0943bcbe3e1944034090bd1ac334804f7d5f1205a06182c9a1d52e3e29405a3b

Analysis

max time kernel
95s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18-12-2024 20:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
Size

171KB
MD5

fd0da4f3d8ff91c15da4fb93e8121e21
SHA1

93890a16d1c0597cd4e92b85b2313d21a8c7d41d
SHA256

0943bcbe3e1944034090bd1ac334804f7d5f1205a06182c9a1d52e3e29405a3b
SHA512

d9de2b95064cc1dacc79d9a5a7efb7c88e8eab58b96b208744c075583c3bf28b8c49c5276383ac4122211e3bab3ff9bfa02cdf465e77eef5ee7878aeeb0f28b1
SSDEEP

3072:uXyJStHyynWJs4JrboEwTdrqwGDSSh3+LT0t9NKKKIs:uYStSyWjv6qwGTq0t9NdU

Score

9^/10

discovery persistence ransomware spyware stealer

Malware Config

Signatures

Renames multiple (2199) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Drivers directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers\gmreadme.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\S5hKYdJLhQgBg3u.exe"	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\FileRepository\c_printer.inf_amd64_cfb2c47c5677c442\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_volsnap.inf_amd64_47e3741bbf4d6b06\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmrock4.inf_amd64_bc507add47f436ae\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netpacer.inf_amd64_7d294c7fa012d315\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnms002.inf_amd64_2176cc45624119a9\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wstorvsc.inf_amd64_50cb8ebb1c9584af\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetNat\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\hidir.inf_amd64_7bf4a320e4ec8b3d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\wbem\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WaitForAll\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\b57nd60a.inf_amd64_77a731ab08be20a5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_fshsm.inf_amd64_48c6ccb73844d3bb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_mcx.inf_amd64_fcbcc3807cbf63ec\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmnis2u.inf_amd64_0c5757ecd1574b3d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\sppui\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\uk-UA\Licenses\_Default\Professional\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCClassResources\WindowsPackageCab\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\DiagSvcs\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\hidspi_km.inf_amd64_7e53b3972dc4df20\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netloop.inf_amd64_762588e32974f9e8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\stornvme.inf_amd64_1218fad01506b7af\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ProcessResource\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmelsa.inf_amd64_f187fca538857daa\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wvmic_heartbeat.inf_amd64_ad33c2d1c7a3023e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetSecurity\ja\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ProcessResource\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_RegistryResource\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\AdvancedInstallers\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\adp80xx.inf_amd64_efb36fdc260e8bc8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_scsiadapter.inf_amd64_efffb8c026d3abc5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmmct.inf_amd64_0f3268711a5b2622\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\uaspstor.inf_amd64_63788a81c4c628c5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmdyna.inf_amd64_d89605b6b478d768\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netvchannel.inf_amd64_ba3e73aa330c95d6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ntprint.inf_x86_c62e9f8067f98247\I386\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ufxsynopsys.inf_amd64_978099f98cc73ddf\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\InstallShield\setupdir\000e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Dism\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_smartcard.inf_amd64_bf5afc5892966e30\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmrock.inf_amd64_9b13bcc1f320d1ad\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmsupr3.inf_amd64_9cb7ddc26e30b52c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Speech\Engines\TTS\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppLocker\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmnis5t.inf_amd64_c6e181de81a59b54\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netax88179_178a.inf_amd64_b6748bc8bb8ccf4d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\virtualdisplayadapter.inf_amd64_bcc7550a6e285f92\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\et-EE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\MsDtc\it\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdm5674a.inf_amd64_ec8de8952888a618\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\usbport.inf_amd64_254cd5ae09de6b08\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\cht4vx64.inf_amd64_b03448ba0b72ec47\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_bluetooth.inf_amd64_7e49a68f06c14d10\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\c_fscontentscreener.inf_amd64_bd1517e25f3e419f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WaitForAny\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\StorageBusCache\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\fdc.inf_amd64_7534987814b257b2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\xboxgipsynthetic.inf_amd64_9aa94bcf077169a1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\nb-NO\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\disk.inf_amd64_cc4dba2066ccf53c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\hdaudss.inf_amd64_76a0499c8a4b3752\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\net8192se64.inf_amd64_167684f9283b4eca\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCClassResources\WindowsPackageCab\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmcxpv6.inf_amd64_46a3b42507e9d29e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\images\themes\dark\example_icons.png	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\8041_24x24x32.png	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Images\SkypeAppList.targetsize-16_altform-unplated_contrast-black.png	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-36_altform-unplated_contrast-white.png	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailSmallTile.scale-100.png	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\ThirdPartyNotices.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\uk-ua\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_BeforeEach_AfterEach.help.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\de-de\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sl-si\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\CP1258.TXT	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\LargeTile.scale-100_contrast-black.png	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-60.png	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\RTL\contrast-white\WideTile.scale-200.png	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Thumbnails\Sticker_Icon_Moustache.png	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\LTR\contrast-black\SmallTile.scale-200.png	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\nb-no\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLUEPRNT\PREVIEW.GIF	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\LinkedInboxWideTile.scale-125.png	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\WideTile.scale-100.png	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\zh-cn\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\zh-tw\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\VBA7.1\1033\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-16_altform-unplated_contrast-white.png	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\StoreAppList.targetsize-256_altform-lightunplated.png	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ca.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Shell\Themes\Glyphs\Font\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\GenericMailMediumTile.scale-400.png	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.scale-200_contrast-white.png	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\cryptix.md	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\AboutAdsGenericBackgroundImage.jpg	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\GenericMailLargeTile.scale-200.png	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Work\contrast-white\MedTile.scale-200.png	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-60_altform-lightunplated.png	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\StoreAppList.targetsize-256_altform-unplated.png	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\AppIcon.targetsize-72_altform-unplated_contrast-black.png	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\email\dc_logo.png	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-black_scale-140.png	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ko\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\Assets\AppTiles\StoreAppList.scale-200.png	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\symbol.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Images\contrast-standard\theme-light\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.scale-150_contrast-black.png	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\OrientationControlInnerCircle.png	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-80.png	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-Exchange.scale-300.png	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\LTR\contrast-black\LargeTile.scale-200.png	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\fr-fr\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\CancelGlyph.16.White.png	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteSectionLargeTile.scale-150.png	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows Media Player\Media Renderer\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSectionGroupLargeTile.scale-100.png	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PeopleAppList.scale-200.png	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-60.png	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\GenericMailSmallTile.scale-400.png	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\javafx\glib.md	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\COMPASS\THMBNAIL.PNG	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.People_10.1902.633.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\PeopleAppList.scale-125.png	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsSoundRecorder_10.1906.1972.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\VoiceRecorderMedTile.contrast-black_scale-200.png	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ro-ro\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\WinSxS\amd64_microsoft-windows-a..figurator.resources_31bf3856ad364e35_10.0.19041.1_it-it_0369e340ceb29441\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-speechcommon-onecore_31bf3856ad364e35_10.0.19041.264_none_513ab7577ca57427\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-virtualdiskservice_31bf3856ad364e35_10.0.19041.1_none_2b308a75ce6ce4af\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.19041.746_none_e6778e5b0114e5b0\BluetoothPairingSystemToastIcon.png	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-i..plication.resources_31bf3856ad364e35_11.0.19041.1_ja-jp_6e103d4cd70a348f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-microsoftedge_31bf3856ad364e35_10.0.19041.264_none_ef195f564f00d259\WebNotifications.png	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-mountvol.resources_31bf3856ad364e35_10.0.19041.1_en-us_39638b526478ade4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-unattendedjoin_31bf3856ad364e35_10.0.19041.572_none_90e9bab3cbbfd71a\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-wephostsvc_31bf3856ad364e35_10.0.19041.1_none_627f4acf67956483\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\x86_netfx4-aspnet_webadmin_images_b03f5f7f11d50a3a_4.0.15805.0_none_7ab11546ceb3decd\unSelectedTab_leftCorner.gif	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-w..utinking-inkobjcore_31bf3856ad364e35_10.0.19041.746_none_0313bdb44a466198\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\WinSxS\msil_microsoft.identitymodel.resources_31bf3856ad364e35_10.0.19041.1_de-de_332f78b1ba58e13e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.SqlXml\v4.0_4.0.0.0__b77a5c561934e089\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-t..services-sessionmsg_31bf3856ad364e35_10.0.19041.746_none_18cbe45e21fb4fcb\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\WinSxS\msil_microsoft.powershell.commands.management_31bf3856ad364e35_1.0.0.0_none_9fba00a194c2da2a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-onecore-u..latform-facilitator_31bf3856ad364e35_10.0.19041.1_none_48593f2800494004\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-n..pcredentialprovider_31bf3856ad364e35_10.0.19041.1_none_34d7bae834408a02\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft.windows.r..n.client.powershell_31bf3856ad364e35_10.0.19041.1_none_a71c30bf486844b3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_netfx-jsc_b03f5f7f11d50a3a_10.0.19041.1_none_014838ef8bea39e9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-w..for-management-core_31bf3856ad364e35_10.0.19041.1202_none_497a4c9b969ee5eb\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_windows-foundation-..stics-tracing-winrt_31bf3856ad364e35_10.0.19041.1_none_3b597d04781f6529\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.423_none_9de80b9d881a1ebd\cssfileicon.png	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-p..topeerdrt.resources_31bf3856ad364e35_10.0.19041.1_en-us_dbe0af1fe100633d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-w..mcore-dll.resources_31bf3856ad364e35_10.0.19041.1_de-de_e4c0159ada5b88ea\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Handles\v4.0_4.0.0.0__b03f5f7f11d50a3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-a..atibility-assistant_31bf3856ad364e35_10.0.19041.1266_none_a88c5999d8585853\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-c..ngshellapp.appxmain_31bf3856ad364e35_10.0.19041.84_none_24f8aafdaceaf0b5\Square44x44Logo.targetsize-32_altform-unplated.png	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-xbox-gamecallableui.appxmain_31bf3856ad364e35_10.0.19041.746_none_0119299746221375\Logo.scale-100.png	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\INF\.NET CLR Data\0000\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..duled-adm.resources_31bf3856ad364e35_10.0.19041.1_en-us_b9853e8bc7b10d44\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-p..urepassword-library_31bf3856ad364e35_10.0.19041.746_none_ef08c10707cf94a2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft.tpm.commands.resources_31bf3856ad364e35_10.0.19041.1_it-it_abe65197f5a70b4b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\WinSxS\x86_microsoft-windows-photoacquire.resources_31bf3856ad364e35_10.0.19041.1_de-de_931afdd7ff62db33\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-d..adercache.resources_31bf3856ad364e35_10.0.19041.1_en-us_0380073191187c8d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-microsoftedge_31bf3856ad364e35_10.0.19041.264_none_ef195f564f00d259\MicrosoftEdgeSquare44x44.targetsize-72_altform-unplated.png	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-deviceenroller_31bf3856ad364e35_10.0.19041.1202_none_36057e94c281704a\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-i..ntrolpanel.appxmain_31bf3856ad364e35_10.0.19041.1202_none_8f7e37524c3e1a13\splashscreen.scale-100.png	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-t..unddriver.resources_31bf3856ad364e35_10.0.19041.1_it-it_b0a521f9fb899991\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-iis-logginglibraries_31bf3856ad364e35_10.0.19041.746_none_ff7e6acf5d4db486\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_amdsata.inf.resources_31bf3856ad364e35_10.0.19041.1_en-us_f61df630eb0c2b11\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-csrss.resources_31bf3856ad364e35_10.0.19041.1_en-us_9082189a80ce2580\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-pnputil_31bf3856ad364e35_10.0.19041.1151_none_7233d7a171b1272a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-programs-adm.resources_31bf3856ad364e35_10.0.19041.1_de-de_4065c710580f200d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-t..languages.resources_31bf3856ad364e35_10.0.19041.1023_zh-tw_8b37694f9274b565\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-v..iagnostic.resources_31bf3856ad364e35_10.0.19041.1_es-es_45ffd1f785c182d3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Windows\SystemApps\Microsoft.XboxGameCallableUI_cw5n1h2txyewy\Assets\StoreLogo.scale-100.png	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-terminalservices-theme_31bf3856ad364e35_10.0.19041.1_none_8bd71d601a2cdd3f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-onecore-c..shandlers.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_1026adf2c1fa9602\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-com-complus-admin_31bf3856ad364e35_10.0.19041.746_none_bb62ff5b8b9c7866\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-grouppolicy-script_31bf3856ad364e35_10.0.19041.572_none_42ec0e96ce977bdb\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-a..ionmodel-lockscreen_31bf3856ad364e35_10.0.19041.746_none_a1846c5cfa5f5331\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_hidscanner.inf.resources_31bf3856ad364e35_10.0.19041.1_it-it_5301a670d0dfc5ee\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-t..nputpanel.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_dd0f35fe6a59c5d7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\6.1.0.0_it_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-uxinit_31bf3856ad364e35_10.0.19041.1266_none_dc706e75d5c4b6a5\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-dfsui.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_da9562ebcf80dffd\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft.packagemanagement.resources_31bf3856ad364e35_10.0.19041.1_it-it_eb7c55d358e44f89\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-hnetcfgclient_31bf3856ad364e35_10.0.19041.746_none_79a98942e170e882\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-audio-audiocore-client_31bf3856ad364e35_10.0.19041.264_none_a79185a7b5aebaa0\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-media-import-api_31bf3856ad364e35_10.0.19041.746_none_1e3b30593f3c12e5\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-c..y-library.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_7535b577879809de\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-d..umaninterfacedevice_31bf3856ad364e35_10.0.19041.746_none_fe6a25d504938307\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-fsrm-common.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_f01ffd50e267370c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-network-security-mof_31bf3856ad364e35_10.0.19041.1_none_6c409dd882170ccf\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd\ = "SYOLECSRBRGHMIH"	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SYOLECSRBRGHMIH\ = "CRYPTED!"	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SYOLECSRBRGHMIH\DefaultIcon	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SYOLECSRBRGHMIH\shell\open\command	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SYOLECSRBRGHMIH\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\S5hKYdJLhQgBg3u.exe"	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SYOLECSRBRGHMIH	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SYOLECSRBRGHMIH\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\S5hKYdJLhQgBg3u.exe,0"	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SYOLECSRBRGHMIH\shell	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SYOLECSRBRGHMIH\shell\open	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe"
1⤵
- Drops file in Drivers directory
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\aic_file_icons.png

Filesize
50KB

MD5
a76bec52fb14ed69c99b4c0771b6b85f

SHA1
33b4f61c544de61073b2da0f1baa6ad00bf38196

SHA256
f2d22b32ca21800227e72251a472a7e4c4f61289d25dd830823c8b3a04154928

SHA512
493669bfe41f076c726064512a405e808b81a9964b35fae5edbf24bbd92a78dae9cf97543efff7b8d690ee2b43c09a0be3fc5db36fab67ffef646d7cced59c9e

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions.png

Filesize
1KB

MD5
23b822bb9d8693387fd9de4b0390223e

SHA1
85683f157eced01f190678847aa76e67e2992d52

SHA256
cd263bf047a84d4f8b20a685a3fa2adae256528560fe5408fc1935fcb5dbdf35

SHA512
938d50accb1166cb6223bdbfd07b93e86aed09ea868f82fd675a64d712d9b81ef90d501d620015cb8971a23c678d598f191b3da9ae7004d61ab77f632c427614

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions2x.png

Filesize
3KB

MD5
15bb99170432e2e1f02d24c90e26bf90

SHA1
d94fb9e57401d6ae7905c6ad9e7ee33dbe10d92b

SHA256
5b3cb32d2eb4f1e0c8212117f866d15f3aa77692841b0ebc111908c3d7b4e6f4

SHA512
a55ed4615da3d3f6694254627caa6a6713330e144e895f257d8a300eb8c249a3f524215f3efa90cffa4bd68cf8aa677ddace3a21653aeb2f677a994f4147cfb1

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons.png

Filesize
683B

MD5
8c06866cce7f7ce604a06b37fb2ff4d8

SHA1
19f2febbf305b845a8bccdc587633783a828122e

SHA256
a3d4864d7ac06509d4e519a48ede82416bbd2812dba1367187d9d4848fcfa981

SHA512
46c0dabb0b23592b4ce51eaf313e5d445b283b7e76c1555ca930f40697fece4188afa0cebf3469e993d1599e54abb8b6449d3b656bb31303ab5924e37bc83959

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons2x.png

Filesize
1KB

MD5
aba49f748854ea2231724e37ac8082d7

SHA1
4e55e2931233681664172466bd9956e7e6b59363

SHA256
9889ed1bb26be598e31ff3c89b626b0759e8131b4ad5bfc64e45432338e6a450

SHA512
0b9693db34c5b00d13e738e09b9f6887fb84bf81c2d2da0f168f4bcdde54ed6f52bc1cee6247e0e3e1ff7b7493e13997d3984c52022a4cdb781f718afefbc211

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon.png

Filesize
445B

MD5
1acc0e693791343767174505fcb87fcf

SHA1
af66755efe77c157cbdd7cd76e97c121989b4635

SHA256
a58516c38cfc57d5191ee7fcb9d348170e2759dd5af8bc5e309f933af3c443b5

SHA512
99ae4a8f6553897fe6de45e7424c4445f6f8a15058969c2a9da2926bba49c9dec8876ce5922a0ec75dd04ce1d6debbdefb48f4ffb98bfd91822ab35e8edd943c

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_2x.png

Filesize
611B

MD5
515add38b721881ada4365cfcf77460a

SHA1
1bb03d47bead5ca5952fe69b40dcec105158cfa1

SHA256
659a125f00504d619b71ac25dcf62a70edf48e2ed55601462f267a4232306ff3

SHA512
3626d7ee2fac4def2834983522661e5edec6110bad2b92b98be4226f0f9a6f40549e22d3d90564fe5ea7b688695f86d369e34f59fa47b7fa49c445098635e19e

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover.png

Filesize
388B

MD5
3dd42814f3c8a1ab07a2ddd7de7ec284

SHA1
74ba1309b08ff21f0ffdac5f0694533d06fa0a86

SHA256
c873a110c1fef49fffdf01d825c24ce62c3f90806ae69066c101c4782ee94eb5

SHA512
b6bf328461cfa336ddab9821718215031639a29d61f04945eb597bb349148bb0a6aae717d90c3b6c19486ad2f629950177469d6609deb57a9bcac097b64b74f3

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover_2x.png

Filesize
552B

MD5
79f9b4b8010338ca535cce3a3576359f

SHA1
a693671c6545d9df87b2238d8dcf81014e963719

SHA256
85783345eacb3181a90d66911cf1b5adef1be433aee80ce4ba879f7c26d1b6d1

SHA512
d22462c7e521f827cea09e4a5964528c29ceaab58af6bc3b3822f869a263b437b92af9bb5fd0bb0d450222682ca5174664dc15aa57ab542ff0929a23870301c3

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon.png

Filesize
388B

MD5
a91f1056c0042d9909fac7b285baa9ae

SHA1
83a4d2f243909bb07aeb1eb6fc48579501c08dae

SHA256
0eeb06801cdd57438d97e16853eecd85f3b2fb57d84249246480f54ddcc23e4a

SHA512
466c42d9b4e61e2bd7e3165ebf58b7dcc40326099e233ef892d4448dcdbad2d9498b00ad8bf8c1bc513f0add0c6c5c949af3f619f1a9cf163e47f21915869dd0

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png

Filesize
552B

MD5
4b20f9c482b6c1039771be6c1d87ceea

SHA1
fe549a8e92523151423d2a2b52eb1ffc670d0656

SHA256
11954f0a3af9cde649af9267a54b6e7d4ed0543553a291cf3242edca8f79284e

SHA512
d2723a0471b34e25f6acc2a3cee2d7989012bb45b1303a69a60f311faa6f2040d51ac94b3a22d04e2caf3b5562410bdbf3ee9a24a879e3b8dbfd498ad3bbc893

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png

Filesize
388B

MD5
c79b3a7b9c46f3ba68a7aa0f561af022

SHA1
992076b180b7a2aff7193cf18d0377c087c5b0fa

SHA256
08c86e71f6dd5b1aca769bb2236375f31efe515d1825d40d292971f66bd43fff

SHA512
a06ef33ae1ef4c008ee0f9e749a346231f0989ca68b62f845e6cd027876b2fc04f2c4725c85322c88230484639e886388f14cb8e67f9b79494acdb55b35131c9

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover_2x.png

Filesize
552B

MD5
fdfb590f060084e6b49ed120578fdb8d

SHA1
e2de11348dd973d6f5e6c09dd062f1b06443a970

SHA256
e002040484f92e6ee25834f08308d58baf4cdf26108b2cb63e6799aaac4142d6

SHA512
492acf9d75c572511069148ad21a358d21cd9cd4a13689162c6c11afadebdaae0c6aaa86f65c9b1a51993dfa174034e346ec87d706acb2356ce2889c7906e434

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons.png.EnCiPhErEd

Filesize
7KB

MD5
95eabb2311efb9cdc65ad17996bff042

SHA1
2fa42c988ac176074475f3ba892f2abcc4978eff

SHA256
077fee1514e4c5abd292344f5869e27df4b97e35a49aecc4fb156c05abcf55f8

SHA512
4551fefccb8cd3f3f56320372b333c960ef8619253b9333ab724417ac352d150d8c01456f97d6ca1349ae0d76f4f5607c79d01dc61adfdde66d13033a5a40244

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_ie8.gif

Filesize
7KB

MD5
e4cddbc2afa131b759f557bf7a4d4106

SHA1
a3bfc71958433dfa369a1daa92f71ea62a4e281a

SHA256
67634a41a8136335f22dc9c7c343085b1c262b576cd9f562b8785ddc3388323e

SHA512
5d1d6cece9a49edbf36db87cff2002faf2aac86731fdb00c92ac5f33cc5918eda11af81537f794becf88f022296e59569c73de13cbecf085bd56ae7b067effb4

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_retina.png

Filesize
15KB

MD5
d0330af95e3383c5d1a3755d5013fa4a

SHA1
3eaa9563df56f8247c0401085511bbd9d1ca02c9

SHA256
0538f5736df24ed3ad52e7b73b0502c8ba2058fd91ab06b2eb7f1c39912f0366

SHA512
8bb251854ab9657aff35390f63880af93abf93c6d2812125a655677160e82a65e014ba2da979b7b7b5c34fd3d7b8956b4955312ee25d0cd875990d13a054bb95

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons.png

Filesize
8KB

MD5
fef1ea514c6ebc0f3d4f6113b1c50a8d

SHA1
2d54256a68c20fd84c8f95c4cc55340316610449

SHA256
f8a199b03cf446ee53d1d267d487891db9e90ec138a305140cf371d42f166aa3

SHA512
40d8d70f43b46915102b50b3e7ff04e899e4654908b85741f913cd5796ed3c76e87091c31a262d44e5023da36dcc7c36c016414b939a9e6227d52da78046cdfb

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons_retina.png

Filesize
17KB

MD5
6115872daf9194109eae4050f906fde8

SHA1
cf1b905a16f76346bef2000b7f846012407f323f

SHA256
8375126f39ab83eceaf31befaf98a9bfcbc4fa7199949088c776a6dbf98d1779

SHA512
df4d5664539ac1bae09b69f2a9bb75376cf6edc38a4b82c11b90476b6c6aa6f1654c4ce9b71d103ded75777848d14f22166c68a39cd0241ad9343eca9ba98f9a

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_pattern_RHP.png

Filesize
179B

MD5
fac6687792fed6ff17219550105344d9

SHA1
593aa9a263011683c4fee9fee5fe4eb7316d5e68

SHA256
c979f5f6d16e09e943b345ec30c0959adad64ce86a63a243da0f859336565359

SHA512
122f66864966d1aee68c441fd9f83ca3194c193f472247d7b59f8df2a548c8de8f62f5b9b25c3e4c68ecff27a43ddbc79b7103f1e3cc0645a67b0e8e5d62394a

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_patterns_header.png

Filesize
703B

MD5
124f9fd4ee82fd51cd1bd15aaddc97a2

SHA1
5aac486a9533f13b7d3b213569349740671c3a2a

SHA256
f3a63ab3adedc5c5a90f717a243734080311b83116f622ea70624a7e31683134

SHA512
19eb06b6bd5128c134fb681532dd218b8e17815578ee82028211d83e6bcecaa0c666babd720c894095ddd03ea457eadb7387764573622e1b2485ddc7c8a1bd04

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations.png

Filesize
8KB

MD5
77e9357abca0685ca01a9addc887f374

SHA1
808c4db6ad48599f0bcc5ea6bcfd3dd7ce8ac100

SHA256
d6941ae7fd021b1bd356e02a6608f03ebd1d81db86c48020c4ad66f1922583b0

SHA512
af9984552bb43c07fcd66a690fd999022df27b3f4696106f6f43560cf4b513ea18fc1deff0af2133367b115ab6eba2ccfda01d467f565df3b68bb4a380b5a675

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations_retina.png

Filesize
19KB

MD5
8063bea0cc302f85d5413d3cded31892

SHA1
fd92d6c23ed469e7d754cce1e7adf59bbd46590d

SHA256
4192df2eae2ab3fc99c845f9009d88e40e056dd262fbc2b2d51d51d566e0f30d

SHA512
6ade0a7aa37782eb9cb6966440f73a1b7529bde51cee057425b0d1f31187385c08b630ac337bfbaefbf831dc907871b67ea60f81dd1d64637021af8db14e5b18

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\faf_icons.png

Filesize
6KB

MD5
b877494b3ce985104912dd48275e8eb8

SHA1
67f661dfff45c8a9fec9073faafd0847cc50181c

SHA256
10f12a332716fb7fddf068ca49b8e6aacfe931c3ddc9504af1fa92ed4a48f66d

SHA512
9290d53e31dc2766af310b39138f181494d6fd54c19a4af1b3e39156f80c3f5ef579069c7f8d09cc62cddffa976e8a29a513273657981e7c3a7650e19a91054b

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\bun.png

Filesize
2KB

MD5
e37bbb9a38f5db287d55edb6e2fb569f

SHA1
6cb6c152dff0f58f14d703656d66b135c8c01374

SHA256
13a090799f1d77a44d4bb53950d5b510cd0ecb446857cc6d699c05d3cdbc80fa

SHA512
db07be0ee16eb61502becba90e81c6420321bce090983d9176613a3b22f69e8dbfa43ea3b6b7215ac1d88db7e4a6acd9c20fa8bb0ad6202d56aee7e13f691e5b

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview.png

Filesize
2KB

MD5
c9b24e5a90c06abf7f6cb03534e2fb06

SHA1
2f3f40e102aef14ea154d98c1fc1301c666bce3a

SHA256
9431493e1d26749cbe20b788f0bb14a4c10a99d61c168787a578c7e6f2eb8b0f

SHA512
4a6745372b71256bdfd7efcea89126b4247833b556a4281da0f3cdc356763771a81e6f4f399ba0b0ead9cc613686313fa06feeaad77eda6a0598c5a75ad43d70

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview2x.png

Filesize
4KB

MD5
1d1309fd1283e66fef201fd6a8b9bac8

SHA1
832ebe756aa3ed33cb6341ae83e628ae5a848226

SHA256
ccf6b0540c2032ad0acea2408a843d2fc8e9bc636ded03ccaa1751eb32f2df4d

SHA512
dc4ca90206d72afb51b93ff9ae1485360d4984399bbdb0a5abf2718a0220dab5f32125892b891c856716af8814f5120e2f557b43992137b711102e4c2be74cb6

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small.png

Filesize
289B

MD5
1e777518191c2973e5ab9de1909ec5b8

SHA1
64df1f77adf131c4d7702f71a55cb95ae8e832a8

SHA256
d27481af9ec1c4b7d689ef874dc8680f42b9b9f0367109a00f5a7899d0006285

SHA512
4acec000d305e10be88efbbd6709abae4e8952e20fd46894263097de361c21bd5bdadac69e88f3e9943ff4c0c77ccdab0c9af19fcc3fd691e4589f7164ba96ea

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small2x.png

Filesize
385B

MD5
0924e1286f932c5e3f2ed7828250c09a

SHA1
4a95ec4cbbfae0b42382aa13853e85d9e6e63fbf

SHA256
e549f39fb22ad0c95e1b7ae8ec59e1079b1e8940de72327f3af95e4666686717

SHA512
0821979b5c14f2bca71df2a1d7d9f90ba6445a6881a2d9ccbb0140b1af14d1a02aa0f31d288d7113a3c53b3688fe00f76de6ff12d3b426e1dc8ecff79cc99499

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\illustrations.png

Filesize
4KB

MD5
8da138ff1e0bb74b9b7cc32a97ca9146

SHA1
9173dac3c82de423027fdef9c8052256aca6c4d4

SHA256
a2f12bfd464a2265fc281b27177fee70f3d15e05eba8fb3d4fc67e29bb350406

SHA512
9a21b2f728ee23d6d73e56325887b419f45fccec014ff6647cac55879f63d72f194be13f96fa59221d9f69524bf668c67b4c0a4ac40540666f0322734dec76b3

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\nub.png

Filesize
1003B

MD5
f70bb1acfd8e08da0e0447364856bf1d

SHA1
cdb1470b4933c68232ad4239a633297061a23a1a

SHA256
3f9b9577aa3451639a3140074438ed598a373c0e81480350e0be8e5e0f8e7a07

SHA512
510e0ca66f26f85dda8d5adf1e3a9ce3d421bc5a7a700bdbd5f9b1d12e9ff9eda55834d3b2067d07eccca41424bfc542a9bebb6bbffbc6966d06d70ed1c822a9

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons.png

Filesize
1KB

MD5
6e19edb1ecaa1b4bf18d166b53f92ebf

SHA1
f98c0404f328cf3571c7ee17fd48ce4842c8da0a

SHA256
2932d2ecaa7e007b75e92d72f569c7778cf914a0562776be32d43c8cd2095af6

SHA512
6b9cc559bfab12b396e6ac4a87e6a530a2416300048303ebd38a1b7034d1b1120f5ac2b8ffd0c24a8c799ff0ed944a0d345f48619ee7d4cb933359545b3acf80

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons2x.png

Filesize
2KB

MD5
d5675406bc76dc2736c25c86f9850428

SHA1
b91638295731598b2ba3125557930105d9f35399

SHA256
7c83f7afd966ded9a532e9c36b4f606a5bf460eab0fa049f490d9d7761de42c9

SHA512
cfc71d307a99015d963a1ba68ef1d4d276d2d457394b8c2910ace84c25bb967be21aab438c2c249d60a53aec29aeb3ad424bec63d1492d09dd73a4d96bb59283

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adc_logo.png

Filesize
3KB

MD5
eca948d559cac05cc5efbbdfb9c3197f

SHA1
58a29b5116e2f590761051f86364d9dc6138a25a

SHA256
82aa21eb84e3a787080acfde90a72ccf33e644ebb213089bdf7fd0d2d1cea7df

SHA512
a52bf2c764d525f18e6ef8d1ce5c1030c91b0cdef055771c85e1443b03cd47a9fa5005a1c68c16bdc2f32ed73a2629d429da4839f1e6bbc5c59bf40727682373

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adobe_spinner.gif

Filesize
556B

MD5
329d24172d237e8c0175d7b88c9f78cb

SHA1
f0ce796de833004ca154b4c334da598587c91ea4

SHA256
1b4b43f52322c18dc5d03f5f4d0c34fa7559784a7ebf8ac7138c46814c041243

SHA512
866d9a6a08c235a21b78738f6d47ed21da2f962e228eafec026967feab7731945dc342df24eb23020d5366123420435e5002f05ad876766ce4da5987ecf26ef2

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\logo_retina.png

Filesize
6KB

MD5
ced9fe4a46e5b6f07536356f361bb67c

SHA1
2d92384668496ae0bab08d173b86b51d1bfab733

SHA256
13b213d34db0ed7ee99c2edb02530e2d8bccd4d68c68feae5936b19845d095e7

SHA512
a70ff62785794258d5def8dfc494e18ee388e3a9b794918867dff4d419cd6b4c1a141ed6d5d55ca9f55fde57fc38a75c62e59ba5ac60c0e1c2aa4bdc958cbeca

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo.png

Filesize
826B

MD5
9eae4f5058ae8498771cd4b4226c4449

SHA1
b7e6e2ee63bb1cea603895a9bee9f8799320853a

SHA256
4a95da63c1813dce50fc545740aa072d2785cc5c1249a097e0c602b66251631f

SHA512
8e9da4a8771d8ce52f83cc8ea44526c4c4122a29cd0ef7b63d97968edc3ed055f3c30957e55cf0999504b8126b0c11fddc9faed29333a871777d63e2c01f14dd

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo_2x.png

Filesize
1KB

MD5
29657e447e774bcf5808690555c9794e

SHA1
6ebcf6064b60a1d19aff766590214e4f5d44a85d

SHA256
01c1ad51c9e5351eaed5cf0579bc656b6f95ddaaf3bd0b1a408d420ba863d852

SHA512
c7ab84d08d3bae0fea8a8c3340f03aa4416e054eb0f93818b9913c718bd1939ec302d086fa28174219f8b9a566734a0156caf773715b464dd94a0dfb9488b04f

Download Submit
C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB_EURO.txt

Filesize
32KB

MD5
631f124514466c1ec7ffc75a4d796ec1

SHA1
b44b2018bc51d318d8b1377e4c2ff08f3c23f53f

SHA256
b22a787209600056799cdac592cd2d2d4491ce8547e46aa8cdd0cb9511465cf7

SHA512
ce07ce122d1ae157d7c3bdcec9157bc9f8ed803f71a6570852c6038d3ec54bc61039b10a3d0df44882c3b4ac8180a4ce2aa8df6342b7b8a8de8067545de3cea0

Download Submit
C:\Program Files\7-Zip\Lang\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt

Filesize
291B

MD5
0e823b2192841b7ab657d598c7f8d102

SHA1
39334061db7b29c4ee2b9ba2e665602a57591ec2

SHA256
e9bb09224381f242827be7da5d3af8deb7caf0fad06179f69e9d41efa46191c8

SHA512
b50bd57d06242c68a8549a3885040b3809cb238d7f777392f530ed4569b0cd099831160bd68f9a898f3914b0379f1801f83be97680f70c08d96433e650aabe9d

Download Submit
C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif

Filesize
153B

MD5
0881c11a1154327c5d0405545f4fc35f

SHA1
be0b73ff518fc2742bbbbc7b4a63b909837c74cf

SHA256
9ea1598e7dec64d9d1a1121415d88730b17b3425c2f401796af72f9acc2197fd

SHA512
a5db6d3e7768edb21668aa681bdbd9ce7e9a1787d561f3b678b4cf311633047a2a1c2113cee79c79d1591d1407d516bf96aaa6c4bacfda79bb15b0f855f14358

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt

Filesize
190B

MD5
bcb3af218ec78505bfaee20f53ae72f5

SHA1
2ec39dc261c8731610688f30f45083d253768202

SHA256
549683b2d956030cfaadd68936a9db602c7e0c0dc316a4bc78536932bd271c4e

SHA512
01a35f8fd171f38362a72ceb37f59e249e668ccb26e37bc29d09f5f8040053edaed3aaf95098f4dcdc9508dcac6e69f563e443beb3973d6817c41adf0a686681

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt

Filesize
190B

MD5
40712c6111287aa1df2f2fb1e426d806

SHA1
f4b7e0cb392866bb867c16eafeaca12b5359e3e6

SHA256
35d72f349f8bad52f91e5dee2ca46639950d222dd53d5b044f7103e7176e748d

SHA512
09a173feb785227e0d93a8cf3b95240c9f065249c541184b2ed2c23b5ee7c41abbe157d20400b4c1079d807ee4a044fe30a6222e429b7f3a080e2eab90520767

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md

Filesize
1KB

MD5
f6cd2b82898d70e769e1871a02db1ecd

SHA1
d9c725b9ec9967c727f7e7a3705508e25072cdae

SHA256
e9bf267549829313b69f69fe0c92179b6d6d21fa2c02f216d7ecac94b069d082

SHA512
d082bbc8be16b8e2b52ebe704008255174a7ce70f7f577dfe881a59674b402aa2fd5a2c24deeeab5b1d0731f730934e411c14a6dcdc5a6cd6f9cce4d1351c54f

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\glib.md

Filesize
31KB

MD5
5ccf1e266ad9862c87dc2242feaf28f3

SHA1
49e818ab419c0c44fae6adc37a215821277ee97c

SHA256
021da554ef56da3afe6349b0a0d72f14c32818edddbba52f2309e4cb5ef54497

SHA512
4ba4e948f2f47be65a308fc669110fae023d0d7acded92d17559c5fd04f2c564fa6ce7021a00548fa8473f0604c05eb15802366fb798b07cc9877084e11f0a5b

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md

Filesize
34KB

MD5
7a68b95087b66ef7df63802da1642bcb

SHA1
80bc664346a68b2bf26f5dd393283a684172fa89

SHA256
7880de740fc5bc40be950fea1d640fa743bd33ac6ca3f4501146ee6461964013

SHA512
607ccb64acfe2c82ab394453f94d91be408debdd2f7e9f2f91c4bff8996c2551f799b6bed5ae6b40a2d1c1bf7af8634a33c8e3396857424354a151cc92785463

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md

Filesize
23KB

MD5
9a33e394d94cdccbd962e2138c426445

SHA1
76fc49cd3fd07de24f418fda8a5f30305a4b8509

SHA256
94b0f184f9d5e71d8b59deb3395fbec6d0a3f9278c73fa3ec172924e3253bfc2

SHA512
f4f0656898bd6b5426bdf12fbcc6b34605b82696c8d5a4074aa5e2db99638e122b0fc377d130fdf06689e1d8d08e5058f87776df77b055863413063a3bbb8917

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md

Filesize
2KB

MD5
ab08abbc34b4c50af14f5ac66947c4e8

SHA1
a92dec1baa91468c0831c755b91f6c7466636874

SHA256
ef492d015895ea784d30c0ea866234c706d2365c569f58f37e13e9e7049e73b8

SHA512
3eba2fffe4871ed503d6d574f37f0a6280987d2ceef941aedab01d6ff631cdbb3963a1bb7197bbeb68f37247927b2c13776e6b491cb50c8fbbcba060db71f38f

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md

Filesize
1KB

MD5
1e52f45a9d6c68e93c941f1818905189

SHA1
1b2d6c70576746202f6ed095900373187a718e25

SHA256
7eae27dfb80c992871d12caa603e70d1c82e7c69d24e87814251c524d9372bba

SHA512
98a290167c5e992f69cae41122169c008416782d550f295a83e6dbc63305d30baf9327aaa1938140c18eeb77ec5221f957b4a987d019805449b8e4a421d9371d

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md

Filesize
3KB

MD5
8d12e9ef2c9cbf1dad5ae01fca862345

SHA1
f3b8b30b0d523784a288aa336850f79ddf831bb8

SHA256
8adac91ac5b3153474aacfd293b2dc27bf858514da5c749a154f6bca4637256b

SHA512
e9e91ac773ea80b38f22d08cec6e0301ed098de823ecbd0aa10e1db3d1001765c30a8edd70931d044c2fab52eb0fdb62aa576cb34e48c2ecd65d3426a0775cba

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md

Filesize
2KB

MD5
4724165d987ed9d4653999557ab278f3

SHA1
4f5a36f4db1bf38cca672ef039f681e2975f5bde

SHA256
7078d46cbda37e2b5d95833722e94f25a9be80e41d36e5da52d3269fa683cad6

SHA512
6e87f869396daa4bb444e6ab1d4bb4d13116700c0f8e7a5bb6db12700fdd439b55072b381bd9381a1a3eb09cebdb588259f00f56e6b3bf6afaf1c255bad3aa10

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md

Filesize
5KB

MD5
e2a7d22506020b54011e1800a170052c

SHA1
9f75e2d2173f8532a1684a8b5b9b73d19f1031f0

SHA256
cf622ce7d1f817439c4de75db6307ebe5f0f70410f038fc272a7f19d6b3d18c0

SHA512
94a94cbce3557cd2620d04487f0b6ae043baf61cb8b5c5c53617e7965cc513ef8325af65109a3c999c726517da03b3fdbac014d5488ff70e0849bcb89fad9892

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\public_suffix.md

Filesize
17KB

MD5
08e7a1a0b7015e6a7907dff10e7eabf2

SHA1
c63e5374ab63a7bfaf2fabae08700b53f16c33ae

SHA256
e857419524724341b06315a49d6649817ef28104489a21b7f80be8d8f0b40601

SHA512
0392ea023d720658f0e7c453b759f63f1f5995f5ca31c426aa4d867f419810e886d7bc978d2eb963b6a98d84bda2615bddbed1f833315ecd0260dc02b96ab17d

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md

Filesize
320KB

MD5
950c2fe51041323d034e43f957aeb478

SHA1
e722ad06afb7a930f43f58dc7b67cd977bc4f6b9

SHA256
b27c14b74c464f75fea94a264422b86319b45a5826ce27589ba42018d8172fe8

SHA512
210492319412d3129b26fa55beb9bbc4243f7d6c4f0548ea1d97283a360d8c8efbe7d69a9add8f497014f9d2bb36ebfc776120f120e891c8d2f4073506d14537

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\asm.md

Filesize
1KB

MD5
314a7e444b6d59ed73bce81118db5cc4

SHA1
8702680d41ffa2bbc3c764eca68edd700c8e6c7a

SHA256
5a6897ccad1b7c20a01923cf8c4a738a4d7d18e9087a8a9bfe86d8892308f507

SHA512
264fadf7ef87838fe96f7fa037d65e2e5c907587b0365be66aca033a111698a81a0d91345250c3c6ba88b4b49643c97a26ff00559b1b7d3acf6f956881615e8b

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md

Filesize
10KB

MD5
74050bf22872aebcb15464d1f0c0bea9

SHA1
cdf49e03995d2386c75f4958bd6aab763554c57c

SHA256
09e52c5517ce348a1bbc53251e1e71d197d1ee5af189e4530280f70dbb3c565b

SHA512
9fc9668667fa4f56d93b2b1921909c3a10111177fe14d28757648aea8084cfbb85195176caba6810c4a9d5787f651cbbc856b80c9849f03a4e1327b751e8ffd9

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md

Filesize
3KB

MD5
5d6d44f1fd2c6fee225d7c815cb250f0

SHA1
8a735d215b307887ba6c288a6ccf685d42bbf84b

SHA256
e995714ce31a4e4a2d73060cd651bbaf928f27fbe9719090f1e318492a920b54

SHA512
5ceff2791f86e144a5b7396140dc333f400309702f68ecd17a91f296f59863297d8eee9e6627d1f209b2c73494b3276b1344d98f5ecbb06e9303cd2e20bb63f5

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md

Filesize
162B

MD5
8056ada4540bfb531bf5364d05de1736

SHA1
ec4b355bb0b09f2ab378078aea26598b5c82b935

SHA256
d16dcf0989b83192f7c1f845c87769060db9d483de16564cdccf81eb5da16c59

SHA512
8434dce69b6f4f23fdfb868f37589dc074f0429e8c7d487a4a3b675d52aa4ce042ea89a5328d5d302bbcd92b5aaacde527173ec33b86855bf21d2ba0e67c4bfc

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md

Filesize
1KB

MD5
2c0186bcf1ac0e0f7316c5a55ee239c9

SHA1
3e20f136806c44f7b6fc584a48097e5953c289c4

SHA256
269997599ad704ba6ea2125fa1e784326eee05f8cae7d2f86bfb2b2fc75c9833

SHA512
0e367d28eb54a27ff05f1e175f1cfe42d5b92fdba5eff8fc309ea968f03555b5d6302046949ae7a3acf96b00165d854b9d391ca910ad72eeaab7683363db19cd

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\dom.md

Filesize
3KB

MD5
35d6d91f1727fff5af0bc50512bb1359

SHA1
e99802d1a40212e192657de60722abe24ee2903e

SHA256
beb003f4449c8adcaa548c9a3a46a731d1e3ebcc7e347ce865c2b275ca2a072c

SHA512
d18c29be20f3225914640088fdcb60bfbee96fda38577f69467513fd5c911f0b3541b88c836f9b2f0e474755ffcd633ee6f7a124d5879146c9ddc1d086a53951

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md

Filesize
1KB

MD5
bd84d2cfc789c79ab31801fb96d0825d

SHA1
2bc74a77b08b15a46177dac5b5f411717daff9d0

SHA256
37885fabe420f95e8b5679b6e1591257e0e1c1b72f473dcde3000f5091219d47

SHA512
88fd5d78cfeae669749fd27c5a6cd7313c56590ac1b510f0b3355011c0acdf16e73dbd8d1e1c84163f3f4ab2a8d8a20e846afba848819b80b63c6dbefa091db5

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md

Filesize
28KB

MD5
41b30487e21989c87f7c9445b90cf95f

SHA1
04ddc6cdb9334e0304da33df325b13db157a4e93

SHA256
08adf7ec19d7755e791b77cf37543784c7774b21808870f3552004e867b58ada

SHA512
f3bff0dc46cd752caab293bac9ba73b6739247c017978a88db13dab11049f00745285bf4d06b8c016bc9d1b690fa29eb071d603135efacb208c720404f1d3707

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md

Filesize
2KB

MD5
effa6baa6a75d1c857fd84b34abc15af

SHA1
5d94a549eef76dc39ab5f1315f8f2cf638757e55

SHA256
653850bd4613310c501c82224f0a7faca0630da8904dc5347fb918b46ab74bea

SHA512
8a7b69e96ed45b012460cd56296a7491c44631c4bcb2fa5b189d7bc69dac04ce6d28c7909647923bcf56229ba5dfa995c4c3383601688ac0fdc0042f98be3a12

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md

Filesize
1KB

MD5
5daa086927215a100ee6ee95b527c3c3

SHA1
55f755a31af978603cba361cb3b290af20057921

SHA256
e0f8afea579782d1724b2a3f72e8e31eeeee73bffbdf6e06ac79921da56e5613

SHA512
578ccefcf3109ae517a2826fffa55abef4f7722db990b3f58f498a1a46adb5b49c67bcc0f25058391225ddfdd82abc995d593c986df17a8853c9038c3acd5598

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\icu.md

Filesize
2KB

MD5
5df69dd11b398de5cece230ef4a9dfa6

SHA1
07256b1713211a929e27cbf80b2b7528d1eb62be

SHA256
eed37aa22db77fcffe2adce4bdd8c4b812a1babf76230ea8ec4ff167afb2846c

SHA512
df6138253b26f39b3b1ffab5dd653a9c9a8bc2aeadf8a72e2a4fc114b6a58632e2a4c292a28a2a0550896284e4224fd61d88d927b87f5bee69b0e64f319e2c85

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md

Filesize
1KB

MD5
2c076c0a42afb7ba7724bf5c5b526e1c

SHA1
51eb952f83448a8cee86c0bcb428b29be302efbc

SHA256
d6085aadc88fc537dec48eda39eef1e647fcbe21ca03aa9f6cc58b1f6d593f2d

SHA512
67bb7c72359c20e29fe695bff5db7aef4292f4a8933ea81c6f5f4c56c9b1acf56a7ce8d7bd97165cdc69ddda14ac53d43fdc8969d56c352e40970965d63013b7

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\joni.md

Filesize
1KB

MD5
62325245bacb5354fbb19ee4bd073c5b

SHA1
f43c461981e1aaede0cfbf3b9793e374d2e3bef0

SHA256
7e6bad98da4126f65856fa4d66acc562a6499e49bbfe78b37e1bc5f4af43036e

SHA512
c02a50d44b4a23c577be773f47177c9978702697bf66d9431d02225d966298461e70c8e53e4c42eab97adea4d9bdcf62bb9b85180bb0a7b9e2bf9fa64b893037

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md

Filesize
1KB

MD5
bdb57f5c84a92c15b11906d526e87d44

SHA1
42bbe83b107b472dc436cf37f6dadcdf7b2ba792

SHA256
89190ea7e69c601248bb14b9f5c1f45de1b6e71b7ca454f4ffdb80f4c3bb7f83

SHA512
d062a4160d50b9124b6094a2ae44daf97572c3b9553147a6d41cd0555b82cb404369dd83e84fea2e9dc45597532b4a0e1822d0604f6bbe97217fc4515ffdd4c6

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md

Filesize
3KB

MD5
f7db90fa9c81ba3a323107ca185da2d4

SHA1
3ea6afa5c18cd66d121393dcc26cfbadc1f5e511

SHA256
d8f3c1a4fb64d2625579aa8fefe2b707d2704466038211043910fad887454205

SHA512
30f616cec0a775f711b9ed14a21b9b3c1309dc1ceeac754ce7af69b81d5622236ae4d08a3597d79159f1bab953214d9c7327cc0c1fc25b466f0e0fc1b9b6a7e1

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md

Filesize
2KB

MD5
50da240cd2fec7f6f18a0fa0516c8df8

SHA1
fb7abccd446d67235ba3f8b70e11b9a3b0180724

SHA256
9696e03b4e95d109706f723c7dd5219cfef583329a6d264e0392b4fd35838252

SHA512
4b76d870ebd9b56de18220ac9379002c80e028d5339dd8003aaf6b7c0faa875cf472f6ed4911511a19cf9e5db8833c5cfca0a5f4e08055fafb18db9351353817

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\libpng.md

Filesize
6KB

MD5
4135cc7440217d1dd62965bba15112c2

SHA1
2fa116574414058ebbe6011f0f73b819fdf86979

SHA256
8ae49455ed8d63b01d0cba330209427aa17bdbf742ffb13b3c711fb1e32412a7

SHA512
a40a09293c64a78d3a43c192ca8c54b62f7f0c4fb98eb1e484cd1d1b256a780afc96b5446594ed1c6d15ffe873d98bc4e16bf446ea46ecd7f74adf8cd14da88c

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md

Filesize
5KB

MD5
c76eb47aea7f549a1e2d19d06c2ecc1e

SHA1
36d9bc5e9fbe73229d1ebec54275cdfb5f3afdb5

SHA256
0568665cf887705943ac9aa6d5a68f9f9263d308eb8951c6d504c56e09788345

SHA512
a1b608e127bdd1b17f24b320c94ff6b321dcf091f97a8e7d7e478d511e0102685d1b16420ac82dfd1d36fabbf5dc8f551ecac841224938020c96c7745b39fc2f

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md

Filesize
3KB

MD5
38c9cf8db2d8d09240f8dcbd38eb33b4

SHA1
fd094d2ff0eb10ca752bab45711e3c8831f3c808

SHA256
959acbbae88199d9d049b55861dfc7aa4f7fac65cd6608688943dfdda8b520d3

SHA512
79730f359dcdb2ac9fab1f757e104a723d7ba8656d72f1fddb1a1a44b11f84a5c63f898b4b165617499e19398a00a01ff2ff87f000de80a20ac6a480bbdf6dc1

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md

Filesize
2KB

MD5
b90bfbe27da3cd73b51f73ba6a21eb29

SHA1
5d8bd52452135bbd21d86bb1bcb09b7c98868352

SHA256
b2bdcf774f66568e934444bd120eaaa76608760d746850b9249a62e38ce09443

SHA512
7df8d817839d59578af0e37c516dbbbaf246a3dd66cb3dd9498b902389c464c5d3f0761eddef7960dce0ac70d0c7311ce8fb80980173af5765e6de2f5b720443

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md

Filesize
2KB

MD5
1dcb70eeadde3d980114ac0ae91ab780

SHA1
c6bb58ada448954dc310581a134177f4690be559

SHA256
c049326d6ad9cb8fc5d7c3f36c4e841dda90adb028fd7a27bed97a00c54742f3

SHA512
2f630de436d49339b5f9fa5d797b1fd9f15651257d85924b697bc7e8d1ee0c8a0d102ca00655b58fd889221cc4dfecc3611483e7bd0abc451181401cd24f6782

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md

Filesize
1KB

MD5
879bc36071634e33296aaade41c5f509

SHA1
ce0fcfb17d17187560f798823a603ff4e5b99050

SHA256
86772bc02b8df1d0aa20d9586ee9756c1c5d98fabd8bf3a41e2b19e9eb7a3898

SHA512
8a4bbd8eaad0e21e36c9fb8bffb995ae24acf4720383085081012b36dac2e76e3ced7d077bcaf3be4c5a260c81f8859ff0ae0f3bd53451387f7d3214858ff744

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md

Filesize
1KB

MD5
ed51fe6dc24d294cbba7316544c35146

SHA1
5f69ecf0fe2b533f276f6c49ebf83aba2926d78c

SHA256
607b6f249b8b9a3259da193de9cc599a7a8cfbee4e02e15b061c5cf667df9a12

SHA512
ecf09f2af4b751b6eeb2f363e9eae5a1b515c256769e6ea0d0cd1a52653356d209e8683bbe3f32a8d42344ddde7acdd1527a5ae61edfa011813e78c6e343c12a

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md

Filesize
11KB

MD5
a34dac0031949474d3a5d0f4846fbe58

SHA1
ddb9c2e611b468de465a42a4b3d194c088ab47f3

SHA256
bb988e650ab8c991a43e91e7ce26ecf38124168a364e3570b13ff141403c4f21

SHA512
017881e38ffeda1f17bbcd091c894fbe49ea7b9e3bd210e5a5f98d0eb82a10d82d03bdcb3e7c36d6954e66762311f905ab7a133ccf454abe4d5c8d0473bc27cc

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md

Filesize
1KB

MD5
88f6d94f9958a86e754be2332d70d066

SHA1
e034e08ce484ca16a203503ee465d693633c2de7

SHA256
ccd5182f2257be78eef22fd6acc7ca1bdbbe778e17f3191913e3e708e1d56be2

SHA512
8293eaaaa7454856d973bc9ff7135e00feb99827f1865641a77d546f0d0630e8e3fd4fca0aaaa99a5d719b1f81322f9c4b0f975bae3be21faecc28e605f54a13

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md

Filesize
2KB

MD5
4f0be08b7c8cf62394edf48158ef9d21

SHA1
ffbc955881b8ba632e4c02c2cca5a8ff1c7d16cd

SHA256
eb9ef610f7a3cfd17e97e64b30649fff426fac6176ac460e087e5ad009416588

SHA512
40989ff2949a9fc6b2b9e46d81331e2c4754a7c9bbc5cd0bf8ece75e828260c07649373f73bc7429fecc4a32b96f8a1010c3e36c2b7493e66873cc7cefdb535b

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md

Filesize
11KB

MD5
2eee51d0e32f0a4bc9bd7fd12b54028d

SHA1
00b99bc743886c03445a0ab5fa1b50c9e2abdbf6

SHA256
542909d31e9b16e9273a7ac7a8a07a5303c88f4021430d6678719c5242f8d61a

SHA512
c11afc70cb3bca19b87267da5c6ebc8096997280b45efe65d6da0c668c1b48f0e74e0ef9eeb4217416898ad2e81bacc8acc17c36c36ad7346e8d368463be7c54

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md

Filesize
11KB

MD5
b3bf3e9b776e58f7ce3ee57e5d019767

SHA1
0ac570a3c5662900c075eb1b5a642f0a34145808

SHA256
47f4b816e9adffe95da010f3ae76b7fe5ab0d39fee2453fc588337aa250d72ca

SHA512
53869609389005043da3f0607ec3d08509c0f251d18f28b6f8803d893a9365af2b0c3ee8dbf42b07f0ca47e425146fcaf31c7a2a1fafeb17e421bb5534d3980c

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md

Filesize
11KB

MD5
ffe810cdc0eb8dc31dcf336306ac031d

SHA1
568250a71fbe38a03ca1abbbec9e3c43beae2b3f

SHA256
46e8be5ecf468e2e2352dde596d174a0108e1ac693ae8fc0c438cadfb2a5ac97

SHA512
df36122b42a37aa8b2b87d76bd70a3433a5b9c2fdfe83237e5169007e1d5504334d22caf979d54d5ee1e6ff978f8ec94c7741eb8ff0062735a1e801d2f5e9d4c

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md

Filesize
1011B

MD5
dd60c8b8138d88ed697f6534c27d4bc9

SHA1
b63bfcea742153b1d38e7cd4a1dc8850690949e3

SHA256
eadb94854c0e026b69ffd691598c2aa28be343b3d010954f8db02eb561e5f05c

SHA512
6db4aa7779ecea88afe32959896da10c27cbf58a460a23755b2e5d443722452337dea28ef958e1e8f33e6653120d967e925fe5414d6601369f5953c281d194a6

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727655840085328.txt

Filesize
77KB

MD5
252428ba21256bbf72d78746c3077021

SHA1
c5f36bddf6a1569dfde993189e18f693921b95e0

SHA256
1f1f9bce82b40e5696ee4ab64d69dd6ccefb6373e533db4cb39409852fdd0540

SHA512
3cccc740137308c7804da7af0cb33a244ab274535f0115e7d3500bbe6451e62bd1b0b02abdc35c001be7fe1bc34a75d06524403f2186f7f83bb2e31819fe1b75

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727656363999749.txt

Filesize
47KB

MD5
d1157a9e070bb1e5e7d8655ebf28c2ba

SHA1
b74597717d569fcc0e573f9108a17c4344764758

SHA256
5019f9571f9a7d312f98ee43945f71f4e78310f5c16053f77a33d469123ca20e

SHA512
ca686c52b3d13906704b86c9cfbaf51f66852f453c374997d4cb02b292ae2af1f2e883749d4f1baefae3375329c3a60e43814bcd2b7775ea454cd3d077f45937

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727662640605367.txt

Filesize
63KB

MD5
f9e5019e1e9ff9df058fe770adcd19c5

SHA1
0131df9420fc2777ca17d6a27bae54c5cb0dbbdb

SHA256
5b4051050f32a5bd7510c188f0bec966c2f4edc8222f47bf0efcec7ea05005ef

SHA512
79ec787487231d74569401c50e94ad74e4e80cd96750d3246508c1c0ebdc675931133af2c2e387db7366e53f3842556421b29aa2c11964cecf30dbfa6e67d310

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727665714398674.txt

Filesize
74KB

MD5
451b16e10c87c1cb796ceaf36f37dfbd

SHA1
ef4c5f7174aff80924adcafd9ec55e9d8b509c78

SHA256
15f982150af1e7916d3d188f1f515b4d3295b10581f3200602ee7202188030ef

SHA512
1b99693fb70dfc353b5e6af3e3359729c7c11bed4e4e4c9d116a103a9811290879d344d38008d90cc3a784e194d25f9e3800be59eec61d2cd794e4365143a6de

Download Submit
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\File Explorer.lnk

Filesize
407B

MD5
69dcb1a8fd29382334bc82f6defbf015

SHA1
09cbdcdabae74d7359295b2e191c385f52ce94b0

SHA256
b9a759201b11b2fe8d204946bc8946a8901eb64c7df4d3047ab08b70ee1f8dec

SHA512
8529c86443c110e4d9107b70d18ec69d0655cbddc054c6b604d53e071baa4311822d4ad880418612993ba8a8016361816d352e8cf88e5207a0918c17bf6e62a9

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg

Filesize
21KB

MD5
092611f93f33071c12f4f73faede8bca

SHA1
c46a500d2a25b4ae289d892d8d55e91bce9b6554

SHA256
e6c3231bd51faade0c434c44fefe2cfe93f197df7507dad9a066447b6d0f8a48

SHA512
51d790b214fdff6214f7008f71fbcc64a894486ee60b61352f271a4fc1403e486560ae4d119a3578293c097ba91a9a1458d0865344cf5ed8fa8036bb734177c4

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\HelpIcon_solid.gif

Filesize
1KB

MD5
bc0c7bf74dc85b0ea2f633286a2e1711

SHA1
1089690fd87fb04cbcd5b838ac95dd37244ccfc9

SHA256
e752219dd9ef5fb47f8ec2a92486af418fd95877b2586d7a9329b8a3b18710a5

SHA512
bfae19e38a47bf361a6a8d5eb7f278dd6e54c0acb652d99bdcf2def4a257b58ef909ea6b364d03e59c0e5663dfad9df84e78054e88fa53c522d71eaa5dba5288

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\alert_lrg.gif

Filesize
952B

MD5
c526504658de7e24a19271c235f46ff6

SHA1
c04fbf18e5f65275a401a9a5db93387e5f39333c

SHA256
a56014b1ad47d7addd7e41da62eda392a6bf5b23fcf3f4930283317e4a2949f4

SHA512
6798ce504492d45c4fa3849aa03a6f924938627bfc27386636049a9b0041539a003ccaf43c014504047a2e3736911ff588547fb3a95ebb7182cedddf46f9eb76

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\branding_Full2.gif

Filesize
1KB

MD5
6d859cea65128b9070a9e0be11007f1c

SHA1
8e37e7e98a748f9be7a8ee48a6c5b71fad8a3faf

SHA256
09c651857ab777c96b76fe33bc27ffd862e0f02a6b57a7e81412e87101cf7728

SHA512
a7ee2038e4cfe4f0e948acc4bae6c847580c7b165121b3c2c3eb66ac774472974fcb52297d70a26f19d7b43991b459dd7c772d16e7293107ac11bfa0fd9ea9ea

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg

Filesize
8KB

MD5
7d6ed6e911e0eee74c6c7350634acced

SHA1
9fe563ddcd0fbd916e84ac410a79d92041041fa1

SHA256
f9150896d019cfc401ea13facba47f30e8f7786bc1fc1e66d0bbb47fd0983806

SHA512
a9212dcf31928337dc25ee5c9171cc199835edad558727437ab03432a01c491c58225bfe0ce8c7f0f78834eedfa7c52806891b5bd82d7c7ee1a36635c4f44dba

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\folder.gif

Filesize
914B

MD5
f4fa8bba95d2f44c238669718eb8cd55

SHA1
0fc1666aef04cfd1180e5fd8a969c7aa5aafadcc

SHA256
7d9ee83efe0791099f1dc46ebf9242790e14ab0b45a03e2180a4fe2b9d173d26

SHA512
6b92e179a829986774bf164e76a30e05248fa4b390fa50b48f3bb64620dfbea6072241c8886e9c464b9de2ebb7c6de09e87b57ff2d57ec16b75f4107bf5219bd

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\headerGRADIENT_Tall.gif

Filesize
328B

MD5
e409fb580d91ab0585a2a61ff55d2313

SHA1
206b3fcaca4e8f8362a5be21731caa7797736ace

SHA256
79a6b617c5d440a414e94def10d4acc926d09fcab43990f2141b0c68414f3d74

SHA512
de37a5ce29b334f6b9f0513a619ad26992d8615f9d1ea48a5aedec278bc5ac703403255d098a82cfd3b0c7bac52bf98e160a999f98cff8f8d76e1461c32abf30

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\help.jpg

Filesize
1KB

MD5
adbfd48b176b4d391bfb264a1275bda2

SHA1
e3eefcff5c020d07452a660fc1493171e592ef58

SHA256
c88fe07bcb7af0bf08df26b4e00458edf72e03f9a1c8d0f67b09228ff375bbb9

SHA512
35e3a7504fe1f920ec72590754699350ac7229f30cc555b7da65bcfcf517f92c59dbb49f7eda672377bb26a10ac384e806ef0233b4573717350a35b7a579e9c0

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\image1.gif

Filesize
162B

MD5
b423af9d7700b913375436b6eed00254

SHA1
19d8b3c86ea33ff6a65b8bf121f09ecfa869e435

SHA256
8e797c19b2073e60f4f5b7d62ee2dd314c00212a82f337309a10b9200d52d4b0

SHA512
81a5c9d7ecc7ae767c4750a9c320332cea3369b915dcb58680118fb32383c3ef40f889dbfd77a3ef06532175170907ce70cb41d40249d97d2683d07be1992d82

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\image2.gif

Filesize
586B

MD5
393d1062b4d22a5681fc45a68a9b5746

SHA1
3617b99ff477dd755d33334682d4d7a5d010d921

SHA256
b6c93f92383a428426a7527c326d1c04eb1c5ead9e4b1a0358a2384435894010

SHA512
70b5a2e38f2becb58fd54a29420de47faa4c2e06cd70f8f42d0b3aceef1c77d6dd509f6884a5f6abdbfffd6293d21006481bf550ebc425b5f8aef7b7750e364e

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\requiredBang.gif

Filesize
124B

MD5
d02b7220ce90d7c8e3ae38ae149598a4

SHA1
df318bf256425ce3bda38b10def747d53191efca

SHA256
6cb21335331e38eec2b27103ac334247dfec496ef6558453ba3e0369aafa8781

SHA512
7f6240b48497867909c118770621739c30ebc4f0d55b644c42e4d92816516ca0821abaa727adb5b183fda05bbc3ed71201f049970016ffb1763083f072a85e4c

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg

Filesize
8KB

MD5
fe6708820fe59ab0aac4dca9b7cb2c4b

SHA1
60e6febc146a7de0519576b1e872583b56b292af

SHA256
4601a1b1779885ae424302d3c6ddd32bdfdd12c3074b032efd9c145158b3e10a

SHA512
2c16110ae6ea6ffb85d0b9fda1823b23e9925a6691027a8e65b2cf7fe63960a4bc7ac0c0a3e98ee8ae5329989032e32802882ef084ca15f4be65b4554890e1a8

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\yellowCORNER.gif

Filesize
880B

MD5
77ef511c7a7cb8b83067d690b41f097f

SHA1
f3139229164a39640d98920c061c1c204f678d32

SHA256
f130d46ea70b70c9311f5b9021ce8b5c1c17094ba1669cb4793d5f24ca917d13

SHA512
3ca0d69101537ff3e98149c1ad18fbce589aadb7a22b0892a6e584d7be906256be698ef942da30495d0856c7ce6a679bf2aaac9683ed6299c2d72ce460056512

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group1\1 - Desktop.lnk

Filesize
1KB

MD5
8ad5595b71affebd427fbdc0d2de6a86

SHA1
d745a1bc61278e6f5f248ee9dc312af5d537a3a6

SHA256
edd5526ccc1e9c66f460cf2932d214c44d456e690665a55c44537e5702cd5dfd

SHA512
f863c4a333d729caf2fea09977e0f15e8babcae1eb3b9ce0d920c1ef6ad9b921b733690d68355271ac47d463abab87d73c1107fcf9466b38c88d4cb91d25274d

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\1 - Run.lnk

Filesize
1KB

MD5
9de7330a8a79de09f534f734e7aa427e

SHA1
358da8b3b890c31bd5e6140ffed98ff2c74be402

SHA256
88b40cc0adc9639ed58cb84f1aebf2e691b57db8cc4910f407c92879665b46dc

SHA512
89d94cf84c1a5ce38c74b8a5f62656d6ce2ce6c6249841bf355a5fa522edd7d811ef8a7222d28e2cb1e06128da5b223ba9bcb93225d49b49757455a1b85583fb

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\2 - Search.lnk

Filesize
1KB

MD5
35a0b5e86e4fdb6c3d748bd2cb7b5f79

SHA1
7531d0e9f33194a7c59895f2ea2c6f9351286dd7

SHA256
fe6a3de515f84f5b29d8ecb8352be215b172e44e94927245e2ecd66bd59bf799

SHA512
6edbfd6d3ea015231fff6a93c9d2c5f86907617dfb12e3f24644d20ffd52e76592b8aba372d0bda4c38e6f75b968c22546835475bd304e4fbcdfb8f8dc8cc365

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\3 - Windows Explorer.lnk

Filesize
1KB

MD5
1ab4d9af4023da004ae14069e9c8fa88

SHA1
3c83d1159b5361726b63a359cdc55ad576e448d5

SHA256
c2081b423b0b79a5e110d3c84eae1baefc59c7192f04dbb141441a2acfe6d413

SHA512
f969815c5c5caffe5c1f8fef5e59aa5cdf0d2bba8dec24cce39601510f8cb3320e15da4466c3145218472a1bf3434e799a9731a7f1421838144be8024739c158

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\4 - Control Panel.lnk

Filesize
1KB

MD5
5893f08f717ec573e319e38b0c9f547c

SHA1
132eaf52729ecd0097dc6d0fdd292d7bbed48635

SHA256
1a855dca084c5864ef80e2ac3aae630a317663a4190d76aa2007a6c053615f21

SHA512
a92e27a26266cf4160467642a1b324cb7f7328edd7a297213dba2e78c9d6fa88df72af499dca65c8bf54469b9cb3f4a225d372f5c27f8fec4cf6b297cad0f043

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\5 - Task Manager.lnk

Filesize
1021B

MD5
46c48ecf51134d95e55fa8a2c1c3da2b

SHA1
c9b3a00c5478fd5c0f3646f0f0e83601a7fab323

SHA256
9de5851824b4cceee1beef69ecf35c93262d04f8ae02fe92037b9bf93c8ff64a

SHA512
1801d175cf321327a5415e00136ccd828457d0de2080e0f210ad5b7304a023bd9c0bd95b83afaac9fee9d974d8e91693b913366cdf70292d754c4b6e55e28aea

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\01 - Command Prompt.lnk

Filesize
1015B

MD5
71e00bdd575b7d5c73746152c03af402

SHA1
b212e64b4c0282a27f5c751081a4ba10035d71fd

SHA256
c9296d02229605ce18da09f0f7e2bab8d78024a33e5e0175f9b5f84c85517179

SHA512
8291f34586df066a6f24ca0a7224bdd22fa9e24e4fd04353d583df3e103922948bbab22df01fcd5a04ebd0c3d704698df92f1b5079959210a1b51a6ac32fdef3

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\01a - Windows PowerShell.lnk

Filesize
1KB

MD5
d9369e7345af11a14d702b9e9aca9123

SHA1
366b2cf4cdc2e751a8578e2fe5a8dd7926a4be35

SHA256
bfb55155bf31581f7c67941b1391f5ab89c18af911f1a2ca43804fa5f9ed7aeb

SHA512
e37f47c246c5e15853e83b95ddb0828bb1199318043177243eae8dd332ee602a58b7319617e408ca68b965b211cf6e7e0fa0ec0e75b5bdb9a61ecea0afe9598e

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\02 - Command Prompt.lnk

Filesize
1KB

MD5
aa67dd8dfb6cdcb89586d0b8fb4c4773

SHA1
ce0fb43a19c64ea39d86210a679c89fcd89e0d1b

SHA256
9c9fdd3071381c8b5a86f0b974e68d7d0ab8e1a1cf054e0301e7cb19a4d733ed

SHA512
1be333cfbed7b0ff2214d182326d375b13c9917a5b471df4c31d8513efe431f57ba91a1da0920d902ab6407665f2c86e89df6e19f17ba5518529c447e9b4999b

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\02a - Windows PowerShell.lnk

Filesize
1KB

MD5
1dc1fe1b90a831c7e3621e5952dd12ef

SHA1
f8e2eef2c41e3fee103cb8fcb93dad5b8a214a70

SHA256
52ac197ecee844b4cfab8ee703b698c35dbf9226fa1b55591f43ece03a9325b4

SHA512
2e82a8f4df09cff6d03c863164a25a1213355b18bdfd7abc2c8c755806fc30ce582b86412bd3e2928f32456515aaa6a42daaea731bb07c595c8cf090eb1adcf2

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\03 - Computer Management.lnk

Filesize
1015B

MD5
51ce0cca5105afdd55383d0e907937fe

SHA1
5a1eeb96b93bb809a668fcd8d519e75cdff2e8a2

SHA256
f6ba7b07c8ca8f1d5547470a7280e7534ecc5bb4f062b3dcc7d02cdae8e0a4dc

SHA512
ac872da637e6b7f8523a43c5bd32de232b644ba92af47e40cea39661823492d2780350d64d811c33e122d7bf66ea4b4280d1163265a6f215c8d93731d334141c

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\04 - Disk Management.lnk

Filesize
1015B

MD5
a7c27ee1df532436cde3f30cccc9d115

SHA1
f172cbc4a403e35984c9dcad93aa73942c1c2ccb

SHA256
b3c861841a772c60cb6488572a2d40e554bbcaeadf3df2f997313efdd6e17253

SHA512
335e38d34ea0444f54a1949c4df634b84e11d3e4e44593e07a7bdbe920064140e5f3fd808d93f84e229eeae2310062ee3f1755be8e637baf2d24aab740f318aa

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\04-1 - NetworkStatus.lnk

Filesize
1KB

MD5
0abd5c406141fe253f8b32fee9cfcac0

SHA1
15cd18471477e709ea100cfb632960608dcc92bf

SHA256
ae2a79bbdb8337289734a239e003cd03bf84d4c5d8ae184777918e4be6210d44

SHA512
3da78d7f01693e11f37633b0bfed7e7b851fd8fb17d7f869731824aa15f33536fbd5698d4375d080c1a21e9af339a5bc021192753f0e83ec4ec370f583ee7c31

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\05 - Device Manager.lnk

Filesize
1KB

MD5
90653c8923dec1d1af24ccc8ee0e5582

SHA1
942cf0993f1a4c7b141a8fb0e7b79f58bec1f485

SHA256
a88c99f6b56eb81f5b9576a872e1f11773adeff28b0ffd292bf4f47aa2c19669

SHA512
2cffeeec3d3372a58cb0d53b40f748b29b03bac8dae798052bff8d084862d568417bdbbad0156a1a972b905810e1879c6d138dab402b1d2beae6ddc6efe287a5

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\06 - SystemAbout.lnk

Filesize
1KB

MD5
af9b5f413535cbd02121323131166341

SHA1
f7ac57c69c17bf85ef6b7145c36048a8341854b2

SHA256
d72ddbb436ef04fd2a432723e5bc3b9f93a62bda9b2a8b682789cbc7fb721430

SHA512
71b112686f96a15df330c60f5dcf3ebad62cfb19bc1b9ff9c824bddbeede6e2ecafd4cbdf9772d6529783d14b7eb889b21d495ff7b1072df22c612f4ee638908

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\07 - Event Viewer.lnk

Filesize
1015B

MD5
18120e1739c4bd5f220e4dcef7ded676

SHA1
045c8d52f54302a9c308c2924693288f82dfa8d2

SHA256
547f081df8000cf39182998b724c9da1d0e5f2115902ddd9921c1bb24728d07c

SHA512
b1c5427d32d80c07047f29fcb465b95ecb96e7385f4c2d7f7717033764ce85817bf60c03b62e0a61dfc41b85fbe4a10dd476b3f8eaa8774c030722a2e34f1950

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\08 - PowerAndSleep.lnk

Filesize
1KB

MD5
c6a6195066522010d53ced63f71c0393

SHA1
f29c500314c21133314821d2efbf6efa9df1e433

SHA256
c189d16d72c4a13e3c04f1d103cf052807897b36668e0c25a97c7aeeaed8571b

SHA512
2348a24abbd776014cdfb85e2dca13403882a7e2b7f60639755421d7db7d1b7400a36b19d28b2e46da164b10d17c91168d528f5dc9d67feeb9e890110762d0ad

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\09 - Mobility Center.lnk

Filesize
1015B

MD5
a1cb683dbc59e6ab1bfe2b3dbf8cbb63

SHA1
70535e4d827a36dc83a63d3cf74d3ab3873b5293

SHA256
af0b336f95ba99f8fb39ac16a85eaf8196fd1aa1a8f23314cd88f80ee54085bd

SHA512
4df6c1f0a22a81a9ba0228146295011900bbb2a6c43e9fcc72208a629e35b9c9ecc220e81c84a64de66171d007ee40fa7396f86d5f6340f8926ec574624d5ada

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\10 - AppsAndFeatures.lnk

Filesize
1KB

MD5
56482f53b78da9ed107adb7b8cc65133

SHA1
5337980216ec82c0483db3f37c5caf6e32044481

SHA256
879502e7ff09e4941750930297772b3e43f24386c746310e32493a9c427205f2

SHA512
d66fbe8197b02454344c45a2c51c3b65f0753458a8b13261be5d66707a58e8bf60f18c95da6fc18cb801cbe8671444b395a5006edb9d9032e34de79172f46059

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk

Filesize
352B

MD5
4d77395c1dd6143b235d288795f13268

SHA1
c6b508c775eee9de1d9c98fd1a1f9d09e345a892

SHA256
9f6f5a16b382c00e38e25d1c58367e278d64655095f54ce4de91b5a25d5f52b3

SHA512
7df1cc763d29cd059dc4b2ce4948a1f521c7893aa9a75b233fdb1e6a675832e8becdbd98cbc28f53ac0848b248747dbda0e8a8345b957b4bb0fff4cc4ea72a97

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk

Filesize
334B

MD5
4e74839310d150bb098194e490706f7c

SHA1
2983c8c0dfe3cc46485f831861690c2cd20511d1

SHA256
82f5e9423621f99396a8d8854559e77d405e737af3ba8e5845d8e16d80678847

SHA512
a5988bdb92428bbcf5ca8934a55566d923143e8ea3e86d99ccf7e9bce6ebd910e18580bae893adb5428b3e3a3aa2cb2cafbf6b9d1610189d8a99f7434012cb3a

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Magnify.lnk

Filesize
1KB

MD5
2fa304cead774cfbac04a70f8e13a318

SHA1
508e4aa572a0dcf42cd134f42c3e250ab9cd3050

SHA256
73f15a69820683f2dc80f6032ab99a5f050aadd69a1fac493b1b72d463c491da

SHA512
810d30af6b6468b6dd77968fad54e7e69009fb77f8c165c133a32fd380b14cd0e3afc3289e60c38e99df46095926e49f90fed89b4668829ddb48825d3164b386

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Narrator.lnk

Filesize
1KB

MD5
221d2169f5365016d12370ec6810c87e

SHA1
547905b372ad1b2206165b2ebfc424954e9e144f

SHA256
6309c298314ea2b4e810de5cdbfb284a19c1f3c4ea5fb6cd79f3f85a568c4257

SHA512
50c49f486064b4733c411dfc3d0a3cc6ac0fa224dacb110235aef4ec5790aaceb5efe38d6bd3885de80cb30f05f24ef7e3ad432c5fea1afcd93e69207e5830c2

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\On-Screen Keyboard.lnk

Filesize
1KB

MD5
ce26b507ee1f5d53c755fdedb34692f2

SHA1
e174491c80c38c77869eb3f11001e96805865f34

SHA256
173375ca67ae0593798ed51e1fe835b8c3ee8df9d18c8cb57c1c8f03afd98ca7

SHA512
55154493323d6e0f5825bfeb291108e5948cbf559ccc36fb9e7fca7c59bba2c01169456858ab5c37fd652b7595b1e0d5fea34afe3fef773a597c04851e1b8e06

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Administrative Tools.lnk

Filesize
1KB

MD5
bb9515baf5eb4e403f692ac83525f94f

SHA1
9226a8fec4fb2c1bc8258c057ab3ae3cf062ab2f

SHA256
1e3d634cf395dc05053ffe97b60ca39a9f07eb71497d9da5eea2e0187cf95b8d

SHA512
01c5b5998fb97f4863f1c1c3d85cb3c07b7260772b4b2098b3cf9292eac32fba6176458719f3ca525b00651c481cb077aff86199751db7bb3d2bf51b377563b2

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Command Prompt.lnk

Filesize
1KB

MD5
0a62342854670fc893800423619cfc49

SHA1
bbd5c2f712dc39374041563533c0db97d93962ba

SHA256
d3d4aeb65e8e1169a2511bcd3046871371d67b9393416b9b06f4e4309302877d

SHA512
c634d4b0eb31d82ec4ede82ec3660e8f820acd650080efaed97d81640c80c0e3899aa561b77816e3890e4a81283a640ec9741584701bb667b829d9a8738d86af

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Control Panel.lnk

Filesize
405B

MD5
c4da211446df3a0e26a3d7554b61a52d

SHA1
da817c9c7df9fdf0b148f0403eda8f23f1c1fef7

SHA256
a3776af1cff128202ec33557e8ca13d6202897e8b69cd29278e156035c27bb0e

SHA512
6615d0bc03ad58976a247c0b343fe367a4880eaa7b866d452a1fedf0be6f2446255d86922ad33c9cf89132be02e53f01f2ef1a0576a7896a1823165efb18ea89

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Run.lnk

Filesize
409B

MD5
d55160d78ec1550e22987edeac5b0426

SHA1
ef30035c6d1d8adc02cbe13354ea53047904d619

SHA256
4df3c58897b6741ebbec099452b17e70e17d7dbbd6853f1b48b88fb95a3df2cc

SHA512
e5dc746a87bb53608bd8edecce291c32d1577430e41c162abad40485706cf0a77fef5ecf2bb8387c81c7b9a451ba4e44e69e56324994094f737730b6de7fb4d0

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\computer.lnk

Filesize
335B

MD5
f6224d044f3e87bea40aa1e57cae52e8

SHA1
1c72a0a42844adc10866e39bb96a0710b05da61d

SHA256
df1bee86b534448ac6d11215d15b53707099ee2b1c1a13837d008da94fa17b16

SHA512
4abbac471874288b24f0d6c43e9eb36312e897c18f49afdaaac87d9d654247495194049c3bdf2819dee745bee7bcebe0274e03debfc965370df91726e9435adc

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell (x86).lnk

Filesize
2KB

MD5
5d68d3e56dc0d5a8c70086f3268ab39b

SHA1
5c6a546acab248682caef089849bd5dfbaea5248

SHA256
7eddf28723b12cf075258a2375c7cd21bbc6e2488c4c6f7c881593241d20aa5d

SHA512
b77f7679ab632c7257b9ccfe9eafe85164e3f41f6e79ad6001989cc17edddb1e1c6ae02d1b7508881702388b5a0cf89c2b3e34cc5d3f8d89ede00e8c6de9ea75

Download Submit
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk

Filesize
2KB

MD5
a145354ff56108af97b157a584f40a6a

SHA1
e0d6f14cb223d787eb35ea8adb7fc83e204ff370

SHA256
9d38e71736c629aede74435f75c8907f9338f79f1e604fd39138ebfe54788134

SHA512
ed9aac9d54ba1196043bf66ea23257ee3d5cb5316e3adc2b620ebedf154b84d23cf8d88d0dbc89a94e1fb3e425673037f89990f9a79bcf986ab2e790a823d944

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png

Filesize
296B

MD5
eff913d09aea91db148fa0fb1210d09e

SHA1
dfb76d7198c93f7040c07c935de9fdeac5e32655

SHA256
291cfd8c6fd50b00cbb15c7f73700a43e8f82db60dcbb66af4abffe5c1315da7

SHA512
aeddd5f0532752a83ee14dacaca5ee729bcca2e99fd87df853926fcf121161168cf07b028be965d9a1abf919faa564d2c26b460618f212ce99f86902fe4f759e

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_contrast-white.png

Filesize
276B

MD5
0ebe05749300c73c8eeb6251b590e510

SHA1
f055d73f0137fb98a77bfdfdcee3d5b6ca57623a

SHA256
bbdfb985bf916c4ee4fed65169920e66906dfd15c8d4de25955adc99826ad34f

SHA512
a4b416b31595ab608bab8d591977cb3cef5ea51dc81fadc324db16665aad584ec62a98733b4022d0c5862a6c7eaaaed66834f1536e47026e456c67df9e28446e

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png

Filesize
296B

MD5
1cdb0aa46472d72b815ef00746713a8b

SHA1
a3749ee128fbfd1bdd57f1f1b6621d77ebfdbcb3

SHA256
3215f08fa1874184ae22557c767d2a0db2001a7e9dc162f22a96487a93890888

SHA512
f3b29ccad3f9214136f5e55ad3e53186568ea323a913195cce108ab0306c7db6eff7021f703ebb6477d085aaadd1bafc50a09d13001ce2cd097a41c7d8b607ba

Download Submit
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square44x44Logo.targetsize-44_contrast-white.png

Filesize
276B

MD5
3bfdbf6c8a4cf4c58d3d81a3037e3bb1

SHA1
7c502712afade3da7e3409f46008b4848e74a297

SHA256
c54f54bd4dddbccb1e238ef60ca9fdbfb5075a624b3e70886922f6fe84196014

SHA512
db1b3c7a25ceb153cbd6eea37891c29be39d01fb84d3f1fc53e068624d6724c624ac7cb86e443f90eff7a7b542d38d626d25fc651b78e2d59d20f49a080ab132

Download Submit
C:\Windows\WinSxS\wow64_microsoft-windows-onedrive-setup_31bf3856ad364e35_10.0.19041.1_none_e585f901f9ce93e6\OneDrive.lnk

Filesize
1KB

MD5
3956cb767cca1290181444c88c43b53e

SHA1
d2bfc60d507e12315f07ff80528e6eb4b4dfe3aa

SHA256
5003cf7aff6067120734c35cb69fdab98e41f2b9945a192ea6365d29c4187601

SHA512
de0b3ed52f7ce09e8ebee94020ace62275080edea51cd3f2d18cfcd433085abb5643d8dd2a37347d54a3369b7975ddbdc8e003463e3406bc6bccf72821cc71c1

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads