05727c011be355add7081833be82a806b3e3383c6042850bc14f426c1772e50c

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13-12-2024 08:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
Size

12KB
MD5

eaba1ae7456f1a50c16a6762371e0bee
SHA1

13b4aff7fd109029fde13495000853deb1678ba0
SHA256

05727c011be355add7081833be82a806b3e3383c6042850bc14f426c1772e50c
SHA512

8458bf0e270e952ed4b04d9131b3d017fbd9b09761aad876c9f3597acf5abb717d827dedb51b6cf5a37b683d0c0a34a3d754218ae8bd7ef728317664299c8d56
SSDEEP

192:e/TrG62a6B10k3g4fXk1iTV3HGc7EkpAqEjvu2q9C/YpXnAITZfPtRM5os:eebFNw4Pk1itKkpAjjI2Ypdm5X

Score

9^/10

discovery persistence ransomware spyware stealer

Malware Config

Signatures

Renames multiple (2178) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Drivers directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers\gmreadme.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hvu40GibjG6QKIo.exe"	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\FileRepository\uicciso.inf_amd64_32023cb966fd5c8c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\IME\SHARED\res\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_biometric.inf_amd64_edc558d403ab30c1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netr28x.inf_amd64_5d63c7bcbf29107f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netvg63a.inf_amd64_9f5493180b1252cf\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Com\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\IME\IMEKR\DICTS\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetNat\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WaitForAll\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netwew01.inf_amd64_153e01d761813df2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Speech\Common\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ScriptResource\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\net8187bv64.inf_amd64_bc859d32f3e2f0d5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\nettcpip.inf_amd64_96215b82eaa40fd5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\nulhpopr.inf_amd64_9839c838c72c0594\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AssignedAccess\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WindowsOptionalFeature\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_fsactivitymonitor.inf_amd64_cccd1b2cb61d2440\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_monitor.inf_amd64_f02375bf47a4adb2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ndisimplatform.inf_amd64_b6b644565437983a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_amd64_9c09bd1df352f065\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\kdnic.inf_amd64_6649425cdcae9b5f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netrtwlane.inf_amd64_20caba88bd7f0bb3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\volsnap.inf_amd64_ce438b6e0c5b1af2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\whyperkbd.inf_amd64_6c54f73a58d5fb2c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\Bthprops\@BthpropsNotificationLogo.png	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_fdc.inf_amd64_fe3599e7eac09e7f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ialpss2i_gpio2_glk.inf_amd64_dad1e0a2b185e32b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AssignedAccess\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wvmbushid.inf_amd64_fd2fe159a9daf508\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\fr-FR\Licenses\OEM\Professional\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Nui\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\spp\tokens\legacy\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\usb.inf_amd64_683fd853c8b8a4db\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wvmic_timesync.inf_amd64_aa4bfe1897922114\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Speech\Engines\SR\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WaitForAll\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmgl010.inf_amd64_b4f4b670a266fda5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmtexas.inf_amd64_ed0ab85128ed7a01\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\smrdisk.inf_amd64_f945aad6094163f4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\usbncm.inf_amd64_9957a38c3d2283ed\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\oobe\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\de-DE\Licenses\OEM\Professional\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_pcmcia.inf_amd64_92be188847324ddb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_volume.inf_amd64_a2da2b286ed77704\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\oobe\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\virtualdisplayadapter.inf_amd64_bcc7550a6e285f92\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wvmbusvideo.inf_amd64_c531b5e68fd6f6bf\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\spp\tokens\skus\csvlk-pack\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\e2xw10x64.inf_amd64_04c2ae40613a06ff\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\microsoft_bluetooth_hfp_ag.inf_amd64_d2736f1d9bc815e1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnms014.inf_amd64_faec3fc366f8e1fa\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmbug3.inf_amd64_aef240978776cd0b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wave.inf_amd64_8e8496aa33c0a7f6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_fssecurityenhancer.inf_amd64_e84a289dd0df20ff\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\iai2c.inf_amd64_a77c815b2999404d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\idtsec.inf_amd64_9321d33f1997dbfd\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mausbhost.inf_amd64_34c86c15777c913b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmnttme.inf_amd64_edc94fc65bef3d27\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-48_altform-unplated_contrast-black.png	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-black_targetsize-20_altform-unplated.png	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Abbreviations\en_GB\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\System\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\GamesXboxHubBadgeLogo.scale-125_contrast-high.png	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-black\PeopleAppList.targetsize-40_altform-unplated.png	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\AppIcon.targetsize-96_altform-lightunplated.png	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\LiveTile\9px.png	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\temporary_multiselect_24.png	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Controls\EndOfLife\Assets\farewell.jpg	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Videos\SmartSelect\Magic_Select_remove_tool.mp4	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailLargeTile.scale-200.png	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarAppList.targetsize-80.png	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\EmptyCalendarSearch.scale-400.png	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsMedTile.scale-100.png	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\151.png	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\cs-cz\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\AppIcon.targetsize-80_altform-unplated_contrast-black.png	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\SplashScreen.scale-200_contrast-black.png	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteSectionMedTile.scale-150.png	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-black\PeopleMedTile.scale-200.png	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-80_altform-unplated_contrast-black.png	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-30_altform-unplated_contrast-black.png	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-white\MedTile.scale-100_contrast-white.png	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-96_altform-unplated_contrast-black.png	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Fonts\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\StoreWideTile.scale-100.png	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\StoreLogo.scale-100.png	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PeopleMedTile.scale-200.png	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\AppCS\Assets\FaceReco_Illustration_LRG.png	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Generic-Light.scale-250.png	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\ExchangeBadge.scale-200.png	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\Movie-TVStoreLogo.scale-200_contrast-black.png	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\System\msadc\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCalculator_10.1906.55.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\CalculatorSmallTile.contrast-white_scale-125.png	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\MusicStoreLogo.scale-125_contrast-black.png	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sl-si\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientPreview_eula.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailAppList.targetsize-36.png	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Square44x44Logo.targetsize-16.png	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\fr-FR\View3d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\es-es\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\locale\am_ET\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-20_altform-unplated_contrast-white.png	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\StopReproTraceIcon-glyph-e916.png	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\tr-tr\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Trust Protection Lists\Sigma\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNotePageMedTile.scale-150.png	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-40_altform-unplated_contrast-white.png	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-24_altform-unplated.png	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-96_altform-colorize.png	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\zh-Hant\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\LargeTile.scale-200.png	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Home\contrast-black\MedTile.scale-200.png	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000011\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Cartridges\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\Square44x44\PaintAppList.scale-125.png	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailAppList.targetsize-16_altform-unplated.png	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailAppList.targetsize-20.png	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\uk-ua\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\WinSxS\amd64_mdmusrk1.inf.resources_31bf3856ad364e35_10.0.19041.1_es-es_6eef9270869f539d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-d..settingsenvironment_31bf3856ad364e35_10.0.19041.1266_none_00391982e430c025\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-n..quickstart.appxmain_31bf3856ad364e35_10.0.19041.1_none_4a388618f6365227\NarratorUWPSquare44x44Logo.targetsize-60_contrast-white.png	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-u..ed-telemetry-client_31bf3856ad364e35_10.0.19041.1266_none_14b8c34dbc1df417\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-u..ratorschedulertasks_31bf3856ad364e35_10.0.19041.1_none_373f3db2af841e70\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.117_none_e0d32848ac56114e\unifiedEnrollmentProgress.html	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.19041.1266_none_fb76f6fb7e78a373\ScreenClipping\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-t..atibility.resources_31bf3856ad364e35_10.0.19041.1_de-de_115e3c7930ed0747\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-c..-migregdb.resources_31bf3856ad364e35_10.0.19041.1_en-us_76a329abc1128d63\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-directx-dxdiagndll_31bf3856ad364e35_10.0.19041.928_none_9e9e408251c787a9\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-wab-app_31bf3856ad364e35_10.0.19041.1_none_02ef1556ab50e6d8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Windows\assembly\GAC_MSIL\System.Web.Extensions.Resources\3.5.0.0_fr_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File opened for modification	C:\Windows\SystemResources\Windows.UI.ShellCommon\Images\CellularToast.scale-400_contrast-black.png	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_de-de_6988eb133eb82b0f\401-5.htm	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.1_none_75cd350cc8b5dbcf\tree_icons.png	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-n..pture-wmiv2provider_31bf3856ad364e35_10.0.19041.84_none_dc38e61c21c1b710\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_10.0.19041.964_lt-lt_b6b0c2e496a2db80\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-microsoftedge_31bf3856ad364e35_10.0.19041.264_none_ef195f564f00d259\MicrosoftEdgeSplashScreen.scale-125.png	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-rasbase-raspppoe_31bf3856ad364e35_10.0.19041.1_none_0c2491a439f55f8f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..ingshandlers-region_31bf3856ad364e35_10.0.19041.1081_none_1830f07005c2525e\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.19041.173_none_6486f23c2831aaf3\f\AppxMetadata\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_system.io.filesystem.driveinfo_b03f5f7f11d50a3a_4.0.15805.0_none_20268668c5582045\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-d..g-cmdline.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_0bef72ece9f0005a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-winsrv.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_1dc37c5bd1e4ad66\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Windows\WinSxS\x86_microsoft-windows-m..ponents-mdac-sqlwoa_31bf3856ad364e35_10.0.19041.1_none_73537a6854750989\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.19041.153_none_e669b22d011fc6b2\InputSystemToastIcon.png	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.19041.906_nb-no_e0132477454b2a7d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_netfx-microsoft_vsa_tlb_b03f5f7f11d50a3a_10.0.19041.1_none_8b13e4aa62a419bd\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-ole-automation-stdole2_31bf3856ad364e35_10.0.19041.1_none_a91c7b19ecb3924a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\Logs\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\23\common\images\tabclose.png	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File opened for modification	C:\Windows\SystemApps\microsoft.windows.narratorquickstart_8wekyb3d8bbwe\assets\NarratorUWPSquare44x44Logo.targetsize-60_contrast-white.png	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-feedback-service_31bf3856ad364e35_10.0.19041.630_none_57ca0a77efb2334c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..ast-black.searchapp_31bf3856ad364e35_10.0.19041.1_none_e479c512c8bfeb66\AppListIcon.scale-400.png	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-c..t-library.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_448fa1ed64ad6da2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-certcredprovider-dll_31bf3856ad364e35_10.0.19041.1_none_60fe3ad7eec35771\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-t..ervices-tsfairshare_31bf3856ad364e35_10.0.19041.746_none_0b33a1c93a22de1c\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-xbox-game..scription-component_31bf3856ad364e35_10.0.19041.746_none_96020d9c6674d6a1\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-scripting-jscript9_31bf3856ad364e35_11.0.19041.153_none_7021b9937a60f661\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Windows\WinSxS\x86_netfx4-csc_exe_b03f5f7f11d50a3a_4.0.15805.0_none_be984aad4cfbc2f3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-i..i_initiator_service_31bf3856ad364e35_10.0.19041.1_none_9064b8c1b47576c0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-npiv.resources_31bf3856ad364e35_10.0.19041.1_en-us_92f19536f153ce43\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-provisioningxml_31bf3856ad364e35_10.0.19041.1202_none_7c6ab7a8e8712a09\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_45a6c0aa2ed16c7c\http_gen.htm	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Windows\WinSxS\x86_microsoft-windows-security-spp-client_31bf3856ad364e35_10.0.19041.1_none_f06f63ba929fc72f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-edge-angle_31bf3856ad364e35_10.0.19041.1_none_23f192ec1e5d7b7c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-mmdeviceapi_31bf3856ad364e35_10.0.19041.1023_none_c9dbfa256e864692\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.ApplicationServices.resources\v4.0_4.0.0.0_it_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File opened for modification	C:\Windows\SystemResources\Windows.UI.AccountsControl\Images\Outlook.Theme-Dark_Scale-250.png	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-a..agnostics.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_d10b91e1120e581d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00000423_31bf3856ad364e35_10.0.19041.1_none_9e16129b03037c55\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-lxss-bash_31bf3856ad364e35_10.0.19041.1151_none_b46b739f71bbb8b7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-c..provision-framework_31bf3856ad364e35_10.0.19041.1_none_1b184e58a3702f94\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File opened for modification	C:\Windows\SystemResources\Windows.UI.AccountsControl\Images\Advanced.Theme-Light_Scale-125.png	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_digitalmediadevice.inf.resources_31bf3856ad364e35_10.0.19041.1_de-de_b0e3802c7509fc2b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-lsa-msprivs.resources_31bf3856ad364e35_10.0.19041.1_pt-br_1eeb72850502686a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-w..iagnostic.resources_31bf3856ad364e35_10.0.19041.1_de-de_adbc089469a13870\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_windows-networking-..e-windows-component_31bf3856ad364e35_10.0.19041.1_none_bbf3b27114f29f94\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Windows\WinSxS\msil_microsoft.applicati..ulewizard.resources_31bf3856ad364e35_10.0.19041.1_es-es_5271e4fe1d5d533b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-p..talcontrolssettings_31bf3856ad364e35_10.0.19041.964_none_dc22c8f6a2b16b3e\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Activities.Build.resources\v4.0_4.0.0.0_es_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-onecore-l..layserver.resources_31bf3856ad364e35_10.0.19041.1_de-de_6bb3e75033baec07\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-a..nager-runtimeserver_31bf3856ad364e35_10.0.19041.264_none_3a70ff62ff294b67\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-c..mplus-msc.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_1fea7e4c08c4304d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TQEUHEWFJVXEXDL\shell	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TQEUHEWFJVXEXDL\shell\open	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd\ = "TQEUHEWFJVXEXDL"	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TQEUHEWFJVXEXDL\ = "CRYPTED!"	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TQEUHEWFJVXEXDL\DefaultIcon	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TQEUHEWFJVXEXDL\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hvu40GibjG6QKIo.exe,0"	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TQEUHEWFJVXEXDL\shell\open\command	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TQEUHEWFJVXEXDL	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TQEUHEWFJVXEXDL\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hvu40GibjG6QKIo.exe"	eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\eaba1ae7456f1a50c16a6762371e0bee_JaffaCakes118.exe"
1⤵
- Drops file in Drivers directory
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\aic_file_icons.png

Filesize
50KB

MD5
4cd80d65f16fd0a9b1743660bc172343

SHA1
63ee6d807ce461fba70efb5e472f065b08e2c58b

SHA256
ddd8f6041c1fd21e9df0701b2115e433e8993892194ec2ffd6d1f7a83e36efad

SHA512
1db88efb12cf3e00bbc59bfbec4b3be1a184f2d143f5563415f8787554c28bddc861437de6f9d4ac7f756e3793c004edf16640f8d16dd07378d918c2ddb10195

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions.png

Filesize
1KB

MD5
bdfb01a0ef00f94bc5f689bec6730cd6

SHA1
e2f62f579b9d21315034d520aa7d125a320876d9

SHA256
b6dff601c47770c80f2bf7f1212b6f2c7e0856a1bf1f2c7f4c7192859302ed8a

SHA512
66a940cdb8871e02c5dd711f25e8bddbcc045dbec127d9c70ba972e4cd75a0653896b5eeb9ba476174b6d5b1291bbf13caae8f21cc398dc21d98f5042bbe8a80

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions2x.png

Filesize
3KB

MD5
45f14c68bb84b5773401236b35e4f43f

SHA1
eb1494c4fc8af76cd8e1d09c00c8a370db4f3f8a

SHA256
c6a13d4f4bc5b8be7ff611e23d4bbb3df173acd2d86f4be2044a887eddce7e13

SHA512
5d6d8241262eb3a8489d1037d7da5febca2488899829ca3486f59a3ef8b6642f4f53d0f7d42d61716af49e4a66ab149142575c37f81753c20d30c011756c49bf

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons.png

Filesize
683B

MD5
e0f3caed897c2631a59aea150f71404d

SHA1
de8ee3fe04b2aa6400787da51d9c45f92b118d87

SHA256
4bdb6d3e86be5940ab252568714fa7bd93dc9592f258702a8a2005979b645c0d

SHA512
835ddf28cf9455d70e6ee4537f0b40af0d34a4d0ca15b6079f9833498817eb10eb2d5f9b66347ab867c9972ee882478fbba5bfd0d38e33dfe6996898eebb2b3f

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons2x.png

Filesize
1KB

MD5
ece1775179ab2a34d5282a59eabd83d5

SHA1
772243ce7efd6df4a52d7a717a657a6b0a8a23dd

SHA256
00cefea0221f69ec3568d67df09fa5b470c94d351c8423124a07944797eb5721

SHA512
c9f1ac38f4fcc7f127dcfba3cbc95c72d581eef9991d06b8d6aa4694cc127c7429e280eb8d50463c0d963c7594d8d8c37bee978ac0718686dbd0e14136a93d38

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon.png

Filesize
445B

MD5
7b53e7067e97546fe95f19bfc4c7851e

SHA1
a8c2a5047ebdbb02c404c6c4d686892952cecf4f

SHA256
be8162624468cadd49c7f442c35a0858e78bbabde01eb1594c3ce3eace4ab322

SHA512
ca014ee460a8f66bd1a11327da6edb5c2e6efb67d0bcadad2f9987476dafa8e2b457fb439940e7965870f636f84aa0e02cbb97fc7f6d5967cf07a1ae33d3bd6f

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_2x.png

Filesize
611B

MD5
9780ab6fcc93cb4cd03c00cf033ffb35

SHA1
c862c5e5418d23a062c4adc146fbd27e42c8e833

SHA256
e9f801836206529e605c3a697d2ad86a9bb21bd81d8293aa65e4f4ef98c61e93

SHA512
3e37396739eec54d48d8c2f60531b225fa26e9bcd86f0be57a6e8e035b09ebb88365b0d7a39bcefb2900d55085737f93bb7ed1cec3ab829dfac4eefec65b4809

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover.png

Filesize
388B

MD5
1940a00e240fad7a7b2e769a9058e4f3

SHA1
44e4e6c457a8ec0606dd3a9f64e5b19d9da12792

SHA256
8d00b6b096d2dbdad2e6292f94860738da19e3ebca4e95efe39b818b6f405b33

SHA512
44108799b0739d4d4237f251918943d4a06106321afcc7b1bad2a03cfe7065901e9ebb8eecbfd65d1f11c7adf01a10e50d564d045d1b76e5480059c9fce7303c

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover_2x.png

Filesize
552B

MD5
171d842de3751a2673cbf64d84121437

SHA1
0d76a4e8b0eedfff0aa167d6ba6b5a3949f56c18

SHA256
93c62068cd02779721a859ed4f5ea4a63ec62ef6b7c1129c6609eb302ec983f1

SHA512
952bd002fdd43630039d7a5cce29720c22023072b5671089fcbc3a75ceb56a3db2a3db13ac886bbdd4a915ce16830c0ceefe0b4b84c778854feedc617e099996

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon.png

Filesize
388B

MD5
027bd1d06bca46b137932c2b4491ab88

SHA1
204523968b8c233b9a2c7c14effd1ac0f1983cee

SHA256
12040041ae39fdcb2c9d5e4f339e9588393d8fd19b0656aacc88b57d7d925ee5

SHA512
a2d08a2a33bc44b91db37ffbd1c65d4f981208dd343e66f9608fa631f5fcac116b046cb58350e25f911a5091e02bea8c6d50d7287044e6bacc614ed7fe8942b1

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png

Filesize
552B

MD5
3f6b32812a7ccad41646f0da4ad46d29

SHA1
9cc8189bf4789f36d4253e87d6a2a7e1d87471ba

SHA256
1a3c8fcc9ed6e0c27cd20d6ef7ee4d0d383cf5bb48f2c2c53b5b77c2e1e225f2

SHA512
eca8922f83c6daec87dcf732c774df1a5a864dcc485b2338a14b7e5d46c9bfdb40b41d00c87a83132c52451f5e0881f8f2cc790e9f04ec6e08c7c8e70ff9c6f4

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png

Filesize
388B

MD5
fcce92a228c7225706bfae0179120e03

SHA1
8d34b0830cac2f50ec371eea2f5ff25afc4b49b7

SHA256
ed6ad2a776c527365b7b9c9a322a7ccbad724bcb62f761892b68f622885f2596

SHA512
1191df8a43ecfb4e7e5ee5a0ac3284a94549f4be61a69b3e04fe2d49df1f506e70a27df11a75fc791aa0358f28b3000bcef8f2d0727519eba00f32213feee507

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover_2x.png

Filesize
552B

MD5
ed76ab57160c20ee981c7b65fb142947

SHA1
f8a44c975689da049cf94350710b17384898f278

SHA256
18c3064657e1cdd93c8ec8fb5df5c1837bfb112c0aa90c21eb201f616077883d

SHA512
ff0620d8cb56b77a1005bfb1aeee1f589d010662a7ca0c772b65947d5af154b865f1606f4efff3cd284e11adeb642e7a353f703ee68d7e4be02f3018f992216f

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons.png

Filesize
7KB

MD5
a1d4c5bdc6903f4f93100ff9647d23d7

SHA1
123f2d614c7447268377af47f3f37af2bdf1af86

SHA256
9b28a5b7f9f508701289464cdc492e688ff724fd2c0ea600dcb4dd73d10cef6a

SHA512
4836b6fbabf451800db2a2420700adf7f64b867171b3f82ab8988452ee28576ebcecbeaa83d220434f01fb9201efdd4a9e0daebced0d074243825c11273e3504

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_ie8.gif

Filesize
7KB

MD5
5c9dee8ca5da00e053cb00fab91fc001

SHA1
25605c695e9347132f94e7c856fbdf0f0d737384

SHA256
520377a315bbf53d7a6c7bb26f24c08a258fba1eb3bf3c0e64ad7490e5b3455a

SHA512
3947d443b686edce5082ba7dab0254187da7ba83250aeeb331eb3f97bcf00d631ed67ce23c97efa52efa8082c11ee99a3d7b033a95c7706e4fe6353ae231f091

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_retina.png

Filesize
15KB

MD5
69d44cbd874b1afba06e12b460848b87

SHA1
e862ce420e52fea48a2604e6a397e186e546c748

SHA256
94f8bedeef5eae18720c91dbe1ab1e15c41cdb84997cf7af9f132228a72897c7

SHA512
8812e3f37aa560aac439fffb012277a2015373ba092cd16a892ba104d1ee39e27eefb5ff572272dd169ac301923b2146133232929836798fb60986628a618399

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons.png

Filesize
8KB

MD5
6a9bda0d5e53f003b89878c20d3deba5

SHA1
9fdbd0f04a089f357f92d21ad26b16f541ad4cbe

SHA256
b8142163643a48f335984a2a9d607fde962a25cce94d90f4d7f95fe93f1746c5

SHA512
1a1a5e4591bb1844a51f62482dd937ee898379e8d3ba444229772f4253648cfbb0856cb94fc105168192754e82a3a945ee7b189471288f40b1160cc4891b5694

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons_retina.png

Filesize
17KB

MD5
ada0fa89dc6c867a6ce131d178d4b315

SHA1
dc51a033c95e9382285a345aead4b427fddf92e1

SHA256
17b6ab3b7f6cf1a010f8178dc24a0706ad6bd7074304b5a0f32bed7e7436c131

SHA512
03629c2bc5afa7814defd85addef55e2a520ca8e6972caa5534cfda4b5f760ef32357c7f2792abc9d71da71e646c0fe63c440b3114f6653e9183c019d6686dd1

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_pattern_RHP.png

Filesize
179B

MD5
4dcd296c5d56d3b9b02042bb86e1ef3c

SHA1
6013534af24ed0fe5f155378569e5a2c0ed87958

SHA256
d9e15d4f9c665f6525bde81f2b9a82a54cedccac84d31a077416db70119e119b

SHA512
941e553321465dd039375b7ef21eb75986d513591fa8dcbe75128449dff73279fdec9247c0d75adb5ae750e56d19d38a4b6c6c1e833ca3be26147e769e82662d

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_patterns_header.png

Filesize
703B

MD5
78bcc0832d6b4837793dbeebc69a05e3

SHA1
410539ef7ffb3ecc2281f684e9100943565b6806

SHA256
6e1b5fbacf9ea91eb674cba6635d6d45fc677dfb18d584be3808c4391436f8d6

SHA512
09ff8d5e54547b4afafac74409ab91706280e7c3b13c44778e3971c0edb5ccd77428b6d85803d5a5cc92e886ce908ca78587941c7e32412f7628c9d0d29e5399

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations.png

Filesize
8KB

MD5
a34c6dfbf132aa4db8417ddb5834e033

SHA1
04d9f526bd003922279da1205641286e5dd98c00

SHA256
b1a72840528dac7103806df4259f5bbbb426c79c88df4f074d65a8b708d31a12

SHA512
ac8c807007dfd8603a9c5bd30bf0970d8ed1af0048835430aee9fa8312dc1465cbbc4eeee8b733f947fb24c99038788b71adb0e65fbaf21adc96ee5ced346086

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations_retina.png

Filesize
19KB

MD5
ecce24da061e94e8e15125ab4bcba2d2

SHA1
ac5fe2bdf52bb82efd5e81bc0556916449dd3861

SHA256
566104474aae5b2f20641a206a2b30b45aee61585d28dfd4fdc433a7777dafd3

SHA512
d91d39e87e55e5379c66c0c60cd2b6c032dedf54e015c5e7848a173131bdacd281293f36b66c2cf4e4d62ecac2d21dd135bd981c564c1fb5d9afc0290c05c7b5

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\faf_icons.png

Filesize
6KB

MD5
17f0973509347b896d7906fff9aeaa88

SHA1
8f1c9873cd8c3552b6fc41bba683e25bb53c7af7

SHA256
083cb2fe18862fd5e5b0d7da5ae5825f7f2e28e81b10e14cc1a2aeb8a16d3dfc

SHA512
06d6165a9a7282f1b4c85e4abb25a4ab34c8c929d3d18124da38e3941e18b2b5bbed02485bb1d8c3cbf75b8d3bceb8a2414c168f0e1dcea52cb0ceb9d6e46b40

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\bun.png

Filesize
2KB

MD5
d7a3543a4306abbd88aea50319bffa99

SHA1
8cacff742d0347b6bafdbda9917412ed6b2a41a8

SHA256
25e66219105c5435eb4b257f5ffbe7562d32474662b84364a41ee2b40e851f10

SHA512
de26fe6f48314f61fababa92f31afc906dbf33813d19456e75e055d05ef8c12e028d6f24c03364bf5f7edd945481af61ba9ed68e76cfabb726d4f253f1f80a9c

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview.png

Filesize
2KB

MD5
81817fdf713566f0c930ffd7da0cea56

SHA1
59ab51253d72093524844b995d058d03c1444c2a

SHA256
84a7dcd9bc81a618f3a7d5d8536fc8973eb297a5e016a7da6fba1fc423ddb0e9

SHA512
77612e49d8f69290f5217e39aeb76b7a04155791981e76a8923c40d075aae95e1f0fb18cb8c369fe55752c09348191561ca4963ad00f5f22a006d7bce510a9d5

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview2x.png

Filesize
4KB

MD5
87ef8448be39c07bc4b786170744aae6

SHA1
f2e80b1fb9e6de695afbc8e7a3c52f547acd3111

SHA256
6e98870752a43c9875c935099cc1aa2ce716a393c64668b5327aa5f4dce43897

SHA512
80b0db73fdebf86dcd0ca13b3e4596b06fe362d9d7ab850e1f864f09eecae34d62269d467f6586c3333550f358753bda51877ab32f1b1f859b1c1e3dd60e5d64

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small.png

Filesize
289B

MD5
d6bde72089eed1eee6ad0dc0ac6809f3

SHA1
adfe2375bdd1b0a9afb10167badc305711d49fd7

SHA256
030ad0bf09918365a0428fdc801add002e8421cf9ce38a00a74120592a4325ed

SHA512
12dda160a5e13d2ea676ae249eb1bed48033fb4a2ef2610b5db51458196426aafd64d4ca0bd8600a03b044da6d00cd841bfed5493d0d6024065df5def65fc666

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small2x.png

Filesize
385B

MD5
3098ace25a3ae8ce7da5a87b19eb8a41

SHA1
94837107b2a64e68a92873f1f635b1b42b596492

SHA256
c62b6bba55ed4ed57967dd36151c9b0a66c75c1ff77c773bf4cbad77977359af

SHA512
fd798f27b7154074e03a860f59b47f03b7e7549a45a6d815e78a5fb3798f43fb071a0205d1f3b2dd072645367599c6bfffeff6b1d9ffd90b66f0731bdf4f0bb7

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\illustrations.png

Filesize
4KB

MD5
4b1b9131573321a401f7d39ffa15188d

SHA1
8b84bc043641887b0a28efde7f71ac8f6994b9e4

SHA256
ae911946b2f4faf54b4edff4a4fd7989c5d86ba042f011f62af7a111dd487cba

SHA512
d9f31b0fce33927a3fd92b1669ce4b7b30add4daccb9e1f795df3d156439cefbd34b291a670c70fff01325b6467b4f706bb350f175f6e5ba6021c2f629469680

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\nub.png

Filesize
1003B

MD5
829847eb68553145b3430d1457752394

SHA1
71350383772c91426145d66670101c8cfc988111

SHA256
a707de27a1fd3a5156cf499acdcca0cbd663736639837fa288c10367d8334624

SHA512
d698ce535055454ca7f9133ab24be961eefdf3b08258e7662991a973c372485c73da0d7b41d2c5b45f4ad84c4404ddf348e9e90ca209d85e07450b715a412879

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons.png

Filesize
1KB

MD5
5fc826ded04d9bd79f6367a1403a1531

SHA1
da7612ad740fd15739dc541c909288724ed89da7

SHA256
3ef0787cfec41f8235bf35abcc235c54519da749ca39ba2532aeaf2dc007afba

SHA512
e7e255d3a19ccd48703ec351c1de7418deed4d9813a312689ffe752bf952f9a8cc0d3f0b0b75b144967bdf45a5e4f9b175faca363bdd6510149612f4fd59496e

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons2x.png

Filesize
2KB

MD5
62a49e0e82627b557c86d99d545cf20b

SHA1
1d5e5d85a62a101e412d266dcb3b190c01f9e5a8

SHA256
7a59c3d5c8a1fb58d4c41709dfadcdb190c7d86ad62c4640b0aead5d9b49d28f

SHA512
ba3e456648b8ce60735f32b08a4885a34042a72d780fb647dc9e0180ce39a18096fe01434037113be4b3d7166df835301cc0e31265b6be489af3efb91317466e

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adc_logo.png

Filesize
3KB

MD5
40637fe50561cc686a979ebdd6d0e5c8

SHA1
8a6612f2ab38f53875698a40f487319bf9248746

SHA256
f12a21232cb78839c69bb780162af1831f328e2603bc26e56f31078ee316e1ad

SHA512
86c6683572cf1e9c16a1279ca3ce0abeb265907b4bc5767c0dd0141249090498771683f9567314a7425d7e3bf84aa7797ad4dc09369aebaf2a8ecc2d6f533e24

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adobe_spinner.gif

Filesize
556B

MD5
347a7bdf4887a3a956cdcb4ffc0c550e

SHA1
d02fabfe39badf4d4e6c25805e233be8c57de78f

SHA256
6c4bc3ea1c4b30ad84401e7dcf9ebaa39187444a6fe074f1b16878dc641a7e04

SHA512
a6c655bf4c532c868a741e671c5ae587971a8d22c246e2ef6c8e8ed20a320406da5fe67986de26de5f620c2ddc08496e22e657b76d769f2490636b922c93b1ea

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\logo_retina.png

Filesize
6KB

MD5
70498132b899d782b10a78f01275c211

SHA1
7389f052584b064ad6e5e5fbb94f4958911b1fca

SHA256
f7c004051589f71db10ef1aacb5032ebac77f63c2daabf4887b71fa755dc7b68

SHA512
1185d34f2d07c877db1a91763b2f1da681a5a1485e38e823075bdbf57f00670590a1e0fa078513932d750213fb91304ad66bcea891034de3c542cdda38d8a8a8

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo.png

Filesize
826B

MD5
da0016328e37f09b3be954786321ef10

SHA1
feb7bc230110a69160a3aad5f18835668cfc1c8e

SHA256
9eddd4d991c52b0527e65138cf0c89436f8a717c5268e071074f373ee417c17a

SHA512
2c94218e402743f07826aaac2f68f2697796fa455ecd3e16cd002c6c2745d282d57f19a17469feb25fd289b99da232e4619107860a423e9bf1fe35badd32f35d

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo_2x.png

Filesize
1KB

MD5
6e7d67648023b87b3458146b17455375

SHA1
cd6c476b46e34308c45bf8e76e8cdb497b34f149

SHA256
82ce543723c5e0feece5fea2d980b78cd8014b2ca7605de5247afb5d7c68986d

SHA512
ebdb01467d660c2d7def91c077abdcb09e64eb96269b5797ef63eda1c1f81cc55b567bf6e44ee27dc433db35f1a3fabe884db352ad2a5e41838b200355f865b5

Download Submit
C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB_EURO.txt

Filesize
32KB

MD5
52f878b332811aa25de064510a080cbf

SHA1
b4c5467a1f7d75e913a149905a65b78c93039383

SHA256
4f301910141564556fa29e8a79edece212d149b83cb6873c80e5311aa767dc30

SHA512
7c4d73fdab9970e4dd0bf6549f03dbec316e192058fdb958cccc5e0897e414b8a6d98f7bf8d323900da10f32c0257c7a457fff40d96ffef522cd9d3fdb6e4b65

Download Submit
C:\Program Files\7-Zip\Lang\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt

Filesize
71B

MD5
2ff931b756ac45e6ff5f76137d70008e

SHA1
076c72b895648b9fc524b4c954057ae60597f54f

SHA256
e6cd0ec310309f6ed7e5e79eb2bd6a7a4db56e9f5680272d2793e74ef31f35aa

SHA512
f32745b84909309d178fa46b14000e1c8922bd87e087e16ba5f84df35ec3b4c45724c7ddefcfaf6238a42eaf1c83de4b4404c35ebe6823f3b471e03dd377a2ae

Download Submit
C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif

Filesize
153B

MD5
308196d000a45c48a3610bd27938821c

SHA1
345416e7a9e8fbf48b2efed546131d134febd825

SHA256
aea1aeac9a746dff68eac418536ccf03cdf5745a9f43d2329679aa303169d568

SHA512
246763902cd7aeb8f410be89e43be536bbd7470d8fd68ca0eacb7c03481814597d5a2eaae91e28a1ee1398786900e612a1c6644ddac5fcbafc8200f4aaee1736

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt

Filesize
190B

MD5
d5b9e1b14bc146bf0ca125868339e696

SHA1
ee25c0927a90a6c82e6aff0ebf38177adf800c2d

SHA256
a7175ff388863554548f94d2ad04476a03a9b7662cade5d4dc1c35d237f56401

SHA512
de998ba891af60aa4aabe2903d31a0c339fa7f62ecc6e37795b292608af9b9e0485a5330e29c66cc1e3f6bb07b6b4951f5de69dcd489bbf9409459fb27c75966

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt

Filesize
190B

MD5
58314f164db23ebe503254b38a44ac39

SHA1
42917d13a6620ba52ce2bd470d7b9afe07745201

SHA256
eee3b4f09e7d757ea401a02b3df51686c35cc4ed90ad5f907fc729f1364fa49b

SHA512
b87b59407cf4601dba647b3345c450eec68b66119d202dd43d23f612cecd8cfa4f2ad41c0e2f29cc4724a7b7916bd5ae239ad079dfce895144245231f4132463

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md

Filesize
1KB

MD5
9122ba7946af070febb6a35a4410b0eb

SHA1
c20f78ad16dd91effc54a5f5438472c54e76ea44

SHA256
7ae469821a0d47868a8566d4e09b8bae27677c71e0eb453aa299074d82751fee

SHA512
50f99ccb09a5fc204fd4d54f0956492c910caf5c9cfafeba26e2f46b4969c10411f3c9c8e1347e7620e14689d0bacf46b09b1ea3f3620ed0406ff446f8a2fcb9

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\glib.md

Filesize
31KB

MD5
057bfd73ab68bce2f0540596539be4d3

SHA1
a8a91791d3c6f1969f7c9e0b424f4089896e5588

SHA256
7510d48299583faf9d58077e8058effad2efb068654181c07019b11761874bd4

SHA512
4cbfcbb040ebeec9c6ea6e5a2043b9971c8359225da04ab6bc15ba5c28549ecc76a58ee585208aaa1b36d5fe559c90194a4ef22996fecfec4f9a21af8b963ab5

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md

Filesize
34KB

MD5
afa91c30cc3bbb783a7fbeb6a2824a74

SHA1
30b63ee86c911e3068261145a9bae555738421b8

SHA256
2c3ca14d9c07ea0d16ba1f233cd417a806fd93094f70219c37c379e020a54a74

SHA512
98d17f5c0a28446bd1156c8e3552a04c696d34204366ffb27a685cf1eb0515a727119481d73f7c7ef9e88aec288d8177bdd6454cb8ad09406cd0fa8b1941b86a

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md

Filesize
23KB

MD5
319961e45639d50238ba171976432ea5

SHA1
99acc67ff6ef14fca74c4b6cdf44128bf13efd88

SHA256
575e5aea178a81fbb3d3b6df07be528a8ab401ca23d4964ddc87b5791f7697bb

SHA512
6abc27c7475e9850903ba917f36a7e0987d438f904b48b541169a9f3b1dace0d8f65f2742e0227654b13574eb83b189970ed0f4406d798af10823e2ae2fb8299

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md

Filesize
2KB

MD5
64c2fcb392bf790a20366a407bb6fc1e

SHA1
d41dc60fbc505d5e53943c09f171c98008fb46c6

SHA256
b992fbf54315a1a7f02ce0a55e783e1e0afaa8bbef09960b1ca01cd205c2b285

SHA512
719eba710016981826c7edeee37e46d052859ea990b582f45e356b2fd27ae7cd93710c9e74e45af7b4042ade4441011d6648659d60bbeb506de7b751aaf015f0

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md

Filesize
1KB

MD5
d03707eb86eddb9234438521aad7f327

SHA1
81685b11cfa1a541b19db0f8624376fb7cf235a7

SHA256
ad6c3d53b033fb4776259c62aadd9c0334eccbc35028ddca17c38611e78c0e3b

SHA512
4ec68ed0a76c1a2457661ed2ccb3289a072b829d009d07a678d4cfb37a476751cb6db2a76ea4c4346478b85a04b2b16e896428d9683c8f95ba350c44c28771db

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md

Filesize
3KB

MD5
e5aa024de5705c64fdfffe5805342bd9

SHA1
007dc2cfd7351ff3478a74a5b86387fc8b9c7d42

SHA256
943385f334dbcb970b579e5df6ded978990ea5af25da27c9281374084787e966

SHA512
fa069b7b26a19ced701293ac23fa9e09ea61dcba2b6953c7cc5022fc9da17e68e45fea8f981656c604a615a6873b68658c622508e81037c4ab62c59ca64d15fe

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md

Filesize
2KB

MD5
e216494d41ec14970cbc39f304c50c08

SHA1
14c809d7cf9e1e0c4bd05f57d5386841c26dc714

SHA256
645a4cd8c781b97d6cdab9de44a5bce90e0c49901b8fafe4e82233bdd277fb6e

SHA512
eff6924940aad9b1b819400208d327aa465bb4283248f808f4bb60f42db357435b43d0e52763ffeb21b1346c22e79aea795514502d7fb5753abb0c8b59359052

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md

Filesize
5KB

MD5
82d85c6d018c16c4158c2b18c997686e

SHA1
eed578088bb12e8e1347a0f17776eaac836146f4

SHA256
6cc6cc36788fb45d83c75f4570c975a4ad03221a61d64e767b3f59ebeec24a14

SHA512
6b654726edf859e0db5bb15edbaaa48b3816c37851bf929f6264782173cc2edb04d56600079d95ea1f9d1c18d48d2e2ec652c88b81e725b1467c3dd348d62150

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\public_suffix.md.EnCiPhErEd

Filesize
17KB

MD5
b63b591dc4f68edd9c033af2c18ddb51

SHA1
bc0b072bf672d859112030f50e4c17344bc8212a

SHA256
f581d7d88a3f68a88ec15a9a14fba82a8ed78ecffe3d28d61f84a6a3128ee329

SHA512
dd522cb02e7d0702df9f3e83ce74008206a598667614dcdfd31405e9e876ad9dfffb685f2b83794320a20aa804392b4751302f3551aff7b004dfa3947e63a391

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md

Filesize
320KB

MD5
568a0e9214a57187ea2d446300314563

SHA1
044235bad57624e641dc687e4228af75d06ba9d5

SHA256
e8e79fc1d16a5846418019d9359df4903feb98e15575f3fc8f2498d428fef392

SHA512
9f5fd1a0f7493fd4c9549cee5f5c3f5ca79b359a5e82d678e93041e512559ccb0fc072476919e1f2af3d2f7b91f7c1a82db9fd83d779777c93cd1c95df00605a

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\asm.md

Filesize
1KB

MD5
970d9e70f2dd7127b49358a429d86aa2

SHA1
ad7bb16d70a6e0ea6893649f294837901f65b3f7

SHA256
abcc997e6e688f4d0e9f9264d4c58e5226c0a5733861d5e84fbbec2040ec616a

SHA512
f07d15693a62da5e8254b73d0592234db2d18843025b49d8d94a928da1afaa2d2c65037c800f31f868a29743532342a58d025379c79b5f6f76d99b5a76ece498

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md

Filesize
10KB

MD5
ebc42057c67882eaa688f6217866f31b

SHA1
85ae22fac195276e60595bf094af34f2e065ec8d

SHA256
b38ee038e652618eb5ab70ff2ca51cba4732626edd968ebe2ee6fd2986c99ed8

SHA512
8e64d322270f2866045aaf500e249e8da711171a433bfc46b5cc755a48864710e77f29b07af33665a8c8e57975264f143fd7cb7fd5ea81de4989dc5f70e18789

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md

Filesize
3KB

MD5
954977e34f68f8944da838d2dcd53a6e

SHA1
1c6dc57f795692345eff06da4e0e81ff38af0db6

SHA256
fcb9d0b94544bbbc01b1ad8881b588de8a9c025e3081654220d4013ee23feed8

SHA512
3af141d26e994393e2b8169f824cd0992a9d9b618b39191f1e6d4472c13f0eaa1b1b66467e2dc6953219ce3c84b22db2adea16ac110ecfe1b0bc27d9a99dde36

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md

Filesize
162B

MD5
66a00d360bd01128cbbb2ad199f98b68

SHA1
fbb89cf25bcee986c2681c61d3bb646fe9ce80a8

SHA256
289484faf1488eb98bb28739b0760e89d928df19a0177c62ec9e39a69effc353

SHA512
055f5cbb7778f6a14002fdf703fceb32008dfe566b4eecf4ffb5bffb16e8718b3688c0c4239df5ee089ba8af874df52a93e8a65b69998447d56a780fbc01879d

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md

Filesize
1KB

MD5
2b6378117c5a7ae2650dd99f23620164

SHA1
eec76e3b37b898b011d944c281d3b26c8173c49f

SHA256
cca4336db1b67fee8b781f33154a465662c9312637a54ecccf0bfe81d873923b

SHA512
bad221cc1ee4da142653edf5abf222a81219f01f6a0f1dd592f83baeacf33fa60752dd77a312e501f5bf3a6f381aca465c480b8be732084b69e75b198326be9b

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\dom.md

Filesize
3KB

MD5
6e04b831cfda0694245e4a2222a3fa5a

SHA1
e0e4f1035ebe1dd71c850c8e953ea034e7d2d00b

SHA256
245f06c2b646210ff97279cfddce285924c431e380a245e165fe7b969a2ebef3

SHA512
8d5940c199195fe704952d020f08f7ca7702b0b1379338756b7bf553b0356035b0e2957594c9952be4db16c95ac6b5930b6ebeac3e77179a942b90003c458e94

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md

Filesize
1KB

MD5
dd4474655b6b53f985bacf0084c06600

SHA1
8879b102b615d86a24d5a024ad69f7ef092c516a

SHA256
ae11bdb80d387cb592cb25785ad8e61363d72562ac05cae6be1c24fcf0d19ef8

SHA512
093227ed7fda66fb8a9d44a815986aa1cccf5065e7bd27d9e8fa70ccc7a617869ed8ec5f0b5b1adc8db68a34a0fdd4fa212cc93077b72c30fca209c3e477011f

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md

Filesize
28KB

MD5
bc2c2fb18d44ab0cfad4340ab2bd114e

SHA1
2a2771ad1c8b1bbf708490bf3a025e4382ff82c6

SHA256
2e64240ef89412c70dc0150bfd6186a43d2eac2c853e1dde528e93e16cd9447d

SHA512
7e74649959a327ba6ab46b44a8e1941c3ca853222bbfe1f9a9a7a2c5a9ba8ad9613feef8527beec716d3bafeca83f5a79e186323583993bf4b7f9d080e1cc495

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md

Filesize
2KB

MD5
9c3cef4cdf67b036bff23133914b7412

SHA1
2dd550d1fcad35938af976315a96b7c15491220d

SHA256
0574e947c95e17c47f18caaf1b71a848ac287cad32bfa9d68eec080f2f1963af

SHA512
b9555d9ee8a900e298d2245ead865f00fa3bb3894e8c4fd15eb9b00d0a51e8aff558c2187287bb7ceb30ddb6de81de9cbdbced34618e03e400f61105aab21e4a

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md

Filesize
1KB

MD5
a896f40c700e017604baf769bdb43742

SHA1
d954ba27bde79a0b9c3f3976067f7667c6a0a0c7

SHA256
fef5afb9999165fa0aab8514ae1ce5fd02ea831b6f117d8bd817feb78bbb8070

SHA512
db7ee13780ccbf60cd7dd63965302a91229f9d6823a627bbf7c3b1e8d6ab9caf5be360cf1fe86c7cfa19b85415414f94b2f354468255c3de38c053e99830b994

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\icu.md

Filesize
2KB

MD5
3eaca119b48ad788baa189fb7090aecd

SHA1
dc7a4361bf18f60a79c646cc60b6964d735bb0d3

SHA256
bfd4433c743b65cc4ae54122eb5acf27c2514120453f57e4fef8cdd41ecc3d44

SHA512
d5fcd1d0aae3460c7f6ad06e8e15589d80e444b3f8e44dbb5a7a397b5e5363e0adca1d1a0b363a68744ac9aa8fa27ab94b985a053633b77d4d76c51d4bc67685

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md

Filesize
1KB

MD5
f2478bf05460c5bff384d1c3bd4931d9

SHA1
974fa163c76e5ffa654664bc2c1d311c085ed99f

SHA256
08cf59552a0ed33d6ec27a86aac0c1cd8b214a6eb4664d70fd5a3e97ef3787b3

SHA512
b5d28476de89b933577afdb38b7719d1de9315846023ee80e737d80bcc26370418a84b9d71db3a1c2b6fc8fe016ccb53e2b76515f953f6e65f48e400718c3ff5

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\joni.md

Filesize
1KB

MD5
3a7cbe3f06b5b137de16af01e52ba379

SHA1
baf8bc1fe3142020e6382a0ab91174889aa6aeb6

SHA256
60eafc4cf64747b5f2bf0901412da8e93398e9e1d7fd603fa5ec76299e84bc50

SHA512
3f41ab26b70f97c00ccf164b0e9283c17ab6b99a3677a8f32cddb32b1371c4bc22bfd2eb8054a0c0dad0471f8cb3bd364e8e6be410eed6520852d3d909551231

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md

Filesize
1KB

MD5
84d741c162ed2d3b9b867fac240bf829

SHA1
b569a0176992d94bda05a5dd43f6bd751cbfd5fe

SHA256
085da8172039932d9a9fb0f8b8640b934c01726305c336629dda5e6b9d9c4fe6

SHA512
4b792f09d46e179a7c217604c8132127f9b6abe5e5cbe040f2448cfb07d7a393f3a193a9faf343ce5ff57496fd3826fdd3a572884e784b06501cbb81e7ebf944

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md

Filesize
3KB

MD5
9cc5b21a4ba3fdfcbc579ba0b1fe2542

SHA1
c1af846e30f9f7b44fbbfb14d915bbb2c651f59a

SHA256
e8c2dea3238450399365ea7b5d1c838068cc532bd2acb14f2ec23187d4c33932

SHA512
c138e8078a4efeea034b0fac44aa740614a5e8bc0dcdcb38e7917ae247fb31eb3f8ca764b09cb601ee70ef504cc6e1ec8412140fd584055951f142016109a944

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md

Filesize
2KB

MD5
4b84e5f901f28b0617d55c1f118254aa

SHA1
a32a707430a94a8727fc963f3ad98a24c31c74d3

SHA256
f5fa10066be1987accabf37cf41a27a547df09c34aedbd72735f17fd9956fc19

SHA512
f6a8c8b0c2a009ce702dcd7a090f23677e0387ba9ff66c723c3c3394da39e34fe568abaddf4a535440b8ac766dda506c9230e7ae4e57cbda2b6b3cd3275adc53

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\libpng.md

Filesize
6KB

MD5
20bde353162f41e20d9162308ae3ee0e

SHA1
b161af5b2206f13dfc236e712a4da09f45cf860a

SHA256
368c2cace5f1f2579e2f722146159dff423dcfcaa34a87cac7097266fced60b6

SHA512
d79ddaedde80f6c86130ae7ba858cb6d0a8d65c07e0efcaf78a250fe2b44284748e21c771a56cd4091b067b731216a7af7042f6670273389819814fff908c7bb

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md

Filesize
5KB

MD5
a604c8ad297b8f269f264e734f1c99b6

SHA1
bcfa07f2dfa8b417ccf6402d63cc4abd2b987567

SHA256
445ff9f79cc47a30848406408d9898d608a37227ba3c573d84f1a3a303b0f10f

SHA512
55cb76c89179e1afe1fd59d65a309ad60e3276f73fdc3befa6290da42de8c1af690237e63b2accd52c59e896839fa4bb789e81ad29b05b8861f90753096ab06b

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md

Filesize
3KB

MD5
571b9ea435e57ffb343e9a704268cacf

SHA1
6e079aca81fd37aa4d5adfc4360d2be0dd655500

SHA256
a5180c4524aa4f4b5b1bd1cc49b43ce6fcf9ed4c1bfd4b055ade0e4a226edd85

SHA512
6cdcf250fe0507a809d2c47c38a907c180867f27a6d625a9e2b8f2bbb9a77ff44fb43ece87473b247b986691e413687397987754e4bc32fb80d1ae95814dc799

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md

Filesize
2KB

MD5
0c3ce38f0d6650e5a5cdb2ab18f681a8

SHA1
193cd738eea61d317d881094808c697dbd4803e3

SHA256
7235b2f48251db6581b079bdd62da8d56bbfef398527a2d9ea81171161e7c2e3

SHA512
1e72155e3c4f86efdfa4e30efba7828c1cdeea670a07e451afe9152ca91f87725b9b01d7789c6cac1b3703659325c528e8c1100e7e6669c4658411ee08df82d4

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md

Filesize
2KB

MD5
5731b02073c82838c8495a0282f9480f

SHA1
08ad2d870448aaab207a5eb8508aaca67dd5f4a5

SHA256
6227911fb7f6764af56497d25df01214a2cd2c1b6592c298d7ed01e3f331cf06

SHA512
c3386a0e8aa3c6272d7e8f5dc7cc8e365dba8a4c144314436a941a73a66969923491105d46bfe77096a83d4d63bcc7d77d4fa1f55322db674d7965a14206bb09

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md

Filesize
1KB

MD5
ace6c5a85f9606f734f032d525bc0688

SHA1
d401440fa4643d622bd3e5438b75ecb0ee8d751e

SHA256
214385cfede128e367a33fe7e4022ec1ff73280115a29e210ea8c659f765f3d1

SHA512
72e59d640e36fc764e59f96da745e1175b33f8619c19d277afab5516ec0e040b20c1d13db08a1f674e12b96d76463c97bca9d9caddecb3a645f6e9872d7d8111

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md

Filesize
1KB

MD5
197762ef98995a54327e3e64893eb94c

SHA1
b8e531e77f5e312c9d43d54d96c5d4f8608fde15

SHA256
9e4e9b6ea1df11e234b9a0f012e86dd838ee7801e6e87ef6c3d8c56ac73f8cdf

SHA512
e69571fba2f7fb8695834e2bbc018e2dc6e5b28ae942221187d77284a9ec6d615a2154e1840c908e2cd1fbf2604d43680793682160ff8c4610a7241424ecd684

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md

Filesize
11KB

MD5
c16ff7cf83be2aac5e522caa01d3c283

SHA1
5d975869d0b26bdb7655e01fb120df300cfeaea5

SHA256
1379e0ac46e01fbeea7b05115bb8e358ed5d372def18137cb6ca9bdb5e8884a6

SHA512
85b3a8889e5c752b2139df15e47c212537747ad1aefdbe8da0cc4abe7ad47319c9b945d54890ce73760585b6447f6a53338700f4a207cda3c0e482681af864c4

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md

Filesize
1KB

MD5
54eaf06cf608a4e587e3a17527d21547

SHA1
5996cf512f54d727296b9b646575e786dbb0d466

SHA256
babd18ccac9b34490e3a20ad2431dc04b3332819fdf3408d185bc79abe182379

SHA512
3c1b4707b290be3e0ae53d1b6cf7887820f219a7febe74492176439706768df56bf7bbc3dbc8c38b721a3087dadb26c5948279d98f755c6b8f7a4b4b22d0c75e

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md

Filesize
2KB

MD5
ab7e2a9ca4443be2f88098dd289f5df7

SHA1
cd479b64ff883dd03f8ed21d67a54b0181322be1

SHA256
72ecbeb14cefffcf0c8140e1308d8fe47711f65ef2c596a009f0f2922d50cbeb

SHA512
601665448cd94e588823f9d02f248e20429673e81852dc36b5799e24270e2c2d17c628294613eea19a91bf0e4b6af2ba3595b8fd8b669213d73598f23d7c51cd

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md

Filesize
11KB

MD5
960d5bed27ab92d3654d48fcc020c6f3

SHA1
0f3949f41b5ca8fcf8d6c147ccf2f8c3826e4fa0

SHA256
dc642cd53ad46ea59316e69292b48cc3d046bb30f802e0b7207dbdf2cae1aca4

SHA512
8e7364ba038cffe323b1474913b390c3fee64ae0a15a5d2b6b12b3e59401777bcb7bedd3be8538e93149c720e77afdcb6dc18c7b342cfb4fc1d22e803afc4110

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md

Filesize
11KB

MD5
492a2dfe39061a110efb1b3a38981582

SHA1
4a4f6f42f56c825057e50b84cccee160eec35e7a

SHA256
3d662afc3a4db50ae536c4d510507b8846682429373d73818d49af6fd2ee4f44

SHA512
4520444bc928f6dbcc0b30955b082d7c692af3ca0bcf781680f83d2faced348bdfdaa7c3918c7465b7f89e64232de85db5216b61d4e2403f611a8a08767803ad

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md

Filesize
11KB

MD5
34bf3c4d3d8e7b20fce89f4462943d25

SHA1
b5fc22faf0404b1f3d1e9901ee22c68943dc3708

SHA256
e68202c8842f91da1f70758986ec22f730b54ea6e3e43711b0d1846bad77df04

SHA512
b9f3c91522a70af27087e140f639c136e5b06b2cd12861e2c8045db284300ef9c0bc85020bb226b6ad26d08f394746a8fd7f759628b95456f5ed456e2b8c07ac

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md

Filesize
1011B

MD5
62c881f916e0d7b8fdbd71a844a28ae5

SHA1
d96e9e566e9b34369d1c9c22e8778dbc05861442

SHA256
0ba19cd7ab18524d82f371fb7a519c3f5f49f4273bb49d24619a0da09ef6e01c

SHA512
8553ba9790f3a63e1b116f97aced2d89c655f226c3c4a4a8c6e3e982d265c7d892ecaf3b1ca228c411f2639b0f31fa1bf22a2b910c0018ccad95130d1fc16529

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727655977808114.txt

Filesize
77KB

MD5
9360985fa1483571f291dac3d6e68dfa

SHA1
7a7e55e95c8c89731ada6ba28bfb4fde02e1bd09

SHA256
7c573cf700a4fcb8d5aa393f6ccd2a421a263ad9b0bbfbcfd4fcb0d026801053

SHA512
965f3ddd5f6d09288383546faadc5948fe79f890c29cc6f0112075cefce9b994b923184263b6c7b6888c3d3f9a99bce3c4d6282f7a8eac20a1d37ccd9019218d

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727656717558154.txt

Filesize
47KB

MD5
bec76fc1a0115166cb0e8b47e0d754b7

SHA1
94c8057c942c6f4cc9f093369cec7686611eac9c

SHA256
56c3c1c37083b906aa90ba47e48db661c1062f9b165aa4d1275f79776713303c

SHA512
b5781bca2c7e8084ab31188e2f23a5c01dad28cdbb6918cfa7f952841acd96182b725645d131f2153dc88c7b82e2b5376fede868a431c4d1d5c103e73642d61e

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727663096253949.txt

Filesize
63KB

MD5
499a4aacae5cd17117d1a2a34d890a4c

SHA1
a93d6dc8f089abc6e0224091e2f70e4c31d09a3b

SHA256
3a876ae773acf8a8d595262a71261393528999f244c9b9e3c29e6c3351040eda

SHA512
b43549c2a749f6de8a2daf2f0078d2501fe19d97eaa724801062988332f4ce2ed842557828f8b99dd5a1c0038ac3d68d86e82c959bb5f08ee1e1d1adb60b4782

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727665766873969.txt

Filesize
74KB

MD5
bd55179e52f21e7f7f654305e56ac4d4

SHA1
f815f672e331ad2ffbd840f895754478860b25a0

SHA256
caf60bbd5e084ef3f2ad6d4e8db8c31600da9974f74ae50d3aaacb7ae0196f78

SHA512
5853fbb208dd1d80a0875956105dc9a66dedb6e9956f81f2216e0b79e50e4aec49d4f2a95f644bdcaff3d4e62f9d171a3f38b78157c0a6f8cff4921d18b09062

Download Submit
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\File Explorer.lnk

Filesize
407B

MD5
fd557a8af7e65611c4878033ccae455f

SHA1
a9f696b89b242f9cd07b94acc189466f93e3a238

SHA256
a809638744290c0e428f7fe39ab4c95209b35b35d51e1b687b0c32c0cecddb79

SHA512
3cc7540415acd1f0867683b2dbf2b62de4c02b2514acdf509d1e2a7388b818340bf2ba0ff470d734115f038272ed5ace955072a37972a183311ed03c44cb96d0

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg

Filesize
21KB

MD5
9db841ae6ecc42d80327706c557de779

SHA1
5fe066dac83461b3acf3e1c7148d54b6c3788adb

SHA256
b6d5dc21b793b9261270d10d31796bfe92abd9e8c5aad494f721e5e95adf8033

SHA512
d7d51fa282750e43d22071f8e7e9c73b8f3b7e1aefef5d6ab10fa663911c6f79416578dca59d08e1922e7504ed496fb9d204c835c25d438c4dd26775a9060272

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\HelpIcon_solid.gif

Filesize
1KB

MD5
2ac7f97a61c52d664f0295b12f1e4612

SHA1
8efc8eb971e41be2d6886bcba1a5e9093fa8e26b

SHA256
3ae13e70f3481d974122504d70acb6889427c71181b680307490079171003b4e

SHA512
cab0fa2ff31f1ed50515965c5b41b6be53915b32466aeca7a96c5fa2d42e957d6fc58cf6d76e1d14eb74f222198b0bb669dcd5844ca0a20730649db773b32fa4

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\alert_lrg.gif

Filesize
952B

MD5
56c30d8f838174add62475e9218dd956

SHA1
440bc59a423da8fbdd368182678e9406d617a3f1

SHA256
2587da7712753843e036cda181e6bfc5c3f92fbb2b2c5e827ac4f42bf19edb15

SHA512
268f67b76407dd1c7fe70499fec2fcb4b07fd719f403414588cde53fba879f484b13bc3899fbee0f3bad5ddbab5ee9335b06d9ff3e3d5b342cd35229c1f6f999

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\aspx_file.gif

Filesize
121B

MD5
eb2de057b857811517d3aa6bfaaa50a1

SHA1
489e3fd7ac9a56a18296f786082be67156fabd7e

SHA256
0ea5d7d24bb5f7d06757372e1978ffa1f6910e1633e35d9be755e8f2f9d196ff

SHA512
4b439af49b91228a8a5670f3ab5213d851b69189313f5af5bf4796b4623f21de53313f0601fa1ffb547d0f68c81abba86987cfe221a96b38186407208076e94a

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\branding_Full2.gif

Filesize
1KB

MD5
d28d4439762289384f84df31844d3c7f

SHA1
06595fcae3992dd070b6e8b3b01f7ecca4c274cc

SHA256
f6b8141c391037333757ef0a09ead0a686c083f737d621c37f7fe9dc42d9d059

SHA512
b9f726eefb18d28bb6145cb5b44f389c4ff0f29f7745e76055a1b151417cc68d31db592866c9c0762e2a612f0fa8658d95545eb71e75815ec9cf41f7a5e1ed2f

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg

Filesize
8KB

MD5
e790e800e0d231443c09231f98cabcd0

SHA1
71db28074616f71714511ecb45b97c9c95d17557

SHA256
841607e808e9dbc3b8002918d1c2a1b6b1198efc6cc097e46ffb466bc79315f2

SHA512
f2eb7b7993845fa3b38a9a8bc46e5c5eeae01154679314b04641bd6b476f312cfe4593dea8f4579d28e6194fe0dedc36e417da5d9f547efde2cad0e81e6468b0

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\folder.gif

Filesize
914B

MD5
058e87aee6607fc8551ad62d3e82f6cd

SHA1
0c7009965b154da5d724bda8b2e418e7ca7d58c3

SHA256
c51acaecaaa67bc6873eb75fcc1c7e8862aa4ad96f894ce1d5c094589fccc4bb

SHA512
e38c6444c299be43c90feb5e4ee524501c8e81bc91adec5dabc0e3d5f3a8a2ce295bc2a9480cc5ed528c876f0081c59f085e6065fdfd3261b7aaef15eac742c1

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\headerGRADIENT_Tall.gif

Filesize
328B

MD5
9dfcda4ae06e6fc277da3de6e60ab091

SHA1
00dd086850789e542ab9b3829340db434ce7521d

SHA256
325e085cbd5cfe05e95299a824e4c0ac9b0a38cb59885a85c030162b375fc2d4

SHA512
6352fb3dd9e69758d470580aae87441d59fdf30d1ee40e7d6ff30d624ab627b5178ef5e307f481c94d32335f3a34785d5ab16535bf1545c497affd705ad4fd5f

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\help.jpg

Filesize
1KB

MD5
6c41c04d6b8cb360401875ce57603a6d

SHA1
2f460effe6410e809948e3741ddc94e740b88f98

SHA256
624a502a968febaffaeeed711ccb390773d64be7d99ec395f6ef2da88ffaf151

SHA512
319a3ced4d0ac1a72bcc842da520d7c9498a23aeb84c13f477191ce7874209767cb96af34d1d72941cbe3e55d57f1f0107ac48e2d3413c9397a3970464b40eb9

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\image1.gif

Filesize
162B

MD5
a2e48459de55af07530f8a31911b6596

SHA1
c5dd7d39cc509a6c15f77e3a9e904b87463c1191

SHA256
e48fc5e9a76ecf80f24985248b1c198f2416253c7ddf000c64af7594aed7fe36

SHA512
f604c9592dd77eb14a32fad59670c1e81ac9f07924e3b0040972c82e72935d51f0302f94b9b025c94250f0106fc335f0212f73c26f2f25f517d39f3d3b9fa9c3

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\image2.gif

Filesize
586B

MD5
aa03b4f759516273885fa0b4cbd8fcd1

SHA1
c9af30a40eeae1dba53b4dececb32f32409a070a

SHA256
9cc25b779a124e98c3967a6a6052f8a5dbae9e2dd0364f563cc306e7676f8998

SHA512
22217fde0720a287865818f2c82f49601a29f2576a55e15cc0ab72dce94b5a66b9b0d91130fd7ec45aa5d407bd74073445f6393202299903f57a93e78bf44e19

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\requiredBang.gif

Filesize
124B

MD5
cb7a7931f428df709956f6bd09f08517

SHA1
b25afc44dd87767735dc96dd20c64ed993ee3bab

SHA256
f2f516ba455afc9f4a12bbb03396d6cff7a3636a5f0b1384ccd7ef074d9ef9cf

SHA512
7454ddc6305bfc15fe059e81adb40cb1868270c8b0ad79e2774c1acfc87f036e22e313fd9adb3675b2891dc2d0dadc77a56c82fc29bd771396e123bf8761022d

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg

Filesize
8KB

MD5
d427affa7f97fe2f30a1d32cf1753181

SHA1
78f5c1eb2a3064bfa34ca646bb534c586de35f50

SHA256
16491f5ca7c99835eebd2d6cd857635d39436a730669322e90ef201fa7731ebb

SHA512
4bca2df04932b27b70002f8925ed89611f70b3f9d2054b998a05a1e1996cb175de2a1a0ba0b8b70da467db43ab27f8f70d34498693a14de010d132d46e57598d

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\yellowCORNER.gif

Filesize
880B

MD5
83c5bafd0de674e89d0c38bb7f19f4b0

SHA1
c5e94a9f82ce4468532ce37b7d4c2344d1ad4791

SHA256
27e9bc80e1a63e1859d0cd757beaf93eab00ba45baebd7f703fa26debe43ef55

SHA512
1eb33f33cf5319d37aae7e477e0848e38046bccd71298c17f5d312732a2061c8c9cdf2959cf9b6bf42b06c15fb9e970ae9eed6989d9927a50f49e0f0ef0d7046

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group1\1 - Desktop.lnk

Filesize
1KB

MD5
9c1e5e321514eb465e8b2a52fdb95ea4

SHA1
6cb9dbf94c6b12d09fc37dab3158508448457ead

SHA256
bcc81afb6b55245418f3dd3cd271ded45eac62af0c9fcde34916ea740679f8d9

SHA512
62b8277bc9474c54e9b39504ebb04a0f8e2e63da8cc1ad8a3346cad4fa7335f20fbe0e477f8184e76099bb9de2d2f293c88c73c0e81cda1fc4399040ce2d42a1

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\1 - Run.lnk

Filesize
1KB

MD5
06e10ed35ae49faefdeed239d13702aa

SHA1
1d3ef1115b09bff09060f324c3ecf5a9ce59acfa

SHA256
245179e6f5b4743f8dcbabf669909d8aafb2bf41699b7265c134d358b0c9b98c

SHA512
073e24d40d0bb98a576d372157f12f346e7f8ce66c3a9e54ed40fe41bef692efea1cd3974f300904facfe53a311689fd64db92fcd8bccff8c8d4203c44c1bf2d

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\2 - Search.lnk

Filesize
1KB

MD5
05bdf4d6aa0a38f2848e6d81d298190c

SHA1
32b4b32cb12a0863ae672f8d2262af5a8a96aaec

SHA256
47ead8233db906e5db45e3241d3775ee3d6bbaf4e658cbac5b5e3929052c80c6

SHA512
0087bfec6e7585f22214561fc2ea84e8b42bea093a5db0e3173706355953cbedd55d53eec64e87fa9971b02ad81d5b32c7082fda45f42f07a9ac71395730e853

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\3 - Windows Explorer.lnk

Filesize
1KB

MD5
daaae28f41b07cfbe70b246725c2ac2d

SHA1
fe2b7753fdcc59edf50ba4df71d3e187ca8b3802

SHA256
d81f1d74c5dd82ca355b7c716235cd0babdcab913fdf34dc6742601c651f966b

SHA512
698fab44c40942b5fa2b0eb7bbbf8900526fe631ad608a63ca247e08b30e3841256174c48b5f2038a7faadeef4d3623975498e7df2e0d1af0157c4ed924e9843

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\4 - Control Panel.lnk

Filesize
1KB

MD5
2d27e242e5790fbafc4c294f71814053

SHA1
8bbde7d9425a8f99d4f6157282f7ece6a2644b5e

SHA256
0aea34e4d969b190775e231579e94060468061a5c882550be660a14c9e9e5756

SHA512
00aa34e006ed0ca876730cfe16d12bb340a358f65c4324bcd6ab1cc123b47670e21decc65974e3eaa9357a7972048d221203cf08151ee882de62e1734ace7ede

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\5 - Task Manager.lnk

Filesize
1021B

MD5
396f67fea9dfcc251c439a6788578b82

SHA1
d35e54e8bf9bce2408e4d1cdef605df2f804c67b

SHA256
0e9710ab624f189a0975c37680111567daf4f09dff8b22b8a61b13a42557d7d1

SHA512
337513b7b85825504002e616b5178255cfef733df474692db1ff3228e02895e209b287bc0c0769bbe70548d7d02e0e9def9e96fcd20bd71fd0f923f21bfa508a

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\01 - Command Prompt.lnk

Filesize
1015B

MD5
3f765d359f19d42a38e0086196e23916

SHA1
c378c4d880a88525cd568350c9069e79208b44f1

SHA256
24673592a9b7eaa87e0479e78e1808742c8c7d8e4a376b07920bb3cdb71c7c12

SHA512
16e482eec3e9c14129786b320d6c91e729a95167d9e54eb0b7703b61d77a6bee896445fcd3a4803626b32d5cc7acc586ea9a2452bc5bdca048fbe2fc516d37d0

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\01a - Windows PowerShell.lnk

Filesize
1KB

MD5
4b537f27a6284341550b4d2c0dd26beb

SHA1
873b1fab0bf121e13374a5df1743ce920a4cef5f

SHA256
f3812868e0b3d717ff5440270cc225de8fe6fff939a58204f0131bcd91941955

SHA512
f612bf6da05563e71f0ef145b8bd1c09a2ca0b5e73be403f0931e624aadb6767779a512318b28f11555d135d6e252f2be632091b56167b2279f3db9b1a5897ea

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\02 - Command Prompt.lnk

Filesize
1KB

MD5
6ed53037c06f3aa45b1068af189960da

SHA1
52e7db045340251215d741234ea072be4516fd05

SHA256
a49507892a7f5320791772dc8aac1975f909c9c177c7a50ec19ff3153b50c769

SHA512
8169fdabfd1da2a7c9e7d63aa7159a6e47c4fa8f1429b7bbe04ddd52ba1bbc9be7c6c325f5d3c20db9a010652d8c2a46dc45406c1b98ed8a0ff07425c5367d85

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\02a - Windows PowerShell.lnk

Filesize
1KB

MD5
d445062d7984d9a8d210b3c3e20700ec

SHA1
ce0c5f200db36199145a04a870c49646ce5aaa09

SHA256
34e85aa404c4d0cba57364672dc667b3c415a5554d081eae2e28fe14b354fed6

SHA512
e6b75cae8ab8ddcdc58170726f9e92cb6a405b9b3854ecfb2cfae9265768840ff93a7d10cbaccb57930c91db0a575698d549551fe65688f61e381a2b48f504e4

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\03 - Computer Management.lnk

Filesize
1015B

MD5
52e32948620bd5d0ba3f1f8a2b511729

SHA1
bcd6528d4be58c522d0b42c4e4b140d416079ed4

SHA256
894682955831dded60f84f02c7e27bf9b92353868c95ef467a35c63a9932bd58

SHA512
a24ba3c9f75cfbb2fd072bffe18819cc347998a0a865710af38b13e87e025c7ad3fa92a2303636255f33a4a8941cb294233129b17010ca19789cdc5707b65b40

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\04 - Disk Management.lnk

Filesize
1015B

MD5
5f18fd6258d8b2d8c2741e783a7d2bad

SHA1
7f2f7d9d019a6e71f6212ec8397a1b4bdb2a6b1d

SHA256
9e38bb69324cff4bc12bcfd6b88235b741bc6064675a37fe6e3028be414f4685

SHA512
933c98feec567259c51906e71ff6bdf7aae591cfa38bc69f9c998ceac65e3c4980caeb15eec45e5c276dd5ebfb6604dcbc3c22e5ac65401f40974bbdc1be4c50

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\04-1 - NetworkStatus.lnk

Filesize
1KB

MD5
bbc2387341b2068d130b731614662485

SHA1
49dd2bcdc9968533dc8cde424f966514df6cc916

SHA256
c3c655f6ef7784466a0be66a205d21826d7453f75610232d45dd6799f6eb48f5

SHA512
56bb56da1dcc4f9620a69c53a3049f23602ad2b01f705d97cf49ac6485cb0243ea280662e95203571362d7861b593446faba4bc5a43c6b83de855d0db25fd436

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\05 - Device Manager.lnk

Filesize
1KB

MD5
0dfe27252e6b91bb7886799c6c410fed

SHA1
87c03892d838d0ed34ffd152738b61bab484d507

SHA256
9aae95baf0b14253bbbb9539e9dbce846ae77d96d74998eb9927fbb551e709f1

SHA512
4f609a79e77328f75e949f9c01bfa0e855537231a5cbe5472a0802b6e59873ba3579c6be7a3a6b8ee31b19dfdcf9c240e41f74d18eeeb11417aa837d556d999d

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\06 - SystemAbout.lnk

Filesize
1KB

MD5
831cc6355efc51c176b3bbb31647146b

SHA1
3ca2c1ce4c1d4c76eec07557628ef55567f7ecaa

SHA256
3268b70c05ae16e566c8c3c572f86ede4ad1d03870235c3a1a35e5acbac9c84e

SHA512
c30ac8a063973d3d5dec34aebf2009b035920e1df7f778869e7c265b4aa1cbbef5ab12a19c87dc4b0620e45cdd1b5930a4dd73a7a27ac08cc3554da68acbfc43

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\07 - Event Viewer.lnk

Filesize
1015B

MD5
0367671fc4f8f2e14e83fabcc82fe30f

SHA1
93444f9e6652b80de59bc6267b158960a7543ef2

SHA256
1fa2f82f42173f5928ad6af7867e01e92dc522b3084b08ee3d6ccd2ff60b306c

SHA512
ccaebe676ff8cda127032d2f915cfb5371e44ea3a7b6e5becc725fae6d6e95f93c8877bf07f739f2130766fae8c141f6390142edbca8beee772f7360406b4eaa

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\08 - PowerAndSleep.lnk

Filesize
1KB

MD5
4c47699baba7ba1923be41377457b929

SHA1
bcab712f53fa4efdacdd37c644689e593e33937a

SHA256
fb544d9c679f82335d94ea739d6352479d3d97b9875cd8a62d4e89486cb7e8e2

SHA512
fbc0bb3e88ca2c953cae69c423d7f321fc4b42a0c85f8e2a27c1bd4bf26844581d4e4e5fd4f83d06d4bb2606aa47724d4f8d35b304c4f39089c285a444e0f02c

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\09 - Mobility Center.lnk

Filesize
1015B

MD5
09ce631c895cbf9c00b111c995a1d045

SHA1
ecbf7154ece6403182b78fbdfefba34f2895d59f

SHA256
ecd637255b064fcf743fde86cb5e432cc1d8245153227d29cbec977ba52ef706

SHA512
10f8992e463a98827a6c2525b54d4cdc93fc77b4359530651efa2c04f6ba8066aedf614925e9aed376b60131afe5071f176afecb98bb5406b37fdce7dfea6212

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\10 - AppsAndFeatures.lnk

Filesize
1KB

MD5
a99f36b022247ba46f9bc87cb5d44303

SHA1
1fe558dc5450b9b6c84dce98ed92c343ecd2b6e5

SHA256
4f4f761156619ee4fb06b93e8da708798c4dec7f6aec57da49c32d000b8f478c

SHA512
8c864729c17b4c82aca296958ccc678f3da3e16c22d7cd55f5d6a0b934014d97b3d586fc33bd327160e64adbc463f119964489c468cd089bf8019f9b101c205e

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk

Filesize
352B

MD5
6ae86f94b3521f8ed39d55b5d9122a27

SHA1
64099f94b21cc87b7ccf218fad627000b1018f69

SHA256
53b31ff8dbffd8185bf24d62c4b552979f54ed6eb5fc6c86fa221b44e689336c

SHA512
006ea4fde30115095169313c32003c938cb2f23de692481eb3a2319e25e292c616e38dc733a3082b2b38ea733d6eabc2b2137eed0830d30655c31b3af1d9124a

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk

Filesize
334B

MD5
6b89a202fd93d18cf6e0f8480a386f00

SHA1
4a431d0d2b4e6783763b51941da1be7bc1307fbc

SHA256
f113fa336f170877fa646db6dca43487d9399d97a01ab4bba519c84afef2844a

SHA512
f0662e1fb5ef89c70b9641d9f49b2314f509a3140904a436abdfadd03093118d16b874da886c295ee31356c1290656f6c0acacda8b2b4f88ef45a3cd8e4a7612

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Magnify.lnk

Filesize
1KB

MD5
b72ecba826965e367f1097cdf7782a1c

SHA1
12c26c2b07cb5d0fd9450ad2ed63ec57e468965d

SHA256
5678f3039e654003bf3879bda423fea7ade8e12dac4031d1d488073224ceac20

SHA512
8f057e10ca90d5511c71f6eb64ebeb3cc040833723667c70cb4a9d607476075f640d3feee0be37ae8bae58f71d237d2a82fd6fddb4bf18540d8a936587b0d8da

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Narrator.lnk

Filesize
1KB

MD5
dbba8ea8796524fb3e2bbf3d74ff12b3

SHA1
db5eff40b4acfd2170910bc19e8f70dce38245d3

SHA256
b8c75561eceb58a95334480f67a728cab565439856a7a3bc7303a44b5619ee2b

SHA512
17c96574bb9ad8b5d0d6211f0713874b66dfaaf60b41baedbce11b4a8ab35333e9c78801ac79d4f345d919c0a34b51252009702fafe435a6b60d9db3128f8426

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\On-Screen Keyboard.lnk

Filesize
1KB

MD5
8b2eb90bf94fe751b1fdf76dc9e54e21

SHA1
c90f3ddee9834f8c1c5a49ed01fd1bcb425f948b

SHA256
69a701fd922b8fba77f58d9127ce2c293339ab0d0cd14e13195ee81cb11fc1ef

SHA512
106185d1d852245edbddd70c80ffd9336900989903804f575c608a76b39455910a95f3b636e5c1a29be74e33db7093928580ae657f20495f1008946add051dd2

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Administrative Tools.lnk

Filesize
1KB

MD5
92b816f8ec6553e7613a0e645005c440

SHA1
510b7f9f357a8a9b87799c240515eff55d765266

SHA256
e31a4338b20753ba2c144b2e2ba2fcecdd7146172b16a563ca0eafecf94b2fca

SHA512
3b73f9757e4ce61aeea1d023a1be98f7d1965ac2a41fef3d53f1f84aba4822748bfd84ca997c9f5f33e777cb09d8a4a9c5e7187e38c7599e397f3c39cfe25e90

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Command Prompt.lnk

Filesize
1KB

MD5
a67f74c3796b2ad4991c35d28ac21cdc

SHA1
1bd71bf2d80f47bbc30ce60de74336b09ba17860

SHA256
b28017abd625f3a87c42e9ada7063fd3c49592a4ea2bd168f75fa6046f428306

SHA512
a8a1ea15ad4a29529e6965db14c0fd58bcd417ac9848a50f49bfd8e7eb7948935f47ad95db40ce1f50c39fef3249ffc21d0d52a61547d0f12bd76ac6df608d41

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Control Panel.lnk

Filesize
405B

MD5
1f0b67dc9a8b7937b621ff9233ec3c2d

SHA1
ae73dc6bad5320d7da70d26157a8abb7dd57b590

SHA256
68e05ca6e19ad3cc6a8bbd1c225e219ba521425e1a2784db59b47e9bb4d5ef9d

SHA512
294b9671672b41fbf464f5605c93e07e3b8a82da8f566176d05582d31003d0a37dab894d0c2694ab23652097fb5b4c81c6bf9847ac155193ef498c50cdcd6c03

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Run.lnk

Filesize
409B

MD5
4c8afa78926ff801c573f755614007bd

SHA1
018f172b65d98f1c46e7587b87d2a6a7e3f2d33e

SHA256
ded601a16a27d131658984750acf38fc386eb1eb13d55d136d8041a4dd8af254

SHA512
8c2fd356417403e660a7066bf65262b6bf6b20a5e237c9beb6bf9c363a019802c0b8f453d078fbc05dd30d851c8b98a5d0a7b63d75d7488807b10529022f022b

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\computer.lnk

Filesize
335B

MD5
4b9ad6f9cb8ef4c6262c8c61e872f919

SHA1
9277174f0c2f16ef7a853bf52a1a4d26d2d6d981

SHA256
f517abe73a0e175f0c60a260324f5db174876bfaab0724652a3f84d1a1b21c54

SHA512
e7a9c00ddbca92188676d4eee9f54f40a4180fbd956c2a257f9ffa56d9078d44a3181c31f66ac922087b6a3ab35b54b0fda05905be694b9e97ab32c7cf362c5c

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell (x86).lnk

Filesize
2KB

MD5
6f2ce3bbb83527f37a8982fa0904f665

SHA1
d12ebef93ceea6cccd2484b451d63e812f77472d

SHA256
c4271c2a4319056f8f7f07ad2b57b174575cb254d88646800b25721af232a300

SHA512
d6fce3bd90688b84aa8b2fbace73f5b0af5e9060c54b5b740d53bbf6998a2e4661a6271566968e925a00d3b79faca9b37e846fb31281deb2224c39deb18dc400

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk

Filesize
2KB

MD5
b60c7acb171ba1c264f7cfd2d4b11a0b

SHA1
e6fa8a0a6315d1d74d462f79d6a20b4efe7f97c9

SHA256
37454c7e847c648c74f42be48b3ed2e05a2c53935d964822da67a982d4702145

SHA512
730409d84c964407723c1d59f87f0b9327e83a7b5b60c84d21d1a942ff00552cc04a6fb1bb4d4abe47e68014069a7ec87afd1242936189e088cb9c147a7b4edc

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png

Filesize
296B

MD5
13fd186b0e78659c23ba64b7e7142ece

SHA1
a7d516e5fa23fb25364821bed976a05b2b2cfa53

SHA256
4511b659c2113732031c2e4b6cf5ba604e785dd1385a4e86d74c87e6926e543c

SHA512
b3d932059123b1f980f426164cdabc03fa3c3e6e77d6d14ffca0e1abf46e4f3ddc691c52b173942cb916d154de08561ca1b417b4a6cffccd4fe8b071caffb6ac

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_contrast-white.png

Filesize
276B

MD5
85f3fc32689251b2607a30414f88118d

SHA1
a120097d4d37e8cab005ef63ac9a500899f2bad0

SHA256
5c714964889574021a2c148ff28d53e98c1ace60763f4bb440495ccd79afac00

SHA512
6432dbdc9767b27e9a7f60c8b19addea52f07b8bfcbd1014b52a1fdc5f01bac34aa5e488250320cbc50bde48a5353953c00e19b06623631ee7b126200cd6ab0c

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png

Filesize
296B

MD5
5f394fed3b200f63e6b9430124b058f5

SHA1
f459d17a9ee3ed60c1ed780d38f834c9be99c270

SHA256
9eb9ee33d709a97301743b8cfce723d3900a9e80917366dca6280e11f9c0a3ff

SHA512
279309b5182ee1ec739f2f99ff0103bd7afccb35f6da56763ee0507b48a7c510602d931920ee05d4d3f58f726991d6e2d73766664310f7d80f0b6672e45cf4c5

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square44x44Logo.targetsize-44_contrast-white.png

Filesize
276B

MD5
13f05d9d34015b41b44bb4f09c21dcc2

SHA1
4fbe58b2a69219633d5ee83ef8aa6ffbff1852ad

SHA256
3dc2e985630c738004adbcfdcc0ac00ccab02d1a6e47ce48b3cb5ae86b3632b8

SHA512
3ffed0df813fae43eb1fc602f8597883ea758af497fd635a7bd20f95510d53d23c9103fab7860e43e6ce387d1521e54f6affcd1ede3cace949a02a8d3c985199

Download Submit
C:\Windows\WinSxS\wow64_microsoft-windows-onedrive-setup_31bf3856ad364e35_10.0.19041.1_none_e585f901f9ce93e6\OneDrive.lnk

Filesize
1KB

MD5
3925525702aab0b4a5c422ece5718290

SHA1
1f20d2c773e252ae9e4deabc566a120ff147234f

SHA256
ac10146c000cef6b2de2f5e13a48cca58495f0c7251876c6189bc3b609b2c128

SHA512
39fb789557edc98d7e2d1509c8ef2af2f30ddd3781893007aa26404963cc4daaa622092bffd2d402eab765d1b18db7d2b8276595f36e99961a6bee4c2aab467d

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads