHA256 6b073051d26aec2ab1cd4621a03d80a9067df9d32a83e05418dbea98bc4bbf16
MD5 a1b817368f7d9cac1baca67a0bf4ea5b
SHA1 c332a8d6e9da0d7e64e56ad1e6d9e7d569d5dafc
SHA512 a324389cd3245773593ee9f24f69741787b527638111851e66d4154b557d4f429e1e49b40a4461752fb54f9131fb44809b32814ed99adb838294a0058b77bcb9
MD5 SHA1 SHA512

Submit Download

sat_logo_2x.png

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo_2x.png
Size 1KB
SHA256 c8da348d101ee57dc01a95198a543b8539ad920295bbae23ad6500718bb030c0
MD5 1fc8bc5bc74a4c01ff45979d1e22ae75
SHA1 466141c9666ab87dd9fd64b325c102de395699d9
SHA512 154dc4ed6734b479b2299e13f0c3340f0aca04335572550583c74e63030b88b62cf0798f789756fdbb1619ac9f21d475bf106bf84f84f147cf7374e096ff0f05
MD5 SHA1 SHA512

Submit Download

DisplayLanguageNames.en_GB_EURO.txt

Path C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB_EURO.txt
Size 32KB
SHA256 7b662d5e0aac590f9621ae3318abac9b40a8013c6f0c4c1a728cd74e894290b4
MD5 0a3b1a1f61ded8573082b9a9ba1b859b
SHA1 a3d984ed16830c8c2c30792a80cceb928c3f2522
SHA512 25502c0afdf0933e74ade172564c3886962d0edc75f7e669cfe871d078fcd70b498687adb7a471305ad33df621b98a87e04eff09d5a1614f1f764009df9b2cd4
SSDEEP 384:lCui/e9CWqkEEL7xAuAHsPzcPpn9u1+Z0rfNRtQ3imQ8CxQ97WtD9qPRspLsW67l:fUSEn3xCD45IipFrYCOAUU
MD5 SHA1 SHA512 SSDEEP

Submit Download

ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt

Path C:\Program Files\7-Zip\Lang\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt
Size 316B
SHA256 da83c9f23168330f1818abf1f4c4142aa193a4294392bef3b5cc0c8086804f72
MD5 2c8b6a90f1754cc90d8aebe64d702ab8
SHA1 1f6fbf21ac777614a0d94cf08046f412e24b65b4
SHA512 04d01969fdb7a2cedd92c4bb727c565053d440ed34b2b175f6d8fed5d444bac210f319508b54e47a3b92fa4b9585822b8af58000369bb0c1daf0e539f1fa5fa4
MD5 SHA1 SHA512

Submit Download

win32_MoveNoDrop32x32.gif

Path C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif
Size 153B
SHA256 821f6f72e6ff8d8288b7d4cebf6d02ed7a7c5a18114d3e8e809e7c46e18292a8
MD5 46db4b6d8cd499d54ae597547b1dba9c
SHA1 01a61ca8f8a6f1ff65c9013f7738332b3b772d02
SHA512 3196d16118b2c2894bb8467b2a7b237076d31943b1c5a6b659347a1b4d9d6163221fa4ff7fbcef56e2e5c0ca478b5665d94b542d72fa841bc5f7241483baba50
MD5 SHA1 SHA512

Submit Download

THIRDPARTYLICENSEREADME-JAVAFX.txt

Path C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt
Size 190B
SHA256 79def6b2a95cb5752a84b7d5726e28b63b58ff3676c586e711b1fa4fb6ed3862
MD5 505d6c86c9fda8c8fab73608214e20a5
SHA1 dab126d894b635f29e409a1c7c643cca9d065ad8
SHA512 8b0a11582a45d278baff08f0f1c176eb2247d8473217150132314f64f0246ff86ab13e68e0f6b1a95591be5f972f2b4819466930eeab36fee7df8fc3f2bbbde6
MD5 SHA1 SHA512

Submit Download

THIRDPARTYLICENSEREADME.txt

Path C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt
Size 190B
SHA256 c3e83fb98da8ae17b3fe1ac01de2a80cc63bdd44ff9becca7de5f6371f4f0165
MD5 761c7c97ecc738d53b846a1a31745d55
SHA1 25e679b559f450c6a8be5aed4fe8923cb34a9cdf
SHA512 f6f97975b0324b50e8bc3b8b622a9057847aa2477048eba9b0dd6cc2a51b4dd978173b520e8d247813f3cfa8d0bc94e283e6707cd405ca7769fcab0b4dfa9589
MD5 SHA1 SHA512

Submit Download

directshow.md

Path C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md
Size 1KB
SHA256 bc54f3b4b466f3f86b6a8e9754ce7e403bf2ffc633493249df55aecf0c790113
MD5 3581266aa2b9e1c46394ba9268f77cd7
SHA1 11a505df1e481c21e7b0fb7552296ff8cd447a68
SHA512 7be92432d6ca4d97c18c2306a155d1aeb36dcc08f2e98157bd6d75b7e0b8c90e33f89d960215ec118e2fbfa45344b006f3bf3f14bc41b3391ced98380ce84141
MD5 SHA1 SHA512

Submit Download

glib.md

Path C:\Program Files\Java\jre-1.8\legal\javafx\glib.md
Size 31KB
SHA256 2997f3caeec914c76008e370742f8aa18975c1528e61099e5599ad29778147c6
MD5 3844e7413972f5f6116cdfbd3362bcaf
SHA1 311d0179b85ee098c402207111867b99bee48276
SHA512 9fb9aad636decc88cc35ffd41ab29cfbae15fb8950b60d8f011ee16b8f6391e216f4007c59f8467704741183ee5b3124fc1cdba4ad62ae237c0d58d274172e61
SSDEEP 768:W3Dpamh8Q/QX2Vf3DOOT0O9EWc0G9KIVVdx4q2A:wph81GfZ0O9/c3F1x4qV
MD5 SHA1 SHA512 SSDEEP

Submit Download

gstreamer.md

Path C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md
Size 34KB
SHA256 f4066f253046f3c12c2b8520a314b2536778e059d3983aedafc2f27ab8aa32e0
MD5 f9e2199580b5f0b3aefb9c92143a7a99
SHA1 1cc5a903b9a81a6b88304c1b5e85bff8af003feb
SHA512 a1d4fc910f7d1e7e548b836150b746e93da55341fde1c85b5313b903d27e58fcd3020d5e701a0d98dacefa0b2db9aa65ad7dace1f209322863e1f616e04d4310
SSDEEP 768:fjyeNbQ/QX2Vf3DOOT0O9EWc0G9KIVVdxgLq:fjyeJ1GfZ0O9/c3F1xgLq
MD5 SHA1 SHA512 SSDEEP

Submit Download

icu_web.md

Path C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md
Size 23KB
SHA256 d58a9e3d6816471d7c99acfc769423fb07abae955956b0143cb9034e96799a36
MD5 846906df8055fbc10de016958cc35ded
SHA1 f445e20fd6b0ab512f040a5afaacd7f248becaa6
SHA512 8706930b1aaf379f47f4a72ad4808575cee16f54bf987e0654950984cbc1c669ff6cc3f4dc1b9600e4c97d47a721c9d370497e3d82d375188cd8a315ee1f38d0
SSDEEP 384:Ia0cF8xAAAAAAAlAAAAAAAAhhXxo71AAAAAAAeHaHYmgfThd3Ktx2KtwpAA3wAAe:n8gRFxo74YlPqcqEa9vuIqwAHgdeEobX
MD5 SHA1 SHA512 SSDEEP

Submit Download

jpeg_fx.md

Path C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md
Size 2KB
SHA256 e7662a2c25a7a8a22df9eb963b028eba53a41f406055822516f6cb7e40bf1f1d
MD5 e01a9da57884c217a1f7d5a70432c264
SHA1 90a94e974dad2f1d6623a0fb66fd86cfec6215ee
SHA512 a400b08e15235a1b3647c3d6c788e447d27573da483c9345df0a6526c88b91c41be36d70952a2fa1e0672bb1cded1d8df4aa6147d4e44c1137b8bf78f0acedc7
MD5 SHA1 SHA512

Submit Download

libffi.md

Path C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md
Size 1KB
SHA256 9b160bcf84a3e52384bdfc0c251a74072e3a524d80fa1a89196b806e380b1299
MD5 2735cb5584a85fe77be1217b65b3e571
SHA1 02b651511d0ee63d51e6a1f8829a93371fd6d936
SHA512 e1ce04c3b65409a0e1e8264ecebb787ab3e051bfe5edbdd6126fc472666619f5175c69229f93d5f4168cf2e1915cb33be3f1694892dbcaabaf79c20b812645b8
MD5 SHA1 SHA512

Submit Download

libxml2.md

Path C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md
Size 3KB
SHA256 59df3ee13f705809611a9e1153eafbeec2ef2cd488e471dea4546fdb91b7cfad
MD5 62671d0594f768c0a4dc622283338020
SHA1 4780c56a6e0c9b16354d2b6b043727adf2048ef8
SHA512 1828bdf357a1f75b57070b4c9546788e9ae6952f5474083ffb2e36b73807ac664c7fb510413f9a6d8c511f98f05a47847205ad0b578afc924cc934049b3079c9
MD5 SHA1 SHA512

Submit Download

libxslt.md

Path C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md
Size 2KB
SHA256 1dc09b4295e8281d0a0dcd5b6c54e86a872a0850d94fb9bde7982d7911ac5fd2
MD5 6c09b3ac469711bfe7b0bd6623fb8692
SHA1 a4b65c3e757af3f042e5a0239afd8ef7080b5c9f
SHA512 1c8477429827c1b54df39f2ad034790da6bfcb41d2c7eef65013d850c0a0fd1f0b1d288076a6a71ef63a486c91f1fb2a00c9e939bd224d6b368414c6e5f0d229
MD5 SHA1 SHA512

Submit Download

mesa3d.md

Path C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md
Size 5KB
SHA256 2c51fa998fed4cfb526d49f69c459450c74d5509b47749005ab4f9e9388bfd37
MD5 a232a42201395463d1d3eb0fe4e8f7e2
SHA1 2673aae592cafad4a1b6d03fc37e59139e3a2609
SHA512 f55db51df4d377ef43a8e8664befb89e90363ceb16d14a0376a13b8c82708abfa7ee86da0689cf32d1ac856d7e3eadcbe6f29feee09607976a55d8e4578ce5a7
SSDEEP 96:Oe7ZkrwUDnY70Mej5ztX/+XrFuc13+vaDDTb3d0bH2NMCDaFgsQqXurDceiZ+:F1krpDnY70NztS1OvordAknaCRqerD7
MD5 SHA1 SHA512 SSDEEP

Submit Download

public_suffix.md

Path C:\Program Files\Java\jre-1.8\legal\javafx\public_suffix.md
Size 17KB
SHA256 378b8662f146543c01da0d155793ed443e109171c6a3cc153fe6610949717d92
MD5 c509cc04fb5b4f5d51a056b20b68c73c
SHA1 c63c70ab25e0b0511af35eabd8ddf02a754b9f0a
SHA512 33663a8bf1adbbc0c9c62fdffc6123b1071de575c717e8e461e81f38a2ed62061ca6fafcfba308737c3c61f8173fc2edd4fcbd918432fdbb8d181c31dc4afc7b
SSDEEP 384:g5SN2Mu8JQbnMEOAiXQ9Vfedy8GWoDDRyAIptRgI4yXSYO:g5XMNip2g9VfedW8jnCYO
MD5 SHA1 SHA512 SSDEEP

Submit Download

webkit.md

Path C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md
Size 320KB
SHA256 355cbd3ae4f14c74dfbf4bb30dcf71af7bd12969c001416bf0eca93ec584fa0d
MD5 ce5a74e22a10fe4963574851439ad605
SHA1 30f279158ff16da6d0b73577a060f1eea877b779
SHA512 2eb9c488d38408781a5f93c6014642929bba72bbab09cf53682cda66f2fed953abb28b0811fc9a258eb3e96868c7854428f32eaef22e5f876680bbd80756dffb
SSDEEP 6144:mn6O6/YWuyIlNPvAq7WHufbVanSzVrekZhRAs5iuqQs+T:C6fYLvvPoUWNSleknR55iDO
MD5 SHA1 SHA512 SSDEEP

Submit Download

asm.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\asm.md
Size 1KB
SHA256 6079606c98f98e9a305b548d644997c2b842c9594f3cee15a8c79942b6885163
MD5 a16102fb27e73857887953f54fbe5f69
SHA1 f35d6c302bc75817c5db9ac7779285d2d4f08897
SHA512 1830355eef9ad27fe05aa210f9a17104ef09505f8e901a0477d57476f102805dc532a56553bf82f4e0af41d5eee249ad018f2a5a4c53dfdafda86f5b749d5274
MD5 SHA1 SHA512

Submit Download

bcel.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md
Size 10KB
SHA256 245ae721dde12bdd1fce4863213a2dd79606de42f6a0a780aee35923105a3373
MD5 82674ef797105e44cc224105fdc4278b
SHA1 c5434b762e3f2cbbbb0af88163141a8faadab461
SHA512 8a95dc6ca763468521c897c495b425e6324e8b2953bc53a941cca9c18fc6388ae6d9dfb377be9f64187c47fd21fafe7233af88b56a05eb552246edc8fca1005b
SSDEEP 192:wRDLGgClpQPEUGM0uD7ruWi3IApmyKrQWB83joN9AH7ZHqFlz4bcKM9vOJ:wNGgeyruWkItQEgeK7wv4o9k
MD5 SHA1 SHA512 SSDEEP

Submit Download

cldr.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md
Size 3KB
SHA256 b107d398d4fe338b569a219fe989679874cbf1e88d2f8250ba36d7c69b045f5e
MD5 ae91a51e451bb5868b665ddce39140cd
SHA1 0c77a95be2604c0bfec245edb895302275c88bf1
SHA512 c0f4ab5cc758b375cab45ef61a158af0c02eb343384db1031b6eef526e86b16203a2035d8db79f90e76f6d8f423a775fbf9afac4ef2184ca0041712faafa630c
MD5 SHA1 SHA512

Submit Download

colorimaging.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md
Size 162B
SHA256 e4279866610ce08bd3ec4758b3fe6bf29542af5cfdd1b2a9c1620519aa4afdf9
MD5 af54b57e176ad886dde60cdb093d051c
SHA1 1ec26be923ac14faa2596236221b2998e18c8bfc
SHA512 2a2e93c1db377323aff8be68a1ecb84c712b5574e92f550a6d3c9417a48b97f92d4b6afaaf84cfa8c713cbc5e4451866fccb1b271cb7344666427e4536c51bc5
MD5 SHA1 SHA512

Submit Download

cryptix.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md
Size 1KB
SHA256 1ca01ac94e25c95630bbbddc1aa208d954340e61b0f617c893bd29be2dd5cb6a
MD5 91f04d741c426b5bba762559c8734db8
SHA1 1a345850ec8310119a9a57a9eec1785b5aae0b0d
SHA512 de2ad0abbdbea515964cfd4c80836bdd7a2383d6c374cdb5f0c20671680d53bbaef2336f6704b926c0ff2a637f90dcfa530877e7c5919fcc20d053e50760b39b
MD5 SHA1 SHA512

Submit Download

dom.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\dom.md
Size 3KB
SHA256 e97897762ec26c6ea7e608c6a13fbf622c254baacc7e9376f6ccdaa6d1432f3c
MD5 6a8160ee8c75f59e70a227c180949b8b
SHA1 4b49fbaa899321a7b34c0707e1ef20789deed422
SHA512 59990e1b0b35db66658bc7d570830b51e6baa8869c43f5dfed0d364860c8d97ef42ed8f09a378a5d11fea55c0205079ed32b528d55accf10e88a87d4c09c2433
MD5 SHA1 SHA512

Submit Download

dynalink.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md
Size 1KB
SHA256 00d2458c1b8dfb99173bb3f165e4e667b6965adf1413a49329c3085643e7466b
MD5 92c2b27341b7a3b1f6d4d2c8f37f20e4
SHA1 6030f6e2a2a799ca2d339ae8e1ead2480cf39ed1
SHA512 4e9c13400bcb6380d823bf158bd07c970b8be8ae71d7ef7e7c3bd14c5c892416e4301a44a948c883510a564c86a29afe681dd8175e015c67c3064ed4cea9b9cc
MD5 SHA1 SHA512

Submit Download

ecc.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md
Size 28KB
SHA256 8bd0b5a7a875cf741068d4028108e0af11d304cc889cae8a7d4f2c87e7dc09b6
MD5 b3f2de9167952549ea0b67e7ea610017
SHA1 804f8b132bd96a711cf37566e5f2a8dc12a096e6
SHA512 4069eaf11411c7045c71ad1b60122525d8c9ee25cb5e09643a412f8ba7b43b0ff33c2c60eb638667e0b14b0bfe688a38c04d67b247d58d2a4325e1c9c2ee3912
SSDEEP 768:dbtNg2NyyrmbpU9L06+HofGS15Dx43j9A5WBPV6LUtDegelyylhe8:TGjbCpQHb3j95BPVs5BlU8
MD5 SHA1 SHA512 SSDEEP

Submit Download

freebxml.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md
Size 2KB
SHA256 e2de319623b85a1f80d9b30acc6baf788e4e9e43c803d9b95f5feb9c5ca94a7b
MD5 dfa1848486828d740288a9823382016b
SHA1 d41524c480bdd15c844f47c29ea38cc89a897b4a
SHA512 b60b27e61cd3afb4fa827cc21198cb2ad66d5cab705241c5d996b259903c9d18074f309f7d8d33a60bcd5b2b299645a6b2d8a7cfc5398ef04f7187ba035f12b2
MD5 SHA1 SHA512

Submit Download

giflib.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md
Size 1KB
SHA256 f2a1662af53e4672ba60276ce53a47762e306230f4fc32df00887b05b73a27b8
MD5 650f561e8bfd92f6bae2d028afc91c25
SHA1 516ef8f980e8e8c0a677afd2728223ddeb052c69
SHA512 2c6f5e9e2074f2d98f71cd73700cb8caacb8bb9630522d30420bbfaa523eaacc8b3208e7a4412f4fc3548844e7baa0f20639814d1208b6b99cccb02ad1fb0215
MD5 SHA1 SHA512

Submit Download

icu.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\icu.md
Size 2KB
SHA256 c32a5a3002c640a3ad44497cc6e9f51350bd792ac9c2fd4fd92ee220d7c1a823
MD5 739d78de004ceca488b16df5992b6257
SHA1 cbefcf9fcfa9a927632ef5560d5f53539d29d6e2
SHA512 8ab75a0bc983c22e23c2b4dc56e5cfbd624b18c0aa6ee963e90bce786b7f4d0d122c268ab1f0b84c456d2cc025169e035c47ead9561883a18a1f66612d39b96b
MD5 SHA1 SHA512

Submit Download

jcup.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md
Size 1KB
SHA256 b36082f4cf2e3ac5193d15b55e35285ea2643a5a66237b18554da469da9417ab
MD5 94635f38fd9189223933d23449f0b682
SHA1 f4d371db1252dc0088a4137bf416c364438ade16
SHA512 3d05e9c514631d8f6b375907390e915cd1d39c8a4ad61609c2ba42ca5a424df8a4f6b4bc4c5c94b4e282a913ed9a3e616a889e1b88ed31ad87211863746fb0fb
MD5 SHA1 SHA512

Submit Download

joni.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\joni.md
Size 1KB
SHA256 813eb1a6afbd38453721698a1556ebf36fd3a9d0fb49fa093722ca44d9a5700a
MD5 d1ef0ca24279b03ca760f7bd431d0a35
SHA1 4d8514e68e07477a6aff6576f489581da41d7da8
SHA512 4d453936f2b0018ac4b28d77f37f6f7ce84d79632abcff1394228b0316a20901037d2e71244de277aa027009c5f7eb20d8a1233a6748bbec186b3ff8fb41c9ac
MD5 SHA1 SHA512

Submit Download

jopt-simple.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md
Size 1KB
SHA256 8113003dd2554af4a6d7f485921d9b5a066195e61005091f537a418d9da147e6
MD5 3c92ffa5c3a8a39369d66da9954b99ef
SHA1 c37f7308103ca08572dad1016a4a64bfdd98d7c1
SHA512 4d3829d9f5bbe0f4711eefed1a3e1a398b96c00da875e0b83e8a783f4b8d08059169f2512f9d44095bc91cff08f97a747373dde7be75acebeff6ecab8251effc
MD5 SHA1 SHA512

Submit Download

jpeg.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md
Size 3KB
SHA256 c0a5549aafff471362a04ac6f82a0dac05b7121841c09502c9fd2ffcd64d04c5
MD5 531aa95de7360a03cc8b9c2fcbe2ee67
SHA1 62262120f0ed3a0e0811d195a7aa44a904f46cd6
SHA512 943eec4dce34c36159fcc249e783df241bb454d01b85475cbc4b2613d09d18c19f0be4a82d1fb56654d24dfb0e3808e8fc2ea6521e17c9791bed145c4e911c67
MD5 SHA1 SHA512

Submit Download

lcms.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md
Size 2KB
SHA256 3ac6b7b4a75f46cac8d6a2100d3ae26a2fe54231b456b14f59d3f5e6be0adb7c
MD5 50aa9094de89ac9116d143e924865c86
SHA1 23a765520e239a1550870b9a71cf4f5e861e21a2
SHA512 497318f0660fe7763c23a05a6fb09128b1ab97e7f91d78147fe1a04e418c31ce36f726cd8490ec45e4573c6ad4d20547cabac112dae7348cb593bf43f6d6d1b0
MD5 SHA1 SHA512

Submit Download

libpng.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\libpng.md
Size 6KB
SHA256 5ceeecd0c0c673d960028145645bca0bc0920d289d2e55a86146ce40b2acd5ca
MD5 0e9ae035cadab72ed61c8c28163d3642
SHA1 2dafc2c3ce37c09da1236ed32d89765aba33135d
SHA512 ecf0ae13694a2e9ba060aaa2c519fb4310ed193ecc45cf5b6039a7d7d08af33175befb63f00ec65c209fafeadcfbf8da42b3e9bc8fe0e9a993f81f3ac746d2fc
SSDEEP 96:A0zcccAqo9tgtvjpFvCdIcccccccck8f5kHsKWqr18Dw+KLpzBED9sVA1eG2xW9Z:jqo9tAvjs63qr14KTM2VA1e5W9j9X
MD5 SHA1 SHA512 SSDEEP

Submit Download

mesa3d.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md
Size 5KB
SHA256 a4a157b7a91f639d5a95611c471cd0cc7cd32ff7b046a6059fe17a43b34ea904
MD5 751d5ca93c0ee1187dd58a82160bb2eb
SHA1 2bec99316199ad4a0047e89d65b1453a2924110d
SHA512 9e1d0eb5626d8e0dbdfdf1ddd93f251a4ce34bed8f29f2acc1063155f2e93f865ebee346064aa4d1f7a09354eab7ce9c571fa66f1ca7315de867b6e1f870c208
SSDEEP 96:0e7ZkrwUDnY70Mej5ztX/+XrFuc13+vaDDTb3d0bH2NMCDaFgsQqXurDceiZ+:31krpDnY70NztS1OvordAknaCRqerD7
MD5 SHA1 SHA512 SSDEEP

Submit Download

pkcs11cryptotoken.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md
Size 3KB
SHA256 2234484ba1f88cb3f4be306e496c7c56a1a5e699191e30fb46bd3426ac832204
MD5 4b419b0249943cceb1ef002666db67ae
SHA1 369843e1ff22962ed8631272466d8fa90773fad3
SHA512 8565e906f9e66dc9068743ea1a6bfaae0a0c923d87745bb3163f790f88297b77795265a7fd25b8045783460c4aee53c8b15bc420940699706987186eb0863d1c
MD5 SHA1 SHA512

Submit Download

pkcs11wrapper.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md
Size 2KB
SHA256 67f5ad41d64bcd1a3d5496a3af93f1178b3b04e61812ce0d0467b818c3082e99
MD5 3a691ccb9899aa90e66eb10110067bdf
SHA1 66b0af4865bd400cbeaccf3adddeb158a6882349
SHA512 712ff6085596ac08e1dfa1a7753152a23a659ed2ebfd0b339588bbe60efd33b74fd72b7b76d7ec658f5e92bd014f6d4d6976667f922c916d8fa2bc1ec31a17ed
MD5 SHA1 SHA512

Submit Download

relaxngcc.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md
Size 2KB
SHA256 65818b0d7f9ef0b03c28a9b6dc769a7b230382515c8f3d8de5ead008243c8199
MD5 d9983a44965c20649313d8b6a750951d
SHA1 a848c7810ac6c339dc62a58c47a774e8186d6025
SHA512 251eeb66dc1cf0dec971b4e3e0ddd4e3af1cf02f557f81ee70a552d5280d02d5aa817acf5b5499213b58487fe5af425202d3e359979664880936b15c7028fca9
MD5 SHA1 SHA512

Submit Download

relaxngdatatype.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md
Size 1KB
SHA256 2ca29228a8225aa8ab6d82c424dcf125c0650167894d00b5311a4d0ad54998cb
MD5 ef8f0affd022d5ab810798edf7291f53
SHA1 6fb47376d2e40560a68373af9f0a3d0978a10c12
SHA512 ce4e5a2c7219c8f8a6f4b5735a7800c6b8a922c2ee0aa9e24951c76334dae187f9c4ad8b03111db6fbf0012b990a2ca43ea81dbbda59a0d06187df42e6336349
MD5 SHA1 SHA512

Submit Download

relaxngom.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md
Size 1KB
SHA256 35d30e72908cc564171a4b7349997a08a004f7c4c2d0bfbe8e68886014f7a7a5
MD5 4f62487d00b3ac16aa4019fbd238f40c
SHA1 06a6c8c12bfce18bfc767679d4c34aeb4b466c15
SHA512 d8d5b5c3075b9abcf46d47ab5cbb5a5266456b300cc286bb8ec05d331ad64ad1254c9f66dd0fa18eaaa3333715dc90f977a8b84f2c619b6b0164b621b85e09e1
MD5 SHA1 SHA512

Submit Download

santuario.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md
Size 11KB
SHA256 14228bada9bdc80e6b14e8f650eabb48de97696eda0cd4226d09ec625b333187
MD5 d39448592d74ab584340bab5089443ab
SHA1 26dd723986301417d3fc763ab6895175e3d78b63
SHA512 2d12aaaaecf13e7b1ee6591753d3bbf0f7f60223aee9bc16e80d78e961364a24747a7e63e81fb0b06c8b825194dd96d19c73fa63120647dfaf9152c60c12d645
SSDEEP 192:Sk77nzwVQm+A5LY8jlSgHMwpprrydJCEyvROcLsPbjb7U/wNobpxc3uY:SO7nzwe2N7XrrydJCxvRyPbjb7qTceY
MD5 SHA1 SHA512 SSDEEP

Submit Download

thaidict.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md
Size 1KB
SHA256 b8697fe53430dcffd1741537ae764c0fd57c501f0b0b44702212cd492d8254c4
MD5 3d03072604cfa329ae3598e1aff40927
SHA1 3e833e84d53bb3a4b4aed26414a23b42759bb415
SHA512 841e27ae81886d29ce4d4675acccc6792d9bab699b5500e573a09cfae32e0e864594d9c80333141e4c27aa75eab37bc85895b5419ae075cf8c3519f4d66a98aa
MD5 SHA1 SHA512

Submit Download

unicode.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md
Size 2KB
SHA256 ce2e9e596285cbd064da09db2b488ddfcab496d8ee0a71858bd2de75afe1ae29
MD5 b2bccca3e1fd9b17c16eb6eaa096b542
SHA1 ed88ed503633bdced5ba41fbbb457b50467b6dad
SHA512 71e7359e003fdfe83c14b110ffc1411fa60bd9f69fb099d05362623cf46c6eae6124167cf95d8dcd8321838bb457ea078af033aeaddc3139b9f2faebbdd5bd85
MD5 SHA1 SHA512

Submit Download

xalan.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md
Size 11KB
SHA256 767734842328d4f6cd86dc0e685246faf344481f3c67cd891feb3e22e6456e82
MD5 0a2071f479b0f48607b48d5a8944429c
SHA1 979b5e57a159bc2ffaeadd3e2dc10ecd7de0ba49
SHA512 a73e64171bdea066161cef13334187c7e9850ee664f8ea75146dcaf47d4e80ea62d1934e0fe811bbb386fcc2e5400f28176a5ab1d0c8eb726dccb282547520ab
SSDEEP 192:gqAHzlpmgqsSoV10umAslpsmm6NmQAJYhdcewWIyWdaGlQPD+oWfsEY36hgJK:gqkp9QCcppTEQrfceHICE5fsEYJJK
MD5 SHA1 SHA512 SSDEEP

Submit Download

xerces.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md
Size 11KB
SHA256 7120b6a7baa3ee93cfd5d08c9d644a15392f545cf316129aa6c8992d068ff123
MD5 de6a811aaa105f786a05873cff4db536
SHA1 619dd9913475e0fd51c723d7cb003e364e16d82b
SHA512 ee77e90f5d81fe46cbd03462352969483722fea3f1b6644ad5644ee3aafd6f169a1a768b2a5d488bb5844dffaf298f4a7ee5b385c43bd8eccf3e198b61907076
SSDEEP 192:EbinFE3j5ZKIqvYGXgE+kxG+HkrwOQmFiezVFiPDSlJg4rudf56:pnC3jrqgc8ko+Hk7QWieumld
MD5 SHA1 SHA512 SSDEEP

Submit Download

xmlresolver.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md
Size 11KB
SHA256 c3cbea619d8fdc2c4aa8e2e05b63e846996fb61140a4ae83b625442290a201eb
MD5 af6a88abb87ffc16e62b7d9bd9cbd7ad
SHA1 8bceca263d73de332f409345d26aece88462bfe5
SHA512 db050391c6720f89ae0cbd66bebab2b203d78f103554d76544e349f64f54eed91e8f2a353977df3a8dbbd20bfc3eb8ac4fac314606b4c41ecc51eac02993c6d7
SSDEEP 192:Y37d5v92ypmgqsSoV10umAslpsmm6NmQAJYhdcewWIyWdaGlQPD+oWfsEY36hgJ0:Y3p5v92yp9QCcppTEQrfceHICE5fsEYQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

zlib.md

Path C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md
Size 1011B
SHA256 0f2617c51c1143486b2c7082807029503847f2e5d616f283790df140b02b352b
MD5 f7e6f6b4cebbff70ec5904c0f6c1a1e5
SHA1 ced819914321141dd01658d902be776a3bd8f687
SHA512 992e342347ffa058af4b96ac02b66e084e365a7045b094bfdefed20a1e8cf65aec36fce95d926c369ced15b020374ec853a632b310a9302c6ae033dbfd1d19b2
MD5 SHA1 SHA512

Submit Download

ClientSub2019_eula.txt

Path C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt
Size 42B
SHA256 d200a08b4a4bac86e800e8a7db62be26d6f096e216fe4c01a5e26a588d6276bb
MD5 b8afe149b957ae9344b8bd7d6eb1aec2
SHA1 6861b8cead8509744647215233d9421183088c8e
SHA512 8d289eb93947a7f869628aaf0636e54c13c52e7d1e552f57d8f13e4d7f16748fb427297b158faf16775a41426dfbb511021895a2e8d63bce0f8775fbea0cfdaf
MD5 SHA1 SHA512

Submit Download

AppCache133727656120098725.txt

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727656120098725.txt
Size 77KB
SHA256 ad5d94e252906e91e2b780f821c5fd0df78cda7823f8024994c23150ef1de63b
MD5 3e020b5ec5d79c1fec6d27cdf6232d20
SHA1 87d2ebcf16d1d84b62bf6164d94a65922c3b40c3
SHA512 1ceecf9f7eab37b80af410d30c196bbf0395788d62793517930a9b1ec4ef2f8ea59a6d723dc97b70406a88d94cf7f92e78bb2c4034aeae202236dcb490baecee
SSDEEP 768:IzUlieTaN+o0AhE54TGHjy3gw42iSJPKQb7e4UQG5mA8ERzyXQ:+VtN+oRhE+KHW95Fe+A8sL
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppCache133727656590293648.txt

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727656590293648.txt
Size 47KB
SHA256 c4e7146f21746c2aa3de350116c5baae6020f1d79b615c8858785d399e5fba41
MD5 1568c885108b6bbcb8a439fb1ae960f5
SHA1 568b5c3e74faafa0c20e7015fd24f18bee9c59f3
SHA512 82de76c24a9eac22510c6b36723c1d2e98d9f12fb642d38806c0d2ee6eb9e0e326d6307f0b2d3a58f22ae3932f1c27da59642cf21354540785c801371f4b5d75
SSDEEP 384:elKcK8e3e6xbcVuUR3jeWMp/ye6QmOcG2j1LcWZWM9M18Micdblc61QxYrc41142:eMFoAWqw623kczX14UIkQfxf292+BS
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppCache133727663328721506.txt

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727663328721506.txt
Size 63KB
SHA256 f845d2709286ee6441b25d9b948e6140ba0c54af7ef5647bd8a688cdbb623bd8
MD5 8cd725a47339a406c0004f59dd99496a
SHA1 d850bab48370474cda1c224a45e9dcecc8615b4a
SHA512 51ed007f232251b055c16cf032b2cfc2efa4c286abf5dd5d206cc4b7bed4bad730475c4c74d0cc2eb921c64bbaa5936007b149473319199dd5289fbbfeb726f1
SSDEEP 384:/JwYoECpMptoYte6Z5YxcEoM6uHzme6h4alMzCwGumcbm0M1f1iUv8c1cytmcIsW:OpG13JLaMRGd9547Db/WuO1byFsAE
MD5 SHA1 SHA512 SSDEEP

Submit Download

AppCache133727666039184869.txt

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727666039184869.txt
Size 74KB
SHA256 a2943b2ffbf49b83973c0ef13cc0830bd22537f6d14445bb6ea85bcf342289e8
MD5 df6225f9cb541476ef4abdcc12044d51
SHA1 86f225ee7af30993ab141e2297b303c5341ba900
SHA512 5f3958bdf8ee93ac8a94173f4d8380c6003442c73c06746efd21e78f6c915d01ba19b31c74036013135388a6a0c738a6efade591e18e78cb46b8455228085eca
SSDEEP 768:9bJ3bRZ3ucJmgVuZachjBcVOgPXBb9NZWdkQsApJ2M+iNHeOHFmfth:35JQphKVx343hPfRzmn
MD5 SHA1 SHA512 SSDEEP

Submit Download

File Explorer.lnk

Path C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\File Explorer.lnk
Size 407B
SHA256 a62255b6bc68e45ed30ca1b9f47c5bba0e201b1eed91f8c50c103a8467284f24
MD5 9c37459e6a72e5ca2e548ba58ee0b37d
SHA1 7002ad1f92d856a5a5b71968aabd8f3091dd317e
SHA512 fce9b97bb04517408960755eb652cda53878c67b6fa5e1b60ccbf7de00ae044a102e2efa0752d92227f3b4fb661794761b8a27e0580c65d3d2a8b96a4e1d9183
MD5 SHA1 SHA512

Submit Download

ASPdotNET_logo.jpg

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg
Size 21KB
SHA256 9fb474c02d895474db86cf07810f2b4a87c701728206260b1beb26cdd96bd813
MD5 e4b8fca78ea7dfacc755c4449647393f
SHA1 6d4feac6a3d15b59f88f94f7e7382500dfca430c
SHA512 e6091a68fef4a57212598b0ab306bce7584fa309e918e5f53b1ef52e9cc4b4be84875d2647d627c2bf0d0495a8f503eff043bddaea498262fc51b580794ccaa4
SSDEEP 384:gKLVwUJUYQSONMDOptfXvkpsqzxeWW2ovTcDsof7GxiDRDVYkK:gKGUqZZNcOpZXvab3v1DGx+R7K
MD5 SHA1 SHA512 SSDEEP

Submit Download

HelpIcon_solid.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\HelpIcon_solid.gif
Size 1KB
SHA256 c830cf76c5ea05b04e8e5b213fc237cbd2b4ec0f4de2b65024af7bf71ed30288
MD5 28535f883ef82e1a86906ecd2345b5d4
SHA1 4f12dd40f622d12dc53ae378ee4c1d6ebcd1f403
SHA512 2f8fc7042a5b79871d4b3e4c394da9a3b7efb165d8ffe65c06b49da56970956cab958f6c455dee91313c66f1c74b217f7321172201048e8d11863e65c02655fa
MD5 SHA1 SHA512

Submit Download

alert_lrg.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\alert_lrg.gif
Size 952B
SHA256 19da828d9e32d5cafd1091cdff45f1af5f9738dee75b0dc968b81bd07725a3de
MD5 661865435afa86f74dc99f2573de63b9
SHA1 b418b0af37f0b6a8a1b5d6d81a1979964dc8584c
SHA512 d45deb5af59aea1ec0e4d2dbc55aefbefcd35c746b6190039e61432b2e661e7e650d9c6e99f73cb195fe618d90dd141a86a2e6bfad809e5cce6b7b6ee67fb1b1
MD5 SHA1 SHA512

Submit Download

aspx_file.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\aspx_file.gif
Size 121B
SHA256 ca4400499a6324ce4575145a482054f14e4a3e339f51579ba2981a9bed81dcf6
MD5 c98e3fe32468327627f3ebd32b4cfca6
SHA1 1e96b371fdf6085b97dcfe8360749476d7e4b3c9
SHA512 817f3b916b7c01c2aa06c5a139c18a749661863522cd1fb3c26725cdda7e7fae722fb97e10c5af852215283194f187647a08265420853fbbc6c7d450671570da
MD5 SHA1 SHA512

Submit Download

branding_Full2.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\branding_Full2.gif
Size 1KB
SHA256 9082901e28533219c57a1021ab85aa504bc20dfb001609ae27bebd434b5039f0
MD5 108af5c4b139d6914c0687becdeeae82
SHA1 8f2e15166b641e48fb0aaa5cecbe8c8d82619852
SHA512 a477709c7d87a533d12ee0743f255088ec102d3c56e0328631ce98fbd40e52da5d909491d0e85318bf89b633f6981dea81041584b903fe2562735d0a83c14e0d
MD5 SHA1 SHA512

Submit Download

darkBlue_GRAD.jpg

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg
Size 8KB
SHA256 7eab3697eba70fd8d8af7e715e3302ac0561f908a90ecdb1cbb62948cd96fed4
MD5 30667dac8165cdc85b894bbcc6f1dfdb
SHA1 33e360510c07a7fe84e6a331176de9534a1c20ad
SHA512 30ec21064907a79eb722908f105d8ad4e1ff3a8503b421b29fd6fbdf7e63c03cdee1a58009690d6dbd646cdaf449071bd28505ff9dfe17e024e7f2cdb7343257
SSDEEP 96:ooN6KBHUM+0iyH6gqQrVbTQ+/4JM828LvrKc6A44d:NNRH7xiyH6gqQrpCJ+cTKc6n4d
MD5 SHA1 SHA512 SSDEEP

Submit Download

deselectedTab_1x1.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\deselectedTab_1x1.gif
Size 61B
SHA256 2edbb6a6bb9bb513177be89a9e70e24110cee4fda1c2dfdb5f868c9512bc5051
MD5 49d99b0acecc371144b8fe0825ba3856
SHA1 fb8f2f000ae686f9d72dabbaa485990695180113
SHA512 ff434a62f7b704ea2ae8ad5799354d5f1f19360d33a4ea0aab61cb853d9ee3391259ef5749b2d34ea41fa7384281bbb8347c1f92c1b0504bd2d1463ea245e87d
MD5 SHA1 SHA512

Submit Download

folder.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\folder.gif
Size 914B
SHA256 d77a8b3888a3402a7de17e4daf07c6b515c7dfc0e8eec8842cf665e6044e5d4f
MD5 9c9ef2280a7ff850be6798358762ff31
SHA1 cdd78ad9ee9bd33f923dae73decfb137ee06c434
SHA512 02fb6732b14e4f06261b806ff8ae9732a301008c2d1e9541fc5a337ddc022d563af1bda10b3c5f4f1b499d17c277c75962a8d5d7037ecd43b623768cc2a17aeb
MD5 SHA1 SHA512

Submit Download

gradient_onBlue.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\gradient_onBlue.gif
Size 90B
SHA256 c62caa74b661573abde5ad026d9829d354863b302642714a86cd329419e12daa
MD5 9ba71d555651026d387e450458ae5e70
SHA1 81b3825a151bcd988394ecfde6f37ffc6a8a947a
SHA512 9d4ddab3d56b20e3278179f435d47e7c710c1f2c1313c2f2502d012c9d2a0285b6fc030fda7d57ed8c355437b32e195b6d0e8c2ecb9b8ac9fba67debb2e56a3d
MD5 SHA1 SHA512

Submit Download

gradient_onWhite.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\gradient_onWhite.gif
Size 90B
SHA256 8ef94cd9d9ca63bb4fbe97dd716d5680905c9a5d79b1f2bf094257b6cfd57800
MD5 06003cf3be421fd9c68bb61265a6cefb
SHA1 b28c9394a4c15fcebaf3691e9478ce7e2a8ce5eb
SHA512 6a1b4acec6fd604db56d6fa421685c8cc8f013ba80f9c4e394eafe57be63f973a8e1d52cfca19f0f99a1c34615a8f92e9321ff929189df98bfcfe789c04aeb98
MD5 SHA1 SHA512

Submit Download

headerGRADIENT_Tall.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\headerGRADIENT_Tall.gif
Size 328B
SHA256 f21563ee15251bb56c536def8e0eace027d4bf13d49286dd29000a8397137823
MD5 d85be10b59158d76247b171115f50a77
SHA1 ef42d2cb6ed7254d9aee66e638c71cf5feec8922
SHA512 9e418b8e2383156399fb2ee329b6873293e5f8fe48482a889a1be57e8e3e90076fa1e3b70f233d4ebd4c52967ecc1b10d533145dab072d8bed690a2ec44f1d72
MD5 SHA1 SHA512

Submit Download

help.jpg

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\help.jpg
Size 1KB
SHA256 85c5bfa90e480a5dced0f44d1477ec1a324131dd40d2b7cda67d9ac4a92e9bac
MD5 b78b049f9cafd995f84ed27f5017c416
SHA1 d4df735257686520c3b93889996f4366e38128d0
SHA512 153cd0ff62c6c72234d6183311a3cb4edac251b5e9bee201c5eb9403375d43c80ccdce76772ed5708f486220a0867803b0b7d483a224cac838a7b728ce995ef3
MD5 SHA1 SHA512

Submit Download

image1.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\image1.gif
Size 162B
SHA256 021076e492b282ea78d9a1224eaba079b6ff83426de2b49498f38592758dbbed
MD5 44062d3b54ef112d32075b499748d764
SHA1 86e889cbe8c9e0cd0def2c6cfa381ed1f33905bc
SHA512 fbdb2a07587a180c21cf0957aa1d59dfedfc09314e0613907b380522d84e4c77350dfb42762142647a24f5520a53f8f2c94d121441223027c84ff953ccd83847
MD5 SHA1 SHA512

Submit Download

image2.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\image2.gif
Size 586B
SHA256 ddb5945a7665d7c307ce84b66fd0bee8ebe7588c441ccdcc7fdcd9c733934850
MD5 dee4babd2cd35bfa4f07fae529b88930
SHA1 c0bd0e4ab190b7584f37626bc30323a830bfbcd9
SHA512 048214b53bb8ef6376323c7e9a899220cf7df12c61886ab29a803a6dde0bb3ad342bd56078a39171d993843cfbc41782c64b13bcb14f0211e5d5a97c48f3b159
MD5 SHA1 SHA512

Submit Download

requiredBang.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\requiredBang.gif
Size 124B
SHA256 c01f6fb674ea2f43d83ea6f98baaa7502a25082cc93025fad4ad0fd9ae22cc02
MD5 2123c01bf4458de0b092f705324b20fd
SHA1 8c2dff16495ac0ddd43ee6eaa53079eb78ad3123
SHA512 5ec8725a7929be8c7131d93a9f784c7bdcd26f29d1c87c6603603d6d34fe6276068d97517aac71fd1e9cb0279d99d1b14a03e4b61095befc6f86cb04a2f2b60a
MD5 SHA1 SHA512

Submit Download

selectedTab_leftCorner.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\selectedTab_leftCorner.gif
Size 65B
SHA256 a069f5935f36d6097a0190416364becfa6b12afabe016d9f5a8f924c83340173
MD5 9b36ad691644cf7165a1563d8a98579a
SHA1 e2827d5f29aa3968e86013146d37f878b8275dca
SHA512 7af5ce4be1072dc722ee760e1a5f02e67ad651b7e84ca100820a97f79636f068f568cec0b8a09b7c850d7b972055b4e0eba8cf28de8825317768d82e433895d6
MD5 SHA1 SHA512

Submit Download

selectedTab_rightCorner.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\selectedTab_rightCorner.gif
Size 65B
SHA256 6259944ddd6ba298f7a2b82bbdfab79a91cdcafda0507b7a3ad91afc160d8641
MD5 ff1d8dd2649695a04ec74ef65ed16dbb
SHA1 46f3913c15ccc096735cc63d73262d67fde98676
SHA512 d304573300cfd4ebc353336c5f7a6e9de9e853f3ef3be0b110eb7663db0b04620958793e03e1d93299d7787589c1468007e0e32b41058489a8ad1d8d9813a542
MD5 SHA1 SHA512

Submit Download

topGradRepeat.jpg

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg
Size 8KB
SHA256 de708f370ed352cf02ae311412d51c4c8ce34f76db02d6fc8533d05fdf17edea
MD5 df62bf62d33e33eb31ed797b4d0b53a3
SHA1 1a0e5667cb167bf36e395ada1fc924f23c82c1fe
SHA512 22287c5b2b19244bad835c246e01c97c8ea22049bf5699c1f6ff1061c16088a777a8e773200d9a5434fc16889ba7a3cfa3e229f97a5c0ce9339883511c1820e7
SSDEEP 96:vPGQ6QznrPy+T+RYP+1O4CpSzoHso58NZEPz1klK8kw3Y4O2p2lfT/lBwB9dn:vPGAPyiwf1q8Neb1klKq35OQ8nwB9dn
MD5 SHA1 SHA512 SSDEEP

Submit Download

unSelectedTab_leftCorner.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\unSelectedTab_leftCorner.gif
Size 65B
SHA256 3f9767bb6401cdc3fde0207ef97b8a283e599172f94289bf4fa848b666ff6dfb
MD5 ca48099904cdfd6307015bcfe779745a
SHA1 5e0bfb10068a06e023291cc76d8b8efba6bb6b91
SHA512 6567ac6bce8f7a0e6a650357182c3bbe067c47ec1696454477d66ce75aa1459d595d0c2610ad54d04ec3ce15ef1991b3f15088edca7819cc6915378105b2a400
MD5 SHA1 SHA512

Submit Download

unSelectedTab_rightCorner.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\unSelectedTab_rightCorner.gif
Size 65B
SHA256 6d59d0cc4a7e445f500e7339a1d9b3645e8b408ef1416fcc26e567a00394a5ea
MD5 d9f5d498d9be91074e2f0c8b48c25a11
SHA1 13f4160ab0673285580f2c81bbcea7030c03d6b4
SHA512 9c8c8c07f468907ed817a342f0b30d12e5ad8f8a544f0164fbc7d820f443ffd50feebcdf949fd10cb5dfafd915de775f6604ae5a43851faf34da5756aa93941d
MD5 SHA1 SHA512

Submit Download

yellowCORNER.gif

Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\yellowCORNER.gif
Size 880B
SHA256 3447a839f0aafd23e3cbdb8157ef3de06aaada330c87f91b0f205e11a1eb5e85
MD5 ac4315e05aaa8da695f76cd9ca59b36b
SHA1 092d92aed9518d4b4108fd598d274454ca952eb3
SHA512 596f282ea247be40b49b9fcb7e95c1f9cf30bb1400968d53ffb4f1a0ead24714d8329f782d7dc3441d6ac6f9ff0360fc91c23a8377fd995137ebc434cf79cdf0
MD5 SHA1 SHA512

Submit Download

security_watermark.jpg

Path C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\security_watermark.jpg
Size 49B
SHA256 104e5f135819326b4221fe2661b4d0bd8cf90c919c890e8502174cbb173c6f79
MD5 3334c887eec453788a70d1526b0320c4
SHA1 15bbfde6b99df5f6727ccd3d3199b74e4a8f062f
SHA512 2148f5bd1cbcd500bc66ccfd3578eddb6c2fa4295bb68459d6f9b4699fc7cb18e9dc98d585f8dabdd607570ccd1973af7e52b1348ee479689e87c43a2c0a6721
MD5 SHA1 SHA512

Submit Download

1 - Desktop.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group1\1 - Desktop.lnk
Size 1KB
SHA256 ceecc8ea2fcbdf957b64b2e891b2945346b3b1e6cfad2ed2c4dc13e97e27bfff
MD5 dadddc1dafdc56b5efd505438050c909
SHA1 6fd3cdd0a8555e69d3f8e8a3a0edd702e9f1382b
SHA512 9c8d7a1fe371f86bfa558186b3824d713b33a6ef389d877d54cd4607d8f856020114f57b994759d3906566ee202a8edacbafcac0539d4e04fb2dc5fa4548cf02
MD5 SHA1 SHA512

Submit Download

1 - Run.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\1 - Run.lnk
Size 1KB
SHA256 3e72f3b2e4fad9a0b6ee487eebe4adc39c4b11c0a33a5a53f85cc4f4011d1e17
MD5 ea25e0166a31c353d4e97938cb96da1c
SHA1 33d272eb82fe4d4d8aaa073df175a5a3f61fd78c
SHA512 860b6a8faf45008caac59b02c37f6b9b9128136ba34a4d31091a1c4cf4f4e60edd2221193133de702b755335eedb1c91fda783f2ec1fb228bb806c232523a8d0
MD5 SHA1 SHA512

Submit Download

2 - Search.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\2 - Search.lnk
Size 1KB
SHA256 25d2e007ac079e12ba0f39fa73837994df026ae60b8e9a2ada9ed50153ee4457
MD5 09e6d0d3b42ca98326538e089293eb4f
SHA1 3a19f3ad3b3750ab95bfecef477e4cf3307ef39c
SHA512 d5cf2b07cf33c29645736749805ce7a985c2b51d34925687c3ee36568f58d07f6ee28793f75836960f1e17cb2260a9c1e880aef424d8b54137f4bf811b916d89
MD5 SHA1 SHA512

Submit Download

3 - Windows Explorer.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\3 - Windows Explorer.lnk
Size 1KB
SHA256 938b5aa3a319f769cd833d76d6b749445b441bc0eb4b645dc15f375f5f820a19
MD5 41125226139c3a14c1a9ef92bb7e57c5
SHA1 32c10505c9f50d79cdacc6df0c27db885f656f89
SHA512 ad08b4face2184265a0695c890c7df811e9831cd6d4ab778f8261fe5c72df6be982f849c4bc2e57a2d2f7536dee473e149d6a704c2e5b8ccb838cfc1d54f7f46
MD5 SHA1 SHA512

Submit Download

4 - Control Panel.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\4 - Control Panel.lnk
Size 1KB
SHA256 51bb1cda3e82d993f98592c40a3f551daa5a0d1905219d48a64bdbba6d684521
MD5 0683c93f8ff4dde536343c6d47a66a16
SHA1 caad6e1ea1e9336f275618517ab4786ef9eec54f
SHA512 144dae7ab8645f8ba9cbe43de03adba6ca6683572a90243c1e3f0765d20a87648f85faab9c403b5ec51c6554f4a13d33e1fde4e0b8fc4edb86e996dd06568870
MD5 SHA1 SHA512

Submit Download

5 - Task Manager.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\5 - Task Manager.lnk
Size 1021B
SHA256 4ae809efb0150de6f6fe57c12787f657ab6b9873f7a632f4b20b7e7e67adbaa5
MD5 de4dcfcf068415384fb09d7aa1958d81
SHA1 33ff228a7091da7f65aae45c1c1a3464117c2210
SHA512 744f30c15124f26995fd0456757ce61d12c037b67b7691ddc8915e7f8c3d93cd363f42d73700210f720e60968a8206eb33c93065509f13d51a32e099571dd785
MD5 SHA1 SHA512

Submit Download

01 - Command Prompt.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\01 - Command Prompt.lnk
Size 1015B
SHA256 54bb430b5ff98812b3e97a43077c2883aca8d93b4fc5277f37dd91dd89234c0d
MD5 efe7955bbaa505a401b69e92a4edd175
SHA1 9bcf6589159441a6bacf1769e6ef977f15080d7e
SHA512 d9b227c0da790950e30e8284f22c1cb7d8ff00f7e84629da2762d8687feea1c31486baca43e729162e69cb840527cce5b1e34f76e644b6aa0016b608f706dbc0
MD5 SHA1 SHA512

Submit Download

01a - Windows PowerShell.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\01a - Windows PowerShell.lnk
Size 1KB
SHA256 235b6fac0d47ec5b6d806eb674da573582f6a1e5261ebe66027879ac602a6327
MD5 7ff47615d05f70177038c029dd545a0d
SHA1 158f5f949cdf2854b64105ef96c6c39682209325
SHA512 498d698fa87f63b1f642f6d65edf0f5db3e82c2d7b8dd2f4bc1f0a1bcb6d038349f772d31ba4b01f411c42a08234a2a8bc3f42a8ec7cb722588c7f77bdb9b000
MD5 SHA1 SHA512

Submit Download

02 - Command Prompt.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\02 - Command Prompt.lnk
Size 1KB
SHA256 547874c717770aa21ba030b7bf3b3a1a0263dbaf2324cc18325dac78b03e45e7
MD5 97b4ce0fcea2082eff05e1e764947a90
SHA1 7f9c359766ca7625b2d25133899f1795d8be60ac
SHA512 56a5b092a90d2d702b30a6c3ca35c843f08cccbaada9e2afd32fba4526e14b2414661303b3cd3b92714cebf4203a1529da2f4152956f00e5ecdcbb575d0f5c43
MD5 SHA1 SHA512

Submit Download

02a - Windows PowerShell.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\02a - Windows PowerShell.lnk
Size 1KB
SHA256 5277083fc293183591f06eff5e56df68d72a05a75e476f0925c3327ca3c94755
MD5 e3c0d65b0b541aafe7e35ed17e0a4179
SHA1 91665485b18d7d804e2bda1eee72c88f6a852df7
SHA512 9776d9e66e10f6c986d57d1a53315a4eaab30213383590ee7889b94246c37cea18223d58ec592db91a6802c60c6b6a271b5cb186a2939ac2de49176615fbf50f
MD5 SHA1 SHA512

Submit Download

03 - Computer Management.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\03 - Computer Management.lnk
Size 1015B
SHA256 1040f53aee5c033c054411e41c4bbbedc329e261fcd9045275f916ab65acce8f
MD5 5a68d84f0c6bcfa6d96d2bb2f2edf097
SHA1 c6c1e23ff9d056c084d864c264cd87a2388cb26f
SHA512 9de1de91b3898e7c81bd0d815b15703c30382c2c223bf1c8c2aa8baf08ab0a14db9e90146bd7042de2871abce0d4934fd7f237c9a386a5fbf078918f0eddb9c9
MD5 SHA1 SHA512

Submit Download

04 - Disk Management.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\04 - Disk Management.lnk
Size 1015B
SHA256 67bd1e6169235d8b80630a47ab65e399227bd69b801d4d418bb785899de73931
MD5 9c63605cd35b9768b5f3feeaf038e887
SHA1 330eadf8dc3ab482f2f191881c1470b7f4651b54
SHA512 fe8f073d96ee9a1d7ec5e233730bf921177c1e8a2da528a9d9b315d4e1b9258f4411022bfebcb1392b2dec829a07431eb5d07b730161b75a5f30ea80010def39
MD5 SHA1 SHA512

Submit Download

04-1 - NetworkStatus.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\04-1 - NetworkStatus.lnk
Size 1KB
SHA256 43a2ee059ecdb3b84749baf69a3bb4868367e291376b82be57c26a618fe381b8
MD5 114def6017747a91cb3df31d91d752cd
SHA1 b1c28753967632dfef8527c9eb8e130da5d85fe1
SHA512 2b68136f4b20e18b15d01afcdb06d779ec07e32d87a0a8ca79b7e44abe08b189f2eb8af9a74d538a1222c734c0a49a931305c8319a774311b83eda50e0ba529e
MD5 SHA1 SHA512

Submit Download

05 - Device Manager.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\05 - Device Manager.lnk
Size 1KB
SHA256 9ed9c7c86726a4344a85525ceedacc751abb9e21982d098300c8691d4076c1bd
MD5 8200dfcac6b9872d7900b29c4f2e9455
SHA1 e5c159ec064603f7a1753f3a2eb78ede19a9c7aa
SHA512 cefab776706b4005e265d765c4cc528d06fce33387322bb306be9b399e82f1e29b1a5416182b79be06b1508c593f1da5fedcf3bbe76e793bd765f41eb7f48a80
MD5 SHA1 SHA512

Submit Download

06 - SystemAbout.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\06 - SystemAbout.lnk
Size 1KB
SHA256 a713a85dfcf5d190ef7b6f6feb3aaf1e4ea4ef21bbbf6fc6a2a56fddc4a99d75
MD5 3f4753a510f96b391ef5a3ff9e886343
SHA1 794b2d5d99bbf41dbfd7ee2f8225e3d94f019074
SHA512 c25738c9f17f8578a8c6bf97f208ddc8a128be61a623aa3497d70268eaa786eeffc1c5534eca3b41db2d31629aff731be18e0d83f441d663e897a7cd3318149a
MD5 SHA1 SHA512

Submit Download

07 - Event Viewer.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\07 - Event Viewer.lnk
Size 1015B
SHA256 7de553d88d69b7e5557931032f268837b0030a80edddea2e1af57ac3139e13b6
MD5 a5200635f3b2c611f510bd153d5627e6
SHA1 409892a9175a8b915d859f1676640d6b258785c4
SHA512 eae06bd38dacadfaef5d78fd1bd67ff7412b8e442c98c649db6fcd410f09a5385d0b0f67b9d912bc31b70901443f4fbb0d56dc13d3d7131eb4e3f9e588461fe0
MD5 SHA1 SHA512

Submit Download

08 - PowerAndSleep.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\08 - PowerAndSleep.lnk
Size 1KB
SHA256 f8d8bc65b668fe1ed37d238bfefced0e6b4f1c081d6263f317e86c655310aa12
MD5 c947eca6818a30e33b9d555deeebce25
SHA1 f1b088d3f823c4db662e8082eb0d680c1e9d1274
SHA512 5c25bcb5edf7f8a75c8fe054f44ec0d1b5f7adb01bcff41ab681e30764b8915d478c2e857eb2b98cc41e21c4303abe024c7ec1f0e92e22b3b7d50439f3e985d7
MD5 SHA1 SHA512

Submit Download

09 - Mobility Center.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\09 - Mobility Center.lnk
Size 1015B
SHA256 547064b207251d242b370a458ecbfcf3759c1c9f6a8d61adfa549c4ecc25dddf
MD5 6189f8fec91bcb5786c01bba3300baef
SHA1 ce543eb8c57901741ef6336565e7409562dad850
SHA512 abaf81e5642f80fe3c52def839d5c60015cb0945aedfb7ed31e2a151e3d12090b0b73492e52e5c903010da6fb89ce88e1208a36e82a511b50a62cf06df34b1ee
MD5 SHA1 SHA512

Submit Download

10 - AppsAndFeatures.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\10 - AppsAndFeatures.lnk
Size 1KB
SHA256 8f2cf3cf662d656638bd86e9559d01451613dab4f5e53164b224d0a41efe4058
MD5 71e18479b0e5094affa6e1b67fafddc3
SHA1 f58f8561c991f7b37534bd06e75817a5ea7a9f63
SHA512 6b1d10f25529799716c3ce01ab037fed418cf73f48f98c8aa4bf4c7028a8c530b7e17e146afd0a5f98c13e61c17ff3a4988c3d76f0027ed6dc494ad0fda18a97
MD5 SHA1 SHA512

Submit Download

Shows Desktop.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk
Size 352B
SHA256 6ee77d83433b23b7d6b422829573187ef54f4f57d136f5c8c818a995e4257efa
MD5 e169922fce9678ce24829137d2b16182
SHA1 d3bf11422502f971f84fe2f7b49302c6b593eb4b
SHA512 fa3276d94865699e7b82c33667da61510dd2d99199c33e95d6331b130b91e050073beb42881b194eb517d95186925d2eb772056f8c23dfb6cffad98ab8d6064b
MD5 SHA1 SHA512

Submit Download

Window Switcher.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk
Size 334B
SHA256 341f362a1f5db0db882bdbf253266b6be341a62ce6a999899d696ef5a6c981bf
MD5 e1986552b66c834a42f5a52856945f26
SHA1 9aed1d479e5b8d7f48ed7b4e34db0c6c727ccfde
SHA512 235e61752b0e1cf6ec59854a57f407848b0c2d636b9c864e2fade13747436c855984b31895f2365bcdf9d74c0b5cff91eb5eb21e1b7d68978ac9fb24ee2791fd
MD5 SHA1 SHA512

Submit Download

Magnify.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Magnify.lnk
Size 1KB
SHA256 a1f6c6e66bcc8f75043fe84d1ac2ca7b1994341270b250ba0ee6077e2dcffb9d
MD5 c64bb5b62f8791646189671a56d75c92
SHA1 93182387560ee2ac3ccc9dafb35c8339277a1b90
SHA512 4995a404c276bc7b247895a17143e752aec627a988ba71fe33e8f3a1cda366c93838fa6bd4c2a877016e1d79304fb6162232beff8ef2f2ec034a29691f94c9cb
MD5 SHA1 SHA512

Submit Download

Narrator.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Narrator.lnk
Size 1KB
SHA256 359663062c9e8c1d7ee914ad3c358ce573ddd1fa73083067663813ab5d579976
MD5 67315f5bf2e95ab1741e000f7250875c
SHA1 089ee04331765f570622853d80509eaf8dd7e496
SHA512 286156cd6ea6f54a2202707d8763dd04d6b146212c52399902b03ff44789d237b90caa89e0ff783ebf1c946f5bbbb572bfc49d8f63e2afe1b56fd56ebcf0af32
MD5 SHA1 SHA512

Submit Download

On-Screen Keyboard.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\On-Screen Keyboard.lnk
Size 1KB
SHA256 80edbc4d55b20712d9254d240059ef1241581ba44054cef6fc10e5a9cec35f9d
MD5 000c68ce00823e57e98f8578ad2e22e7
SHA1 2029594ca14ddbff89dcfea3fcf58f51cda0142e
SHA512 5430c7d3f9cba1498f8adb132e9b38c83b18123a055544e15cb24b418d1a9f386e2523170c443784a0bc4b7253dfd90cc2310b8937a501a28018c70450c774e3
MD5 SHA1 SHA512

Submit Download

Administrative Tools.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Administrative Tools.lnk
Size 1KB
SHA256 217e24646de3cf2daaa338b6da517c4293adee7d899dac1211f78dfdc129e942
MD5 a4b39320bf1050573ff13c4505214df1
SHA1 ebd5a976833a604a673445bf6a7b6b59139019c2
SHA512 4d73425ad1b3b9311a013e88ea8ec54e0af6fd579208fba3760236d615c1583f8de5b064cc383c74dd1e9cd433443c2f4b7a3f1b0105a5cec51a28e01afef3d4
MD5 SHA1 SHA512

Submit Download

Command Prompt.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Command Prompt.lnk
Size 1KB
SHA256 c61e0eb2d7c8e752651691c0ff98d1d960932efc953d3d693067e022de0a4ec2
MD5 4b876232f6e204cba9578c37836f91d9
SHA1 c08ca8782d9aa520c926f66fa1214d93d9fbe775
SHA512 d8327943b8dbfba6a6bb48d7620b8cd0112d18a83b8922c5cac68110754e98e3d53f7a7254b8612c61ad1a440f90714993620a605d87895b3ef20825de7a1c82
MD5 SHA1 SHA512

Submit Download

Control Panel.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Control Panel.lnk
Size 405B
SHA256 f65f2d619c011da2b22940082ca7a37dfa11832fea9d3f9945d2b19769af94a3
MD5 b6df36561dd030ef3ccfe571fc9c5b6f
SHA1 de747bb9bb0bbad83e32e3a49d813384bcce1f00
SHA512 e843a4e41573fef91aeb18b671b200a89f53ea58272572cea5fe31a551700d0ef011c21fb75a40d5af2344cc21ae85ac87385da249cf06c284e922aef65804c6
MD5 SHA1 SHA512

Submit Download

Run.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Run.lnk
Size 409B
SHA256 c4dd69b6c240120267539eda269ba133df18e96d42c1144d2aebfe91c9ed1822
MD5 ef7aef64ff1579b13946a412fede40d3
SHA1 294d5ec5355b5919b207509e99b191f9d048e340
SHA512 217c97b348e916778c4824b8db2a2ae3978eee6196232f96052d4bbab00cd78a181f4b7d029187a3e9927bead6a3ee0563931019927a054adb6f5877286f2ed5
MD5 SHA1 SHA512

Submit Download

computer.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\computer.lnk
Size 335B
SHA256 33d76d82c179a8f848f698a4219bc5e43250ed9339fc7e69c610b75c58134164
MD5 a69c6403e398be805628e21866d2bb56
SHA1 f3d7684d6d1c835c2adaa67ce337d276786643ac
SHA512 b60c8f7a1f7d3d1f0643432e835767f92d1ebc9410be4241eead1912ecd40826947501b50e20c3a3d17a8f4501605f3a8be9b8b5366cbaf9088438f0c75b3745
MD5 SHA1 SHA512

Submit Download

Windows PowerShell (x86).lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell (x86).lnk
Size 2KB
SHA256 3a38eb6bf0b0ac52d5e30a4be87b244f5e3d6cc3325a6991b627ce0fb8db77d4
MD5 3ba4511793b8bd4d0b6035154f7d33a1
SHA1 1b82fb3f65a61bdb84178334936f301ee4264013
SHA512 d6703309c595a6cc0928df201e624077e29c2924fc8188e2cb15fd828c72332c9d6d1879a84553033f1b64b5d9f94493e1f5b160f02e5fb42ba2aa8c353151dd
MD5 SHA1 SHA512

Submit Download

Windows PowerShell.lnk

Path C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk
Size 2KB
SHA256 b93522da3b5a9b095241f60cc0d19cd56d5d0252cc90f7ee07b9e5bcf371536e
MD5 035a50ca710adb32f24d20ff39f3ea6e
SHA1 b19b9b7ee81b7f654a5ab5bd8536e7f88e514dbb
SHA512 2e1dba62debcb8787c93b9663d800752df434610994546719979e8129abe6d4d0e0368a8542558f2d2f00802cd1b6e66812b92e37a2037aa79f8c067f7bf7537
MD5 SHA1 SHA512

Submit Download

Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png

Path C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png
Size 296B
SHA256 0d01573b6944cd71d4e70f58783870204e3f1d64199a512c22a56ead66784d9a
MD5 65d33394ca4ac294b0aa428cd450c763
SHA1 3c4a3b6190fad1ddc5546cdd043ab72257edcec5
SHA512 0a86973796d4524e4add59cd662720b0c4029bde09f2af0ba810bfdc5c16c8d6c29b992303843579cfff2cee6445566626e76cca7175d568272cf3105b2eda94
MD5 SHA1 SHA512

Submit Download

Square44x44Logo.targetsize-44_contrast-white.png

Path C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_contrast-white.png
Size 276B
SHA256 7b32fd2525a2f6a5bcffe9e968b4bd7e1f29d69e371673a567c43e4b94b21118
MD5 e8e710cb62ad1e6b2aea655368ae31d2
SHA1 c4cf9558aec80279126687bf2f6e89d5c5c970d7
SHA512 8c1fbfee665f78d2eaec6ad7b6b188fdc3a1208aea6e0890cb74c4421585a9940296b80c24449f303a8213bce90e59462df6b069249a39c693fd8ecd6e9ca5cb
MD5 SHA1 SHA512

Submit Download

Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png

Path C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png
Size 296B
SHA256 19e12eb4eb883c68ab458a9d5bdae53b94f7b7ddc2829fc9cf9f428c48303cf7
MD5 985cd88318c5d7fd8d2b82d988aff41e
SHA1 1dd6c2c00eeb0ee6b49b1635b5610f184c49630d
SHA512 544df6cfd18915fb4f5776e710b0e1510387357c8cfac29f9b399cbbf233ab302a3636e996ce14684d27c4078d565f8d18dc38207f2dd8460920fbb0c1655c86
MD5 SHA1 SHA512

Submit Download

Square44x44Logo.targetsize-44_contrast-white.png

Path C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square44x44Logo.targetsize-44_contrast-white.png
Size 276B
SHA256 c1a11a688ef7ffa9673cd34d3fce79bb22321ed084e198478cb472d895825bb8
MD5 c71bc2178ff0ef18e549e841f7c654af
SHA1 ec2a882bd818d311dcddf06a5e8e43471f212da0
SHA512 b896c8c7914c0a22a563de908bab2579792a8d8819173be4957eb66e7628d43e7b4348ad396b28ae28b53fbce3961d7618c87278c7723fb129e51a5c3ac140db
MD5 SHA1 SHA512

Submit Download

OneDrive.lnk

Path C:\Windows\WinSxS\wow64_microsoft-windows-onedrive-setup_31bf3856ad364e35_10.0.19041.1_none_e585f901f9ce93e6\OneDrive.lnk
Size 1KB
SHA256 a1ef2782ea896296893ca8d5d37a26596508f44fcb10b39d44d056bdc8e5d3ea
MD5 21fe65bcfd05fbf4382be0e4a97f836a
SHA1 5694093b53c3110982a52dfc8080d5da9ac6a03f
SHA512 cc173443421d8b72965c4d717e83bb70d581dc764acb6bbf1c7a2f1e9336d363c50ea4c747a277b050e989561059a4ee5b18205559778a44243e7d2636246f12
MD5 SHA1 SHA512

Submit Download

memory/4936-10110-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/4936-11017-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/4936-0-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/4936-5568-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/4936-11338-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/4936-11355-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/4936-5566-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/4936-11360-0x0000000000400000-0x000000000040C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads