Analysis
-
max time kernel
139s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
15-10-2024 16:22
Behavioral task
behavioral1
Sample
48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe
-
Size
18KB
-
MD5
48cee60c2d2d32979c40c5f630c8f220
-
SHA1
12531e0df36c3b5b4fab47bb7feaac105fffc30e
-
SHA256
b43c7c6a97d02ab5e6a4bf60cf9188edac971f3ef8a807b5756a1584defa2297
-
SHA512
b63758ffdec53453f01d01e983765a4b43b4de764b62968da350e1fedd8a8c80f17965a0c134952bbf92166b8748fcb283ec0db23a6ffd1edbc15c07c40221bf
-
SSDEEP
384:SebFNw4Pk1itKkpAjjI2YpdmAZQzVg48JrX:S0FmBkpKjPYpDQAFX
Malware Config
Signatures
-
Renames multiple (2177) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Drivers directory 9 IoCs
description ioc Process File created C:\Windows\SysWOW64\drivers\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\drivers\gmreadme.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\T77E0sNhHdq7Ov6.exe" 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\@EnrollmentToastIcon.png 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\c_pcmcia.inf_amd64_92be188847324ddb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\netbrdg.inf_amd64_8a737d38f201aeb1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\netvf63a.inf_amd64_a090e6cfaf18cb5c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\SysWOW64\InstallShield\setupdir\001e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\SysWOW64\sppui\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmcpq.inf_amd64_3acec385f5d67bdf\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmpp.inf_amd64_e196624c9ed43e83\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmsuprv.inf_amd64_696bb57f8e3bab65\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\SysWOW64\oobe\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WaitForSome\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\SysWOW64\DriverStore\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\SysWOW64\Speech_OneCore\Common\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\SysWOW64\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\fusionv2.inf_amd64_a47d9636ce0d7dab\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdm5674a.inf_amd64_ec8de8952888a618\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\netax88772.inf_amd64_5d1c92f42d958529\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\SysWOW64\IME\IMEKR\DICTS\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\SysWOW64\Printing_Admin_Scripts\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmmcom.inf_amd64_9179c145f01530e4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\net819xp.inf_amd64_ff7a5dd4f9b1ceba\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\netrtwlane01.inf_amd64_b02695ef070d7a42\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\SysWOW64\it-IT\Licenses\Volume\Professional\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Utility\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WaitForAny\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Dism\ja\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\UEV\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\MSDRM\MsoIrmProtector.xls 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\netrtwlane_13.inf_amd64_992f4f46e65f30d4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\xboxgip.inf_amd64_90ed6b3fdc759a5b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\SysWOW64\MUI\040C\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_EnvironmentResource\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmrock.inf_amd64_9b13bcc1f320d1ad\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\SysWOW64\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\de\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCClassResources\WindowsPackageCab\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmadc.inf_amd64_7b6fc0e15997ce81\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\SysWOW64\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\SecurityAndMaintenance_Alert.png 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\SysWOW64\spp\tokens\legacy\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AssignedAccess\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\volmgr.inf_amd64_b98e2b928f71a2b1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\SysWOW64\InstallShield\setupdir\0024\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\hidir.inf_amd64_7bf4a320e4ec8b3d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnms010.inf_amd64_9e410195c3b236c9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\tsprint.inf_amd64_6066bc96a5f28b44\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\tsusbhubfilter.inf_amd64_283a44fe508f0682\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\wsdprint.inf_amd64_b616bed30e8928ca\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\SysWOW64\InstallShield\setupdir\0005\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\1394.inf_amd64_a08737ea39f5790b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\61883.inf_amd64_789f35bee584a939\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\ialpss2i_i2c_glk.inf_amd64_7b6c08738ca8a856\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmmhzel.inf_amd64_e90a0a4c8e15815d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\sisraid4.inf_amd64_65ab84e9830f6f4b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetAdapter\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\bthspp.inf_amd64_bdb56f181ef6934c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\netr28ux.inf_amd64_d5996f2a9d9aa9e3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\SysWOW64\ja\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\SysWOW64\migration\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\SysWOW64\Speech\Common\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\ScheduledTasks\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ProcessResource\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\c_fscontinuousbackup.inf_amd64_4db9ca877f67dd36\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\1033\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\LiveTile\10px.png 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageSmallTile.scale-400_contrast-white.png 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailAppList.targetsize-64.png 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\images\default\linkedin_logo_small.png 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\AppIcon.targetsize-96_altform-unplated_contrast-black.png 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsSoundRecorder_10.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\VoiceRecorderSmallTile.contrast-black_scale-125.png 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\images\AppPowerPoint32x32.png 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\MixedRealityPortalAppList.targetsize-64_altform-lightunplated.png 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\AboutAdsGenericBackgroundImage.jpg 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\nb-no\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLUEPRNT\PREVIEW.GIF 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-black_targetsize-30.png 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\MedTile.scale-400.png 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarWideTile.scale-400.png 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailLargeTile.scale-125.png 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Car\LTR\contrast-black\LargeTile.scale-200.png 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\pl-pl\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\StoreLogo.scale-200.png 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\MedTile.scale-100_contrast-black.png 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\Background_Safety_Objects.jpg 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\contrast-high\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteNotebookWideTile.scale-400.png 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-60_altform-unplated.png 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarBadge.scale-200.png 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\cstm_brand_preview.png 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-30_contrast-black.png 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adobe_spinner.gif 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MediumTile.scale-125_contrast-black.png 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageBadgeLogo.scale-200_contrast-white.png 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-256_contrast-black.png 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\da-DK\View3d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-black_targetsize-60.png 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsAppList.targetsize-96_altform-unplated_contrast-white.png 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Car\RTL\contrast-white\WideTile.scale-200.png 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Office16\FPA_f33\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\en-ae\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adc_logo.png 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-256_altform-unplated_contrast-white.png 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarAppList.targetsize-256_altform-unplated.png 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\LockScreenLogo.scale-150.png 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\WidevineCdm\_platform_specific\win_x64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.513.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Lighting\Light\GlowInTheDark.png 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\AppIcon.scale-200.png 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\sl-sl\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\RTL\contrast-white\LargeTile.scale-125.png 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\TrafficHub\contrast-white\SmallTile.scale-125.png 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Square71x71Logo.scale-400.png 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\Background_RoomTracing_02.jpg 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteMediumTile.scale-200.png 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-32.png 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\Doughboy.scale-125.png 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarAppList.targetsize-48.png 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Program Files\Internet Explorer\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_2019.716.2316.0_neutral_~_8wekyb3d8bbwe\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.scale-200_contrast-black.png 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fr-ma\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-48.png 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageAppList.targetsize-30_contrast-black.png 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNotePageLargeTile.scale-100.png 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\kb-unlocked.png 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\LTR\contrast-black\LargeTile.scale-200.png 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-a..recognitionadapters_31bf3856ad364e35_10.0.19041.1110_none_716fb22d165a336a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..rpautoreg.resources_31bf3856ad364e35_10.0.19041.1_de-de_8b8c655d4789ad47\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..tworklocationflyout_31bf3856ad364e35_10.0.19041.746_none_f45b2d2476c81fe5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_percsas3i.inf.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_ce7df9b7abcfeda0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_lsi_sas2i.inf.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_94c12825941b5b0f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_d1f435fdf91e63d5\PhishSite_Iframe.htm 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ork-msctf.resources_31bf3856ad364e35_10.0.19041.1_de-de_b465665769c4d842\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_scrawpdo.inf.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_173acea5b78d8bbd\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-o..tooth-hfp.resources_31bf3856ad364e35_10.0.19041.1_en-us_eca7356e184a830f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\WinSxS\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.19041.1_nb-no_3420e1dc94cd020c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\WinSxS\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.19041.1_hr-hr_91b1079c55cc3459\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File opened for modification C:\Windows\SystemApps\Microsoft.ECApp_8wekyb3d8bbwe\Assets\Square150x150Logo.png 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.19041.264_none_5481650943811810\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ctoryclient-onecore_31bf3856ad364e35_10.0.19041.746_none_e2069d230cea7747\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..tup-ie-ieui-windows_31bf3856ad364e35_10.0.19041.1052_none_ff653a7f07c2eb65\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationBuildTasks.resources\v4.0_4.0.0.0_de_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-eashared-imebroker_31bf3856ad364e35_10.0.19041.844_none_67b5915b5651dd8a\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ndis-tdi-bindingengine_31bf3856ad364e35_10.0.19041.746_none_1c0e323084570b53\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-telephony-phoneutil_31bf3856ad364e35_10.0.19041.1_none_97174bfe81ba37d8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\WinSxS\x86_microsoft-windows-i..plication.resources_31bf3856ad364e35_11.0.19041.1_it-it_6fcc22bc2b91b17e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-aerolite.resources_31bf3856ad364e35_10.0.19041.1_en-us_7596a20e1fcd34b5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..imulationextensions_31bf3856ad364e35_10.0.19041.746_none_d6e6ee80f19ae0e7\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.19041.1_pl-pl_caa978e2e1557994\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-healthcenter_31bf3856ad364e35_10.0.19041.1_none_6ba2da093792c423\SecurityAndMaintenance_Alert.png 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_netfx-msbuild_targetfiles_b03f5f7f11d50a3a_10.0.19041.1_none_066ce525f9daa3d6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\diagnostics\system\Device\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-c..ngshellapp.appxmain_31bf3856ad364e35_10.0.19041.84_none_24f8aafdaceaf0b5\Square44x44Logo.targetsize-80_altform-lightunplated.png 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.117_none_e0d32848ac56114e\oobesettings-main.html 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.19041.173_none_6486f23c2831aaf3\InputApp\Assets\SplashScreen.scale-200.png 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_multipoint-wmstoastapi_31bf3856ad364e35_10.0.19041.746_none_df8caad9dd4996b0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_usbcciddriver.inf.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_14683ba967cda790\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..on-tokenbrokermodal_31bf3856ad364e35_10.0.19041.746_none_b7f9af5731258e18\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\WinSxS\msil_eventviewer.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_c681a6538fc9e40f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-r..ardwareid.resources_31bf3856ad364e35_10.0.19041.1_de-de_ab64e0f789630212\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.CallingShellApp_cw5n1h2txyewy\Assets\Square44x44Logo.targetsize-36.png 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_hidbthle.inf.resources_31bf3856ad364e35_10.0.19041.1_es-es_0fb107549962caef\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-uianimation_31bf3856ad364e35_10.0.19041.746_none_69765476ce6b52c3\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Transactions.Bridge.Dtc.resources\v4.0_4.0.0.0_it_b03f5f7f11d50a3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File opened for modification C:\Windows\SystemResources\Windows.SystemToast.Calling\Images\DropAccept.scale-300.png 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..xperience.resources_31bf3856ad364e35_10.0.19041.1_it-it_e1f063e51d144821\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_10.0.19041.173_none_38fc88f8cb913df1\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..trics-sensoradapter_31bf3856ad364e35_10.0.19041.1_none_c9a2d5a514d6bb75\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\WinSxS\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.19041.1_zh-tw_dcd6e37ff183c65c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_c_fscontentscreener.inf.resources_31bf3856ad364e35_10.0.19041.1_it-it_e91a43c0fdcf5b44\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.19041.1_th-th_8739216e3790b2ba\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00040408_31bf3856ad364e35_10.0.19041.1_none_2cc6f434cbdad49a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_dual_mdmnova.inf_31bf3856ad364e35_10.0.19041.1_none_02a78ea2d210ac5f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-themeui_31bf3856ad364e35_10.0.19041.746_none_6d4c8b91aeb12ffb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..mcore-dll.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_3033be76bc329cb6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-alg.resources_31bf3856ad364e35_10.0.19041.1_en-us_0a9a2abeaba63462\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-authentication-logonui_31bf3856ad364e35_10.0.19041.1_none_1b8420121296312d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mccs-aphostservice_31bf3856ad364e35_10.0.19041.746_none_33374e3aacb7c6e6\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-performance.resources_31bf3856ad364e35_10.0.19041.1_it-it_894f46c6814ac5e5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..aml-phone.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_42dd145d1f4ad385\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..bitsadmin.resources_31bf3856ad364e35_10.0.19041.1_it-it_ba619d64cfc181a1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-icm-ui.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_2153b4e0fe540e12\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-idctrls_31bf3856ad364e35_10.0.19041.746_none_763f66e71796b42e\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-srh.resources_31bf3856ad364e35_10.0.19041.1_it-it_b84488df74bb7a40\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..services-publicapis_31bf3856ad364e35_10.0.19041.546_none_a52a325e25248692\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_dual_mdmgl002.inf_31bf3856ad364e35_10.0.19041.1_none_093f50a42cecb54c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..it-snapin.resources_31bf3856ad364e35_10.0.19041.1_en-us_60d0ba296fb2847b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wfpipsechelperclasses_31bf3856ad364e35_10.0.19041.964_none_507f3b8f5adc2210\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe File created C:\Windows\WinSxS\x86_netfx4-msvcp120_clr_dll_31bf3856ad364e35_4.0.15805.0_none_bcdc70ae3d2b26c1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe -
Modifies registry class 10 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ULEPQAWHZVFFULJ\shell\open\command 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ULEPQAWHZVFFULJ\shell 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ULEPQAWHZVFFULJ\shell\open 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ULEPQAWHZVFFULJ\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\T77E0sNhHdq7Ov6.exe" 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd\ = "ULEPQAWHZVFFULJ" 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ULEPQAWHZVFFULJ\DefaultIcon 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ULEPQAWHZVFFULJ\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\T77E0sNhHdq7Ov6.exe,0" 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ULEPQAWHZVFFULJ 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ULEPQAWHZVFFULJ\ = "CRYPTED!" 48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\48cee60c2d2d32979c40c5f630c8f220_JaffaCakes118.exe"1⤵
- Drops file in Drivers directory
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2520
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\aic_file_icons.png
Filesize50KB
MD530df42721a8f98736509202d5fb00569
SHA19c63addbf10a8fa0e9a7e2c624f38e4d438be2bc
SHA256606708e978146b28186d66971b9411d98f64346fa66811badb3478733ad240b7
SHA51283ab32308b10973addd9da78f9f326169ab7d6b63aa15ac2710ced515689fd45ecf3269b4bd2efafb6e32d0501af87c7feaa44b819fe4d276aedc31514d5ca22
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions.png
Filesize1KB
MD5019f5e2f95a45768be6fa7f1f95991a7
SHA14dcd79ae1fecbfa0c632574817a1373e999f0264
SHA2560d7b707070e2b1916586ade711210b9edfd64e589f4519ba2d95c63a91e60b77
SHA5123eeaa1d9f2884ebd32082a054108c48e58687657b0a2a0273adfc1cf35457c36da0d3bab8fcd108af824315f79fda418b70cf72f74619ec0a076d7a794a9dee9
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions2x.png
Filesize3KB
MD5c08aa57aacc75979b2a7eccfbe4b55e7
SHA19c0e9e10ea2068baa612e7497f38808485e3770a
SHA2560d7d2efedf4b3a234d9b79b14fcf1bb8560be624543078446bc4aa68066508f9
SHA512ac4a78f244e882da512ce73b99c7f1e9a6394275790f420302294af8329ac33acb9fa9c2d98b003f5081010099df6df2eaa162da871d356fdf58a50a13c1e05a
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons.png
Filesize683B
MD505c8aa7112e0964c0fe375f31c60391d
SHA1587009374a7c35a778ef0ccd7f5e7cb7c62c06f3
SHA2567aa747b0c8747b68749eca404e15afc9d59bd15cc7de4cd82776bb4c651206cb
SHA51265e0eb22bafcccb418b5b1cda421e1a35786186263f31a12ce730abdffa19ccc2a33447d04b14c2486e200b2d8e668181e73cbd22cb1839983c74fe857545450
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons2x.png
Filesize1KB
MD580f6f56983dea567a3528e2befde7f5f
SHA120e80998720cfac753655efc06b25ae96cd3c802
SHA25617065d0e6bedeb114dc654860c27e7c91987a6204394a8ba3da47fb90e25d3f5
SHA512cf56a2c51887811b4b77e8d2074e6faf246cd99fda932694ba270f4236677d0da0c8ddebf96dd1dfe2d29a60892a4893b5562cb7bbeae2a52dafb8fc5c562eb1
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon.png
Filesize445B
MD5ac51da2b393018fc0b9bd517e9773381
SHA1c897edaf08586ac4ca8c37e542f1ce98bc8c6f61
SHA256a394434f430c39edc8653597bc6505b08cbe4ac2dce2c290a1ade53933747401
SHA51278a8d69927fa81121106729bd4d6ad7e86941fcda8b8bd76bbaedde7ec0eb4e1359058e9206df6c163f180705e7392d1a6eabab46a23489dc8467b441ef6c010
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_2x.png
Filesize611B
MD5cb2729017a340a1716a36337833f3281
SHA116799214cadeb9cd08acc82e43e7227cfb31fd69
SHA256c219419c92f7a0662e210d2c3bb309f442dab52f8b68697ec98f76bfe7c9c74b
SHA512eb357b9c6806f20b29141a5f55a8486acc97c8f90733b6898bdf3e254a822a5dbd92314c3045ff4ba5843e28a6350f31bafcfd6977e5749d32fe564f3cd6ce27
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover.png
Filesize388B
MD55368df92a66e67da9ae87445e39dcdcd
SHA10a73723d13cf74893feba88c3f5bc8ba79f5ee91
SHA256cd934cf5c1891fd40500e6aec6b4294528241753df80df3cdc4bc4cbde5ce877
SHA512f30c6d01f2910b66a2f3350f50f39bc8dd1aa2dd3e6f35da9f574908f815e0a7b48e78e8a3607c3d6d35b17c4be0aeb6a655d8aa58dad45208c02f774a8fcdd1
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover_2x.png
Filesize552B
MD5762c51a625a6ebef5b97ab54045b16e9
SHA174f073037c534dcb5a3c3d5580e66f006ea3ea29
SHA25680c526071ccd34b9c9e63221f69341375e4837ce2a02bdf0adba210a4b1bc5ca
SHA51253a7db5d7f0b362cb3d4007b2b0971420fd3578761e23a91be01d12ec3de0af81c106d0c4e2ff8dcca6c6183d7d79c9ef6d8cca40d8faab64ddcb25d19d8922e
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon.png
Filesize388B
MD51386147dbcacf47f17f2da280595145c
SHA1cfcffd7eff3127e7cd6748b5da8f57c349e1d637
SHA256b0bd4dfdf7c99a6eb340e98c6eeacf4059da33bf5e67e2a5ef6d936924be5623
SHA51268099b636fe06e3b7794829876a2de0d96ca3d6dd65747e5647afd93b1268408261f16f7b8f8694c9395fc8b6683940ab77d1aa20a08138ca2aed6fac8499189
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png
Filesize552B
MD51d29f810abe25e30ab5fd61a644530fd
SHA1d4b3034366f97b616fc5508118c99849c9328392
SHA256e77efbac98e17bee2979b2640608319b954a6af5c386ff5d350a3736d89de7eb
SHA512431f5965488eab1560b523f0b09f440d351023fd76ea3e4693a5fff80b7d0d9c12ae667c792503559fd1d978e8966f21a9317fe97f1a5917252d759e4d259651
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png
Filesize388B
MD5b49f20cdcc604a9118f0400f52102b4f
SHA1c980e339237687b86915b159db60ed9f4cdd6238
SHA2563453d1cc0d2ea30f1b477cf8362709f9d844551ac0757c2ff5f6dd724c200c81
SHA512ecc5e7b5c51b5cefb6f8b853158cf4b26972b9eb08a87fa964cfe4765d4224c7c95ee5f7be01bd468358441dccb90ddd57d317d6d410860761cbfdb54ade2f85
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover_2x.png
Filesize552B
MD5f427c8e83dadb0198afefadb79d5b2ce
SHA131ac49a0fb6b5079c19c51aac02fbd3f0877f60c
SHA256a24c23138fa087655539137c21f8c0ab6b801b809c1c15edc838f538adb228da
SHA512563da5537e46b5797cd4794ad1c8019bdccbfa2586ac8cc9e75ad0c618b6dbc14dd7b5154e2aa107966d407565b849c7ece9fc403d9863f65824e4486ce4ac5f
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons.png
Filesize7KB
MD51c7b98022dac3647d2c2854ea9a26012
SHA1abbf2f11e77f5bb576661f16551ad74d7fc4a834
SHA256b7919d37f35a2a03988eca591c6f5089ac54759e1950184c9c2e83a4e44c9c30
SHA512b4033e731205b1f1555d7c83ce5e38227f35dd2ee39aadbffd76482dc8321cd7a7031da6e1d031bd7dfeeb33d7c8df76b0a4aa2864c3d1e6d68392090d6fbece
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_ie8.gif
Filesize7KB
MD50fba249e3a592024ff0c0d9ed015f7a5
SHA101a77ed1c178621ac6f57d7fde0e00e260ebed13
SHA2562d95dd51c166a89115d46a710867ea6b4df774126d1972ef1257d5f7c6f225b0
SHA512fc243ee87bf43b192d93846df855ac4c5c03a0748d2ff5cf48d305cc33454cba7633b6ecf97b898f74aa72a8b194e2bf35178b715f50cb46170c1e4bcffb0eba
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_retina.png
Filesize15KB
MD5009cb7a7d911fa03b17d895f24582bf9
SHA18b86865f3ff89cb6e16016613456a7ba9aee8f92
SHA256bffa9181240021d9b5d572a09816700c1974c19ea455864ab4db0a10f809e2a2
SHA512d016e84c90d9fd47f5170bc0f5875c9b754d2237d1e7b43c334d49495807a8871922697fc3688bef0dea75de1606b652becc90015962efcf4de3ad62bdad2bc2
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons.png
Filesize8KB
MD5cd64c294b26ca2d6333b7d224b24ab92
SHA1e31f482afc1d05382d86f0e3ede9d58006696fe2
SHA2565e211401f846eb19726ff76447d16a85ccbd9a9ff761313ff68790f66af34c11
SHA512669079bd122fb3815ca8964e602c23a209a0be4d2325c97abe05b7ec8020b89ba918f3853b89a6a2fd3ff5079a0cfbedf3cc8991b5c6af8dedbffdff5d3c39e1
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons_retina.png
Filesize17KB
MD5b1d29a8c8020e009375b664553474744
SHA105b249c7e97ea905acc0d7f01ac906e4c6f04936
SHA2560dd48fc7e1454386719e8d6c8aa9ff5e671512413a83e6e76c2f0aa5e9473b8d
SHA512b4838d11907e5fcd1886f14a16256039f2c459f2c930de84a0610f8f2bf62974b33bd468c1f1aaa6292adc71d4eea0da136e8e1aef71a8247b4dd60f802aa91c
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_pattern_RHP.png
Filesize179B
MD5a1f7c1c909980faa4f64db304ada771e
SHA178c581a763a2e72932167027c85649904237ce11
SHA256d282adcc785aca26991a2e632677131446653952b5902884af4155d906a757d7
SHA512f2f312181374c32140ebf519d1450d0959d5248de55714f6edfb8e38f46aaa7af7ffb104642f45beb2b5d04fec6bc4b7cb09b1354604b119f87e2714589fc7f3
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_patterns_header.png
Filesize703B
MD51acca0c2efc96a4036a9ded0f016fa7b
SHA133ae22bbd9adf65d5643126deff40f82fd286507
SHA25676a49cb717c45ded834e775c06ebbd8ae4dae2d24dfb41aef5013b16b0096ffc
SHA5122fd8b845dedcc766861d13dd46ed48abd2750e7e8ce44151fe0a7e2adf3a8176f29cff88d772b534a2b24bfc0d81ceca5576aca7660e3d6e1b6b015eeba4ca2b
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations.png
Filesize8KB
MD56d1506239431ab3237377955142dae1b
SHA14f4f0c2667bc67f1b7f5984b61f2c572c54e2d12
SHA256398e356c9d9d6163ee056ba00010b8d657e0059ed960f2c6dc6570270411fce9
SHA5123850188d20d5c6e631d295b46bfc17943e5a93d5f505b2a11361bdc9ee5c1ad002d0eae423f6046e4c9579277f28c16bb61b47f70e89f2255cbed6600c543c2a
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations_retina.png
Filesize19KB
MD501aba1368289745e937b57f771885673
SHA1c1c47d63ade873992d546686ecf7de7c7dff2889
SHA256ab5475439b0220248cea0a74600b990d504d5c36d0179a1aaf47864ae9903087
SHA5129b00796e2bafaa2d6bd7c18481370d6305105970118aa1fa5b6351ee71b25356f0e972fc8d64c3e8ea665b5b79c66b7f8d40a726e071c14339d7c47a2b31e782
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\faf_icons.png
Filesize6KB
MD5522ffd639e3f61a20f3ccc0dfda13b70
SHA1f345a55a2ea7e3e45fb94dccd1770a76ba398b9b
SHA256ba40edbf82a4f885e7ceae0a4c66fa19977b511e711399d12156689a8d8a6620
SHA5129f6db7f760bc57f790ea519d484e532dda188542260ab9de16621f172524524b50b3fddc0a444a9b2db15c67e49c7b4cea0d69f025ebfe1e9639ca009494561c
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\bun.png
Filesize2KB
MD5790670c7573a034ed59a7fdfa1c44738
SHA18fbc71e2c1dc1bf9781fbe4191c142838312e41c
SHA256338523067f8b6d86e2e1078e00b1246aed55cb259939235a8c0090f6cd0532b2
SHA512c04bc3a114f083369af544baec87d15b0a343cd2e6a6b5908a4c0ee39578b05405875997678bd409ce37e4600e8a0f364b48995a073dea1c5198841a39bf7236
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview.png
Filesize2KB
MD50854bb2160c6d49d1770bbf39f14e739
SHA198d0d3a6c7c95c6d795a01a761df2b2426a872f3
SHA256e16e34ef445fd90b048790f08225a4dfa5e41e128d1c1849d1f13281f153187d
SHA512cc4c2b059745ec847700d52311808b5dac429d070c026b195e4158f7551a453f67bc05f967a7465d6e5096ec78f0186e7f37d733d57f66cc46c0cd47efe875fc
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview2x.png
Filesize4KB
MD51c76be33a7325d34a16f1cbee373776a
SHA1f35359fccab7fafe24f58248e2e663e454ac60b8
SHA256ad0ad4f3246f4aaae6ec3109426dfd57ded03f7cb2bfd99382cfce36b0f8a4bc
SHA512e38bbdcfb2752b43da86001adbbb0e690f2cded005ca119ddde76b4200f385ce434729aee6082e5452e4573d7bf1e28ecd64493b7d8b3b2ab3dc7d450b858fe6
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small.png
Filesize289B
MD58be6ed99a8d1639330b3a2f0e102dcbb
SHA13dee048c1a24377dddeeb562bb363e932e62b08f
SHA256a68e06ae84c96707e8d001a2b3e4d0f77611a299ec1503a3eed4b360575c0b1a
SHA512e4cdaf66ad92452880dad90e17e515e552ce1910028582c3d49fbbe91adcf6a48c682bd2f28af25a75273f5a3645ae3ae4ad43447e0d7cab5009c578c8f8023c
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small2x.png
Filesize385B
MD517429a1416d0ce3a7443bbfb66165e19
SHA1fc68b6ba7cc2168d064270282420fb59cc2bca94
SHA25649afe2928d180b7cbf1b4bf9d04384ef75b316e56264045cfe7b9afb7264f9ea
SHA512fc8774286b1ddedc95fd6f0d84a0a8726784a1c114fb99dff2109e01ef60af1f518b8a3e6ea59a8974b4927cec2b0a949e94c0e8e9d0b23c0fea2dc3771246bf
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\illustrations.png
Filesize4KB
MD5537cbdfdb89c23c2a7fed616add40b67
SHA1b4df5d93f45650bd582fdd9e5d8a7e6b529a5aba
SHA256bca1595f0c517cb37011a4d7ae286cbdbcd6cb2a57976864283b9c2fb0b07497
SHA5126d8a74ecf2fd45b36275206e62b82b68035dd5172869911b553a40c7a2ed2608a3b446ad38820aa7f33e7bca171f648e1a29e47aa26bcb122813ff89de56e1e9
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\nub.png
Filesize1003B
MD53a0760d7156c886512216693c01a7cd6
SHA1ce174d4833e4a7b52c7d8fece299e5a580924779
SHA2564ad65bf74fb4910d171cd9ed0cca2353c84f54c49cdd07cc123ce6f903f5d896
SHA512999c9e2fc45711006c0ee98c40bf933360dd4dc8b0c82b5b62484eb4c1042e242ff4a52952c8d44835ce593bd9212d1d114ef8fa7bcc2e48e3fc0bf5f03857c1
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons.png
Filesize1KB
MD5cbcf3455e5be1b1ba60a319555e73e14
SHA12f9bd30d765f53c6d965c2a24dc2f6d25508e176
SHA25603c6e4b93cf49da8b554b3374a9df1213f5d7eb290b7b718e1dead29ab7832d4
SHA51280de39c091135d97f14568a062e40c231cafd90aa03fe5cdd82e1cb0547f83f42b1841d3c1dd92e3cdb0f66471b04846def3353ad8681f73fa2dc3c8dbb007d3
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons2x.png
Filesize2KB
MD5fe95570fa82c5951c936d4e594992452
SHA132c477bfd0c89298f54ecff0aac4065d8fa1d1b0
SHA25622aaea92e2f1a189d25737a7217984a74b5ad11049d408eb7e5bc6d245954504
SHA512d2442eef00d99b76496a70ad3420bc08b84b7659de0d680fba4b05510609d45aac4e5d2f1433ed74a781af87c86f5ec334f5e04bea1e92ccbab0473953e0934e
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adc_logo.png
Filesize3KB
MD5e94a10ce3197f343f68770d487edb5b2
SHA102195093891d8518ed27c5297c32fd42aabb38c7
SHA256d6bab4c8172bb5b3e798f85ba22eac35fa34dd2ea5ddb2b48ec694fb723c58c9
SHA51276bc6a27f4c13540887151e9736248c3f3f3a739881fb7c73c0d09f54c288f7fd151e63ed49e499d0b273f148974665b17db0d4df60c66c351fd1675de21d0f4
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adobe_spinner.gif
Filesize556B
MD5bc72f03c970f02d2e8db2612b6cbbd71
SHA1a7b1d4fc2307faa8f9be1c133adf3664a06aef70
SHA2561563a2701a8746cc55a08e62f60e3f6958732f7f3eb20b321129642e67611a57
SHA51270cf4fa64353b99899ad233dc9e4daee1f0842c7cfbb6254487b0c952ca274d1a4b276d3a7e5a1bca0847d703bae895a05e9e4823b053106f523cc4e42e026da
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\logo_retina.png
Filesize6KB
MD5696764c2ce6d1874a89b1c37da170046
SHA1aad715ab3c66763146e46c6e2862e3b001972b38
SHA256ff97a7d28ef6b216f442a02000ed5242cdb699ca871c732925857766686058d5
SHA512df657c9f2de91933c88fa1dd1e6e1c9303105618f1075c6ad5db11a2f853ba5538e117d2efc0db7c5b71efa479fa0b4f119573d82f98019c90ebfc41b6546c78
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo.png
Filesize826B
MD5c7a4063f7e4af211b3c2e100ed04b7a8
SHA1eb79984016aa078c145d7fef20561ec771e9a105
SHA2567f19106e602f6165c5034bca1ccceec4e78e5d9098be1ab1bde8de28dccaa62b
SHA5129d797ccc25e655ad3ffbbbdf430af418c56d7129bb96d03e1f46d4450fd7c03d66afe8740c108c3e00d6ddf0a3b5a98bb57d9eb33bff4500187eb002200f48ec
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo_2x.png
Filesize1KB
MD5140f1adb93285bf4b6d8689efe9b7c97
SHA1e9569a5ee00d474e49650a91bfa9bd8b0e0d142f
SHA2564b5101d50bcf9a88f639a27f1257562f181de95e313ab3dc63166887d5c287ac
SHA5127dcf81d4088192e8bf4a660ec98e9b28fa5c1182a246b1b426f73bc55d4e86498a6dc0345ce857489271f08a836f61b9e5b5d2694ccba73af93ec85fa1790876
-
C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB_EURO.txt
Filesize32KB
MD57817f01c59a502d8698db363b855e733
SHA10fa62c34f7b944f3b643391fc428db4662e639e9
SHA2564411de0118cf65ecdb50f47e216e969df2498375f15a2d02ab015ba314afbc9b
SHA5123dd7976858aff0846ec878ce7dc0f24327555be51c205c586aef88adb234ae9e38d3e26494dbc1cab9e27a4241b3f05ae7f85895376219dda7ac1b7a35ad331f
-
Filesize
518B
MD59e9783ffbc9a6de1f0a8375c6aabf453
SHA1b65c9e7b7eeca453620b880dbeff68f01782cd6b
SHA256a44faa36146ee2b314d8388f12755bb00d4144d31c17ffa2c6ec544dd1795932
SHA5123974cd57606d2c0f65d4e2c8069cfbfbb1a185a3ddd83abd8a3be59e10dc93bb77335a7aa6c69c6c12850a778123d66a1e02ea2a0d191824d0692e7358258d0b
-
Filesize
153B
MD5696ef31438ccd42b2a9bf7f2b0a4b15c
SHA1a089b0b316f5830bf512774cc0ab8b785bcb947c
SHA256c85d93ec0d28006237e0d942ee89ef5e1aeb41c80536f62c565f48cc272132dc
SHA512aca3bab1704a205b452f725313021ba70f766355e14b4c5513f38e0d80732dfbe0dd0252478a70e879c729340cc964b8be7988010f2bd095942776d4827e2b60
-
Filesize
190B
MD5970dd9222250ead018814d3271bf3a13
SHA175e3b12ec79498d6e881ff69f9ad4118b85f510f
SHA256acb74e69390a86287c60a33e169bc14cdfc057006c844c2fe5f8946baa55a0c8
SHA512095906f06a55e791e9ca4de0010c266b7329f3db7cc979635ae60c0b04cd1efc2790bbb5be86e5d560a31e5bbc98449230ee05eb59b07724ee797086f07097ba
-
Filesize
190B
MD5398a2e264f5020b58ccdbe0626b1cd9e
SHA15cdbba071cf727483ddae85fabef3238b2921694
SHA2561b50db97e0ea66ae244ea2ecef7343f233922e27670735f778d7328a2ad7f358
SHA5120cff9c98697822dcc18ea91a77394bed3aae524f302cefe8b4aecdf9911a48dd0cfdd3cb276dd82078cf47e6befdfcea900ca47575c4de5465d4b5e3a3c9a9e5
-
Filesize
1KB
MD5119cef4f3c1b0dba85c51617db935127
SHA1d012b9358532872d34b91cb6c9caeea93f4e9bb0
SHA256a93efd266d00e2aff518659d150a95a2a370d98c304742763121234c18f2cf0d
SHA512dfd261ef29d99d649ec901652162c37a93f435e53e012dbddd5ef95de33fff1bcde36258eb7bbfac9525c8e2d9e516faa470c8938bad74086789a1a177dbe368
-
Filesize
31KB
MD5629be9ca02bd0eef272ef26d4ff60f0d
SHA15feedf1392a1e578a684a7f6145da3bf5c99b1cf
SHA2566177b723b282304fd26d9c8d4965a129ed5e290f8f2eb3920f538f3bceef152f
SHA512bf2faea1bff3b56717b58688f6555fcdac7506a4defc206687169eeefbd0e01b094f19348a5b4502e79f04c35ec8741f5cca70dca5f08a94d170822345a94b1d
-
Filesize
34KB
MD5a9932f8eb346b25cfb89ef7b57575d08
SHA1d58b44cf80a863786843a075708746bd4520d693
SHA256b92d62bdf27e814582d11c21ec9816f8117d0663093785e9a1600886ca8a56a6
SHA512cb070c313a1cae4fe49d9959826fab700d6d82e6f0e240aab0cb100e7431e82515c7a588df96cff2fb4e15f8669273365174cf645dc8ee58f3fa14f42a49cb33
-
Filesize
23KB
MD5fd149ac926ac7a837d709c32965cacb5
SHA16c531b7080e78c35b70ddd5502c5b20d3d931251
SHA2567a2c8156955ef4de379b081db03aa695269fd222fe590ae2cf76563efc25e4b4
SHA512939a486e6c743cf61352b0ff86ffdbe5d5a415191c11207d29170c45d471f8fb1424f4fcf397ccee43eda38f7e6c098d89e07442cc4c6c40a4c3a785dfee68ae
-
Filesize
2KB
MD5ea1ca24aa319f1150e758cada9d36007
SHA111b5c98574fc9344c477b2b9bcbe4d0052594713
SHA256ec6cde40ecd56561bc5d04d0d42ea2f3163661d4161e239bd83c9df67edae79b
SHA512e8d08852efa6e865291b939be9fb697eb02e41f7a58548704b882d32c3b5f35e2ccc9a8367ff8ec4f94f0e274e32cc6462c67f625bf243981f7217c5f1ef0183
-
Filesize
1KB
MD57dff002fed1c1ae120ab351535f765ec
SHA10beec3e5f5b430bc746f547e5892f504af06aa90
SHA2568d3448abe62d7774447ecdcde198e242e3be575844b3573fd93c9def6d8bbbe3
SHA51230e1fd28bc0193e53bdbf98c4a3ffe89f8a34bdbe5104109ad6cc760153abc2425e915a70defb603cfe795838bfd48b34025e18e40105d35af67df804d672b50
-
Filesize
3KB
MD54126359a506bdb6bf549e0bde9acad90
SHA1419535ff269c2e3c46f82a7b20928448588b3f98
SHA256c90b5003d944ee8964d4e9edc709f1d00ebe6d73a846d5e9f3582c0a29b0d15e
SHA512f82b9244d978e19873720c6fda0a1670293a952e3a4411c56ae6ad37faceccf264f7b4e0b795f68b16eae5435be6764a07f2574f858b9012197e07b8596429ae
-
Filesize
2KB
MD5664de033c4a95d95e3fe51f45af61fa3
SHA1f2639ec1ed9520e6ed130f4361aa9f95ef4614d6
SHA256b9dc1c83ed1b4f15600522295ee13d9eb3b5e8eb9c78a606c395010d3de5b773
SHA5120e2e84f416fa4d145298658570acec53350c02103ff3dc088fbb145b24a3ab393daeba38bbddc47922dc257ec7fd257d45bd42aa59201f42b9003c263d69001b
-
Filesize
5KB
MD52c7fe289366bee88a6249717044a92c3
SHA14e426d6d38777f52a477119fb2d329669816a211
SHA256389ac1f394b14079219fcd3ac7b88f3ab83e75579db69a1e1069dbdf3e1e8432
SHA5128421daaf16df5787fea2c667c4497f1a86cf6f9caf31d5a6b5a3b63630197ae786a6f8782debbc1fb1f33d00530f9cc2accc9d5b5c4a2109a108d4ed9c3de082
-
Filesize
17KB
MD525d590a565c01156071ce558a745ffea
SHA1304b76404402f6630098e55d15429b8d9885231e
SHA256ef9c24ec57a3d373ee2ac31cfb283b833056dd3dc6166e4ed9fb97311cea7f96
SHA51248105dd10d1b4e82e9f9dcb16b51227e92236410113ebb7d6f9ceb8646d737ae336598904cbbe93ef3a0acb7be3fa4875fd877af74a84e10d733e03b5fa4ed20
-
Filesize
320KB
MD53491d824bf45ca767ab99f50530043a5
SHA142257184e49fccff11baa9df87615e17bc636ba5
SHA2569eb636b0b4e8ce2b09e86a4fb69c101d69424fd065dc859bb5305ec3d59bbbf0
SHA512d7b054887aec863153ae5ecff80e6505c699ba1440fbb6110224d5086801087cdf2a341b52f72575a5eb2c85d554a1c3e51bad87f559ba84964be8a219bf0e4b
-
Filesize
1KB
MD5e32e623569c542997ea993111b3a26c7
SHA1f8406ad06e277a5bd1eb1b2ea13f0c5c88e34784
SHA25603daf1fae772ea14a247495d16cd0f48996c87d7d5db7549d3afe8cef9e030fd
SHA512e1b4a6ca77f361720dc767d3aa64af9c6bd1f5a7efd30622a30076b8643a4eef0680e97d8c8253796324a1273b8ca799a8af443ec63b445fda7a3e2d609f1bbf
-
Filesize
10KB
MD50e5e3cc93ea3fce86bf5569176d317e6
SHA186b93cbc3a09ea1bda8bf8972b5f3cc1f1596051
SHA256385c007c90d5b55aaff7a90e79819d47c2b87289d213376b0a64ca8dff29c8dd
SHA51285e6f8e69389c3500f4de5e9f567fa7c3a837a66e79630333b7315ede9201bf9d670fda5b4c79e69e2b446114c183c7528a7f6cd9ed60241576815f06b1c6320
-
Filesize
3KB
MD5090e3df160e432ae71be3d71e886321d
SHA178e5f0cd7cd52b9bb0e11bb4c4544cb178716beb
SHA2568edf1b2a524198e8c9666523dc09813bf741b23d4a81bc99b614d21b7eb9dd79
SHA5125edb5c0999ba596197cf88327794524044f14ec7c66b2cf1186c278ec6067ca6d71f14d8174948939e2c7dbbc1ddfce2355b682f6058e3075f4de51a9d385c4f
-
Filesize
162B
MD58ee49c5ac2a4fd90deeee713593f62a4
SHA1363085c13bd69989b177dcd7f3918ecf425b9478
SHA256f209dc56572dad8aad05379aefa0e26856eb11c59d2108680c529b48660293bb
SHA51228ea16dda907d56acc692300c5f9bebb4e1821d982cbc8c885e8769fcfd3b1505bee4050675601a8c9ef392e98ba9b10a86618b7920fdaf008a8bf154e85674e
-
Filesize
1KB
MD5e8a82af39ea97439ab04712058ef77c9
SHA18f9f7f9e9f78b9c82a7cd468a724ae5ea32b1f35
SHA25687ac9bf3e320ffe421d0523d8ea2b72eda3e59562633e53237d641112b0905f0
SHA5122428e49277fb67e256857fa414736b0b63ef3bdaebef44be460da1ce981b5daca77e1a674fe34c65dc5082cff6e3bc7aaffd2556024dba58ca1c7e3b8c02c1ea
-
Filesize
3KB
MD5536b92961714f28ec6208d542d21d464
SHA119c150792bfed0d77a6ca85f82d71100da9b101a
SHA256d0406bcdc2ac2817fdf3ff679c681599a856b415761f63b4fce0d5cb8967b75f
SHA5125b62bb3f227a905c026a342ab902cf83bfcbcc9df45551a506b0b8c619b33feae4e317345418381182a41771d6d6250d66d598e85357a15439a676544b4d75b2
-
Filesize
1KB
MD5988ff52f7e60963426bf68b00afeb6b1
SHA1a31b5c86f3418553c92186804f9a1b07dc29bb72
SHA256bb90edcad58a3ff69e262d22f26cb57372c8ebe212ad78bd979585a7262e9aae
SHA512bfc1ed98360f179518c0502340f3e09f239c4f90542c6efec148c07c178633ff15510a17a5a7c7f959c727a4774ac3c4853ccde70447e91bd97af4c84ddaca80
-
Filesize
28KB
MD56834d2c398dec6012071199a89fb1e08
SHA1a4729b576b3255625077034acfb36187696ef1ba
SHA256432281ea651c9f49d20ee0d2d04f8cdd5ea0d0d330405f6b3cfde936fafc9427
SHA51242f19062f25a308b629ed24f8ec6034566073c85dfab301cd9c9960cb71dbcd647953d4ae9b33e86ef4411bfb2b27e058ee56fd9ff4d305d28ce632dc954e7ed
-
Filesize
2KB
MD53f081c6d2aef02ef5ba545836f3d7dcc
SHA1ffd3b10b763b744a4368a1e33bf96285cdae46ab
SHA256297c6e3223d12a242cc18e8ce1cd01fe2ef5eadd362ee3182572614ccce10cec
SHA512041ce3a7d2ef04c0d28d3f7bdc3030a09f1468fccd6f7dba43147d36057ee64e34a966b396f6404e94d148deec8a34fbd6d9b6ac7d6fc0663a47a962deb0ab70
-
Filesize
1KB
MD509061d39aee18ea2b0fe296b487acc19
SHA1f07bb27e26aa2cabfca4a9157fcb911bbd02432d
SHA256e202de29a5f4fb33d51666776532cd8af8d63fe5c8fffd1bcfcc5673b2560e49
SHA512e29de1378f23accfae566b567aa548eafb29de638a271295a013072c454b4ddb61b38952a27ade13e3ff53606c83f2d4685742702a406e068a1eb75a20c3f071
-
Filesize
2KB
MD5f56f997608e9af9ffa344fa36fb375b9
SHA14dea1cf9cc7292dd7dde11212b5c5bc3aa3f5a6a
SHA256188ff0310443a5f6ff0d8fcaf2cb2bbba213e8c3c4a1ef07d92030552a294617
SHA512f7d79d7b7bc7636aa5975a8e165a7c342d595a7abc5e611ade564d48c227a9e754101cf46222dedecd303aa47501656ba6896fe58eee9c3e2f255b0afc5dcbe3
-
Filesize
1KB
MD55d7af7949228bd49999525ba21d0a63f
SHA1ea964d04df590c62c2990c863a8aa20acdf7ac0f
SHA25676249e94ce2d089fc4a2e52965c6ae73ee7cc86c06f583a36d1b57148931e4a2
SHA5122c274a8002cc0709e313568bfc6fc1572683ae395c566d97f1b8c661ee6801a2a02b2e745495562372d69e00ade6e4251ccb699de5371cb4b013b1b878691fcf
-
Filesize
1KB
MD540a34f390e979b24139f8ef065c6f983
SHA189e106d4094dc64a9e5acd45a5518fe05915cb47
SHA256fe34e79b075d3d3d1a4d23239838666b90dc9d5e28856c2e76550c88dd515fdd
SHA51291152e36e893a60d297da95d1958341fcde1c4d59236b49fe44bd1d6df641294b603b957acc8b748c652e79a74fe8eb7f2a83a9c6599980d4844a9444d7f1ed0
-
Filesize
1KB
MD5776f35c52bdbe55da1123e680d97c86a
SHA11a5f9b60310b6eca6b14e8c0cb807a7504164917
SHA2563f8369b7fe4d17bb25548b2c8ca8dc3d34422fa79d23a7f35140096f1bd05d9f
SHA5122ff25aedfd31cefaa43c40042b7eca3412f5d1e66495532d4d1a6dc39a10310679b0cc8efbbfd79437bc0564179a3c9608afdf5059bd2bb384441a29dcae7d5c
-
Filesize
3KB
MD5d8894218c3c82f728a101177e6ab9663
SHA1b24a3fc92aa71acfb0ea6f1bc741b0741295460c
SHA25644f0071821999c5fdfd7d5e51f1fe7bbbed0e9490a3dccc85713f1e165274612
SHA512e8cd8826823bee4b792df8b44354a2797b554ed49876951faa985b743e20487d06f85bac1b110241c3d9b1a77ddf3722ca5c5d3fcaa7d4a6571b8ac71de5804b
-
Filesize
2KB
MD5c09526ed4a687cf2c4d37e437fb27236
SHA11d526cf17c5a6d5e6b2f4776bb4947b1db30f086
SHA256c27494a3667289564364aee67a82819602d832e37a0acc755063f3c1e6c42c49
SHA5124e6b1698b1e7633b8f132998879128db67ad07d2c2f98b7d63ef9728e75eb109867ab2aa05549cab53fbdaea81edacabe75cb5d2e874aa33664d6f7f0cb5b43a
-
Filesize
6KB
MD511d471335bdb90d149ed7068f755f651
SHA1044fbaf978dc7a81df49a135f5e0dba0021242c2
SHA256c367c08637f65bc68c02cc10b43c9c0e883fcc8dd5f14ecca47fdcac6d4f0752
SHA512fa6c3512bf3e0bc67892565bc53b60bfea83edd3e99751fc7619e02a367f3aba6370bc78ecf7bc01c37f258530cace9063dde05293a421f5857727f5fb0be69c
-
Filesize
5KB
MD54bd078af690ac68814f79c0f6de61fa1
SHA1caf4536811e7d13f3a1733e3d60f0c491379abbe
SHA256b2083078f5a7aca7427822d1b290ae738cc1c378a75a51ad3226961fc37f65c3
SHA512c43d693fe216722f886a5a952ba55ee034ed20a11c12595c5d8ada72bb1e3778ba7dbcb7ba8da89fa578f577bdd308a4a51b85791a0124422edddf6e83aece68
-
Filesize
3KB
MD5c05b6d32e367f9f85330f9a427648703
SHA11b60f11cce1940cab73b800fcdc185b13d13a630
SHA2563991d1121429192ca0e51a751a85a956258f310645c6968292175f591b601873
SHA5127847813e2486c4a750b04d0e1c64dae57f1377d437ef92b557b4972dd313bc1ca90bdc8d940526f41150142d016c85a6e7dcdf0f727aa5d2b3f8d9b302896601
-
Filesize
2KB
MD52a14b38ee472c85fb4b2dde88274bfa7
SHA14ea8d6863180c4f94481a863bbc592c7ce3dadb7
SHA2567c47774ff7be4594db2ef223c6389e01282049acf67d4fb9b1252cb3c99006c3
SHA5120b19e7f5fb687d0801612bda120368fd0148826e12ace13f96fd16d303a3825f5513e5e8c511eb088bfcf360df2d9b9c2b353dfe3e3287356b38ac069d9728e3
-
Filesize
2KB
MD512ce1cbb4c8f56b15f8879f8a329abf5
SHA1271efb96e4c3ff97d41f96b88e53aeaf59e3412f
SHA25690635da0709c97848693383aa29246400aeeb16a51d5de28b9d57615fd946289
SHA5127932a0c3976d7f88473c4a30d539841ec940db8ae7a689166b2504f542118dc7f6ac8cb74a436eb246295f251b971e0c72209ea65f300ecaa15ca18c0bacb2b8
-
Filesize
1KB
MD5a0fcf26f3dbd28c0cc14a1b83de460e4
SHA15ea79dfa43af82c15070c3ac2c4029c7aaa7d7c5
SHA256431a874ae5db02fcab1be94734825802ba897324b86cbe389d50a3191d5deaf1
SHA512187dd2d7197489dabf1b347a2315c6e33cea937d296c78aa2d30516d23c72fe7a2ff76ee56c0b049eb8cbb97bf13f8c86de847589138b606ce3c78c08f3bca7a
-
Filesize
1KB
MD5f1e93502126783a980e346fcb532065d
SHA10298afee385624b88375c76a00bd0b7ce23876ab
SHA256e2f7d5e4d95ce0e2e2f8fa4f640c087dc99015f294cc680a9d5b582f7da55d28
SHA51225dd71fef4003589105520445b57bdf2c25fce2cbe4f7f2d3519249895ead2dfba153780e698289c402bfd2345c16852ba89a42daacafb499bf8884338ceee2c
-
Filesize
11KB
MD5352d80f4b0dae770776b76379c16853b
SHA19aad00ee369ff69176fde38b1a85292a5fd115b1
SHA256d03d17b4105fb2ae6a106949b8db7487746370627879848995cd16251bc06762
SHA51233ac5f3673309beb561217f1e0bfa5bcda836320f404cf285bc16794526420e2d280ea829c6274ba5da2a723fb3894f8a6aef73210dc28e139bce3216a2123b3
-
Filesize
1KB
MD50f589cb7005ffae3d16d42954f66b9d5
SHA17c7aa7f9b24f9164a88dd1326fb10d163d6a0dae
SHA256f5c4cadad865e4574275f71c438a9553f2f7ca42fb1d91122f241c0774ce3d3a
SHA512dd01a522e8200342c550ff27f406712febe28399ecbb10334eecdaf2d79f506035ff93bab900ecb02b7abaac4aa7b27f3940fa2873e1f4d7556ad1f6f159b13c
-
Filesize
2KB
MD59d809be76fa4205ecbef5807ed2bc4fd
SHA1d0663bfa3723ffd6c4a19d47e0d6dbbf6e4660f9
SHA25635bd87aeff738191bdaab04999573d393ef8e8b1baed466f543a63397bdc8920
SHA51222281fd9c2603e66727d5112e6ca7da489c02bda78f8189d238b6cd6c9c50d57f2593ebb54fef97a7027c0a61ccd75cf790280d13f9d99c8264eac85f473d714
-
Filesize
11KB
MD53dd15b5d5d3041c323171a84f73cf7f1
SHA1f59a6c4164cae799a82c1e95dc179f229dd7da97
SHA256f74a5a0a9569bb8d867b02051b09a3b0ad241722acd3e68f7a2d3364edb058de
SHA51201cd37ea8aee5286f4cd4d01e24c03fe0b3499081397bdd2f13836cbb43863930df041e825ce4d8943ebe0a446e11f652dda203201be90e07d2181ace98b8879
-
Filesize
11KB
MD5ffcb4ca8d377dce6f53b1821975d0805
SHA16b60c381d981c662114f5799af862add8c2e608d
SHA256129d1fd4116c91ca643f6f5ca28c552df406e581f331545c96730462e4fa00c4
SHA512af1026c81298d38140269b042eaa98342d72ad940009589acc4e94dc81ba81f64b9ba60ade2d3982de3f3a1367fcc256115accafa9e9c1226675903d4af67efd
-
Filesize
11KB
MD5f7b5bb49d222eea17199b1573337b73c
SHA13fbe5815f6e9c0389393fde1f8548282edb6754b
SHA256b150402616e94fa48f826a9b862c57048d804be9bcf60a0b7b34d0de76be3ef1
SHA512c9eeb7ca3d18cfc8b551cbd512ddd1ce6c02f815d00d4a30e66b57e1550568f4a93ce20b3e4aab1f21462ff8a68598b2c8c6c82055f41a00ac23dbe3e0b9cdd6
-
Filesize
1011B
MD5b539126fba7838ef87bd245134cf26c5
SHA179c0d2b35c7140837c7788484b0920935a285a06
SHA25651806033ee02e3d5477ce04c4d849153974e8881c3f791496481b933d67ecbf6
SHA512514098bc4774370fa8222ccdfe2c2555e2316a21a5e305c95ed0dbe18a531cc061e56f3009528bd585c7a7d92a672dc6b827fb1a4623d8dbe9e3123e5b5309fa
-
Filesize
42B
MD5ac154d8a3b1315e61e5905fc6fcf547d
SHA1a50f49738881b22bf11638420bba2b73b2c2368c
SHA25607fb57b9dd876615fed4efcd8a0f138e69c935e952b87ff2f4115125e06a88ad
SHA5128a31afa3dc49ff3979c1c2b5b46aa56e4dd2edea918d520c4f414839e6d9bb852430de0c18962480e17b3748bcf7f2c7b0d2f593d70e33be11366fc099acfe0a
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727662721799026.txt
Filesize77KB
MD576050c96d1d519a7b1c85d2b4483dd97
SHA10d727dcfb09a3a7f7d73c7cec894bd52eed74667
SHA2566551440544fe0a93760b264b96968457895e31b18a935049f5a3ced704bd4468
SHA512f6a967cc4b8f8407ea809dfff8f60e5122c1c54154034dc382ee6a63aa605b63cbccede5ef3858ee867b10cd42bbfb1475ee3769cd331982ff704e233c06bf6b
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727663191189319.txt
Filesize47KB
MD53f6558adb05a4a0b1a4cd6444984d92a
SHA19641fb8a76e3917508cebbdb6a0257220e3b6c7e
SHA25660ec47cd5b601b72f308f4b82b09baa83f8b940f248c38434a9a933861d09b23
SHA512f4a3b29be66b241e57cc8028173e8103316bb0031046d144138695a34ce45ab3f155a722a3cddf2811265ccf3281495169fc06f43112cb497d8460cf6136bf46
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727670188807600.txt
Filesize63KB
MD5baaa03c8958cf5e8b3e174222090c143
SHA1e4af71978b7c5235b78cc4e3d07a5204fe06f369
SHA2564e0a0979bddd67861f2392cb59d8597697852dc3c80c3b0160fe05b3b0a03bed
SHA5120630c63c721bb55bfbc3d854c248064f4d862c3b3902b8ba2e17eb79b2dca3ba4921631087bc4599c7bd3aceef86b5a6e753b5015f7382ac8b5470e29c330e99
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727672984949051.txt
Filesize74KB
MD56baf58a2a101cd3781f537a36b2f087c
SHA15858b9b43c5d6d1d46ab311ac0bf2229cc01b465
SHA25628c69b73c1874006c22307f44c795d223ec484027dedac3b4204e481968f676f
SHA512cff403bfdd899bcb6cd47927d3d1e41ec64ce5f0bb2460dfc7d244e92e3c53429a6063b1182bbff8df3dbb143d4526bf22baa3a962703afa59f3d936987954cd
-
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\File Explorer.lnk
Filesize407B
MD598b662a779ced073153d0dab9e7d32b8
SHA10acabaa1b70cfeb6eeafb706738d3cd148dca83c
SHA2560ca95d1b5466fb211d0e6d65e2a213db2f738e493da9c84733abf3fb809917a7
SHA512a28cd49cbe4fdd6e7beaf942589886d5b40b51d5f10678a034c9f15ae9443e4c811756e3612802a2bb5d11a3ea13924331597b3c87ea91cc98115a5121fe168d
-
Filesize
21KB
MD5a1b0126d9a12f3b0a8984e3c3e30c743
SHA1f1e2b37eaed1bafc90dd2e5ee6e0df1f47e3d047
SHA2567ff73af6c8a25bf0787e23a0272e82ed98e92d8f891c42c86c60c6d622f2539a
SHA512b4db44e9eb5f9679ba46ed4c71470512520d91a319bb9ca1dfcb72c7fca425e1087c2c3a8fb1300c0f237cf509cbe5d75e1155a73d8e745cf98f4b19548ae4d3
-
Filesize
1KB
MD53eb34d3a25acdcf7c6f534db38b03060
SHA1b6832c2c7a8470d2c49ddf768bfb235124d75bb6
SHA2564dcd2d2b28b4257684248e78cb26bf3f6731322811fb79b4dff5c50c6d2e1c9b
SHA51296aa1b92cda10f34895b7060fad606a8326534eaecb051302a73886bf9b6a7d49fc62c3117ee2b9387c26c668cf5a007b3fdc67e3e2fb9dd4f09b6f1cd75d055
-
Filesize
952B
MD5a87b7bbf98d5a8c1fe66ed0942c7f3e8
SHA1d1d027ebbf7d3d0d9c8965fa9d02444f9e491c16
SHA256b5451a7b9e2ec77db8db704b80af757678faa8b2b506193ec1a0ff6fc3e8c94d
SHA5121e6ddf31cd78a520437835429aa22c7d135782dada25c6876b07db2248c5ff342e8d5d7302d8818ff20e458e946cb977afb77728eb954515c48f1fd6da6c61cc
-
Filesize
121B
MD5a9f0c635db736fc248f908d6fc31e721
SHA1b88b5ebfa76f09bba768d2aa7508a7f6bf3ea73b
SHA256f58d9ba1ff3c5e7576aae9f07d130a350e3a427b685b30dec234cc653f2ad98e
SHA5124d927bcc084415b40f5763066a6ec60592ce47c31a10b5939740439a098969c69ff8b56ce25e07312d03da8df6a734ab0a7ba5bddbe588903af07fc48b281a22
-
Filesize
1KB
MD59f1ded1c62c63aaa807f37b96bee30ab
SHA199648281050b3fbf14f5535a687487798d872081
SHA256a827ee7bc5b06a559c5501e1d8577700fee6990a3724a3ac2752780b4c9fdcac
SHA512c4a0b21824f3c4a8a69a33c934adcc9bbe315ed59ab23988fe8221f866037c8a14762dd20d694824c39b5708644439037dd351d27a8324522ca76b75712d8662
-
Filesize
8KB
MD55a9a0a21bc8c4eb99000971ab1156720
SHA1bc96e776cf1574f069652344a14fbfe37c5702fc
SHA256b5c229ce098a7be4596fcd0872dd2cd5c365f36da89dffd65f40020db21a75d1
SHA512ee9cb5f10f713e719d741e9303317ea63f184e11dd6d6afdd13109baf6c375e2255c7fcd8c7a27485de0d2d65b7ae6f0dc4be9ce044fba95cf8ecca8088e7135
-
Filesize
61B
MD58beaf3e476b815427f1e9e74b832a5cc
SHA12fe362683847dbc7ab44b89d1748f91741ea5fae
SHA25606d421e3d5733d3d3a0d7a94aa96ab4c8106f19f26b58b55aac27d6ba0ac8ff8
SHA51276781eac93b4ae22a04585c3f82bba0276b40c351821d6eea6b042c00137cf6d67116fb91d5a6deb885c6c9fb867fa334ef01fbfb8b6a33c28235289b6dde0ac
-
Filesize
914B
MD50a2e24e93635b867aa51886a3895139e
SHA15b88f4fb9a1c4e96684f54e52b190749ff38aca0
SHA256fdaa4ecf243f7472205b2c629a07527b81c604009ade298c252d3d39a78ad8cb
SHA512308297db36e337f9734e945fabe283ca41c6d0053745989d1f3065c8dca01914531c3c8812c013f17a837489bbbca2aa6b3fd8c7f77a6e9241bde974fe1255d4
-
Filesize
90B
MD51efaef84b3e42d09047d56b316e7fe92
SHA1fd2dc03b3d85a825402aa9e5eaebd4072253f0a1
SHA256cc5664bbe5abe043f53b3406c3007874ad38cb516cd1665059a481c1ba3660a2
SHA51231a7505c6a9fbb3e5bb2804be5f4204323218f058fa8ecafae9ad8b52c34b6c69a0a09b80333908741dd170fc481a26dc9affb97f66d1f443d60bed9c35666e1
-
Filesize
90B
MD540c09a67b6dce8bb51a0cf425944a35b
SHA108771fa66f51cb873eb98af7e16443cf1d8205f3
SHA25693ccbbc5e3c94181349cf8d27bd029ec2bb5349a21d609f111abb8ec93cb7e7f
SHA5129141ac091491cde1bb17042df70cb65293699407f350e2e606a4e62fa5b134e1a474454b4e9c0acc524df8d48e288444ed66ec3d5e00db32e6fefec481ea6e71
-
Filesize
328B
MD5242d080458a50ed8693bbbb28570eef9
SHA1f660fe7cd8b34725b3f6d27a7aabb0bffdf97399
SHA25690c8f0b1001777500860f9d116a68b1c7f7380e1e65ebe0a89ec2cfe0464c44c
SHA51234140c392ba8c2c93f750678ec001687995f0b70267dda5ba75e99b56148fb9144418631846249b91f533638444f8cc738a2d1fa8e0a7febe862ce2a08c5cd29
-
Filesize
1KB
MD5958f67b53dda20abfef1a1040ca472e2
SHA1b4adff05b07ee5595a6374641e4438d524f56bb8
SHA2562832b71b78b5e1efb99d7ffe2669d1b5ad68866464b3467847c13b103b8eb408
SHA5120fddd03afb51197930a841b3f74c476bb9ac3efb33507850ec526c03f9aea55a4e7529ad3b80c9e36483912e916887c461a8e87a801d7453a0241077e55d272a
-
Filesize
162B
MD5025ca584b2a7d41d2c4a81f9d1bd45d7
SHA15aa0df95effefb618e2534b26ebb117c3d56bcf9
SHA2568361286cee9486321a28e9c9a0248f915c4f07540edb7ed374d9f098376bc556
SHA5125b42944b9ca42452479efbf4ac9f5ff3abbf3b7448a1184e7f5637e40880867cafd235a4da33274243d4291a764400ed3d2dd4c5395b5773cac21d581a4d8cfb
-
Filesize
586B
MD50a37f1e89840e7909f42451cd84219f9
SHA1cce144e5b66fa07bc5d4d9d0055cdf453af48591
SHA2565ec228f7e333777c7db15baf1c96e3c32950305d08d5fef8a1aee91682c53449
SHA51287abf1ce356ad6e29716eac9104589f7404f9c1d3e40969438be14ecca9b0dbe4cdfe43d12c0853e8cefed53d6dd0d50a0e0db9126c4387b37c3dd9ce0142669
-
Filesize
124B
MD5f84dc35d23103f200b7a329b5bc3d48e
SHA1db5725c94742c6060d17b253aa04bee83c90d1e7
SHA2568a585507d19b4338f2b7adca3cb665f1e00a899c27e5b1e1ddb1b6d4b1e1536e
SHA512a7aa21060d5758b3f0e3430a0084d512568ed207128ffd2cfa25d224f6b8b548e16d8796e1e611876dbd0963171994460204a32b1cc7a09607f88bb16c6c9cfa
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\selectedTab_leftCorner.gif
Filesize65B
MD5d908b26931c2de5aa527638aaf859e4c
SHA11f0b523c5f721c8bf23c731764694839b5bd1f83
SHA256f1410a948ac984335f4e693d37b6411a958fa182abf73eb262cfbbef5e7f7555
SHA512400d6d05993174cfcceaf4efdb1c0f2f2040cd11ba54bcf05e3358d6147f1c1698e98d51a9641e9877fd3e41d76c9bad5eb10ac1ab6eaee82a73d37129a93ed9
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\selectedTab_rightCorner.gif
Filesize65B
MD5b954ec81ca0cb0b7496a779381bc5dea
SHA10aaa4512716dfdeb903b97d99f8f813737e7f581
SHA25668c2a79c333352432133b96a41d036427639f5cd7895ce52661268945ba03045
SHA5126687a4d68c757c86be4fe0b4bfd3774061a3dbb065022024c6377c6aa3bd4791de7b7a544a8f6025b76c5dfd529e9bc7ddac428343faf22f245904b1454e1e74
-
Filesize
8KB
MD52ab075be554c0d2fe1d2d761ff6ca894
SHA1e171728d7dde750356b51970d074f57bdf25a2a7
SHA25652ffad81b552847a001712a180500d0fa0c705761619784273b13e227c15a6e6
SHA5124ca12936de35b2cf0cc2b9444a08174d5da04f19385677eea35031173a60527ca01e913d3d3d3f08f0cb94278d846cd5924a6744131f0f6a256d509d33b4037e
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\unSelectedTab_leftCorner.gif
Filesize65B
MD576b5a6a8ad1fde890f38fb18723e1360
SHA114f01d369d7e12da200eb17f9393d50a37610bc7
SHA256a967f62034b69e234cf2a2f3653ea7c2aa1fe1172e66b00fef279e5195dc4997
SHA51214e5ae87289b12bc6c655b44b7b452221b0e7f280da1f0d5a397b5e328ad8da8d5e703f4785dc2b3c27f9e872a02c31539bf9c390a9db9026baead3ef3119a90
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\unSelectedTab_rightCorner.gif
Filesize65B
MD5275c7fbbcf8a1c3bc38c1cb9587aca7f
SHA1f591970bb70b2b94d29e30ad613986a977b09907
SHA2565b4cab00eb49b5b5643c9c9e7c38261aa08d232aae8c7fb6d9ce09aefdceefb5
SHA5126e8436e7a714f8a34da82ab62168408daf8fdf61e66f7be2fb33faed07463793ab7baab9e37ac0af685d24a0c4be069fb463b37b12975107898e3e34ff637c56
-
Filesize
880B
MD51c48ada56bb0b949a64e85f12d587ab1
SHA10419263ff835058632cd39cc48e2469b96a91833
SHA25696d99bd31e6c4c26ccfe71db7c76503418ba0ee47d595b63b74131691057007e
SHA512ad2019ddabad397ef8a994ea1ea1fb76b39cfaf0f8a4944cd581071a7871ac7890348044f33a88fa64f62cafaebb30895c3f865575e4bae301191e41b4c19751
-
Filesize
49B
MD54daa3cccb9692cebcdbd71cdc5120bbe
SHA1441c46957351888bf74576f338334dbe8e6bc152
SHA2562a54805a3911175a88cd34ee494a6082c4e2a53c930a22adcb4638610db75dcc
SHA512b9c2d8cf8b1e0686673d78cadb969c5d53a4f46e6d57c88b06d1767df978bb85b71c7c0cd4d503fbd1c728da40fbc62bd843825db00c677b2343d9f3ae52ece5
-
Filesize
1KB
MD58debad8d6119fe30f77ff14f6578ebc4
SHA1c0806739714e3760b8565c4dcc1e3caf0b2df400
SHA2568e86ea362a68926735bc5d3174289b0f2cdae541927f7f2ead525b41f10ca376
SHA512d8294fc7d848a71af94b29d4aca9b6f3ed6224ade3bc9be73b06de3bbded395547de79fab1e752f90011a7be741a0037f4e38e833d0813eb8ff592c0a95112dc
-
Filesize
1KB
MD5ebc325097037180c07e8d7559504ec47
SHA105012199f71aff718e4ed4cd847f46d84d8a6e72
SHA25658708abfda5e941efd9aa3d8a3bc0fbf86106340006ee5b5d96b967577cf0fef
SHA512c6830ec88f7b2e2b5bf50b7889f2663dd06d373d6cc916cf36e3eac35caae02f6c999540a693b31d69d6f1b5f917ef7972a96d53ea77900e5b8a539473ad31f3
-
Filesize
1KB
MD52d4a8d76ea63434fe71685de81513b0d
SHA16860212d6e89462aed69039de8b3c95378f6c80e
SHA256dc55d918e2bbbf636bbc4f1e0f34923762f7a511eabcb6057c3fb744b3120e87
SHA5122f423a91e49de9b72f6acd2ac575896db85f391cc12a5942cd3b3dc45ff1c9947deae8901b6a93bd154e07b3010c109322020bef547e67fe23286baea3deab93
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\3 - Windows Explorer.lnk
Filesize1KB
MD5a53272f5b5e03215590b703972c8d5ef
SHA108bcb7216524d110e885556a1ba1e3f24060a00c
SHA256b5c65aebcab620f813589e283960122ac439eac4b2b88897793ce35f15b11ba9
SHA51229b1ad397b60300392b9fb08b5780137d5b1a7d6f60622ae1d1413f6dcd18ab032da561bcfb443f17f2446bc85505c394d0a52bfef77ae69a8db136783a79023
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\4 - Control Panel.lnk
Filesize1KB
MD577f021e591e3552199d38f68adcb9f56
SHA135127d5d3348c0643d69ac6952807bfa5bff8af8
SHA256bdb15928c25dbca08bead905270bb3dbaa49da1070ce17ba523e2e8770375c9d
SHA51282c15878a125f4f4bbd9739f33a9ec1a20aa47c2d80caa3a419cc63cd9b0ea6ec8345ba7524d1e055f30d47b0e6a0478cf8de300f4fe8ce2d86b080151c41c12
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\5 - Task Manager.lnk
Filesize1021B
MD5ab93c0cf76ed8794afa9d51106e20d46
SHA1ee5f55c2c75dff4e60b7cfc77be905890ed7e1fd
SHA2568ca92dec1b7178c351fe709ec1a43facff0b746dffd6d6f77d2c94909e6bcb28
SHA5124684ac85b80c84997abd3a1937a9378de72e1efa64cebc6adbc1eabeb12f20f0b1e427e092504e6a09308ee74cf6b9c6872faaa1ae7009f9bc782345b3130d42
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\01 - Command Prompt.lnk
Filesize1015B
MD5b73e252b1c5ccaca6323deb99c85f829
SHA1207aebc3cd5d1932a4562a7f8eec0018371cf377
SHA2569093a012be7a90b6dc91672f7ddd5174bba93da8991f0764d329065e277c01a8
SHA512e7fd8451abd9c1f6eabc52832fba9aa962fb6c89d326b58a66a41ca536867c6b78e856e49de1b6bad299cb27a451e07c8421cd56fd46597e8b8a582ea33024bc
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\01a - Windows PowerShell.lnk
Filesize1KB
MD588df8d0f0b44a625f60dbf5c79cb8b9d
SHA157c09c069f471f3e1d76411ce6286b1919410aa5
SHA2560100fe8fb4a5cfac801ab56ee1946d9d3bc5fbf6c8ffdb31df08508d4b359366
SHA5121c65dfbccab674ebd6dfc6f8dd4d99435f41dc8cb00fafa02de6792378e9ebd94b4dee595474a881190895e38b5ec25c5ae6c4dc58570bbf0edaa2c3e9038556
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\02 - Command Prompt.lnk
Filesize1KB
MD50c4eebbb34177cbd7f77a88a9a72b717
SHA16f7afd445aa3ee40d10df495010ee2527da95bf5
SHA256050cc03b62b820baf827a2e21645a320c55e1a487e97fbe707438995edfdb9c8
SHA512552f6b856795d1fc17368381cfb9676392b9d00a3598edb279ee742b39966c77d4c791f15973fcd8bf14a4db14ab49f02c338ff0618c09db1765bbdb0a88d019
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\02a - Windows PowerShell.lnk
Filesize1KB
MD54ff9829da2eb2af443f7751d93b102f2
SHA197811262e3203fb9cbff103b8d473b94d2e099ce
SHA25680e1feaa8c86d8b3edfdc09a3139fe6c74024934af3c43d26d1a8e5c43c6d204
SHA5123354d7cfc17eca5912745c9cb67cd476e4302d92369e75b8f07811b7dc08108f68f37b99f054cc9777af2f302cdf2536a7acfc85f172eca19138aaae87fd7651
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\03 - Computer Management.lnk
Filesize1015B
MD595b499902e310f689969f9f4770498d1
SHA11fb53de34b4ce1b4e7eca6bd465c8c46b4e7fa94
SHA256e5eea3fac6ef6a4d844c95ec3db5afc367fd8c10bfb382d59b739b6582936082
SHA512619a05699fc1ae4a6aadcf44ef381c97b40492091ea0216df9abf8930f53d7b0d61a73e082331fe68d6d543f1ef987a44204560469c6d5af243992cbb2c1493d
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\04 - Disk Management.lnk
Filesize1015B
MD5c44fbc131d8debe5148683b194686bf7
SHA1f19dd0e9704210ba52f6f30fda48385a9ee59daf
SHA256f90c8941ad3c742aa1fafc8ca2441e6e8862e5f8ce558bf45c9cab428efbd415
SHA51299c0035a64f5144c6e2793c097570683944737b75be036a70a4b15d09fd3471c5a16bffd3ae3e51b01d7d1612b4013a3b4c5dac2f6cbace54894089c555e70a1
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\04-1 - NetworkStatus.lnk
Filesize1KB
MD53740fd90cc521c86b70b6259d1a08a7c
SHA14241d31ef32afd23efad384a6cb16f27c7646f49
SHA2567894c8abaab7251b3a05e38895f561562df219555f5307bcfa767c653db9ed11
SHA512582c024da7d34066ab9f3c321cec028bf86cdd9364b0e9a8daeac325568be2b9e78809639195d5c45b5909ede7a88663a12380b14ee36b83c5bc064e3f7b5884
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\05 - Device Manager.lnk
Filesize1KB
MD52edc34dda5d59ddfeeada9bc8a08278a
SHA12528591c000a7232867f18a43b3159c4a2a5fa6e
SHA2564db2f16b5f5ef91f56fee48618c05a2a577a0bada7375e03420ed1890dd9c167
SHA512020e6d362210fc5d02d56a710571938eacc2e2d5fa834910a5f10cbc4b5f494bf264661e311dd95dba7c3bf756069e992f362a68a8aec01c06d335aa76887009
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\06 - SystemAbout.lnk
Filesize1KB
MD595fe4ce8fb5f1c78f81e409c4be40a93
SHA1339051b0033ac3c57f3c88c4c6f536b603a43ca6
SHA256196cc3e145935e11ab885c313c49e4a1c01c8ce3ac6a6fe0ddfa68e62d1f6457
SHA512ec9bbc27138a109180cb4f683d964ad1f645969c95ed92a82ef0e24c37197b87e96fabb86371025afd41ec6633468fda1047e0aaf12ba11256cf45b9fba7741c
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\07 - Event Viewer.lnk
Filesize1015B
MD583281a45b960a16b809fcdcae875ff1b
SHA1b057439ac7ba88698d87de1bfb56cde5d7b2d9ea
SHA256ea8186185c5a4026bfe596776c9dae9645543c5cfec6c5a32243f1b22b410180
SHA512ba88a1234e58821eaf60e03968e7ea7d3f5e1c2e1c94cca4a5d2c83e7f5e6da3fcf6b93c9490358c06d9e42f21a8f3383a7b7fbd0307b2f471fd8cb08afa37cd
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\08 - PowerAndSleep.lnk
Filesize1KB
MD5725ccb8bacf204fc69b0d64080e87b5c
SHA1feb0cee790d6655e0f62dd3e38a675981dd3f48b
SHA256b0f092f54f4bed7a1a1eee71a5e5aa318977fbbdcea916555b6e41a6ebee4618
SHA51261a303dbc1472e1f208f0a7657434f8e01ee7039018a7e762689b8ee598c1a8d1a63f43354a32727f3b98aa74a508fe06409d3c07f9e5126c9050ca036f03c51
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\09 - Mobility Center.lnk
Filesize1015B
MD50caca2f1ba0ebc611c55967504f1b4ed
SHA1195d20557e485ffc263760a7fe82394154fe7e43
SHA256127ceba7b31ad71db922a9a1ba258b37cb1b26c81f8f26cf69c0097009b00756
SHA5129b1ac70844bf22ab6741701da53d79b6ebf370e990c3e2ec46a7e35c2a146322fe8da44cb7ce5a7ef500cac8857a7be3b43ac2177da8b78b0abd5a9cdcbb164a
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\10 - AppsAndFeatures.lnk
Filesize1KB
MD5300449118cbff6b3120615029be104a4
SHA133f33a6d00c0dbbc5a546e041840819d0b1f43a4
SHA2564b936a8486d46b4840f0bca1f3b026c82ae36fc0ab152995360629b5cd3fa35c
SHA512b08b892352cdda458ecf81a694eeaf0feb1cc6ea8f3d5cf999b31878bf76e22ccd1111a88d65dab81a7d8547b36a078d08969f76963f8c9255b356eed4947e38
-
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk
Filesize352B
MD5b8d395f1d996a6632bcb945d64743bb3
SHA1cc2b8be14606767082cbb621c7b1c3d9aa534593
SHA25632c0ce931d2d66cd66d89b40897529ab328cc4ce0a4074d0565e6490748f920a
SHA5120c393a4fec614915906ca484392bf6cbb90193a51d255d6d3690a3aa663ccf4873798c7acc1baf1d32df22b3cb9c285c4cbfbc6da8c6d345bbe63f02e1200f6c
-
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk
Filesize334B
MD5607815773595a168cc7df066e4efec7f
SHA1aee6ac695492b2d3370cc8aad9fe27ba392ea00e
SHA2566c75ec48c9ce874bb724b26902c0ff49c59076ac31550459fec2ba2b4f854ba4
SHA5124c9415fe6970f6f14f7f813ff195e70b7a258aa6b8e48468c2b678c20e8bdbb73c74aa85ab3074642f0a7fee0266fe7eea00354b6994f90692d6a82af715a103
-
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Magnify.lnk
Filesize1KB
MD518d921f530efedb7b619a6f52d355b62
SHA1488ec2d7f8dce4282479fc91fe5184a0e4917367
SHA2566d78ef71e6416a512a1d697baa801506df36fb63aa938b01c3f81eadacef8f96
SHA512ae26fa0a42cf5105943e759516f880e2ea75a02e61697a7e5b6c735007396b89996fa21a9f6b3a9500c8d8697543e6138406e2751d40da58657cc21b305a79b7
-
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Narrator.lnk
Filesize1KB
MD52ccb9b4695baf73d1e90ae3135f8ecaf
SHA1c130c9dbd2feeb52436fdad2d100443f682a72e1
SHA2565fe0e7b3b2bf8d7fec543c7f08767f7b39d322baee0bdef1e076db344736b5f1
SHA5129a7e658f397ec1f2f8507fa087c547e95fb7def8ea762bcc2e85de8df6589cdb6724b0008c1ba9321e009690ae66596cdceed08ddf8d05922e258fd1035c4fea
-
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\On-Screen Keyboard.lnk
Filesize1KB
MD547576701e6424eaa5e0b0f8804469b1c
SHA182636b6fa3069b6dccefd9e2ed1c531a7d238e6f
SHA25690151cba2e4bdb9efa463874873f0ffbcc96e3c9bfd11dcf4c74331cec4c9a84
SHA5120e35e8218ab1efb71fee4ae152061ddc4be706dc7bba81a7e0ef4db31b43f82e2203b9e0550c5d05005c8b6999e62c5f42b58d2c62f1579d04d7369f7b395948
-
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Administrative Tools.lnk
Filesize1KB
MD5c15398c4b70a427068da363b240f066e
SHA1a3514ec69ec173fbef9677f6a9ed4e523157db4c
SHA2568eb5683f6f02891ae488420944a2a2bb0611c4387a4dec7ba91361239b33645f
SHA512aa54e90f28a7ef44b5bad2cfa318c902a437d7b686d10751cc6b366cb6d44afeb0bfaee6d9cd845435b2b9b39254d34a2030cc655819fc4bc8edcced0371e7bb
-
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Command Prompt.lnk
Filesize1KB
MD52d1aa3e1848cdbe727debd0fc2b29cbe
SHA19af437583f11dec9766ce6421d5774feb26d9963
SHA25636eca58dbcd5834e2a9470482b0d23bb0a9f20b2accc70aadd3a5b70699947c1
SHA512122eec2d835c0874aa0314cd681310794b6d9538ebe758cbff06ca1491c4ecc424ebf3cd9de7f1483c32c43511bd6c6c3e5af04cdc1692f557bf55d3d509699b
-
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Control Panel.lnk
Filesize405B
MD5d870dbcffbb75d75937cd4a3a5ca114e
SHA1358e83b79f7cf31ef842e06d7b60beaca0f617e7
SHA256763ca27fdc8dcdab73a4f81040b0a74fbd8d17b3242309fb745b33518f0e8e58
SHA5122643d297256495a9ea19e5f9c895bf5fb4230bc9fe3dab4b3663aebd24971b7c3867f0e5dda6bd19d01d01e46292962516a1f9a9c559b4143803e240ff196ed2
-
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Run.lnk
Filesize409B
MD529bfd53030087b4c072ccabfbcec75ff
SHA138f50e67f488cc588fd4a7b0e5ea295b96d21345
SHA256274f637cb0fc91632175eef0723e01839cc6247607ea63caad4c9c2be53c655c
SHA5125c3fc5c419ef30da6b967fa829a79b9959841664c0d0e2cc0f9b20636fca25efe78ecbf60ce73aadcbdda80c401c995e432dab433e8a8ba8975d3fb138ae1792
-
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\computer.lnk
Filesize335B
MD5fd2505daa09b4484469709774bf89834
SHA1e457daea8dfea5e4f79e94d7b406686f17db83aa
SHA25608ce54d87ffb8a89424bbaade4608eb73cba489f1de05b9d5e528ef25ec04b66
SHA5128ae9be19faff7833e86aafa3f7024f3de7b29df6ec7664d87cc379a7fea190d85a193efb952f6fa6331939a221d1a48d19750be7439c610e899a45608b58578c
-
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell (x86).lnk
Filesize2KB
MD59f55b384e1134debc42d014b25d10041
SHA156f1471b1fbd0cccf974e0b4542f98f068e227f6
SHA256f0b69d3e6ab9ab3ccca63b1353da442bdaba26841f2ebe356fc339a5183a37d0
SHA5127befaa35d38a6bb650b04747139354680a51bb4473f1a873b4023c2681e5f9a5e01ca514b973e8da8c554062cbad3573c8713c473bc53c8dc0490ba1d8534740
-
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk
Filesize2KB
MD52aa0b0cd1862924ed6f7066c8f6fbbd9
SHA1095ed1be35c1ba2afbb7347f7ee903a3acec1ad2
SHA256fc3d4e470b5868c6deb5cabdb4e1af04e0d56debc64d6bf1a4b1ca59fcfeafae
SHA51284d66c8c5c017a417878f81bf183661813eb05cfafb902ebf879f7d214ddaec2ef35be9e16d947121cc468e05c0f1dd900aab9c2e8ca84c13572ff3f342be54e
-
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png
Filesize296B
MD57d41d899a515f415a9a3336e3dd22c06
SHA14b395ea7125a3d5dbf241680d4f8bf49dcca8b63
SHA256718579ccc2626f5f72c53fb2fffa42e874d746a05f32eb37d200e1553f18e59d
SHA512ff097bdfe73a0d289008eec2045450f0aafb835ef383cfbfd5b784f83239298e7ab0a98fa5343c362283b2f75005d5655d790e2b2054a772451590e87894d732
-
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_contrast-white.png
Filesize276B
MD57fbb7afeb7d94107093c4719e43d9ae4
SHA1c4a4ddd4c6e01588754b9c65e0177819eaeee1d1
SHA256d96d764bdb642d48c2d42d837be0a161ea10869835276f9588538f9b40a943bf
SHA512e6b65dda40a4dc6f934d44c9aba64b750a89cd0e5d1b9d6e08e9f02af484887ce048160c03204474e42b0a5b988e27056c2bb171e9a88eec6b5d7e7ff5389058
-
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png
Filesize296B
MD5e3d1bc584f9074d3d21bf34e98a6f057
SHA174792789fca03e8d2a3479ae9bc8a93e6df244bd
SHA25693b981ff55bc24206bd901457dcc91b97b8e48fa60a69d3488158d650e7b0084
SHA5125736a75fe4b6414d4907684417424e2e05ea182b3ac179453bc959eec689f6a9addd8ef2fca1c8081e5cd85a42643c94dec8c4acfd9b62cb11ea486080611349
-
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square44x44Logo.targetsize-44_contrast-white.png
Filesize276B
MD5fcf902d08eac858237c6da0e28a01415
SHA17e5ab6c5bdbc13626b430736d92f017c2c57db62
SHA25693fe25f357b51bf3d21ca7687e0d677ebe6b5b5e19c7af3b808201bbf6efcbd5
SHA512fe98a3ddd3afa89354850795301233e6b88e93f08d616f6dd97f3d230de38c4c81cfda33151b3008083cbb441798a7760dd5aca808c01737f637529eec94c8f4
-
C:\Windows\WinSxS\wow64_microsoft-windows-onedrive-setup_31bf3856ad364e35_10.0.19041.1_none_e585f901f9ce93e6\OneDrive.lnk
Filesize1KB
MD5cd1596b0077e9256fcc48793559639b4
SHA19980304694c110e1d6017c807312a21deb1fe8f4
SHA2567225556e8ede3046456a7f9e7c24a189f06e2b5002ed961e2f684eb1f16773ed
SHA512e452b617b5a2ed9d4387c874b3f51a084935bc35ffc0c488b3d6d8e90e6c8e28b9eb7ce979193da855f27b68b478ee470b12efdaa39dece5dcd4a63d13bdf630