Analysis
-
max time kernel
141s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
15-10-2024 05:02
Behavioral task
behavioral1
Sample
45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe
-
Size
23KB
-
MD5
45f9c9052ac71cc829ab548215e9bad0
-
SHA1
9297c7c81fa4ba1797897156afff1e1e9bd3064c
-
SHA256
b3de64e53dd3864d6499a60867e036424f9f93e9837edaae22e0505b765536a1
-
SHA512
0f1548a9e26ccbab7c5c40ae8da456538d4b6b730b26fc0d5b5081afe17a752901a2f43921067bd0e771f8f86e89ea9644b3e46317935cbb7238227784f32510
-
SSDEEP
384:SebFNw4Pk1itKkpAjjI2Ypdm9LGSFQAKDNlzi8TFtp5Rlsd9xG67mM:S0FmBkpKjPYpWD58vn2H
Malware Config
Signatures
-
Renames multiple (2157) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Drivers directory 9 IoCs
description ioc Process File created C:\Windows\SysWOW64\drivers\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\drivers\gmreadme.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\L1o9m7si2knIS4b.exe" 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\System32\DriverStore\FileRepository\megasr.inf_amd64_72258921635be994\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\msdri.inf_amd64_97bef65a8432edd4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\bcmfn2.inf_amd64_5ebadf201c5b5845\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnms010.inf_amd64_9e410195c3b236c9\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\SysWOW64\fi-FI\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\netg664.inf_amd64_84cd7b2798e0a666\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\ISE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\SysWOW64\it-IT\Licenses\Volume\Professional\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmeiger.inf_amd64_05ca2a1836c16cab\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\SysWOW64\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Security\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\SysWOW64\Configuration\Registration\MSFT_FileDirectoryConfiguration\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\SysWOW64\Licenses\neutral\_Default\Professional\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\es\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Host\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_RoleResource\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmpsion.inf_amd64_28542b9aafacda15\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\battery.inf_amd64_a239bc596073092a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\nete1e3e.inf_amd64_895623810c19146a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\SysWOW64\InstallShield\setupdir\001d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\SysWOW64\slmgr\040C\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_LogResource\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\avc.inf_amd64_0eaf27d749819837\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Provisioning\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\SysWOW64\lt-LT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\tpmvsc.inf_amd64_9b03a5f041e8d2b2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\netax88179_178a.inf_amd64_b6748bc8bb8ccf4d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\System32\LogFiles\WMI\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_EnvironmentResource\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\VpnClient\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\c_fsphysicalquotamgmt.inf_amd64_796516c18b264f1e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\c_fssecurityenhancer.inf_amd64_e84a289dd0df20ff\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\dc1-controller.inf_amd64_63236b4ab51ad398\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\ialpssi_i2c.inf_amd64_8e00e1aed7fbdf70\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\netwlv64.inf_amd64_0b9818131664d91e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\wmiacpi.inf_amd64_4ab67656039b026b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WaitForAll\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\SysWOW64\Configuration\BaseRegistration\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\cpu.inf_amd64_0abeab1ee6572232\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\c_firmware.inf_amd64_36e4e17f210128ab\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmairte.inf_amd64_a99a7ecb03853141\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\SysWOW64\IME\IMEKR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\SysWOW64\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\SysWOW64\ja-JP\Licenses\_Default\Professional\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\SysWOW64\Speech_OneCore\Common\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\SysWOW64\DiagSvcs\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ServiceResource\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\default.help.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\SysWOW64\InstallShield\setupdir\0012\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Dism\en\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmrock4.inf_amd64_bc507add47f436ae\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmeric2.inf_amd64_facbddcbb097c790\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmusrsp.inf_amd64_4c83ce3a06d0048e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\uiccspb.inf_amd64_18454ae612999870\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\SysWOW64\InstallShield\setupdir\0007\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\SysWOW64\MUI\0410\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\SysWOW64\nb-NO\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\ConfigCI\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\c_fssystemrecovery.inf_amd64_aa57df1ffa9aace0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\SysWOW64\Dism\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\sisraid2.inf_amd64_845e008c32615283\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\SysWOW64\pt-BR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WaitForSome\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hjjmobbegjjmoolo.bmp" 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\LTR\contrast-white\LargeTile.scale-125.png 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\RTL\contrast-black\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\BadgeLogo.scale-125_contrast-black.png 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\GenericMailLargeTile.scale-400.png 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.scale-200.png 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_CopyDrop32x32.gif 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\StoreLogo.scale-200.png 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteSectionGroupLargeTile.scale-200.png 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteSectionGroupSmallTile.scale-400.png 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\GamesXboxHubStoreLogo.scale-125.png 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\contrast-black\MixedRealityPortalMedTile.scale-200_contrast-black.png 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-80.png 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\LargeLogo.scale-200_contrast-black.png 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\SwipeTeachingCalloutArchiveImage.layoutdir-RTL.gif 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_GB\license.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\Attribution\weather_trends.png 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\themes\dark\nub.png 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\sl-si\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\Images\Ratings\Yelp6.scale-125.png 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\Images\Ratings\Yelp10.scale-100.png 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\LTR\contrast-white\MedTile.scale-100.png 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.scale-100_contrast-high.png 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000049\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\hu-HU\View3d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderLargeTile.contrast-black_scale-100.png 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\icons.png 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteWideTile.scale-400.png 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\images\PayLockScreenLogo.scale-200.png 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\themes\dark\CompleteCheckmark.png 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-80_altform-lightunplated.png 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\hr-hr\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\System\ado\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Program Files\VideoLAN\VLC\locale\bn_IN\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Sticker_PigNose.png 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-30_altform-lightunplated.png 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-30_contrast-black.png 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\SubsetList\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\LibrarySquare71x71Logo.scale-125_contrast-black.png 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\A12_Spinner_int.gif 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\nb-no\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\images\example_icons2x.png 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2018.826.98.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraSplashScreen.contrast-black_scale-200.png 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\VisualElements\SmallLogoDev.png 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\GenericMailSmallTile.scale-100.png 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\cs-cz\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ca-es\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\themes\dark\Info.png 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.NET.Native.Runtime.2.2_2.2.27328.0_x64__8wekyb3d8bbwe\AppxMetadata\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-64_altform-unplated.png 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\WideTile.scale-100_contrast-white.png 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\GenericMailMediumTile.scale-125.png 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailAppList.targetsize-16_altform-lightunplated.png 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\faf_icons_retina.png 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\legal\jdk\relaxngcc.md 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Images\SkypeTile.scale-200.png 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailSmallTile.scale-125.png 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\pt-br\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-96_altform-colorize.png 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Outlook.scale-100.png 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-72_altform-unplated.png 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.AppContext\v4.0_4.0.0.0__b03f5f7f11d50a3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-opengl-mf_31bf3856ad364e35_10.0.19041.488_none_a92b736874b31bf5\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..-credprov.resources_31bf3856ad364e35_10.0.19041.1_it-it_4db68c64ae1f912f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..sionagent-uachelper_31bf3856ad364e35_10.0.19041.1_none_7aff9045397d4a4c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ntfs.resources_31bf3856ad364e35_10.0.19041.1_it-it_274e132ac7bdb414\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-coreshellapi_31bf3856ad364e35_10.0.19041.746_none_d03b5674b85bbec9\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\WinSxS\x86_netfx4-aspnet_perf_ini_b03f5f7f11d50a3a_4.0.15805.0_none_682d14c5c198d0a3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\WinSxS\x86_netfx4-servicemodel..ormancecounters_dll_b03f5f7f11d50a3a_4.0.15805.0_none_d5e0ebedd4e722c9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\WinSxS\msil_system.xml.resources_b77a5c561934e089_10.0.19041.1_es-es_383433c5b111c05c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-eapttls_31bf3856ad364e35_10.0.19041.1_none_e35bd1cc2c7388f1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-ui-xaml-controls_31bf3856ad364e35_10.0.19041.1_none_d622571db1e4d62c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\WinSxS\x86_microsoft-windows-l..fessional.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_e16b46576e4d3713\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..airingexperiencemem_31bf3856ad364e35_10.0.19041.264_none_09685a22812568e5\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rpc-adm.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_2ae052c0aa21f15e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\AppConfig\App_LocalResources\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Diagnostics.StackTrace\v4.0_4.0.0.0__b03f5f7f11d50a3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..dapplugin.resources_31bf3856ad364e35_10.0.19041.1151_en-us_ff0c0b80e0527b71\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-windowscodecraw_31bf3856ad364e35_10.0.19041.1165_none_09c62bea6ce5a482\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Web.resources\v4.0_4.0.0.0_fr_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-holoshellruntime_31bf3856ad364e35_10.0.19041.264_none_8c0ff17d5f0dd1ac\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft.hyperv.schema_31bf3856ad364e35_10.0.19041.488_none_a82f565621f4835e\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\6.1.0.0_fr_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\WinSxS\msil_microsoft.web.manag..ftpclient.resources_31bf3856ad364e35_10.0.19041.1_de-de_94bbe2514defe005\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File opened for modification C:\Windows\Media\ding.wav 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\core\view\oobe-light-footer-template.html 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-cmisetup_31bf3856ad364e35_10.0.19041.964_none_f895b4edb7317563\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lsa-msprivs.resources_31bf3856ad364e35_10.0.19041.1_hu-hu_07428f2b6fa741ee\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wbiosrvc.resources_31bf3856ad364e35_10.0.19041.423_en-us_c99b855b8edbac2b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_percsas3i.inf.resources_31bf3856ad364e35_10.0.19041.1_it-it_b8a5effe8301d31e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_windows-application..ion-winrt.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_c923184ff021aa55\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..panel-adm.resources_31bf3856ad364e35_10.0.19041.1_it-it_9fe3357d8beb3b9d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mfplat.resources_31bf3856ad364e35_10.0.19041.1_de-de_11dc7879e6c74b51\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..italian-autocorrect_31bf3856ad364e35_10.0.19041.1_none_bdfcfdcaa8511603\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winsetupui_31bf3856ad364e35_10.0.19041.1_none_14fd3afa650855a2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft.web.administration-nonmsil_31bf3856ad364e35_10.0.19041.964_none_a652814defb84b57\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-com-dtc-management-ui_31bf3856ad364e35_10.0.19041.746_none_85260db75eb98bb6\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-p..l-message.resources_31bf3856ad364e35_10.0.19041.1_en-us_00b1eab996d6e4e4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-spp-main.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_afcb3a8deacb6a8a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SrpUxSnapIn.resources\v4.0_10.0.0.0_de_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.19041.1_none_ff46bbc9afee54c5\RatingStars41.contrast-black_scale-200.png 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..m-install.resources_31bf3856ad364e35_10.0.19041.1_de-de_7bfccfc4be3f9f2c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ionplugin.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_466b14fa7ed272f6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setnetworklocation_31bf3856ad364e35_10.0.19041.746_none_ed1556d332a211c4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-version_31bf3856ad364e35_10.0.19041.546_none_f2f7962fafb5066b\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-efs-rekeywiz_31bf3856ad364e35_10.0.19041.1_none_bddbb800ab3565d0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-raschap.resources_31bf3856ad364e35_10.0.19041.1_es-es_e475f3e1b586f459\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_netfx4-aspnet_filter_dll_b03f5f7f11d50a3a_4.0.15805.0_none_1eaabd976aa16db0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_ts_generic.inf.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_988619912aa818e5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securitycenter-core_31bf3856ad364e35_10.0.19041.1081_none_8f1e438c6737a711\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_dual_tpm.inf_31bf3856ad364e35_10.0.19041.1_none_d551825d32bfc58c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-spinf_31bf3856ad364e35_10.0.19041.1_none_1391a44117cab095\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_volsnap.inf.resources_31bf3856ad364e35_10.0.19041.1_es-es_c91f955d20c278ea\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics.resources\v4.0_4.0.0.0_de_b77a5c561934e089\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..appushsvc.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_54ace3fe83503858\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-duser.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_552ab53df048b40c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tapiservice.resources_31bf3856ad364e35_10.0.19041.1_de-de_93d6152192280c1a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft.build.framework_b03f5f7f11d50a3a_4.0.15805.0_none_1dcdb1f76ebea253\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_hyperv-commandline-tool.resources_31bf3856ad364e35_10.0.19041.1_en-us_a6356880f25940ae\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-containers-library_31bf3856ad364e35_10.0.19041.153_none_1938164b9765a005\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..talcontrolssettings_31bf3856ad364e35_10.0.19041.964_none_d1ce1ea46e50a943\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_windows-id-connecte..t-provider-wlidprov_31bf3856ad364e35_10.0.19041.746_none_27cfe93015f60c72\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-cryptext-dll_31bf3856ad364e35_10.0.19041.746_none_e7e0b7d9a8e927a8\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-c..in.preinstalledapps_31bf3856ad364e35_10.0.19041.1_none_78045c4b5f61a56c\DefaultSquareTileLogo1.contrast-black_scale-180.png 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-migrationengine_31bf3856ad364e35_10.0.19041.1202_none_cd68049c9076546f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe -
Modifies registry class 10 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\LBXGYCLFZCAEXPG 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\LBXGYCLFZCAEXPG\ = "CRYPTED!" 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\LBXGYCLFZCAEXPG\DefaultIcon 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\LBXGYCLFZCAEXPG\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\L1o9m7si2knIS4b.exe" 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd\ = "LBXGYCLFZCAEXPG" 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\LBXGYCLFZCAEXPG\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\L1o9m7si2knIS4b.exe,0" 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\LBXGYCLFZCAEXPG\shell\open\command 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\LBXGYCLFZCAEXPG\shell 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\LBXGYCLFZCAEXPG\shell\open 45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\45f9c9052ac71cc829ab548215e9bad0_JaffaCakes118.exe"1⤵
- Drops file in Drivers directory
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2304
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\aic_file_icons.png
Filesize50KB
MD50dd43beabe10fcd2454f36c326bbfb46
SHA10c344b3bc322f89b5c70b75b72a0f7fa8c7c5787
SHA25602f3dc703d910f1139ce97d10994349d93441873299bf68cf75187fe964c4a99
SHA5129413db59ca9aaf0607e863074eabefa85179b7bb53bed5c12b6f6ce40c13de7bad0d5ebed7b8c52b2fb4b3cfc1057dbbef440182f12128ca64fb96f3b6db626e
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions.png
Filesize1KB
MD5a93c04ff078e6b89effd4c6b514ed825
SHA1617dd05d5a0f0542d73bd766db8f7eb13c927915
SHA2569e0a420bd50cabe6dc346b35912f33b05ea305d0ddd98ef763754105827f8343
SHA512891b6b9d0ed751dfbaf77d7e5653c972e04835d5bd5c9a1a0d8f82a0bdd049c25e28c5e4e635117d79bb96a4e5c86663a5187cd708a48d0e655e0f9242b06819
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions2x.png
Filesize3KB
MD54e02b5af4993250e64bf1a2f71358590
SHA192e31a940c19a7207503b210883e433d4a8a5b86
SHA2568894aed44655190415711e34ba7cc126d97304ef9d2dcef297fa39d0b82abd91
SHA512a7c3b6ae89efd1c227d3b5110214ea751e58d59f6e39f11276f9a8de1a7d54847f90cb314da290f183157dfb59f02a622c431c3d4588c4f6f6b180e2802bb917
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons.png
Filesize683B
MD58d0f1da0c44bc9fcb20d649a857f4f04
SHA1e411db6f5bbd272ef4bb505143e791124f6faf78
SHA2565a15be2b5435c4c58d02a38a807791e50bd940173d725206627b3eac1c2a05eb
SHA5122dad49cc1e830d33f581757f1c0bf1b782592ff78f890f53dfb4d70b56b8e4e8d2349c6dfddbd1b53a36c44d56019036974b59762816971533a815a5fc8b382c
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons2x.png
Filesize1KB
MD500f6761b54308282e3c361dcfeaca37d
SHA172147617fdee33e95b7775cb2bd541959455a716
SHA256d507999cbab723c68c4cef4189a09a0fa3df334a9a2638ca944acdb779e5579a
SHA51256590b9d2904056b02f2d894bf3e0e85e4ee747dc525eb9f31ef490d58615ea4f3d2d38ed61bee0065303dd7217b01406f9937d7ecdf89dd5f1aa9537a647646
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon.png
Filesize445B
MD535ab06fbbaa4608989a2a028008ec125
SHA10ac35ec2f6c922926da85639e7a64b8ffbf92110
SHA256b76a871009066f8e93abcdf202d1474d5acd331bc30cbb4ad74738141fa10fc8
SHA5124e45fc34196c81abf67021fdf536b1b5e6cc77fb9fc9381b688be7eb8a3a5ed4e7456dd26968dd6ecd4e27b409369959c49fe71445eb8cbcbfcdea2e3cf6a011
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_2x.png
Filesize611B
MD561894aeefeaaca477f66b990b9330917
SHA129fd8a8218891e515e787b0cac1b83512dc0adf4
SHA2569ef6766a97f3659e4669ac48fb18c113c8422b49e8e646a70016c4d944f8666b
SHA5122e877c5ecc52e7b14b14626a1f9f9af187a3b4f70184ea162f35ee0a8d319d7cbd456d45a2b21b582508bff45ef5e4394853d01eca9bb9d378c950b7a7e8ceed
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover.png.EnCiPhErEd
Filesize388B
MD573b0d431892e18a3556ac0d216d33553
SHA15e9cb86f130f06f0024884bf0a5ebe0f65119b48
SHA25641587c00cfec2a14ced6c07680086f5697586fa532df0eac4dda108dbaf09111
SHA512e2e7b681e538c6d169668570498bf5070d6ca69ffa768e6b5d8283e21fed7d1148390f0081f97f5d2b99bdbdcf5aa45a069fe2187a36399557317ba63738581e
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover_2x.png
Filesize552B
MD50073f9342887d2aace6b3916e4f0498c
SHA193f07953da912acbc2c1680b359918eb14af5b69
SHA2563dcb08605958c58fab6150b666938235110c8250da405d11a4e28d25d2ba935e
SHA5121a1d4af07dfece8f315e8d5c6ff3703a6cc6d444395a3b8f96b96ea9fed9aa9340eb3a6005b2ad655873b1145b76da3005e6f8c128d040e0db20312ad5089085
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon.png
Filesize388B
MD516b3cb5b963fe17ed45645473152cda8
SHA1ffd8b0aa7e74723efd6999a4ef1ff062b4915fd1
SHA256793d8ef112c361e948491291949dfbb95b0dc739605abac093f0f78bd16e67c6
SHA5127fb335cd30a0da81a2024b81d7b57e577537fbc2d87e2d303169dd477fa59130eba470bec9f00c44ebd06a61da682726a9695813da809c284704cf9ddf43462b
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png
Filesize552B
MD575c6f7dc523c54bcc700cb3da7848caf
SHA13dd8989a6bfb99f148d92644ffc45139b6db4a34
SHA256692b99a3a7739dc790f16b8d132ff42e4fef6b386129780424781277de08d934
SHA5120a2cb002794e7edce234599300c07b45baf15e83094ad85f4e808af6bb8250074da0c9a69829e6de7c95aacc23fd339bae05228d2e8cfc10c08be056c2b94e99
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png
Filesize388B
MD528d8012aa8ab28d55786860dd9c30a4a
SHA10be1489e74f13bffd1ed0f3118fa575991772a40
SHA256b9baee70320f7fe1d97cff182c39aaacc86deb66e7861c1d1db7197dc3a13e46
SHA5121790538acecd6ec0ddac47d079321bcc5a56fe75d5f74a64b268bfa82bb60d7fba28aecf633b7234e5bc11c5f9d7d32d34dbbd75561c573bfc660b145629b250
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover_2x.png
Filesize552B
MD55027daed9dc354f6aff056f39e3989c3
SHA1bd4fef577a755714fd38229fa78788ca178d967d
SHA2564139669de612141d54d255af6dfeb91efd255bf75f8df2fb12189308a7e40164
SHA512017953f5c2d61469b8fef6c4cdb0acdfd81796c34db160eb76685a5e9d8799d8187d8c7378d7035d435b90ca7c618c769f67afb6f3ee705f69621edbd081e475
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons.png
Filesize7KB
MD5a7b5f2f1b3941789bc23768d99668c21
SHA1dc20bcd233d1aefaeb2f896df2be8ebfb94ac3da
SHA25602c00d1e820922804fa80ff8cc9c239947d9f0ecaf0b8064e3e2f9ab01fc2244
SHA512887146d36df168d704bc0d98c5e232814ecf6ac87012363a2a3af4c4635dd65de9645800082c706c724917633eef79ecb46bfbbcf841d3ad377226980a09af79
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_ie8.gif
Filesize7KB
MD5677454039fb346e077eccc5f870fb856
SHA15efbc44fe3bdf82a3e0bb3cb6388d6be65835009
SHA256110146495dea6c5ff1170825d33aabf4a8fc13d71621670f604dda5b56fbd7ce
SHA5128a2e095d8c8a76895046e06f89ef7d256eec265687e57fb72cf92a539cfbc08cb83d7038d7635a0eb68af1dfc9baf28d91efe396cff591accc2027c7f17d2e38
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_retina.png
Filesize15KB
MD5a36eccc9897c0e3c8f74f3c4b3311734
SHA1911e354dd83d1ba8f710423a95284557bc2907f1
SHA2561e9fce4db87385c35161b392e7e3ea5a6c22ee10717d4c91fec4dc099a362c25
SHA5123ddf30172ebb91280e07dadeb7130e7fb07165f4721b2831ee16682d9bce3eb1aa7bf13056ed2652a98749d28af2c424f31e4d17894355b8fabd453fb1962fa7
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons.png
Filesize8KB
MD5f36fb8c733cd1938a53f584a808c28f5
SHA12e00e135a6dcd014fb69deb62cd0242e55a59c4d
SHA256c001a9fe311f97c226c987c31e73ded95f193f3683bb31572a12ca6c38cc7f06
SHA512f82269730a90ee520e9c3bdd3215ee356ab1b4ce8e84858b8549bd835a407793abd28fe484c6c2edad5950eb2bb2a994e8b7dfcc3fae739693088fb7c09a08d6
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons_retina.png
Filesize17KB
MD588abf4cbbded46bd6321ccbb2e693a0c
SHA1910d8c4444c6046355e242a4889a073bcfa69bc7
SHA25662daeb158268f6499bb07b29c6f492a9fa138b51e39671abfad59cb6336b807e
SHA5128a1ad2003642c9064c94d13bcba0a01f485b9fd0d060e40d2d099a72776b2f8fc9f355e7df5a13a6e3505b4086f3638fecc16e20e7bfe082ca923c777093888a
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_pattern_RHP.png
Filesize179B
MD53a275c58399403fa9169e3d9addae68c
SHA19f493825f5aedbb4082017973c43cbe21d9137bd
SHA2569b7ed3f4db50743dccfae69c5590be56c5e5df3b3b0e32cdd19c5366c2210d94
SHA51221a498e26fb99966968647a7b2531a26033351cbca9164103b8b0d2dc45af6625df1cbb46b0105338ccdf8335d65cddfe3445c5a08fed049562480ae9ddfb3d8
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_patterns_header.png
Filesize703B
MD58fb4f05553646b31a08e3dd47086e234
SHA19d733c40a7062cc3168b9cf58b56c0e659abc657
SHA256411548360912ea5e256dce0bbdb3e81bc0521788619b6460d09e09849fd8a811
SHA512cb4f7dc726ac8a79ea97d83856427fe48bc208f5d80b2525dcfe4438f05632e55ed165581f8b9845ca28d72e5d546121125be21b10218150f9eb869409caa07d
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations.png
Filesize8KB
MD538ef2fa51b4d4f30d8d664751a283750
SHA1bc05eaf7433829aa356e1b5bcd46f28da7197235
SHA256c0704b935dcf2fb8bf155da8886bd81c2339c913a91eaaec581567d03323c25c
SHA5126cfa3977abf2946722b4e2a3cfe7c8ba94bb727d696d359b839cad8e590d5dab2df17ab6fd218e992f2e45129bff60f936884d12a87ab26f16c4e1be855be5cd
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations_retina.png
Filesize19KB
MD587bda595358d7861df6934c485ca5a1d
SHA18f6bb7549d79151820a37a9d1738a4e5ee07e9f0
SHA256c4a2ed1051a2c627aaac42abea1ec52c866fef88d65b0a2e516bbf48c51d2bac
SHA5120e80464faa49fadba502093ec831d7e812958c761b64bdbc5432e5935ad04bbe0646926f57570e3e24a16327942560e02e9710e9ea33522abac668852b5b793f
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\faf_icons.png
Filesize6KB
MD5d072499a669ac9fe68f905f3fbab7b50
SHA16c5cf1f5ecbc7928d20bf35819423200b8454970
SHA2566ac83d4e9b1dafbbfe656d440a24af32473522d224ed0849ffa7ba69d3eb2317
SHA512d2ed71aa17c637d9ebfca439f6288bc79ab7df2b4389e263e4371b4f0c6a10610f6737c5d748aba210a7fe2bed47220e20405b191e478caa78597fbbede11bc3
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\bun.png
Filesize2KB
MD513b9e609b89cfd9687d3281ae2969bc4
SHA178604ecd3368778380d7902f79bad1a45e63e52a
SHA2568d2e1d61a0ad980ddcba59b5f82cde6edece345f63e01177836da9b5180c2718
SHA5129b478a3d7eb60c4adb9897aad3abe1d021203c12ee8d3dd6bb4b7c1cfd2003b4a65574aa010ce563c9702a36e77647bcd3ae8934e18e8c8e8ef32752f7fee131
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview.png
Filesize2KB
MD52b4b17a86cf38bc60d7be79c278899b6
SHA18bfc8f4d563447856c91f25d7a9197a001833ac6
SHA256fba3acf8a75386ab17ad8876cc49812b8b0e7a17aea63d459597266fb10478f5
SHA51236352e8c133bb09303b2d296d80ee444f020e8e48ecdd912a751e4ac90d2ce9887b932ea1b420b6fee55104f4e6783fc9ab71c00cbe2d1ea1ba896c946ecc023
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview2x.png
Filesize4KB
MD564797cb692a434a43fbbec744adad89c
SHA109171755a6962df50155fbaaebcab376cad884f7
SHA25607499595cd5c3ffc44885f5d061c3bc80cc377401eaf6f6366dbb609090764b5
SHA512f077c3368846c732726bb64e88e0cc3c52cf0d812e7b771963c2a00acaa465451d5e460b32543d4cf8b80eeb2b16a25bdd4e7518e085dd4574d909387b08a9d3
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small.png
Filesize289B
MD5e460abc796d712722ce121f359aeeaaa
SHA191e6c80681bd9ce0b30ba30fdfcaa0d292570a1b
SHA256397d5f9c661f946634799b745273f7505422316a4fd1a62d469e48bb599e9bdd
SHA51298293946792a668836df3f4556a938e6d4637d0083645b2d5d32c4f710530d69d668b5f536236c05d3746cef8f03187114c34eb173835e7bd7a25b5fd49afb3d
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small2x.png
Filesize385B
MD529f6314ed45abbd9a0846589d215b06f
SHA17214c27f5e56a97ce0e4c33df7c90a76c9a99330
SHA256629223d0f4c8a03f24828a13f4ccee8abf747517db940282058d30cbc297c0c0
SHA5125f38be49fce3724252949335b42d871e844d3844514614febe5fdebb65eb34f6c8722687e57c798d96d7eecdf65f6eac5b40a0bfe93170ed339163d60a387b8d
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\illustrations.png
Filesize4KB
MD532a6d09965a723f559ceaa66d5f81748
SHA166ecb196948407b4d40c6ede63c4f0da92954aaa
SHA256545058fc57403252d56518aeec70589926e05637ef86bb88513de12d17dff799
SHA512a2316be624a86a6d660dd28fcdaa468c0284abbd83a99d6574fff39c1a701eaf4d43d94d9614f0c63dc7267a896d0498ed7b95a93f5c1c0a531d1973ef9cc8e4
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\nub.png
Filesize1003B
MD55ab6c73154e896cc69ba0349beecb233
SHA1a5d68abd2e9738d25fac029000d26334d600ad02
SHA25687a924b0507e9677e1c27f0d3a21daf623a30c92eba5534ebcccd42624f1c95b
SHA512a572d379cfb2c34546f4e9b0c51cfe4bf497faf301fb63daf073a76ca7171d436d7bedd0e15241619604ae9543a734593702702d94dcc97ba05800ffa8ae80de
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons.png
Filesize1KB
MD51a1d39f22aa35f44dc4b479d23ba7f7e
SHA1270339b0cdb81c39c845dd63c923e471b6e08602
SHA256d59f8851d5ecbefceb4901a3ce707a783c82588f092004dd6ae6f5d31a003ab2
SHA512bf8ccec7d9fdec2bcd612f52210bf746223a10c19732871e5593b48a3b428db655331b4854d9b0847dee24fec8c0ea5c0a312ac42556a6ab372db3454ac27a0f
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons2x.png
Filesize2KB
MD5870b62e2a10f0649dc6fdf52f303a76c
SHA1d6d1dcc89cff7c235fa3b5fcbe301f35ad103705
SHA256bbbf2a4f53d09201199e40a998f90cb0ce2aa0e5f077f4f518f811e4f79bc320
SHA5120641a70a5e92dd84ced7d18d76acfa4a6a8b3692f2ed2ea1265005c3af5d923c4076eddc140514a2f1f7ed82bd660c2633bfe4b7645989e31d183b25d227b6d3
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adc_logo.png
Filesize3KB
MD5cfd16d91d3732faa95fda6b2088d0664
SHA15b4ce3efd328daf132a61c8573192a1d7578db00
SHA25655d1f571b77445e1a70f52f20432d76ce33a2e1af5632f3550dbd299db5bc91e
SHA51250380939b934d53d95388b98fffe9cd49b584547c63ae107e674724bfaed11298e318798eb48d21b03d8261465239c00c48daf0fc69482a318eb7842ea856a3c
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adobe_spinner.gif
Filesize556B
MD59b45b9fb7fb951a913790484d18285ee
SHA1e93d0347b0aac4290d8c7f3fb76617e7926a1b02
SHA2565def93266137729d7190981b37fffd04c3fb333ffaa85bb29f18164dbc79a091
SHA5128ed0a023eed538f202a247c75cedc34e5a837032725a44eb99d17715a28581edf0fa1fdd4059d579fbd55d07bc2aa5770b7c589d066185e1213a2b0c7a60e440
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\logo_retina.png
Filesize6KB
MD57ca9c23ee7087743db0529f50ad5d8e9
SHA1ba2374e86c1011b3042fbb400a036d447461e32d
SHA25695fafdbe39a8a146efc3cb99ea9b6657bcac4139378eefca9e28f44df5add36f
SHA51203b6c481b91bac290a905e49d90f58904dc2978b112e92cbd8c9d5369878b41573f45944f4d4c7f6713069e878dc102bc0f40318ae17a15ad1d1024bf7dda55f
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo.png
Filesize826B
MD5dd7ecc76c0e780ff00ec07ed578a190f
SHA10e7c2fb984a296b763252d9707516e83421429e4
SHA25663755dd30887c5c7bf274df219f115bba9a6a00e698c104fb8b5d890b357db83
SHA512b7fe3445ee375147b560e4e16b751a80b99a5a5d8647ac0ac775cf5f517299f6848c0178b6fb8961aa59788d5613afe198c9fc1bbde935d8162c6db7b06c45f4
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo_2x.png
Filesize1KB
MD50901da45ad9f483fa8d0b557d1049219
SHA1ce206896dd91b9c57e8e8affec39b78c96c00ceb
SHA2564c651813b5e239d3941bf6b800ce8014c3c5e50ca9e68c602d2b327df4b863f2
SHA512f19de733932e489c94644bc6526c0693fd4ab989dfe63fa2da618cb74c7ea73e8df514de802700c217906cbdee2f17d9f956cf3ddcc454099cb749d75c675269
-
C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB_EURO.txt
Filesize32KB
MD5274c0d7b12f8c46189d95a859996d26b
SHA1fedd3f00bea3654fa5398d158f53f9bf54ab5c11
SHA256dc005a45b80fe480a228a5f9495497a875615b89ea7e7f551f6d8dbdb892a628
SHA5127c949cca6db181b31dc47895cfbd78b20b70ab2405991177bdefb1f89a3aabb8b3ec898eff5d9caa880eec9ab58b03c3e0d43d2fd2c35331fd57d4b823219272
-
Filesize
321B
MD5771e9e60910ff5ae17214e984d4263cb
SHA10f0f34e72e38ca6cf88b02fa1d3c9babcda2fe5a
SHA2565594cb08289cff699592961ca1ef9489ebeed81c32c5bd8d668bd71e212aa300
SHA512847e7d198c4f63e1a5cc0819cc0e2e60f080d8e19ff66e4ab06969fd5db88ce6be3550c52e9d38c7d417456c08c07cc2dc755e47f64cfe98a0e4c44f83740c6a
-
Filesize
153B
MD505f7ff9c6457cbdea9e21f9519611fcd
SHA1cc991ff7f01d0f7fded61c3c034e3cb39837b815
SHA2564672db19cc3ff29ff3f4db6b753b30c23994e25a4a45b060c9d7677ad4042793
SHA512c857a282c6662aefe102d222ce523d309b6f02e0678b6c72af8d5a4a2e2b52f31e3bb7bb8f407879633957d5afd119f423fbfe711b72dd58a53f780adb4e2ee6
-
Filesize
190B
MD55e707b4c436b48fdb3d88b6f66e03556
SHA1e759e3707ee72d8c2ce94dd08609ebbd2db82831
SHA256ab9756a1b002b4d644dcbba0614ffe3da5908c03d7942a17f58b43761f680671
SHA51211f2be75c81efb0370e51784cec3a59e6129a4541246751a40995c9a695399b6d86fe9bcf30d1790b14529ecfac2b1b221a43054bbb511fca2c8c1469c293786
-
Filesize
190B
MD592ee6d35192fe1806c359840563e78be
SHA1c72db771cddeb9efef2e570d3e771bf766da918e
SHA25601cddcf02b418feb4c6a4cfec0f48e5bce88db18cffb09ec0b31361720bdf26c
SHA512a41d868e9c85106ea97aa2b757346e91edbe1a827cbf78033d9744178fc29423ae9efd93c5d272633b1a41b641ab690d08d212548ed61f6f2366b95022292c3c
-
Filesize
1KB
MD5e20cdd80bafe9d9703fd93f7bfa2494f
SHA1457fb7d96f68615f5a6fdae90bb96b6dd0f8be17
SHA2563ce0008e4be1d055124640ef232a8c673aebced44695faa228031937d9324fc9
SHA5127cda2e7bae7ac3c9dc34be89f0606f6a069c92320eb0d05ce52163ed4321429d81cc99d6042aa1e3460c8d0ae344a54b276d9871fcac11128b9a5ab713661c22
-
Filesize
31KB
MD5af7bb249078f29eecfba4d56ab58fba4
SHA1506b0bb67713a4e6ee689fecf20739b2a4c800fa
SHA256fdb13de1e311d949fdc0c3996694eb688dd591a27b9c7832d518fe189fe6456f
SHA512d1c184763609e8a4272586995c84eeac01289cfabb27a20764464beabbb6b64b6d432a935d85eb7627b334323a5e3e23a3c5f36d9a355b5ec2c8ba029ef85731
-
Filesize
34KB
MD58dd002079f623bf9c1cc674f661057fd
SHA1305200ceec7b75c57dbedc9f876b3de2e53df0cf
SHA256afbc1fe33fd98261b6381ff2deefd11cc824d3bd9e7a4f34c81a5ce9d1ffd54b
SHA512fdc9186e6271befa34165b8d206448536b4dd05d7d6628e49d8507e81af19cc78bc68381aab399f6bc2ab3e03d6dfe308f99ad99b9c66fea890f137282d01da8
-
Filesize
23KB
MD5f11be321ebab3460b05a5e3ba03a0e5a
SHA153d36977636c2ebbe5a2ec837804e7ca6fbea5e2
SHA2561e248538c7b7b4d2f6b7d57518b17dcbb1dd64614b42264a7d9674e292a8ad06
SHA5126b3b6bfc1c21b6aab1bf48053691c94e467a9fba1d780c172f276a62fd2ac18c29e30966de140427342f404f5fc60b76b40a6e9da4fe92d83c479a10207b5738
-
Filesize
2KB
MD57b2591ab0879a0812de8a690ce5007a7
SHA17c187039807eb419c903b81feb3315763fc724dc
SHA256933ca10d1bb4f679b231a5bc77b12a70467edd8e508d3bb9e94d00b77a89445d
SHA512ee538d3b21d5d1329035c624f04c1462135be817f33a5c6b9c42df618c27cd11ae9f06ce8dfc93a59d3649ca89b0303a6b9794ad025fe5e9e909d4e07cc7513c
-
Filesize
1KB
MD59a7dc0c2a3eac5fd58a2c1d08aac76af
SHA146a44f68b01140957db9d7f237a376fe8145dc90
SHA2561a6e55fce2f5d30d462b4ec6c930a234b8a6f5e66eab0e4877071e055641a0f6
SHA5122bd0e2c87f50ec88fc35e0dd31223e1f5c90906e90128873f0352399a64d5bfdc210e2e7ba7b5128509979f54d84c7e08336cc22ca3ea2893e5d26e34596f349
-
Filesize
3KB
MD5917017cd686c5db09c013dc0c58a83aa
SHA1ce6ef5910d21079def0db3ab46f6eea6b72cd145
SHA2561b035017b4661dd1abf1c6dc01d8937c621bfe13a7f8724ae824be683bc5753d
SHA51206dec2b7f01ec381455d402bdc95689a4edeb98487359c739591f9f17ec56c1e0a52c0c44216331d173d251d21e614fcf524a13008a6e13177a0363308a7b249
-
Filesize
2KB
MD5c97eb8db01f3c68ae52fe78ab7e67e0b
SHA1deb00813ce6013b361da9f15d895c7e2742b4cba
SHA2561e7f75547955a932660f55d59701846e87709db4f05bc416c903d006a34d0c44
SHA5120bd3f32d96076fb763a57725c95464403ce5115afdcb4f8e373e58f77168233277ec6eb4b4d0f12bab9dc15205f70999dbd51babadd10354e4d0bc4dc4d64c7a
-
Filesize
5KB
MD5fb96f25830a40485ac5eb3342e73c31f
SHA1e43df0a696afc485d0cebc6d5e95c7d631b043cd
SHA25649e652b648fedad24f0f4c1d751674a0e1b0adff4012faed0d68040d7684f865
SHA512addabb16a13b41d0f671a43279393a620272c69a01d9053f3dcb90ca26be3b236044f52588762ce8d4fac75a7d4d6e07900b6d0915a883e71d7e9171ee49f6b0
-
Filesize
17KB
MD5e08909de17c01021ebe5faf9c2fee7d4
SHA1b0bbd8c947f5e709955fe1d6b7144e401ae9f257
SHA25638b8cf4d228ffea4f41524d21befc52d9066083e5bc7746854958e57d850156c
SHA5120f65e07dc977b4c26d44377ec6a37b75e2aec63ce69ee4f4603d6735a9a257035ffbd912477f48aba417ff690ca8e2b42a63a464291456213eb7c7aa197e460d
-
Filesize
320KB
MD5e6bf11360078b06a0b9d1e991a0a6a8e
SHA1d00658eb8fd834d9cce5316ca8e647b8afbd0c29
SHA256bc8f3fb236f5a5a031acdc9ea08c5e41f57bf17aa85ea5cb8b99b6458c012e2b
SHA512945868fd0283b8be5927fe4ae7917b548d437a772b8d8d8f94fa9c3b0e600e0f1b93b228ef146a5f12004795e89fff536d9ac149eeec8d1a4fb60393bb0c5146
-
Filesize
1KB
MD538d3549492ad915ae607fc09d7aa2577
SHA179e20b9a272d6c77134eb86724d56c07b5b2fff5
SHA256508bde3eec8b85b077dadbb7f3986c2163ce8357b9d6852a0a9577355022f75a
SHA512d4ff77280bae1e24eb601b5d8147518ee54af3a98b7cbebad77851773aa9d1490d2c93fbadd4681717bec5e8239b0c80f4a18eab9772e2a41458fc1ea0cf9418
-
Filesize
10KB
MD5d9dfbff0e56a8056be9dc8a3b1750e26
SHA12bf0adc4e8fc95c1b7e07912b561c0fabcae732f
SHA256c528c2a827959d69c1dbcd97d9ff7765c0dddaed8054e48ae2b6a8061426e602
SHA512133e5adb4739e218481af7f0b845aca45f62d7e3b1ea75adce4c3b401b45ad6a41a78533efbe6c44d1148a136638d26c8db8bbb011a44f5c03fa87249d495243
-
Filesize
3KB
MD51c4a7a77f4efbf0a96459458cac4d538
SHA10c5515dcbdcbc8f37f32cea9ba08db248ba96279
SHA256b89300bc6ef41784a0441b753936a751c1413657da1b12d2c8ad31818f11337e
SHA512ac1fa4a9769acf2ac2c7add978ee42849678b45fe9b59532e7d8342b8d2ac75b5bd533ab043c10590e678748cd4a066224f63a46b521e5dc96d66517cbce0556
-
Filesize
162B
MD50398b6216281e2850370f36cb47e8453
SHA19b58a42393c1f01058222595dd716b34fc6c47a0
SHA2568c540b571de4a990b3acd6aee0fb43626149a9f67b5b3a8d92172ae306420389
SHA5120f1e8f65b29025de7d9cb5a6c7acd86f5858b9234cf7bfd453b3d933ce72401856f5ed15167c814e141112a10254c8ee10e47a3224c3e07ee7307b1bd4b922de
-
Filesize
1KB
MD5fe50e5396250b0ef72021c1813cd4c6b
SHA144188bd2d86202654a40257f21c94f7b3c93d533
SHA256f613fa7fe3801376350389c66dfb9b289619f136db7cd31122548aaaa29beeac
SHA512e2895801f16be751d2de965bb7c14272f1124fd19da6fd0897a8bd26efb1e2ece24c117d9c927d975e8006b80ba7f305b4fb38876238d30481508944c6acf7d9
-
Filesize
3KB
MD52901097698abd81ff5efeead7c0eb24c
SHA17e9f471f39b5b3eb0c6ebeca5d9aa4bcbd3b1674
SHA2566e8fa5f818c620607a393f95c2ce817ad9223296f47eb8b62f849aa40b0d83e0
SHA512b4a77e185070b69e9258887bf2360e1b7354f44791927e7b4be72b970c2b58e0524744c7a12ea2a0acff5b7839c64751efe71911627ebe0d65ec9ad69c6ee3ec
-
Filesize
1KB
MD51e036b42975360b4d41fb69bb6b0c02b
SHA135ed2a9627613d534e12a8312247aa74534e25e8
SHA2560bf4bd1653999d9a93c830c7b6f9db8f278f0f23a8b7a6f8e382597331c581d8
SHA512311c2728b70b575e9a1ab5354899cb94ef3749fedcc1c0be71da225a236b03ddbabe5d93e79d8dd1573b70cfd426561c5495191aff7e05ebfc4da13173f95688
-
Filesize
28KB
MD51d1d723a81b45a197a099995394bb320
SHA12cd2fe52e2b5254cc8a87a4a2f44646f48762038
SHA256e1d82a6b626503ea357456742e68b25d9dc189fba60f6bf3f5700f2333b734bc
SHA512109c43eeee7e4c443d818e657d7c13322bbe2364475ff07e059db6215a71a7a30abe01df4286794ddfdf1b5d21532015b755e01d70c740723ee4e87c91452aeb
-
Filesize
2KB
MD571e0b080c986101ec4ac94892588d908
SHA1ce1e9d69b035ac3585002a8f1569aae45fc2c0e4
SHA2567886c4e065ba40d99cb60ebb45988b767a538d462a96f12b7e6696914ae605a3
SHA51222032b4d93fcdc4b8a8b99faf47bd0e2d21bfe546e361a93420e1b1bd184bef3819dd82fbbf75deab92f8a5bfc2c74dfdf77397114d6f1d562b2c68bff69c46a
-
Filesize
1KB
MD523f5be57e8122c4192007930d9fc5d99
SHA1714bb7893136bfc99835f1e5bb25910c42c50f75
SHA25616377a2915712bbb485ce8ff39f177598cd80d878df9d0c64e61dad5aa1beece
SHA5126234e0325668b8bf48f80a10a6de6507649a5c8b6107b6d7aeee7c0ca174380243c2ea2b0049d8ba6b3b186c09d2cc00b32598af491f4943491b3273e5310197
-
Filesize
2KB
MD5baa0d2d6781f019aaa1846acb2674f94
SHA16b3d0836dbd222e36cd4dd1b842c83114958a8cf
SHA25620566443bab3ceac5db7e17f95e6bfc4aa65c7beb63e8227a60827b76c6a68c1
SHA5124aa35adbc2d94fc950190e38cc5b169206c75648ec12213627985394de4650f1bf2122591e447127feaa5afdebc0daafcb546823289d1e22baecfb75742a3588
-
Filesize
1KB
MD5d0080574e610c7954e455118c7e1ac98
SHA1561d9386fe2ce78b9b01c51ced321eb975622441
SHA2567848709e9b108a30f3e6b4cec98f07ec772b41bb2b6abbaee59813a16e6308b7
SHA5121a353294bc8f074bbd9d4935934cb26c465e91d484b8d06ce35c6c7ed40780db08b645cc0e4a56ef1b2ef04315cfcfe77b85be0010355fb9dcafba208f2059a0
-
Filesize
1KB
MD5e7029a7cc689628c027fe08f4693fa81
SHA140fcbdbec70cdac25a45bd58e5b0b304b65fb35c
SHA256b35dd7e624bf0da5417e0da795953dc215f7e0a05b9116052a922c2f50c56f6b
SHA5124bc74e88e94159c8019c2328cb9f8dc50e642ddbe64117c2e621278d1c3223aa31844b3da96f614a9ff7c4f1977a4f88486212fbe5919b2a5df0cae66131b1d4
-
Filesize
1KB
MD5718c5f4f1df0b9195314c55dfa9944f4
SHA193d7b09e69b4df8d32c3f2ca7435ae9587fbb117
SHA256948d256adcf4261cec0174e2d81220875e27e3aa0c881dd6645d016f10183cc8
SHA512e32c6776f3815c01134eef97e89281956006deeb178074b76338b933d9ba424addf761424cd0a0111dff2e9633a25da41340dfc891990b6ff41289c993bfaef3
-
Filesize
3KB
MD5e08ba43b61bb884622fdee921e5bb4dd
SHA1f2c3943b8b20c4d75676082271138aa8653df46e
SHA256fa7bb407ae601ebf50c6d473d0938a9ff3cc3742d82fdb43b535fc0cea3415f4
SHA51248fc1b87e031f1617eb3352ed5e21d14f2ed2fa9d4a4a0048137340e7d5ddf13930c33a90e87e4e990db728c5e7de66390deadd74802894f763e1d5ae6fd4524
-
Filesize
2KB
MD5e70622cdd779e9408c6967314397c760
SHA152cc617ebcf0365430c8db59ecf5f30ec48ab3fe
SHA256165d7b1be25546883a5ed484186e4602a2b87ff35fc13b4baba50fed5ab98368
SHA5125bbbe3e87da54ec78723c1c3efb9dd154099004b11924fd8db96a4fcd51c8bd100232996f38623356a988de5e8c53c189816a2e98e9332f7e3da2608abc3de70
-
Filesize
6KB
MD5a00805415a666553cbbb4710bbe61a3d
SHA1db0697bf062e36099bf421623d50b009a7715799
SHA2564fbff05ff106078a7dd40c0e4d4b9ff3b2a5e854607550fd7d59def50a1095ac
SHA512582477221936aeb74ffc31bb97bc828159368b544ae8cadeca47bf5ffa001fe71fc0419a29b240280645a7836e9a9e789f3255c54a5eb07e99a2932d00af93c2
-
Filesize
5KB
MD591daf0243a4a4b63838fd06d16203d1d
SHA1cd71b161f356083f8d6d52ce53706ab52bff63ae
SHA256f82c1e11d929bec85b224598619dcc3a7fa6ea8010875a29041c886a6462b7dd
SHA51202907dcd2ed4c3093b99a1a15feca64a5b81ff26f5300d756f5e50c56bd711db8ed7f404851524299c91c71209eeb51aa5118eba45a4f8b2bddab009f84b0cce
-
Filesize
3KB
MD500f55c69cae34518a52a8de4217524f4
SHA1179580ca871757d1655deb09ebf10cd86cd06b41
SHA256e03ed976c0d08ec747d1c8d849cf6714b9bd1784d140b3de70b2989df7bb762f
SHA512f77fdeb594057dfc09247e5bd56540ac935e48df2aae67e00a8cb6909c9e1f98a5c2de5a651f4210d768c2fff26e872865d1ac0abfbe0330d4de4717413a631d
-
Filesize
2KB
MD59947c2b82ba16aebea8c522eb63b3237
SHA1750c12377321452b1f1aab89f5fbbbcdc929926f
SHA256b799bb98273076fee6d916c5181fbdb6f2c9687b26055bb0ab60010c9d1bdb0f
SHA512ce0a1f4b62f315bea0d997f9c4843111da5ec6db46c3141f1081ec05808ca1b2c4125cee826cd4950077b241a3e028377c1a804fe331bcde618e700a0feba689
-
Filesize
2KB
MD504785804d61d12f7c5b41340725c905b
SHA1d570d2f228d67d4a04f989946ba37a43bc8a16a7
SHA256ca421cb99f17e9da3697d6034492ce7de436c1bff74867dffd3f55ebd7100111
SHA512d91a594d711f1f3001fb3912aeef26d201c2340ed306faf7e857c561b1caeb8988f4d2a2641ef22f66eacd73e273b4129390e855ceb4b614435cf0fe1430c14c
-
Filesize
1KB
MD5dec1b384cfaf33c2c44455fbcba4d9d1
SHA11630a7b67e6b77e3ac5265ffc06b4f69cb394687
SHA256e1e30d7355689af1a92f8971b48d55c55a5aba0ae7d25a79d8119de4919882d8
SHA512e72f2770b91c2258f1823107783c32223a7d6252f004194b8177150e5d335ac30d6d96aa1a69528ae27d444a0c36061d773c95c65892aea87915889eb6ba4178
-
Filesize
1KB
MD514f79e4990e3611ef3c6250aa8780f88
SHA1a938a853d1978724fe52d52f86ef768d086e8a6b
SHA25694234cd44b562cb6a0f24a3c33698b1ccaca842c7e5dd5219c8c91c535050a2f
SHA512af570b7348acb92edff4dd4f67b56af59c15f8d89614cbe1cfa15ae85e4c16e24b555b12035e9ec079c75b47c8c5258969046bac1a3a2c2492c38b6fed66d87b
-
Filesize
11KB
MD566c04a498e97a029d6fb1f262812ac58
SHA1adfea87e784ddf51580e916507da59858abd1a5a
SHA2566f8c83e9c115377c8fe7b1e8bb79b9bdec9dc621af0de9e5ed123f8186e296a2
SHA51245f892e47ff445f652e5cd3fc46c51d78a7349a23862c4351f4ce56701e0d8e59cf28b4cbf7c5d4515b9962381de0e865b4331c0def9031df01b7ca327247fa4
-
Filesize
1KB
MD5568b3ae148544d668a25f9bdfda87eea
SHA190c9b6910940525e0eda6a36ed37f91785d24eeb
SHA2562cf677d3827f349dbf80ef74cea73a74667154374035924ef2815abfb62c61d2
SHA5127407249b5e37fc1b793074ef989251ed99da9f82df7db982c87fad15ea67b2a747e790fb1b5185dba7b8ca259378541fc567fa4fc31dc2f8bb7af72fed06526e
-
Filesize
2KB
MD57ff2e2958b11f31b5fe329a9c6976c99
SHA1bc8949e5bba38f4690bc7800023ffbbf7742f9a1
SHA25663dd55ad8c5ce480cd103822fcaadd3f389c88f9392abe6b5c87d99eedcc7cb9
SHA512ecd539f7ac4874111d53468f80440112088adcb24b6d79dd3c5069c5c3d521914febb2599c038f95f2929273541239ed68490bfa3bc8acac82dbbe03df93c615
-
Filesize
11KB
MD5a79c2d812572e9c053e330e4d09c884e
SHA1e30dd2ff014c32ebee329528ee7c3b4ab81e20ab
SHA2561883e26454708acc0c2463f6b7a54a327118a7ce98997223b0e1d14dcf2f5834
SHA5128b8e9eaf49ca714d0f14dc45a3c77285115ae6372d5efb334a903ce722653742edc0bb543029f28bdbdeddaa40c4dea864ef9ec76728a38d02929eb0a79739e1
-
Filesize
11KB
MD5e2935aae6b3adb087353c83604d9ab0a
SHA193fd71532687eaabcf18e79990962de9d65c1898
SHA256e6367368cdc90a9765749411e59d3cddde79cc3b17f284194702e114a034b473
SHA5124ca03a077dd74d77b4423ac9cefd45c2deae9b7c63092b0f28e5f25cc54d82ca69cb9f6679bf0f1f8f0e339a8b2dff98ceed7aeb138fe2eeb6f2eaf18812dbd2
-
Filesize
11KB
MD5dac05687511e5bcb3ff3b59c8e1029ca
SHA1398a891182ea28ac5b00fea6423ac1cedb9f7289
SHA256b34a3111ec2b3d7f2a819f272839223bcd444f7e09d38e382f74a257ff44d641
SHA512fd972b7460bb6f2eeaa4fe8b003cf1eadce4d867c9b29a84284d0d946bcbe7439300278e97e2067c30f26570fd473b5abce5d3ad776738445e1d1e0314c0c87f
-
Filesize
1011B
MD5053e05f13a369d7e24c9f821c5130471
SHA112bd8aa78b11aef82fb27b71bd99fd071aa296e9
SHA256f3db8346559cac24d3710bee8c663a940e35b057f596c3427f1e84d589cc1f46
SHA5127ec6ff45656d01d022e7da34b3eb182149374d2476f2ef290fbc312436bdf939ee1bd392605e515db0317d2c2836fb34f02167a44865461bc46996c391a8156e
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727656226049089.txt
Filesize77KB
MD5ef7a0cf9a6bca8879c3092f45c61aa58
SHA1e251f131d844b484215f42476b3b60e072d695f8
SHA25665720f15e107ea7d3ac507a0ee3448f72c58afc6964edaa6cd98acd91f7f3002
SHA5129408b0454f59454e75855edf750278378aa2ab438b8ad699f9f3833739677844ed0a93370271f8e0aeedca86c46cee5e98c2c2bec6860a58e6a510b3a289283b
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727656623420834.txt
Filesize47KB
MD5faaa251f06ece8a099eb38dac37c82ff
SHA11994fecbc8cd7e825c4381945cac932712bd5c34
SHA25640340e9800cc75fbce2938a0800ee9dda61ec251e7248a6b7c1d6ca1513571d3
SHA5127ef4a7a319b0bd50c7fe204bac9d9e3adfe5f40c5d7fe51515455eb1edb35e98ae33ccc31aafa4554c444c5db6a841f09e6da0e6ccdf57d18d51ad8a45ad046c
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727663536793873.txt
Filesize63KB
MD5bb3a833cc69c3e2f45ecd8337836fe1f
SHA1e74d00cdcd66582d6581d2d6300ceddea7ad1127
SHA256b6783c1cff1dae074f09a8c7fb67a367dde1df4d2ef9f9fd4412b78a4db4d95e
SHA51270ac70a13fd020fa84b874c68ee75e7cd059925d3812fd3af6afa020dd91d4e2d0ee9c90d10a5621108e2b586197a02a466607d45463e871e0d2f13250d39514
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727666235612999.txt
Filesize74KB
MD507e3fecf98d8d216f0487b92199029b1
SHA15526a18c22711ad4543077cf8aa4bd94cd90df7b
SHA256f00ad6debe25ea63f98c818e02fbfcdf9c4f8dbd5a2ae4675f728e52cbedde96
SHA5122eb7bab1ef218c7aed39a0bdff65f947a68c83823cc22c3d09383a5a4eb490cd3b8623a120b48687a265ed9f31505ae1348bd7ef705b59688f995919dbd42e21
-
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\File Explorer.lnk
Filesize407B
MD5a1e7fc341680a001afa05b6652d7cd98
SHA176bacd009d03bd1188503ed36d506ef00bcf7cb6
SHA256fae325fe5fd3435bc26b75ef828a8db0c063c2bcf0242fff95259cd17a712bd1
SHA512567f66e8816ac0811349414813be348553bbb465c09de2a9f47d98483d732aefa34deca0026296fcb202a76e0d7e29f4088cb026b439f863e67fe6581f662ccf
-
Filesize
21KB
MD5f19535f6394bf03180bee9ac724b80cd
SHA15af0a454091b714589efa6c507f8cde57e0ccfd6
SHA25624bcb0fcae0bdf214bf7e590692bcffbd701a25bbd71cdfd968aaedc27067dc9
SHA5123c3d04a4f97a708c1bf2154711a11a721ff6d393a03f38cc20d814b0589f68133e68d8ee67b50ed883a59b4fe4d4e328ad6395da4ef8ead3404acb5fa3d6d5af
-
Filesize
1KB
MD59925494bed9f10841fb048aaba6c76a0
SHA14f00272ed70b3f1b4ccf8313a00cf84ecd22131d
SHA2562ed3fa90e20a84b9948e24c69e1729e38649c2d04170c290dcb7bfed12d75ab5
SHA5128e97a313885cc43fdb19c32d4882249bd6c8745b33ffae5b6f79add111ab797adf416b97b768e64385f377ad0c3aaecc57046ef2ae2faa49f58c640cb4019db8
-
Filesize
952B
MD57d518c6b59d0322f80e99e5e417d3d48
SHA1738fc77523801357d05817ec58c96a4ca499bfda
SHA2562f8f199d74439453a1f966a14ada8bee14c4982c3bc703d69c5da6ab9dbffdff
SHA512fc79e050cefcb6b507e6e8e1ff34f746fb81794bf7e03dc68cc9bdefedf3e19518b2ebd2f1f8e3951be22f38c9612886b3fd563f3c9d692845233e43861be55c
-
Filesize
121B
MD5445afbec1a9131faabe3d9295c50c414
SHA1c0881a83820f9e5d4410dc1aa4c514343a3665e7
SHA2568405384be1380788486ef88e05a3a8d7ed153d506fc88fd06652d15cf24aa5af
SHA51260550f490dcc979115c3cce3d6c7f8904831d69a5cd6c38bef8e7b171f70d781de547f13c87b5a347d781366736c2f04995946ccd8ab3f2d34a443a203048975
-
Filesize
1KB
MD598fa0a175021128037b7937ea84c36ce
SHA16ddf3eefe0f8b34e6deecc38f6b209eaff9323ca
SHA25685e108da775516dd894c3659594fb61b41c11f3fc300d14e1d76fd59f0bc8744
SHA5129bb2349a546cb900d663431fe9d2e2391464e84cc15d840a9944a1edd98b158297d4ae3ac849515a10220e19131e3b36a548a100d42a2521e4bd96774da52a28
-
Filesize
8KB
MD5b0a50b065bea2c81884133a8e015cc0d
SHA103094e1f1b0b6cd89dbaeb8663251b8bb5164012
SHA25652193a94dc7229da5215c86cbad5311896dd291ec3544fd46a3d1b9d4f2988ef
SHA51237813b28d14717766f00d62f3016dcec2758c5b688637455d15f1a1deacfa9530f020daebc530d8c4d6c595db6d6af1d0f68e272b448b0501d0c4e9bbf5016aa
-
Filesize
61B
MD56bb7ade19ce482d765b3d1a80851d590
SHA1f014989c4ab6dda6e67e2bbadd35775b18f2ce3f
SHA256cd606d1ffe97de47a82e6dfcf39de4938019c44d1a180738dfe4f9eb99a77ef5
SHA512aeccee4ba8ac56b1f1d514abdd65f8cf9ff5699fa90fc580ee46cb197c47cf6288116356cadd25fcb75b62b90220890c3a9e0ceedbc66215db8e592fba217271
-
Filesize
914B
MD5f3b1ffe40f64ae417082a584c37c74fe
SHA136b2b2be1d6114c4ee438d138b887b1b16d08235
SHA256fb2e030cd20797648b8edce40b832938145600db635afb43248f9954031bfb30
SHA512e8b54b6fdc84277eef6038555a8f203f9e824cdd5dbfd388fb77a8fcff5b78d5964b4504fae40bec4ae70ce9117af40ac5059781a8102fbd86ec3797d9fb1b52
-
Filesize
90B
MD590f0484f10c7eafb9524e5bf7e186190
SHA1be17d708b67bbd123ef83360aa0114a603c1703b
SHA256f6eecd92b70d23003ba9970ce2945ce721dedb1540ea6b64b8165e3ab540559c
SHA512da5f031c0ba3476f7fe2784966bbdcb9c61d95342177fae8662b00e48e9fe4aeec1e3024d39e58b1aabd6d7f5004343319dfe6311a87949b9d4bda67a4a798cf
-
Filesize
90B
MD50599289e8ac007289cd07d4b70d5c991
SHA151dac2d1ee26b4a70fb5a45c686d51255684b2a9
SHA2563583f6d1c856710b9e916f9e782a56c6646fa6b4fb19af61ef5df70eb7eb2de9
SHA5120bec4662caa0af1ad8e0a65cd5819a45daeda0f09fd8a3baba77d7059700d8240ee41aa44bb8d60533d1f400738a6fcb3769d473dc07bff6cc71150e491a95df
-
Filesize
328B
MD519756955a4f50b67aebb9bae095db10b
SHA11d4e414f3289cd1c523da0bd4fe93fa481dde3e4
SHA256cf8ea2ae0550636bb2d8004c68bbaa4e1edaf460bf4f25ee435fcd0331d78ba2
SHA5125e2bb5551687ce2d41bde32ef16efc1eeef6284c6489e51b8833c65331e64ac58fe0e8ed216d5ccf650808996ab84f3a363441a51d023324bc55b07384e9e8f9
-
Filesize
1KB
MD56513f82bbfaddb0ae3c1cecaf4e719d9
SHA1333a52e741a5c535ebd0c57913e1cde3b2a42ec2
SHA2560e954e5f956b3029937f096cb89d3e0f59a20c8bb7a01d0843f11152d5cb5514
SHA51205a3593978189e314ff574338d48b7550ba1e0bb94a786423d5f5917a7d766d52029f517d6933b8b90d63e09e00ddccf2fda9aaa8dc3c4e668c1ac904b7f4dab
-
Filesize
162B
MD5c4133b9ddb67f10d95125b50a8f1ddcc
SHA1296bc330a72ae608be52ce28ab44d92c1a546e3c
SHA25622682d3212c8e837eeac4e168ca9184fd3bf5afcd1c4d218523ab9170c32fc1f
SHA51260b008f9d14c6f6e1de8f9674ffafb95500b728f88e9eabc345947505db727c12dbc38904079f6dfbb502964c565a104b377e69781cc08fce8824f80aded0da7
-
Filesize
586B
MD5d98e7904dd0b4dab56f66f4d01c8dde5
SHA1aefd9e3a59af0373aa841f76f9c89ab5bc475ce9
SHA256a6a3b85d52b84a1357895e75455258c2dc0644c0b52e1fb11a0f7e6e25976e6f
SHA5128020d7a1f4e0314b41c24e00cea153304b4cdb36141ef6e43e5c76f1eb38c383a9e2281ea62a585c29e17adc4e68e84024c711ea5127eaba5846c811a6baa782
-
Filesize
124B
MD54f3ac9506fa89246cd0b38a3e42eaa63
SHA184f67b85c17d8dd262e3be89bf8b5f183c373581
SHA256d7ce9c3ecdc3e7b227553ff159a1d695c219f3838e52cdd0e48c02c97e71e8b3
SHA5121a8e25ae31e85ccb9180ed92bf725128e0a74a8684361a750e7027daed5714054358f8112fc818090ce87ad91ab8aa7dae4a149ca0ba83a091d1e3c3aba2db8c
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\selectedTab_leftCorner.gif
Filesize65B
MD55720e14c31466316b71814716049144e
SHA1033d6ef73b8742dc3c4ca96c00830e0685657d2f
SHA256f4f89c555cdb4efa890e8b06f030d1fa4bf0fde5f34dc06608ac94e554a9fee4
SHA5126ebbdce11d62a60de23532d79fca160a0623a8b29d6d03e2bb96db2721b95f71d4192a45e966699b0edd4e5d5915c637b2002a798f19de62fb871098520faa98
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\selectedTab_rightCorner.gif
Filesize65B
MD57c663a4d837312b113e783e0541c1d7a
SHA15613cea10b1247df0a251a90bf8163bfb7995f9c
SHA2563cec27fc52a35a87ff0ec1e297f5f2a1ba8c17de0de85fc32e22af432da6b2ae
SHA5126e48d4a796cc29fd27de9f877d78b5a0987cf1b7753fad205e7167f77fb7b71fd55495f88b04a2995361dd7459f4b7ea13e73b72cfa7fe16133195be5ed1dff9
-
Filesize
8KB
MD5dfc82f4d8343c8b1b9e3208dd14d88fc
SHA140309152425f0993e5fb6029945d3d24103213ae
SHA2560b21ddcb469fed9970c31346dc1d8ae1086ef104481456389258c0a36a5179d7
SHA5126c49dab0fc2fc807de309052a6327ff24eadd0ceba4857f436f7b5b80c90558d1193c00dc8f9d1ca221b71fa5164f7cd36c474eeb675ca05e396c2f0197cef64
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\unSelectedTab_leftCorner.gif
Filesize65B
MD5b18b591bbd6c753b9b1840160939f261
SHA104e47457b11fcd2690d548a87e215a0c48ed81ce
SHA256f12cf35ee827971a3375f9245187904eddd6081b1175f63934f1acd765fc856b
SHA5123e5579e25ccfc87800fe0608856efa65246bb41c3478aca3bf5393d1ab5d9b61f8ca0d03f1f9aca7c954ae4779860a7cfcd2afd35119804d878a075ed5cd8e60
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\unSelectedTab_rightCorner.gif
Filesize65B
MD5141afd63a7efc70c24def1a5e60f68b5
SHA1f65ab5adcd8950b4b1aecec57fb690071a37e372
SHA256a971ece13c746978b975cea423900cde6ada61761c7723aa465238771ba8eb85
SHA5124078a1e4ab25c7a755c8d9a0decf22af75ea2c8cca237edc912723e8d13396c9cbc8a336e37a92265c58f2c752aba03abdb3d6414bd731a1fd3e48f4203f661d
-
Filesize
880B
MD5dfea1a9d65c60c0208627227b689c06c
SHA147ac861ada985c6d197a5126d7769bb2df9af517
SHA256ab9150545023a774cd4d6dcdc333df9e9e6b536e9cc5a44a55b29e46e8b53633
SHA512c650f54ab1be21c20c478575cc921e6e2fcca863b9767ea4818caf23b33c1f52e80a8257c9ee81f215d475166227151a10039e9aba2946d90c7f12227de1c843
-
Filesize
1KB
MD5e981a0db5161b5426792105910ab8b91
SHA11fb880aef60ec198b7a04b4c1a6544fed99119e2
SHA256ace6ffd1a6ff070b30fa7564d742a08ee667fea276ff3a3cce8a623129fbadcf
SHA512157b22c7fb39ef220772cd28e8fcd7072cb21e7bd8912140fcf9178ad84f8443ea7928d3316fd59239834fe751c5d3d1992fd1a6fd9bbab658c2ebf3a41225d8
-
Filesize
1KB
MD52fdc923c32a8623594896d402d391223
SHA11f49e2332b1fbe8167bf4f736b1df9b1804ad89c
SHA2562fd15de19eecdcfdcd8da7ebde8505b635f868dc9c544c4c8db040c7e14f6771
SHA512e3707ab794942ff8d81e3cc7808cdcd6043595923b1663dee77364fa8bab8193d994ebe25cda510f1c6f6af1ca6fc8d6d7959076439d07ee83671df1e2babf6a
-
Filesize
1KB
MD5f277427707d05c161973fa90f29d3e41
SHA1e1491d700a50051671c461a048587b932a574726
SHA2566ce561f590a4fd8cb24082328c469e8ef5c286d303f4cb21d4e4ff9a239c2cc8
SHA512a3469f1ca65c4f09cd36a486a88bb4cc9dabb1d20f656cf8e40b0ead989243960f89e68039e2454b682a5c8e843d9012f144952390514cdac7a9c10b5e96bac0
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\3 - Windows Explorer.lnk
Filesize1KB
MD59f89839c403289b9b9d0dd99e3985cd8
SHA198c1d4bf14069521974a8ad700b1c0aa77f008a7
SHA256dcbf14a98456efd0594e0e67bd7e35091bcf7b4ffb3bd76dacd42d6fb6b4baea
SHA5124a6c95b92a99b128a67d71e37cf30e357c794d639622391e6072f54ead9729e0e1af2f745ef9e079b803f21503829391c25c9baef0666ca8edcab08459c9d24a
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\4 - Control Panel.lnk
Filesize1KB
MD57b2e6ce3b87ffd5208d9c25ea432375d
SHA1cbff8af7296ea66a899f0744b1500940ed6ddcc3
SHA2569c56891317c7e4e30afc5ca183e9b6e9cc7f38c5985403d0c44d509314638fa5
SHA512db0aec85d06bfac575e35e9bee76f156c5c6e0b14ab9e1b84c7dc35956494dac084cfff98c9387987c1a68d415380c30fc07444ffe56c41441f56473d29a9a3e
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\5 - Task Manager.lnk
Filesize1021B
MD5bbd3c30f0a6e188de2b70f3854bcffc6
SHA15deb4440d10fb971ac21dd8ed1e0d2d23bdbcdee
SHA256e1522744206bb6889db49cb8ac967fcb1b6c454ef5814f6329ab2241ccd47795
SHA512043f9686414239a406995a7f743149071a9d312f01ad0fe5c66f804d327a0c5976e66be20a9920ec46b6def6a92093f6f8f18b07158f6f3ad328c314020986a7
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\01 - Command Prompt.lnk
Filesize1015B
MD54b03785586e2aae93f5ffe782c123ec6
SHA1b21ac4d40a6f9c3d90416c075538e6bab6c64262
SHA25609db5554f82458a46e7705bf2335cabff406f0ab9bfc186f757a6acabce3bb13
SHA512669224dbd2ed9494ee587b7de6fda41ea97bb4146e25448d13bb34ae4e9e4e0402d5e21e06c3fb4ee4fea22d9d840614c9965f2d55306b1ff29fe96d27791cbd
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\01a - Windows PowerShell.lnk
Filesize1KB
MD52fa7889e8e381b8a3892b5c02bf80a48
SHA1e89635f1abb06c19eb00632301401e5b189c368a
SHA256851d700c1bf3e91d876ebce28df10f3115c3cda0ff27006cd364a0d2bb6614ab
SHA512b5bbaa833e3f5daf582b7446eacfec3fd0ac18bb532a72d13da728c1d195ec8c81f70cb10624b9b95113c854148bac9cd8e8f1ec75e21bbc193ccc822def9fa5
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\02 - Command Prompt.lnk
Filesize1KB
MD55cf8784ee477d27eefcf6aa3e1676b3b
SHA1f6912d5cf3665184e5a93cf39ba32a36eeac3e05
SHA2563fbe6db1ef2c2009e3625bc6b76c61b365daadb94ce97f79e9531cf9146fd880
SHA512bd489530b319ffa8f38d23b751b6283864babe04aead3b769e5de028c7e882c219fe9ab71ee2bfae48109e010de7456691ee99518270805bb3c3f674cbdc4f7f
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\02a - Windows PowerShell.lnk
Filesize1KB
MD590efafbf0f285f979fb624e5208c56a3
SHA125e52c43ef6558a9e77ebf7412a97d69eb8bb4cd
SHA256d69d1485539f4d319c98e709b79caaa2387261686a703d9683726e970b42e55e
SHA512d645f2c44b25a5ef5a47e1a4fcca76da06cc84ada8236cf3516629bc92f2f456896413c1ddbb0ac38b669cae515b49d1a29e24d766b649847adbe696e41d10cd
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\03 - Computer Management.lnk
Filesize1015B
MD52477fd199dcc74717d31a33a948c3ef6
SHA1fee3fac79078cb54dfebf1be1d89b135e19b93c3
SHA2569f57646b8352e56f23c705d347d18c380b7affa2dae8ef17e9dbea90cdd00911
SHA512032c902d09a72ccd640eb6295f6f95bba8830a557bab0e7f273c823a98dca33f3114ec4a280124f83f3175e24c476a7e1cd32d19c34d827e23a0e0a14cc87c12
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\04 - Disk Management.lnk
Filesize1015B
MD5ad7ea5c417c6b7c47e73dda17fe9b7c8
SHA123b487ac205bab297ae287d7f42740c42d48c160
SHA25636429b581fa27de980d4063d5487ab8d9cba7b1edbb1cdd90f4bf100fa8ad790
SHA5128157602331cd3c6ef5b4c58a70848c136cd1e4c5f4f517490094bd307a8bc40a2538832178307d0c4a547263a67b296bacf7e62790d9dbd00bbd4d5ea96aca7a
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\04-1 - NetworkStatus.lnk
Filesize1KB
MD51373946853d0c1253ee6a0f90f8a4949
SHA1fbe692d0dbdc87043766280dc396ef668152edf1
SHA2568b1160b7c6fe26f01f734cb2e8b63bc9f6882059b8d059c46405ade2286bd9f9
SHA512ca9054748242cbd8b4daf083317377c227b2fe1d119c1ca4aca5408b9a7c9fa9851ac16e8761128cda139c12d9feeb41e5bc05341fc4866fca1238f54980ef23
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\05 - Device Manager.lnk
Filesize1KB
MD5e5a60204880b45fc0242321af4a05fce
SHA1c6369e3174254b77b4e6953de67db1c2aecd6a3f
SHA256387ad7a483c7bbef43cce25f7ce43ec1e98409d2579ec2c5527e27900748270d
SHA5121d6da90619f1e5467d95c44c95ce86df581582d09c6528ded2d68018309229a8f2280395f7e1c3663dbfc0dd4ddd2a9331be3eacbf2dd11182dc415430c7390d
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\06 - SystemAbout.lnk
Filesize1KB
MD567fac971936dd91b942766df2a9cbac7
SHA1fad97a1b94fe717e9262bf007d3dc8bb1d0e49a2
SHA256b89c4d04ba03a23b2e847b5b7ac4cb3abf22b8ea0f720fde04a8b1cf29235c46
SHA512c3db3ddae736b5fccc602f6990100be6cb17d383e0e923063536c117c79d81a0bad065d87cfb214c26d819f67e843e04c450a9115d158cb6190b760d045e1188
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\07 - Event Viewer.lnk
Filesize1015B
MD549ed0de229af059ca5ec29448543bb98
SHA1a3769ee0a771d0456e4217b47097268e60897ec4
SHA2560536737d3308481ba1097a28e30cb0a97d84e63f1a7178bdd644a1b528e336e9
SHA512d6335112bf8a2c8276b40cde15b60f77c2209730b78cda21f1175a68628c702a174e2e1d9f3c2d4a942c4bf550e60d3d95991d95f2a757261e5046b4900ccd6c
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\08 - PowerAndSleep.lnk
Filesize1KB
MD595945403aa7ce6c2226ec47df077be44
SHA10d8053e44aa1e87691023eddb92b7228cbd7e3a7
SHA256962aace4ca19678847ae8ad4f9d66c8577d36b50fedbdf6255ea7fd8b509be49
SHA51217434ceb4215c9d230ce0e6a6d3545f4e22b40a8c1151bdd9aedb4c64762b87d34856e98a480f6b62567b50eba0bdf31340a71558f6dc7b8467c29023e6570a1
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\09 - Mobility Center.lnk
Filesize1015B
MD5eb593c45cef279c37373769d8fdcb71a
SHA1e24fdf144b44aa933e25fc3e29128b479081acc9
SHA256e2a0a52b8e4dd9f975d94297b91444b84c004b748dbdde7db8dabb526810fc99
SHA512144b81ef8911929ff0b7370dda2ba38cb8cb6bfc9d91a49f74059f663d66fd85b1d3f65ac25d1b489f56c81233313eeeb17d3e23b6ceaa92eac28dde460069d4
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\10 - AppsAndFeatures.lnk
Filesize1KB
MD5d6a4f2a20588ffce660bf262feed54a1
SHA1b75ca6b6ddd6c469154a92c443edec40b9ddaa5f
SHA2569dd5471078047af116046954cf9f82b037ba4e1b610df17e35d78f940db422f5
SHA51297bd9b51e43ac90ab0df2b56dd46019531e92c026ada397a956b27c93d0ca4dd7e43453c8704e8d5e7df58ef08dc54f8ee3fefc4ffcdd0ab5b7c74388767a5ae
-
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk
Filesize352B
MD5a51f63edb6ff637723c56adac45e6ced
SHA1282ac7975ac1347d28ce3ccef910349c66d7212a
SHA2560f8e72992d9d98a67be767d86a77aac6ad11408e931f527e8d515527460d30c9
SHA5127556e667280c0f962708c99d960a2358ecc57fd9086727e6c910ad9c7dabbceadabeb6974a4fc5c4beda12a50f573e43075399ddbfd82ec53552d19715383e77
-
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk
Filesize334B
MD51fa2cca339e56832f8d267e30150916b
SHA1d91a59f5c068c025f689e18f0964f5212b365b98
SHA256d424336f4d6d4280679b85e06fe2531da6a25d2c9bbe8988f8713762aba3e15c
SHA5126f1690b224e1e1c14fb48c4342ce3e8c7a1490757002b58e54b2a8c3fc7ce803d528aff1fa92417af947493d05d561dfcb9c68b5ec9e10c935b6bb396e84f137
-
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Magnify.lnk
Filesize1KB
MD507bb24f3da000f3818657c6a4b12b4ed
SHA1a4482af8ccdd3583c07b7bb813ee194abb46fe2c
SHA2565f06235bea9d8ce0b416b763984e56df2d0b9b4bbd8bc000424c8c3a14a432e2
SHA5128d477e93d7e622e8583000b3d4999eb96e8b3c862c39e62b7d872dde03ede1418b8e897ac809a1269b665fd905c062627a81492ffc5919a9a058e1ead14a3409
-
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Narrator.lnk
Filesize1KB
MD5b06349c62e8ace1cf412feb42b889fa6
SHA172d2ed82251e7dfc3305e66566578b3544a45da2
SHA256ecf9b4c83811189f6183b18598b9b0decfb4a9fd87b8d7e3acc034d543045f85
SHA5124b42489fbf98aa4d78946e769d84294c1f3cd71a866b9f985559f25b7549e487e0c572c99ac6e1a57a791c113311affdc7355374a40ec8cc11b80e6e35c9634a
-
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\On-Screen Keyboard.lnk
Filesize1KB
MD5cfa417d33c4384ce24129b96c8bb6d5d
SHA1f50f80a67cbaf493cb37ea423bbe914fd50efdf0
SHA2560858c7ef08d8246487e44242fed8376186131c2d5d3ab9ef7c1e560076378074
SHA51288fa89820970316031f68abec5cb2053910ff0b7dc13bbe27ded1503577cd67bb02cf11559d2ca63a5c1e9165de928370cc32280e5ef9334821a3fc7dc37398a
-
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Administrative Tools.lnk
Filesize1KB
MD51073171dc9834b334b8d85a5fc2251f9
SHA1c1eca37d577c567101af4186109e2151fffed796
SHA25643d30e91bd841d8759ace3877bf048142966eab8e781d627d498a8f1c2925e3b
SHA51292995dfbeee291121bc8427a90bbaa9e94f7adbf2ce23fff479d5ec5ee70cd1e6333bcbf019a86d87b532c1615367d1621d32ff70f27aaac48f253a56cd3f687
-
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Command Prompt.lnk
Filesize1KB
MD5897cd4922d8ae24ae793c2a7be374c95
SHA196f3d34785afb76598b79421c4cee6980e4e9d01
SHA25628c7701cee690d1024373e8ffb3953379cb9e5d35a5d24e5e991a06959f1ee54
SHA51226888326c0ecfe517dfeb18b62ea83e3f404ddb3749cb7683b93e3d4d2f11b41865b16e8a7c7584c8e6a223bc410d4518916debe5078f8507210f2bf34332030
-
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Control Panel.lnk
Filesize405B
MD5ec5bbc538a82195bce2b2f955359889e
SHA1b7793f1a48c4976f5782047c58414d90c014403a
SHA25652db2a32bbc55f397a1d4117765184de829b901ab08961fb8a82d3347b0ed921
SHA512d680e5658edd455483be7a0fbbd390aa59c6cfd593e327e5f997079a951548eea9fc8aa24dffc27c0b1cff51bc8d33bb26dbea94c9e8eb2f3fef7768eab4e65c
-
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Run.lnk
Filesize409B
MD558db889de3593e735d44109dfd20efc2
SHA144325ba82a2b5e60ab3985083fa8cb5e1a5dcc06
SHA2569c409b1f0948c561aaa9564245acce3a0a766614c105658f67d8fc6e1a78c01c
SHA51289d60c250733d5b9db7358f4354d6895128cf85938b56889939f30850f9ed604aad4e45ed89693e26c5f86dda2b9f2fe54e2110969a9c6264976019e79dbcff2
-
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\computer.lnk
Filesize335B
MD58c83789610a1fa5024e453a4b04437a2
SHA136452a7703aa52a568bd4bb3ea36022b6e4bd81e
SHA256128c2900a6d7246fc8bf6d0dd3237e11214187c1e31ded7f24ab973f19b3d294
SHA512accab8b29912ad119b096aa174bc58fdd17d1833e89e1e52c47933426ff2904efa2354597b3e40f178c7cfe6feaf69cf5bfc7fe8381ae7939c02e0c2e3766c13
-
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell (x86).lnk
Filesize2KB
MD569e34b1dc3d30b172caa95a258ad5d77
SHA14d97966bdc0d4155a3250e8fe0541ca929c388a6
SHA256f2c0882a8e24117029da3576d1760cbf4679624ce0557010ab4eccaf19586003
SHA5128de299246d606f4879fa1d6c21a99c1115e9c9dc6743d2b23fcf60dea73630f536ff6177acebc82186f0b703bf233b5815f119ebfa75767945d804ba27a6086d
-
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk
Filesize2KB
MD521ee2c41d203c41eb021eb0337c0e304
SHA13a544ef432a9dfade757a31770807104228675c4
SHA256ed730410d8561410399a40ff07543951a6bb4c43168adbc2154e2a7ee123507d
SHA5124c3dfe9b83fe3c1e04d763508539cd2fbd058045c01251a6c57ad61b163f19ad3e52dfab4f12d5a4e798133e98874bce6bb81655df0a965e3842a60a10ae9383
-
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png
Filesize296B
MD5e1ed2f5edfc8076c3812f05f4be28e10
SHA1cde742782b1c4a8411e67c0f284b36c66144b912
SHA256de213d54fc15cdd4fffdc2cf1ddf076afb503334a95ebeb0be10869e8c1e74c0
SHA512560eb5ce82f3042311f0b62e0dc1250d95b0e54f745e7df43e3b378f30abaf1834a4bcc23dc4a850dbcef8b1b52d4a610c3a039bb6249dc9c4cbaf488b0f77fd
-
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_contrast-white.png
Filesize276B
MD50c5d0b3ca5c0a1bfe8f66b33ce88f6bf
SHA1eaf0a895124bc203a039ee2f2be2e0ad99fc9665
SHA256c4f348d979b453a66630be92e2fa13df1c9a0c6f943d04ab550fd7db2e1fe2c1
SHA512f31dd9ec691a5c90922993e7d3c6f673dfc486198b3abd1a5ef0e23233bd38b53c0ebd31f8c33613916408e4dfb8c2408c7dd7e52cfecacf13b0f063895323fc
-
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png
Filesize296B
MD558c8c250ae6f3e5a29df06cf8d78ab85
SHA1e4a0ed9c494e9812c0f49f3269d3bb3d42d44aad
SHA256889755c8bc9715a7c39bc05e0395576d3686a8b5392f8692dde1a4281aa61552
SHA5121c56f71bbe7a013bec587c563d301789111e49e5c3fc4c2e0dafe59ec86fadd608ad6ce09ddf718b2e8ccc7b201e3f22e633a34f5029dbeba530c0bf7bab7a84
-
C:\Windows\WinSxS\wow64_microsoft-windows-onedrive-setup_31bf3856ad364e35_10.0.19041.1_none_e585f901f9ce93e6\OneDrive.lnk
Filesize1KB
MD5dc3671168233f979b5741ce063bb13a6
SHA16a1635862e5bba1a8dc5749348c359c5be1e5609
SHA2561389b11cb5e5357884705a4c823a9e7618ac7c70b443c128d5bcd1f85e2fa23c
SHA5126380ce0b011ceefc96e9dc563a992d80d1065d85f856eb4e0b3471e667dbe595975f9979ede2ad758908411605619f778d1c950e869df388812d483c186839a1