c239a0e143d63c177f0647cb88febe8695feb31c7f9d2f67d7fdd0d3d3b4731c

Analysis

max time kernel
100s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11-12-2024 21:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e342274b59e65578a37019215b798b45_JaffaCakes118.exe
Size

104KB
MD5

e342274b59e65578a37019215b798b45
SHA1

6f1acccea63b791e26b464066aca10d6b5263bec
SHA256

c239a0e143d63c177f0647cb88febe8695feb31c7f9d2f67d7fdd0d3d3b4731c
SHA512

0a96c7f3ddc34dd52a907d0d96ee99245f57a22ad7460c5bbd9749d1887e5b2a765365bf4a36d22026e97f60c9ba22607c4dff17c9dc86380dff484f96977032
SSDEEP

3072:OCFqSLhcXBVMKkQNsgrr/8vsp0vrqUs/8ICqP5:OqhcXBVMRQHsvS0jdDM5

Score

9^/10

discovery persistence ransomware spyware stealer

Malware Config

Signatures

Renames multiple (2346) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Drivers directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\en-US\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\ja-JP\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\uk-UA\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\de-DE\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\es-ES\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\fr-FR\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers\gmreadme.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\it-IT\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\8lX6v1peh72Mukh.exe"	e342274b59e65578a37019215b798b45_JaffaCakes118.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\FileRepository\uefi.inf_amd64_c1628ffa62c8e54c\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\oobe\fr-FR\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\wbem\en\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\de\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netathrx.inf_amd64_220db23f5419ea8d\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netrtwlane_13.inf_amd64_992f4f46e65f30d4\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wsdprint.inf_amd64_b616bed30e8928ca\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\fr-FR\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\icsxml\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\acpi.inf_amd64_605a5cafbbd86f6a\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmnis1u.inf_amd64_64035dd8a7571ba7\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmvv.inf_amd64_26dc960cc4c84207\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\InputMethod\CHS\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AssignedAccess\ja-JP\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.ODataUtils\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\es-ES\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Bthprops\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\cht4vx64.inf_amd64_b03448ba0b72ec47\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\hidspi_km.inf_amd64_7e53b3972dc4df20\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\rndiscmp.inf_amd64_81bff1eb756435c6\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\usbaudio2.inf_amd64_8d164ac6f7088f97\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wfcvsc.inf_amd64_dfe08f401a2eedbc\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmcdp.inf_amd64_919b7beec2c70482\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmgl008.inf_amd64_c0d977e565fdc839\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmlucnt.inf_amd64_f4769cb994ece833\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netmyk64.inf_amd64_1f949c30555f4111\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Dism\es\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\iSCSI\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_fsphysicalquotamgmt.inf_amd64_796516c18b264f1e\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\tdibth.inf_amd64_e1022e6b4f7ab56d\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\usb.inf_amd64_683fd853c8b8a4db\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\F12\es-ES\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\spp\tokens\skus\csvlk-pack\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\default.help.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PrintManagement\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_RegistryResource\uk-UA\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ScriptResource\fr-FR\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wvmbushid.inf_amd64_fd2fe159a9daf508\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WaitForSome\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WindowsOptionalFeature\de-DE\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WaitForAll\ja-JP\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_fsreplication.inf_amd64_cadbd20a667cf903\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_wpd.inf_amd64_0245a364d71cf6b5\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netvwififlt.inf_amd64_c5e19aab2305f37f\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\vsmraid.inf_amd64_3d2bbc45931b8232\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wvid.inf_amd64_7c50642b144b870d\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\InstallShield\setupdir\0816\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_EnvironmentResource\de-DE\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mlx4_bus.inf_amd64_4c426f3bebc68844\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmracal.inf_amd64_dd534e815632509c\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\megasas35i.inf_amd64_4df7f6223ebcd28d\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\megasr.inf_amd64_72258921635be994\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netelx.inf_amd64_7812e4e45c4a5eb1\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\lt-LT\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Speech\SpeechUX\ja-JP\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DirectAccessClientComponents\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_RoleResource\fr-FR\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\de-DE\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_magneticstripereader.inf_amd64_86e291110e37418b\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmtdkj2.inf_amd64_46dd0342577f43cd\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netwtw06.inf_amd64_2edd50e7a54d503b\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnms012.inf_amd64_707d3849370b9d23\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\termkbd.inf_amd64_a0634dcf2da1127e\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jmobeeglobbdggdg.bmp"	e342274b59e65578a37019215b798b45_JaffaCakes118.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarAppList.targetsize-40.png	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-Google.scale-250.png	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\Assets\AppTiles\StoreAppList.scale-200.png	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2018.826.98.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraMedTile.scale-125.png	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-125_8wekyb3d8bbwe\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-60_altform-unplated_contrast-black.png	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\Scientific.targetsize-16_contrast-white.png	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\TXP_Flight.png	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_glass_100_fdf5ce_1x400.png	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSectionMedTile.scale-400.png	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarAppList.targetsize-80_altform-unplated.png	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\StoreAppList.targetsize-256_altform-unplated.png	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_US\Excluded.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\legal\jdk\cldr.md	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-60_altform-unplated.png	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-48_altform-colorize.png	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-60_altform-unplated_contrast-black.png	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\eu-es\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\256x256.png	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\ExchangeBadge.scale-150.png	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\LTR\contrast-white\SmallTile.scale-100.png	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\iheart-radio.scale-200_contrast-black.png	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_Pester.help.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\loc_archives\en\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Thumbnails\Sticker_Icon_Concrete.jpg	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\SplashScreen.scale-125_contrast-black.png	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\hr-hr\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\sq-AL\View3d\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\Logo.scale-125_contrast-white.png	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-96_contrast-black.png	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\tr-TR\View3d\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSectionMedTile.scale-100.png	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\AppxMetadata\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\WorldClockWideTile.contrast-black_scale-200.png	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\AppList.scale-100_contrast-black.png	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\BadgeLogo.scale-125_contrast-white.png	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-80_contrast-white.png	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Square44x44Logo.targetsize-36_altform-unplated.png	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-32_altform-unplated.png	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-72_altform-unplated_contrast-black.png	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\AddressBook.png	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\new_icons_retina.png	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\195.png	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\es-es\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\TrafficHub\contrast-white\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\pl-pl\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\LargeTile.scale-100.png	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageAppList.targetsize-20_contrast-white.png	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\Background_Safety_NoObjects.jpg	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\plugins\rhp\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\da-dk\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\fre\StartMenu_Win7_RTL.wmv	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsSmallTile.scale-125.png	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\LTR\contrast-white\WideTile.scale-125.png	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\dark\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-16_altform-unplated.png	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ko-kr\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-white_scale-140.png	e342274b59e65578a37019215b798b45_JaffaCakes118.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-filepicker.appxmain_31bf3856ad364e35_10.0.19041.1_none_7862ca1f7379fdcf\SquareTile150x150.scale-400.png	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-t..interface.resources_31bf3856ad364e35_10.0.19041.1_it-it_3ebe1e0ff4a3730a\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-g..-base-mof.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_f91e0ac1363cfad9\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-nlasvc_31bf3856ad364e35_10.0.19041.1151_none_dc560ad6c013e621\f\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-smartcardksp_31bf3856ad364e35_10.0.19041.1_none_6be17c8122b64bfa\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-ui-shellcommon-core_31bf3856ad364e35_10.0.19041.1_none_91b1f58702057373\CellularToast.scale-125_contrast-white.png	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-hdcphandler_31bf3856ad364e35_10.0.19041.746_none_65c2c08a23dfa2ae\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..okerplugin.appxmain_31bf3856ad364e35_10.0.19041.1202_none_d081f9868ac0a804\PasswordExpiry.contrast-black_scale-100.png	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_windows.networking.vpn_31bf3856ad364e35_10.0.19041.264_none_14d5bd407f524c83\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-m..demanager.resources_31bf3856ad364e35_10.0.19041.1_en-us_bf493abe1176addc\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_wms-chm.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_1c41d961cdffbe1c\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-xwizards.resources_31bf3856ad364e35_10.0.19041.1_de-de_fd8c8fd0071babca\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft.dtc.power..l.scripts.resources_31bf3856ad364e35_10.0.19041.1_it-it_2d76f50e984eb7fb\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-t..nkrecognition.de-ch_31bf3856ad364e35_10.0.19041.1_none_7919a9fbf0725602\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-usertiles-client_31bf3856ad364e35_10.0.19041.1_none_df86f0e7b84bf07b\user-40.png	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_ykinx64.inf.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_d2d59ebe793090f3\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.19041.1288_none_d9539a9fe102720c\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\CYRILLIC.TXT	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\it-IT\assets\ErrorPages\http_400.htm	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-microsoftedge_31bf3856ad364e35_10.0.19041.264_none_ef195f564f00d259\MicrosoftEdgeSquare44x44.targetsize-30_contrast-white.png	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..resources.resources_31bf3856ad364e35_10.0.19041.1_en-us_bc6bb427497320ba\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_unknown.inf.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_894f22846eee75ab\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-r..t-v2-core.resources_31bf3856ad364e35_10.0.19041.1_en-us_fa34c4083f8eac3d\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-onecore-pnp-drvinst_31bf3856ad364e35_10.0.19041.1202_none_ca1e0a7a1f21274c\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-consolehostv1_31bf3856ad364e35_10.0.19041.21_none_366e294ae81d8c31\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-v..ure-filter-tvanalog_31bf3856ad364e35_10.0.19041.746_none_4b8e94dacaa0adce\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\WinSxS\msil_microsoft.certifica..t.cmdlets.resources_31bf3856ad364e35_10.0.19041.1_en-us_ac3961ad28ad6512\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-d..t-onecore.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_dabf991f90a68c4f\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-i..ingconfig.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_c38665ec78480172\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft.hyperv.schema_31bf3856ad364e35_10.0.19041.488_none_a82f565621f4835e\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-bwcontexthandler_31bf3856ad364e35_10.0.19041.746_none_c7440cf0162b9bf2\f\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-dusm.resources_31bf3856ad364e35_10.0.19041.1_es-es_1d4d399c4d3f29aa\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-netplwiz.resources_31bf3856ad364e35_10.0.19041.1_es-es_e51b12575abf6254\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-coreuicomponents_31bf3856ad364e35_10.0.19041.1_none_03f084fd11897e73\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-printing3d-winrt-core_31bf3856ad364e35_10.0.19041.264_none_7e6520f6092da338\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-w..tnet-mua-hostserver_31bf3856ad364e35_10.0.19041.746_none_b93dce693a9c6db9\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-dfsui_31bf3856ad364e35_10.0.19041.746_none_37b94d735bd22150\f\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-store-licensing-client_31bf3856ad364e35_10.0.19041.1_none_bd00dc33a869a94f\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_netl160a.inf.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_78a4fd4caff2cb54\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_wsynth3dvsc.inf.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_afb501a324a6f582\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\WinSxS\msil_microsoft.web.manag..nt.webdav.resources_31bf3856ad364e35_10.0.19041.1_en-us_749e1a0bf831f608\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-azman_31bf3856ad364e35_10.0.19041.746_none_3ea50e5445e96359\r\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\SystemApps\Microsoft.Windows.FileExplorer_cw5n1h2txyewy\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-ie-controls.resources_31bf3856ad364e35_11.0.19041.1_ja-jp_c69be8787f60975e\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\WinSxS\msil_microsoft.security...licymodel.resources_31bf3856ad364e35_10.0.19041.1_en-us_32298de2240861e7\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_en-us_1279c10c2d9636d4\500-17.htm	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-n..oundtransfer-common_31bf3856ad364e35_10.0.19041.746_none_81ab93cbe6fbb519\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-sensors-core_31bf3856ad364e35_10.0.19041.746_none_884674ebabfe0d4e\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\WinSxS\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.19041.1_nl-nl_61fdcb9606b8baa5\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Providers\App_LocalResources\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-lxss-wsl.resources_31bf3856ad364e35_10.0.19041.1_en-us_01d5196beea9fa25\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-t..languages.resources_31bf3856ad364e35_10.0.19041.1_es-mx_6ad0630b96d5eea6\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-winocr-tifffilter_31bf3856ad364e35_10.0.19041.746_none_1b70ed4b7ed28266\f\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File opened for modification	C:\Windows\Web\4K\Wallpaper\Windows\img0_3840x2160.jpg	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.1_none_75cd350cc8b5dbcf\headerrestore.png	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-n..quickstart.appxmain_31bf3856ad364e35_10.0.19041.1_none_4a388618f6365227\NarratorUWPSquare44x44Logo.scale-150.png	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-w..win32-dll.resources_31bf3856ad364e35_10.0.19041.1_en-us_599754e5b9029653\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_hidscanner.inf.resources_31bf3856ad364e35_10.0.19041.1_de-de_1d66074e17d6cca4\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-n..quickstart.appxmain_31bf3856ad364e35_10.0.19041.423_none_72535ca9b59a9515\NarratorUWPSquare44x44Logo.targetsize-48_altform-unplated_contrast-white.png	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..-cryptngc.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_1131de8bb2fd5de7\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-u..lsettings.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_24affe06b00d9f2c\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.RunTime.Serialization.resources\v4.0_4.0.0.0_ja_b77a5c561934e089\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
File created	C:\Windows\rescache\_merged\1973483750\HOW TO DECRYPT FILES.txt	e342274b59e65578a37019215b798b45_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e342274b59e65578a37019215b798b45_JaffaCakes118.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.CryptoLocker2015	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\JIXYNMTGOFNNODU\DefaultIcon	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\JIXYNMTGOFNNODU\shell\open	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\JIXYNMTGOFNNODU\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\8lX6v1peh72Mukh.exe"	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\JIXYNMTGOFNNODU\shell\open\command	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\JIXYNMTGOFNNODU\shell	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.CryptoLocker2015\ = "JIXYNMTGOFNNODU"	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\JIXYNMTGOFNNODU	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\JIXYNMTGOFNNODU\ = "CRYPTED!"	e342274b59e65578a37019215b798b45_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\JIXYNMTGOFNNODU\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\8lX6v1peh72Mukh.exe,0"	e342274b59e65578a37019215b798b45_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe"
1⤵
- Drops file in Drivers directory
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\aic_file_icons.png

Filesize
50KB

MD5
744f656de755ff574e8381608a88e857

SHA1
93fed564996a389fed243903e87a0939e3fb54d4

SHA256
7affce34c23ec8e809ead4e5e7899daa8b9b44b07e5fc9989d80a3b9aeed68ef

SHA512
501b17c3efd6f46657c61b43cefe36a97622eb785f2df34c3ec57e3fa1f6641dbc7bc6ed7a597285cf9e9f2f64bd886c534dd63002477bc05fc13b5eec259fc3

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions.png

Filesize
1KB

MD5
1fb8eaddc75481fb0a75839b332c9303

SHA1
f0a3332a9087fe27ec74e8b767a47c0d2c4b89cd

SHA256
0994f059534fabd1adb9db300c72960dd6d4196c19cb29eee34b427a5d816ea2

SHA512
33962b1c96573386a34a9d8a3902077f4600721f30a65c078876ba2c3c4e4715815a9f9905387761eea7a8330a69963c330fc5bd6a32d2eb2fe2cd0dcd63d841

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions2x.png

Filesize
3KB

MD5
c6c64ae5a26e727696d7de8c2fec87e1

SHA1
aa1011b735c1c6c9926d5883630cfc80ea38d00b

SHA256
7c2b9fe5e8b80b004af5489e6cd1c17fee6c638c8459413f4ffc9f9d66008e2c

SHA512
0f4f3dcd680bf665511c847c7d3da4ee567b0652b300794ca8066195c0b8e9dfcb6d3d8dc48126f61e854ad6d1c209c2f76f341144a07bc826bd7e6de5ff319a

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons.png

Filesize
683B

MD5
11fcae38ec006cd6d7f75a620fdab5bf

SHA1
1b70987d937ea539031dacd3c0d6a29199183aa5

SHA256
a4548c447d56bda279ae851eaa8f4825d17fd417e1048ae7a202714f893c5d85

SHA512
821f9f6134621907368d2529d389e5883f2980c56ea0b05a4278506be4a4443544cfc2aa265a21a72f715d78e83ff94fcb9252d5ba824fd3d47753d90fd9ad3c

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons2x.png

Filesize
1KB

MD5
4333aaf9c9c8d6d06e07e67d6aec6114

SHA1
d41238ef98e73c84cccadfe96f8004659e21d538

SHA256
7462b86a1a8fdf0b24b1ea3c8a7d01fecf4290057b8bec44597d18c5c51bebeb

SHA512
ac2ed5b0f4b7d89fe2fc6df3d4b1d7918bbc88cd1413f91abd7e60b450e1318f4ee057b2106aeb52af74426e09dd9c356209d7e4b7c5e9d31ea9ee424db82c4a

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon.png

Filesize
445B

MD5
59fef74b8cde5b828145d5499be647d6

SHA1
4eadf5286cc5fe8733df5f5eb722fd60ca547a98

SHA256
5cc69b2bfc4b0363ffbcc0735b2914f8ab50fbcfc0c2f94d8f47929509f0d55f

SHA512
dd831cb20285c16991813dc64cd0cf63a89f2869f17a3289938b33d1735359250edf4690736e00b0f1794a2db34b8e8107fdd38e69c951645fb1b88b5d2b1ee2

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_2x.png

Filesize
611B

MD5
0853029485b861703b68ee0d989045a0

SHA1
a2b39b10c4f1a7be6672543b4ca92aa6521bf168

SHA256
2c81a30f497867e438ada90b2d6d7ec772f8a5ac3a8217c0c8fbb9ae7ebfb507

SHA512
dc4d835cd09719a1779f8abb09fdd02a6c766a886c3cb255c7d8ce9f2b4428e65ff38bcf39717814725cf9907412203560948e4f07402c7955bbaff9140afb88

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover.png

Filesize
388B

MD5
e4f0cf3046a14f813da0a5648206816a

SHA1
054bd1e393519a15fd9ed7a7086a23c7dad635e7

SHA256
d1d9572e784e04abd763f91a37105bc8f24809e83c95d7a9854ad49aca75be33

SHA512
bfb28b2c7c91870c003fea5343774108b009bb706ca27b55aea7324cc5350c7d0c924766faa0a4b88a4388d2da5bb777d042b015fe1b6664a2594b0390a50979

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover_2x.png

Filesize
552B

MD5
00ebfb4e8dabecca8a14bf9a3d8ac10a

SHA1
83f134b6218aca9b1be695a0e078730047764ccf

SHA256
15f17d116c0133571938512ef6702f03f27c5f8b0cf508ca9f5dabd97e4216e1

SHA512
75061c3221715bfd3d107921b30b0b0a169ed95d5f41095ce098b4978248fba7ef98af0c946f5ad8d899ca6a2f32af13b6a64157e6e53e8e6e66a53a41707b49

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon.png

Filesize
388B

MD5
0eaf9e01d5e54f4e48e317c360779886

SHA1
0563b07161f9d47ae50d4634461f396d47c3c845

SHA256
254bfc3d4b368ef0b7573bec35c011ab2d40df3c79371d0842d0025999b1b402

SHA512
d6f695305bf7e2bba893a37e1ab67f6bed12464858ae2f3d153f4946c3f01e7251785014d1e5c06845d55b733512a00801da0ef56be554b262f29a072e74316e

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png

Filesize
552B

MD5
82f58729c8361cd8d171b2824734fb2a

SHA1
851974301be099f6c17c2a6cb576d7f02b963816

SHA256
603ca10a0bb57c349fe004a6fb2a3717e8c8ad9ea4728b6198f274664b492b0d

SHA512
546639aabf97bb8352bf2f2365af5f3e804af5e2b425542b5e32a9210952d8b3474274b8b58a3840fadc0fcdcab5f3eaf30ca4b2c30d444e79291dbab927812c

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png

Filesize
388B

MD5
51868d1708703313837043d5a80f3d27

SHA1
ba55793c5d4100c939f9456c13dbbd42b9dedc02

SHA256
ad44178289de78428c15922e3527d00cf10a890418b15ddf670f4a917ba7c4e3

SHA512
e39af2f3a7f2c28dc258d3833631ed1d296ca97804b9b5bb26454e66e2ade777bdec0b185fcd066e413c400f704f1e7d9940f1518a2ed36b0fe1664e59a9ab37

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover_2x.png

Filesize
552B

MD5
176582b8d4c62b79dc7e5a4190231546

SHA1
25408e3d4943fdb05701cf4e466c77d6cf5c8db7

SHA256
c1558582a9db68876d4824154b494ed73d6350c8afe1bd37bdd6d1420ed6f072

SHA512
a1024613e78c8f08d64b78661a83aaa6a3b76a90fbad1f879ed5a76580d714df999207166e3d2c0571042df0d2ca35a33501e3fcd638b7e35b313d3c98514a4b

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons.png

Filesize
7KB

MD5
14f87ee10d1ec05e626ddbaf204e365c

SHA1
6c19196526bab45d97bdcd556700e51d8e863b8b

SHA256
fe5abcf4c210658c9adba71b96feb2e178e3a7d8c57aabda448a3acdcfcea3f5

SHA512
7a9e1971c46ddd506a0ae6930fce8b95ac707c397e6367975ca859240b136342a7e139e231644702e8887e66ee3247caffefb186f92064d004cb64f77f79ffac

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_ie8.gif

Filesize
7KB

MD5
90bbacbe9570d0f944d81204c02c9bcf

SHA1
f92b02a392e8eae8eaba34937aec23b762b4e859

SHA256
82d56e58087b4e230f92bb42b473d3db4276814386ceb69f6136a76f89f673f0

SHA512
2becd89d1baa1db7a90fdf541ad73335a66d9c2765283bc697422519ecf4a2f0f8bf644dc8870ded0fb629e341adf97a45a37d83744cec99c72dbc2c953b1a72

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_retina.png

Filesize
15KB

MD5
86f1dc78b6dd23bea07261521cb52d3b

SHA1
970460c5c756d21b4f20703951925316c56d28da

SHA256
2391ede99b39c1f38d02e9e87026e2cb7388571aae912d97c7f4152a7a704aff

SHA512
d81b8690bd96d9d5b305f0817d6b6a2b7d18b201956db48f666f73c83140c96861b571be40f9d536aa9b73be146962eba90bc30adf8b3ae2feee49b86b6548e1

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons.png

Filesize
8KB

MD5
ed76ae2745bb5ae2226cc87b1751242b

SHA1
940c69fef525696bddb0bd94991248e70da69d61

SHA256
bd23c4d24af20d390868cc361a47c775c5a54cbb370ef0b3b4ba474f76460426

SHA512
26d52b6604b7fac0139bb336d2b4e52dfe90c90b2e710cfed1eebd2abd56ae20691096be68cfc005ca059efb49ce61f4598b5dc411a10b4224b48e01b0858c1c

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons_retina.png

Filesize
17KB

MD5
8fbea186ad51a80333066773f5414f25

SHA1
f8dd942420586bdd821e0be56496b9db74916c73

SHA256
bdab0037598093f917b41516c604ef77d96ab730e06266387f6624efb36c8d44

SHA512
da6724b1fb5fe13adc1bca427ee58fc3bfa5cbfaf9cfd09ca3aba87302c3debdc18f0d7f5e49f55d0fd93d71de5b27df5ed0037f2c089a1e72a5d0e9218eb478

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_pattern_RHP.png

Filesize
179B

MD5
fd5644bac84502ee9249ba1a0730a58c

SHA1
3bab8796410c403c6b4019860c04e8e04381ebca

SHA256
584c69ba72a6276d26cda274ed9fa0f4558e5d844c8512fee0e3570f8af8c161

SHA512
709660a4926f73ec1fe21c0e34761fe524b4c21433e22a75b5acf77a00150384a7c6fe94c73b8080af4c312e47ead2bfcfbc5ea4e6d0bfaf5ad569e0da438e9d

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_patterns_header.png

Filesize
703B

MD5
2cea0e49ab3759dcef5219a9bcee6c12

SHA1
36f1b61007799ea82ea89044ca5cf3d9721ce57d

SHA256
3e4bd2028a4d6398ece40977c3ea8886e85e692fb7a94952e55f939f93532d46

SHA512
cba7122abcc24d17eb3ceb0619bc92d3e1504adb1f035ce83fa8adeb8af9fd28f222002451f85b5d7ddffd77f51908585b70bd9c3ff2c6de6d8ce5c0b46cffc1

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations.png

Filesize
8KB

MD5
0f27416ae0e8eb1dad5eb34a9961c0a6

SHA1
08e5cf5099aceb196f8c263e429a6cbcea7312b8

SHA256
69f377942e47f44116177e6671857fb0b4ea552e92d6b30e90b2003cb1bcba9f

SHA512
a807c8c6e2ed8ca0ad2bd67c62fbba4c1cb146ba0347417aa5b6081d009fe746f55c2640438a122b35391b5449accbce99697f2bd94042ebe232c7fbe8ae82b5

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations_retina.png

Filesize
19KB

MD5
49e5d02298dbfed403a726fab2a74647

SHA1
a826215dda5c46fd243b69740a7ea49d20d7e881

SHA256
38d33750bc11959850b4ed3120e1ba6ae6140b5ca5addc709cd9730d251958fa

SHA512
faf3a310918c742a216fbb7dcb2ee49ca6b227bbd229a743fb45d861be8c2218257250d10861fb2877c6b577f6b307a9bb31fad50cc3ab37aec866bead15fb08

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\progress.gif

Filesize
19KB

MD5
7198d93a70954b14a534bc8da550d5ac

SHA1
dd1a5eeffbe978099e39dc72847c40b345c37d90

SHA256
2c982271fd35612e9b5cc64034b6985f0611805968b860e02e338b5a4eebb70c

SHA512
93d6c5845d5627818fc59e57005508c4e59903bb155adbc6269dfa22a736dc954f4ccf3edc75d2d9e7065c12fdad985da967529a11a8f7b52ba254e88b80a571

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\faf_icons.png

Filesize
6KB

MD5
d28232bdee5a1316096aee43448c4e20

SHA1
60f96247829f5d5cb0171269103ded50680abd33

SHA256
81228d714490dca597d1234426d19722c577997fa6fa3d9ab7f8aa3cbb32edeb

SHA512
363d0796fd25ea59d545c477113dc4d1a39d780721a5aa14190be27745ab0d8cb8fbae83b614efaa279fd3c6bfc84ad741116112a2a57a156800927cce53cc3d

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\bun.png

Filesize
2KB

MD5
d4ab342db363136ca42c2936e98150da

SHA1
e26985eaadeb90ef5b00aa66dfc2ebd9f65be6c3

SHA256
023dc56f5e9c6666d7108eebe9d30a3f68da330bfd09bad45ddce4f995699538

SHA512
56451953ba48ba72c9879bcbe1266ca07ea10d091e085710e7ae704c5ffb1c4febe4841882dec3c7fa17635648bbd08f12df0e5bf7bbff6cdb19872a2d7384b2

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview.png

Filesize
2KB

MD5
7b1c87d3d2633bf07dc1c273cafe6682

SHA1
df12c1461f25dec5ea113fba438e877fd1e4ffb3

SHA256
b02ac60a09f4cc7dea182b29836e11adb177de6f73f2f98bfe547a39863dcc54

SHA512
6435f7797812cd619f3ad908fcf2bc2fddeaa6e5ef1727cf7db64ae1ddf30c894315d361ae86f62a9c43a2b8d44a965d2f4a6bd1594aea2fdb4930d8ddbf1dc4

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview2x.png

Filesize
4KB

MD5
1a4299a1fc77ff34eb77ec6901aefdbb

SHA1
ce7a27ca6e03ddc5c4f61a151210c20a1e0003b9

SHA256
f870a111eb39dffb4cf854fce3cb5824339583e99a3d74dbf4d94790c0d8c45e

SHA512
1e8eb0d19ecdc51cd9f7cf79baae6476a261533f3808c4635115a82f1f631b7e89a0fe2afc524fc7826c28fd205f05b911c3984e713b27900c88afc7ac441759

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small.png

Filesize
289B

MD5
5a9dc328e62414ee2cd0610493a39227

SHA1
b111fa82ef1a3d6e218c510c7abe872a92419e7b

SHA256
215fb78c8642455b35e04a5cf44e325396d69814afca706d7e272ae879938156

SHA512
3218f8e5a6e6fbcb74a1ee237d457e409f9dea309c8ea3d7562672dab43bc81feb965a7714270bcccf57ce576a663471ec1dbd3a5ea931f06e1d1f9bcc30ced0

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small2x.png

Filesize
385B

MD5
df1685b5fb2cdd11700310498bcfefd7

SHA1
237e2484e29caeaf48c9e0ff8d5ec21380e1ff3b

SHA256
b472d3344fc6e8e92af5c0c58a6d3f274f48e387f2748c77542f44c0efda458d

SHA512
8bbc4ee68d038ea1b06a4468e1741382910c3a7764c6b811da1c1073ea0fea8af586969ebb5257e47a2bbd2b008b0c2217c5c7197d06c343938af1c4a4cb57c8

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\illustrations.png

Filesize
4KB

MD5
270d4053ae407caa50e984ba13c22fa9

SHA1
0ce2beadf04ab466cc84f1daa4a419409f19a514

SHA256
2c1e5294092d57bd8ce73837f8d31a4f1c572b1ffc85323acacbf754e27c14c7

SHA512
ac0f9169743a895555f39dd018921d6fdf5d36f0add14ca7d71c1c4329b9a19f1d33eeac7a338d0bfea5a53f0e38eba0e93c0dcc098882bc1de379285d3d7320

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\nub.png

Filesize
1003B

MD5
8d1e936977427baffd6eb33f193699c4

SHA1
21320cd51a01015e2157989c72538d2c9ea9eb1d

SHA256
fb5306c0612dfbd58ae07a005e416ac6acf3db3c45486d109ce491b188fa48de

SHA512
acc37c5da8f6661fac41cc175f2a8e4de9230fa11b705b5b0f6141501bb7571e4dfae63494040d4d8b8bb298ccd196eee9604be5676f18d6331411c51068c4a8

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons.png

Filesize
1KB

MD5
3ec828fceb6db288eb2516ba296af375

SHA1
9d8551c2448b0374fe39c77d9ff14ebc15a419b9

SHA256
049724ca1f8192ab7285bb2de2552d45086dacee846ea1bbbd3a451ec937c4dd

SHA512
b1876eb83001e8553d657a3c9f48100b8c642f9eb1af7ce85388f02fa2644e094eefee407d21d40701a610fb4a9f8ab4d44b43f566696b441737e731e881dbfa

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons2x.png

Filesize
2KB

MD5
6cae2748a9c66ede406a5bc9f9cf5943

SHA1
8157c54a465570b9235584380b8634cba7e75a85

SHA256
df7e5f1bde0f89abf30699d34a529a2126ac8e132fb61617da4b18d32d0f8742

SHA512
2ba13ff38c53ff6b38bcc3e5e88aba208c0e9f656a3dd61f6a923db7176b743dee5094dc16bf99af6ca706978759d17f519ff8347e260134e67c55f09c24c0a7

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adc_logo.png

Filesize
3KB

MD5
cd0184bf1974721628007bd0341a702f

SHA1
e3d284562304f1c25be1d18de52ee4fda5f9f577

SHA256
1ff31034385c7e3b967c040d3ea1bc8bc94c55d4d17c03785ea763f2ca0cf750

SHA512
7f1d14d28b3c1efd2fc8772634cd3ee404c41ae9b975267a2d1d8db8e2c7ddbe630cd9b8a5a8466c6cc27c25616591679210398e7fc10bfcdf7d97b3234a1960

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adobe_spinner.gif

Filesize
556B

MD5
4f04093c87e414d05a7864466dd7584f

SHA1
9f38bb6c07ce3ca0ed0c7f0120e7f7615c49105b

SHA256
065fae467d755c882fe10d7f660461167bacdf1c646b38201e00031bde5a8190

SHA512
4d47c7bc14bb424305e04d9987f5654b9fbd07fd6815f1d82d9deb13848cf7d8da196c3387d4fbf0d8a2ff734ace6a144e5773909ac11a230a6b110e5f7a722f

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\logo_retina.png

Filesize
6KB

MD5
3d18366e9ca06912f88bdcac8c395ee2

SHA1
8c98d1a50fa6216ffa1c6a741e04ec58b5915464

SHA256
6b768b3c0fdc71ac309836a2f106446ebfd409f98b85afa07be2e55925f7687c

SHA512
80ebee009e3025b206e2381ceddb234dc225b2cba9c783973ac667789780b720352766c7fe41c3da1e37ebfbd82604d91aee4b96956256e10ab2ad07a6b617cf

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo.png

Filesize
826B

MD5
909797cbd8404a2ce18895f5b7d69423

SHA1
5302e9b6f2fd477570fd636ef3d28f6c472fca57

SHA256
5ee3b5002e4c14d197ba47a219c9730334a2e689091e3c720e9d09122b5c040f

SHA512
58d73937b9d75b03a43799f040d0fa72dec9a464e8e2c5fbe44f692d8c1221e85bb1cc2fae89b6c0639d08bd37b0fa3b3b8b57c1d34d97a5ce5dab661caef97d

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo_2x.png

Filesize
1KB

MD5
ef22bb8a66fd77cfcf117a1919700b06

SHA1
b3a0dab9f61f9c48f0cf0051eba0fe19351e12c9

SHA256
177cef859f97e4c55f135999c8a2f11520666cf431e6ec09198bfa1018958dc6

SHA512
b92370aad53dcad123adb133ddfb516b650b45bc6ab3e8e855ae42c0e8593ba5d84b9abaf337b2cfa96279aaf69b03f6976b59ca2cd694174a7f02655fdb16fe

Download Submit
C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB_EURO.txt

Filesize
32KB

MD5
27cdfcdb547b1db26eca097bce7503c4

SHA1
dded3529a27186d0570a906c0046c164f96c8fa3

SHA256
f48b3e8fc0679f7ecacdb5c136b409b7173e2c24806dabb026dada439676748b

SHA512
6eb3d2e140a2a8e10ba1e69e561717207e72d67ada10b2fd064cfb4f00ae3d430185ae6cf579415975456d92a86119e0695f6b6d5367115db0035471b160569d

Download Submit
C:\Program Files\7-Zip\Lang\HOW TO DECRYPT FILES.txt

Filesize
438B

MD5
515f29d240c8defcfd6ee9395f2f7564

SHA1
e7ff1b461236fc7dacfa7776e43bde1188fe8a0f

SHA256
dabcf6b327c3ec0f177e21044c1aa01d215055b8b195aa1a7298ff8f8820ddc3

SHA512
5c42006bdfde4ba445325c3ad5dc28b5c5583d50c0cd853911c6224827b0dc1ba76d3bb16514b5815b3d82ebbf8e990a32ac64450df45de52a9f36fe74e0bf8c

Download Submit
C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif

Filesize
153B

MD5
61f51ef4c749977540451baa47632167

SHA1
bb9f0c5d17205316589cfaca227feba29de7f324

SHA256
536c04cf0c28c408eae391476b9e3e192dd595ab2d9dcc657eef9899454b2f33

SHA512
867fc234780ac7f432cc6f6b256117293fffb720b286397b8e7856830821ec5a81dc7753c3cf4b25d6aa3fc9a5b2255270a41705bb3e393da862f00a1b1abcaa

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt

Filesize
190B

MD5
6a86043da7e970f3a936e60f1b021c0a

SHA1
0e7466afd643210e6fe0dc8de568d41f8d2d296f

SHA256
71926580c3e091566d9316a60999908df51bd4a3a75f7341bbb189051b2cd878

SHA512
033d68ef297ec0ebdab347c8f569d3b3868d1e75b4c93a348ffb676b14d35a393d0416f5329b80a19d737479292359d34e3e96553bd2172e85fd73fba40d669b

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt

Filesize
190B

MD5
1cfa92245910eb9b98a39e725cd2d051

SHA1
890992c4d4b7c3ce16be011f602b487b6245ad6b

SHA256
76e5c13d602247db44593713e5485b97740b4472473859f223d75a7580d0e380

SHA512
0273e461bdd874807cdda95d5070401007ade22a63b89eb5fb3acfc7964b17a6efb04bf7221c768737037661e0fc6b1ddf7cff04ebdb6a48582be1547b949b2a

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md

Filesize
1KB

MD5
aecc71263bb97bbf6fef382b1524cc50

SHA1
5e8e273ed72774fc1a70a2c4372261be9901a319

SHA256
c1088c6b9019c69204f6754778a88fa7c62039bbb8aadc88ecef64ea8ddfa3d1

SHA512
ecfe1d2004eff72d2977d4d4d586d447498a5148de9d2270ded37bf29729735edf7d7646359864530cceecbb2d6ab60de69ff0d202f0c8c7bb891090c5c75c50

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\glib.md

Filesize
31KB

MD5
985ddcb637e37ecfec27b92c4e69210e

SHA1
c3c725a3b06755c6c5664ece432faeae2d56ebc9

SHA256
95849fc1c07c6bb2f298e84d11bdb651813ec5cb16e5bb64e404fc428d65431d

SHA512
2ba56a52d34385b9fc9205037cef89b9cb6c6af86a471865f219a12ca08bb1bc422cc0c9ff50dd34a4c68339ee84feb8527f394a1a51ada7c79f34763d862703

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md

Filesize
34KB

MD5
61e20256f286b9611ec31134fa90d027

SHA1
a53f747c812e9fdaedabda23bfd600057b52e988

SHA256
d67f320c2297667c987b57fa4d290b140b115a6a9669acfe1f06797bcefec3d4

SHA512
9a651177d1edadb5b969255fa19017d4753eba9f59864db37af0d313898f96b17d2e88c2accfae0161a9a8cfbe2501e91c1b5cc7262c3c15f7d60b90d4158351

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md

Filesize
23KB

MD5
f36fa926fbb317f1728acfb457327dbd

SHA1
31fb6601bf500b3fd4f04786b56a1d9fa55ad1d6

SHA256
5915285b49241dbd3887c2de9f8fa744f8d701d63a858f9f9804ab3fd3422a2b

SHA512
f9bc819e2759a787769c619f9992986004931bd9dbb601e040244c71e524f467524a73c17441fdd37a244fbdc7bf773f15e24837554e8e30d2d682ed0193f8ae

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md

Filesize
2KB

MD5
b5ae8d8fe89568739e44a14b6ae2f022

SHA1
4262e586a2d8a0734094242c178f7d6aaf834a9d

SHA256
a08d88ac954150a5c673aa7b90ae9725b57d2aff50ac60432685d764bb0fd497

SHA512
93ce909003735de777e9bb0f68cbbc9b4c22b633ad047a7ce7b6b7597d6e954cb78af90237654e8ac27b27573247314e16836146833f31069fdb10a53e2a3fe4

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md

Filesize
1KB

MD5
7019e074b8d10739ff474b8f86c8e825

SHA1
ead9b6a59946af35e411d9c10d85f8ebc77cbf61

SHA256
f194f29317d9198b086fdd090194e6bd47d296b93818225015567a0e27c6a4f7

SHA512
ce72f49af4731d9b48e6cb2cdce201c58c767020cb772f9854a94dd7d856b80ab3cbf55b340ef6d2fa2412755db4acade4e621ced5a9cc04c7508f1f8c8ff2ac

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md

Filesize
3KB

MD5
495b671793daf9f7f53da86a5b0022c7

SHA1
ea226b92a64fa19698cbeb11e6b372521917b745

SHA256
9be684995d8e5001f5bc83446601e20286ba1c082c75747486c7713fe5735c3c

SHA512
0c07c66e326fcd9ca6591843e67ef79519a0ca6a6a11b1a92c88b2549480029c32a7db1ab4230e7dcdc33b70d9bf419561af8cd571429c7186e0601914c83a87

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md

Filesize
2KB

MD5
92aabae7a473e54daf687146453f28e6

SHA1
15d6eba289e1c5ac96c6115ecc4c70278fc5dbf9

SHA256
2a93451c78d9b07dfaa82a62442d3fbebbdbba620d80122273c84502dcc07033

SHA512
b3f3a887d427393d0f184622d23291b23768f20d08df328a6ee491903684f4babd9b29aee2cfd33911762f541207eb11be2d37632a91b68b8b7ae4bfc434fc68

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md

Filesize
5KB

MD5
9b859ca244ab30d42e15fb361c83f1ba

SHA1
091c4d1854d8a2252c37ed15543763b9474321e0

SHA256
aefa3ad6aac4f9ef6d1a980fd7be61415c9427df4c34217f5c6c717605c6f7c7

SHA512
fe6c7ed7fe95423d921d4dbfd35beaf4dced474079877684dc29a1b6521af7856c52bdd53e5518650773c9b398d8f88df3027a0acf7728c89c100336211f7d42

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\public_suffix.md

Filesize
17KB

MD5
9375465f66b95f6f1d4cd195ad2665b0

SHA1
362d9c11f6707ea5cfa3c9596df252db9ee6cc2d

SHA256
fd7617c38cf499c91e20cd453944ccbca68a7cb0e5f3a1158a943729129cac72

SHA512
9dda636f15efbb5be4a9ffd40bb63a6ce1966e534a1160750987a96991cd0e0895664946e9aded5888536519e57d29a67a8510485e2c01ade745a3441e7fd215

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md

Filesize
320KB

MD5
77326d505e9a7fcf8dc312a381dd6a83

SHA1
3080cf2ff0c649730749edcb384aad45335ca66d

SHA256
f0212b4ce6d3c87ef3ea2cde02388083bd05b81a16a9d89c144eba9e7c9cc97d

SHA512
9a7ecbb43779f42c68584e791aff2cddb4113d640a4bbf6a7aab8e8bcc9d265525a3567f1f1f7193246edc3d2f03c732080ab9ab73a4258910742b915b3899d8

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\asm.md

Filesize
1KB

MD5
31a88f5b1e15e3997782a1fa344882a8

SHA1
7593753be107be92b9b108972f80e4109a2d93be

SHA256
5e59cec8a4fe732fb998ea3462ccf5f142f5e64f3b8443fa82d4f1fdc5156f43

SHA512
b95dca151c0b881a625c2847028e0a5f6dfeb119c374c2a247d8190941b6469b8a893687eb9a606e1a088490a7b6b0d972f6597dcc74e1066490ea9daa094de5

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md

Filesize
10KB

MD5
679300d1a275f6e22b957ab7d188a65b

SHA1
a246e38fc2f556b529ad4af7d4ea05caeb08a66f

SHA256
bb209f550ca274dd1ccbbb8c141561acb449989666367aecb84aff7e99a16c3d

SHA512
a1d60f1aa52755ec58a36ee7f127763a34d82a438901146f7176f314d694282cdb25acf8cd7bbe09a82d83938e36465655555cd2409a02e4e8ad0acd4fef33af

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md

Filesize
3KB

MD5
8365aa835bd88da082bc26000453bb6e

SHA1
9a549b0341b9e5a814f2ba5147fc4bc190752ec3

SHA256
cf5d6fe6f0ab84b55811b403890e89eb063919ed7c3ece1c7b6469db3269b311

SHA512
c74104e77618962df9dd80dd270cc9590a3d49cf84ae0d1ec7fffca1678a2dbbef6f44c37bddcfd06e51b0296f8693a4d9e544a42e23b6e47497b5d7963718f8

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md

Filesize
162B

MD5
561b6e7baa3006d16c89e45ca8184091

SHA1
9621663c0d0a80050713e9f3a81c36cdbc4b42c6

SHA256
9f9de53d9052479e5f7e9138048f8a069bee1e6ff8822f3dc22fa91451c0d66c

SHA512
a05d5e52616ecfa8c8f5db692c24a923571fb08776a2e25354f402d24395c9afefbe170dbf7ccd1828f06f9aac1a5b66936a800724e508e4515157ac433d737f

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md

Filesize
1KB

MD5
aa4c3384e3ffc3b6fa32b32d61451fc0

SHA1
1616375e82de3fc5086ff9de7a085f8e5821da62

SHA256
69936abce775e68f8f55074d1b3bfdea95a75557615ca404905b968f7f653562

SHA512
81ec7d177ec3b02988b7a98721c1ea368f250a02fcbbbe05003e475ad2a1ab873e16a3eb773b66cf240d82b231d76be9bc3ed6b91504d92c84fbeaa989a4b2dc

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\dom.md

Filesize
3KB

MD5
8b66e2c3e3e1f246fa72331d44d77567

SHA1
5584c620017f1f6b061607bca6b8b13af3a125da

SHA256
b9d7798c2a77a639602b827944c51358b2959687d961d52de8c884c9789e8f0f

SHA512
31e5b580d4e328af4d1b5c326e04d83fbcb2d6f2269a68c1a7b2f36c5d161ac324c7ed246fce5a007258a83d8d64ab75e6d2e1cc09cdb877cfa62d0851e9704a

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md

Filesize
1KB

MD5
67f5b70cb5bfa08cb7cd50997252fbd7

SHA1
825ab442aa5167c9af7d284b3e29936e454f3f45

SHA256
be4d368846e19915c9e217717cbd66b2c96254b34d39f228face0391d894ff8a

SHA512
e1154ca4d87987ac6cef08df9270c6528f7ccb1b4c81f3b56c53a838843521dbb259e897f930090ed9ff59a257b4e1a8035d302a571d7d5bef8008ca78b77c89

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md

Filesize
28KB

MD5
5a1ecf98c0984a66d9c58f02a64d942a

SHA1
7a7a04c13a83853a5e8922e74110b708307d1eb4

SHA256
173360ad6972577d1f91eaa56468d95b1b220ec1845ac1ef89369bf28242cd16

SHA512
62f9459cbe12e8806f20c9f9680903ce3f7987ef12583d5c8e5160eb1e8f188324f59fdb0bcd770e7344ba71deeb0c335812265c459ce90a028a2322661e26f1

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md

Filesize
2KB

MD5
d8e526bac8d01d7b0008abcbc5f39184

SHA1
bc9c92925de0796990388f405e60ce5aba8d3b80

SHA256
615190676f59bb134a6f466b4d3cec62115f474d598d166d7454eab639d7232a

SHA512
0c0a93dc220df721fb70ae90a9f343e43aee041bcce4f931953ba7d3ceaf460f9879125a26824129a9f7f4fb2b0efd9a8e69c8e61bdc6ffd7eff8de8f59684b3

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md

Filesize
1KB

MD5
178766bf5c65b1581efd6e793fc2947e

SHA1
69f8a25c00e57d21e632e734ec3cb8293ec25742

SHA256
c0366bd5822bb8a808c77e9c815031502b59f6269fc7e117425b96d5e0749c3d

SHA512
bd797e70b7b985cf040f4194819cb27a958b0e372695ad931c73a4edc5579a9c7d76e3927112bfa8cb357eb66b4438519fc6055536f6e2d86b374718366c92c2

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\icu.md

Filesize
2KB

MD5
ed35df8121c275eb0025565894a41ea2

SHA1
ea5c68985db2dfce7a743cb1da816a0bb28eb473

SHA256
5e3d868ea4c3141204e114bf8255664446077509e321192ca7c99c17eeb648a3

SHA512
f5bfbadbc776939a29923b8d46bada28b03d69fc8f8ce27713cad7e109ec0b16233ecda97fe3800836fdfd2e79de256115fc8577be64d6b65388bdc9f111f7ac

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md

Filesize
1KB

MD5
47f3e0cbbea48ae5a3c0d2ca8ba9f6ea

SHA1
853124df1a62c11fde7e1cce0e777d43e306ff09

SHA256
f970b88e2f8af8a1c554f26adfa8af12be16f9e48fba7cbdb31e2bc774e387a0

SHA512
1ce44241f033e80b717193707ce22e0aac6745de4bd7dc816ff426bcbed734921052013ba8908508393a38e889e69baa5d01e4f176476a299d7ef94b717f6a9c

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\joni.md

Filesize
1KB

MD5
4b7e5ac0e325dca9edbb28b335284f22

SHA1
fc2947536cedb130d1bc6e3425e62bf7991dc2f7

SHA256
e17c6a5783b463ba1cb0345fb395d442a805cc13913d1efdcc1c41de16713818

SHA512
b39a7c0aa8e89456b646f2322bdad08f5e7a48bc12724f4a766376ccf6bee6e12937cf86370680aa1d5bb8344228388ad90a25d2619c3f7e2eee1a37f6951393

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md

Filesize
1KB

MD5
b8729821a39642694322020637bab0bc

SHA1
081e722b7956c38f2b1603dbb079e6de403c1765

SHA256
0faefa9af3bd2e3b530c8adc39442d21a07bdfc53039d051eff46eb99bd8734b

SHA512
6e31639cc3732fdaf07301a7b81913d23cbfcaec5ff73dc43fdb23d0a883e9c38199ecf4001c8d78f91312d7cb0d8641c991890c92932d2ad21d85e688aeea2d

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md

Filesize
3KB

MD5
7072ea411bd78e88b6ee59a2945a21bb

SHA1
e18749abca992b0b09569e29fb09e8b3f06c007e

SHA256
a6ae0917bb393ad886b572a2cd3643fb3ab5955a832009a88d8b08e9547baa01

SHA512
71f1337b11b91c47e124b4d0efc91ef40b28f65e154456119966c040e073f6d6872b0db9626ff295010f6ab2603af9f6bf7cc5aac5f0ae84bb8c185077288175

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md

Filesize
2KB

MD5
3a765edf38c843a0ebe7ebf9f47d2e2a

SHA1
fb38c6d2f14c4f7b9abdba2e623406829a2e079d

SHA256
e75635347edd68b421be5058f8ee2d12dfc4135a7de14abbff2fcf4d547d8b97

SHA512
1dc3c24d68042f384f318295b41c612beff4bcad94d9d491635e14a2f6d20b599e4ab3ae7891860d5aa2033bfaba10fdcd0b787d8cd8b6abff22da1f922c8d9b

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\libpng.md

Filesize
6KB

MD5
55b745c7b0843e3f89ac271c663498d3

SHA1
3caa858164ee49aa50203e3ee31108f6de496541

SHA256
422a89048e60de925e8b76afd3f5c10d13f5eaed1c104609ef67856324824533

SHA512
7694fbd665a0ea752f8889ea50c7b283154b09b9ce4c08395fdfc8d62253780bd353622f975c8dcd7daf80a373625368a97130043c4f3988eec60d77594530d5

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md

Filesize
5KB

MD5
798a3d75185fc7683bc18c6a2844b5b6

SHA1
54558b7052878bb639c36d58e0401ac0fb7699a2

SHA256
edd9fe5223abf711cbb409217601195337f7bb8275d5335e50a66179617c1b44

SHA512
0a7da4be61c27bc37fdc92d8745e3b31d2de9100b221dda30973c968197e9e1698d44ce5d0f2922b980898e3bbe1bc3a12ddf4abb2e8d205f3103db7221874b7

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md

Filesize
3KB

MD5
9fe18cda7cac62d8072adf86ab24e116

SHA1
1a8ba131136e02bf9db9683e35d9b172b4457c52

SHA256
c0a788cb181edaf08392b2acd91643d50129b01b981695b29981a3bbf6e31f03

SHA512
b057b91b16f58b13ec77aa14c3424f35efde7ede1211ad8cdc12b87b6de63839622db41f5b660955e56dc416785dd439d998b892f34354796ffbeef59fce33fb

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md

Filesize
2KB

MD5
8141005033a1fdfc1d9edfa5925da78a

SHA1
5f3cbaefffd6f27a13ebdf3df8e27962f1dd5a20

SHA256
3252ef9b6a6feca91368191516a266ed7ccf10dd8d912a67d264a3f2861c783f

SHA512
b9a38ef6bfb22680c6a8c4820d3c66f656a9553697d3680f31aa5f0b25149b834ddea76b0e83b737533e9c2468f3ad74fee10fdfe115671dce60451962689de9

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md

Filesize
2KB

MD5
143a2d7bc249891b2cc4946b0efd2d2d

SHA1
16c971a9f43c0421d371820d1228082ada5f28f5

SHA256
e2c4a044262c44355469e48aff035d408344efe56757e030044422ae44a6cb73

SHA512
e95a3e25dea2337ee2a0d1f5e863d681d9930a0e5f24215d2c1da314c4bf4c5f0b78504466bd1dec5ea5a60f7b139b9e55efe8aaecc479f81e0b0a6f666f6637

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md

Filesize
1KB

MD5
37686cb3783ec1993c670ef27daeecee

SHA1
1285f2242d23f6e9024967ec7d77ad9317476f63

SHA256
0946633140b95588f6dee16c5895f7dc0a2669d6a9c3a073383c75828962a351

SHA512
0a01b77d8957e9542197f5bf3eb65ba41203c6b0b38570a6e9c0502a5c57202ad1cc494c557b6442ac38914fc0617a91c1ea63a401fbd3b3fbfb0ba40c0cacfd

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md

Filesize
1KB

MD5
b1fd7960e04559a89efa58d86cd99932

SHA1
24f0920ee502c042a0091729c7da45c865537c42

SHA256
5bb39bd16988f0c37dc3fc09106db4544a0eed7f40ff4948cfb9282d58282530

SHA512
0a95228272ffd092145866a4218fd8f1d6d2be9b6c36404bd92d49b643b6ad7a3beae6e17ed888e95e71b3975200e2964fdc3fe6e057e6630d9dbc207c6f8ab3

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md

Filesize
11KB

MD5
d5f9b74eefe85471e86823c7aeb578f5

SHA1
1aba36cad62934f9b0c21639eaf0f85c9d901ce3

SHA256
b7e64b16e484c66cc1ce15c05be8791079b70663373c9fa28f6dade5d3dc812d

SHA512
8f25723f3202b959cdd3c2f4a81e1a976bb3b0929dc7d15962ca381319464faffb83e930c3dadd83145f3458c0b7faf605ab60f580549a3bfa7ea2070d8e8cb3

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md

Filesize
1KB

MD5
99182f4e22a7611123496e2c19dab32d

SHA1
b297d802f6294c25967990a17eefa9ea4c968fa4

SHA256
4807d259f452113e4edbfdd129850f25f34d2477a071f699bc651d94ad22e5b6

SHA512
306970aeb5d222e017987569794216f208a5d90489e4dfea6f7dcec0eb3a94b75212e1943ca0e3584aca24a56bdd81a4bd0e85ad40d0cfecda4f02cc3afb7eb3

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md

Filesize
2KB

MD5
2ea6348c2d8e4e6e4d4307ede6eddb5c

SHA1
dda5aead9d2c162e14bc3430d86ea4f50ef40150

SHA256
7ecbc102f6f59926771b5bc7d14a70b255cf089e2cdb2367a5ed4871ad3c3451

SHA512
a3898c66a7a1a8819547a3e38563f7db12deceec6a1266650a258e7904b355e6a665f31d71b026ef6a7d485b88f89ac7586bf20803d4f0b1b769a1c17709a28a

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md

Filesize
11KB

MD5
8f2efda0749a3ebd88fa49058d3075af

SHA1
b113fa2d8190f4630613c6f272369104639e479e

SHA256
9f1f3f396f157856edc90a407a6b005878741e53448b8616aaa60ccb091efdb5

SHA512
3d7a319b7ce86f226bf33344e590e4c42ed507b4740ba2d0572057f9ee056877cb2a0b48c17fadee9d598a0f829eab1ba4c33140ed09f527f770a4b693b91a06

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md

Filesize
11KB

MD5
f88e04d81a77b578eae247de70babfc7

SHA1
5c66d7df679ac2d8cf84feaee114e745f0995f4b

SHA256
d3e8a75f42389ac3068c7a2871338af18d97dbf7bba18bf84c0a4df55a867b0b

SHA512
c2d5f22f359123498339d910d1b1987540c0bc9726587ca15decd4f420d817d8dd8ef2c34543a12f00dc7107e47d3640196234c3038a9611f943a78f06e707d4

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md

Filesize
11KB

MD5
d4798c13fcfdf5cbca71555ea7f7f808

SHA1
727dcbd315cc2ba485d2879f11d1fb232cade467

SHA256
4e95e20add59a85dd74e2f78e23585fabb8d1acbc83a12a15f81c539299d2e9c

SHA512
f4c320faeaaf1a3e7baed7a23b609f537fd6db86f459dc0e5cd961a5d1778398ffba285f0a8f0454debc116f02993d2e78ce23414cdebf44142bad3e9dd27c29

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md

Filesize
1011B

MD5
1a188ab5b27f392f046b44e89708b61a

SHA1
1c614686353b923986808d07c561cb3558b14fd3

SHA256
959a5b62adedda3f48347f03447cdef92a3e9b14360de1ffc2fb6e3a81fb9e3e

SHA512
44d4b90c61699394f4379099b9b0ed8a384e20684c4f5d971adaa060052bcc4ce036db715f8e51983f27d61b891c0caf317f82e53f6552aa2f79843ae7f22c7b

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727656120098725.txt

Filesize
77KB

MD5
7435750f431d0e1cc3463abcb760110c

SHA1
a4806f888022e1981c3e551edee32c9ec765b993

SHA256
997324d04c965c598bdf3f986fa0ab2cf4fdd7316f2a4be8f0f47a45f9a442d6

SHA512
480ea8c177ce1426c0008555c9f5afb5447f755c576ff2d2305dcb2c5f56123a287b8654f33feff9a5a72a603227155c483307ef7ad64ea3d1f570a778f0db9c

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727656590293648.txt

Filesize
47KB

MD5
4ba0781c90bf4b06750f8cf59b9ad872

SHA1
937a761d5647fe0225d908c8a2865df2582706b0

SHA256
897a1cdf2a9303b9bbdfae1b1d8164dc5961fa7e250d8084e61134e678137923

SHA512
511945e9f26adfff63a5c08e1cdaa5b37fc8f86213e6a0e0e1dc47f58792ff2e680076214bd9f5f7fe800a3a12f6743fcaced394d76145e39916ebaa5da9427d

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727663328721506.txt

Filesize
63KB

MD5
2c3065d8eaf7b2798c3b7b14a38f4e93

SHA1
825ef9c6343fb960b2dc54fb1a739afff5ff0863

SHA256
621e21302ac17e8c1bb7686f7c2a124c849de7857ec7cd1df32f0f4c1cc60866

SHA512
b29d4e4257a9135b776f4e17bfe90f58f8b6b2ab84090c0b918e1c8e7e8652bcef7a362fe2698d34d26e8a0e64db9265d5e315df7c63d82d33bf781255d777c3

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727666039184869.txt

Filesize
74KB

MD5
59c896af0e9bf35e67e5531b6593b19b

SHA1
712941ac13822971ab72cda37d77874fe88562ee

SHA256
c5fdc6e27840471662f30f7bb72e2ac0d3a1723706ab1fd064f70eff6391a490

SHA512
e3268bbb1421fb0b02b619934ec1f1eada96226e71bf174d886a9d5a98496546d7a4320b1a963d2b17aba186e598e7e01c515f813d79173e320fdd0cdaa3202d

Download Submit
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\File Explorer.lnk

Filesize
407B

MD5
d8a5bb5064224cf77ac34ff3566cbe20

SHA1
785e78d63f94be2e7e100ac08810b0d8b3e14a09

SHA256
0503e6e596200c9523b74f1715267449770c8e6c2f377de8c3a5358230b443b4

SHA512
e1c8cc1517ef475a559e232e85936446b57d154f8f9feadebe64e6c2b2c23af7b7de4d252a98651570500d7556cefe1e61f18d22cbab5e14129073276de3a0ed

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg

Filesize
21KB

MD5
8a131e686f2b7559aa448ad87c8a0132

SHA1
f88ed9c516826735a432107ac2dba6c13725b199

SHA256
a83bc2250f4f51be3fddf5baaa9bd12e727984467b3f4dc23db66167366c487b

SHA512
53bfec80311d91e1a08ccb9b466605f3b6d1d7959aae8105fcacf12abdb8e5e43561737de13210187f180f637962f15aefa97c9bdad753bee2cdda40f476334d

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\HelpIcon_solid.gif

Filesize
1KB

MD5
9e6538e1ee09f96bd696ffdf941b0c31

SHA1
8bf05ee8eabcb10b77a8dbe9ad523ccf6f593110

SHA256
f8e89edd113c82ea85647c4f4b7561567e51c0ad2b8b5c4edc4d668813b63e5d

SHA512
95f72b43725e93194be0e1c14e87774147cdfdba8046cc7283a22e90ae7f2e4e2c82b5d4b0da3302e80ceb9f2b51e73a7bbae3522ac9cd3911f9d53d39a93539

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\alert_lrg.gif

Filesize
952B

MD5
42c0f6f58e6be7b9a2ab1fd075bbc55e

SHA1
b924bcc78ca3515a3d9b71d6610df25b9b3ea4d8

SHA256
82ded1476660bfd9c7157002a3030e3b4742f2cceff60f44c0214b2b060ce0e4

SHA512
da20fac333e63522730efa004ffa338b25970775a3693da8aee45af8f4977059ebb59ab6c4b548cbe40a0675966addea7bf4f6c70661246976b5e884b39af8d0

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\aspx_file.gif

Filesize
121B

MD5
65dfca25c9f496d84a2c1b231442c5b0

SHA1
c1a44986ae16b985f4d666ad36523444b6d23933

SHA256
ceb8c1d2b3c079833d7b19e93c9a8c0f7b6ca21151f564ddea481d963b402de8

SHA512
d2b8ee94a477357a2b7d5cdb70cab216f5cc85bc26788896bd896100757f8eee3087fb957f5c01f2b26d975cf0f9e8bd007faa4706b6e50412ee3e230047199d

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\branding_Full2.gif

Filesize
1KB

MD5
96cddaa44774e82d7aedc762665122a5

SHA1
58337de5dc14d9d1b650cb8ad048d7b021e07472

SHA256
eddc8bacddd596337b4981eef8468a6aa817786701eade0742b799ff616421b4

SHA512
defd1153a33c4470b96d401639eede169c22ac57a3e1c92c258d3e76966f1b7b01a8aa055dd2828bcb33b20e276a70e7775de74c4aac39e4c0136d93eae58a98

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg

Filesize
8KB

MD5
f25f79fab2656119ca12fd4832de08f5

SHA1
a5eb7a3538f4437b738335a14ba55ef862294a4f

SHA256
a2b83ec797c25f2f69d9d55618fa6462cb3f5de692c6183c0cfa7e877a6f3966

SHA512
3ad26bcf24f111a7b8c3b266b41337809a08ac24c0b1db9007759f53fcc704e6fd6ae6752bdf67eb05a3e23df0efe6b7f3ca94ead6bd8688d23034ceea6ba25c

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\folder.gif

Filesize
914B

MD5
00bf6bdae4682f81c2575d04bd4978d1

SHA1
c33b8cf1852c1806ae6af92fdb1bece081e1acf5

SHA256
94b4ca1eaa2008cce5cd2a723fca7921b74058e5f314d3f8102aacf72f2617c0

SHA512
e47119be4ad9f29693beced9542f3be7c542299cd6ec93f5a19fc97ce27cb51699b855a06415f8fd8c390d32b2fe40c4af9cabc875ea722eeae6fa3a221f8076

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\headerGRADIENT_Tall.gif

Filesize
328B

MD5
f0d736c834fdadbcb62fcd6985125005

SHA1
dfe2836694900f5f2adfcd49cc8ae7e793482ab8

SHA256
1e7c219bb4604d435709a121e1afe4022549479f5c0eaf1bc0d5fb5af385a707

SHA512
111cff8bb0c51c30fed2b2557fc1a71b0a4293e7b7fb7a100051255deae90f5809e838fd37be82dfad288efa2e6369050487fbbb04860fecaa085fe625e370e5

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\help.jpg

Filesize
1KB

MD5
51cd650a2589c3bcb1a747f3a5f2de0b

SHA1
2cef3e6720773715570093806010b42c7d3dec29

SHA256
27ec5aba2b778260f91ee4b8996baddf73c92dcb02c73dc6360a1337bedbc594

SHA512
1609826d62336399fc8e6e20f796ccf71eeb8deddb3e760a31a48ef956ad9755ec248bc50b723190e0f763a0f8804896986edf9261e4fec4b89a02da55585bf9

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\image1.gif

Filesize
162B

MD5
77bd4f8807abea386d744ba96c33b8d5

SHA1
d9e81e6f355a8d60c4afdd31fa40de753f3ca8b0

SHA256
485b8cdc78c3db3be230e9049fd3146fed497adc92060ecc056cc8fd5e4bd24e

SHA512
ee093a3c886359bbaa993c555b11a0ec26b14a29fd731f2a8b7e99b301b3f65144c4e7cb63479a2a4c7a49a316d69960d234125a2a6eae4b35f671fd4ffbeb98

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\image2.gif

Filesize
586B

MD5
417c58aad74b0cd90e76f77c8d2c2ac1

SHA1
b4d89ea1738f85e1a73a03f8a38b6454f9dd45ea

SHA256
41f2b910cc16dce9f4ecc40a191ad5de91485398ebb9668504c03e17a4e16e5e

SHA512
212e3b9e957bdeb5bd5e382e2381ebf3cf7cee00cacef60dce44e7cb697059287e8622efa54be63a10100d24609c568b2f2a17c43d9b852a32bb966cf26cfbb0

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\requiredBang.gif

Filesize
124B

MD5
f45e0aec75bddf174dc418ea3669cc76

SHA1
7b17407b945d748715714fcadcf5c54392971870

SHA256
3a1ee21a59e73f7f4e8b7535501ef6b0b528019472d9e5c5778331758e35200a

SHA512
7c8460d7665034838ab8862c286394390750501ab9d681c52bf44da7824d620d85d7ff57dcbe761f4a9a091c6de7be89efaaaa1ff4ab4002ee5902bfac914b15

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg

Filesize
8KB

MD5
a3b3139f75205d176f310bc8d087cb5d

SHA1
92825048c870c302d7e4d88df8cc4e98233a5837

SHA256
f4d10fe6cd6ff7ff82d8002606c29d551fd788ba4b8a623003e1c5c6bcedc843

SHA512
028bccdf0968818ea38777290e822d128a68a9446214668d417b6afc04cd191adc1a215dc529e3e58cba982aad4bed786c8fbb98e0ff3683dd56b10fdebcdeb9

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\yellowCORNER.gif

Filesize
880B

MD5
3d615f1cfe48e6b70d468e544ac2b576

SHA1
3205d086f7dad7f589beb2a240d7207f901de8ab

SHA256
464163505bea41ef2cbde3924b909c072a42f7421772aaa11388caf9c971432d

SHA512
d5f708106872b157a370522b9ea537d71fc57478175a532cee21a1aeee114146f5c9e1615c25d7c8f2c54c74134706bfc577b671bf3084a0aa8ab1b97197a542

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallCommon.sql

Filesize
24KB

MD5
7497c087a3da874668d19c22c50a87f8

SHA1
c479cd4d93678b90112f45fa649a85ab442aa8dc

SHA256
43375589c0d8f88db5a56e2cace01db528901fba53112ccac9c7599a695d3ed6

SHA512
40ccfe68ec49502f1acf96e10381fa2c2fc7bec1ef6fb67975251a7edda56f5639163345933fe21a63cd9b5298655cdd05cfc1892346940c9118e3a5eff69790

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallMembership.sql

Filesize
54KB

MD5
c1512547915914e7c189d211a82241e8

SHA1
e084887cd497dada81f1687a12988d0d18e54a6a

SHA256
760a54b3641fb7cca0dcd91cb40b01c63ba861db9f90f8406cbb2d362b95c042

SHA512
119e4b7685aec7059aacaa7be253da8db02f95af59e573f890833135d5fa020800651fae2d5744864794916114c4fb37cf4ab8f6f228e22cf7b1d30ccb41ff53

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallPersistSqlState.sql

Filesize
51KB

MD5
d81911b2e6954cd40ad650ea71988abf

SHA1
7a6e901f33f975a7e87cdf5b3bf83a33d181eaff

SHA256
886e94a9d9ab98e9c8cbd9d5078277cb831a046eebbaf334ecaf775d5ea41395

SHA512
4fcf4b55de4987656153b8605830fa9e5c2b3532c3080ae698bb671411ebfc17e88c3df8a0927459c1ef3a99eabe1f21b80d08bdc0016ef4e5f492a3132e81fd

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallPersonalization.sql

Filesize
34KB

MD5
e70f90ed9ad03b1fbda7b574938a59d8

SHA1
921b41285e6f6a5650dc740fd10b8124d0360fcb

SHA256
587f8e85ff0c5a29c3fcad6ae9a925d7d648db2f2430cc1ffd77bf101f139ad2

SHA512
cd76538a6b0745d0e8a1a5808d101414f83b58c656c1068e59637ec90006863a500352f217f2412c055632466dd3cd47439c23f7458f67b71d3368fd4841b2ef

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallProfile.SQL

Filesize
20KB

MD5
83cc3ff8578f31abee66540cbff4f422

SHA1
845be9ac25babae73dc5cfa1b598fc50cccf303d

SHA256
2622b503767c00ce292bd572b9378580b43269d1424adfa2e9ff8eac808a87d0

SHA512
8d8e7b44b62571b7a574d38efe25e6c21a9f816498c27117676068e623b5ce3a245f5a4c59523adf0be923d8cc67f1ee7be8eb89c869105fdde5fcdcef311fe2

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallRoles.sql

Filesize
33KB

MD5
75e9c640523c8400c941bbcc74da3e7c

SHA1
1c1275322131b7166e57e950e20007b3cb52e5b7

SHA256
f7d0d9d8c39117f990450206642b52fec04401b45a79e42b70583dc7ea2e7cc8

SHA512
9342d3cca5544eafc5d4304b495b411e351939ad09431dd8cd7efc5851df0d74da90434bed7fbc7cd1119a399b2ca589ded665f9963478aa9140b382434404be

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallSqlState.sql

Filesize
50KB

MD5
dbc0f9949992cae6be61e2f2ca30327d

SHA1
d5dcd522af48c4dd905f242176bd4e80aa0fb262

SHA256
e6f2b8a0b68d8c9306b45c79f6853bcbc3f85b11aeb51a57bd0858f3880b6839

SHA512
c3c6708f167b45fe3044f1b58e3bc211e5cf1bcf37cabf3f09b51e0222148cc859137310c3d1c3200387f69035ee474a0129413672ad3c48059d1287a69a0d35

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallSqlStateTemplate.sql

Filesize
52KB

MD5
bbcd27db1745966a1bc22091fe51e83a

SHA1
d87384f6215848210981a705a2f62b887ac27dd4

SHA256
80c5f84fadc2dba93e5aff966d66ab8d9814c8a4748faf3e8bb1214e1a150d75

SHA512
015bdae81ced18aa4e6e6e698baf38a4fb0ea5976fda7d732ad232524718d7d867ce222fc9f46427801f7dbf64476e36834e48d9ed3983ec4120cfce71190a12

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallWebEventSqlProvider.sql

Filesize
6KB

MD5
d93feebefa356bde982eb2117a17b2a5

SHA1
a2de5e8b29a4bbdd34af00deb17847588c1587b5

SHA256
4f7ae1ecbe06996cc8cd5fbbc38d7bee154e30575ccd6d51970d98d400f69fea

SHA512
45d2c091001c2daf628b33ff0bf2d506c2577dcece802fd520fde616fb5eb1aea4c9dcb45f28c32c6e77fa955fa6966535957741460528ad9764f6d18d9873cc

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UnInstallProfile.SQL

Filesize
4KB

MD5
1d7bcce60394e087b148c9abeca3daa4

SHA1
7f95158c8295568e5c77aefe8096961f66a7aa7b

SHA256
df88feb5c8136d07dcf24fdff037e416be9506a96e97a223945bb020f118b9ab

SHA512
3c83a5975d61b5be51f64c094a1dac8315bf779fe7aa4915e24a69b70e3046f545e1b0e9539d9b972abade97751f90651335b2b0c0b5ae0fb6a5032387a2431c

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallCommon.sql

Filesize
3KB

MD5
61aad74f9a3edf709f11469e8b52a433

SHA1
f6519ec452667bea209b73a0e30a30f04b3210d8

SHA256
e66f0e761598e5f84ae4087ebc502d79c2a117064b2c45f725ebab5e40ce59e6

SHA512
bee2ede482f5ddeed967d3ff854b95adb74cc8a2d452072d9c2f7f8d2ccc2b60347fca4466612cc24b178d0061e6249dd41f53404a7ef072d000f154b18b9a30

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallMembership.sql

Filesize
6KB

MD5
d010626df71b6aaf6b2aa85c3e504ecf

SHA1
741a41b7dc1653424c3c989c70f35653e2336f83

SHA256
3f2e5c8a38ad871d32a9ef8183d75a45bb6cdd373966959274610f6d6f49fc4f

SHA512
33f1f70eaced1dbd633ae8769cce165e5501d59fa6971733657cd7f4f6b6f7b99157e41064e66d6c8f8ec0b374e8b10afb119ab9c885cd16c8acd11f055ee91a

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallPersistSqlState.sql

Filesize
9KB

MD5
6bcc8b0d26edc27e31b7c2b6b38e9626

SHA1
b9b22d13867d7edfc4b3ef003bd0b179f1d44f0f

SHA256
87054856cb58e6b2e4dd19db00e98813a41174eabaac9d826d7cc375657b4751

SHA512
55d636facb4da1f7e7200b7dd068b792bc46e0503632c5055de4323593fb48c67c774fc5c8996d4cbadb158a461f97150ac4d15d12039d88d4b8f2785f229907

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallPersonalization.sql

Filesize
7KB

MD5
1d139a7ea6da8cb268080e52e7088f83

SHA1
bfab81c1bbe194acb5d415a5e8231f9eabbc46f9

SHA256
67622b4b021cde3089c7ce3abb3f394a2e06583588becf702eec14f472530bb3

SHA512
82e7c8fe7d9d0525e9c22bb35d1711b1352275dcc1e6ccfd24994bc7b553261f6d8e8fdb54c9c83df21a766a7a82b2a5bc75926a6f3983158ed455a0d7cea27b

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallRoles.sql

Filesize
5KB

MD5
74c168a8b2661f7f30ae356a2a264d17

SHA1
46e4c617cba2d0d3cdbd320bfcbbbb88a59a7730

SHA256
e1fa7e2ebae224b63effc4545c35fb5a88336f564df3b4ae3431f055c9e20280

SHA512
59a35fa37c019bbfc09524011579f5f232793b6cd83ee7cdaa32513a4b6fbb1680a9e44269fbf90c596a8d63bd66d58ad7f0c1c9bf089ec25ea319954b3b759d

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallSqlState.sql

Filesize
9KB

MD5
2c4d15542a775787e416a24a5ea42528

SHA1
c3d6f7a5ec380b67b4176c4dff194cfd7d06ce0e

SHA256
f1a22545c502ce18e466e67da81613209646f945da7f7cdb702e3c82a1a07483

SHA512
b353e90ec3bb39fe1ba07688726103a23e3cda1aa2483ecdf5559004ea88b0dcaf9bc52a4ac61d5635ed57b409eea559fe1859c7d01322564ab008c6c6222b9f

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallSqlStateTemplate.sql

Filesize
11KB

MD5
b36d4b95b72644a22b9872655cc9c107

SHA1
8eac430372cd355cbca2532029f372fadd3847d4

SHA256
ef075542a31885215b85b1374024720efa3120a7d4ac7ed9e842c24a9de4ab64

SHA512
969d490eb5f8193cf753ffb38a4da33dee9dd8f5adb7e8a37af45c92335ed1555cf45b003fa1aa7b98243c1022c3d80edce2c4bb2c56e8bb5dfa4d10268f68b7

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallWebEventSqlProvider.sql

Filesize
2KB

MD5
6c8e7a78992c7ea9c00bdab0a5a29bd4

SHA1
71769593437cefe003b9e3e0a50e77da3cf3881c

SHA256
81b8381d13bc74ae9c86d4a91a8c311f383e54cb689a638306fce4711da0f23b

SHA512
6674b0f1c807669d893c378dc83bf2b95db2201299c8d4afb06bcd5e8addae7c11ee77fb93b2a132ec05bfc6443972e9a1410d8500fbc5e8e49ce9c23f7a6ff0

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SQL\en\SqlPersistenceService_Logic.sql

Filesize
23KB

MD5
b1f265a99bc7decbd7149056029de05a

SHA1
1abdb6381b8f5546ae2b3f7d5491c858707780c3

SHA256
4fe6af3082b244a57e3d3d13bd2152ff3a724c69ddcb7c052f2b65a7f69ed622

SHA512
eb372f01e3530e5c7f9a6c8fda4b8317ef1f966c73dc64fa7f5377959bd32ffef5b7f2bc0c141ca5cda240f7e8999bc42c419dc03a553035325b9de6bec198d0

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SQL\en\SqlPersistenceService_Schema.sql

Filesize
4KB

MD5
eba0f1236a32b0908c2d59b4ad7802eb

SHA1
8545a10beb2aca9393c7a86963a32e942427f0f5

SHA256
6b75af745c95d23dc641f95dc257e00d83b5ee8e7c4950b029c06879c87cd897

SHA512
bc3ad1c8ae735357d60294085a780f443efe6753f418b1fd221c7ff014b1829c76967d759d11df75bb1ffd918e18abe2fce7484ce238167a96a2aec7b40a379e

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SQL\en\Tracking_Logic.sql

Filesize
372KB

MD5
cbc7fe675cd619ff9e085bdee48f34a1

SHA1
b7beb0e5ce5ea8ff6f87c30c524fd2f0ccd7c5c1

SHA256
c973fb484621e398c3ee4f4ee7779e8012c1bb8992add5ba633a4aafef8a52d3

SHA512
f1e6960ad7b49972b7c6bc17ba72636dc49097a53858b7443932a9eac9470c8e28258c53809ae8e131e924ea5d366e2ea1cdd848fdeac8528cd972eed4d9493a

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SQL\en\Tracking_Schema.sql

Filesize
49KB

MD5
2f8137035243f883794af0c7487d29bf

SHA1
e84900a6e75b347c46414ea3d2aa4138d59886ff

SHA256
2836550dd82ef09a45225b1ff42fb5162cbaf68310e53351092098141df51450

SHA512
00a1cc48976b24a309b4beae9c996eaac00925c630779e9a29be1362d25b9d413577dca76db42a7e35a2e08050d60dbd9bb69fd9f657351c07be3b8a66b33a93

Download Submit
C:\Windows\Microsoft.NET\Framework\v3.5\SQL\fr\DropSqlPersistenceProviderLogic.sql

Filesize
2KB

MD5
8c19f0110527835fa7cb4636ca89cb3f

SHA1
917e441248181b19772a73b055bc8e9cb8064e33

SHA256
54de6ff987682096f635cc240cab77f16574ee773e590c2fa2b5fe8a5f5b032c

SHA512
b8eefe3f582d9cc9b216ee39a5f82359bf93d77a6a6e95826a26fa587bcb6e855d5586a1edf8ac7f8dc9876a53bede3db21d06d9c39d756a2d2c4cea1166352d

Download Submit
C:\Windows\Microsoft.NET\Framework\v3.5\SQL\fr\SqlPersistenceProviderLogic.sql

Filesize
13KB

MD5
ea78097e2d5a1747de7655a13062035a

SHA1
e7c0e4dfc2acd655a675eb7c9bac033166495ca6

SHA256
eed0454beb5294a2b333786755e86db26340368ef5aa4b3a7ab530b175dc2cfc

SHA512
80ce816db5094496005c1c86f49ea1ee35f63813d9abfc8efa33fea8a0565ba47f9561b05ed42b0e24ce2a990687b450bb9261783e467fa7b348c9cb4febc53f

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group1\1 - Desktop.lnk

Filesize
1KB

MD5
6fed9c1e181cbe5e029e7276d34b9d06

SHA1
117dc716d0906063848709d6da0d61e1afd4c985

SHA256
347c341bdba08e7ed6423344ce7dab31f1441faf1ac31309f49ae2f093ccc018

SHA512
2fe14b3a297335c0d1cf53ca65650a9fc4f2d1e44cf7d628da3f3da263af469413f7fb58352d4914f1493847f94f2c32d443bcac82930466c69865f8adb12672

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\1 - Run.lnk

Filesize
1KB

MD5
552406b7f46974c8aae173f1e28ee68b

SHA1
fa1683f452483044daa8d20a7fba697f7d4e0fec

SHA256
6186b3fd8b3ef575382ff63178322c54250aaaa3008561148559d4c662e440ae

SHA512
42b0d0409f4fd189cd542405148d02680061d7c4189c3903868992f15af191355ed89f48880136f31ee5fd53f4e795e93cf8068d18b4d050bcb403f52c730ba3

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\2 - Search.lnk

Filesize
1KB

MD5
06e62917c4dfaf0930fd759a47c1aa81

SHA1
d507cc917ef75f301a2b1e6fd0223bcf2bcf03b4

SHA256
bd72decdcb677b0ee44f46320cfd3e63f4d12cfcd9c40a8e7bb131efe3f9b6aa

SHA512
052393614b1946ba380a2ed08b2ae805c7b380dd039225b3c8531ba2cb758d4a6d4866ea51f2255f26cbfa8062a2af43aa6832ea6f67cb292aee016294d9ce15

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\3 - Windows Explorer.lnk

Filesize
1KB

MD5
99e901afbf559a316f3edc497ae347e6

SHA1
e64b8d36f49c63f06b75fab3a4e7f8a9dcf1c59e

SHA256
f3cad74a5879521077f09b1d74b23a5010194b4e0507205ef05c02d7af39646b

SHA512
19b5f3644577f11b7d61714ee4b77f8200d9afa1a3a1a28ce934deb47971d81e73945b46640492ff1ce05e4b3a7691cc458561a2850ad533c581883a3d6c0bcb

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\4 - Control Panel.lnk

Filesize
1KB

MD5
cc57e93a9412d35a9f14be67bc184f6b

SHA1
4f9c1fdd828bf6b30517f90d48903c3362ae650b

SHA256
d7afd09d3e1171ca26047a3483c0d026cd206cb2799022273416434e624e72f7

SHA512
43cd7f78db2dd2fe2b155781c204ca87b2f9481a142ad52593ae40449d8a25ab86797ddb0daa03058ce657f025bf6b21ef34225ae7ca86ee951622b4060b00ee

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\5 - Task Manager.lnk

Filesize
1021B

MD5
4d7e148e950e49b346db4b3e4d68cc4d

SHA1
9684ead6ddb72cc3622316bda39415e355f25783

SHA256
5b91f5f63f3f08a4e0ed4aa205dd589695f191ce5ae6f1e51b494ae1aac144ed

SHA512
0ab9234380aaf02c145a33dcd23d36d8dd0a8da6cb02a0733f2c398956a171253577d9adecfd7632df3b7b3de13c3ea027cc5b93c42b12a99d6f3765d53a5542

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\01 - Command Prompt.lnk

Filesize
1015B

MD5
ec7c8d1c6ca7cde523dcc1375be53af6

SHA1
2d54a733f97d3b8f6ae8b42fbc4898ff74fd4431

SHA256
0c521ebf278b96477255d1be829452bf6834a316b8ae47da98772a70845bc3a0

SHA512
a125104e5f0c3ed34b50a215dbded309c6c79eb2ae855f9cc82593862ef6527dffcb2aafb75651e2cf4b7bceca01e88a6722496e81176859106d6bcdf95a8f92

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\01a - Windows PowerShell.lnk

Filesize
1KB

MD5
15c757684c415f7b27276aaca2f7a8d2

SHA1
792e526cd12019979a425aa6f5823579aa92d7ef

SHA256
5326ced0cbdc611fad6bb069f5c8641fbda194e6c8fa6745ddff37a31130dc5d

SHA512
6acdac6d0b43415e2c13c778327a9e6f8eb5e6f8bd033c7eda44535ccc94852ef813b9f447e6451616e4d1e4de368bcf346d1b9e281ad8ae4d48966c315bdeb2

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\02 - Command Prompt.lnk

Filesize
1KB

MD5
df77b4cd053d34174fe6d689d84b0164

SHA1
a474459c758ec5016be24dcf4a8b954fbccb55f1

SHA256
b308bce03b037d66a5ed7511cb9eebe26370813066bbcb527854c7440b4d4263

SHA512
25eb5c63dafd84073cf28b9a5bf451dfc89547b233d2f8416be37be5e1610f21cf77f7abb376c601fb37a81b17393e993eb1d393faa2ac7d3afc55f24d7aed2c

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\02a - Windows PowerShell.lnk

Filesize
1KB

MD5
1cd948ca8434e16b59a832411f0fc634

SHA1
6f141c891ff70d35ddd4d1af9453c6e23fe6a520

SHA256
fa1364d30860c37d5bf703636956b8476c0c3e2208501b3f97779fe5d3ab5ae5

SHA512
698ded91f26553f497a35b67c3f154d8b99499808463720ed541e6ca1c8aad2a640fe522add85d1bc5aad0c9db7c657c1116622aaf584660ee257f22b9cb07a2

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\03 - Computer Management.lnk

Filesize
1015B

MD5
3fbf381100457bf1ca666ca49286609a

SHA1
18c5108d9174349cb26cbef01111fce21011ec75

SHA256
61623cc921764822a4a59f985ca13f170d76d2f42f40b72708cf2c9075a35e85

SHA512
ce708043b96dc133229e0407473c5618a34c7f91daadacb3ad6c73f8e255c59c87acd81387f39e61ca6e8e45e396d756d104d538fcb4cbc056282568eaeb1f94

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\04 - Disk Management.lnk

Filesize
1015B

MD5
202839b27760814f21a208d28211420e

SHA1
2b0c16d877081c77c98bb640a581f1312dfda72e

SHA256
28d2e6fcb6f0e04ffa34a1f1d660d5a0ced1ee6a019a022e5fd9baa21528ddc8

SHA512
9fa1120e75d76ede21beaa218cb4a2b71d6e0e4370e7542d9ea616c61ef3c5e76ed589e807105116e040068f668e6fa2f5815e3984d2fe4a567d5eabe048dd36

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\04-1 - NetworkStatus.lnk

Filesize
1KB

MD5
c267c3d62f48c75e55ff991fcd6440fc

SHA1
324317d2156d36376fa3d83924e73439e5fbe300

SHA256
539b3de5b0370789251278dc86061945be4929cdd405492cd44c075dda14206a

SHA512
552244bde7f411a8dd8b8d1d7a8791b64e31792d3efd597d667a65aa8fdd147b8abfcb9f20163eb06a6ffbce47cd09d0c2d27907959bd27eb14ce2a610bb5681

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\05 - Device Manager.lnk

Filesize
1KB

MD5
77604a07a29b000c0c8bb8746e6cf52c

SHA1
12cdfdb49675354dc34f9b558cbf5a9e72311500

SHA256
610e9c317448e776b64f86ae9a4673d07eb94504c658c65b7d4bdf21a024d434

SHA512
1b7e9ea3fabe020e288b591d15198aefa9f4328eaf2bdc7b6d0423ae34f809a9de4761bb11438c155251b3973f7697e81c6042b1b5adafb44f07d4c7904db0b6

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\06 - SystemAbout.lnk

Filesize
1KB

MD5
5e82804aecd09095de93186388f5351d

SHA1
068a2bd05c8116a5048f9ddc83f018d303935264

SHA256
3a2514f4abcd18366664948f06c280dc2146bb4c4c357a0e40d0198bed393f8c

SHA512
17f957870263c68a0d505394bf510ea4c22252442975cd1e5f320a4115f16942fa986e340611263dd4b49eae46da64c47fb0a6263229f5c906632a55cf02b508

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\07 - Event Viewer.lnk

Filesize
1015B

MD5
9e3207fc6684357204afb407dc7b05fa

SHA1
14dfd6daa43de475953173696b75b0b5cb51ba6b

SHA256
7924b7f346da694f163299d80f24285caae059c01c536f0e03e3346d492ab9aa

SHA512
5309c43d8045874d07f31c6fbc9133121f58f8ea913edf642a627d09481a2f5494533173765f65183d261122d4ac5dd755b23039615c690d3807620c4990721d

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\08 - PowerAndSleep.lnk

Filesize
1KB

MD5
d1c9382e66f11de7392885184d0d2581

SHA1
ffedb2df80011c290039be5c80e928e5976a3724

SHA256
20d5bc538545084899e354446675c7ef3dc18142e9a5c24bc8e7dd9fd5eea231

SHA512
91fe03c7a7458e0ee36a7ef6965902e1c8b911de786468e39e97108c2a952b8da26bc3a4b842c9e28b0327b63933d83ed5154bb3bb036ceadedd0e00a10a17e0

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\09 - Mobility Center.lnk

Filesize
1015B

MD5
5ad253dd6556f5deff32d755956754ca

SHA1
64b162b57a29f76977dc0b82a77ea3fbd78444e0

SHA256
1e7d65915c32e2d87a3b422883c227f035d644419c809d9ec4fa25d3960b649f

SHA512
1d47058a5b2c0c56045e974aaf76b0653d5b0641c184692620d915ad9cba96b8d27ddbbce60f4b6bfbe4c9d14d5af98970cae8fca38d55b28e65270c3d26edd1

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\10 - AppsAndFeatures.lnk

Filesize
1KB

MD5
2ec82da62f3403cfecf50f49ef208c5f

SHA1
18fb291c5aa95791a50253a0353b8a628f1b8128

SHA256
5d7a74770c42a67897775f3b2ad6a6ce8325b9079764765a6bf9068eb426c4a1

SHA512
ba33a63309a78d0eb363d9c5d808f169714982d924853c73f319516cbbd28c3650db701d5370857ccd1b875cc25ae84db08d65629c85fd3a8907a2b79b926cc9

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk

Filesize
352B

MD5
68323d60189d2d437107d3b542da7204

SHA1
deeeb8491b4bc27c5d5d6f04182f26fca6c9c1c0

SHA256
a27ba4327f06276d490f76060f6749938d643bf56db9ceb82d06910b4d17a4b9

SHA512
23475560df1c9745168ab4f3c0ce4b6903201bd4f7c4b29bcf4717332d7c62aba756fce8790c940351423d327b9a41f4207b698b7fab58ec709a84c0b526e3aa

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk

Filesize
334B

MD5
28223b45b5b88ca36e5a9af22c84f554

SHA1
8109a05645409347d4832acdd593151e3aa66af6

SHA256
6eb42f3d8e60315eecbc8ab013cb85644ddc11e15d474029d912e779ae464e86

SHA512
2f338683ea1fb138aa932ee2f8ec203eac76f1056f09792bcf989b79fc7101de3c6cf5f41ba72aa9f6bd2e16741e61b0934b9f52bacd27a59733c39b000c36cf

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Magnify.lnk

Filesize
1KB

MD5
3dfa4f230434fc6c811d3a6298aea10c

SHA1
0cce72879aafad66ba645499c34d6b0ad20f2d0e

SHA256
d5b08767a0036771b34c35daa77c743f1cc0916150bb17d420542e91c370dc7e

SHA512
93824b6dc3fbe272b19209226110aa4139c7f9cf51022cf0b851a821f7a0ef0dbf1da53b5038ae615ed9e1bf71792dc1909e2134f24211f56036a0ffcedfee4b

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Narrator.lnk

Filesize
1KB

MD5
be027c7005f33f7b514f727b7e630590

SHA1
d43836c3f46de360a46fdb64b4acf32c85faad27

SHA256
2fa5afd33d6150c56ef607303fac08dd885452e042484fad6a7b5db74c3ce509

SHA512
1c6c9a6a2d83b78c20789b96261b0efd0951040dddb7d9cae0084ea6a8abe0210f184f0f257a1cd7e08b9081db656be03ef465b8650bedc743ca5d4e7606ccd2

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\On-Screen Keyboard.lnk

Filesize
1KB

MD5
d36687cf64ff8ff3aeb3aefe3bb82950

SHA1
1e7656d191333ccede94c3004a47a4ed14a4e066

SHA256
ad56bfdc3bf412090947ae5bd2f4560eaddac98a08216bb99131b623fa6d07df

SHA512
0106cb0bd474a3a70f00b7594dfab5d2ff49a62d19e1b003faf2d901ccc98df6b02f2425ee7971e16ae4735e87d80c9f4fc608e3ff9d7390f9485b5b1bdf2f53

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Administrative Tools.lnk

Filesize
1KB

MD5
315ff8ca5351c899a20a75b19efcbf6d

SHA1
c5017bdc1c67442ea875a187343faac68b420e64

SHA256
9a8d514cefa7cfbaac610225a9224215223233ed9119aa0a9e4972e6ae60e455

SHA512
f8082a984943a3aac4820b4d43c29de3dd32e1c2cac4a877a49db5e16c6e25997d0972f91f0190a8835d4b792237c4c26b5da0fb3d9b0f26e08beed182e05dc6

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Command Prompt.lnk

Filesize
1KB

MD5
4f3f10af65884c4a49c57b70b33a01b7

SHA1
c285b719aa0405b4845d3f459d01b588c2117e29

SHA256
4c9497c77fc28f5d5af2cbcbd59e5c017e1e9e0c277d220860633e95e2d74476

SHA512
867ca0cdcd5ea7734c4c661829af0251b067c61d09192c12bfb5217abfcfe9b684e38fe91764d6bf8c9c134ec85647f7053ff3dddd354f8714c816a58acb0ea8

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Control Panel.lnk

Filesize
405B

MD5
8b0284b4f4477c081da14867d8a6150a

SHA1
5fdf8d2e065b1649081ab75db414e6b6e90c763d

SHA256
b4f404fcd6723dc38c1224dfc4bebdd7a370adb8b7688ff0b23689deeaadc857

SHA512
ae4018a957543496bce8b999a0fe360961815da4a2765af051e409293ac8c2e1589ac2338eaf4525b0819df88d5a0225011430fa94e5ebd032ddead771d9ed12

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Run.lnk

Filesize
409B

MD5
9f8feb7e6a697b3c35c88a0f92459f80

SHA1
ec0fc245968457e416556d3e120b3de4c8e954db

SHA256
bd2507e106991f2c6f8a0de78148e58a8e8bc4e8da9513bb0e6a8dddfb9269c1

SHA512
796d93fd9e940917dc410b69f0881786f929d64d11784f7093043461d73f53b152aab2684e10e9beef3284afe99926acb1f0eae5debe9860b6352c12b3b6ee59

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\computer.lnk

Filesize
335B

MD5
1c256433f33794d51ca4a2d18da9fd88

SHA1
5e7dc4485cce1be1d2d03383b6ec6768fcceee37

SHA256
247aa02d98a198f0fadc8dcd36100d12b73dfcb698d1576b766a148fbec6db12

SHA512
0c723869781a3b9736abc798bad445e010fcab4c485350bfc2fd363a0800c95d08e5da59fc50a25051bef200dbf72d97f82b06b2f0707b7f7493a52823ea9597

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell (x86).lnk

Filesize
2KB

MD5
32d8c80bcd97bfb2a3a0757e4d2e9f1c

SHA1
e8fc1d1950f7e000d799fed44d09a9b44c475b08

SHA256
e3c730d58913d60af5c2c39c2aa32c6a94f57329873569ba19766b80298c6196

SHA512
666afa8b8a981f08d971d6364d34c57217b1464f45ead17950927cef8809417d9ee031b0e7a57957881c6aebb7a41d2cf813ac48767e595c3e03a8be15c3fbe3

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk

Filesize
2KB

MD5
e7f2794864eb07a3e0976b9b20baaade

SHA1
2e63fce81869723aae4a7b64fb9c356f4515876a

SHA256
1a86efad374698d4aa5ee176806c5d84088440c222bab0fe1e0070bb5adf6ec3

SHA512
87781a2bffa74d55f08971e1535b9103a6dcabf19aa2bc9600d0281adda21d02f830e62fec1eea80213192afeba93cf64543889cebca3aa5b7f50554ef6e3a2b

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-msinfo32-exe_31bf3856ad364e35_10.0.19041.1_none_61cd745a990bcfb3\System Information.lnk

Filesize
1KB

MD5
267102515235879a2add28ecee9fef93

SHA1
3217314b20725d646ad380774649d5f148648edb

SHA256
1f0c5c4f5ec03cc2d1f35be58c8a2c0ad84acb11e4736ef8580b6555f285186f

SHA512
fe9f997821914915842a3a3fa3191220f3a6b67d2229a631bfed950f60fcf660985fc2cfdee63b48da807dace16ecf613949df46f768487ea604acea73b4cf37

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-notepad_31bf3856ad364e35_10.0.19041.117_none_4d353cf1ceb5d6d2\Notepad.lnk

Filesize
1KB

MD5
76f2036dd723ba8fe390a1dcbf2ab638

SHA1
ac561fdbd2c8b7ab2a92b8be9ffab621f1940ff9

SHA256
62fe1a325abf58644fb2bc6e6f3afaa6792b574e212f0255277b335832f7996a

SHA512
68fcba63b367cf6f9673259a152f443e4d3c70a2ef73629aeff84a486c3ce43ba60810b6dcceb8fa1e7a115ba79c0830f417cbd0651fd5c3c4378a5aeda8e442

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png

Filesize
296B

MD5
06b177bc2ba14eda2d682120ef9649ff

SHA1
71b81e1e98542282f5ae923336afc393c08b9a4b

SHA256
c014fabbc326c96d2bcc9698c2f331139670cd250058a58a3b0669bae436a8e3

SHA512
8034ca669b781a17ed9cc102ad29d15fc6f9c3344837f981f00d9f35cb6b5fd6a950457c5779177b9035fae7cfc366aa6e5b636783d08b11dd3caf7f4f2e7ad8

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_contrast-white.png

Filesize
276B

MD5
f42ca722b5dd799e73ac9abf5759f123

SHA1
b06629cfd0d62e1792951c38396b8325a3dbd362

SHA256
3f89be95ed057bcbbeb669aff534d113df0748ca621b7486037b1a1d986d2557

SHA512
2afda740126211bb60acc3332b76f17fb6381636ff2d276af738707ce651d3e25842b08408c44b7d12d3445162627fc8971a8416bfa84998f831f77d6eac18be

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\squaretile-sdk.png

Filesize
501B

MD5
d3758964b8072affcab6063e488d55fc

SHA1
58f0a03575162324129ab8485fd05590766af5f0

SHA256
8fb367028c4a11674e06de2ea03a7e6888560bf4d3f415a6f3b4d5fb6c33b0ce

SHA512
7d4cf4936f59fc0f7f06195cd052c19294208f47b7acae57b6e0ce02585ccd0905e6dcf2973cee63b9f5f6adfc989c3599ac26e81859d958a400079945774f63

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png

Filesize
296B

MD5
55c082e5c753a3be7704ddf066d0e895

SHA1
ced13c44a19f82b143b033378d601f93b1de3388

SHA256
e45f697a81e1cbd46046a50597ba9af08e1d8311647d62a17402cc418b0f63e8

SHA512
8a7dff042cf53601adb5212f9bc6a21e48de61faf38096def0a733188e22b57d0141a7b2885ab426f76c40c73ed92fb0ef80abf0e469c83a7c14166a6830a0eb

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square44x44Logo.targetsize-44_contrast-white.png

Filesize
276B

MD5
c4be1ce9dc39fb83fd5a2d617c2a4837

SHA1
eca34cd429eaf350804bce704d19ea61c74fd54a

SHA256
403a36ada7f7579d09670f9b98e7dafec1c2e1beecc5fd26ee6b5fd0b4f2505c

SHA512
3e736e36954c970143a82baa806fa88a36db812d09c08a6ab4d19a78e6d0fd2c42c6b8e59b62f7f4c3fc7806f5b1d9f30e934b404de6465e9280300b034fd64e

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\squaretile-sdk.png

Filesize
501B

MD5
cc732d0bd874a5559714f32366affe1a

SHA1
b1b7b5585059d53f44d8e0dbfc260472ab658c71

SHA256
a836ae986ad1fdf66b57b8f55eac652b146a474835c2c0ee3a6afc945bd60bed

SHA512
3d9324b6ff7f7db2248f609f2364c515e39985e7db154df70926194ea141cc67a8283b8ec91b0c0f71b97476755cd272ab6af1d5b44c37f1b5821c91d18d4890

Download Submit
C:\Windows\WinSxS\wow64_microsoft-windows-onedrive-setup_31bf3856ad364e35_10.0.19041.1_none_e585f901f9ce93e6\OneDrive.lnk

Filesize
1KB

MD5
1ccaf905d6c5c8d49bacf72f4e46db29

SHA1
319ec824802b35a1b6ee601c354a5f5946606e93

SHA256
908a71da86c8ead986cc989e3679eb0c11de6c9dd5535dab2870d7df08bd5e72

SHA512
d73949848261568734dc8361b5436d848dd0ed8edcd60b91496c4ab200b3b64a7bae26598bcd640462b19f6cf55b1438f468c4e938ec6dec1fdac704ea6414bb

Download Submit
C:\vcredist2010_x86.log.html

Filesize
81KB

MD5
ce0c544a7e3b6a4ae37cac8e97fb5f35

SHA1
fd7c8ea9bcf41e035a346bff84ac8154d433da23

SHA256
205a57090fb789fc44394479005756a3161db587ff9bcf489dceed011762b8ed

SHA512
719c41c8a06816db9d9662e24168005c8ccc4865db88e0016530fa344de570b286a46464060e1051c689ef80b1f797f87a517c106e44fe56f566b4e63dcb683c

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads