xorist | d5f089b24f91f71ea717f61439ef7d22a7428d3ed8afc153a42a4f6f1d3bd034

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
15/12/2024, 22:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
Size

40KB
MD5

f5f61535258ba0a7120a34ea5fda5b70
SHA1

10b03d523b4342e659d1a6fcc3cd442576be52cc
SHA256

d5f089b24f91f71ea717f61439ef7d22a7428d3ed8afc153a42a4f6f1d3bd034
SHA512

6a55e1d44468e913a0311e0862030136ec2f8f9dee6cf417c07bb141064c4a4a8ad6c8ae4da22c39ab6642f16426e104e419116eacc20b426f730994bdf35b4c
SSDEEP

384:6ebFNw4Pk1itKkpAjjalrbL1cqqYvjSzkDCgStzRfMB:60FmBkpKjsZchY7bDCdz2

Score

10^/10

xorist discovery persistence ransomware spyware stealer upx

Malware Config

Signatures

Detected Xorist Ransomware 3 IoCs

resource	yara_rule
behavioral2/memory/2116-0-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral2/memory/2116-6542-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral2/memory/2116-20358-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist

Xorist Ransomware
Xorist is a ransomware first seen in 2020.
ransomware xorist
Xorist family
xorist
Renames multiple (6796) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Drivers directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers\gmreadme.txt	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers\afunix.sys	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe

Manipulates Digital Signatures 2 IoCs

Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\pwrshsip.dll	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\wintrust.dll	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\M9rxG05XUOS4TJR.exe"	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe

Drops desktop.ini file(s) 64 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-ie-objectcontrolviewer_31bf3856ad364e35_11.0.19041.1_none_2108f0881e5a7a03\desktop.ini	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..2-kf-commonpictures_31bf3856ad364e35_10.0.19041.1_none_36436b821c9e7209\desktop.ini	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-shell-sounds_31bf3856ad364e35_10.0.19041.1_none_cd0389b654e71da2\Desktop.ini	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\Media\Desktop.ini	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..32-kf-commondesktop_31bf3856ad364e35_10.0.19041.1_none_a81a33274fb1b624\desktop.ini	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-ie-offlinefavorites_31bf3856ad364e35_11.0.19041.1_none_4b0e6b545bf0f4e7\desktop.ini	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..ini-systemtoolsuser_31bf3856ad364e35_10.0.19041.1_none_d69cbb4282e4fe2c\Desktop.ini	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..l32-kf-programfiles_31bf3856ad364e35_10.0.19041.1_none_cb8c8caad1a2ad44\desktop.ini	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\3D Objects\desktop.ini	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..-kf-commondownloads_31bf3856ad364e35_10.0.19041.1_none_a914e3e3f19ceda1\desktop.ini	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..ktopini-accessories_31bf3856ad364e35_10.0.19041.1_none_a208296858c76413\Desktop.ini	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..-kf-commondocuments_31bf3856ad364e35_10.0.19041.1_none_04c252e5678f305a\desktop.ini	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..ini-accessoriesuser_31bf3856ad364e35_10.0.19041.1_none_d9f53b39b3834744\Desktop.ini	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\Downloaded Program Files\desktop.ini	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-shell32-kf-public_31bf3856ad364e35_10.0.19041.1_none_0cf1a65e91dfb2be\desktop.ini	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-fontext_31bf3856ad364e35_10.0.19041.1_none_5476a60692fad199\desktop.ini	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-s..kf-commonadmintools_31bf3856ad364e35_10.0.19041.1_none_0b090bb5ae01dd1a\desktop.ini	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\desktop.ini	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\vrd.inf_amd64_81fbd405ff2470fc\vrd.sys	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\umdmxfrm.dll	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\wbem\esscli.dll	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\Storprop.dll	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\console.dll	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\IME\IMETC\IMTCLNWZ.EXE	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\mfc140rus.dll	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\LicenseManager.dll	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\MUI\0411\mscorees.dll	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\OposHost.exe	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\ucmhc.dll	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\vdmdbg.dll	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\@AppHelpToast.png	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\dpnaddr.dll	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\IndexedDbLegacy.dll	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\InstallShield\setupdir\001d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\KBDCHERP.DLL	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\KBDGAE.DLL	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WalletProxy.dll	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WMNetMgr.dll	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\hidvhf.inf_amd64_0a924aec7600dcde\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netwbw02.inf_amd64_1c4077fa004e73b4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\ExSMime.dll	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\en-US\Licenses\OEM\Professional\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\Robocopy.exe	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\w32topl.dll	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\Windows.AI.MachineLearning.dll	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\Windows.System.UserProfile.DiagnosticsSettings.dll	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\bcryptprimitives.dll	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\crypt32.dll	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\msports.inf_amd64_f2e8231e8b60f214\serenum.sys	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\ir50_qcoriginal.dll	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\rnr20.dll	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\CredentialUIBroker.exe	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\cscdll.dll	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmlasat.inf_amd64_36a71a022d8bb0bb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\MailContactsCalendarSync\LiveDomainList.txt	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\WindowsUpdate\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_system.inf_amd64_184528953a6fb673\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\iesetup.dll	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\KBDKYR.DLL	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\MsDtc\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\ARP.EXE	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\mwlu97w8x64.inf_amd64_23bc3dc6d91eebdc\mwlu97w8x64.sys	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\iedkcs32.dll	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ts_generic.inf_amd64_b6cb67052996a0bf\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wpdmtphw.inf_amd64_1aae998f86058cec\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\dxmasf.dll	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_GroupResource\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Wdac\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\DeviceCredential.dll	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netr28x.inf_amd64_5d63c7bcbf29107f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\wpbcreds.dll	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\TileDataRepository.dll	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\usermgrcli.dll	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\MsDtc\it\Microsoft.Dtc.PowerShell.Resources.dll	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\ialpss2i_i2c_glk.inf_amd64_7b6c08738ca8a856\iaLPSS2i_I2C_GLK.sys	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\IME\SHARED\IMEDICAPICCPS.DLL	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\KBDUSL.DLL	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\Windows.System.Diagnostics.dll	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\AcXtrnal.dll	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\KBDFI.DLL	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\KBDIR.DLL	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2116-0-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral2/memory/2116-6542-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral2/memory/2116-20358-0x0000000000400000-0x000000000040C000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\pstn\PSTN_phone.png	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\LibrarySquare150x150Logo.scale-200.png	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\pt-br\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\SubsetList\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Web Server Extensions\16\BIN\1033\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-30_altform-lightunplated.png	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\es\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\EventSource.dll	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Assets\NewNotePlaceholder-dark.png	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\zh-tw\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\BadgeLogo.scale-100.png	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\demux\librawvid_plugin.dll	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\FileAssociation\FileAssociation.targetsize-16.png	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\onramp.dll	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\Images\Ratings\Yelp10.scale-125.png	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\onboarding\calls_emptystate_v3.png	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\pl\System.Windows.Forms.Design.resources.dll	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ja-jp\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\SmallTile.scale-200.png	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\Assets\PackageLogo.png	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\cs\System.Windows.Input.Manipulations.resources.dll	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\WindowsBase.dll	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\MixedRealityPortalStoreLogo.scale-125_contrast-black.png	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailAppList.targetsize-40_altform-unplated.png	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-60_contrast-white.png	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected]	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\osf\dropdownarrow_16x16x32.png	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Thumbnails\Sticker_Icon_Kiss.png	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Xml.XPath.XDocument.dll	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\SLINTL.DLL	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\Doughboy.scale-300.png	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\nl-nl\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\fr\UIAutomationClientsideProviders.resources.dll	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nb.txt	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\aic_file_icons_retina_thumb.png	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File created	C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\es\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-32_contrast-white.png	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\AppPackageBadgeLogo.scale-125_contrast-black.png	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteSectionGroupSmallTile.scale-150.png	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\RuntimeConfiguration.dll	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WebView2Loader.dll	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Windows.Forms.resources.dll	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\WideTile.scale-200.png	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-96_altform-lightunplated.png	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pl-pl.dll	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Square44x44Logo.targetsize-64_altform-unplated.png	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack.dll	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\flat_officeFontsPreview.ttf	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\System\msvcp110.dll	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteSmallTile.scale-400.png	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-60_altform-unplated_contrast-black.png	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Advanced-Dark.scale-250.png	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\fr-fr\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\pl-pl\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ro.txt	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\mso30imm.dll	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\ThirdPartyNotices\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-chsime-binaries_31bf3856ad364e35_10.0.19041.1_none_3177307267d89000\ChsEM.dll	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-com-complus-ui_31bf3856ad364e35_10.0.19041.1_none_6698d138e79617d9\dcomcnfg.exe	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-i..ntrolpanel.appxmain_31bf3856ad364e35_10.0.19041.1202_none_8f7e37524c3e1a13\EaseOfAccess.png	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-mediafoundation-mfsvr_31bf3856ad364e35_10.0.19041.153_none_9ca88f0919de3053\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-t..cognition.resources_31bf3856ad364e35_10.0.19041.1_de-de_eadf012ed6b8754b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_srpuxnativesnapin.resources_31bf3856ad364e35_10.0.19041.1_it-it_9361985d1a4d194c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_system.componentmod..notations.resources_31bf3856ad364e35_4.0.15805.0_de-de_fdd913bb9f4e88f0\System.ComponentModel.DataAnnotations.resources.dll	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-batmeter.resources_31bf3856ad364e35_10.0.19041.1_en-us_281d09af1121293c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-m..band-experience-api_31bf3856ad364e35_10.0.19041.1081_none_6e71490dbda799c0\r\MbaeApiPublic.dll	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-n..quickstart.appxmain_31bf3856ad364e35_10.0.19041.423_none_72535ca9b59a9515\NarratorUWPSquare44x44Logo.targetsize-30.png	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-refs-v1.resources_31bf3856ad364e35_10.0.19041.1_en-us_015b430cf72af3e4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-wmi-view-provider_31bf3856ad364e35_10.0.19041.1_none_0c3f9626056b2ee6\viewprov.dll	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File created	C:\Windows\WinSxS\msil_regasm.resources_b03f5f7f11d50a3a_10.0.19041.1_es-es_a32c2083866faa33\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-userdeviceregistration_31bf3856ad364e35_10.0.19041.1266_none_9873b9bb8e242ca4\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-devices-radios_31bf3856ad364e35_10.0.19041.746_none_3ea2e277b12254cd\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-c..ngshellapp.appxmain_31bf3856ad364e35_10.0.19041.746_none_0b4ed891dd9ccbc8\square44x44logo.scale-400.png	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-waasmedic_31bf3856ad364e35_10.0.19041.1165_none_a82485b8f343811f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\ImmersiveControlPanel\images\logo.contrast-black_scale-200.png	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\msil_system.messaging.resources_b03f5f7f11d50a3a_10.0.19041.1_ja-jp_a18353fc47f78d16\System.Messaging.Resources.dll	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-provisioning-core_31bf3856ad364e35_10.0.19041.153_none_95ba73d08e5f739c\provtool.exe	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-m..nifests-onecorebase_31bf3856ad364e35_10.0.19041.746_none_dd92b0d44ce363ab\Tcblaunch-Replacement.man	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_netrast.inf.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_c59890739aecdc30\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_ufxchipidea.inf.resources_31bf3856ad364e35_10.0.19041.1_es-es_263f98d1d83e9ef3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\wow64_microsoft-windows-srdelayed_31bf3856ad364e35_10.0.19041.1_none_16a30fa92fe5e343\srdelayed.exe	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-a..bility-assistant-ui_31bf3856ad364e35_10.0.19041.546_none_26bf757a1d9def6c\pcacli.dll	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\it\System.Windows.Forms.DataVisualization.resources.dll	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-mdm-wmiv2-dmwmibridge_31bf3856ad364e35_10.0.19041.1202_none_7f60e559b9e25c1f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-oobe-machine-plugins_31bf3856ad364e35_10.0.19041.1266_none_43fc06cabc62ece5\msoobeplugins.dll	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-t..honyinteractiveuser_31bf3856ad364e35_10.0.19041.906_none_a6600355b5f69459\SendPhone.scale-300.png	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-t..s-clientactivexcore_31bf3856ad364e35_10.0.19041.153_none_0dd9765b24825c44\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-wlansvc.resources_31bf3856ad364e35_10.0.19041.1_it-it_806160a7ffa356b1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\Fonts\serf1256.fon	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_dual_wvkrnlintvsc.inf_31bf3856ad364e35_10.0.19041.844_none_d1d7ae5b69846a35\n\vkrnlintvsc.sys	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-uevwow_31bf3856ad364e35_10.0.19041.1288_none_bbfe125d1b9094cb\r\Microsoft.Uev.Office2010CustomActions.dll	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-e..-host-adm.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_aa5f0215ad90e7ac\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-winmde_31bf3856ad364e35_10.0.19041.1202_none_2b7322505165cf2d\winmde.dll	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-wlan-dialog.resources_31bf3856ad364e35_10.0.19041.1_it-it_c5943657c9993c72\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\wow64_microsoft-windows-activationmanager_31bf3856ad364e35_10.0.19041.1_none_1f3185cd3dabcfe1\ActivationManager.dll	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\x86_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_10.0.19041.1_none_6fa7e5bbaa15a17d\selectedTab_1x1.gif	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Web.Entity.dll	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-client-li..se-platform-service_31bf3856ad364e35_10.0.19041.84_none_cc8b03b372325d69\f\ClipSVC.dll	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-0000040b_31bf3856ad364e35_10.0.19041.1_none_b2ee119cf59d1ddc\KBDFI.DLL	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-installer-sip_31bf3856ad364e35_10.0.19041.1288_none_a7f76f84cd7409f8\f\msisip.dll	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-ncryptsslp-dll_31bf3856ad364e35_10.0.19041.546_none_9a6b25b903405d7c\f\ncryptsslp.dll	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\msil_microsoft.certifica..t.cmdlets.resources_31bf3856ad364e35_10.0.19041.1_de-de_03488bb439cf594d\Microsoft.CertificateServices.PKIClient.Cmdlets.Resources.dll	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Web.ApplicationServices.dll	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\de\System.Data.Entity.resources.dll	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-devicecenter.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_3ea6bba55d18f0e5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\x86_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.19041.1_none_21374cb0681a6320\api-ms-win-core-synch-l1-1-0.dll	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\INF\rdyboost\0C0A\ReadyBoostPerfCounters.ini	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-lxss-manager.resources_31bf3856ad364e35_10.0.19041.1151_en-us_1287e4df3bb1e999\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.19041.1_es-es_29c0dca63bd2aaff\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-mail-comm-dll_31bf3856ad364e35_10.0.19041.928_none_57c2196eb749de48\f\INETRES.dll	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-wsp-fileserver_31bf3856ad364e35_10.0.19041.84_none_30e5e60f38dfec50\f\wsp_fs.dll	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File created	C:\Windows\WinSxS\msil_microsoft.powershel..anagement.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_cd60a093b8ff3a94\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-fileexplorer.appxmain_31bf3856ad364e35_10.0.19041.153_none_47569e595c44e70c\SquareTile44x44.targetsize-96_altform-unplated_devicefamily-colorfulunplated.png	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-b..demandbroker-client_31bf3856ad364e35_10.0.19041.746_none_e5f7be7e804b667d\r\OnDemandBrokerClient.dll	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..ttingsextensibility_31bf3856ad364e35_10.0.19041.746_none_06e2dddebda5c3ad\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\wow64_microsoft-windows-gdi-painting_31bf3856ad364e35_10.0.19041.264_none_5fa2234faf4e2bf2\mf3216.dll	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\wow64_microsoft-windows-mapcontrol-desktop_31bf3856ad364e35_10.0.19041.746_none_33ee7f7dc2112414\r\MapsMigPlugin.dll	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_dual_usbaudio2.inf_31bf3856ad364e35_10.0.19041.1_none_128a33052deb10ab\usbaudio2.sys	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.19041.264_none_8bd2f5fc0c992e06\f\SearchFilterHost.exe	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-wifinetworkmanager_31bf3856ad364e35_10.0.19041.1202_none_e17f082b30dd9027\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-dial-client-dll_31bf3856ad364e35_10.0.19041.746_none_8c16622dc5661428\f\dialclient.dll	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\JVGQJDIEJGTXAOE\shell\open\command	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\JVGQJDIEJGTXAOE\shell	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\JVGQJDIEJGTXAOE\shell\open	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\JVGQJDIEJGTXAOE\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\M9rxG05XUOS4TJR.exe"	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\JVGQJDIEJGTXAOE	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.DeviL\ = "JVGQJDIEJGTXAOE"	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\JVGQJDIEJGTXAOE\ = "CRYPTED!"	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\JVGQJDIEJGTXAOE\DefaultIcon	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\JVGQJDIEJGTXAOE\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\M9rxG05XUOS4TJR.exe,0"	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.DeviL	f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f5f61535258ba0a7120a34ea5fda5b70_JaffaCakes118.exe"
1⤵
- Drops file in Drivers directory
- Manipulates Digital Signatures
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3227495264-2217614367-4027411560-1000\desktop.ini

Filesize
129B

MD5
ec415574a9ded96087c21ebe53d3ccd2

SHA1
c2384347426c3fb22d1e6770756394d21f3409ed

SHA256
ef2c55c2a1fb0f493e7404b05a6911e16b9770497bc176a4335ea039a93a47a3

SHA512
6987d47aab465f224a677a4541a080dd852c6860df8e2ecd8e1b597b5956c8c210b3550c9f8a1517a3ece7bc603a6efe6574dc6ab48ee05a6870d2c30bcc2bd9

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\aic_file_icons.png

Filesize
50KB

MD5
1044143fabc37c6ec53ca392585c15cb

SHA1
f0e3cea1281ba9c7a54565dde9384da4a2b21abf

SHA256
4552a53ea371484ff085c60c49883a7f28d3283418640aae7f727d547b47c0e5

SHA512
637edfab11307a2e67ff6adfd49675b9d3c784d499006cc46883e30f011ea2578bd427b30b4036553f12b707824fa98fad77f23ef2884de039a73208e3d0e802

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions.png

Filesize
1KB

MD5
3cbd2df2b497a4f0a59b7f747367b861

SHA1
6d694263c1b3470bf8b46ea8889c2ca0c3daed14

SHA256
eb5dd36ec2528e25d5bd51cf82db78b37db538195f04cdc38b4d9fecbad4bfc4

SHA512
b19195df2163cba16ec5c592e12bbd38f7c965ece192f1656394aa6d42d4b05ca5feb41a8e39530c583ff1fdb5f5dde0d280855c3d70422b68a8150d231d37d0

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions2x.png

Filesize
3KB

MD5
60ee80c0a690c1b0a56f2efd84903313

SHA1
1f0307f8616fc27eed4429bb0422ba9c8e2aa7de

SHA256
71a909d2eb477a1b69e5b893528d5cb3e0e275a0be0c4b639fc6ac45824d95a1

SHA512
6984a0bee6c2c831a33a4295c5f6f2fc9bb713f043a9ea27577c41d7938172bba94dd8758151766613600f57a0efde740c69987c607b1498001ac0731ee46e30

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons.png

Filesize
683B

MD5
b1e49a51198df85fd926429b1df62e80

SHA1
5fd78f9b53bcde13e08b4d591176af57b0725aba

SHA256
a7d8b259221cd7f1ec8c4042f07a026fc6b2c5202b82b2fce212a00e7fba7cbf

SHA512
21c0f94a8cfe7d4b14833102e5272d2d6da71f952487af89c5a9b62714f048a6a125b84d5bc2d537bdd26b908d8a6af7cc47dc1f7ce273aa84af48c26ef9c40b

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons2x.png

Filesize
1KB

MD5
42dc77fbf3fba9cf20d5540c3d9c9668

SHA1
92ba36431956b1ac78ebdac1c5ca68e7b3b84549

SHA256
6aef60c6b78bb7f9873995bef701cb896737fc3a141b7f870ea338a74c13b5ff

SHA512
f14754a2e48aa838bb46450f1386ae2e885bd6f7f17fcbefeaa5be5009cb896dd8902d3fa07449d654751a4f248932128a15cc5c08b5f85bd2eae3e232ead7ab

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon.png

Filesize
445B

MD5
35150594f8e1a25cde1ad9b83859ab12

SHA1
cf68cf2d71f61278ccb6833b858ba4302311ffaf

SHA256
2a3c8bf3382507b7ce2c7d9c6e763176923ca3f9122362114fc90c34db604792

SHA512
7e0b56f1fbc31be02d14eead5ad296b2133c07d5bc0b43f81ca7ab8d3666227ec88f748fc987c9508b8fffdda1faaeada361d9290f9ffb97a83c05f3edaba204

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_2x.png

Filesize
611B

MD5
fe30307fa042e219360cbab1c1947388

SHA1
56542933e10b2f354eec2cdb934113a1cc4b01a7

SHA256
3395c1a4fbb53907bf1d694a4d51ebc52697a136749eed20f6988564ee5beff2

SHA512
d369cd6f0c1b1fbc78fbc4a7576de3841128bda9197ae87818d49693907f4505dc600e08993784b442bcc1f4b86526e5169f38b00b8c89afbc8db661edc0577b

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover.png

Filesize
388B

MD5
bce9482a069f046d6aeb2747621affb2

SHA1
b20586c39db476699dd2cdb9652ecbf259e2c05d

SHA256
40165cd1223c1271099c22f89efe87a2f5f7db4ec4830308712634d612c4a5a8

SHA512
245292e432753d9799cfdf4150d75d7509d6fb53e49a01f00f65a5d471996123301b1d056e3625273d8df56613c7f09cf13a4b194b18b17ae8f25fdac710280c

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover_2x.png

Filesize
552B

MD5
498e068b9ccb6067ce56351e9b21b592

SHA1
8a3651faff46699073152b0255367c4945886b7f

SHA256
d48f8ff6ab7ecc9556005226405c89fe13b234609d61b200f7aecac723474ab1

SHA512
46da4a9ba0e4c65c531a9504517966871442f31b49f5822bfd7105a59dbe3682593d27f4b4cb4502faf4287b5e4cfd07512c625e2c7150eadac5a0eb60edc2fc

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon.png

Filesize
388B

MD5
9aeb59fb4302c6c96d31d2f83eb87bd7

SHA1
ba1ad12290098102b03bf3070f03d1f84eb93fde

SHA256
1a6d90cc620681a4d9cad5591014dfa9e11becdb5e0fb95abde830ddc8563eca

SHA512
3d1d452656d7a05d6353f2e982a63a1d782aa4396449e1c321a7c57d9279247bb6e10d1cf61a6c6b38c5fb648308ff6d7a40bdcd65a297a35d9e6bc5f34b9317

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png

Filesize
552B

MD5
6a77e5887142acc30efbe5cb4951a70d

SHA1
c4ca6a970da42d2b37e230dc695dad4437ad47dc

SHA256
eacd8004dcba6e61e2d42d991b6c3b88db84b8d034a0f13d1d3b66869a773a93

SHA512
e78d8d2cb5a10211af62cee33c62dc35dbea3ca6f1340446bc86673d67c5c7a1460e0700ac0d0c10344c954d68cbf39e4548f817398efdfdf524fb664e52e2cd

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png

Filesize
388B

MD5
3d89870b52ea43e69bac32bcc39c9bb2

SHA1
360b47ad7bf6f82348e3042f07e4864ae2c1335c

SHA256
50edded68a248fb3b92e2b6ff5a47f82d4874e2286bc7954563fe3d08d43a221

SHA512
4c1426295a51947eaac00da0c5ef923c4aaaba99778b3ba33a013fe4319b418fab1b99e97cd4fd0e6ae013df7c419cc305639cd54862371ae5703fc2ce99f4c3

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover_2x.png

Filesize
552B

MD5
79e4e68ed4e0d62c5a4256b5164c5322

SHA1
8c84765ac9a90ebab6afea541c5af1b064247c9d

SHA256
d4b5f6ae32ab6988eb0dfc557bdb553e64c1d917eb3be88043755b99018dbdde

SHA512
7d51ac2f63f623929b5d1a7b33270bb95162811df81375768db1c980738021577144386bd128f4dd2cf5ef0588ec02f57e335f661762cc7f39b3cce5b5eb01d2

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons.png

Filesize
7KB

MD5
560a24c1d23a2d4064365f93e22a8774

SHA1
1726d375979d1e9566a4423c2359cc88b3a78b76

SHA256
bb55e1c55b51882689a530666a8deea63263c0caf3bd84438d7015b1288133c5

SHA512
045b2fbf4786394a166683a09a149d7586b0235f62dcc1872e0d0abca890473433c59d653a9090a88373d31df61f146ecd4a1001ff8fb7576ae3f802030a33d3

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_ie8.gif

Filesize
7KB

MD5
ce62058c6226ad0fbbf58d7ca90b8db4

SHA1
a091bb7057bfbcb1b21d9e80d7d0959b1ad93cce

SHA256
7af9a6ac8b43312d9e5ddc48bc39e1e8ea6f49bb94437855306172ad8b60e672

SHA512
0d5e89c1b5cda037a6c50989f81b7570bc484d29df579a986e1a42ed4333146033a1a32cc73e3098d7b2262540f112a62891eb23a736ddf6d4bd9b106d0507d3

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_retina.png

Filesize
15KB

MD5
d38a4c8a99865ded5dfe3cca0a4ebf71

SHA1
4276b7fd57e875d0e3b74b1cc415e8eb2c78fa52

SHA256
64fbaaba34d46eaef0ec5d16e5448289bb49f2d7879dd1cecfd7e236ade300d8

SHA512
ed42506a0aa7681c25bdb6a1a10fde21037f04ad84d32336bfe1784dd3fd801ec30abba6814e3d30bae1606f51586abd7cd447b1eee85bd20f0e1222a02c68e5

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons.png

Filesize
8KB

MD5
77e16ec0032e06b6c3b025599a2bb4bf

SHA1
7658f679306db5363572db3b0dfb3f9ecd44da37

SHA256
b0ef3acf9da2da3e9bf5cca7e5ed4f4f043bfea9de04c1f28be2d893e0273ae1

SHA512
8e888985b2dc0ca7114fb42d47d1ef760b7f084dc9656bf149fa1bbf0075036524740e56d951daf5ea9d4560bd3a371caaa884e4711b5c30e60fbf8106066117

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons_retina.png

Filesize
17KB

MD5
09fc07cc13c1437c278c9e932cf57d67

SHA1
eb52ee8d5e95775b4185e6c10db024c74bdf553b

SHA256
00561afc602b78f2fdb98ab6a3e340afe275d87a71dba99fa6a9887e90d34520

SHA512
9dbe407ce4ec58706ffaa5e857c143e2c17f3dc13540a2a0b14ee8e6a8d1b6d85cf6c58f6f4bccfa17f10b7294634680cd88d19512da401390c15a5fd8c0113e

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_pattern_RHP.png

Filesize
179B

MD5
d6e296c46e9746bd36c9a8204db37612

SHA1
fd0ead7c5a024b5f11f674a95194730b14dc3ea0

SHA256
d64949aa6d83ab7e77d1999a14a4fd794c7e244ae0c7283ecdd6e6984faebb95

SHA512
fdb879888d90d5f2d345ad0cbb11e0c3a05f179ad09c8e4fa3c511d2865ee173ae48c610cf9ed89a566d33ab510dcd84c2a10bebe7eb3ffc926205b6075a6cd7

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_patterns_header.png

Filesize
703B

MD5
cae30b8343555833755d9d1e54a19b78

SHA1
5fb56a1a75fd0ba93623ff1d6a0fda526e37a634

SHA256
a6f7e3a046d909b8bd0f09e5d13ac75bcfd0687f60da910f0e88d87ece2a430e

SHA512
961736bec8d00c792c18ed60163bf202b8005c48a4f1bf4e5b2c3ec916542168a889490e09f6ef2a3f2db4ef2d87abf01427833ba81582d0d14292c5cb9d1359

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations.png

Filesize
8KB

MD5
4ec3a46c4d0d2dcc9fbee58ca464412d

SHA1
15a1aa28ba38f97b4067e42b848d3fbb479055b2

SHA256
908feaa7cf284a4677de45263ce007b77bdc7b8639c662073b290f7a8e9018ac

SHA512
101b8e503a1992eadb64ab35136d3172f16d3dd0295da0dfa651893bb20e8ec35156326157f9393334d3f2bf2be1e47470cdefa7440e996380aa15fe95905e87

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations_retina.png

Filesize
19KB

MD5
7c68a9d33c0c940745cba1dbf1ca35b7

SHA1
f11f123880f42981c7ab06ddfcc9ae36504497d3

SHA256
fce855802c3f538908d5e26dcfb902f4d3299c515ae9e63f0be94114457bc5f9

SHA512
bc3b790e8210c4e25d432a52485dd66cbc6ca0fd96e5f28bbfa90b9ee23abf379deda5c2ecd0e03b39a314ca8f3c2eba499cd9869a621b7b2d8142e053114f26

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\faf_icons.png

Filesize
6KB

MD5
e6758db3cbe34cc83d5f38d7fbe3882f

SHA1
f8f3ff5c6717d7cc3fd04d8fb219cc238c112d57

SHA256
7b4fc50c097f30ee1db8918365a4676e3d87b9a8b50f8e6b2fdf48bf10ccc6ff

SHA512
f1d8532cbe0aa6cc09cafc1c4f1ca58d1a5232c1a836ca18987d116ee3821c02f6e7ac51fcf16f23138da7d674540e17ebf6e14239c87571f234006a79309261

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\bun.png

Filesize
2KB

MD5
4c55a28db6707676e2ac2777cc758d42

SHA1
ce989fde5ec12a3247dc5764a25a49b3bda95b2b

SHA256
995dec69bc0b928e9a3028608bb407e5a6b252d9d599ecf4ecbc5d128bc3c2e0

SHA512
1dcb86d2c0157157c1a7d2281121f6786781d771db56089e8c5d7e5954550144119156b3779f3a5e48e5783c255bdf81704c0f11c24f81330151cd361a230018

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview.png

Filesize
2KB

MD5
4293b7b5333fbdfa919692f4ee0c416e

SHA1
92ac007c568b77e105282d3a2b69637870ff35d8

SHA256
e337b9af7c66ecca07c5755c0adbe83719d97b18baa409e1df98d8742573e3aa

SHA512
ec0302512a6f1a6065bfa87a7f9ef6c0bb0cfa545326076224640556402cfcb428c3e5727fe2461ee73ffe159635e1003d4fa7f50cf54fd3522948b2eb324d53

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview2x.png

Filesize
4KB

MD5
670a97bd0c7d8c65b61519874db3bd8c

SHA1
9851d4b0ad50063e02b22f241ebc76d96e4f62ab

SHA256
be48fbd8b037093ebee4154cf82cfcd282150c0ba7f817416b743d1943fd2605

SHA512
1cd593ed3f1af25f12d476b7622235e5b71d1a058ea269b41b9652d5f9a1d30d1be441c54a45d5dc3539c4905418adad17d53b59ed7fca9a6a56f2ee22327687

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small.png

Filesize
289B

MD5
66d248259ea91dfaea976051f75ac1e6

SHA1
ce2f0cd5016c2c37f56d7ab8d86c1913bece2a83

SHA256
593b7924bc2c341d63a9c4b2ef4e3cf3f48f3e22c948495827ad26b748aae8e5

SHA512
e46244b0aaa886afca13f29ea882de2e517f61aebbaa4c569e5e8e6597d7e5b987909a8669e22568f5f982270b5d2db320a89b23b4f3b42a84f7650d16077825

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small2x.png

Filesize
385B

MD5
b28b4fe14662846a3182c318d61aa9bf

SHA1
64d94cf66afce4efe757454e4378070a4a3f539b

SHA256
f41db2c6492f16625fd31419ebfce5b8f33776e7e3f15752edace444f87c64fa

SHA512
c83f16444d6dce1788691844166a5fbe80906510c8f0ebd73768c8e047a09bc66c553aab67e49dbf4633cbc2eefa22cf1e61464474a399e4beb4d4fd40440183

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\illustrations.png

Filesize
4KB

MD5
3cc0ced3ca74668c21b157b95345940b

SHA1
e9a0ed0e37483ccc5639b691f7a719dbe609db04

SHA256
a1e39148cc0d0c48825dbd993d0ed04a006858a72b4d2b5ae7600eb8733cc2e5

SHA512
8021ecf487821d45e9ecfb0167dd977865aec5eab9f0c680382edc3c56b99897ddf555fad33d41dccba646fd26b1eafcb364d5a6c7feadee65012e2603f7e9dd

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\nub.png.DeviL

Filesize
1003B

MD5
0f232b07469657aac684742b254edfa1

SHA1
d10f288f96f6e2ba397cf6dc658a48d4b6182144

SHA256
4a17447261ee1a1fd9a0b441c4c0bced4da7dd9fafe80236cd648aa67ed88fb7

SHA512
705a29a405a537fc8c1138cc60fbc4fb7bd44e5bd543c667bad49e2e6dc9ce8a43426ef393be2376f79ea3e61836d4faa72ce7e1806b623f5e1ad792d6be2f4d

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons.png

Filesize
1KB

MD5
a5ee3042dd9dafea1bfc33e2237a1ea5

SHA1
a18e66151bf36fe5aa2c9d5a40c89bdde7b04926

SHA256
bb0652d483f91e7890745285075e58475cb278e89c5ca11e5c7223d70c098f04

SHA512
fa39af3657930c2d241ae59740acc88305203ac6ac2b175ef9d5eb0937ed0b334f6a6761ff1e93beb3078c98ca9a60bed219840ebd42bf35cde53cd8b3fe2aeb

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons2x.png

Filesize
2KB

MD5
bb969d63f41c3c8dcdef415216713adb

SHA1
ca9d2d782bdffe232f88e0f76dfffb996b573442

SHA256
21d9964d81bdb27c01529e1a610f7c4835dc7fd6a7bb72d381b3801b375da8a2

SHA512
985cc62e42bde7c8a9206b5d7cf7644c0aefbe7dd81a982652d90072a71a1fbbaa8a7fe2827244e72edc5a95c932451378e6c21f4b23c1c00f2b1ad7a70fcd66

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adc_logo.png

Filesize
3KB

MD5
5e372f67efbeb6bbb82d5ab27a952a86

SHA1
aa76aef2cac02883baf70b861ef460e3cc5b6b43

SHA256
d47f81617dbeadb90d021236003262ad7241b509d4087145125a87efade993de

SHA512
fc3125f5ed46c3891ae7df050f62679c0b9962e1e9c9cd12c4b1a2e93080fc859533904d26f46eaea6eafb2507ef92b62b04aff67cef645a2c1e6b3a0147fe9e

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adobe_spinner.gif

Filesize
556B

MD5
77061af2ac540d942f322bdd324d8fba

SHA1
8129105ea3a5d6e55de2b5abc92dc07788a63b31

SHA256
b55ee7b0589354934e798e749a34fe1c96b9151e8f6474ebf52bca3561859edb

SHA512
bbc6610b3fc6eb05dcd61edc241833e979ac542bf174b63392781b338316e2c01b6a2b58e56c38223343bf8f6ec5474d9238471a2160d763151fefcb5a55482b

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\logo_retina.png

Filesize
6KB

MD5
75d56428ab618522e8430e89f833f086

SHA1
7e5d9176b1e4233627d82f8ce19a3f2276df5594

SHA256
02c317578811f6fbeee9e6b106f3541941c5b343372548430ac37986ae67cf29

SHA512
e994cfa843f9ce87eb94055e607c9276573b2666a06fbc16e74992600077305d6edd4b43a7f61e4b59dc4ac094075b31c065634a7daaaaea4c1e9383e4b40192

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo.png

Filesize
826B

MD5
a7ba5d9f81b434896ca4333f1061b93b

SHA1
fef02053eb47f7846eb15e1e9be8869a76823e1b

SHA256
82ea834dc2c62b73c5344bf0ad867f8c3157d27a115dbeaa9e493ee0b4f2f95f

SHA512
cb419bc360a4b02ad003bb38c66aab4e495bbaf2626e9f4bfec2f8c370ac45c782540c974bbee535070520b02d504e9bfc84d92ac8adc01cecfd3290acbb6be5

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo_2x.png

Filesize
1KB

MD5
bcfd4cc35ad820fb2a9f25a857a24ae4

SHA1
d183f09586042f134c1145b1af7a92b0ea496684

SHA256
f38daec3516edfa765e7f5de9d813cf314db96149fffd00427e918e97c73725d

SHA512
13e341840474b6a1503bcab2910e001420c99cc7b83183817498540d99d90aa98b1b65a4cc8170e6f55c66ce4df011d899c4904b126b8ab452a3d239b84d1c5d

Download Submit
C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB_EURO.txt

Filesize
32KB

MD5
5e7ba7e36d338c3e53b2851f72473239

SHA1
d2934cbbb909265d38d57ec6ce4926ecd2e1b007

SHA256
813f4b1b15c522f035f43dafd510623f72174f2f963f8bf2e70af61a4d239948

SHA512
f7d3cf2e83be5b692c501db81e0fe1fd29a07b4692ba2ef02c44e88f3175d95ee3c619c03902886a6c5bada7c68e26ce71fa68d96ee5c57b41208e23b6145035

Download Submit
C:\Program Files\7-Zip\Lang\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt

Filesize
278B

MD5
2f6fbabf3d3aaeb8bba17de5a4626cbc

SHA1
c0543be835ff8f01ae2b234a68caf3c480f2334e

SHA256
fdae5edf0c23b4cb8f026f7cf69195d10047ed0664affbcfb55b42bbd8dd03b7

SHA512
2881288ff9d9535ef45884c8b9a440a99b7b7cfbeee4c4b0b602052deb96b6fa399636c6a1ba0703fd0f501e5d014af21978916268b933b00c4617b296d8720c

Download Submit
C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\msvcp140.dll

Filesize
558KB

MD5
88ad77e1fc7ebbb0f78af07a4a3891c7

SHA1
9e62afc70d5557780ef66f0b2feec8fcc9d7dca0

SHA256
1dd021e97876004d82c8631a12849f060ab5e58051da8489d3d91d793a6154c1

SHA512
6c15407310b76430dc20548e309651c8eae30ab1caf20bf3d75e4180cbdb58db653ee99a8bb08e044736906c0fc788d38aece0c5948b8ec4d0f14fe7bf08d4ba

Download Submit
C:\Program Files\Java\jdk-1.8\jre\bin\vcruntime140.dll

Filesize
95KB

MD5
5ec1fcca66530651d77091d156fc8eb7

SHA1
7444018e6eabdef40df820ead28d7167374ce984

SHA256
def6587707919e77367c60eea04eee6e3224bcd9bc21ab1de06f12fc25252c37

SHA512
780e52ba3905aa6f6fb33951c8f33c13d45e7979369d2643cbc1f848cabd21e322564e95ee4ce2717958588bbb5468c7d53e7ae83c7bb95e5ec63e8fde07bdc8

Download Submit
C:\Program Files\Java\jdk-1.8\jre\bin\vcruntime140_1.dll

Filesize
36KB

MD5
a92e68b3b2aecd40ed5b2c0ea0a3f9f6

SHA1
c3a20e3aa2465ba3282c157735a2d85c57188a42

SHA256
99ecded1fe732ae6063c873aa896d18b2d26fdee3acb9195e6a6c369049cfcb3

SHA512
94f8ac07792b6bf1181a265ade5b0a9e1cc142d791c725d6f86be39e73933eab4ed090847564d6cb284e6e1e50a2313f285f2107e58e786e488ba626915e7165

Download Submit
C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif

Filesize
153B

MD5
d960b11e718deeaa2b857eed3ae35984

SHA1
6c8da9cfa000df3680861092c47227277d41b884

SHA256
55d45b95c929b003ecdde22e4d0e151b0579a6cb1375884ec9218ee9e15d4453

SHA512
94b9158ab803aa444a8517f8db01a257b5af727d3494b0bad64baa41e723d061986e6c88cc93085f8dabcbd64fd56ed79a7dbd2747fa6278f1b5c77a863f27f7

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt

Filesize
190B

MD5
93faafb1d2d243f5262c8a225ce48e45

SHA1
6046bbcd503531da3b9b8036c268ee04c108137a

SHA256
50bc906022c7e7b47eb7d74f898b8eb4d885b73688b04b9905c24290a1721df8

SHA512
80f5f840fed4a054ea9de7947017c6e152a2bff67ae98620addbc559471b70840acd324fcab34fe66e443d21bd17aadb65df61dd6a6d873ca90302cfaf3ef3e9

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt

Filesize
190B

MD5
8033ab26788c5032e3ebeb17a7b53f4f

SHA1
b2d7fbbed6dc536e9d79298caaf38c998a679625

SHA256
91bdcab6f15fd16bde9ef2f757feb95cc583bf93eebe690b8df9f8b99854a972

SHA512
eecb163fb6705b53b1932f4dab1a89943076d18b7e6be5183ed968f90c1d050ff4d294647c2f66be3365fc9549a1ed5158e43891d64db731cbe824317231d656

Download Submit
C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-console-l1-1-0.dll

Filesize
11KB

MD5
1bd9543814a084af2d77010571ad4fd6

SHA1
13985d8772f142c1eb6faa0776d688afbc572650

SHA256
34a149fa4590cb37ecea9ee02aea341762f3dfb9b5f74ee7ecd0bf72829b85d9

SHA512
81b0565d7a6ef4fe17604d304cba994c5483d9330484828a73d266db1b0a033fe90506edfbd910a7d8cb844a7c6283c2f8cf9d485a8cc2ca50e00bf8d02dcde6

Download Submit
C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-console-l1-2-0.dll

Filesize
11KB

MD5
ac404dfe2d4459487aff712549ebe727

SHA1
33bc35c0334c5642b5ec331fb482e4eeefbc6e5a

SHA256
64885a7a86408f935bb1aa68974401388967d5180214acfc1596410a21625b40

SHA512
8898b0a31e2515cc0806acc20866cbf520b86d996d37c2946a4d2ac2bd01116ac1c252c1d4fe3c4e034a594fd711d3628fa2d7c2ab3c6ba83d209fa12ab166f8

Download Submit
C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-datetime-l1-1-0.dll

Filesize
11KB

MD5
882edd00f5c8f114fd228608e38c7518

SHA1
bc005c7dd3698c779bc7b04510c20e2d74a7f1e0

SHA256
d62860ef79eba2d8b5bc56046291b4a86a7d3be0bcbcd77f683371e2a84a4118

SHA512
a5dc2c6631c25673b29f2a980805af67e60185b8a22a3bb060b5946ca75bab1973483455b7681e71d205e8046b94a886833a9e127b87c76d702c88860f1fd812

Download Submit
C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-debug-l1-1-0.dll

Filesize
11KB

MD5
cecab2ededd3e21de062fe5c8b1c1fd7

SHA1
f5bfb87f11bba8e17aa6b32ba62b3ad98c6e1714

SHA256
90120261a2fec051058785b06fb11ac69c9f53e1fea98d7db17f924d151c248a

SHA512
54a48fcb4487e686d3b115a7b43a4e7fd9ae9429665d6de713ed8ac4db6ff37427cdb53b81e4d37dbed4b1f61510ebb265792e7bcf6244e62ee36c0f394746d5

Download Submit
C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-errorhandling-l1-1-0.dll

Filesize
11KB

MD5
42425d9d79787eeefdf1af90e4baf481

SHA1
280db2e5e071d2aee4b1826305800a2e881cdb80

SHA256
064652771c044eb0f4705b6db5ba3ee2b3b4bd6a08158c58548c08c0dc3b6f67

SHA512
e80e0c98a9958548dbb9fb464598fcefe1c228bd58cc0bff06a916e044168d30982d9b68b851df42ccc5a7c42b871328fd630a686f62957727c7405a0302595a

Download Submit
C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-file-l1-1-0.dll

Filesize
14KB

MD5
e28287ed4d1860a90758cce0bc63d4a3

SHA1
7766c5c29a411b93fe0c02ed4e519d95c7fb618e

SHA256
1cc8f4ebfa144f4063a6d23f652e0ad3f67f03fa5dc12d57cbf9f62c479bb68c

SHA512
17f8625448e6a54fb394eda27600b8acf71300bcdf41b4aecb0ba37004ff8ba008394f2892dc550f63de799066d82046960c96138bfa49b09f4a52d75426e786

Download Submit
C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-file-l1-2-0.dll

Filesize
11KB

MD5
506382ccff49c7c58b03733e9165ce52

SHA1
c24e3a56281ebbd30d61f39ee6a4f3fc7a3578ea

SHA256
8b1f4df5c288b3cf0b97e178806768baf00dc132259abf235ce987954912294d

SHA512
985bdb24115d539991e80e4b9cc299cbe8001e2aa62c75f377058b6611d1902c786ed87f76ffd25dadf2ed5c174a2d490d8771c7bd6766912619b29f4679dfac

Download Submit
C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-file-l2-1-0.dll

Filesize
11KB

MD5
66864269e5013a6bb0f11a5509d0c906

SHA1
220249729a087d710988159e3ebe17d0ae0a96c8

SHA256
a726f73fdb77e25e97d66e4200ffca78558d10564abf871b8cbb712f73a1d41c

SHA512
ff8ce7e6ad7a9012521c0cc0ddd0f57429390a732320256f5e98674f7ce5a4e3c724f8d873733b7fbb57348f5930cbe1c19233635cd3ef49cbee641c572eb069

Download Submit
C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-handle-l1-1-0.dll

Filesize
11KB

MD5
fa1f516cc77f46b758fb10a50b5c764e

SHA1
9de73b2e4148d3433943d5cb2200260ea8a112b3

SHA256
9f34f2c398683c136c539c2fa09d402a6f37144886f4e622540cf04e4cd3c9b2

SHA512
9b32c7a3e42b9086d58f80997ec2dc6337f635c8f80c94cdd98c23b7e2a5c94b78d9f00a7d0598f936cd0ae3a268111efb40cf3a282b534124cea8f67358a5d1

Download Submit
C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-heap-l1-1-0.dll

Filesize
11KB

MD5
6d7236ba78b0f92eee741ac0f2e7109d

SHA1
9796f4beca630edab189a06ec3bb5204230956cd

SHA256
68564de4aba3fb1eaeed2e48c3a2aeca883cd6e9f82faaf9e2ee5843cf3c38f9

SHA512
637cb7f6087c091da886711359a1ea80199c509a9776a07a9a19c6fae767cc9d225a4bb68513b36488fdb1bdcf266668ea6faccabbec4a9b76d1a78a50693cb9

Download Submit
C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-interlocked-l1-1-0.dll

Filesize
11KB

MD5
5a7c23e0b1729475eaa5a16cdbb98eab

SHA1
914380d70e5ce464a742b1d5f2f0bf4c5c28dfa2

SHA256
586714d6810582c4a282b6ccba8dcb42b157ee079b39fb9bec88ec0555185dcc

SHA512
a2cfd2649ac61e02d2550485b8fd82165f878191c659f181a895be022995ad7accce1dffeca80d7043d0840d701e221b6afa15360f0ebf04e0dd9b8abde945c0

Download Submit
C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-libraryloader-l1-1-0.dll

Filesize
12KB

MD5
68767c7bb1b96ee953fa7fe026ea9d77

SHA1
62705b676b84cff91376bcdc364ffcdcf03d1886

SHA256
5cf8685ea6199f904775f93be637a62f4afd5d8d23050cf22f9c55a6a8799b84

SHA512
c378c9c615b4777537a161bdda68b5653641da031f1274a61c03522e2078d2898531a69a1fcaed3cec4410191e9208a32b247e25a7e40147fb854121bdacb725

Download Submit
C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-localization-l1-2-0.dll

Filesize
14KB

MD5
5704cff9355beb9abe12d54f24732db7

SHA1
270a9e2b2cf4cf4939096ff63266fe35e89779cb

SHA256
bc34bf61fbbae55016fefd1f7df48c7c5260f335bc4c895630a0136407eea04c

SHA512
816031eba2df812a999faa893f68d3e3d3b58729525cde7f548169c648c91ad8d5b064247f219556db16adcb23f207ae1d28ba10c0398dac5a18df3a37d49ef2

Download Submit
C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-memory-l1-1-0.dll

Filesize
11KB

MD5
e2a8ae69a87157c28a3d7173e6dcb0ba

SHA1
b6c962acbd493162f1cf7cfdc5a08ddf8732814f

SHA256
0eafac0743c8cf2cf8cc97aa75a7dca4d2eb27a4a4a7ce159439f334007ebb3c

SHA512
1c760392877ce3221eb38e0dc82acb4797711c2bcbf92b50a17f4693d64769f60d9e36a29e80cc22eaee5e62e8277b7f6987243e24ce0d3dc6d23f496897ca36

Download Submit
C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-namedpipe-l1-1-0.dll

Filesize
11KB

MD5
f580142805aaeaa8d1a152bd4ccb2913

SHA1
8bb10687f369d8043f1b1fe12163873a43e1f0e8

SHA256
e83d1403182f0a35e3ca89f4078f827c38dcfb0d006844e04f92645088fbc858

SHA512
c8bde9acef26f79e937191ddaafd2b362ebf6ae91ed6cbd4381225b90992c410d064f0ad696f7959be3cba2450a44e65b0a35f6d98b6e80c15fec3bbc7a1b057

Download Submit
C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-processenvironment-l1-1-0.dll

Filesize
12KB

MD5
c07ff81694c6d416b8e30968e77d432a

SHA1
6f7a51a5e847512f17b99d41f8d0a97b4f6c1e79

SHA256
71a78802afc675d85aca91654d0c4baf6b470de8d7a6c61110b8969655d35a2b

SHA512
f513473b57593f91766f21245c93998898f0e5daba36cbcf545079c272a66a0984814b6ed167b9697421adf634aa216937876d3ec50e1b6b9df66f25e39805ce

Download Submit
C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-processthreads-l1-1-0.dll

Filesize
13KB

MD5
b09bb64a29ad97174fb01066e957fbce

SHA1
9c2f2f38d51186a1fc0fe8a16f544b0350703829

SHA256
b9b6d1d4981405f29213635f666da71558ae0eabcaeaacfec67c90d51afd3b7b

SHA512
c5ce85560ca212cc75db36b7c22c7cc99e534945d12444f94eda815a8613b1f8a873b6cb83bf2d3cfc22684b533ce90268bbef7f2bc532571dfc4cca4bb98a30

Download Submit
C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-processthreads-l1-1-1.dll

Filesize
11KB

MD5
1616de0c8bb09a77c80b20fe049f89a2

SHA1
fcd0b3e3302a7ba9850e1e9a6265e2fb6d5b8137

SHA256
ab20df6fab22b5913b363de71449e23f0f38bc69300aeba80612b904ee444430

SHA512
ccdccc39e8efa8d1231185edb6197a90cdcede9e5144870b19a73c36a1c11c221df9744be4b51ce989a0215479df92fc34e00387dc4f6304e3b12ce9ea7fe240

Download Submit
C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-profile-l1-1-0.dll

Filesize
11KB

MD5
6fc26ee3f797a3ce5d971ac69f845b66

SHA1
58723070f334b4b7a3ed83d40905c644854af2a6

SHA256
078664031dd4e5d7ac28be481ee552caa501f2bb7f0366c14e400fcc27213875

SHA512
2e585dec1f86a1f48d43289aa1397c4be796ee13fe6a13abd30c63877d846afc8880886fc2e5332c7e04d1b9f8c763a773fd011aebbfe1657d1fc2e9f15c65bf

Download Submit
C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-rtlsupport-l1-1-0.dll

Filesize
11KB

MD5
45b0c3adb531285eefe6c9505591b0a7

SHA1
d11ea71511358bd490c846a0360a6ad00ef69c08

SHA256
531a4346afcbce87cc37fee87c7b35b90826075ae4ae6d612c1fa2766e750d82

SHA512
9eb4f142ea6c76a0f782cb91a271c63623e9d256854a1fa313c4f8e85c25468fb84270f53a5cdc3811dd5129419f90045062f4cedb539e9cf30c638ccdd5a685

Download Submit
C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-string-l1-1-0.dll

Filesize
11KB

MD5
cc97c1c93d11428d16b578c1f12ed553

SHA1
857cfcf4c5e1ffbea19d500385841053b27a1f78

SHA256
53e206f8a620441561e1a9ee3d74872883d55882b3e30050581c1e70a6856951

SHA512
d3399db5b74438c6ec056ff82602a912bb5887f306bf0b1bc4271a46acd350e2eed95150c9f030499381d40c70d5f8401c03cc370429773397d463e18519e993

Download Submit
C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-synch-l1-1-0.dll

Filesize
13KB

MD5
088db886653ac73078bcb4b4336e940c

SHA1
229129421c81535b0110586c37a43f442007f78f

SHA256
84bb641f71f23d184d2cc0c1c16452658f3f1e75dfc9ada1d64794676249a479

SHA512
cb7f4de102e4dac7e1bf88cdec6d17eee185f10147abcb1b0f1da329216359e1f9076a234758f361bd30e8aff7072e84b7d8cd848895e00e124133762848f282

Download Submit
C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-synch-l1-2-0.dll

Filesize
11KB

MD5
8618bd077bebcf9e0542410739c2ac57

SHA1
a69ceea97121feb4ce63758befdae9f1ce9c98e0

SHA256
f62af28a53b421eb28a97b2c7cc39d51832d583da1959b0a944ebb23b4d2101c

SHA512
c7f5626231f391715e73339ef20ef77e774c46f615f1cbaa9957437221d9cf3cda7bf546f7b10adc91822e140f273edac9abc2be57cae08011361f99aaa600c2

Download Submit
C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-sysinfo-l1-1-0.dll

Filesize
12KB

MD5
36551f462a997d8f98e8e0b301005f3a

SHA1
de3f3cec0e71f338c4c172b4cd119888e3716a46

SHA256
cc3eae631fe0b72367a74b7f3795b841bad9d9a49d3063493a7787b371b928c4

SHA512
e98f8068fb3fa9e34114017f10d06e8141476a08e8a417e486bd4a272e008b002a2e805fcddc6db50f5c1579917bc4a1ebf2cdb70f53272f87a1ffa9dc494922

Download Submit
C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-timezone-l1-1-0.dll

Filesize
11KB

MD5
bef8e82fd681219ea71a21f3f9f20575

SHA1
fd7a5601968c77a34278c857878de1a9953217fb

SHA256
8f346240b254640e849bbb8306f2d12738dc6fb3ca477e62dae90d03fe5bc9ad

SHA512
7800e071b5c564b147a220ca42010c3cd800a3fcbd7c78511227d54a3beb9c3f6b7786ebddd5e28605703f4fe55858e8856e0cff2cf3936f7ce0b14079a35e59

Download Submit
C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-util-l1-1-0.dll

Filesize
11KB

MD5
9f89c29bd29dae3100957d74faa21b4c

SHA1
0a49304b32cc76ffadd86a2ef9802f32ae0cd74c

SHA256
64116fb83b1eea08ea2bba99f09dc14c931f76d55ba86a1d7567bef552c6321d

SHA512
623e1554bd9e9e7256088e1b3c33f340f4af58c99f25910f0efb342be0ea024fa56b660c3f746464c6a54e2710630337ba4b5485612cee3cdd948e33afb0290d

Download Submit
C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-conio-l1-1-0.dll

Filesize
12KB

MD5
e4c0b9daf04a398689757256ed53c075

SHA1
86d551455a603b23638b96e79d5f29a917109362

SHA256
4fab7c227993670cc9b41d91931a485e29832210e47ce5898d2f475ea2292b2a

SHA512
38336f367e4f46da8d6adfb88db1e475eff4d9e52e4bf3ea32e29ec7b9fdb9e5e13f141f7f3a004ae445db5f41107ba36cc732eb028238a9b97f852e1c38d558

Download Submit
C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-convert-l1-1-0.dll

Filesize
15KB

MD5
c7dbfc54e58c136a2dccacbb716aea85

SHA1
75d7a56d1918bf3f0dd43c02b383049067ae19bb

SHA256
a4888d69485a2d6fef24e1832450bbe10c5e021623e70f6178a3a9baa8ca0da8

SHA512
4cb9c66bfb564cc18cd670bf691f51261ad9fea9ba95a9684169cd86bdf2865b54d422f521f61e4e5c9835d7243f81852512421bd3e0a7463ec0fcacd7949532

Download Submit
C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-environment-l1-1-0.dll

Filesize
11KB

MD5
0c2183552a73c28b962699ddf3c7381a

SHA1
856327edc7cb2ffc389030176c1a0f0d1e06ba65

SHA256
4bb86e55c2819817dc1ee4513a06f40d8c30d6733ab4a575c4528386e379ee56

SHA512
c7467b0874786d1613b2a89aa025300a1e9b2d7f9c01fa11586287fc15340702f68d10b6029ac0329304b74321c14344629dfe444da85f7fbfcbec72f56a02cf

Download Submit
C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-filesystem-l1-1-0.dll

Filesize
13KB

MD5
32791acc236737c8292f21cf79083221

SHA1
d5ff023d7454391030624434a66cebd627e918b9

SHA256
e3478aaf507845bf054c104c43c00fed42a44a2dd02f56d42ad4efe0e61f098d

SHA512
1d61531a0c66eeb27df56eaff6328e7a2fb99d258fbd8f95276bfe3be4bdc0b08e4e8b525136a915b2d1cd420dec7e2dbc69f764312b7557c1dfcdbc9c21c1d6

Download Submit
C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-heap-l1-1-0.dll

Filesize
12KB

MD5
6c4c19378d891f6e82a6e113c57d8b80

SHA1
b149472ec1e9e7f5f5309c75822699e6414a332d

SHA256
0641ff4cf4bdde07c882f0261f05f1b2b96f471386b263108498dd09307f5b94

SHA512
04abbcf482092f092ecdaddb2e1ef5a55c7786c5fcc6fe1343e8ca60ffbf7fd48b590388d95b1e3e46845025b5303e37be1aa08dcd677c1fcf3620dcde2b9483

Download Submit
C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-locale-l1-1-0.dll

Filesize
11KB

MD5
1f5bf8bc2be5ab06c3c2ab8e944ca79f

SHA1
8b1b5c2ac090db6ad25b79e1b620b5342d35b66f

SHA256
587d4526ca60dada83c65f2660c2094daed84fdac2c46d767b0c7e2996747173

SHA512
67e69160603f53376dd4622848381318ebe9ec78eb9ba1418706adcaa2156589f2ddb7880a9ab66c9a2ba30401cf18d8912ddc0130e9917ade7b81b5ef64fd93

Download Submit
C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-math-l1-1-0.dll

Filesize
20KB

MD5
671f2b3fd5dc4ad4118605b38cd100ba

SHA1
52f52e1e162c7484699c4c8f765ee6e37c69b7a9

SHA256
ce5e600deb94dd8fdf56a02b73acee828f25cf7700e55999010a32577dfccf79

SHA512
e0807ac7e720f7207a8ad5f0040960f5abf09f23ceb0fae429fdca58e7eea95471355de8fb5d2dabc6316b3a5e71104fc05d30ea54df6dd4fc974cc100d918da

Download Submit
C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-multibyte-l1-1-0.dll

Filesize
19KB

MD5
652985e8f3f92b9ddd05d37d77c9bcc1

SHA1
04f9dc06d5a5e1c27415afc8e190ce589bb4b7af

SHA256
1851d77f2ea56448a1f2abe436463f5b1fa751f6b156d9ab80d31afd5d301434

SHA512
6e216323764957c79611daf69262cff33401dbf479fe7bf5335dc93a51c631dc4371df8958708dcf9d00f3a34efae91de1c39b8c11209ee13a0f9a1b25949c46

Download Submit
C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-private-l1-1-0.dll

Filesize
62KB

MD5
7be1c9713c8a3b7087a00cdddd61b65a

SHA1
071d793c69fcbe5ae3dd56e0859182a5a24c3da1

SHA256
97504a415628414b88c4dc3564bd92afbc5ac962c193d669aa7dbc85ead6126b

SHA512
ad982d674f5171b207c900c95ddc033b3780a6b8c563dd7ef688684ea3ba9060d83c4f2596e83e2d748f691259da72bb3f253579e2f33381d186cf8ab2553291

Download Submit
C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-process-l1-1-0.dll

Filesize
12KB

MD5
8205f1a0cf6e42f4fe614126f8ea8a23

SHA1
b80021e5aabb465f0db315e458e61d2fa0e362c7

SHA256
e7474735a049ceba80394ec27b69893d494a7b5f4f38863957edc785e7c1449c

SHA512
10632975ddbf01e4004888b423aa1141531f9994cc1f667fddd03839a9c8c3398de668f1a2814b84f89806aa0b8d4334e2f466dd0d5834b1468c242eebd873e0

Download Submit
C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-runtime-l1-1-0.dll

Filesize
15KB

MD5
72c446aff5f05ddae0c3a5be0fd6b1e6

SHA1
93ed1a46bc83f95723f4e47d49fea8ff3b7bb199

SHA256
22e6a7d412d95ab8558053fabdcc8d4bb84d50b1e597ca769e454bc1439f16e9

SHA512
37df292a8fdc6a3ab4dc05c5ac844d74a9fbd3fc68216549048c037e2bbe1cd678055249ee1b037f95639b99d01a5c032b67cc1fe41679142ca10173959a746c

Download Submit
C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-stdio-l1-1-0.dll

Filesize
17KB

MD5
0434c30e566e4095446b15b08ec303ab

SHA1
8e8273eebe4f56085ec963c63207c5933ee86bea

SHA256
c9004dceafc0ae17f258ae8c10838e6e2945b44b06891dc8b37c23e66fbdc146

SHA512
8ce018e78ac314f793c9978cff19c5f8f452a9ff14f463d40dbdf289cce5bd825fdcf71bae067213e808459039141613a69058efbb4168632efffa7b9f844888

Download Submit
C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-string-l1-1-0.dll

Filesize
17KB

MD5
f65265ed7669cdaed6256a18c9d04338

SHA1
9132d947393f8d59d3a5cd13dd8d45b04c10bb4e

SHA256
f078f906af6290e6240b136f4ebe360e13da1d5c18ae3129686e49c048884933

SHA512
d5d491fa2048d827affcbc93e0489281c7ec283c69c7b2d0b3dba68a72c09eb2ae9fa8a332ad578c2b16abfe7df77116f514560e319a4d0f2bbac92833b6bcde

Download Submit
C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-time-l1-1-0.dll

Filesize
13KB

MD5
d4025496658821c086cab69c03ef730b

SHA1
06e9f2a75452af9414f25541277c6e3fc58530ed

SHA256
4698f338e4243e6212fc0ac9490c9b41dcfc6896e8f151628680c58936e58633

SHA512
bee868cee80cb7034e44842b22ed8095a552c4e9cc71079df929400f0fd3166edf37a6bb38061d90cd6a5eef1073c8697c8daa2c6fe21759d143ba118c94ed93

Download Submit
C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-utility-l1-1-0.dll

Filesize
11KB

MD5
6cc4913c9cb28e7ed5c880ec03518ac8

SHA1
d009a2de2bc5be34a78ac1bd7d4385378a2e0bd6

SHA256
96aee8581002616806f188a5fb438e6e643d94ddb4eddd68eb1c76028ea6de65

SHA512
b797b3dd2c384cb39d3f1cd06c98d41171a39380bbfcdbebff259b278db2c7fa3bc433648d0763b3c187973471bebdce634b8658ba183f1d82746d78b983b094

Download Submit
C:\Program Files\Java\jre-1.8\bin\ucrtbase.dll

Filesize
1011KB

MD5
037afa797d7f096f66d784bf06ff6286

SHA1
cd60f9ff50783c17059efba460db10160218710e

SHA256
95ca16a7c15d98e8b9a31de46d22c57560a493ceecab603e7a04933d901e2bfb

SHA512
f457f0eba1093e1f4321c30d05fcd9383fe6172a6ef696c7461a7ac9baf1c8eb74739ea6e211b7df9cde8b03bfb6b085bc19858f794917ba1a64da0b9bdfcbd9

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md

Filesize
1KB

MD5
325ff1251aab6c530aa177086ceaae9d

SHA1
6d96e41d761a65510b22279f750493cf324348ce

SHA256
e54f4c1f0dd09a91cd7860015e004d1279fbce76e2f67fad66978600224908f1

SHA512
1154ca9f2b00ed9d252552ae3478353b90c64de64859ddfda8adfb48fa1c37acaa0077f8e401b596d709db5a9c248893742c30ad2f0a2925b6aad30b2941b44d

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\glib.md

Filesize
31KB

MD5
3718bb63b287a62693e8a2f11c1d92ee

SHA1
941036dab758b062114bffd7e993af8dab5d1f78

SHA256
9c0957e35741be3697803f7eea7ef08a986590352f7236f40e8895ccb309211d

SHA512
ee7231649427a4a06fd0e4f533916c09f30bdc885b77a80ff83be3066d68ad58cd7e3d840d23401877ebb462b958c4366316b15de3767414e24f40081ff761e2

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md

Filesize
34KB

MD5
6562c8d28e3c8d57b7c8c6613fb57eda

SHA1
4bb32f1e1611c1c5d9462592f16338b179454bca

SHA256
ba87427b0eb6da163dddcaff0919200a6bdbfbc8d840f63f65153c4aa74250ca

SHA512
6738083cd7cfe7710300e0a6e0b223c60927b7c08cff3bd283e5764fdd42bf75da76c3c85694c2564950a90b10cfd5284d2ea3145040dfb8e1dd39d782ca73f4

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md

Filesize
23KB

MD5
d77d5eea9fe93099f2c5e246f5c5f5b4

SHA1
38209b0b18ef365219a2cb28d9e600b114a03aa7

SHA256
0571d4dd78075fdce9fe5cbe05cf224daba32ee57576c7124e5b37e4673083ea

SHA512
ed534a03c4f804d56034b00809f03d5bcea2309f338b486fc5eb1452ce15848e82a55d795cbe1273b703b934dc460ac6d9ba115f428885b35613c01d11e03150

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md

Filesize
2KB

MD5
da313ca97d6583eefebfaeb44a6bbc2e

SHA1
94cca7327de1709eb40e45c7a7417fccdb3b7636

SHA256
ef096d60e078c9753b0c0fa1ed35ab11c5ca9e3368ba955be4da10e1f0fad4f9

SHA512
1164121b82bf78fc1b4f6efbff21c2da1de3f52dde3a9eb03550abac37000b39c75e1475fda7e587edf30e150da0ffb254d7a0c279e5cd65dc6a8e26553a2df5

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md

Filesize
1KB

MD5
e7337204698af59d32a58e793a03f4bf

SHA1
146543f30196f4657e8b98d0cdc7a2929c110360

SHA256
74819137fdf32f1ce7f24fc8b4f75b5d4509bb1da660314d96664a51d7c54699

SHA512
d60d06650bcbbe98f8da7c0133008ae256b976e0547e19dd607b724df839f9f3a69989fdeba38e7905e0f9fcd27ab5bc0b9601ee6aec3b6ec35a993d3abd1b05

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md

Filesize
3KB

MD5
7c0dc865cafdad9766696fe37ddd6c8b

SHA1
9f062a7691f9495da315d28871f471b6f921523f

SHA256
200df8ac6b5fddffcb517dacb7761a44226961a4c1d89f23fa19b8da6a2822cc

SHA512
855260960ba0d336dd74bcdb504133319063037271d90c5688fd34dd647e4fc6476bafffedcdb7c12034a0596f4ce2e47dda3ca430a098f62ae44cda121b9170

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md

Filesize
2KB

MD5
fbc07d30e8f5b8d6fab5330e26dfc55f

SHA1
b967b977235165a5d47c0579646a200baaa3a65c

SHA256
49273b41d49f2b11cb0f12e0fc0d40478ea5c8954007303f5c7b79c6c95fc97b

SHA512
928457cf88d7f78dc94be675167ea03f98e8db10d2f1a72e8e3e079f226c702adbe8715c494765af708ceda848c61469093d3b8f341e1f0e070c23640427ed73

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md

Filesize
5KB

MD5
51f81c348e6ce2746fa9ed4725833137

SHA1
b0c25a5fcb1e342f5b81e11a0c21ac335e9b62b1

SHA256
870fde32c700fd313ab6c17fe11c24ad752e3b464d4c48af6ff4afaf98091e40

SHA512
a938f0975316ee7987e7ac946d7fb93206b2fdbf2db673f20bb57b41579dce17908f690476fd4b7bd1738d76882e9ccd8560e98b3acfd14e6c2459e83f1eeda1

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\public_suffix.md

Filesize
17KB

MD5
28ddf2c49df96e4cd47fe7d357ab004f

SHA1
d10967d346fac08d04c42b34140c1d3dda3122c3

SHA256
62bab77debf539ff4a288e5bcc9cd09fa7e0a85c4c5e527615faa7bcbe2a8d3b

SHA512
e6017c93c8225a28fe5c5053a718df6c968a9c6184d265a66d000928e2d819ca7cc77eb7563dfdf34f6ebcdcfdfc1b3f7a9a808e15506eefa2a4d5f6b7011383

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md

Filesize
320KB

MD5
f46eee21df546ae187625dd37d20b9f9

SHA1
c03a1f91d2cdfe9e2e861cea4081ed46542cbf9f

SHA256
5000e629991c0e7f6d78e68457e59a584231655eeb5318df3acf1da651989e8c

SHA512
f7d9fde18f217754e58bf39e9913f3a32b5abcf10df3802f5435c0879ee32fe1d189ddf7499d5f20e61c6d7fdd6194548e67e05130519e075d6b6020f95cd550

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\asm.md

Filesize
1KB

MD5
d1954c136aefe6866e80579194423e2b

SHA1
1e1f98aaa9b9d7e5805984e8b027eb22d9546a1b

SHA256
c47c0a1266823252a9576f27d31cd4489e329196b84d55e5106b9622a1a8c922

SHA512
e26adb55421d7ef56b1a619fcfe99f346e50e38c7ddc03b32f391cb3af2e9e1c702e035d593cfc72bbbdc4b9fb256e9460c678d50c611c510d87c444abb542d7

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md

Filesize
10KB

MD5
e77ea06f0e1beacfbb0a5e251c4a86a3

SHA1
f3c34c921b9b570254b03e101584869e9af3b0c9

SHA256
d0c641f627ed66079ea74c491ee4c919cced290499dae46cb4ace5be99305007

SHA512
614af4918ed599ea66d5b9aec7ee89bc019f1c631fc685ff13d5dbd7193f54aa9af3c17f1c5a5290f40b56057fb66cc6b6a9200e2012407d7a5268f6d63dde8d

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md

Filesize
3KB

MD5
afd1e3a5abfa26ed0f8ca14b6387ba23

SHA1
2badc5b7b80cf3ccee7b9373be80f5a9b5d88c83

SHA256
8d2a661a79b6922480965865e03ad4514c399afbc3351b6a0a64db1f77a299b6

SHA512
c1999035ce5deae2d08b6136a6e0af7287d8b5648d6baea602522924e040f3a8e17ed357eb62c9d009f688225cbd38942e8e27910cdb59b19fc21c7c478fdf0e

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md

Filesize
162B

MD5
5655b9a4c31e8be7bf18997f41029190

SHA1
15fa5d46b8fa942ac00a98a2680e768ff004a157

SHA256
8a7a2045fdc80f605acf349927a9b49b3dd921f748b7488a0a21f786e4fcf6bd

SHA512
4396859835d461ef42c88a2912b1ae4c8989785e619bc41e85457d49569f9da094045f67a2b1c93f63026f10edaee145588da7eacfabff4c1df321bde5ced8ba

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md

Filesize
1KB

MD5
08058385dab586056658a6c7bab172b2

SHA1
ba2b90c9c52a971a45155df0849bb615bf2f6148

SHA256
77a2294683f4fea312e237667eb3177e53221cd68bc2014bb79d22677472e383

SHA512
3b4944e2b5504805cd5f8c4cc5a9c1c68614a9b10fbab488dea6e0f8e4c762b6867e18b156453cd48ab534a8bca64e929b48d109b8b8bd06f3be994e7e332875

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\dom.md

Filesize
3KB

MD5
9581600b0af4cf7f17dc60edbc7bfacb

SHA1
34e449e89c28c2512ce685cac6c8a384a752512f

SHA256
c5df191537d5f97a44fe93a1a4922902a817b01f7c17abd84a4e9d1d68e4e557

SHA512
395d068fbc07e7de93825e06bf7d04f3ef4b97e37e1af77ada01082a82bf9817d5bbba4d238605d0c518593a8ec64288b109d9143c3b8c92b07c3c881bbdd442

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md

Filesize
1KB

MD5
4c28d77427bbc9bea18a166d75942bcc

SHA1
41e3e8d57c1e5fd85b0cb7e9f4679110c2f0732e

SHA256
49a81fbd71a08412ea4ae3221260597f2e7c960f46c293616b598c2814ae8de2

SHA512
74b084edb1999ce238e3b2f2f4c3151d965f576f621d3de55573b6e16c616882fb62edd2f63238a69cc378b15e33030eef7bdd7b9c1e8d58411cb0397ccea6c1

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md

Filesize
28KB

MD5
fd741d114b32222f6ae7fe86c6d2409e

SHA1
aaabfef8f4cd0ef059254946e3551652916e58fb

SHA256
708920505ffae143afac1470c1198d3db9e5eec3c11c260e83189aef28c9fb8a

SHA512
2ebb99fdea6fd663ddc4a53d61475b0352d0efccd3ce66a07ddf80b3bca42e5e5bf16ef6d6c4a83189d87e135aa0c75e9ba676ccd2320185bb712a98a8e09780

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md

Filesize
2KB

MD5
a455fcc0cf1c1069997c064582c7c146

SHA1
f183bd9fb5461df1c87d67d30b74f49e859930fd

SHA256
b690b6f669fd53a30233dd4385938fdfaa83ffd66329790d2f51bfbb7dc3b051

SHA512
65938943e6449bded0c411a70234824d465b21d1be8f101334bc3bd761faedc6d77e15c99081cb2e151b77007bc114c1746cf21e93ec3e3c3e724d1c464c73f8

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md

Filesize
1KB

MD5
f990e131de1415c6e378ed319e194422

SHA1
1be791a2c741db6e7ff2874f2b2d2df5bc1fa57e

SHA256
91d2c77782c61230f71d926eb8562184251aa482fd41db2d9a0b919dac5f4888

SHA512
c8a118d795761f32eac099142eaf007b309d64418fca73ffeae38c01147f21cb33caa34f7a9c6f3f520e8039d85ab155783a852589d44a9b77085feda73775cc

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\icu.md

Filesize
2KB

MD5
cfbc5a95bc166f867d83b0394a941160

SHA1
478f05b6f63081238abd55e6feb3a53fa026e6c1

SHA256
8dcf4133ec5165564517bfa4c17295cfe5e115b632ba428fb4e740eec83952cd

SHA512
cb7a4b456d784ae3eb24be0ce704012ce6941eb44509f767552516a67f9cd82102b0962ffcef3af99a73fe3fdb5f5d18ea86771a24287ae6b86475d0f135c5d5

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md

Filesize
1KB

MD5
65355c1e619ee241f3e5cfb76a7a4b86

SHA1
9bbe057da49d9c00bc67bf7d9c5719c17f6d4370

SHA256
2282bbb78a6c3068eb6d3b7f9a09c99b41fdf202abf530120eaff3af0e820765

SHA512
19e7f71b23b579af11659027dd109a13dc415ae71ca66fc4b41570441428558285375355df8fa8f0b19b2ddab75ba7b1952d83094bd7e72804465c652273db05

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\joni.md

Filesize
1KB

MD5
8d8fd3626d509ddf0c18ba87a73d077e

SHA1
9ff23f09f35f8429257ffb9ec6f9f2057036e107

SHA256
7679e4794b451958474a0964023972aac552324214d27e8c6c9870c464122ee8

SHA512
4722e6513e897abb0de628184b38264649e60da891cddbc541486484a58b2b0449189f898f9d771b392fc698637f0399cd2ee93decf7267eb35cfa8d79734ccb

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md

Filesize
1KB

MD5
47cb1e6fe6093d3170e36c95fa8889e1

SHA1
53fc721e66c1a3b70901145618c2c7354d3b7d0b

SHA256
5843432a8c9bf86877307296dea027aa2720fc9e8c450090e3e39f23d0e0a487

SHA512
6445896db892a47119ef67ae00a4fa1bd49a164818f7cb822dd98db986a60ff4af96847269071f713cc958f12aa28a29c62bf2351b20a573f897004a69e45102

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md

Filesize
3KB

MD5
ea58e163832a228b56be4c4fc3ca2f06

SHA1
861853e06b84bfa5988893b49251b4137d051a71

SHA256
4967d71ab5f6ac92b6b56e85b135c06cbcc34fea5bebfe538a706e985eb8a46b

SHA512
9438b58304393c2b41f18eb880f935d1415b72669457183fa00987cc9b5d7adf4c8d8ac49aab2a732138cd6af573f3f61b4e8ab07a3e45dd37dd74cec5017f99

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md

Filesize
2KB

MD5
6cb046b6e6636b28efc469f48e7c609c

SHA1
7497849b942a758e4562d4cf2cda0470eb13b8a9

SHA256
f179455053a93b88e4e35a2ca4ac6ca3eb587a347c28cf8c32a143f786bf2584

SHA512
0624c7f9aa4edfc2bc610e5444ddc4db3bb8ad4cbe80b7ae5886a57789ad3e20306554a5d173a9b6ff1b017cfaa60f4fe7242e86940aebbff9ee0ff431efc410

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\libpng.md

Filesize
6KB

MD5
593b03d63d7c5a2c8db76f2208d398f7

SHA1
441fcfb1487bd62782ea7af0eac00e59c6b814fc

SHA256
b065e383f73a4065cb90eeefea104734d3f1da0d2e6d6a393c0ef61267152acb

SHA512
09850151315f240adfce60ca545f3f81ac005b7f7f292d7fde59bac04168a3d678358f2a0f51660c876b9061a325b2bffa2f9d0a9d5b8308e7ae5443132812c8

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md

Filesize
5KB

MD5
6522e4fc27dd73d647b533f942744b7d

SHA1
5c85d12d1d0bc15a2456ace26fbd7c3087ab91da

SHA256
5efcbac0087daaa75f14d84379a69ca91905c29474808fdc5e210d967bdabd28

SHA512
b9712e851ab41db08ff918d9a443b158ea041b188affb000ca13511e992f6ce03b47c58639d619d4d4a910f9ecbb88bc699a48e0840c356109e32c5ba44ef34c

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md

Filesize
3KB

MD5
be83257e6e1c9842593273c4b7d626af

SHA1
794325fb2d9b90a7951879562ecb79f1e4b19594

SHA256
a201b2b175530fabc6ef490bf705d0cd42eee7babf16c75979f6f6258e4db2e6

SHA512
2084217a4e1637493f4241c5742baf6bd30ee4c36b34849f6bdc2473e7d46d162d6eb3289fee604f125d90ab83f00973af79e8600d3d17f1e2eb3e7ce6590a69

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md

Filesize
2KB

MD5
5ea8fede17901bccd8fd01912034e5c2

SHA1
43dca8cfd3d810e11afb376efdeac61401529032

SHA256
eacce492c50628d4239a92bb66be7b990e19d7a0940bc96d052dafb08b1ade02

SHA512
f13ea514d7077cf59f94dc47a91d1cf06ba3cd8b7f76a7ff12240c1a1e9c95a96aef5db9dd8860f26118e2918fed29d611ae75ea9ae6d33f9af3eeab6a5c8e17

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md

Filesize
2KB

MD5
aa9fe1bfed4cac81a350546fc2ef189d

SHA1
27acfb2d65e8f2d095fa8c971bd79435da48e211

SHA256
621d8b3e06a23a6ebed100015eed3d81f60df0b27fbfc8739a36c2456fb9f4d2

SHA512
e26b6611bf774c75c9be27257e0a3117499472354d146e4b32bcfb135220eb09406c5a85e832d6df66d1fa275ea788f3718699bbcb9775132234a82ff8983111

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md

Filesize
1KB

MD5
d75dc15c43b4440b2fa3d29c7327c309

SHA1
30e02520c642609e2bf94fdb63ec2efcfc8d9bf3

SHA256
d195d2abb5b9ca64c99123231facbbe17d5ecedebaf308b68d559d6cb8d8c516

SHA512
a78f36741475a08f971db3b13fa7373ae1028c539194a00aba977c1424a47193782bc0e70c0d1907584b8d66b1e85086007788308faa341180cca82be3606846

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md

Filesize
1KB

MD5
53f380b6fecb47c69e1fa0f5bc6334c4

SHA1
6f0528fcebc69d0926e1160209175f567d24521a

SHA256
e14ba20922673bc032c865156daee24d223b3310b1efc5701e6161ccdca1ec91

SHA512
862e11d82e5805ac3638c0039370fa056a555d38a93b20fd101baedbb0e78b4abeb2ec091002b552822b5890f20b940dce66f992c1ddb943169365f282687279

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md

Filesize
11KB

MD5
f1fde9814762b763b9c8c0302616837b

SHA1
a2652f2e73a188a5b1c6e492e48099abbb8a3f52

SHA256
1add2352444230bcc39122ef60cdf7f0c7680bfacbced1f363dca696ec058f04

SHA512
b4546e1b3840901afe024fa8f2f750dd28f176e3f5e8c5dee7a4fefca662dfe02b4d50c999b094268708f6482b2b45cacd76796d21dbe7375caf53e94d032659

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md

Filesize
1KB

MD5
59761484287ce5150a18934ccc644a5c

SHA1
f3ff48916f0c7250f80f081500a1610a1711e66e

SHA256
de1e6c0afda86e4aa13dba97fef7a5c2412eef42aed2601058548e8e75d62c49

SHA512
b93d301e62c41c78c57e817edb65e7167ba452da569bbc536253ff0b3dcc298564b37aef5b7d9443d78ad2fce6f048edc3fad3ff55a9d6515bab7c8d1da01ce0

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md

Filesize
2KB

MD5
7147d1444781c76c301755a77348dc5a

SHA1
6eb07b3083e43904a9e454ed15d6f03b86cfba7c

SHA256
006b032770b19a81c1f0309ace5c0337ae0414f8e83916122cc9dd9b93008752

SHA512
bfe24a171bebb375c43037a79a7f19b36d4d28d54bd7d630d2bccc60533f19ddbb5c8bfd110aff5998798104f4728fcb88f371acdd5e6ea7412bbbf8b552cc5b

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md

Filesize
11KB

MD5
d551f175b9cfce1942ccc517b85ed01e

SHA1
c43a7da5a50aef659fedad5564c0c1a3ffab2f25

SHA256
e8d3c6bedb43fd8c328c7bd9b43add7b6bace6a6def7d7a57a877800340ae541

SHA512
c5a424e22c6e571c540e10cb134e6108648e386260fc00ae2376f5a54d49eb8c6d6980d419c5205a0161b7b88a5bf01ef6263c531f9f3edc0340254843d84d08

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md

Filesize
11KB

MD5
3203bd99167f46d3a1ba5e425c765803

SHA1
1fe0603e8185d14e33b1641d7a2c70d0bfefe937

SHA256
a737834ae1335972344eec9ac38d768b760b9fc4254f05c8701bd79d2516da08

SHA512
8261b69c69f34d5ad3a41c5ac998e7c5d4b49ebaff608e6c25d7091e56583274368973e4da34b1362f94d15d4acf84b90bbb98b1e2c1829bfd665782e57712e4

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md

Filesize
11KB

MD5
8451795779385100c4932917b265a5d9

SHA1
62b314fbe5be5478efd70bcb74fc673fc250e4a1

SHA256
3e75bfe2062b8a0b2f8ddf1df6532596c17e23904e6457330303c95e3a71ab47

SHA512
01e97ee1add16f4cb95460e35aa8994180e99b610c7557959ada6d78f7cd735802336f1271118fb0250c56cb65fc377cd605f5c8b532a09c3fd1b4bf07903bf2

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md

Filesize
1011B

MD5
80f391d2d8bba3c80199cac8bca2686c

SHA1
caba2df823a630b27d9afd2d42251da52834a1d7

SHA256
7cbe3981b0308ae7814db2dd00f8c41427b7c1e58ba0fde2c50bc8395f606163

SHA512
0c60fd4f770e58e3a2bb3da1b1574982248cc55c2aac3266f89c4b77c2f58e1649d83f8ea44e2e903c26edda405cd5a993b5ca38c8270d241ee923a829a01f4a

Download Submit
C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\zlibwapi.dll

Filesize
274KB

MD5
847fadbf3efae70d1c8b2f64f6cfb65a

SHA1
fd887bd7eb38ca1a5b31bc0fe80692544094f3ad

SHA256
f692f31300828b53dc2e228f7480a937e005f5fce5812d1b84e0226b8a38f657

SHA512
6d6591a1f7ab554f3fa0ad8823d63fd375a2a552614f23f3cf78fdabd6684437bc4fe12dd7f26e6f3c434f32e9e6f277888901f34b36d2d61d070aec99801ee3

Download Submit
C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-file-l1-2-0.dll

Filesize
18KB

MD5
5335a2e57e033fda942458007fe2a25f

SHA1
a8e96e06b2d791fe2d7836379ce03f6ffa83aca9

SHA256
ef0aad47e5730fbbe3a1db1cedce963817d5a0815eac21e4c48db6fddc80d0e8

SHA512
8aa766ba825e782ef954d7ecaeec634ccf7bc7a0c9921096d392e321f09d7f3f2657e1a0b9efcaa7bea4647b95271de0d079b4792c445abe9dcb02e02e806fde

Download Submit
C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-file-l2-1-0.dll

Filesize
18KB

MD5
b2936d58fc5a96c77d62ba2cd089035f

SHA1
7a3325a040c97a931e8f209fcdfab1c4f55a4067

SHA256
0aabc34f755a3d7305c08065eae02c9b2344da021ed382d169fddfe90a537b56

SHA512
97f8ec6d36e5ceb07b16f2749ae468b0ccf5554f05a944b44fbd6cf77c45f98b84420309e5ff93f69f45ae4aca994320fa53372fa8b72b80b8c03a8358d63c5a

Download Submit
C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-localization-l1-2-0.dll

Filesize
20KB

MD5
6d192217ec878096eefc6261562e9864

SHA1
2078c585d33c8325c0a35544fff5b052fce23917

SHA256
6f18a443bc2bb687643d656c2eea8f9dc51d929bdb32665e289e49ee1e17f05d

SHA512
f3192ad5e179f2c2c6e2d4b7453055983cf8ab7b70078704e406e2d356a1ff08c8c2a4b6548c9f2c5cbcefee200d06289edda62fa82cb590fc99379af7eb61be

Download Submit
C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-processthreads-l1-1-1.dll

Filesize
18KB

MD5
93548c96ad6cf1f07a285a3f8763bf0c

SHA1
5a5118e3e8ebf8567a1eb0266ff34b5d016960fa

SHA256
c509b5f8e72228692d956f754b4ab4bb8d5aa9c501ce729153d91162d4cea70f

SHA512
2f551bdf6f62c543db49feb2849c4da0765b0b11f388b8c910df2e3fe603717f1bfc95690ddf85953d40788cd231a3d45af5bd6563f2c4f5f560c61b939bd671

Download Submit
C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-synch-l1-2-0.dll

Filesize
18KB

MD5
08078d291414367d84027c5c328786bb

SHA1
07f350e053b3e10cc465a42b26ebc7888c4d4a75

SHA256
4355bf681819cb685c1e0cc98391ef061de4ffe8ec98902b4176ffdb211aa79d

SHA512
401a40e58ab2e5b01b3c625781914e00579ac1476236ac0dfb5e54c5eca932667cb12457abf950bb9a8fc60bff969c52edbe02e8ecf469e6d4655cf56c25ff0d

Download Submit
C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-timezone-l1-1-0.dll

Filesize
18KB

MD5
7b21ebc8e0198b14aec7d27df44417b5

SHA1
0c664e19b79c2d0c612c8bc5a15773cc780b2eb4

SHA256
88978dcded936ad5d7808515d8ade656984e4b6b0b661163775bfc4cdccac353

SHA512
d0b8a7fe98db080a7783c01e66f87747256f1aec296aa459aedadf1fe29e168eb1bef19cb98f79f09a02f635c3441ec0c30379ce3f93691a205de2504cbb839f

Download Submit
C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-xstate-l2-1-0.dll

Filesize
11KB

MD5
30a5aad764cefdd120bff04a29ef3a74

SHA1
5ee1dd3a1f297b6a2de0bd426a939d29acb2e38b

SHA256
531a4d2bab6466cfff8c50d2ae32f6b9f0fe04963797f2acb790c7fb8f36c12f

SHA512
8bd778b55a9b5636792994e53ebc9b696793175ed99960e90e096b6f2e2379143a23d5be9b96a9f1ee4d422605b4ae58d27866cd6b8aaa838d1c5e70e531238a

Download Submit
C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-conio-l1-1-0.dll

Filesize
19KB

MD5
38efc7b18e3d9df2f9719e382a974b93

SHA1
6c8ca17f30a2032a078f839467eb78de3811a77d

SHA256
cc43405e5b69fc133c07ca5f4a9db59a55b6ff3750765a4e2168846846ce3943

SHA512
80cccb30eaa7b4808075663a70f0169ac4606fe73d8541c083f76654436c21ad4cef60915e55043aac61f26f0d8eb9ce7d3ab03dcfb73a549a988805fee337b6

Download Submit
C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-convert-l1-1-0.dll

Filesize
22KB

MD5
0f2a4581cfcbe6b9522e6ecff3b649cb

SHA1
63647f7e131ad24b9babce38e55f6285f1868e79

SHA256
dcf871ac5a22cd4f8b096e3a03776b4e9deed61a33e10e323c21518b9d54614a

SHA512
671bd480c67d47ff574b4157b4877d622705c401b5bcf9bc87fa0e3fedfa07d5ab2fc7bf1f383a4bca2b9054eda65680e9bbed3f562c7a9f11f75f77d3566be8

Download Submit
C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-environment-l1-1-0.dll

Filesize
18KB

MD5
a3e52f66e14aa744e05f2cd5c878a18d

SHA1
1948cffa1490f1e5feeb58cf4bbb46095e556e33

SHA256
e5b81a6b511a224d3770890f105213d5270cf14686e53f6806a6d712382e8e04

SHA512
3bda22cba9654c4a35db19dfefc915f8f2ddee72fdb3ec4c8cd20f91c10b7fac12890143daaaac71f11ec133f97ebe6c90888ae21d888314fd28ece8b4ce05dd

Download Submit
C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-filesystem-l1-1-0.dll

Filesize
20KB

MD5
284320a29b7678849e59181d89f8f69b

SHA1
2840b2ee62310a8e6228d5aa56a6fc673411f693

SHA256
1d511ee9d201589a6e57e4137ee7fdb495e38a95080399c68d6f517773726f73

SHA512
21ee4f5ea3a9e0585bf4e0e96d6b679c5a0f4bf38474c28ef20dee63abe8e0b0a8fea34bc0d1e3782c8c971f6a0c417fe21e7316b903e633fbda0cee652833a5

Download Submit
C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-heap-l1-1-0.dll

Filesize
19KB

MD5
c70fbee83cbe8fbb1e7aaaea987635f5

SHA1
6daec1744ab1839cb5b61426f62376ea4ee5b0bb

SHA256
8f32f5a569164767381f58cb533dae86659721772a3a23ade23a9fbe7edc6480

SHA512
d00a29e7f24b9dc916d32fc3353873b1853add8d94c2f381e85b9a39e674e579d97a27b0dfc8a5c80e2347304625d627f63b383cd837066ac55041afad6a60c8

Download Submit
C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-locale-l1-1-0.dll

Filesize
18KB

MD5
70b399ca7318a38b0f0d394ac84e4ce6

SHA1
2187c2827b0ab5d6921de0b354ae7d59ad11ff90

SHA256
1158f0a1969ceb486fa595e869345cf609fb339009a3a94fadb59689ea74b527

SHA512
f35aad3f2799dbd71f49608edfba25dbc8c7c44fe58afd616f1456aee7065f5cdbf0bd8d729bcd00b1c40c97e878ac4af645627294011538c759341300d8c67f

Download Submit
C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-math-l1-1-0.dll

Filesize
27KB

MD5
cdd5c63dccb5cd08eb434d5d6759efbe

SHA1
f1a7e3ff6e3c312effab2419d84d6dae693fdc61

SHA256
46f69091339ee1e5015a3a657a978a31822a6cbe1bc461fbe67a8db056e5bf7b

SHA512
6708c7194f487c775e5ec4092c7c7b94640902a7acc056e90b3ccebce3ea3f4fcf98fceebe59642b84b521729fad85a8de8df4be615ba6bb69d06492bbade479

Download Submit
C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-multibyte-l1-1-0.dll

Filesize
26KB

MD5
87561f9df0fb12d9bd4a9a1d893cc1c5

SHA1
58d5a7c566a632d4421c84befe55bd5569665561

SHA256
0a622303caf3e462142e02e815ffa18e79a6f8cd3e903adfa0fc1fa3ff4f4783

SHA512
f0048b870a0946b82b3ab5e6209ac4e178e24532c12d21328308b2759feb8dfa9fa83c096b5bbd2d589f89211105018dd23dcc7f90b81309d790c64e39f2d974

Download Submit
C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-private-l1-1-0.dll

Filesize
69KB

MD5
790db27369e26443606a8a87cab3371a

SHA1
e7548a42e62561e6aa33417bfaa141ad44cde6f9

SHA256
646ec31e3d70df76d2cb4c56657e8c6b972c40479ccf04a06153c8c8d7ff0a2d

SHA512
647055b3b4e75db1c89380bcfb06908dff428033fc6c317322b143a67a5b493d3de082162a3fc18b54857f6e6c102289a4f10d5e283f7531f9efe6ac14ad3bb3

Download Submit
C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-process-l1-1-0.dll

Filesize
19KB

MD5
1bbb006dabe824601fae736517834eb2

SHA1
5c36b03764ea518e5585b3004d4a40c043f6d6aa

SHA256
d5b51bfef7ad3f6fa8c812ffb75123862660ada052468d86efd056c41f27e059

SHA512
ebafe54b128d18d953d637c1b590ef83b7c3a586614a62395047b84f2b1fe5b4750fc1dbd7481fc27c2dfc1bec4f526d92d7beadd8c2a759b9530ee3dd3a0925

Download Submit
C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-runtime-l1-1-0.dll

Filesize
22KB

MD5
65bc9f1fc679462fe74534101ec525aa

SHA1
643d2595903894893ff66ef9aa40df79aea5c9f6

SHA256
8b715ad286689976f9be85e99be4c6e89cebc1285d8227195dcbb2dd578ff429

SHA512
f18231e396639623283233aa9d7d6d39e65afdcee63c891b698b6849069e54e70dcf38d146c98f13381ef5ec5dfcf5a912699ffead58f759fa234f36f69c9b96

Download Submit
C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-stdio-l1-1-0.dll

Filesize
24KB

MD5
16d97946960ecc5a3dbb23b53d550afe

SHA1
48aefef09349543743ca3a26a7da07295ce1e3a7

SHA256
85f26dd700d928ef3a4e827c868948b49171ae886105b296d70b13ba44e50a86

SHA512
4c4d5f66cb1023c315d9598f7d8088ac956b1ed9c6f514b5c822db6674f17817b953da6d0a3c5480c1176e268b7d507f66d99a518b8581eb68f24ad4da0c3c1b

Download Submit
C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-string-l1-1-0.dll

Filesize
24KB

MD5
20525ef20664eddfe6f807031100377d

SHA1
3b7f1d59b706f767946969f589feeb593f6572b3

SHA256
2a4f7efb25d7da4fe7ad7908ecb1f54268146dff08fa032b2cba902f0f441973

SHA512
6327c8bba3993d302dcad899a148b6680203330dd211619042b1b04a1b2c66119e907b81ab3e2fd1952131cd1d8643bb382f68cd7a6f3c1e24576f7a7bb09f25

Download Submit
C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-time-l1-1-0.dll

Filesize
20KB

MD5
f343f0e42330594ab441747982e51fcf

SHA1
60e88168c05d3e66f2972a01a28affcada481d27

SHA256
b7d3aa9444f4b7084595d1b983f5be44e4a36e2e332bd474a50d35b44f14a0b9

SHA512
a71b16855b995ce480c951a51413b7e97ffb6d1523fbd54447835704ba39729f73fe52b25adc23c017530b3ca17f31b8857d602f8b7cbaf10f034d50b8df4ade

Download Submit
C:\Program Files\Microsoft Office\root\Office16\api-ms-win-crt-utility-l1-1-0.dll

Filesize
18KB

MD5
7229b146acf66b129931aa2a48c23a6b

SHA1
69d3a41f679945e3b6e75622152f99cdb2fbcb01

SHA256
0d1d76d134eed34775e73b25aa7ae3159f85412143410a05d2f0065452c04044

SHA512
b645dd58da158afed33a91c5044cd0d5f3bf3931a917bb5410d0fdf1f22df2a721313c3397cd984ff8a80a59e1eb81c714dbb81c85b6c9db8c3b75f5d14269af

Download Submit
C:\Program Files\Microsoft Office\root\Office16\concrt140.dll

Filesize
324KB

MD5
af778a8c85b156496df10218e3bf33b2

SHA1
cd68415dde0fce7cb86410dc9e47fc70b8848c01

SHA256
26a63f5e7cdb5bd1d3612149f28aa9a07b8204ec8b8ebbdf6433eaa13c587175

SHA512
85215e2da95f659e7b21d1aba8ec710f0a872ed1c7e5ef6ba52f4f760cf21c4fe1aa4ccc26cdad7d300882ff7646cc97b55a43d8b1b5c11b10ee664a3388e080

Download Submit
C:\Program Files\Microsoft Office\root\Office16\vccorlib140.dll

Filesize
358KB

MD5
c674d95594041588c5a0b52668239671

SHA1
7a3522586fbc5f883d312069c12e7b325ff1029e

SHA256
f037d853e7dcc621b10d551b234442d68a48027ea5f2533858018f8c9d8fd5a9

SHA512
70fa58bae83a5f1b6edd0a47fda94c6b52c3b09cc8968c8903b28303a55316945184d85f9647a5728b985489a90d75c96b9a3da76873f0171c08c01dd4ea0199

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\mfc140u.dll

Filesize
5.6MB

MD5
3b68578eafff673863635a6c1f91d7d5

SHA1
e0e62259a914e0ee806d393e7c6b3f7526648c1a

SHA256
4b4e26f4c454a2c5191aae2eeee04393a4745744cc14419e0d872672943719e9

SHA512
a20b469707fbf6e9b31440d3facf3389260e337190d283e2d3bb2a9ddecd69bf10bd678d55a64e2751a976c5e81d9414b94d4781f4f8af80b3ae593f8490f3ca

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msvcp120.dll

Filesize
644KB

MD5
6330d56a97998ba0cac91477f1a57bee

SHA1
02cb87f4f8061787c620c955b9b14291fa785f80

SHA256
97449188220ea883784b4a8f76d1ea89cc8cbe7c27611ef6b7ef2f033675880f

SHA512
c274007644018d059b4c0d329f3c92060e9a372ff519baf66e53aabe8e60735359c7d3823f81f425699302291b1b25fe06c705dc27e2a451d0ef08223191269d

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msvcp140.dll

Filesize
613KB

MD5
23fd67f83151e001108c94b48d0f8748

SHA1
da1f98a2c235c067978969a81ce6788bf2bb2c01

SHA256
90a01fa46dee1f7b938f5972ffbd4c3494aad65d34bbcd2cf184e4e8f849c00c

SHA512
316e83bae6dab6cc5625ef290e8c312740a3bdd352b1f3e9ad2fab2f4baafc128257bad683c0b6383722bbac950cb0f268906d25b3f455f166b42ba7974c4ec5

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\msvcr120.dll

Filesize
940KB

MD5
6eee65cfa78bff76151a6babfb5b81e7

SHA1
d18c4ade25cc7ab2f44ad7b6be5f7b99c30ea8dd

SHA256
2cd2634d20fb70e328b767d9e27226328ee7556e0bafdce89b9e4cd1f0de728a

SHA512
8ecc4c486eb0f695c8f6f97ce4249a37ddf36d3429e7bb64fc8e7a38c68d7db1622930d51db721f2f041f9d03b6e2e951ec3324eba6aa15936a2799f391dcfdd

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-core-file-l1-2-0.dll

Filesize
18KB

MD5
98f188656c14556bd5f01257ce9c3ec7

SHA1
664c304cf911c10c7b4199ae5d405c9afc889fe2

SHA256
cebedd554427d49b2c7d4e71a405d0fc684b9fa68d4994f754204259cb14545f

SHA512
9c6efa9b40fe98bd43319323dade6e2ea8e49e5a436d60caa084c13dc73c5915521b9e016b527abc79a7f5ecb16b660d4bbfb8d5a9eb26f3f3b3a88cb0338802

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-core-file-l2-1-0.dll

Filesize
18KB

MD5
34f286652639bc53b7289bc9e5100bc8

SHA1
5f2319b1fb1357fb581a9212fa679de3db5c25bd

SHA256
f1a96e01b1fc707cc29121139fd31c0b1936df3b9838c6c3bdf58074aec3d20b

SHA512
072f55b217c9b1dc92c02600b10128b3df2387f1888a41d19d7da1789d674778e94ed19f5894b35f6f230f701ba366e4b966dfc4fbaa4dd1bbefc7f14f156150

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-core-localization-l1-2-0.dll

Filesize
20KB

MD5
a803414df8480c4a9e2fb5d44dce5f8c

SHA1
29ff99abe440321089939a44e53ff3c92ba10f27

SHA256
16618f94a739533d89779d6b904181be90da5a0c95701a3ebf06e163e3652973

SHA512
8bfeb0b90e7fffaa04a76dff5960adcb22d4223387e9d7ca3154a5b1c6b1a78fb254990112afc4ad44f20280b90b75e1f5dc62166862bca90537d6ef9ffdbcf9

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-core-processthreads-l1-1-1.dll

Filesize
18KB

MD5
44f23a0cf4fe08fbada8464be312fd19

SHA1
0ff18c3ee98e82e9c3eabcbee7233a5055141a0c

SHA256
bc41e94fcf878df1699aceef42cad903fafa06dda145d683d0633cc497f90d20

SHA512
012cba8369410699d1bc67403769d8895647f01a320ca006f78559ab751e31d070e216927163eaf20cfd5cf4d22211a44e6fcfc9f1d0fc706900bb4af330dc37

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-core-synch-l1-2-0.dll

Filesize
18KB

MD5
5747aaaa873c760ac9982a0770c31207

SHA1
36350ca42f752b1fe3ffb0cd2fc0492e40270a01

SHA256
d233e3694c931e9aa8fb28b8edfcc883b0fd5caed85a373ea4481d25fe62d214

SHA512
c5fd39a5798f60d66795b047941452075297769a075cc02c85a842d5d1383cca08ed4de7e4d98ef927960be9a35f45f19d913490f223daaaa705d8b811d4aa80

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-core-timezone-l1-1-0.dll

Filesize
18KB

MD5
9a652422b54233eb1c469ce20a763d6e

SHA1
23f063b3b50deac9a1b3330601825656c9fe5f53

SHA256
1181e574bb6e216f78a87ca03eb335cdbb6bf6ec3fc7e4485f3de5cb907e627a

SHA512
79d8a72f2d0debb711c675b32054b15a1175f9ea3c8a03041ea2bef0ce3a109feb1152ceac0eb0c41f237de4bff522bc7bf7d120c743ff2bc7237363f23dc4ae

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-core-xstate-l2-1-0.dll

Filesize
11KB

MD5
f3d9d0500a8ec652ffc1df2ff0f65494

SHA1
e66203ff059adb80a340e5fc3ece76fd1d7b2892

SHA256
0fb708051c834b1403c43af45208ebabf8ca4b2b1d178aefefcd0db98bebb181

SHA512
ceecb94db12d1bc3900c612ea768e35c9e3c25c4c4a447009a34e60471df94b7e3cd035cd21432946ce04144bfa9eb46b76e1ce4ffb67234d3f374f1883f3afd

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-conio-l1-1-0.dll

Filesize
19KB

MD5
3c5fdfd87f528ef346bfdaba97ff07f7

SHA1
6f765431511623b8bdb3ebc2e8c77364367fb726

SHA256
6f3dcefed201768b6becb01aec13efa3f2934cedd51672190af05d82a902d6c8

SHA512
e5f856efea775fbc4c25e18b021d158bfb1d07bd94fa9aa6070e90e0882dc4a5ae4001b83c3452a9bf5344564a60f8234acc14992ed7134c97315381351f1c57

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-convert-l1-1-0.dll

Filesize
22KB

MD5
ce5d830d8afa21bd4aab8eca41344ed7

SHA1
b1c06fdc861e4eb9fe4dabb4f7ee3348222a5490

SHA256
c559c95a073112773d9b8f2aff0ffadd27b54058ea75a2c7ebdcfe96ab42d1c0

SHA512
8c5b92879e3a0d9729a3a20215b13c57ae4c5399bbd0c5a8a7ec1caba4d80f8104548cf7ef0f28e7bc83dc89892939f6c0c0d4c1307149c5914f86c6d1a5b1f8

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-environment-l1-1-0.dll

Filesize
18KB

MD5
f87c919154b494db9243791c2f94ee47

SHA1
dfa05443ec32ba2f16d4db2035cd623a2ae20210

SHA256
6a17ba2ca39d816d4415ef5d618ca6792cc08e387d72921d9e97509807148cfe

SHA512
f93cfe108133feb5f3df0d418e8e7c68461c64444ec30a2a328827064d528dbc96a3053d5525f5fa689174ba747d06bd77dc80f9ac9dfa892762f0fac1425f40

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-filesystem-l1-1-0.dll

Filesize
20KB

MD5
bd396349b6aa03c8009a5b5f1e92c900

SHA1
ceadc83e65315bf7eed45d9a64f36a345dd5dd2d

SHA256
2a4584c66aaea5fc97f199558ccd6c5164640fb8716867d3daf2255fc7a84cd6

SHA512
d172800b584edd936dc98dac27be1fd0e28e830ac7c0376b1a458043690a7608152d8c2922e91cbde2805577fb58d63d81b6bd0b8ca424e3660d323e12b901d4

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-heap-l1-1-0.dll

Filesize
19KB

MD5
083c38d93d4f9e69ef339aec130e917d

SHA1
6f7d38c9f8e342d4d5c813fdc16a3e9da8855029

SHA256
7e20f6522ba2c114fd5ea98e3ce996e9a96e42a1259af0de9447e190a029db7b

SHA512
d47c7552526aedbeac20a51a2449795b44cff7811ea497f467727a54ea8ccae7aa6938546787afade3d5d53fb58e8a8acb5b930926f3464ec779d07d6998715c

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-locale-l1-1-0.dll

Filesize
18KB

MD5
4bf7d0ddc075706f6877ca493c111fd2

SHA1
7b3aecd219841df6eb29483786eda661e5333c10

SHA256
1489777d30d1811393886605bb25fb5415d40cc62f84f96480477a0b3740e03c

SHA512
55df89cdeb7659371b2f9bbd5f047b431286f8d922693aeb3143d3c83916eb6218fa8d573ac393a6952f5fa46da54f34e19f9556a0c65e2bb73c955660e9e894

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-math-l1-1-0.dll

Filesize
28KB

MD5
9a589706d0d1c8b4f991c2b490c14cb5

SHA1
5a8442d70756fa193fce73c2c1d7f222e09c9203

SHA256
c58a23b63065161fe988bce3534974faf9e4fbdba1c2f73c9c1aed2f9fd66a87

SHA512
7f6fdf039d9a4a29550f2c17658dd39f2844e6d0e0d4c0032d55834c0ee0faf50ae2fd926e1b3742abd42e55b3786ffeac9561eb422510134b38f7d245aed953

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-multibyte-l1-1-0.dll

Filesize
26KB

MD5
fac617afaa4023fc71eaa36755e2a973

SHA1
6fc2dc5c505690eaf8df25afb7cc9578c0d41305

SHA256
bb982b605aa3ffa686e1b8a135cda883046cbac04bb4e50777420c9b3c11a667

SHA512
dd1939e902ed86f13ba8ae8d6e76685fb28091c5993e8f26e03f23ae5d66a6b193112211cdd49de45e876282f843d4aeed099bc42bf2075ff3b317e807331edd

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-private-l1-1-0.dll

Filesize
71KB

MD5
d6c048ab477db7ab4ae7060e23a14d8f

SHA1
8916abf1b94d7559a8e9a1b01f8cc8b10ce94630

SHA256
439de9099e82f835b2133201a90aac4593ee8f66076e732630dbae86aa5ca093

SHA512
dd40b068abf969723f9e2774296bb7faa2b92a4cd5fee9dcf8c39453e3b3b933f232e88e08e4d7f81adfb3a5a17397acc0db8b95cf45096d5176bc96e478c649

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-process-l1-1-0.dll

Filesize
19KB

MD5
85333e76a253953d0f17d1607694729e

SHA1
4cca35306d88541e4b94ef0903c787007a4e065d

SHA256
c1bbdc7d2cef0d33c1caac1dfc6bb9293092db176d63c3cd4d6027b34d521019

SHA512
93776e8cc7c9ff364970c2f494386e23d3b5dce9a156b5f1c40bc215ee8e9c1a48a72a22469333a8e33bb64420b67d8ea3a3ac77135729f95a7f5bddc9068215

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-runtime-l1-1-0.dll

Filesize
22KB

MD5
2a6a29d430dfa77922d035c5f0f3487e

SHA1
e9a116c64c78b21d113da1577df9ec2d26aabfa4

SHA256
6d3e7794a8647a18e98a8562f52ebadc82e76b056212c22077f3d08ff42df223

SHA512
3f1e2322607a158bb7520c1c80aaf0ced0538b9a6f58fe19689a987d32e0f8d9e0129eae4b5ce5200b32897b378adbd11e3af239be05f3b54cbe909373af9490

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-stdio-l1-1-0.dll

Filesize
24KB

MD5
1eedc1fced53daf55001773c5cacad02

SHA1
d2d76266b63239c9cb75998456919fcff2540dce

SHA256
c843034f490949e3f198f44079db862a9c7c1463a3ec5c1904f9faf7e4cae256

SHA512
a3b7b137c1c866d723ca84092dce50e9421b992fb9572cc633166c9e1735e63b5830a724fe0019bdf726808a11beb44088338cad53ca92a1ee89972c5b932fdc

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-string-l1-1-0.dll

Filesize
24KB

MD5
310e2803ce89bf319d8ca0cde1c09dfd

SHA1
86b552d217f4d83e5564f6e132afc540f573bdd8

SHA256
9fe168ec4e95f69010fd455bd5bed27ccbe691cfa44b37450cc89097c5d75d16

SHA512
19acea950768a00a24ea42fcd9615433ccf0622310d7d5d0fd41e81a7bfe561148484cb1e20fe4283a3abd68a753cbbf5cdf859dc91ec4c5d1cd7743b118d495

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-time-l1-1-0.dll

Filesize
20KB

MD5
7885b6feecea304923374264d3c12a71

SHA1
d133a194812ebe2f628e7896b81affcfed4a5606

SHA256
345776b0e4ed0d691864045727c1828b82ffb22fbdbfed8e9e58e61a19962f25

SHA512
e46a062a77cc6f8331e3bd3dc435d8cc37a7bd6f5ce47c6c04e2516feb16056fbd4faeb6d3012a3d4da8ed24713aad3f4e659f829babe62d71e4ed19fc0104b9

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-crt-utility-l1-1-0.dll

Filesize
18KB

MD5
da085b7f8e6c123746ed56f61a09722a

SHA1
bd32f4390dde42e6568fe74867d872481d7c2a13

SHA256
32c5528486f8cc214efddadf26a8e7f149ff392968b6c4e38126268ce1af735b

SHA512
12c0c2272a26ab9ddd268fe5999fdc6923bda2b4d5aef7acc39484f4588ca633e4ac428865c4e7eed238d47735f89d1a44783c4b04cf653e4590275eed5e5b80

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\concrt140.dll

Filesize
244KB

MD5
30598d59c292b97de547ca4e36d5a387

SHA1
6c749cec9f278cc6afc3aec672141df9fd5ba211

SHA256
1bece63e04b716e5496932f6c3b1130c0a93094ae1c62a12cfa850cb5be17768

SHA512
945f8eb4e775994f850308d786fec34271b4d430019c16e3227f3f29fe75ace00219f4b89b1305ccc0956231033fb0f97655fcd8ad201d6c30f78c0cdcd2d631

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\mfc140u.dll

Filesize
4.8MB

MD5
12ee6dae7985350eba53c333c5ddde9d

SHA1
0e7864b6c7abfc6bab7b6bbc18d44be686bf30fe

SHA256
b5d59f7ca17aca3cd74ffaa55aef3ee6baec4eecb0868cc506223deb15d28a6c

SHA512
b2980d9b248106faa9cf6b28bdf3efe8e0cacb0d2d3d80b12f719ce1efc1982da3eface1f1f8fede0d882611a075302afff0b62ab924b83bd07feced7129b395

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\msvcp120.dll

Filesize
444KB

MD5
7256a75f9fde9d6a93e1003a040dc816

SHA1
651f98420d6b9626ac566d4cc85ade847904b0e6

SHA256
81bd821eabe926ce7a5b50f5bca289f07bf750d7c4ba6a80db316a1b97f99c5e

SHA512
c0820cd4e6a0de300088608180acf78d8478d6f762f792b9f18affad92985acbc79b7755039570edf9627b849cdae5a55d8412255d9f4ea57350e8363bf77266

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\msvcp140.dll

Filesize
439KB

MD5
98b06ed1bc71e6f973ae45c7a7d89d59

SHA1
4df1e4cc4bca5e817c4ced1f5fdc2d077f251ef3

SHA256
29d81c430b280247f44f9e948d7693858ac009d036a05ee60e884cbf9ab44492

SHA512
ea6e9ae1fdf50e744570efb3e617a9c08b308d59a50ba5d67a224ae408fe9c6263bdcb78970065e92e22e16b49e21461b1cc996057c9501514938aaf2e4b46b6

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\msvcr120.dll

Filesize
946KB

MD5
b83816d96dae907f49916184edb771fe

SHA1
08bf825abcd1b8fcd24c0d19e100059611029e17

SHA256
b7743db830fcaf0e2126a3c13a9500069ad9a7022bcf84eed9ac9484e979daa0

SHA512
481d87d9caac69acb56f337b6f43a57cb228fa4ff837fa09ed2876b6274b34ce8c9b7d85da8f585605194b8b6676033c992199b4e2571bc933cdb937b8191207

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\ucrtbase.dll

Filesize
879KB

MD5
93266125883353b950c3197f0023aa78

SHA1
169a6e7f03f9c34854cbf84599768e621536a32d

SHA256
441cd6d95c513db15832cdeb87552e84d6296c58087cd26838dc5437b26216f9

SHA512
38c91135a909905477da56a3af00ae59d5dc73ee76a002ff15ee64a18ac9e364f93448d350c7b3b44354c022ee9e100e144dd2a292c06e8b88e37e4b38240fc2

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\vccorlib140.dll

Filesize
263KB

MD5
a95cd310603e429af5b2904c81ad4078

SHA1
64a8f81e88e168aea36345d26ba9073021021e3b

SHA256
092b9ee3065c6bedab2814e2faf9c02f78211d2c7abccf9d9a4906022a6224a9

SHA512
599b8b14f5f706bc270832907a5ab1a4d5d2ff1d7858645522f265bff43b5b0f3cac530a42472052f59e58b040bb371fe6f2c9becdfb4147a18e483e75cf5284

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\vcruntime140.dll

Filesize
78KB

MD5
286131617dd123ba95e6de357569bf94

SHA1
e1a72723aab28827582858b13ed7062f69a89768

SHA256
524d46ce83d5b4b9e88639118718694911d7c94e2cc382d813d60123abb0224e

SHA512
8bb0733090f8d490c2048d8a58a12e517dd7b762bc8981f266f1c56709e10b15786e6b63302bdc6ff891003021726afccca225ca69cf0e1540b216c4eaa01969

Download Submit
C:\Program Files\Microsoft Office\root\vfs\System\vcruntime140.dll

Filesize
83KB

MD5
6a5f192fbec079a1db7f1f8bf0b04e7b

SHA1
578e1d838d8b460bc78a7c274d5436cbd6dba158

SHA256
fbb69879ca984233b9a2ef3bd157a7709e5e6024fa43e4af105bc7724e2f4f87

SHA512
80da97fc0892f2f2bd912385073eaa1825cb2d73dd651b9898bcf6545e96d7b508801d60882036852b276091660f1daedb2a413e90545b6aa65539c664711159

Download Submit
C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe

Filesize
1014KB

MD5
15cd08845011bc0bf25228fe2c1e9ed8

SHA1
d05eeb3e30fb7abef9dcbffafba6d52925ce919e

SHA256
20d9cebf4495647654a5c1717f3c17532839af5708e66a62ca269e48c13f47de

SHA512
bec1da0496434593d23aed19fba31668864406f6c6e22a783c38d2bbaa7526efa2134c0997dc82eb9f20ae4150ded26e881bea371e2693a68ef81acfe4a8bddf

Download Submit
C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.DiaSymReader.Native.amd64.dll

Filesize
1.8MB

MD5
18a679e8615ce903b67232ad991f5f4e

SHA1
7215203f5ebd4794d2143696bc884498161bc3c7

SHA256
1ca71b07cf50e9361825545307da9ef8653c96527bc527beaecce3f2e2d68e87

SHA512
db749742f32e521f988ba6a9607a14b293ed33246b4582b43f3d8aa3eb8b3fde665ee6a7481a2196d928377d359e73ed3c59ba0cb1e916638b71dc1639713ecf

Download Submit
C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\D3DCompiler_47_cor3.dll

Filesize
4.7MB

MD5
ef26a26821ff1257392a53fee6529c90

SHA1
127d2fd0b09ad2773eb32d9446f12c4a33734d6a

SHA256
37a7026d1a5a9297a6e876fa08d8169c02e482128404a3aef920be19809d6bf4

SHA512
7a16a17581af447a63dcbaf348fd8cd239f6f134bdfbe2e0c46fe2531bf4cf1a659169d7f2fc0841d75a7e29579b9d9ae1ac99bc13b7c287bb04f0a1a62e54e5

Download Submit
C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\vcruntime140_cor3.dll

Filesize
116KB

MD5
e96ca2c0024641ac2034b0c5c34d1373

SHA1
9d48402eeb3a7ae29bd631e8b08ec8423df57995

SHA256
6914bfb37a2b8399e8230c43bffac88d05f2504af4ade3d6af5a3932f498cc36

SHA512
eddec577244c130226dd57301dafbc4b83387c4d2a15177f3224f84c128637517fc0f87f3093fdc63a76388a9cb669893dafba50fa4ebffec43bbd7800af58c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini

Filesize
174B

MD5
185e3895048c71200f51a8bf76abc0c9

SHA1
6e3dfc098195222177fcca08b269d16baff3f8f5

SHA256
95269c33de913d9e5eabe02d3a26a18be0b6edcfa5a7dcf7ca3c088036fb3c55

SHA512
901ff2e2c9b8a5859758f244807fd20c6bdd1d04f38d97b53927f32d7f3531de6a76d71c548811cb3e933a6d6f65956d272fb6f05d55a215f2b1bb357249b57d

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727656226049089.txt

Filesize
77KB

MD5
d045a72c0d8dd93f819a69be911dc671

SHA1
029f9331954fe8104bb3ff3c1828e36c7f179257

SHA256
f16ae0e98815a6dbb569ab22472246a95bbe1616a4a06671cf5c497b39bf9d04

SHA512
8556e42341f3705d2e5f236d5460deef69bdea007083d9cb122557702bced2e0a1235716a9510d9cf3423bfb950c4378f1fc3468cb3c59cbaca6ced26cdd3d0f

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727656623420834.txt

Filesize
47KB

MD5
0f3647704c02f65367d8b7632697c0b3

SHA1
8d51f5af494fe53eb335d1e66e623d69f786ec50

SHA256
d7701108a1460550ab68b3009c0e0e6e74b6280c061864f9fa7b8b329b9eee76

SHA512
c8647f3be10a655df6524e3695a5e831840c48c8f2a02e25323c6b70f0dad50cfa18e76cf5e6b1513064487c286e8d7711275b43f01cd1420a197669f71f3810

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727663536793873.txt

Filesize
63KB

MD5
2f15717dc1d8d1d99186a1a73bc16f85

SHA1
20f0b8d1f96a45c0918fe0aab2f1ec3f4becb0dc

SHA256
df7be5c36edd75799506df521389c4ee9bf380e5b7c8f45d3a092aa9f6e744b7

SHA512
1e263eef6e188539f9eb15b32c87aa5e59d62807bcf60121fc73d524a5c86d15ed54feec61e77d31cd99f71e38f661e1b61ea4ae70115dbe6bfa67e2fef18a33

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727666235612999.txt

Filesize
74KB

MD5
a5b3c6280aa607eb92d7bb24ee640e88

SHA1
4bd58cc48408f63d996f10a7320bf680787f2a9c

SHA256
e66ff7bbf645b183fdf5214c7ce563f50a73bd899e0a6589d7df2605360de481

SHA512
4096a44da722a04d167dd52484cc0476f4c738f8b3ab6fc5e27040dd9c135799bdc003054eeee6dbb8826a3e9547da43246cedafdd5c863acfef2969248a9323

Download Submit
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini

Filesize
170B

MD5
3938cdb1412511d57f710d0c7418e25b

SHA1
eee689b24d2a68ff85bbe54b46ea73113292b217

SHA256
35b0b4641dde988ca5c9e0af8f2a2da8ef03601b2903d8bef286bad3ee7da172

SHA512
5f079c85f345ef86db94457079ae6d380eefb01c25593b5ab8b851e9dec4d8e37688d20d4fba00b868ddb927f04bad99825c28793c7518cb0e658795bb168b5a

Download Submit
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\File Explorer.lnk

Filesize
407B

MD5
ae98c6669a38ac0480275c7179ff7f0a

SHA1
4072406aa813bd3b29cd755ab753628d3a5a6df2

SHA256
664738ac5f283612f3db39f3cd8b9fb2381a2583a60f62ce83e000d55a49282d

SHA512
a56b5a58531740ea0a18acc0d6a90977c7c65533f23c00bd76a9c646093287ba7aa48e210f20102a4650141b64947c6481a1891e7c03a1e7ec6d1ca4b22fcdc5

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg

Filesize
21KB

MD5
1f3e52c4412d3b6a9fb415fb9632c165

SHA1
312a6d5ddab8367abbb80dffc149d3a5e3cd01c6

SHA256
211aad2b13748c3b8c48bf0e236ad4d2d9724c21eb1076d3b4695429dba27da5

SHA512
57d4f32a30a3c16dca83ec059613ce59a462f079cbc4de500e15cdd8d8b8a38e303efee4d370c64db5595704a1e3486aac23bc3105e4c92fd7a041e7b0fdbd3b

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\HelpIcon_solid.gif

Filesize
1KB

MD5
2825432425e48f5c5b55dd97e2d229ac

SHA1
6d537ce43061272ff0fd72d53a271a3256628115

SHA256
52f39c5a7e6930eeaadb170da0a87bad3502a55e0fcb6ba2901c401cdd961a09

SHA512
5dff7b45061c8396cf42be0e31cc6776b49caed9da7d446d0c4d39b684fee8933a73c4c55b317decada7cd0553dd511fe00b3872dc2b362388d71c55d721643e

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\alert_lrg.gif

Filesize
952B

MD5
cf04e42c2cc3db1d142dd48af64cacf2

SHA1
6272f04b35363c601535e3495106a1ea272dfd55

SHA256
9ed0aec89378f373b1b9c5110fb1b38a414c7dc40dd02fd75cfcb7e45254a528

SHA512
ac622a65d408fe0175c80fb4edc0b8e7d6e865aac70f49b3875fa3581fb4a1b74a04e2789fd2c3ee59e4701b1549cf166a11f17ec1c72d5cc3d44db58ed0d0fe

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\aspx_file.gif

Filesize
121B

MD5
bc60d114ab69b8788b87dbbafc5f6ebf

SHA1
4b567a2ea842cc00af56e4b1f429b0fff35d2c07

SHA256
7bd64e2c1dff6019282bca56a03456ac11d508fe2d32b7fd8d624d40a90ee738

SHA512
2fd55da2a543702cdd05375b78f6585610bfa15af00e87a69348cd602128f8a095184d5224fdc64452348bc4ac03b483c69457176e0a1f6710496d46ae9e7fcc

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\branding_Full2.gif

Filesize
1KB

MD5
99f9d0030e47a83f31d3998b4e919dbf

SHA1
0d29e4e14a69f9335cfcc9f4cc94f686d10d4bb2

SHA256
f623acbcbb26d7a488c73165910d54fc6b163b500221fa24af188a5daf5aeae2

SHA512
c01eb73e72d67fcc25bd1b1b041cec03602ea5422a6dec0f6920cb8df364ef936dc67f405cb296f2132fe6daab521216c05d8fa1e32707bb1caad7a7abf5ded4

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg

Filesize
8KB

MD5
7a65c238286833e17fb19f59f405aec8

SHA1
82786fe5631d479d5f91c6c703cd6c09eb299abd

SHA256
7ab15364b36fb5f9b0bc69ed4a3f95c590393bafaa7ed3885ad195ad50092696

SHA512
ab9ff2e2d764e6a1b76ed3619a6d66e711f85f2c13dcfb21d40c7f65f263fba40eaa409c01a4f45141ca3d6c8b460a3787271884c5b543bb29864915344d71e6

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\folder.gif

Filesize
914B

MD5
628752b12e94a9a2944516400456073c

SHA1
019846577765124bab6399793e146aeb4fe7c657

SHA256
514d02c109c998b47fff16f8bc55f820af110a88681128f5a4e50be28a909ab5

SHA512
90bd1bfe391b6edbc285a79e9a1e8e7e39c1b69292ee7c50055be7585fb1c6a15c376749229414f624425cf8f045d17aadd2d3bd305f5e4000d886ea4d564683

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\headerGRADIENT_Tall.gif

Filesize
328B

MD5
7b8b4a4c6ef3098810e9f53c94b953ac

SHA1
d288eb27cc5e38a4924723e02d129d02dd77e2cb

SHA256
b347b62719f447da9deb41348c9d1c8b8859dab89b8fc3bd9e9497e7191092cb

SHA512
2d4719df60f9c401d2b6e717d6c4e5d2e56d23da00415cf349c5cb402996d837f20e3410d172f71f976fafa05087298291de0e366ced0725a1268cf304aa9510

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\help.jpg

Filesize
1KB

MD5
3243bc531694567e91480f7d47689498

SHA1
441154545279548df2ecf81e9b36ba5a1d1b898f

SHA256
d84fd53d237aed7defcace3214d75ddc1a821e332c2065fe2fa15d83d2489bb1

SHA512
c3c00953d0a60fcc8cff24e10029e144b2ae84b7ed04e193a6cde4afffc65b2198b5652f4263dd2e248de734c9baf017e33b0840a192d51da40fe5875e7ad386

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\image1.gif

Filesize
162B

MD5
2477f90c434a7367165e205d9fd3d701

SHA1
091a0ffa2f74bac9e441797982163720baf222a3

SHA256
909bbb8cb79b8c5adb7d63c99982087009be13662b892324135e3c5f044c2262

SHA512
3c994bec6c8c01e9f004c0604433abaae73746abe31704ff533def37a1f4ea653561201245ab00f2b065a16604dfed43d7e2477050b448eb75b03598ed0a55fd

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\image2.gif

Filesize
586B

MD5
cddc555114747e5f2f080994d436e109

SHA1
be7e258900e9da06c580e0b0c4a3b39732541e54

SHA256
cafe11c5afb15f60502d53cb190f5ca658addd19806d36a2eab37b7ff3e7d889

SHA512
f929eec7c467e1b565157b4d947d7f56a9b6327db8f5cbc74bf3d8b31245ec0ac10a9b195b7d6bef1fb9d04005c71f1117c181c62249c5a77e72000071d9344c

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\requiredBang.gif

Filesize
124B

MD5
af0111c83dcb6a61bb4831c64d9dd916

SHA1
cec1e1dc02a68ead72f4663e8d2f0ffa2be3df99

SHA256
3e571aae1837058d5c3d04e0cdaa190d3290316d688e1358d5dc11b536d0eb45

SHA512
28ad2cdf4cc7e3f84b0e3cab5b4149d75b19256ec481510900ce0b84c90b1c4b92a4a200b540e819ce1eba429cf0fd456d1fdd16220237f31434f01683a3a28e

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg

Filesize
8KB

MD5
29c9604b5bb68f647f4db1acace91744

SHA1
ac408c5186071653f5751197f9006a73055fee17

SHA256
ef2634e58550aed2e47e34616a3ee329efc23d453f9c4b4ff2170228819d0ad1

SHA512
ad2bdc291347117ad64f40ee82d547d7bba8c7b2be340de41ac85c4a31b42aefdca23b48c31ace6752b29c3c6fc4d11b779c775c5c809e4538cca9c08192c95c

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\yellowCORNER.gif

Filesize
880B

MD5
48ac56e3495792b6ef63f8815bf636f8

SHA1
eeb820d5678bdfd6878b9ad0bf1343d2dafd93aa

SHA256
e4fe0185f036950662fbb1151f8a60574a031253ee9c2b3449e23105bc5c5404

SHA512
8c499e72c7950167820dc6d354375c870f01a8cb6c50e4fe5ed07fb75f9952437b44611e5832312e6d42a4318a1285d1a766379e864ceaadc102cad275e3fa5e

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group1\1 - Desktop.lnk

Filesize
1KB

MD5
2661a4bf0c2a4a5bbc9cc87b057966ee

SHA1
2d4d58cbbe5620dce12f6ffc2c75f924ffe123de

SHA256
330e80f89c69321efc0b7c8d0df0babf8b27b7c7360a91c4bcd97676bf0938ea

SHA512
0db3104bd556761dc6ae24f58acae4c344368ccfb2268f9c3af122e3494608654408ed200d3587c502db6e37ce52c4f66a13977a3f8100cf68cedbdb80f0860f

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\1 - Run.lnk

Filesize
1KB

MD5
4a0dbd5ca1970b57ab6809dffde194a1

SHA1
f37e460e4b662cbb516bf1c43e9dedac92485b7d

SHA256
8c9c66bc7a79bda383f440120a38f65789bc6fbd69f740d538fc44c0ca1257de

SHA512
018d4ce67501f25df4bc251df4ca2fe80d78ee0cb499071e2ccfa5571de5c54ad30ab8fa621e09a1a62eda119b6176817b97b8f5cff1468b13a50368c9de74e0

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\2 - Search.lnk

Filesize
1KB

MD5
c8fe3fd54bef755f82a1c0fabd0377e7

SHA1
90233f0c39dbaf3a1a9183eb4c8ff23b90e10955

SHA256
d498774be03c6fd172983be7547deb72d242b93cec31bc6af85b354e05518519

SHA512
6dba584f641a7c28bf56cab2be322d02a6802fd7df2b53b33fc49918ab1d19b26750ac5960ba2d4e8d9e9a5a9c0c24bfe560524cb5093a8aab2b7d20f976ee3f

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\3 - Windows Explorer.lnk

Filesize
1KB

MD5
3ac1b1c577ec46ee869f1840fcab3fb0

SHA1
3e3983d7467b202d6a3c251f3d1ff3e62cc6f959

SHA256
04e5e03b0db473e03c5cc91f1f1feb2b1afd2a8f21604e541097b1af12913b8f

SHA512
cc14c31a3e52b16839a7536223d6dd479c3ffe5d423860a377e76f346e204f96a991e60af29410268522e74e45a6a012e5598a6b2d42c3c3000c8258eacb84dc

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\4 - Control Panel.lnk

Filesize
1KB

MD5
5f72c09b84612efa94c42bf20e3b37be

SHA1
8e7533b1a8fe95315a8118a43160bafa389b97f3

SHA256
a901517f8f882c7e3192d56d6f96a59ee1dced9a40d675cf4f5e73b5517cf0b2

SHA512
0f22b99e9467b7cd13ab8f2908bb12cb3edcdd99ad681847b3c3db3a7b531f1810ed79fb6e69b01df15f9d2e408150a453b3e77ea1969b0279b9b0e52365beec

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\5 - Task Manager.lnk

Filesize
1021B

MD5
02c99006df2d2d15896dc6d7a4a0425a

SHA1
4be173be6fbba6021a22300923a28adcb9104034

SHA256
72da111a940ad39799a548ea499a19d3e8e6af2f8cf78b15788c7ed2e01dcb79

SHA512
12799b361800b7bd3fce3024bada6a51788660b2308cc81d479e390558ea8f13d3375e54878c137b8ee5213e36a2d339e74a13021a1ece2a7c22b18957eb19bc

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini

Filesize
325B

MD5
370f32e2a80c18e33db826b7db216193

SHA1
e9f44f4e90696fe684fd2e66240fb9b2f33813d6

SHA256
fed47cd1732303c539312ef9a3fa12ea455ca2f656f944dbca24dfa9d5152947

SHA512
b5110c0a46de1ba09f00467c0f70af6a965c6cf591588798273c632a53c1d4fa936f47a609256697c7f19816b1dbd9575799922cadf877efb3c120d5eeab7b11

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\01 - Command Prompt.lnk

Filesize
1015B

MD5
9adb8f0762615a3d55138804b10f0811

SHA1
dcb518141afd16d4a83eb8c1fd34a1a7ccecbbff

SHA256
2d13af87da441dcbc91c8ca9164d9ec45d9478dbbaa2ed7fff852e6feae2717d

SHA512
c2de93ac18a9576036bfb00e08b6680c69ec19de5d81dceda440fdd07bdabb98a5841cff5ee57c7ce63b5e49c2e18232cf6248215f06e7537856a2538fd01c5f

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\01a - Windows PowerShell.lnk

Filesize
1KB

MD5
9dcbb1075a1fb77d5ee64f1a67cd58ae

SHA1
b7b7c9617837b2f5ba940ff8580472626a8a341e

SHA256
ee25dadc7745c95360e3753957a1beef1d4f21de9bfa61da80d7da80fc27705b

SHA512
2ddb3c09725137fd7f3b9a8691fe4cf3e7939dd87eb3899718dab1aea2e431dcb2e988ff1dd4c6b4863c07969c1e7e328b529f01513608bc322ac09ab462afaf

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\02 - Command Prompt.lnk

Filesize
1KB

MD5
41d6fabe2e4870ff6d1ffc4adaf83efa

SHA1
4c8b6f42f9728a71147cade6bcbe1b3c1d7e5a14

SHA256
4dddb52a1e444cf39d3f8282660567c2e504f3688d7eca7452867acf9e99273e

SHA512
2ff9d1088c3f456477aee091591f48858266be7858356a60ef05518acc0f7ee972038cb8a0029b0fcd37b0e2ecec259b80e1dbefc51e2f435348c794ed1ba838

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\02a - Windows PowerShell.lnk

Filesize
1KB

MD5
e7e0785c68f0eda272c025d7b954aa04

SHA1
83f031f857cc7c8234f420cc397e74477070d4c5

SHA256
2035440effcdbf27cca0f39b10816aff1d9da9a4eee4831af27f53cdaf787c56

SHA512
89860fe3ccc6d4ca69bb62c5460c2e46fda61a289116d33328a3ea4323908ff30fed3139cbfa4ebfd55233edf67d072f5023c92de982407a61659e8568bb75a8

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\03 - Computer Management.lnk

Filesize
1015B

MD5
c1bd7772dda1448aaebf4281951047fe

SHA1
d027c4656a4e7eb88ba9d127a9d312dbc2a516be

SHA256
91eefe7742a6c548acfb534d642e9fc21552db7d54ee70b4cafa1faf8affd84e

SHA512
c2e80e406d77363b2f4357ed56844b1f2c1984c605c113f41e65e004fc9c92ea5c0c1f41ca7b3bc5a732f7cfd7fecc8defd357656c8ec11962716b5eaf2c1b51

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\04 - Disk Management.lnk

Filesize
1015B

MD5
4f4c172987ddf76b6b16b5bf9dafdf55

SHA1
88b0fb6896a5dff9fd96d260c5c59217c4111495

SHA256
465ca6406fbc78d2e7985bfed33fc88d3710bc00aaf377ccd547bfc2c730c4b6

SHA512
358522753a7dbe4f67c5d0840c05dcab692baa19dc3cd06a787eb12e5d3d9f9a80cbfe4e3240b2ba0e8e67fc2a3ee37eb111122d6abda8447f5f987cb937cc65

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\04-1 - NetworkStatus.lnk

Filesize
1KB

MD5
6d01390815208f6291b7317de6376bd1

SHA1
6a0c44961d1a26f954d92d243ec1bd06ad4eb538

SHA256
089cf2ba1d890a5382b00efe09283805ec5b74d630a88998fcf45d4499766928

SHA512
cfe41265cf32b99f9b0a1f4ce450d3605234a25aaaeeb5ff92b72624228ec317dc64d519d5c07cdc015bab425a9ab9766a40564f2783ef67204abd093387abc9

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\05 - Device Manager.lnk

Filesize
1KB

MD5
edbbf6dbdb07bee194433324f0c495ef

SHA1
4dd2579164edc3190e8b200fe0999b0035269451

SHA256
a6fa13fad3cb719c825cb8778c89f90ca60474413d37ceac9fc1b5b5feead207

SHA512
c883b542c92d0430191b5d3e3bf6e68fa9c684f7b9b445883e936905fc0c08d2d304da40168791ebe3ab3d8984e41d3c72ad24249da339421eee70e069d5260f

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\06 - SystemAbout.lnk

Filesize
1KB

MD5
32d3e35259ee66cb23268454a20d1d80

SHA1
d6250ca5d10b917b31af30580e52fb23e70790c1

SHA256
4386f90e9ee35832c7db04d74a8991bb1ce4806dd5c59779a18b95f0592abf57

SHA512
bef89b47e27b6388a7250d16bafb10ae73649c7b553ef0550c44bff2df9fc770eb35b9bf8afba6bf113733ba55e4d1feb0751d61aa0cfa83e1a75647cec3e367

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\07 - Event Viewer.lnk

Filesize
1015B

MD5
d3678248a53da7530301ce725587b460

SHA1
5d78ea4845b0f0cb16564bed769b8f0e1e300720

SHA256
1fb0cefea4d79dcae06ed3466fb6d27b0e4ecc7f7551fddd6dd1a040917c1ed6

SHA512
06c90cce751b8288daa348480a3eb63ded657f7f49015a032420ae60df782d369611413d2b1d8ad3f08df1ce0a8c262aa1c7d9473e18512f8a394b0095bf1880

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\08 - PowerAndSleep.lnk

Filesize
1KB

MD5
e372c0f53b8144c37bbd7a1e810551e9

SHA1
2e5605df23344e161ab158a2dbe3c03978a33fa8

SHA256
212cb11458864e70305643c1137e342bfc049297a6af0def9e54004ab9b70d2b

SHA512
20d6bb9ab39779c6c7425335cd5f90b58aa83e8f79cd24505dd478b7fec163a442e419b43f9f8d36640dc0b60b6bc4e807dd2f6ca9ccb10999df6c4af97cb337

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\09 - Mobility Center.lnk

Filesize
1015B

MD5
ec607a70750f00fda1c5f8bbd92c36cb

SHA1
ddf2f21f4ee29e1f325a2984caa52f85a37db15b

SHA256
f1b4af1339a09529b546a97385965125e95a98c3a2f3a78972092a6c4d06e003

SHA512
82459ba35693b41a9a119c297875f05e07892532fbe55ac6cb8f1625e1b691232ba2bd7b2c1e2e8a4f99426d527bd1ec9bdb1a5e27a6254f360c6ea0b4383a54

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\10 - AppsAndFeatures.lnk

Filesize
1KB

MD5
0bf3328339765d173da4070743ebfad0

SHA1
203d4da43ad85d52a5c138127d39c6b40da7010c

SHA256
336d092004bb0800e4c56b50d66d8d44e4784dbd617ff403bd95d7026c822bea

SHA512
26a3f2fb4be3e89aa4961221f8b9820fb9b3972434985df7604e2f96bfd6204e75ea7b1b9c914f51b9ce6b47b65c1a6512a89d79db84ea1100ef5036bf589d25

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini

Filesize
941B

MD5
740502469eeabd8bd95b4d01dc1477d3

SHA1
195027a881223cba0fa38241f619a51b6d832872

SHA256
bb412f1fef907158c997d29c0d0c42c9822581a660e283412fb7f8cb11c75486

SHA512
9aa11a81cf6ca079b49c64813a8d09b81009478bba5350d1e2eb551314270734f5a402df153254f0445b8037e500e1fe5b95935bce7867bec5920bb33e09dbf5

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk

Filesize
352B

MD5
7c07ae1cd16f4b113ea4668c2e333eb4

SHA1
e94894b2d9126ef570c3649463e8dceb5acb8fc1

SHA256
0f1469dae520133cf16b242c71646088d3e807421c4c686fd44e73017b846bee

SHA512
5bc8dc4117b1db7ba8710eddc63d6fddd6877f2409fa5e2a8d78524a1e54800e08325ec74c577478760d31a4021651f685a2e84cd3eb9c7582543e0cabf2e02b

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk

Filesize
334B

MD5
e832971db5d1f88907f9e8f13bfca8b3

SHA1
74b0d39e41737d85e36ea233f1bbf96a8ffaaa4c

SHA256
a81bdcf6b4ce4e2d31c732684d114d61afb71947cc027dff4eb58ba96c69a0fa

SHA512
caab85a227e36baabe1234f60e55376a3090b0e6e9fd990205dcda2d173f56dd449531cbcad0f50e8e2abb48ac1629af0aea58f479a2d9f1cef61b9ccc51a4df

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

Filesize
148B

MD5
fe6043d6f1cced98639915bdf15440f5

SHA1
b61ecafbd4a48ac4c0da5fed017d184365c72b34

SHA256
593cb27471d818b2a6d6c4eeb71550932edc2decbcd7b662eeb424ad049e2ba4

SHA512
5580f874eb0a318a34770e9140a2c6f7202e68b6a4aa46b8de665405574b67ff1eda7ea77e3a34400c69aad598c30967dd197a9f7b95f2b7dfbdae538069d76e

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Magnify.lnk

Filesize
1KB

MD5
024e969c4207fa95aba5b540d5162b7f

SHA1
787a7c3f17bd1ced5f2fb9b9d2cd60161f8b3d45

SHA256
1d6a8d1fd7b3720f6a72bd9a50cd5271e0650b4ecab9e06caeea03bae5348327

SHA512
2c7615d7591e5cc47ad465c956d1c4cf8fb6dde8cd23d64d9b3d3486ee0d55e7209acec07cdf19b10f2079bc94b8670aa106b90a3ec57799ef4d69ad5e1d6737

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Narrator.lnk

Filesize
1KB

MD5
ea3c105303a0e8c0fe11938ecd668ffd

SHA1
c2b65d42790fb19c08f02fa1e103c6f34377ee63

SHA256
92610b219f224f8b4818bc3229b8f2973ab9e30f505ebc91541349a535880af6

SHA512
9b141174ea78cdb00359b6228099d6b3d5725e9b25c5516df6935a0bb958c23b68f381b701efba70c7ad938048ef7c39b03d46b876fa3b1005f90a2c6b979356

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\On-Screen Keyboard.lnk

Filesize
1KB

MD5
872b9ceb8c7b5d6206621f58070a7c71

SHA1
89b0313a316cf6a5b2f31d27fb9def845a817457

SHA256
dac852cfc1dc4c3487609e88591c07305dda1f0aa0e91f349c28d284fb1ec894

SHA512
2a470edd5c7b51152a5aded2db71bab51b8cab62e388a78ce328074fdef613918e810d4d444d29dffd61a277ffecf578d08168c3196f5f99ea26eed6364d30e5

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini

Filesize
568B

MD5
6ca6ca3d1349dd525d604ab126ee84b8

SHA1
603ab9dde5a5e58e6deb5657b31f60648e4def86

SHA256
cb00a9a3e01933240d5a7e34c1317bcd41ffbb623536b9ab40fd46eaea8bc007

SHA512
592f8ec80071828a4da03cc107b596a3cf52239b775bfc91d914b11b9e62918336efc20ecfbbf9cbb0e897e72c062f4db21195cd2df4e8268748a2bcfa3e2273

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Administrative Tools.lnk

Filesize
1KB

MD5
f7009e22e40ea968399173c92551cadb

SHA1
5eba37f879ff51fe5e5cd8920112ac29b375427f

SHA256
7422a701cc58bf29d90f51f78b39f699f95a91f63916d75b122029e51b76a791

SHA512
08948af6c1ed0ce557f7c1c75a42f788256b65f781478fcc4d994a24458c1a5873c2ac8362d6525b544ce4074283489051a6718ccf7c0bf5c145c6ef201a0d9e

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Command Prompt.lnk

Filesize
1KB

MD5
918c6fb78b83be65a0d37bd51f374a31

SHA1
8fc516511778914c7168605fd95834a1b864ca66

SHA256
4f04dd87ed963a9a50bbda4a6e58dcf70f8ec37733e6f854bf9848c5de09069d

SHA512
26053ee6c867f331b731662ebab7fa18bf1c19eeb451ed8d61ed9bfe945bdee9f0ff4f2c6125da05965236fd413712cddccb3b93cb40a1af6144358e00cf470c

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Control Panel.lnk

Filesize
405B

MD5
70c08027bf01f4901130e48ed79da034

SHA1
0a02676f16d019d16801a2633732a2928addcebd

SHA256
4396b81f88985ae7abf169c8ff397a24246869a9c8bd63db97488253199f6b99

SHA512
bd7c2e9a3a0f03b207d48b0ae78e1d2c7517a08518d84bbbceee1a8ecedc4b66855995ca856672818d60722c002a303932d56de5f3162ae31ad6ce35f04e5982

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini

Filesize
934B

MD5
214cedf84774ddcfb3b355fdb080f663

SHA1
2f9d1f08b976c5ef25e49a121626c9c2b79ae29a

SHA256
892a7bc5038044c10295fa8f036a4ad4ebf4e1fe3b146e7971330d2477eefc4b

SHA512
6b1aae3768adb038149fd3f611888b09b8dceff5112a5c5a66cb879050a4d8bbabf04de68b258c14f86248057dd56f2c275bfe0c824b08f41392b9c11c630c22

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Run.lnk

Filesize
409B

MD5
c8552259b96ff3191982637cec9c9c50

SHA1
1d8c7fe81b7de16a6fa3b2a389429c8630bdb723

SHA256
9fd906debfb277a2ca5775b23ed7f52df652d069c5de2bce4e2aecc4290ca459

SHA512
51c92c6f5cb95f5695588808beead5ad66f956b2dfe56d186d7761532b13e804a61dcfd26741a338f3d855a2f44d41430734ca20544ba7945cb2a41e4b2a18f8

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\computer.lnk

Filesize
335B

MD5
6aa0e4c694095706b75a62a8c4b6743c

SHA1
a30ab4094a4a2c9fc3aaf4dcd9ea417e78373900

SHA256
89ae0d8c6c5042b0fb89c7d25eac9c8b0b13df9a464ca5fe0da3e2b6104963ec

SHA512
36dc5ce3e820eddc3f14a0891d03b34a8d49b84161f578941c71e9cefda22606000d8aebea720cfd504b59fed39795a780e8aee81c1d912748f0c0b97a91e9ef

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell (x86).lnk

Filesize
2KB

MD5
9a744348662a254c63341bc17525883b

SHA1
8867c8a3c2174046153b1d3a01ffd1716d3be13c

SHA256
f6b2fe20c99f20706a3a5b31155f9ecf5835c46c52e813a292c9db72ac106192

SHA512
19f306661177658f9f2cc085013bddd04805d4943b658f98325e9c3940bc5a3a17f4b4e2abf470f86e76be02e8d8ff8771e58c51b76f5137d0519eff56f14965

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk

Filesize
2KB

MD5
915557046e75def9169fc6e7aedd374f

SHA1
3d4391cc4d5a2cb9db9ca889d1ad4b30a6690d82

SHA256
440c10c19f86859b3a22c778cf7a66c3837dc85890ecfd80eeb9c7fedd67045c

SHA512
07a204d3f783747d022e58777d05fcd558c0c70243982791cfec504bbceee8210b1ea5ea1a5454efed9e9964e5fd39d18a4f04fbf6b56e462684c32b859ce6ff

Download Submit
C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini

Filesize
558B

MD5
d41e249e968a3661453bfa6504361481

SHA1
6860a07b9a4a40ac20a95558a50ab5776d0d8d16

SHA256
8bf183c0db8af346496edf70d6f0672780de6a56b6b2f101c2baac2301bb2052

SHA512
75680dd6c45e2588cfd3883ee7dd23519b13195d77b2c914b6e7693336da79d8a53419107f6293c434fa0d58d97068a220a7199fefbc56008fdf4fdcf96c71f0

Download Submit
C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini

Filesize
218B

MD5
38a701733150b6e92c9b2c5a1fe31357

SHA1
12016818c65a6cdfcc5d881494618bd81fcdb825

SHA256
edec6461cc23336256c2bb68b5181b231e4c3ac9f71d0b6a6cc7b4076e2b2c2b

SHA512
0c080c2f3a1e8c04d9b64ad5ebbe37852fbd995d0cc25ea1e84fea8b36aebfd12af0d292dfe8d3870414663d2b3a15e3609c6edb103ced71bea8eb170e298f7c

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png

Filesize
296B

MD5
a437e30f8b400579c23105eac7291ab3

SHA1
783d4142fa5fd428ea2bfb5f35c864050f71b1e1

SHA256
06b2bc43ae35ab1826eb30b6c609b01a0de9c964679d968d0ee23d5d11fe8e01

SHA512
6df6fad0417185eb456eb25ae58e85bdd1a3522fd2f14b46adff4513835c7dd6cbe8f490b71cb5cfecfd36dde090778c636c80d4b6269f99f9e1618a543e3667

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_contrast-white.png

Filesize
276B

MD5
a6c97059bbbc7ed8b197d5d324f408b8

SHA1
71826bdbf16944232671c08b080a7e36bff49579

SHA256
4466b9be56c9ab8cf4c6ebf1beb1357300d3d761205ebad591a627b65bd08f5c

SHA512
49d1ecc16c26f5e9ba36932464b3ed3c37d33687a27adb8eb590d35fdfeb42ea57835fb7740f93ce3bb6997e876543e3535daaac34c95a58deb7d48983678cd4

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png

Filesize
296B

MD5
d7ad1f4312780bc565cb3df7c8e6a99b

SHA1
86b578a4d222b832e71829afec2218843cd364a8

SHA256
3e4893359e6730f9eeeff4bb04da73df95ce2990fd538d829035afe23d66a600

SHA512
f1e63645d7329dde1c55ef4164c556a239a856e963701c0c867694e7bebbc696ea3cf0d4ba302b0247b26459dec47c9d555c2d6f937860db8927d0c2f840dba3

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square44x44Logo.targetsize-44_contrast-white.png

Filesize
276B

MD5
aa12dec64672077eecfac1c777d08772

SHA1
5bb85b9bf2af0984078ebcdc341488c1918786ae

SHA256
42f6d5b25496222a515451edde231876ae1e36370db7534dc786c8c09d8dd69f

SHA512
809f56d3805dd4d3f90f0d7af40ffb9b6240b034e19cd143e19fa8b36b54e79c435b6396e31bfa0c6e737db810b1a97686eaaee2f231f2e47b56d01af0639e50

Download Submit
C:\Windows\WinSxS\wow64_microsoft-windows-onedrive-setup_31bf3856ad364e35_10.0.19041.1_none_e585f901f9ce93e6\OneDrive.lnk

Filesize
1KB

MD5
47a53f390b3b1c3bcd4d62f31150deae

SHA1
16db5d3514a6ad4bbbcbba6d82383f32835363b9

SHA256
2dbb47cc26bf010a1d56dce70568035db2833cdc775c4cfa17816d0f5b5aef32

SHA512
82ee10e26e7a0216ebf7f02cabe41aa1ad5ffd6257f3884671d4fdf2602951db501eac0aa8bffc4d670b69ed11147ccfd1749b130fbc77990912c337cfc21798

Download Submit
memory/2116-6542-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2116-0-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2116-20358-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads