7bb40acf3aadb46d5d7f7de1d2e8e81739aeb26c7bbe7c4248fa074e3d6f456a

Resubmissions

17/12/2024, 22:47

241217-2qskcasmcj 10

17/12/2024, 22:25

241217-2bx7aazqet 10

Analysis

max time kernel
94s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17/12/2024, 22:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
Size

12KB
MD5

f9154b290dc8fbf1bc82065d656b6590
SHA1

cca6c6b00d6072f08aad735cb559839f333fcb9a
SHA256

7bb40acf3aadb46d5d7f7de1d2e8e81739aeb26c7bbe7c4248fa074e3d6f456a
SHA512

62dbfb6cb8025fe80c47fc076964cd33592f7a1bed2094554522d46b1a7b04b03056343be59c0180543b0097735564e35fa306c0ef025f0d7434bda44a80e623
SSDEEP

192:5/TrG62a6B10k3g4fXk1iTV3HGc7EkpAqEjaGpsHcxUw4h+lfPtRMUsRgHMMC:5ebFNw4Pk1itKkpAjjJs6B40WUsRdP

Score

9^/10

discovery persistence ransomware spyware stealer

Malware Config

Signatures

Renames multiple (2175) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Drivers directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers\gmreadme.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ZFe6iILss4arp10.exe"	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Configuration\BaseRegistration\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Configuration\Registration\MSFT_FileDirectoryConfiguration\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmdcm6.inf_amd64_8b49cb79b258e1ab\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\sdflauncher.inf_amd64_1ea082c6cf8f6982\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\InstallShield\setupdir\0416\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Speech\Common\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsCodecsRaw.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmmc288.inf_amd64_3e3f05a8a446e75f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\tdibth.inf_amd64_e1022e6b4f7ab56d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\whyperkbd.inf_amd64_6c54f73a58d5fb2c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_RoleResource\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Schemas\PSMaml\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\usbxhci.inf_amd64_6e228bfaadb050c6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wvmbus.inf_amd64_a192dbf28b4634a7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_memory.inf_amd64_6fa9664593233d6e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netwlv64.inf_amd64_0b9818131664d91e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Speech_OneCore\Common\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_PackageResource\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_61883.inf_amd64_2c1769df23d261a5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\dc21x4vm.inf_amd64_3294fc34256dbb0e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\hidinterrupt.inf_amd64_eeb986311b3a5b16\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmgl001.inf_amd64_e09ac82d497a19c5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmsier.inf_amd64_3ae2ea3a55ec0279\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\sdbus.inf_amd64_55c0c78952233d0c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\InstallShield\setupdir\0019\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\fr\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Dism\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\lsi_sss.inf_amd64_503a2398f4c86893\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netr7364.inf_amd64_310ee0bc0af86ba3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\MsDtc\fr\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ArchiveResource\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_apo.inf_amd64_a261b6effa32e5a2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_mcx.inf_amd64_fcbcc3807cbf63ec\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmeric.inf_amd64_41ae7c84b8d94de0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Speech_OneCore\Common\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\spp\tokens\skus\csvlk-pack\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\MsDtc\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Configuration\Registration\MSFT_FileDirectoryConfiguration\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\b57nd60a.inf_amd64_77a731ab08be20a5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\net1yx64.inf_amd64_8604d8a50804b9c1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netserv.inf_amd64_73adce5afe861093\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\sti.inf_amd64_096c9e42fe4749d2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\InputMethod\JPN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AssignedAccess\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_sslaccel.inf_amd64_ed6849ad81a24c48\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmusrg.inf_amd64_bb7c44c7bb3664d0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Keywords\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DeliveryOptimization\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\hidvhf.inf_amd64_0a924aec7600dcde\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\net8185.inf_amd64_7a30f5a9441cd55b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\hidbatt.inf_amd64_a6fa9bcee39a694f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\nulhprs8.inf_amd64_e65ae5a38cb839e5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\InstallShield\setupdir\0010\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\SmbShare\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_smartcardreader.inf_amd64_33a0db63c0afb351\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\rawsilo.inf_amd64_1cbfddc97a663ba6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Printing_Admin_Scripts\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetTCPIP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_RoleResource\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WaitForAll\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\cht4vx64.inf_amd64_b03448ba0b72ec47\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\fdc.inf_amd64_7534987814b257b2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\pnpxinternetgatewaydevices.inf_amd64_82b90e51473d48ea\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\SplashScreen.scale-125_contrast-black.png	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Place\contrast-white\SmallTile.scale-200.png	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\s_close.png	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-GoogleCloudCacheMini.scale-125.png	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-48.png	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\edit-pdf-2x.png	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\deploy\splash_11-lic.gif	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\179.png	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PeopleAppList.targetsize-20_altform-unplated.png	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-20_altform-unplated.png	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteSectionMedTile.scale-100.png	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Exchange.scale-200.png	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarAppList.targetsize-64_altform-unplated.png	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-48_altform-unplated_contrast-white.png	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File opened for modification	C:\Program Files\7-Zip\Lang\br.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\legal\javafx\glib.md	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-64_contrast-black.png	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Lighting\Light\GlowInTheDark.png	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\LTR\contrast-white\SmallTile.scale-100.png	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\scanAppLogo.png	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\1033\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-black_scale-80.png	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_mixer\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\FlagToastQuickAction.scale-80.png	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-256_contrast-white.png	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientARMRefer_eula.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-80_contrast-white.png	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.contrast-white_targetsize-64.png	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-64_altform-lightunplated.png	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\TinyTile.scale-125_contrast-black.png	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-80_altform-lightunplated.png	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\GenericMailBadge.scale-150.png	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\MicrosoftAccount.scale-140.png	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\ScreenSketchSquare71x71Logo.scale-125_contrast-black.png	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Lighting\Dark\Studio.png	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\es-es\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteSectionGroupWideTile.scale-125.png	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PeopleAppList.targetsize-32_altform-lightunplated.png	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\icons_ie8.gif	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\NavigationIcons\nav_icons_myGames.targetsize-48.png	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File opened for modification	C:\Program Files\7-Zip\Lang\va.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\ErrorDot.png	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-256_altform-unplated_contrast-black.png	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarAppList.targetsize-30.png	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarAppList.targetsize-30_altform-unplated.png	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\nb-no\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\Office16\osfFPA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2018.826.98.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraSplashScreen.scale-200.png	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\LibrarySquare71x71Logo.scale-100_contrast-white.png	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\af-ZA\View3d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-white_scale-80.png	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\Weather_SplashScreen.scale-100.png	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\LargeTile.scale-100_contrast-white.png	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Place\contrast-white\SmallTile.scale-100.png	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\close_x.png	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ro-ro\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\VBA6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GetStartedWideTile.scale-200.png	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteAppList.targetsize-32.png	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-24_altform-unplated_contrast-black.png	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\GameBar_StoreLogo.scale-100.png	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\[email protected]	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\WinSxS\amd64_netfx-aspnet_webadmin_appcfg_res_b03f5f7f11d50a3a_10.0.19041.1_none_c82ed10fb371928b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\WinSxS\msil_system.servicemodel.web_31bf3856ad364e35_10.0.19041.1_none_e6b5a89fb2e3af16\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-kernelbase_31bf3856ad364e35_10.0.19041.207_none_0f7ca3ee47a2cf2a\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\Registration\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_acpitime.inf.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_a36ffc9394a80c05\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_hyperv-compute-gues..teservice.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_e799932c1d776709\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-gpio-class-extension_31bf3856ad364e35_10.0.19041.1_none_a1cbf947f3a46687\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-n..lprovider.resources_31bf3856ad364e35_10.0.19041.1_en-us_b2aac2063f02bbf3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CertificateServices.PKIClient.Cmdlets.Resources\v4.0_10.0.0.0_fr_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-hyper-v-m..t-clients.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_4663ac5f3efe2d8d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-f..pe-palatinolinotype_31bf3856ad364e35_10.0.19041.1_none_0594eac89ad92d44\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..-serverrdsh-license_31bf3856ad364e35_10.0.19041.1_none_5d5ebb89cb30b1ae\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-w..codec-dll.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_c253a41c298cb197\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File opened for modification	C:\Windows\SystemApps\microsoft.windows.narratorquickstart_8wekyb3d8bbwe\assets\NarratorUWPSquare44x44Logo.scale-125_contrast-black.png	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_image.inf.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_ce735da5c081daf0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-i..eprovider.resources_31bf3856ad364e35_10.0.19041.1_es-es_4bde1f67968c7cfd\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.19041.173_none_6486f23c2831aaf3\ScreenClipping\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-winsrv.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_2cdf3fcd95704082\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\assembly\GAC_MSIL\ReachFramework.Resources\3.0.0.0_es_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\SystemApps\Microsoft.AsyncTextService_8wekyb3d8bbwe\pris\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_windowsbase_31bf3856ad364e35_4.0.15805.110_none_07e9e16bec751b7f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\WinSxS\msil_microsoft.powershel..nsolehost.resources_31bf3856ad364e35_10.0.19041.1_it-it_42493c38cf2daa8d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-winml_31bf3856ad364e35_10.0.19041.1_none_2253ac6daf294389\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\05 - Device Manager.lnk	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_c_display.inf.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_e15896f8ce63e788\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-c..ners-dynamic-device_31bf3856ad364e35_10.0.19041.1_none_b4a7fb8b678481c6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.1266_none_777e4c5802d14c18\ProvisionedApplicationsWhite.png	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-wwanui.resources_31bf3856ad364e35_10.0.19041.1_es-es_c59838074a0d66e2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-i..ntrolpanel.appxmain_31bf3856ad364e35_10.0.19041.1_none_d0af17ec366548f3\logo.contrast-black_scale-125.png	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-wdi-adm_31bf3856ad364e35_10.0.19041.1_none_28b1f17166b79c28\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-d..me-eashared-coretip_31bf3856ad364e35_10.0.19041.844_none_6242879b1c08046f\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-wab-core.resources_31bf3856ad364e35_10.0.19041.1_de-de_c7acf1427c6c7d50\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\Boot\Resources\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..lerevocationmanager_31bf3856ad364e35_10.0.19041.264_none_f5644adbaccaa28c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_dual_vhdmp.inf_31bf3856ad364e35_10.0.19041.84_none_8673697827b26b83\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-p..riencehost.appxmain_31bf3856ad364e35_10.0.19041.1_none_97b0a47239f6db64\PeopleLogo.targetsize-16_altform-unplated.png	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\WinSxS\x86_microsoft-windows-smbserver-powershell_31bf3856ad364e35_10.0.19041.488_none_debd2e6a67bd337b\n\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Tpm.Commands.Resources\v4.0_10.0.0.0_fr_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_msgpiowin32.inf.resources_31bf3856ad364e35_10.0.19041.1_es-es_1de7daf91a0bb20d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\WinSxS\x86_dual_ntprint.inf_31bf3856ad364e35_10.0.19041.906_none_6723a46eefe53392\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-i..resolvermodalbinary_31bf3856ad364e35_10.0.19041.1_none_ff693493b3918866\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-m..enter-adm.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_36fb52842f1779e5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-p..riencehost.appxmain_31bf3856ad364e35_10.0.19041.423_none_bfcb7b02f95b1e52\PeopleLogo.targetsize-72_altform-unplated_contrast-white.png	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-vssapi-core_31bf3856ad364e35_10.0.19041.1_none_902ac89bbb265a11\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Net.WebSockets\v4.0_4.0.0.0__b03f5f7f11d50a3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Text.RegularExpressions\v4.0_4.0.0.0__b03f5f7f11d50a3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_bthmtpenum.inf.resources_31bf3856ad364e35_10.0.19041.1_en-us_6f195516ff1232bc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-f..cknotifications-adm_31bf3856ad364e35_10.0.19041.1_none_41bf6d8cc2a455b7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-d..sprovider.resources_31bf3856ad364e35_10.0.19041.1_de-de_c07157ba416c1d79\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-gdi32full_31bf3856ad364e35_10.0.19041.1110_none_cab79e1fdc701903\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_multipoint-wms.eventlogmsg_31bf3856ad364e35_10.0.19041.1_none_3b53422901fe40ce\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_netwns64.inf.resources_31bf3856ad364e35_10.0.19041.1_de-de_49daefa2efc6e8d2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFramework.Resources\3.0.0.0_it_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-d..2provider.resources_31bf3856ad364e35_10.0.19041.1_en-us_1a1a27236b6e0094\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-mfmp4srcsnk.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_00433ef9c06b3e44\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-web-app-host.resources_31bf3856ad364e35_10.0.19041.1_nl-nl_074a87cd8f8a98bc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_dual_mdmtexas.inf_31bf3856ad364e35_10.0.19041.1_none_01129eece4485f9a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-wmpeffects_31bf3856ad364e35_10.0.19041.1266_none_6e13bacd44a30951\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-t..eprovider.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_138d5ceeea4e7de1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-peerdist.resources_31bf3856ad364e35_10.0.19041.1_de-de_2819a2f1190537f2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-store-install-service_31bf3856ad364e35_10.0.19041.1151_none_52e4ebbd2e822673\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_system.workflow.runtime.resources_31bf3856ad364e35_4.0.15805.0_fr-fr_6e842d4892f4c3f7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\WinSxS\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.19041.1_en-gb_71cb809e11c85c15\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-com-base_31bf3856ad364e35_10.0.19041.264_none_ebcfd7598566d679\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\YPZEZHCHKRGLOLF\shell	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\YPZEZHCHKRGLOLF\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ZFe6iILss4arp10.exe"	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\YPZEZHCHKRGLOLF\ = "CRYPTED!"	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\YPZEZHCHKRGLOLF\DefaultIcon	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\YPZEZHCHKRGLOLF\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ZFe6iILss4arp10.exe,0"	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\YPZEZHCHKRGLOLF\shell\open\command	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\YPZEZHCHKRGLOLF\shell\open	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd\ = "YPZEZHCHKRGLOLF"	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\YPZEZHCHKRGLOLF	f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f9154b290dc8fbf1bc82065d656b6590_JaffaCakes118.exe"
1⤵
- Drops file in Drivers directory
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\aic_file_icons.png

Filesize
50KB

MD5
36b90fd670a37268dd56791e46d38346

SHA1
78608d8a4cb9322dcee61cf9d07e912b73f6bd72

SHA256
2d9ef8909cbc47277d2384604e8e181c3e4a5acfd84490a82e7518748a2b0122

SHA512
0ca84169cfe3794946d7b7a819d97355ef4effb554e8ec3432065006a71d09c71bcda6e1eaf94a600e9b6303ca49de5c8b8caf2b993f64a0731b6cc082893fb9

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions.png

Filesize
1KB

MD5
332b4e6099697e0f15d4fbf1ee1765a6

SHA1
e791e4e30492b9adc4fbc3591e6e163277140a68

SHA256
07d27ad6478a4135decdc48ce2796c2b5f85e00a26ea608d42144717682946fe

SHA512
01c59ae2a383b1b0dc1de65b45802b473615b448fcbd7029c9a3df98aa7d240f6e0d04cf33893080b30efdfbf956bc59bdc3364ac9afe6fe198e16b3748379c2

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions2x.png

Filesize
3KB

MD5
7cc335b575c185c1a874466f1b030629

SHA1
b72a90dc0f65cfc461c941986e16a8db3c17f971

SHA256
345e95b71e1b89c3a9324296163b261458bbe16ceab058898a179bc875691532

SHA512
23a749420f88f75514142587685a7949f6ea1db17caa31e9740e4a7a48b6ce4d0212c686bf7d2a149cf43efab0b485a7c2751afcba426128102ec561c3f31770

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons.png

Filesize
683B

MD5
34573194df0c2532a99c26463c8ee4dd

SHA1
e033634b30db1290062897345efd7c9a0092d82b

SHA256
beb3c9aa47956ce1fd3c315dd2109b3f7b3c909241ed426b7d6259511004c819

SHA512
afbc78f4de8ece0fe3503bff140fffcb8c09359fa5917047c382166adb6df1ad866cad8651afcf62e422e64aab4d363de2b27453cc1d803873a968a6cca4a0ed

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons2x.png

Filesize
1KB

MD5
c55ef7a9d35100f1ff5ca55ad1b9e44a

SHA1
02427288437be6d76fc0ce19030cdfb41874894c

SHA256
361c6bb42ee1e6264fa47f6db67dcd56d7596b4f1d2f721ecb4a244a0380c95f

SHA512
8ce88be676c0bd852a19b29cc2a5f30989946ff244fb85ec8e79bcffd6022ccf0fcfc83ca9eca73644ac73852b8a1e266f5047836db895ca69ce97de67e8fce4

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon.png

Filesize
445B

MD5
602de6346f89367dd95acd8bafa240ef

SHA1
2472f50448356ada10e7408da252b33b15188bb4

SHA256
82db2a496640b3961daa955cb9d29f354f9d7479b820face41a0de24200137dc

SHA512
013114fefc2098ae14c8518065419cd556b4b301026b54b6369776f3bc969fdefb9340948454b2b80d419bb5b0f21c7e675910f4d241cd059c446eae76e4567d

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_2x.png

Filesize
611B

MD5
3f47b99304b95baf195192645c5a9a5e

SHA1
d0ab1141bfdf1a59be884eae695b5b28897ffeb5

SHA256
c9364788b07a202989a95a424d846b2fc3ba35eb2bab9ee57b22cb641d1aaf33

SHA512
a3428bf7efebfb17f035d2018b5a84f859bea3a01b3c6589f29c2a6a723fa395efcce4e5eb81cb29bf6e7920dce9a67f7dbd19023f429024167212c18a654e93

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover.png

Filesize
388B

MD5
7ab37bd18f371341d33d6a92c9ceb584

SHA1
0d495a82d23726df3bd1901956200b36c50a4cef

SHA256
ce7e97f6aa1c44fbd5704d1fde5b91a0e1c73f2ec3caeff35c2c017700b22f8b

SHA512
6aac27113cda490576cd54f05176925bea0d3d8b044e87637bb2fd4ad11ce817ffe400848d9a78d4eddcafd8e6ba833239ba7b0773760c803eb5d2bb53335b9d

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover_2x.png

Filesize
552B

MD5
36a7043844ba97c5ee3b813b7d13f059

SHA1
b7cc7e61ef3c96c0b3ff6615ff4b9d03a4bc694b

SHA256
1adbc005b22aca8d0c07e4c0d5c48372d3bedf06ad05e6b8884d5348e75b4216

SHA512
2ca1c226458a2b1dbba9f4a25c87ace402b928ad65a249f0bcb5e7b59a3fed8bcc3beff45c2ed72b6174d975429dc9ef7fb8f8211e3ef2d9ec09794d41c7b253

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon.png

Filesize
388B

MD5
5fad40193ed62e2c3bbeab2f293bd44a

SHA1
af206aad24a9d8a236abce3952cf4b40d23845e0

SHA256
8fccd28360a23602454feac90f27c8d40f33324877bd634561808de3c889f1ec

SHA512
b338bba9a73851bb7fc07936382b34ff66e0ebc196df760277697fa8db0c861a9aed0a1649ef88276b8909700ddb75e37ed84726b9aa1f109ea613bf7f4634a5

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png

Filesize
552B

MD5
c7024bfc7752a9be648daa23b6999369

SHA1
166e3ad53ca140b0cc99f7e9305eb48279529fe5

SHA256
c638960c0d269d6d6b5f96e68b62748e101810d3d488286535a4952ff12cb957

SHA512
6d807f61372c76a0775e2d259c1c3fc6c7ac49b1e55a418883529cbe0523827c91395f0055ed2bf984e2a6fc9edbb14b6f0832f3dfbea93bdb1b5a3f869a1ba4

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png

Filesize
388B

MD5
41953f06642a46be4eff89af6d7709c1

SHA1
414a11c181c4e8dcafd87055e6b5094effaaa97a

SHA256
4faf34e3e9c37892e30ab3566660c871e629d02fb6d19a6168463e239d6f7c5c

SHA512
d22c936db890053274ccf145bf51836fb443a51cff7b0fa491c8f1a8f9e0a675a5f45610f2bc00455e0976ce95791682bddceea9a5e4d10c64553aa5fdedf06f

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover_2x.png

Filesize
552B

MD5
094fa1453fcccf3f82db59f41ad270e9

SHA1
767aed2ce1ac8a09a0b66ea7b8f8b961ace2e225

SHA256
aac834bc04c098e5a3c90b5774907428ba79b8d53070425fef0003b4ae8ba6e1

SHA512
13bd487e1df59a050304e632970839d1c1b751c9f99035118e3c36d236836173adb7400a72ad733499477f884b324c2107e5636270b5b804af38f7540fd63d3f

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons.png

Filesize
7KB

MD5
9e6a75ceb25e769241dca25c1aafec06

SHA1
993f1bfae2012af178661f06042d552fcb108292

SHA256
6bb050daa1e280ba5379c38c0a469e81234446fb6e8f9ba4138652a73c1b19ac

SHA512
f50457425e93a27aa8f784af9fc6be458d245a09743ced5133a063b28f2c3966cd4e70dccb7379a6482442878f55514f6dba8d74ea7899d2a0f4b01ff2df85cf

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_ie8.gif

Filesize
7KB

MD5
1eb40ee15857031893332bde5b321ca1

SHA1
28f9de1f121640eebd91c4c85247845892396134

SHA256
497a4dc4fd6e521a8acb06281fa6d12ad3289370fb8b9734ba859ec2be2c5a20

SHA512
d049f6a257678b0a8981d50b32ea14e3e36e6b910936100a2a733817e9926c2c91c853937ca3fad647726d9e93fd312ac175ffb45b74d54780169ae78308bf4a

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_retina.png

Filesize
15KB

MD5
5fbe3682479c61a68432aced4c19473b

SHA1
e915d98fe6519e42714535cfc74f79e640fb509e

SHA256
5a2d205f9fe6090c0b61d4f43dadca98253862c12d677283e910cdafd334743f

SHA512
c6b012543f2456ac5b4ce02fc7aa842b3feeb77b7e61b709fee918aa28c975afe9cb5f4a96d9d877ea72df13a53a552ffc30584397faf97ccbc7ad6f10b1d499

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons.png

Filesize
8KB

MD5
940570f444a7f3bfbc0dd3b0cd599178

SHA1
8d759bf2610f4d0235a7fff607a2ce0e7b7d2d2a

SHA256
2b67231c0b66d3dc927adda6a3c140d2c4915385a9685a2dc3f50fd6d7af3400

SHA512
e0ff2665135eebfc5f67ee41b71024e54c817e507ec6d6d16926a2fcf380f5aa36c3fb20c7c83d947d0764f4f9159aba25074ede7a6cc205b53d4badc1be14e1

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons_retina.png

Filesize
17KB

MD5
4b7fd0053c3c1a5f1c70d3e84a2c8b71

SHA1
bfa9dad0cacdd792b441b59d7689cd44f36e953f

SHA256
d1b2e64252ecdcadbe496ecb5033221760a5e1733da87eb39ff6f02ca322c92d

SHA512
dbaf766764b6eba59797b7277facb367cba593164f213d7ea8eca14d24f8e34c782277dba90b9e2735e3262037b44bc62bd075a11e5b1eac2785c716ef0f2736

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_pattern_RHP.png

Filesize
179B

MD5
11c93755a282e0b4970a57f274038070

SHA1
fb2a0eb7c973771bf54e82f6bc1e54c59e5ef532

SHA256
9e9c08ddf0b80a686948210a898d09c697a32c8cb49b78ee7eb10a230e212a88

SHA512
ee79cbc93dbd19ea4aacb4add45b2b0685a3c7f84c5b6e7956e6424b572d6e154681ac86644836e66d9f8b15c65f407912bf41349200c5340ff4c15906922ef2

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_patterns_header.png

Filesize
703B

MD5
c2f38e3c9632d6d8c00688ac6594ffde

SHA1
6237bcc17b2f44727ae662eba5adc981caefdbf3

SHA256
88cd909d5f4f6ec249318a8adf7f27dcb590ecd109b1a6aa76291140569fad77

SHA512
bbc7644278f3539ff65ad2aeec7a22083ab0f4f96f302835f21ed41131f6c22d3371228de2eb2096e438ab10641709595a7760c714ea88ffeb9ad859ecae18ed

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations.png

Filesize
8KB

MD5
b29f2127db70d8a0e358f5b3eee13775

SHA1
5f5b8c98ca347e0a740aa564bdad051c373376a5

SHA256
beaeb14e5335a534dbef9b5cdeba7bd74936e3823aa95b6a822c9a1ebf194ba4

SHA512
4970e798d7f2df97a4100742c9cbc1d4e4ff3ce6c8d9501bb33af3a417351566d6ac0ec46efba25883ee9cea3073a1b500152e3dc2005c5d7b51b57ffbe01dc4

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations_retina.png

Filesize
19KB

MD5
75382d48a1db3aff4539e81c447d7ece

SHA1
1c26178099ad1ebded6f0488433c0f6cf95d857c

SHA256
36e18bce5d77838d0479fba1479a1545c98bc442d6daa7d20b2d26a64005e55d

SHA512
a21bd5ccb499b8bd1744c8237d4927d4af0c5dd3aa10b1c66692b1578f47839f27b546974e0c8cf0190eda320c6e0a445879382cc23d53e2ebc60ebb298c6ef1

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\faf_icons.png

Filesize
6KB

MD5
82ae16f886d7ee6ff5584f49f060e99b

SHA1
47e5efa64b8ce7903cad2ba0933a194b142537cb

SHA256
fbe3a73b5d8c4a485eaf1358256f7c13f564e880859164437e451344573a6731

SHA512
6464d9efbbe8fcd67726713048a3f00710e9b14c62e2481e933169eb99e711340b0c4f88260ecc2d17fbef3625fcc1d715b1c52ea94a4a49aac1bf35e2f21689

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\bun.png

Filesize
2KB

MD5
d54b09c7676f5414697950e07c314d5b

SHA1
1133283baa9dd7e8b1d124bc4f00572e5f914e70

SHA256
0a8b2769a44947be0b745f592d2234ce0d0e19f0ca94503540eb9d15c011419f

SHA512
b6c92f2036cfda3a2b56f49dc52de778ef45ec634fcbd57b647c7ef3808d2323e2df706504b21927a8c0d56fad0caf4c4d9a04c9acfa310280be82118966da0c

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview.png

Filesize
2KB

MD5
dcdb7105f587fc2052f3c61f75e1e036

SHA1
09dda7e7303a96877ba6c85cbe0445c37476c8f9

SHA256
00c83f6abd8d19c03c7cc25490ad69118d492fd6a3f42eeb3ff0fe3621e4e026

SHA512
7d146644ada3fc2ae044512c17585884054fb4bd5ca351d8c2cebf6e0793f439e35dfc9ce89b7153f199a1600e7ce259563bf893f2eff972e309ebd4333ec50b

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview2x.png

Filesize
4KB

MD5
eb105a0d83e3acd385d2adc87dbabddf

SHA1
8a7a3f6e3fb53d8c51928e40714b084ace96d342

SHA256
aab6870c238d07a45028060f10d46ff983d17f515712f7377ee131d92e4f1e8a

SHA512
adf51d657c01b6089532412f6c600020978c59c5aa25de9b1b62b162548f57455bdc3f278b45024060be6994bb43fcd4eb6a62e1cba11b9cfe58e2c5daa9e0cf

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small.png

Filesize
289B

MD5
da01fa8f16c10e3899b2d7186cf4beea

SHA1
0e57afc04fe710dba97d1ff8275192a6a18fc63f

SHA256
b54ebc801ed0f98875e18cef6023ddd04aacd076f6bd960b2566c05c4e03fce6

SHA512
190820a7b0bf3f92892b3f141dcacb0cb775338f74c0611468a726060b784a5c46c1c25ad389c79af4448a0d09391faa5fb94ba8933878b3b6a9efb4968e64f0

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small2x.png

Filesize
385B

MD5
b82654978c5bf37a35a5e5670239862b

SHA1
9d7e16083990e0f0bb6a63ca1d3dee011cdb079f

SHA256
d82fc58f2fa7101c1f399a5639c9cf68a22761692bbfae3c2eb5f63c252f9ae0

SHA512
b13b432c0ce99cdc6a1caa6f70fceca42e8f2dd39f68e88f34f4657e9b4fc14f3a11c6c1a0344a389819cea7397981c7653a258ff5d8b9bccd5eed81d15a8dd5

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\illustrations.png

Filesize
4KB

MD5
20198f5b357a343e803dd260c7dba12e

SHA1
80c1eb81b254cdbba554a3b7d4aa65cbee8ed641

SHA256
d729160342de8127cc00966b73545f8534ff5a2c7d51c723222e342196828173

SHA512
73937d400d74592b1593c78f20504a417fb9134838733a79e086262cac7c5824a745ef254390af94b0e9182277eb172c7454e656e663e1951f8955c6176c3613

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\nub.png

Filesize
1003B

MD5
62b6a146d9b7bf4095c735c785157f05

SHA1
7ddd10e655a4c45db5044fa51dc112829a16c436

SHA256
777bad6fb5ddd584c936c5971df15c10d7389ac9807662472f57b5688853fcf3

SHA512
75ae16d0d24f339f982b339f8a77b95208cc5cbcd48a85cbb8a6ef1ce20f6a350cebf7665a870f8e3e86d28bbc1696a9ef7eacf7096097f932f2155698ffba48

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons.png

Filesize
1KB

MD5
57dd9d7d1d3028bb933f633371564808

SHA1
a62ded08af19658bd174d91401d2fd1acd98b210

SHA256
5b87e4d57630234aa0d5bfad9d598ed5af143099e06b38859ce73810cbd5974f

SHA512
ac6150e4bfc37616b2b99e52b991b461f61f7de355b361cfc68082960d20f2bc27153e2fabf18c3d6a84622f992129fb8df9d15ec899d2683129596748d57e13

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons2x.png

Filesize
2KB

MD5
064e2b3a84a343339633dd4b52b75a96

SHA1
beb48b558ad26d8dab8553446a9f2ea86e2c1d30

SHA256
fa7bdcacb9008b04a75a2bcc2f33133eddb42d117496fa50920f3c8d274ae887

SHA512
aeb88d9e4f7ca7af5a795e7cf67ad49f22fdbf78290a68ed0365e5acad269f6af00a3dbf2476d27823e2fb66745abb0d988d170566e1ddd1edd2e530592150b5

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adc_logo.png

Filesize
3KB

MD5
c75267e7398642f856adc09abd6f217a

SHA1
e8f23061db84cd1293c0b5d982e8bccf7aa09bf7

SHA256
900efaa690c63abef3b4208e5a28abaeb693579c6fc7ef92e6bca1abd091c0b6

SHA512
de4cb9e3df8206dafba126b0db6778e388ac89c1f78f0d573cf1642862c9d820aa038c2b17fd3e5a2da62201bf32f6ae28c29e91a248f8648e9aac6f90024bfd

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adobe_spinner.gif

Filesize
556B

MD5
494c87253ba70e2c0404b4aae45bc1c4

SHA1
b715023eddfe69ec246a9e59f413d66ea44fbef2

SHA256
08146e5067bc3b27871fbd9be456cd25559f2d24909d13f478ffcb56e5908a40

SHA512
81d875cfe28b9dc310c933935c4606267d5e4872e1b2da69f9a34782e9662475c336f69ed8feca2a8a0df9b459bc848f6c13a8ab7bfda84c39c273eced523b24

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\logo_retina.png

Filesize
6KB

MD5
8b506db85f57b3c80cb61ea24ca7359e

SHA1
5ba1e4c608a33776cb3134193cba0e40e1428f51

SHA256
f18e5d31b9f1d482624a99dcfc059773472be7f538452ffeadc80ea1e4963e8d

SHA512
830a3aab0c0b51bc2fe62dbbc84d743ee871f990e408237123b5122f689f553e5f560e56bdeeea05afee1c19f869ea0fd68b9d932a893e57573007580ac0495b

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo.png

Filesize
826B

MD5
69d718171a7ed18c322b1f216b9519b4

SHA1
fa11b564e2f019e79a83dc34a0b5a47d515186e7

SHA256
441e24de0e9a1d2f9a218dabc5148ca8877b2fe1de5798a6befa2b6a15bd0f23

SHA512
be23705e873acacd360d21ec19701a25b6256046cfe4a199bc56f3283e3b9724f19677207f2dc95d12bb0480c2ebb044b303cf079354d71f6c928998c4ba6e40

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo_2x.png

Filesize
1KB

MD5
54c54292e3675e69991ef84b8406e83e

SHA1
4456ae8230eef9feabd400eb1a76768920f34035

SHA256
fc0589f66ae95d0b3c813527fc59dda5b0e556007ee088a4f903cf22270a0912

SHA512
587d2dc82d7af40d839769943af51b530e4ef047701398e23b785ab83b469427bacf6e99ac7c2195bbf837a6ca6512ec2c62fce43592382c677f6e04fff104fd

Download Submit
C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB_EURO.txt

Filesize
32KB

MD5
ebd1c196536bfe3887b557555a010f62

SHA1
13e8d9d3220d4ed11c440e4f51ed087116ce5d2b

SHA256
fb6b648998d3480f4aeb824eafd1567b19c3e371178e3a0be598162f24a02400

SHA512
d6f5944d825792cbf59571f18580e558dd4a9b80437d5061d00cba2a74d6c6982ce9e3978a18a71f60b3e4a036f0b7d2f890d1b2c6bd67576b31df155e1342c2

Download Submit
C:\Program Files\7-Zip\Lang\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt

Filesize
282B

MD5
69a98ef655778f1cb3764a923acbae80

SHA1
22683321e95c9a631039d15fc49ac5d3e639ac54

SHA256
2ff127d5bc4c7333c8f522aa4b456684eca97c06d452bf7d00b6a99b49b11b0e

SHA512
610fc09f40124e1a74ff303ddd95ad5809679be9e0c381e5d367ecf8e1e137c3da188142de7a2c5fe2b1225e12482245f2b5c417d43d73618108bfb1c32a5ed2

Download Submit
C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif

Filesize
153B

MD5
2d0553cc205a3841d14e2c7efb3aaa3e

SHA1
3d98712d43a0e2aa9f02f6e5ec7850811fa34f20

SHA256
b333f3e18552ab51d04b51c76d3bca70e67628be2225aa60bb72d90d4e417f9e

SHA512
4c8447ace4b8a5c1cea65d57341b299e096861ccc58041659c936a6c3e855198c9211e6f5b223bbecde48726317bbd4c43e0042be5669f288c9117263e4f94f5

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt

Filesize
190B

MD5
3d905302ea67d022b5764b8d75f230fd

SHA1
8f3afea0105e00548ca6b9231e80810c4836ec26

SHA256
7f6bddd2725492ffe92377874e4b46a4dae0a4d0ef4af1c079186f0a93104865

SHA512
8ca5624d212dcafa41152b1d9dc2ee3786e9c6715329a5a5fea50604d3180ffdd31f2955d317dd9827285a5e9aa6ef8f8210fc248ac04b3beb059124a8a57cfb

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt

Filesize
190B

MD5
0ecefbcc34cd8f1b0505aceb597075d6

SHA1
dff5549c90cfbae7f326cd1edfe98b4fec0b0f09

SHA256
8dd8f178fec70847b4d54a18709293d85d7b35d24f250a91a4bb3e9ebf6fa4a7

SHA512
0d5af9db30f799033c72e73a3e61a44278d3fb4df00840354786ef3de3ceb9d462a11590131fd435aa4f091046c1042206494aa76838dc4584e86d7eb9b08c24

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md

Filesize
1KB

MD5
19db38b108dccbb6d9d510c7d29c8a8a

SHA1
e9987ca5ef36de9aac7bd58e59db4b57a2b6bf2f

SHA256
b433e3610dcd692354453c05a28791df5c7884ce3372b64c2dd530cfa2627c4f

SHA512
0deb2710e09d88108f3551ffe16efe259c4674b232b1c9bae8dbc788a0d10226a112d279d052286dda15ef83aec622e5c3a4e2f976da4b495742d05c44940f7c

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\glib.md

Filesize
31KB

MD5
80db70c2780e57be05cd1695a888f118

SHA1
53276e6cdbc6c3d099b355a6eb94b173ea90e2ad

SHA256
5dbfd887288023047d3b1178254f4b79594ddef895d2c02cabd9db7a6a01132c

SHA512
39e95a499073c8478bd4da89f50efa503993f58853b4d1ef2ce292cacf0fa471e90a363ee3e4e4512f7e277a3386531cfbccc7c4185c6703ac3acb2f77273734

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md

Filesize
34KB

MD5
c874e92e488e899796846649a23475ee

SHA1
e317dedf93d30a598a53b8e4a70692ad7b864483

SHA256
c8ba848757e692345f8494787b7031c97cbfed6fe6306d9d5edad166888d16d5

SHA512
f95f9e3b892301c8355dad6c13235bc19d7c37c020005a91aec35de6be89d4fa212d799d86ba0896b080b4a8b48536f41df25cf64b4423317d3e55bdb39e2318

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md

Filesize
23KB

MD5
88da11b7568f072800ac8dcd9accd251

SHA1
fe1f1fd183fd0b0fddc25b831bb7d23ae3331bf0

SHA256
6b2bb35ff6dd6c80ebf2bf84d62180f5bf113778eaa72bc5ee9d3f4817d0071d

SHA512
253412746282953d2735f5924a9a988ee7d6c815557d5cafe47f022253fa4f9bf6e17a972f1c35bdb52862fa010c67e316fbf4d45212f7ae498819b2acff8a3c

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md

Filesize
2KB

MD5
baa89f44d4257fd74fe7019544c3e52c

SHA1
dcf8234435257dd407ec124f96a7c25ad1c097a9

SHA256
8cc23704e40c80f3b0a66f24e27d77250d5c289c988277446e8aa1ec4545e0e0

SHA512
f634ae23e4812f2b6531189045c5de3904ab87939fc100181bd2507fd4fde9120e47902b702ff7780319c51ead7335b2347dab6194b4dc5d8a33115b4c173394

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md

Filesize
1KB

MD5
9eca3c9f4ccc936184d0f5a2939106ff

SHA1
8fa8504d6c3437fb6acb4f2031a59efbb33e737d

SHA256
6ff9e6fdac978ad4359f1ffc6aad194098e5f63d51338c62ca24590ccb4c30d1

SHA512
2932909503eb29bfbaeeecedbf3f338588005416c62603e44c9e7dbaef981efcdb3608fea06e019548008169ca777912711f67b4ab14bf503ff0eba68843356e

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md

Filesize
3KB

MD5
8121220eae9e227baf1e6a8e85c35930

SHA1
1a3eeb9c3863d904958dae0656109618fce7c33c

SHA256
e6b8b2dfffe1fd10e6587c565711c9857a7071abd659d4db16df534462ee888a

SHA512
9fceb06121fe0a628b183087d44bfe7575e28c6683a5ba153cf1562f3676f493ce1899e730f1fbfc49e9bdc507a2f18b985514a99a6da96b47ab7641d9762bbe

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md

Filesize
2KB

MD5
9d9475bdf1af288fd139ce28b108c87a

SHA1
c86192f8663738f8aeb94138393a5d2a207dabc7

SHA256
8bcce0799ee8269f83538c8eb53c37c8b469603fca640248a4304d5758fe160f

SHA512
e8fd75c810994b6536d68cc3bc2407d74cee693dc6ade8cd0ce4e8ecbea74dc84f67c4e67f469622ceb6a7cc118f1b13b30986d0370ee0dc2fd4801fe9b93dc3

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md

Filesize
5KB

MD5
53168f2d8d7855ee3eb535fd4c833c74

SHA1
5cca8df1813600d4cdac5ac9c4b742504c2df096

SHA256
4b4feb08b1dd183ebea84250b4910712827d5eece431eddd39566aac40d4517e

SHA512
e494c51f60cdfc3b373866f25db045b5bf54cc463a8b9d0becda7bf3a54db628323817bdbeb3c9ca1d8e6ebb9ccf4537d60a90b4c222ab878c98f8feb444201b

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\public_suffix.md

Filesize
17KB

MD5
c969d16e913ae2017ea8c65844ad2e13

SHA1
c83db12f8441cd72a67a63ac88fe51a350aa43b1

SHA256
3cdb8c1c4cdb7978710eff7cde5b36baad9f5415c228a3827a22ac881bc4eba0

SHA512
dd830b330e766e530bf1916bf4b9142f53c2196d6f33608004d7c0b8dbd4b28e242a91be4be558694df29b4eedc853703df661bd4c541e2861363874caccbaeb

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md

Filesize
320KB

MD5
004de628e9c2caddc9f1a43fd1c28640

SHA1
8fe9f17dc73be10ad5e4c9661e0f0577afb05162

SHA256
a1b475df46c25bd9dd82de1573ea26ba8b623652c5175254ffc0564e445aefe8

SHA512
199ea79a69e5d5d19d3a280d5319df11084e288ab571fc6feae40ad5019d120c8490173e68678e6fba6fe67778b8ccc2c51949512c3d7b9f626f83dece8a1145

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\asm.md

Filesize
1KB

MD5
740f75e77c55f17845b7a008f78c9b75

SHA1
734003f6b1e1493eebd4f7552c96e4b01017e1bd

SHA256
9b737aa7599c14f1ff663515e9e527b1f37203e3a43d1817c5f88fa102e62067

SHA512
d771b0d7fda3fcef1a2e94ce5089bb2148ef7bfb6c70a3b7b30ccb19211f805eb076813a5db2abca1af865a85d8a1abde052ec16997dc67a063f6dd1a4ec84aa

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md

Filesize
10KB

MD5
83178561e229867f51ae8aeb03bdd6fd

SHA1
393127651e7395e5c15ca33ee1defe6c2c6870d5

SHA256
da9a10331da54ec3a2dc4655ea97ec0e580a58a591fce2903fd2714ef8447831

SHA512
f1a1c69d572194af68f1b6ede047dc3275eaaa4b48a36c43dae3a65e1d248f2bc9dca09a69aff219219a24666470d843331e26bdd7e82d92246838b5fcf9a462

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md

Filesize
3KB

MD5
5f88c2d0d5ff4389bf21fe3994969447

SHA1
9c31623168b84a373d946e4e7b56a8dbf3bfd653

SHA256
88950ce17423b3d72d4fa4d0a158f7f9e08fe1b31c25a9eaec6739ca9f600aa5

SHA512
08f5f90aba807b13c76b3befb49d0e9036814fe1054f56acfbeea226592452796c7e100956258210457bd31250fc6c69796e56616dabdc9c5b0d011d9ff3d1d5

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md

Filesize
162B

MD5
ae5f3981f3fca920e5ea8adb51017d18

SHA1
48a517f127ab1009bcf0385487470ddf847e17a5

SHA256
8f55c8c83434d987f83326122954736c6fae360cc2fe8a36af0ca893ca3f680c

SHA512
86861692d48116bf3aabb49bff1789f7365d17e8d8d4321d0b8a2e5bee3bf313e267c43a85d35aba97f32839e66c50ae7ea22c47b2d3764abacf67ad3deb5ba2

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md

Filesize
1KB

MD5
116bb1949a88e5242c36189bba423a35

SHA1
3a39cb5fbaba6172bcdbf0e02cdc0f9caf248424

SHA256
20a59266b2bc4d1ac637371e1bfbb4ff3997be5aab6f1b64a65ecf32215f8523

SHA512
59310e14db503c398925aaa27a7f4dfc6eb61c0d042d15f29f1556165dc4f48c5bf33e2e11ffd0ab101d80376db5afd0792417ff717a9c659b3acf3fca5a5224

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\dom.md

Filesize
3KB

MD5
2008793f99a02841b98d88cb7c60f1ca

SHA1
2b2e5193e8356d7748d9ba32803f58b2ed75e711

SHA256
cffa6e42c3b099551bd0fe76832ad5aae8e3f277a091ed89a319a93839eb393b

SHA512
ac0af0e827582e3b250b47f5f2d5f4461358d488261f4ec414f422836e98c5aad79826716c74fa2c1f499f61aa5ff3acaab08b630c2082cc9584545b8a1ad08d

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md

Filesize
1KB

MD5
862a9c85a5013d38836cd621a03396fd

SHA1
1195cff3b1b134508b8b4328a7d780d6246ecd21

SHA256
9d7816a4bb37abfd387b58368b98385420669f7951ad6724d4d25d433437e05f

SHA512
3b28c1dc8ec4c360306d70e57d7c57a3d0b29b274b07ee58a4da30ca740e7c226a9b5dc411812da9742b69336d36ea25ed9d66dd8b09638064ca82bbe97d47a4

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md

Filesize
28KB

MD5
738319f31238fd8b43772e5b27539c15

SHA1
3b842136db0cfa34aaf5006074df4b655844fc85

SHA256
d647c1a4d9582efd81d08607802a3591b077e51160cd1b9ffd51e10b442023e9

SHA512
c2d527aac22285756830d1580406c38b9c0ccbdb6bb7b5281040aeb0c2bde6ebe910e6cef41c8f2a8c97c2c124246fb47f1357aac9f22bef31f2c6b8391165b9

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md

Filesize
2KB

MD5
4e22b7dda036ce0d93540fb6a239f2f5

SHA1
99391f59bd03786fbc52776f6eb5d2248289d12f

SHA256
d71e8685f83477aab5d7a15cd77e8c86012256099c7a2ca79069d246fbcfca71

SHA512
11ac5cee8c6408c6d04bfd5d825376f4b0bb9ea560346c99fbb9fe85993cb6eebfc4aa7b3001dffd3fa78bbdbcd2f8667ca199932e0055d13094f62a7134b8de

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md

Filesize
1KB

MD5
23c3feb32ca009c0b7cea4de35fe5656

SHA1
ced16a4e1c925aabb4b6e3e80ba8e72cd12ddfc8

SHA256
9176cd592320a88755111fa21d75d40847be530518271d693eb52ce2dfc2b726

SHA512
933e8eab12ad6b12c7e3fa81c07e0b7aea5df3bd9cc3205f64dcf6b344c4af0e2039cbc83be2a7f631277ae700de56938a357fba3b707d2519f06c25ec9f8384

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\icu.md

Filesize
2KB

MD5
ad7f67cb947fbf68116c94c292878e72

SHA1
5a444b23e9906092b99455a53a4680a0ec50dd30

SHA256
c55de34d46050bd1804c16ca627ecb4743d41fe0e0cc1152caaf91e3f0748319

SHA512
940553d9d958e4607eaa6e2b4b2b78a5f121fd0d9c9bd917c237fa1efd8052d8bdda746442d8f6b7109cac5328a0cf6b41f2797c26cd2a099773029cce6816c9

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md

Filesize
1KB

MD5
b7e7fc17c8fffc366d531b50e2d03b73

SHA1
7b084336be4c505d3b70da3848272eef87d7e674

SHA256
3f5bebfbed797f19921f7f3774238b93fc49e8ea1de7e6382a724460332907b9

SHA512
83ead4c0c3fb891f58133597fb5b27375bbad110bcce69f2f5b5d877f92ba41f8c87740464ec3b8197fd3ec4b5333c7dc57267755abca374d38fd2be1ac8bb3d

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\joni.md

Filesize
1KB

MD5
998a7e183a5b2107c5d59646d1f19556

SHA1
929ea35ebdf1b9ba89eebb78d934753ca8a42d19

SHA256
7f57cc1e067014e42ae410825ba5463bb205ae6cecf1c57baa6c78c28ca304f6

SHA512
8a3e65658248e420b39388de70a06d8983cecec97bcbaab1217d9f084dbd792d6cf9ff5c1b8b39f587d8589c16eccde38a357b63aa2495bd642e61129536a866

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md

Filesize
1KB

MD5
4451b19cf27ca6ceeeda239975d27781

SHA1
34d5f32e731a12b9a923c6d9790bea2672bf4edb

SHA256
a3e37f1c28e7c5addac255fa37234e9fb35415143349a2119235c158907b81f3

SHA512
c184fee350f1fb55eac4df9685b2a7e0175f53b5009edafb850779720f29e26a125e638788960f8dd49551e5c61dbd456bd390f5a9f8f993445ef4c0089aa2a0

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md

Filesize
3KB

MD5
d21ab98b81f3286ad3f2c85a75eedd10

SHA1
f0e390f96f211ff09d2d638b8ef038427ff0baf2

SHA256
5913e20c4b368c4b44443e2d4399617645fe5bd94415556d70bd09e1ffe319f7

SHA512
b375161c589aef45f4eed31d7a28417c170588d0482293fdb8ca91e7df2614fecc55bd0665f00d07a39d6f28eadf504e29feeda833c054770a04e2faa4b9252e

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md

Filesize
2KB

MD5
b97aeff37b24c699c7ef04c48a414f0e

SHA1
13267a4d067f628b11c4360e9fbd304fb614568e

SHA256
f3c385b315f0c9ff3f6ccfd3a85085090a8b2f950b41c77f3915ba1295ae5b43

SHA512
89a6be9949d2f8bd523d89c330d317f5f5a253c3c507e9d3130fdb3c5be7e5663dc4065fc6224489a0a48d3e872d83f50c26a539d5988cfa2a6893a4e5f7b041

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\libpng.md

Filesize
6KB

MD5
eaee6b0d5a5444f571a24a10e0bc7b2f

SHA1
15db680587d198c14085d7f5d2fc6ab3bc841127

SHA256
39a401c25f012d2f05253abd2848e60f9cd5a77c55dee9d879ba38d6bf71028e

SHA512
32685077f199f9da0bddb79cdc4fbf94b94827512caeed22c57fab089d2760554b63a10706de2005452342dd82ad1e5ff4e6792325f35b0ec7ec8bcc7b5b4a17

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md

Filesize
5KB

MD5
2ffa128964303b907af1e4803c3f68bb

SHA1
2a470ff7078c8172a1ecbe0758ac18eee6cd5577

SHA256
0fa0080281baaa6d65eae9e11d202cd92477346cf96f5d107564825dcaf626dd

SHA512
b67c0a15bbde5b057486a05d4b952fa274e6dc93d655f96e3585b8e8c9ad8e7f2874d067767dab8580196a6a458adc11005ca508708044d6b059a3502b7ed14d

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md

Filesize
3KB

MD5
98a9636d73bad86f440627b65d82ac37

SHA1
f4db10cc39e1a6e34c45156b5d9a3bce25b01efa

SHA256
eedff1d71a1724530852c7b4d5d7f8b057ca221e9bb741666f7839af7b30b672

SHA512
442273ae5bda3294d31ffcbd55e1026f9dbcf5cbe83c2637469d3041af5916af510384ca32fe9f15c35730c06fe11b482806a12f1b6974211c4a2bcca8640bc7

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md

Filesize
2KB

MD5
5268cc7065dc02553c708bfb9d2b550a

SHA1
3190c882aba7a45f3af2fc5dfa7fafbec2739025

SHA256
f6b5313a7c6e6129680d8f5e9ac38d714c73d546fcd47708ab75e81a47ac3d33

SHA512
443d244535bce02a69f3e70e40e572bf8413c154907bf83e2cf18ba9f9146a5248036d58c6aa03198ede98d5f5e1168b648ab57e4cc63fd6a6605789245fda3a

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md

Filesize
2KB

MD5
9e3b8114b1b6a336dd6e1dbf12aab554

SHA1
8e24292e1ccc6ffdab7283bfaa327a09f1797d84

SHA256
58c9df169baaf746d0c22ae7b7e7ecdc15139bab12bca02b49e9281820e41b85

SHA512
3391cfe2ea972dc7e4a545ae3605f0a2f67e40520f5abb04a902f73ca93e8884192afac0074030bbcb35deca669d51577d4e4a7f23b81882297a7445342a2d7d

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md

Filesize
1KB

MD5
c46ffefdbc445428ae49ba2553e6ecd4

SHA1
3f8a01e58f29c3b28840d97fb1a43a1403979a21

SHA256
c77f9a333d5c26f803e879734ae38802362393b1c3a861b2097e7316e85f92f6

SHA512
7c6d9f39913ce3408419576657cfb96605de79920c1004b91cf385c5eec6ca21e93df38018793a418088dae2a82d86df135ac9efe77eceb26bc9be05c3563be3

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md

Filesize
1KB

MD5
2867b46785d263d4f75042be7c3b8751

SHA1
7dd6f47a62d06f3a84a01a1f5e28c2669877595c

SHA256
31394dd84c0305e293ba0efcf777299cda6b66cf297061e92992a6c09689b739

SHA512
1f17f054eb8700e7e400b11d199800d5c308dc6473b5600635493ecd803bd7fc6e4131a6a4c8b3f23e564d9a2289d6dbcc44e89a9fa6f759df5c7456512e5b6c

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md

Filesize
11KB

MD5
ca0f61644678dec4003881eca3f88b63

SHA1
74841cbf0e2458c115f4d9a84dbbf67acf4edfe9

SHA256
10ecf0a0a6e8989730bcb023985c17010c43480897d5a721e745113344c16385

SHA512
2af0b04ae505f26bed10e8ff9fcd853f69247944ac943516f0d752c7bebd8a656bcd302a3de4976dbbc2f0c3a048cec6ee360985c3331a1b355c666dc5ca2d8c

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md

Filesize
1KB

MD5
8fd08e65c65be873c00c1dbb0b59ad19

SHA1
f024b38fea87d944a10973dd2a6d5e9d03624746

SHA256
5bcede5831cd21cdb46f0f15ce3d644aa8bebcd10973c78617ea8748a6f7cc33

SHA512
625102c9d14fa40a3addb0b78f0bcd9da1e3a034a6bf73c92c81e50ff0ea7c2288e275a83a263fc945b2ba46597b83c5eb57f8e3c3ebcf267728ea980e7f7c45

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md

Filesize
2KB

MD5
29ed73e2a4bd9e90aef272f8b38dae9f

SHA1
bcc04db6d1dfbd6a331698ffef17a01d14bec99b

SHA256
ad09500ac8350b404e28732e98960489c273c677f4287703c6caaba4098082c7

SHA512
c4cc7f55b3236ce8e844b33f2094881374558a36cb31a5bffd74492c9cf20a33c97df1d8e0db1b5fc1a06ab86122343cfc5685b40b1a5652e515323763545beb

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md

Filesize
11KB

MD5
808e90c2f51e64d5cf271aeea6899172

SHA1
511b4e8b742c5af9396308c932136c294aa6baf5

SHA256
790b494d2bd4e9349b6fff263dfbc228efe587d7bc57555edecc002b966db31b

SHA512
4e6f6095a4ec1697e3e7751ec3fdbb867746f0b2610f7a3a49f071182c1a24cc1b1ce788c243c9e5c8440e12842286610b172857331663175d445465fbd9a4bf

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md

Filesize
11KB

MD5
db2e84cc8ac08fe262079638f5be92d2

SHA1
ae1ef601e2fcc1740384ca447a7500edbe6f6b8e

SHA256
61f87d07f21bccba29e5dc725b3a7541092d56cf69c2c1b1b400cc76940423b5

SHA512
57d1d86709b974ad810d9e46ea8805388ef59070da899a3b190eda9ab64e196ad4ec72223d12d1b9d7f71b5d11aac5381fe7acc7c8d4c2ab5b4313107bf496ca

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md

Filesize
11KB

MD5
df4fd1a1dd684ffaf3ae5600035ac83a

SHA1
305390faba9fc653b7e6a942297e0394d8294bd8

SHA256
f9b663b9ae878ffdd9189bef0e90c37f161057aa823270c1bfe60e82e67ebf72

SHA512
dcfd3e588ba567ee26ce1c2e5293961975b1cb3896b238b462e5d5d758b5741dd9bdb9a9b6ab7cb660683b83fc44346b9baa4cad49bba3b0583fa3fd8819653b

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md

Filesize
1011B

MD5
e373fb7a0c345b8a5637638fce1e8f27

SHA1
96e86bc6f27c4530a2f1b2f2740b298778359d67

SHA256
0a3ba06f05513ef9297d94e0a13702c0b84c2b9735903d2bccf6607e68b02949

SHA512
fc7b83f2a2fd3d45a7c447a6f93ef2353800c52ef3673cc07bbd505646a21139c23da535638280fbf0342495cddef2dc0bcb5a6d0e1bf3232ae89219160faf89

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727656060295712.txt

Filesize
77KB

MD5
51e18dcf7544c26069ba08ce85e9dc22

SHA1
16c80979011f01c03d1939e6304e539d87f87b70

SHA256
a380551d33591599d6188f684395f1bfff8ba42dfa30f47c78207ef8ebc35402

SHA512
605a33de149be16266e7e482542fcc1e3b831724776d99d9056211b85894bc0afd48166909ed81a112a319ab758f805d4b3c5468b5ad7cb960446d3203783205

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727656525478361.txt

Filesize
47KB

MD5
38681a21e5abdb6f2b9d1283e546d8c1

SHA1
9538ac93bdabe5105f736e8a38076ff395b238a9

SHA256
eca16c43bbaa0dc20f99394f66d85e55ed78170e3929c773c3ad4a2d8f658446

SHA512
47214a8df4faf19292c7ff23d7b78e49d23e87db6cb8e456e4c51658f2c5818b7fe9e06b98b135876becbd903b04d114b41b6031c5a9f7c71797d56ddd66d862

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727663169040966.txt

Filesize
63KB

MD5
082fca49418790aef93da62bf72bef7d

SHA1
55722ba5dbcd58c6a690eabb49965e9eca9bc5e9

SHA256
4824dc26ff517e2a3198ba328e0b82cda61aef8709c5439e3d8a64dd8b20caaf

SHA512
dec050d1c17f3a7d70b3a40560b1df9c306229978b4c00c6befc963fe7072bd05f9d572bc530e90f863246fda715ad07decb1de7ce157f0395175e216a9f7ca0

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727665885684530.txt

Filesize
74KB

MD5
d836ce72a3ec211cb8c0ab398db1871b

SHA1
37b2779a413b804c6f84920457d5da2525f63b29

SHA256
2b3a12d500b48570df2b4baa41606d2bcede2665e09316788486f21566586fd0

SHA512
7b6600fcbd95c6e05da9c24b4c93fb1982606b1ccf03ca499e6d1d44562bd970c8cb0f5019790fddb7802f55e070dfe36b845a3a63b5a6cdd9bb8ec5b80c1a34

Download Submit
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\File Explorer.lnk

Filesize
407B

MD5
33d5fd2a37e5699c0f471af90b32da82

SHA1
ee69019c68b3214e3060dcaca5196618b489707a

SHA256
f7723b75e04f044fede187870b15a93cec01722e37846903eb3652ba51462958

SHA512
403c93ed0df46878cfa8037f4b9665fc754fd661f43800a885133926974d276aea8068b1ed8ff3d217441a8fab645faf9b82bf0158c2c710652ff3c12cc243fd

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg

Filesize
21KB

MD5
a85df0e4b9ab852dd8f188f37855015c

SHA1
b5a19c5a83e95df865cabc781077fde569d9adc4

SHA256
b672a7f39a2ace9c7d75508030eeed7baaa153ed2d472dd8189e88e6f11bc277

SHA512
122d0c73abf014919acb5b9005b43f25d1df66835022b0c322abf5600bece7f76b9564f418b379130f59c9776e6257238e0911f1f2b3214bd79f98c7d4955c70

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\HelpIcon_solid.gif

Filesize
1KB

MD5
3fe7e7080a0376e6837ca7aed886cb58

SHA1
c8f0bb58f25a2a9b6d3ede835b46b553cd293371

SHA256
5b951b7fd62f1168c1158a166f29616fee8038c49e3d0f55c1542ff118c1a245

SHA512
414bc5542c86c1e8061ad8a00c895fb9fd32fa3246f6affe653c55445214cfbae30f1f54a35bda86d8bc846e7f458a19b4421d1fc151c7a89c1fb3ccf48ec4ea

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\alert_lrg.gif

Filesize
952B

MD5
ec30102a0fd6d076373b38f149a0167a

SHA1
554efa00939e1c247aaed9ad938aa0382ac8fb72

SHA256
37bc25513c64745d36b7191fd2a6df3fab814406f0745597fa619363b0d965e7

SHA512
96e6059cb05f33192cb7a462418482efff8ce08fd8089a2a7af1b183beeb1ecf70ab745bbc25fa2c7614d5036635e1124a7f980424df84c0d43a2b6e2dbbb7d2

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\aspx_file.gif

Filesize
121B

MD5
d8a69df7d67ca613881b2e35e7c6f7f4

SHA1
b93f49083e65d5bf1ee0998b344fc97d21bcbfc4

SHA256
ea9ed7881a3a521fe7e4269160206cf33e233b04505cb0b2fb03e30b6c4e7c69

SHA512
50935176980a930ae8381b00e906084d87620db698aa53586e6e88c0a10123abf6431c67a02d3fb423ef59f5309c2b8897e1616201637bce96b48bf614604a91

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\branding_Full2.gif

Filesize
1KB

MD5
64944c2625fe9dfa4b718a3893470a60

SHA1
fcedfc9327e10525c33187f4a1e93d155b1a5a65

SHA256
b20fb5250e2d77467afac6ac336e4d4cd3d79a3739df06a9d702a25dd18b75be

SHA512
37a9c8ccbd0ae55a305fbc85e38e5f5398f3996fc951cebc6ffa48a3fd01037e7cb3eb60a10f798b113e6c70dfd4e86f3f95c41c495922610751fbe0aa8c69ad

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg

Filesize
8KB

MD5
fdad09ee7e8afa89f3724f9dd568f572

SHA1
47e5167c4cc1a2e70a6bf8981e86d701e184c73f

SHA256
ed0b07167a916e674e3050de518488de8a341f8e9aeb6eebdf7e0bc4bbeece0b

SHA512
1ee08143735b098c49d9a388c6acdf04370b98e29bcc240f63b4121dc7714220b3fa4f28b402b701ca300297cbf6f4580701a7510129de53d3d1b44adef687a4

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\deselectedTab_1x1.gif

Filesize
61B

MD5
8917a4f0a9569288b79cbb6de9841284

SHA1
13662515502db57f02e5d25f56ccbfa1c66f8f0f

SHA256
e72e1dd82c5a7de127d2fd82ee8b91a97086bd8c9749feab976f784b98059851

SHA512
1fa5ce6068fd34e41dda560fe83e6df2897990527704dc93838ef9d5720aca942644ceb4dea29d9e4f2acd94ec138b359d3ed6169f2f9eb10ba8e7866df8086b

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\folder.gif

Filesize
914B

MD5
35e9128d06ea8a57bfcdcc2ae4b8565c

SHA1
96e9a5628e67869f79109e52a8f57df76e96f443

SHA256
49ebc466bc8680fec5fe2ef28e4cf72e989547c616ec0b3c614526c877ca8f22

SHA512
c83305a8d3a7c0db3ce08184bbd0a6c80cdbf964c3ea2c59f53d03f5fe16c9cf3c0787ecbed4ee467d641968ff730a18125a2af4e81e092b8f3cbdff03626f26

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\gradient_onBlue.gif

Filesize
90B

MD5
22f08cd0e5008a7a82f1dcc1ff01cc6d

SHA1
ce8070e90f65037e6b40fbf0f89491590507db15

SHA256
72c4aa30ce8abf0808b391aea9b253b9a1fb4417b14ddf83db5ee2bf21828178

SHA512
9ac15fa0361f040649e79b774a00e410baf32af1d493e2a11f426e89086e199076f5bf46591bee49dd04e2e7f2e9ef0cdd8402f8998b64927c7eb248cbbadef1

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\gradient_onWhite.gif

Filesize
90B

MD5
cd1c39cd44504bb8498f508272d82966

SHA1
67365e3a95eb0a0b3c465c5473518c7dd3dce328

SHA256
49dcf3a3dc4beae083a51eb160ccaeef27a9b3f76839f1c82d5f72568c1d3569

SHA512
b31625c825cd56f144a4ec8f483ef07bc0337ee9b44d3002c63f9808d7e777ad38a9b2c18c7a3d1187944944d6e435aea80c13e48b3427631d83c2b587de8f4b

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\headerGRADIENT_Tall.gif

Filesize
328B

MD5
c5a135130450a5e1306d7fb7d8fc5eee

SHA1
91e96e62e281503c94226f2c9912bdb9700c0f6e

SHA256
0dffe540ff86b0cafc1041e64be9f647e99565bca1dee9b97ab6ebe96e4cc3b1

SHA512
881240815890a1e4e150b8de6718e8433396b856415f328b3b665964dd89370c5c18b52dd4229e9ad719494c433e8dc2aeb0b521f7969f53e636a6a90d94cb5e

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\help.jpg

Filesize
1KB

MD5
5842f15d93dbb2c2363af434d399c9e7

SHA1
57c9b22a23508799bd6a5651639544cc318911dd

SHA256
47168925d21909073ce8bcce27d03bd65a800b0ab201776e57adcc232b9b3a9e

SHA512
c6ace1609f5999c1ce8ed5d72db734f4d45c2b31541830b847a66875ce22767f4d8e4eb3aee81ebb43869b622d522ee8c3d201e890f0bc4b63ac8c58b10f32f3

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\image1.gif

Filesize
162B

MD5
d00ff2a55b13927a050196b634ce28c0

SHA1
ccd30b19ae7399e4fb4774b5a19afdae30629a1b

SHA256
f629d5291b004ebb863dd2e3e859e47ea3bb73426b6794ad43d6fcf929e99c11

SHA512
9b160b77c197a2d7bf48800b7e6a050add2801cd721439b12ebd2a4b4ce79556fb2912b6b5c59ebf1f559d790a9ea53539e287e5c6a2dd102126c636bc2d0f07

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\image2.gif

Filesize
586B

MD5
e3de6fdda983fa80ee1a5d9f9a9cee17

SHA1
ac59f9983cb92c3d9167b6c40949603b1e4a6782

SHA256
90470e60cf050eca1a2116fa8ba0fe341ee914eec5ca7052e67e2a84af3d7ed4

SHA512
809a1ba8c086c5092ffff7a31147369fe1feafa2b99c687fa428cc2066986ddf80fb5655148f56f909a99fde7d2875953a3a51fafa7f68c7a1f81030205a04bd

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\requiredBang.gif

Filesize
124B

MD5
09d5f8f26a0294cbf4aaa5c29ff35d52

SHA1
dc008919c825a57e8162022cff3ed5f4fd462746

SHA256
44b14bc153bbf622d79a735238e5869fd461751facc5987d66601300491b637b

SHA512
f25cd8fb71bb3e9e083a9496953127c793fe2ed08b67301f7a1b85df800509e2044950d866fab7d833648f4dce27967f321dcfa52a463b2763ee5fce9ce5da48

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\selectedTab_leftCorner.gif

Filesize
65B

MD5
948228282eb5c491b7f6a972d48cb6eb

SHA1
22762f58e2c0456f8f8c9c3e83155407edd192ce

SHA256
b7b1970628a6fd80d602a9771228762239c7d91cfd0d4b95b0ac0fff92219dd8

SHA512
b7e0130dcb2d103883d4b1288d82d5413e4769f65380a41f7f4035708873e6ab9b802c69975fc2351ddc074f7a8648f58f95ceeaad7eeee5a97f84aaa1ab91a7

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\selectedTab_rightCorner.gif

Filesize
65B

MD5
545ae7e0323f9ca8caf0d14c85fd985b

SHA1
41296bd50cd9aa9d91cbf9cc147c358395ae3682

SHA256
0c0e49db37c480bdeeeae2fb2724d456f4211275a67f36dd89c2f8754adaf4f9

SHA512
625c9ad077e0a7dea12955d533cc2c31afcba637d7602f3cec4987ff94c925b2d272e02467f7f4172c39aba3ca6491c8448e00619ce7f7adbc5ca37b6c7c1a1c

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg

Filesize
8KB

MD5
99096398e2598a36478b95087cc557cb

SHA1
c8c365b705ef26eb22386fd7451b0ac2ae26537b

SHA256
a5d07da2d0a152f27eb5bcc27ca3a8ff5b3431faf0b93a011dd6e6e311ee5fd3

SHA512
61921098edab154b7fac4fe56dec75123a7abd8e003d8326b1240c9aad574db3cb403cdfc94e4bbb7f384b92d876e077d191fd4fadc61f9ad628e428f283c7f7

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\unSelectedTab_leftCorner.gif

Filesize
65B

MD5
a389f2a76aba1d17ce144f2021c0a790

SHA1
d25209d1ce4cd89d6de860e5d885b949f88c763a

SHA256
272c48dc58612b22ae3464004de8b4293a62d8f3c55a93f718c158bbfd4bb231

SHA512
3d551d49134bd21fc92247ed3376002c953d638f6db4ea10815b1008b1d1ac362f7b6b4e465503260c84d2ed49cbe296c1dedfb0bf44a247204481ab06fc0e27

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\unSelectedTab_rightCorner.gif

Filesize
65B

MD5
b693124a044473c227ffa0d4974a88e1

SHA1
8002f88bbeb435a637a63a06b6961a752422d019

SHA256
a3290c6d805329a2a9a750743bdf8391e170b28a1d0a4afbb9e26afde103d673

SHA512
b82410e248406989b45261d1c49dd1a314c1d62fc485a479388a61aadf3d24ce82d91d5102b08e508453e40cae1d5f6aa3d35dc34737d58dcaba0a4e529e957c

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\yellowCORNER.gif

Filesize
880B

MD5
9507723eca58ad43ad4898cbf53226d9

SHA1
93fb54ac26cbca2609bf90c5976ce9dd7aa70740

SHA256
2429679ee1657932f856554aa7b4e0125010860660f033234c1b82e790a71aba

SHA512
ff643bad0d2dcf7208a69a5590d5878cea96202364a1144cccf6d254f6ef8be8c1142d82721058fafaf88446d35585cb4654c4122f47da5d9b4e50ae7c289d55

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\security_watermark.jpg

Filesize
49B

MD5
2fb408fa4e066829075e6dfb2619464f

SHA1
70c0f86d13275c907454c37bac1299f3034d7bd0

SHA256
18d2e0ca13e6b8d7ba690d203b3cd2fce231301b59388de6da59cf697c331450

SHA512
e95a3ba73a2a432e51364dd4dbac30f568ce8b39022c120012ae7fefb94e0a922a39897c8b7861b8cd5ebcb5274ddfaeb1d18ad9c67b7eed8721b28417388a04

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group1\1 - Desktop.lnk

Filesize
1KB

MD5
ad20a15a4d7e119823301ac00efa1ea5

SHA1
63c3f9897fdfec72fa0fd329bd2e16f9e8966bf4

SHA256
51cf0eea052674d2c9a9eb86d35093c0d0cc472f748afabdb3a27637c31c1a56

SHA512
4ff417582fb3ec1e2935c8c2ca8c1e10ec21950d978e7512c5a5a285b386d3bd63fc8ed17e272ea51282ca5f6a7e5c58c2e5fd3c231ed40dca93bd0952ca7883

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\1 - Run.lnk

Filesize
1KB

MD5
b0c57a81d69a478f3ad8b3ee7a3da361

SHA1
039614fe7372abd38f8ec6ae5aa1600645352458

SHA256
3e74abc99a699768b484d72e5913f2833e452949c31ab91b44051adc007947b0

SHA512
e83350fe5f13796942434911564cc8d29a8ad5533e603dce19054ea773a63312d7f774c09962db90afbd14d9febf54488a34a6a643b8119cc3849f19ab29ff18

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\2 - Search.lnk

Filesize
1KB

MD5
6bfbc43338ba4d8dc1b9d42b0a412efa

SHA1
abeb1e3c748d62c300d179e2c3a39ab33aac3ae4

SHA256
da176bd29b413d32008c504eee7f2f54032a61a1abb529ce7385249d593aade6

SHA512
e562889f6f321a94d4ce0a8c7266f0b1e58efc985f6b77314359020658d4c58b71a46a41228a2dcc29018ed855061b4f21eebf83e95190aeb060088691a88125

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\3 - Windows Explorer.lnk

Filesize
1KB

MD5
a54e63199d163ebc2c651ac7375ca5c2

SHA1
f3032ba76821929f147e0b49811500be364131a3

SHA256
cd982d253cba603111d0b19440187e3099c5c4abe2b4c7dad3bd2f30ade418d4

SHA512
c9a2576db999af2aa6209bc3aa3573e6e4931de78a7dfa89c737b41ef2805ee8c87337bd1c34c410416be4a38e8e0f776ce2710441065789b5b5cb22447c7008

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\4 - Control Panel.lnk

Filesize
1KB

MD5
809e79337bc448b0841051577828541c

SHA1
031dbafe9bbf5a1b3c4397b336c889bb1d63eeb9

SHA256
2d9bf32cb93fb1251c5832bc3ab3f56f08f7777f4759df17bcfec1485cfbeba5

SHA512
872e3174a51a7ef140bd087cdc0c603567d535b143f112c837c7a1faa57fa3b088cc6a1c1f9d5b351a9990cfd5b7c5ea575734267ca0fd4b51cd850e9e6b17af

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\5 - Task Manager.lnk

Filesize
1021B

MD5
e11ef35b23e27674520d7143975c188f

SHA1
6f8fa8b536795bcc12e48e489983da2e8d5f573a

SHA256
0d89b2cddf28dca29e791568573774774318af0a3ba48e53f0d18dbdca48532d

SHA512
aa5843dfaf4add9773c52d4bbcd12ef9e38201bee1d606ffe649a24c9d36214c521dc7be3f3ba062ee1ffac6ea46cbe293992d4bd15af84e6f2a65292995b4d1

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\01 - Command Prompt.lnk

Filesize
1015B

MD5
0c14369079c75310e2a5385aff015aeb

SHA1
861abc50c0e238b0e77542eee6eb2f113273cebd

SHA256
d1f5b690823648d5779bb506bef4fbff00d23ac25559ea881ad12d9137b9d8d9

SHA512
5c486c3671f4abccbb01541175f9b43e1aef9ff1e3cb90c009eb08e182c204a72fa37d5f0dab8d634c1189557855b169c0128222572a76109d93f1e008284595

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\01a - Windows PowerShell.lnk

Filesize
1KB

MD5
474f4203b654666ff66abdda9aaec58b

SHA1
f2185b4ed3f5e7ed88116704ff3ea676939336fa

SHA256
1747c1d9e56dd3e56a193d15fc321a255e350bf8034c48465214fe9a9de01d63

SHA512
fecfbf53b0591d377ee57dbbca89eca235032be256975013bb39df2c7faf4497833dd7751084299323000ef97317d6256b730bc62bf2d07df2e8718bd575ba8a

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\02 - Command Prompt.lnk

Filesize
1KB

MD5
b977b1953e3c83edb7c2094aa4ceb53f

SHA1
08a1ac5da1b519c23c9d6c135e064c731ca7bdae

SHA256
464437d2149b8eb5939930cd8648b74523ba9e1a9b71423d55c7dcfc764d3776

SHA512
81b2ef372dfc0129b20e47fd51d6093e320c15c6522877b17bbefe6461b9b976a1ca5c0fc99f8a0610b08d1b2a700181cdcb9254e19e5479f781dcbf969b7ce5

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\02a - Windows PowerShell.lnk

Filesize
1KB

MD5
97a59450e555bd5c6bd375ca02b53ef0

SHA1
f5ed391565061c0be3209f7ad55598dd3344d337

SHA256
5aa58825e66b55fc7332293102f56a56c5e4025128e41f10f298a8da3c590468

SHA512
3ba50bf46428f47522a5ce90abb7616c307513cc1c5ac8978add57e2d7b3af3d44d1f150cc439fc60daf682ee949ea71826f14e76e768ded14aac95c762a042e

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\03 - Computer Management.lnk

Filesize
1015B

MD5
3ec73df115c30813e388676d83dbae6d

SHA1
2235de7c5945d0e068e9cd1ac342c272c5fb0de6

SHA256
89c864b49f2281114c3ba3ffd6718546bf413d2058c7101214a2248e18b41edf

SHA512
9bfd81c305fae35fecc739118134e241246f78c1d0ea96ccf01373ca482900bd9b1e22350777119e37c6cd303a8782307996a00109ca63ed2e88ef6a60820cb9

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\04 - Disk Management.lnk

Filesize
1015B

MD5
713ee556fcc9c31fa006498da725858b

SHA1
ab66fef933f567325ad0c986a177772aa02c49c7

SHA256
f454747f97419fa637c828096a06b7ce214e8580b23d87e1447d1d48dbfa2753

SHA512
9b9d5565c143aaf7b5f72aa419b7284ed39b5c56822fa631dd8a6e1d0fc08d7f142411bc5407aec7c1d636f61bac0f6f29ea90459097c1d9b20718d5876ed2e0

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\04-1 - NetworkStatus.lnk

Filesize
1KB

MD5
d4183f45d8713125a69accb93be46267

SHA1
5c5be000a37324aea154031b45ae4410484851d2

SHA256
caeed8e5d559c4f980c58b9778c944034195e3eaf2c0b75d0534f12283edf957

SHA512
655b731d978f1cf927300fbfeca3199c01175b7353a75c0d443f97b4005b9ebc7aabe8c64392b2ea87bdec8a1a6b877fd008eb730211711520b66c776e187cca

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\05 - Device Manager.lnk

Filesize
1KB

MD5
938b6fbec5d1c0e96d054f95103b02b8

SHA1
6ae397d0a35ee55d2af46f2fe305aef6e0c542f7

SHA256
c982ba4e113165856e2980ac8d8d581716ff664b88c32d4f68f13278ab802322

SHA512
7144422cef19a989bc575cf88ca9fe426855620dffcf7543d21b3ab52e8380caf1b939d0cd65b5907c23fdade3e81e01b7256cac6b2ee34b95258826cb37946e

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\06 - SystemAbout.lnk

Filesize
1KB

MD5
92900f0c462a4ee95855ea9de6fbdf62

SHA1
341abc3bb444cf4860f8084519f403756e5aa449

SHA256
2a0f46bb75a8d759d2d9dd3f58ca9add17b3776772f68c9387628301a5120bc3

SHA512
09d653e4babb4a6c828c53f11de09eca871115b369dfb223820c69611fc770687a3add518dcebdf3db5ef61c8fe2f313357242fac6f5ffcc9ea29a0533fcfc84

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\07 - Event Viewer.lnk

Filesize
1015B

MD5
4b1e905373437d6fd6581c24e446138b

SHA1
8e473d4536d87f4e091a2e915d6eb9a841facb94

SHA256
918fb2634a45caf9eeb7530288e985a5ec9499bc819ff9857cb019826a31772c

SHA512
78e5a8f331649ed76cf5713b021af90d84d014e1f35a789fbdb21a2572c494c1d1ca0ef004843a5b1561fa116c8a34e734a5eafe49990056ca677c2de511dce2

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\08 - PowerAndSleep.lnk

Filesize
1KB

MD5
64d287b2ddd7f231f7f174db7c42678b

SHA1
f3d6cf874629d2837b678cbcd590a149d12f060a

SHA256
02c782505889c7864a6ff963b92a129b55f011e1fe80e68a8ec02340fbf70886

SHA512
c01720b54037f7110a28a914da19a39bcbb72e428afc163127bd0a64fb64951edbf0a8423e38d6cce36c413592422865ebbff6422a20bdb50a23e04c71b28ece

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\09 - Mobility Center.lnk

Filesize
1015B

MD5
48aa26e762764144c6d86f0678ea9716

SHA1
7a25957221bf61e468985c522cf67fd65d78140a

SHA256
62f06fa63df8fd64ed28bd26540c0989bf40b708e88d413869afeaa2a5e1cf2a

SHA512
44cf35a70310e5003366ecb02e5e723b5ab5d90c6f2c4675b0c5e367401d125541933f24463b2861e47ed0bbbf36025dc30a73b42adff6f794d5b57fea7d9dcc

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\10 - AppsAndFeatures.lnk

Filesize
1KB

MD5
bf26eef2cb3e93011bff845bc144a3ef

SHA1
dd9bf5685ec80e9498a40a8b3f25f19daa8cba70

SHA256
f36ed9e144f837f46cc93b421ef9d618436c46ddc29b4951d8e8b82e91d59b34

SHA512
5e8c09811b4ee9a4b3e20cd713df20245bfa5668a9dacb29d9e86fd615f277d6f1af206256ee1c717d1d640d54a888d25fdc539abb218109da925a718acd1e29

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk

Filesize
352B

MD5
c9d4ae38d2c85b43af603044fd0d7fa7

SHA1
50d6cf3e95cb6b939494d96cc6783bbd3fdb9c69

SHA256
8aacc7503457f126b43e158d1e1ea183103b5e4e7f4e333b6906c71415a5ad4a

SHA512
d702042f7acc840286ea72692708646f2c7b17f2e52909948e03e9aeb09a220bbb1700a78e7c9a434009eebc4f856e6518adfd72d7357b83a952cb0fef27e431

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk

Filesize
334B

MD5
cb3569fb372815bc055c8c32a228bd0b

SHA1
0bebb984dc36303a354c8dc5380f5292f53cfb49

SHA256
43725c755c880e1d0bbcb5470e45ce75e3a6e48a34fd51466e85b0d3ecc27cfb

SHA512
bb424a3238aeea5cbea67444f79c1f72417255fe24df074a29767ef4b43493145acb0bf45367316d08e1a8d8f990f29567b10bf285581e4530b5a503d0f5529a

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Magnify.lnk

Filesize
1KB

MD5
b1ee89c506a9506cfd1dca0ad2fa6c73

SHA1
55ac1c7a99b15a512842e829019a2d776acd0663

SHA256
1c3bdc078607196d5a3d630b4c022fc5e1b8f8d07f7af9e031dcd4e8eef092cf

SHA512
d1e8d1a7dc952b6eeda94da4e4f28b0f68ac35eeccae1574916224a4d2b34a3684f6450b852eafc43a1cfb429d6121e329e36a9931a0012ef53a68a0bd3a0bd0

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Narrator.lnk

Filesize
1KB

MD5
09691def8585b5b70f71496f5d5c450a

SHA1
222b723fea7a532355cbbc9923bd15d98783ed02

SHA256
9f72cff86803b5868705d552ddd0d601360da95f5d78119e1abdd429aae16fe1

SHA512
dd476f120c572fc44209f5d9cc9a4f0b586044bd57cad70cf3ea41bb71e13418079ce6a0749005efd841035623c46037032315d8f4bc5fb346698698ca359e7a

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\On-Screen Keyboard.lnk

Filesize
1KB

MD5
44f2fb16026188a727f50e9ad6bde1ce

SHA1
eb6bbeca8bf5af5db6e7e65acff535ee5bce9098

SHA256
e95020ac89c8a7699eac4c8c9264099cc1302b65204ec56f54dc852a644b88e3

SHA512
024e63ab7cb34f2e5e003e85bf966761333a69a2b0537a9f8b7b91eb339908c61826178808fbf8c3cc2ed08bb05537dcce91dfb471dca5215df2117c1c56cf8e

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Administrative Tools.lnk

Filesize
1KB

MD5
c961d2815dcd0c8a79ba03b4f6d84e60

SHA1
32ccc02f65755bcbe7dd2acd9d35541ca6804fbd

SHA256
3d268d5f23ecf0272603d9dea26c79626897d947a20a5b882ab17fb495697a70

SHA512
5c7515c8bdf73dad40993db3f0798582443b738b20315e451f87ae13ec4bbffbdbd5edaf6f6efac03cbe41a83e95475a3dda36377fccbf374197d150db8a665e

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Command Prompt.lnk

Filesize
1KB

MD5
1f5264cb62307fda02323161f4fcdb14

SHA1
fa70bef1cd5634623841ad115456c76fa67709d9

SHA256
cd6530a9147083b5ccad6b7bef18d586d3be48f97534a158464ec55f1a38a9c9

SHA512
3b8b5f94d8a0fa97ddfaa254c3d40286d680233de28f763b6d9973ad182f66154e05b5165bced728b119be03eea1520b1ea893697c3eb51dfb2f42baacbf2ef6

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Control Panel.lnk

Filesize
405B

MD5
863c4e23673dbdab903a6cef052a3ac5

SHA1
e42068a2eba6d79d7c86580952cf811316ecb8a8

SHA256
93a945e078aeec83e2ac11dd175b3228509b453c7cccc775fc7b23cd6be56672

SHA512
eca64462e1cc984152de37769d17025b2fd1b2c61203d44ef311f4a2b8c74b89acbe1dc80e783339b369bba085ca281f74e02eea04c7a86eb214826fd259e17a

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Run.lnk

Filesize
409B

MD5
e114ede99d25efca443565391b85cb47

SHA1
951f93aeedadb218dedf116f57c577b2e78932b1

SHA256
929e092ceb9268754b5c2471fbe213078446ce48117c20211eff0490f9368ced

SHA512
61eb8f1b94900505bc8cf56bc9ef16be67e9bab4d5fdb5edae18762bb3832ca8247b8ac9a0f96ac2203909d227c976f2a107fdedcd759465d9daf92cc1ed7c0b

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\computer.lnk

Filesize
335B

MD5
c42abfefbd7c23d2a80b8281bec1969b

SHA1
0672ad7e276b461e242f2de79b766c1648eb79b2

SHA256
2b77fcad9682b0046afa5722ed3dc90f4dcd292c13c0aa58da76d03a3343f882

SHA512
1dfb004f091838f6e6879e5164f687fccd451b121c409408ed2d7104c3dd6db7f12085ea7394daded49888ef1db8806baad2652e6cb8b8c24c8cd93390e2f955

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell (x86).lnk

Filesize
2KB

MD5
103dd3476a2d2951730201d65c8b7303

SHA1
22cb4e05f400fd917963785926fd105d7de163d1

SHA256
592799e65e8a8ea7c330b735fdac546de41458331b149f614b03b5e15628860a

SHA512
85873c29ffecfa45dc7e7fccb6a187c3d871a87b559fc5d8b929764d24d82eae65dbd0f97ba5b49db54a75b5df5ca120f48de06dee3a3e09086371254f1c744f

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk

Filesize
2KB

MD5
e532677d6a8b1ab82227092b9c440cd7

SHA1
8dbdd2474f3dfbda76a520f2009eb4c41319a236

SHA256
385ab54ee5ff75f900b2d5941dfb35d445d6f1fb0859d0a4b94c9ecdd43833ed

SHA512
b7d39be71d3cf6bc0506c62e47a46da98b477a18717df614e495924ac386fe59f73cfaf704118d350fa997a95ac35c69be1de348f2de7c99680fdd91870557f7

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png

Filesize
296B

MD5
1d873a23be1ca89d720e045d9ccbacc0

SHA1
77c6976df997e1d4ad046720604cd41b736028bd

SHA256
897fe58c8747234bfa398c4fc7d8fe91f939bd25f46ab8fd02277e0be50f7a30

SHA512
ff522657eecba331f9751569ea375f260eb9c1e8294b3b3f0e7c126e9c822f5f44099ae520c5a94f9c7e4f3c872d6d871560261a1dadc7d53026a9dbac3af7a2

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_contrast-white.png

Filesize
276B

MD5
837c07ed8272ecce01384e80e3946164

SHA1
23755a456217c293d1cfdac9e3c3187dbbdd1b71

SHA256
9659aa00a2ec05fac8ab7151d8d2d44471f47013d3ce8283fcf918ddc83c4938

SHA512
4714d61c24aca66cad47bc5bfa2df9f9f94e2b9008ccb0503a4e43163991c6a5159e96bd6794371c1a407766637d4fe06bb339f4ca7a63d0b35a414eb3b75de8

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png

Filesize
296B

MD5
38be8badc7934854cae3055fd5fd19f6

SHA1
121a0e506dfc43a3ade35eba8f14d9b3a0fc6478

SHA256
9719857f83018cac048cee143909cb83b18f5a0302ba901598a6e4f6f603d814

SHA512
d7711b42f93a2bc82df42279a45fa5018ed5156440c175a7062c2763bc552d1638deb09b06e2b3ba503bacfad8688f24ec82a5a7ff2121ab9358ffabb822a3bf

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square44x44Logo.targetsize-44_contrast-white.png

Filesize
276B

MD5
ab7c4f9ac15388227501590c5b9b0b51

SHA1
1f348f6feeec4abb669c0e7dd6856b5e4d41dda2

SHA256
cb5df92cd37582311b9e4712d0b18f6320dd199b2ef8a9e4c8539ae06954056d

SHA512
21ba40a6788b42e211ce9f4851915a24080bb363e5f214dc52539939e5b5ea101c17b7578467266e58f3e0d54af9f9ddef3e2e8964931baa317a99d4ab8f1ec0

Download Submit
C:\Windows\WinSxS\wow64_microsoft-windows-onedrive-setup_31bf3856ad364e35_10.0.19041.1_none_e585f901f9ce93e6\OneDrive.lnk

Filesize
1KB

MD5
bbcb27872916b44e1b70e305e48ce9a9

SHA1
ffd69089b08b943342b8510eaf66f599b3c2d9c7

SHA256
5194c604d4bb5ffdb6fe04aeeeed7f944c040096ab1a7ff7107391b23917406a

SHA512
758a3e3aaa8137c119d3af63b345cda75309cd0097b65c087f8f59736a3f854d93cedba82ad50ee29c8c05f9bd3e1561e9082b89daa35081c9d530790d1fa0bf

Download Submit

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads