Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
17-10-2024 10:53
Behavioral task
behavioral1
Sample
51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe
-
Size
12KB
-
MD5
51ca67721e3856be5fc9e984d3f025b0
-
SHA1
bc619fe5b2e28a41bc2520c1acb37b93ee898f07
-
SHA256
57ce49cca52d7b0a9be772562bf6b40c7d50961773e369e7e19129c702acae04
-
SHA512
81cfc078f8d892d98edd3b8a25826226b6f50c76698ad2abc8343ea7889b18324247b692798224e7032d505191cdec1b58af85b9b023f4666927697732a42be1
-
SSDEEP
192:J/TrG62a6B10k3g4fXk1iTV3HGc7EkpAqEjaGpsHcxUw4h+afPtRMCZgWOS9p:JebFNw4Pk1itKkpAjjJs6B40hCyWOg
Malware Config
Signatures
-
Renames multiple (2201) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Drivers directory 1 IoCs
Processes:
51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exedescription ioc process File opened for modification C:\Windows\SysWOW64\drivers\gmreadme.txt 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\u0m269i9MFZ31k7.exe" 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe -
Drops file in System32 directory 21 IoCs
Processes:
51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exedescription ioc process File opened for modification C:\Windows\SysWOW64\MailContactsCalendarSync\LiveDomainList.txt 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\WindowsCodecsRaw.txt 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\default.help.txt 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\default.help.txt 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\default.help.txt 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\@AppHelpToast.png 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\@AudioToastIcon.png 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\SecurityAndMaintenance_Error.png 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\default.help.txt 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\@EnrollmentToastIcon.png 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\@VpnToastIcon.png 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\default.help.txt 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\default.help.txt 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\SecurityAndMaintenance.png 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\SecurityAndMaintenance_Alert.png 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\@WirelessDisplayToast.png 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\Bthprops\@BthpropsNotificationLogo.png 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DefaultAccountTile.png 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\MSDRM\MsoIrmProtector.ppt 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\MSDRM\MsoIrmProtector.xls 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe -
Drops file in Program Files directory 64 IoCs
Processes:
51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exedescription ioc process File opened for modification C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-60_altform-unplated.png 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteNotebookWideTile.scale-200.png 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-24_altform-unplated.png 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\LiveTile\W1.png 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Exchange.scale-400.png 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\StopReproTraceIcon-glyph-e916.png 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\icons.png 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\9.png 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-72_altform-unplated.png 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppPackageSmallTile.scale-100.png 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Store\AppIcon.targetsize-256_contrast-white.png 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\Square44x44\PaintAppList.targetsize-32_altform-unplated.png 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\notificationsUI\notificationCenter.html 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\CHANGELOG.md 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\AppIcon.scale-125_contrast-white.png 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Content\SaturationGradient.png 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-32_altform-lightunplated.png 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-256_altform-unplated_contrast-black_devicefamily-colorfulunplated.png 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-white_scale-140.png 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSectionWideTile.scale-125.png 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\Assets\AppTiles\StoreWideTile.scale-200.png 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.scale-100_contrast-black.png 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailAppList.scale-200.png 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-white_targetsize-48_altform-unplated.png 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\jdk\dynalink.md 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-20_altform-unplated.png 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\ExchangeSmallTile.scale-100.png 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\MusicStoreLogo.scale-100_contrast-white.png 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-60_contrast-black.png 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\contrast-black\MixedRealityPortalAppList.targetsize-60_altform-unplated_contrast-black.png 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Yahoo-Dark.scale-300.png 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailLargeTile.scale-125.png 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteNotebookWideTile.scale-125.png 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\AboutAdsCoreBackgroundImage.jpg 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Yahoo-Dark.scale-150.png 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\AppIcon.targetsize-36_contrast-black.png 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\AppIcon.targetsize-256_altform-unplated_contrast-white.png 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-32_altform-unplated_contrast-black.png 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\images\AppWord32x32.png 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNotePageMedTile.scale-125.png 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\GenericMailBadge.scale-200.png 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\pdf-ownership-no-text_2x.gif 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\[email protected] 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-24_contrast-black.png 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\SuggestionsService\PushpinDark.png 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\find-text-2x.png 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Store\AppIcon.scale-100.png 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\ScreenSketchWide310x150Logo.scale-100_contrast-white.png 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Transit\contrast-black\MedTile.scale-125.png 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\AppPackageAppList.targetsize-256.png 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailLargeTile.scale-200.png 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-black\PeopleAppList.targetsize-32.png 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-32_contrast-white.png 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\AppCS\WebviewOffline.html 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-24.png 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Google.scale-100.png 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailAppList.targetsize-60.png 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\RTL\contrast-white\MedTile.scale-100.png 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\AppCore\Location\Shifter\Relicensing Statement.txt 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-256_altform-unplated_contrast-white_devicefamily-colorfulunplated.png 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-80_altform-lightunplated.png 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-32_altform-unplated_contrast-white.png 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe -
Drops file in Windows directory 64 IoCs
Processes:
51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exedescription ioc process File opened for modification C:\Windows\WinSxS\amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.19041.153_none_e669b22d011fc6b2\BluetoothSystemToastIcon.contrast-white.png 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_de-de_6988eb133eb82b0f\403-9.htm 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_it-it_9f248a35f7c12459\500-17.htm 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_en-us_a323edc73bd86475\http_403.htm 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-p..riencehost.appxmain_31bf3856ad364e35_10.0.19041.423_none_bfcb7b02f95b1e52\PeopleLogo.targetsize-72_altform-unplated_contrast-black.png 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..okerplugin.appxmain_31bf3856ad364e35_10.0.19041.1202_none_d081f9868ac0a804\PasswordExpiry.contrast-black_scale-150.png 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-onecoreua..uetooth-userservice_31bf3856ad364e35_10.0.19041.153_none_e669b22d011fc6b2\BluetoothPairingSystemToastIcon.contrast-high.png 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..l-wallpaper-windows_31bf3856ad364e35_10.0.19041.1_none_910333b84fcf455a\img0_768x1024.jpg 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.19041.1266_none_fb76f6fb7e78a373\InputApp\InputApp\Assets\KbdSpacebar.wav 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.AddSuggestedFoldersToLibraryDialog_cw5n1h2txyewy\Assets\LockScreenLogo.scale-200.png 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-management-oobe_31bf3856ad364e35_10.0.19041.207_none_504b6becabbef9fe\autopilotwhiteglovelanding-main.html 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..ets.icons.searchapp_31bf3856ad364e35_10.0.19041.1_none_ceba36fd1b479c4c\AppListIcon.scale-125.png 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_b0c852643271e4bc\default.help.txt 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.423_none_9de80b9d881a1ebd\eventBreakpoint.png 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-p..riencehost.appxmain_31bf3856ad364e35_10.0.19041.423_none_bfcb7b02f95b1e52\PeopleLogo.targetsize-16_altform-unplated.png 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\Assets\SplashScreen.scale-125.png 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_b4fc93ef208f3edb\500-18.htm 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-c..ngshellapp.appxmain_31bf3856ad364e35_10.0.19041.746_none_0b4ed891dd9ccbc8\square44x44logo.scale-400.png 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Windows\SystemResources\Windows.SystemToast.Calling\Images\YourPhoneCallingToast.scale-400.png 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-ecapp.appxmain_31bf3856ad364e35_10.0.19041.746_none_db09942beaf4fdfa\Splashscreen.png 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-i..ntrolpanel.appxmain_31bf3856ad364e35_10.0.19041.1_none_d0af17ec366548f3\logo.contrast-white_scale-150.png 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-n..quickstart.appxmain_31bf3856ad364e35_10.0.19041.1_none_4a388618f6365227\NarratorUWPSquare44x44Logo.targetsize-30_altform-unplated_contrast-white.png 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Windows\SystemResources\Windows.SystemToast.Calling\Images\TextReply.scale-300.png 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.19041.1_none_ff46bbc9afee54c5\RatingStars45.contrast-white_scale-200.png 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-i..ntrolpanel.appxmain_31bf3856ad364e35_10.0.19041.1_none_d0af17ec366548f3\Gaming.png 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-i..ntrolpanel.appxmain_31bf3856ad364e35_10.0.19041.1_none_d0af17ec366548f3\TinyTile.contrast-black_scale-400.png 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-n..quickstart.appxmain_31bf3856ad364e35_10.0.19041.423_none_72535ca9b59a9515\NarratorUWPSquare44x44Logo.targetsize-24_contrast-black.png 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..ast-white.searchapp_31bf3856ad364e35_10.0.19041.1_none_2f147508fcb33106\AppListIcon.targetsize-32.png 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-t..extservice-tigrinya_31bf3856ad364e35_10.0.19041.1_none_32b87d9e1faac9ea\TableTextServiceTigrinya.txt 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\Assets\PeopleLogo.targetsize-80_altform-unplated_contrast-white.png 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-c..termanagementsnapin_31bf3856ad364e35_10.0.19041.746_none_290f6af7d5263efa\Computer Management.lnk 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-m..nt-browser.appxmain_31bf3856ad364e35_10.0.19041.844_none_d9eb415c5b9dbe4e\Square44x44Logo.scale-100.png 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\Assets\Icons\AppListIcon.scale-200.png 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_it-it_2fceb6f1060351fa\startfresh.html 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-microsoftedge_31bf3856ad364e35_10.0.19041.264_none_ef195f564f00d259\MicrosoftEdgeWide310x150.scale-100_contrast-white.png 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..ast-black.searchapp_31bf3856ad364e35_10.0.19041.1_none_e479c512c8bfeb66\AppListIcon.targetsize-48.png 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-c..erymanager.appxmain_31bf3856ad364e35_10.0.19041.1266_none_20804a45b5801645\BadgeLogo.scale-100.png 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Windows\SystemApps\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Assets\PasswordExpiry.scale-100.png 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.FileExplorer_cw5n1h2txyewy\Assets\SquareTile44x44.targetsize-256_altform-unplated_devicefamily-colorfulunplated.png 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\Assets\store.contrast-black.png 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.1266_none_777e4c5802d14c18\oobe-light-contentview-template.html 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-xbox-gamecallableui.appxmain_31bf3856ad364e35_10.0.19041.746_none_0119299746221375\StoreLogo.scale-100.png 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\image2.gif 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\headerGRADIENT_Tall.gif 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\23\VisualProfiler\images\i_f12_context_chartzoom_in.png 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Windows\SystemResources\Windows.UI.Shell\Images\RequestedDownloadsCloudIcon.contrast-white_scale-125.png 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.19041.173_none_6486f23c2831aaf3\InputApp\Assets\StoreLogo.scale-125.png 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\ROMANIAN.TXT 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-microsoftedge_31bf3856ad364e35_10.0.19041.264_none_ef195f564f00d259\PhishSite_Iframe.htm 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-n..quickstart.appxmain_31bf3856ad364e35_10.0.19041.1_none_4a388618f6365227\NarratorUWPSplashScreen.scale-125_contrast-white.png 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-microsoftedge_31bf3856ad364e35_10.0.19041.264_none_ef195f564f00d259\MicrosoftEdgeSquare310x310.scale-200.png 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_it-it_9f248a35f7c12459\501.htm 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.1_none_75cd350cc8b5dbcf\alphaColorBar.png 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.1_none_75cd350cc8b5dbcf\previewTabClose.png 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-o..documents.resources_31bf3856ad364e35_10.0.19041.1_it-it_550e1235949cf95b\oobe_learn_more_activity_history.htm 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\es-ES\assets\ErrorPages\repost.htm 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-c..ngshellapp.appxmain_31bf3856ad364e35_10.0.19041.84_none_24f8aafdaceaf0b5\wide310x150logo.scale-100.png 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.117_none_e0d32848ac56114e\test.html 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-i..ntrolpanel.appxmain_31bf3856ad364e35_10.0.19041.1202_none_8f7e37524c3e1a13\wide.Devices.png 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Windows\SystemResources\Windows.UI.Search\Images\logo.scale-140.png 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-c..in.preinstalledapps_31bf3856ad364e35_10.0.19041.1_none_78045c4b5f61a56c\DefaultSquareTileLogo1.scale-100.png 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\WDSC_Illustration_834x834.png 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\Assets\PeopleLogo.targetsize-256_altform-unplated.png 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-p..riencehost.appxmain_31bf3856ad364e35_10.0.19041.1_none_97b0a47239f6db64\PeopleLogo.targetsize-72_altform-unplated.png 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe -
Modifies registry class 10 IoCs
Processes:
51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\XVFHASZDBSERGJE\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\u0m269i9MFZ31k7.exe,0" 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\XVFHASZDBSERGJE\shell\open\command 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.kmbgdftfgdlf\ = "XVFHASZDBSERGJE" 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\XVFHASZDBSERGJE\DefaultIcon 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\XVFHASZDBSERGJE\ = "CRYPTED!" 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\XVFHASZDBSERGJE\shell 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\XVFHASZDBSERGJE\shell\open 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\XVFHASZDBSERGJE\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\u0m269i9MFZ31k7.exe" 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.kmbgdftfgdlf 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\XVFHASZDBSERGJE 51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\51ca67721e3856be5fc9e984d3f025b0_JaffaCakes118.exe"1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2008
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\aic_file_icons.png
Filesize50KB
MD57fa55c0668e355fcb0eec02e69a17f01
SHA1198e71453b9667c8d5cae1999bc61c064038a1e6
SHA256b84a61a07f00a52f711774eafd82f7db6a38930ade257ef5d28acef7ef9e89f3
SHA512563835679590c8f5605489677fa3fb7b0b2710804e0235a82c1d56f7cc74a6705439f6d3f8a9b1703435e08806353f882bfbacc7521229ddd3ec7b482c8ff390
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions.png
Filesize1KB
MD5c23adf92555876d41c9eb2064a615935
SHA1cadfa67645d43c1c6d898a126a872e83375767c2
SHA2562acaf4dddf489e0fc82cc5d34892bca9a7d727874c4e337fccff2e8883c5cfea
SHA5126238124a2d899a2c4b3c4a47929f83a01e82f7456776ce9a95573b2c7043efbbd7654ae33c81db33e47418a2fa8cf0e8d0a07347739e769a57603fa999fde75a
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions2x.png
Filesize3KB
MD5495288751e1f8e25b57e8b0ff1d9b5b7
SHA18f5e765c500e572065b6f5c140c0d7b26e635016
SHA256bee7df88cbe8658229940347df80f1c3853ee68185ca8615d6c4aeb9910fee39
SHA512281cd5765874dabefe6f8a6a9bd56127b40dc96d3883a5573c11e215ec1693b668cc8d26ad506acf0f82ba694b119d7be0e7a279cedb5751ef867cbb5856af6e
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons.png
Filesize683B
MD5ee344a341bb1a28a2e94753eee0495b2
SHA1c39204fb4b8edb2e15fad45c3e81a3385078a6c1
SHA2567fd80cca1af347d35b8d85aa672dbc6dc834a05f8386efbbc6093ef8017813d9
SHA51268001334ad10a2d5ce6d73a88072d28b4d90fc68041fcb3e2fc6c10e108e756ba846d9a968e97f856c640f720ce97c87d3a7bc0049ec0868c8011a3dd85279ed
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons2x.png
Filesize1KB
MD5b1409feaf6fcba2c82da216f177168a3
SHA10bea360c4232deb10b87dcf4b2e9194662d94e5e
SHA2562dd5560b29c1132d5caa3060f1161c3b2e9aa8edad30cd62dba977f07c14a563
SHA51274cda09005a9ab20ae63db82811bc597042542609006ba096fd582738444cadafc9c27ab8663f84d191913e5f6bc4bcb8d3ac513d9a80fad4dc75f74cdeaf2cf
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon.png
Filesize445B
MD52f86b962eca754437620b7b0abec9b94
SHA11c9d1edb8951db9e270bcfcd32c19e8f24c71cc4
SHA25618c96c939c6cfb8e755c0cb980017f22c355d5b3e55b83c66e66443e345f16b6
SHA51274beb85128608416eff1b997adfcac264290cacc5c45831fc068fe04167112a6290f67be724ab17b56474edd881301863567a46f4e26a8e8bb97ea478571defd
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_2x.png
Filesize611B
MD5cf373ca4a3037cd536cf5658d1c552fc
SHA14981eca43b578c7d5db1c119e1721dac3661e912
SHA25619b22c610d241adceee994a68de83945f66d25af34330eacff4d72c2ebeb2dc0
SHA5126e60e52f49718149fb9f9debb50d616bc433a7ac6c7647eaa1c688da02aa366f762ffb6b0013f4856314971ca4e4e0f3079fb39c20cbc4a3ec83cca8bcb154d9
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover.png
Filesize388B
MD5a049792af483880a85d012b4a22ca473
SHA1a50e4268fd92579828595567d673c83c301b5839
SHA256f9514ccdcd2b5483a3e3d787e966f83ed9cc5d8de287e4d574f4d323be7bf076
SHA512de77c0b79eec0c41e2401fef3e6570056a144e5ef724059a2bfb482db81dbc21c3ded98109949f6700ed231646ee65f39d2928fee66af2d64df05c738c032662
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover_2x.png
Filesize552B
MD5d389e519510e020f11cd0ac610088655
SHA1ecec25e87f50a9d2becc5815560d16346514d728
SHA2567ae4503f1ad27a5a3520a8adf748c690205c9f6d67b459fa163c0aaaee977221
SHA512f583176a0480239ea7c3bbf288cc45f3efd4d461f4701e6a24ec81ca80908701859dcf222a277a9c76a133c6bbb9143f170b414890afe1833e3ab4baee5f7967
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon.png
Filesize388B
MD5dba444841ed6d644e707927b40648cf7
SHA119a3ff05ab839dc3be79f01fcc6ea581c05142de
SHA2565f1c3bfaa9e0eba7f6f4ae45d5d0f1cd7f63a043541b7c562b7dfb902ca4f309
SHA51265bcfe971341d19b32dd47479d0a7875d1e050bebd931da5d421aebcbcae6c54998f6ecc39dc51a53874598be71ab1b46aa65b620f4b34957ac660ff759d7b63
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png
Filesize552B
MD535f201e651baa8aaf2605edf362871ad
SHA1582785dc1e78a1e42f06576d12dc416396dbb9fc
SHA2569189baff99e7acca6879bd5c2798d0af06c8fa0393a6cff21a0a63ef369c132d
SHA5125894160e7f28a025bbbb6ecbcaa1a31e613138531beb84f09ca686e95fe28e7d0053b7c310061abaa90b24a6c0282cb27c9076813ac73aab2f2c7b34d2d2a012
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png
Filesize388B
MD593741d612d9358917ac0c339e5917bc0
SHA1da8c8bf2d2094e1ba1bdd1fa5042b9dcf5f67b9a
SHA256982beb9780e9ea5faa9a0c1ad05e9eedb02ba084aaefaf8a2bdb2b660d1f98a7
SHA51259aae67327742d89f4141014c3820e6b2d304d379a16df6e8ec5c437d49c2e268d502e73ab703e178a56b900598ad4b126507803792965e73477a431bcd0dfd1
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover_2x.png
Filesize552B
MD541fa14768424d85a993d675f12eab25e
SHA1c3f04f0558b6827e4218ac151512ed9f77e880ae
SHA25697dc66cde818562dc12e6acd9e4f70f47356df2da914e3cbb24cf4860debb3f5
SHA512792c93855d222ec4c3af906e9cac549d625c5cda11e9a42da68ae895d285ee7e402b2e4410adbfc9abd5563b5fa2e58fe5eab24ff98ec9f79a9e9f7be987881c
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons.png
Filesize7KB
MD5cb6736f2eaafca94a115efa39931a7fa
SHA103e16fa7454d33200f9646bc8d4c043b93739983
SHA25631e0b145ae48dd35a2a2bb7dabc41fcfc674daabda30e0017992e7de87a88873
SHA51239a8ad1b007fabc193064a3fb01a5209f86448d0837864644f1b94a4cfb75a7fa85bdcee36b6ca0f38ba30b9d3511e9339822baae5a8032d29c87e67f544d85e
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_ie8.gif
Filesize7KB
MD56c38ac8cc032bc5a762117d7e7a91d93
SHA13beaef356a126d1d77ca332bfd76253e5445a120
SHA2564c486b9d6b4c6e7d660e0ab6cb8c917a91fa6412bfc3b7c443478cf2ce2f76e5
SHA512873ba49e053cc911e1c4eb2d29db51086d33f59a17f2ffeda31488e415a323ea7ba6172d853f8882073a2d38dbae529500c297f7b7f8557d5e6aa0ae8f61d681
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_retina.png
Filesize15KB
MD5141ddb1ad6cf0eca0e32330e910230ba
SHA161af7c22c2370654be117600116e84bf1468acd9
SHA25682943d06f8fa17c1003aee7e51c98d473a80420507d8357b6663caec0c026497
SHA512ab09cdf39df45cdbbc99ef5b1f938a9983e35e4d06abce5914db44ed3365be7b97b965b1f28a487ee1adbaf210e9322d63fac12df29bb8880dc95fdf491c3f81
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons.png
Filesize8KB
MD566de01f3e224236c8797e5b1bfadf6a3
SHA199f9a1ec9561f149dfdf0f5de704e1b1573b8600
SHA256139adde9de9f6b39d99a07621e8087888e3eaee11fa76f3c81783b03f6d716bc
SHA51243a84a1489f7a099e79df719213df112f30d8a098f002262df77136b609bc4f5060ece3c357a0bcae5af96a7ba85687c3063de182d5622906f7c80e56fb825c0
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons_retina.png
Filesize17KB
MD5e092b4deeea4f501b6b704a253ed581a
SHA169c8f1cce68c983ae7ce5c2a993f8d5a26cef6e6
SHA2564a978508aca13ae4068fd77c868e4bd4ceb007deada1cd29f1137dd88b01e13e
SHA512d0e7fb1670a88220b4d5f930a765772f57d799f18e415f64d76849b291f7f152b6e65a48d8716a72ba949def739256771f2c8923220fce2485eac82b6125dadb
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_pattern_RHP.png
Filesize179B
MD5e44aa0b0782f339204670c4011498d23
SHA185118f637146829636cda66da59560c85a69b937
SHA2565dba50102405b5c790bc8e91700f9ab1b2092f19e05f999f1de7adee676bf2a7
SHA51263e126c1649f3e2bbd398b00eb4e95c78be081f4870a3ac17a5eb1cdb490f81945c19a7c2cb954af2b9419fd00818de5aee7e2b65b79120c146b2207586671e6
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_patterns_header.png
Filesize703B
MD59f46178a0e5c10e32d0a01a3f51740b4
SHA1a9ef4a8c5536fb9f185815dde3e02ee01171070f
SHA25638a773e21db00421417b127682786c6abbd3bfa05dbcfca2b9ecca439307d852
SHA512b605e0d887762697f4b1dd2f6cb6c22d8733aaf76f3899e1432339029db786f748dd30a0835e5e48c7d87337f4ed94b54cf4eb2151e659bdd3f31df1473c010c
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations.png
Filesize8KB
MD53ec8da1c05771a5fa4c4f8510503a72b
SHA134894bd79ac9d0341831c9b98e7b618685c8848b
SHA256ea128a41027a42837945c216a684954a065c2f3f9ddcaaeb6a730353387c96aa
SHA5126b1489cee0f776fcd1401c475abd3624a150b5a13d664e304c22bf091379df43ca54f69e4660d7b43e78ad550957947123ebdc9a2b4b8e0fdc28483180b8e7dd
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations_retina.png
Filesize19KB
MD5a8d5f5947f2dbd432a8988a915d1dbf3
SHA14846b4f25b4bcef01b1c8f42de49a166b11eb782
SHA256e7ee334dbf15bfbf47aa6245b99a1e11941cd004164624406b06ab1a970c480f
SHA5125893ad83f0bac754a9fb6e9b7b1550cbe74e977dd6e63e316c480417bc61e4d589c10fa91d6acf0973c67b4b5b8a4e63eba434bf6223e45403f544cea2e57dbc
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\faf_icons.png
Filesize6KB
MD56e1138004cf1b5a92e0743b79237b559
SHA1c1c15458bb3c7af9901c817ad971a707c62fca7c
SHA256eb2a01935ef06d1ae72961ab8e44e7168d4b9793d057c85f4a5fdbf9fad06fe3
SHA5124de56629201d2e3384b2ff552ca58d16dc33464bb3095233b4a511657de60ed935d080935b206933fd27e611d6c3cf76ac2514a42645c58e029b2e96e5954d43
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\bun.png
Filesize2KB
MD5f771b02dc59d12b2bd07dfd1c3d90f84
SHA14282ee42def1bd0233005275a87d13e70bceb923
SHA2569357f904e12c1c29aef7db544dce1bddd292dbc8601a87c9a11c0dacda2233da
SHA512e4ec0667d81b6c21c2e90d3b78e7c6493805bf45e354195fd41b2b93482d47de08e9b7f89dc3ad2a8e41d0d42142d9545a2e47c948b7b40439b52a7da72bac7b
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview.png
Filesize2KB
MD529a1f149f7d0a07ee1a96987d66b19ce
SHA12092ea0584da6290c0637ffd9782bc45984f9db8
SHA256c0241b7eb39915fd54844ae540b3b08ebd0a159af21be2665ef7ef344aa28e88
SHA512ca052bae54f1604ae228b7bd84590edaf12a1fc43215408a1f9d7ea94844f2e8f5e0c7c129d0c08542ce4750fd122dd9e01bb73aa2f3602045b7789d81167b2e
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview2x.png
Filesize4KB
MD547d17ff720b62872dc9dcb89f2119f06
SHA1d27b6c9ce125ab10fe715895e165fa4afa5043b8
SHA2561feeed0c60adf748c763ef4225da570afa2befb28b4b93b7d7491973f8f1a300
SHA51205daf1b0ca3485e97e40914d9589a0847f40c7b26b1900ed13154ab7c87cfd1b3c6b144a87e6928d04fbee4e251d3c5cb387b7c85b709ad3ceac23a7b8b4e338
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small.png
Filesize289B
MD59aa144f6723f5debc69334a7452c38ed
SHA10ab93856c23e1dd326a13ac9d40dc4952078238f
SHA25642b334b32cd22caee7cfff4934689ae8db5c12b36deaea8dd409f8ac36b99df0
SHA5120110e25f0f86f142c54509258a42c496d37661cdb902d3b1337f4c1c28869661bd8b063e2a11c377e082fa853335e51a85abc70f91aed7f7583c4df0aa2deacd
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small2x.png
Filesize385B
MD5c9e834a2b891c427fd6b06e2c31bd324
SHA1d4cf76c7d531bf529517248f7d8e521687c43e2d
SHA256c28298ddfcae07ccc6fb033a43f74bbe8b047c8d429d5ebfe6be6f07f284030a
SHA51240a8b39e88bef2373f7388d62e12d5cc8510246ff88c1a6b0205132101c98fddd0b178b8cb00bac4040640baa3c044f2458bc7663e3d2ed4d277dd2e69e96596
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\illustrations.png
Filesize4KB
MD5b49ead4ef7fcd48f7859291c3cece8e4
SHA17fe6ae243cc4ec72a6179d339796dc25eb685427
SHA256c33456296b75d7c4e87801f81205bdc3498405de266dd7dd4433f5d9f5913d74
SHA5124a67aabcc7ddb5dcd14a076ac8d6c6208bf881682de73652bc81070dcddd0d634d17c17ee9b3bbe59a84d5c5013ea784ecc91e33d907cdd3279b93d298caf7dd
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\nub.png
Filesize1003B
MD556f62e2cb16a8fd31385d7c383b9e3c6
SHA1ecdce79b4f9f3a177bdadb5b7223a3cce696e24d
SHA2565e91bd053b7f83499e064949b8c4ff2f49d5ef4d6a446a1911143b19142105cc
SHA512e8655a7ad4cedfe2930cc312ee50e7a3bb9d729212f1f6e18f064599594389e14449a97be5d774032f2b15d956cf2917a32fbc4e519e0b47727f48240ae75a8c
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons.png
Filesize1KB
MD5b4fb91cd86d284240cc0fcbf22480158
SHA1dd3d53a14312f08a912b61fd135564d7cc2bdd84
SHA2561ce17ed0478298f3fe72ce2f02495e08420403eead00c2de999e0fa4e80beaed
SHA512ac389228e820a051587573d6dd8441cc2a6f63e465c8a1ae0bc8221ca7b1620861b6f113f2ff10a3de9ec6f572cd240ab89210759c1f859f9fc15f5a9b425822
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons2x.png
Filesize2KB
MD59b6d9d21c6287ec7a8efd4a4bb863be5
SHA10c0e02cca8b4df635f048b7997cf7ddfcb287c47
SHA256e7a05746f140ec3da2dfbe53f983f8de093089961a19431403a93aeba618bc28
SHA51228e0d1fd26269100f040f460bcc0a056a1021ccbf2ab5b1816239c3140404e1243904e8afbe5e520fe2020af40ffca9e72c6fb251212d89a6244ab39fae6d7e3
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adc_logo.png
Filesize3KB
MD5f9b0181bd8ccc0cf5536163670c55913
SHA1542f14e68071eff88ddfc9a504a03494ce7ffea0
SHA256ed8339834a0e332d2acebd44069017a961a317bd4751f5c3d6e63cb2165e8051
SHA512eb2163a4379c363b617b9b3307d04e3cc9ae198b2dada8db7014541f82c75ccff26a2bbefb0dcec1799a0c16bce1001642a5a91f2fc6b31d4fc75f30664bf1d1
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adobe_spinner.gif
Filesize556B
MD556633bfbf611061058ef4a6f0d7ce8b4
SHA19892ccd118d38e3db3ec12571960e309c1fd8962
SHA256823e4ff6d47f1458f89279f98bbaca4f6b2daf8d43ae6fa359560bcb030ed6e1
SHA51259221a2bb4a5f9c7aa4b26057d33383020e6d1ec7f0a57b7918eabdf6004d060dd14ec97a5ea1a7fecf15ea9970b73490af22cdeef2c34035b577d97b7fb1ca3
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\logo_retina.png
Filesize6KB
MD5339406a8805d3201ef492d3d1ddeff90
SHA154fa18879eaeb40080902ecb13d06bff22c02313
SHA25691029186180c0becffb8487ab0fc0156fbc3fb451b7f845947595f4794205fcc
SHA5125e5a87d24ab3195465fa234a6ac29cd9ca28a60c9ecd65b5a016bc1891207abf10f3fa772ddc211747ec1a4de2d34702ee5bc2ea68b2666af43b8cd89aad12fb
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo.png
Filesize826B
MD5930bb880c04de5cf3b513466f48ef2a4
SHA18cfe0984ffcd8cc46246908bfa2568b9cfb8f5eb
SHA2567217a9537b03399140b3251513cc870a92e6ad5a486a54b4819cfbb69a8857d9
SHA51251896348fdd4bcf8336ce30ca922618e303e296b762efbf7501c752fe85f6bc3102165ad3526612f084b910a373d10d9145b25081ad644c7a975170e3f6f3e46
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo_2x.png
Filesize1KB
MD5fe5ce1bcbb8bd188664d3a27c28ba088
SHA143fe1d3e6a9ae5657ba068d311571b0687773ef9
SHA2566629e0720f36cdfb2b8aeb94bb3ede6fbb75a9fe24b4ef6f682965cfb589a208
SHA512e8422ddf27ae73f41092d252dcd13a566179e9b02cd3c57bafe63c8d60830f40b23aff89d5693670e4d0121632e023f3df352e634d9c01f371fd49cff5c65bb4
-
C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB_EURO.txt
Filesize32KB
MD536cb1452952f0715f3f012fb9660c763
SHA16823862aedc0881b7913a9d8610fdda2ed28d3bf
SHA256def1b3e66a59256026c89967e34cdfb869b642b58601e3fabafb8b220d6b29ea
SHA51205dfa480d16234ec0aab8cce7d44be4f2cdfcc884c0663401bec5240b6cf50f4e889ef3fc750395d619bf3d7247eeadacff6b8496e7e378d83e22fdbbdae5fa2
-
Filesize
153B
MD555aa628a07550ac99de252ab78306f61
SHA11fef9dc3f77821bf750bce42ffb1f6c892f74572
SHA256839eb695666f96062e1ded9d6f1c97056f6fb6dd78d8f265e437c48e9d0675ca
SHA5122e1e0fc7de510c92aefa23840cfe5e5e14fb98e597aa626cbb2f3034294d54d6cdde51dc0bf5a76dc3d40da70a5ac3f774f0db9e450c17d1b416607795643715
-
Filesize
190B
MD5c145018c6b47e995bd0329d13cc581a5
SHA17d30d0e6b989af49b06d1e02482ab38e8bf72ee5
SHA25627c69d2bda0a20559f4e4182b4468f3b406faea809c934832f844866568510d2
SHA51271deb1e7bd4e3a6f7066399c896d6bf76e3204dd83bd50c6ca9005bb27f150983d66e9021a12f616f2b9960dc5d6f0659791f2b189fe928532828931010b85ae
-
Filesize
190B
MD578df9646789b40c521e0c3b0d64a58e2
SHA124564d5aac92d3e840331ef612a7f7c8ac2eda13
SHA256b5b1633b23d3be604c534960b0fb55bc21bb94329628e2a230ec10a21f6c0e03
SHA51216a4e0373ec2512b5d1267d0b5a08640bef358ccaa686916f7efdbdb5a17fa3c8cc10cfbcd072f482c4b458cbd827f2631589901776aedee207c3e08fa96d48b
-
Filesize
1KB
MD5ccc131df801bf333f5f4631dbe8c3a3b
SHA1d67636f233ee97de1c623fe9fdc4d3f632b359fb
SHA256b01caf04c1a14f7cdad47c89be51759d2eaa555bac81c7007cf1c80a5b6a00de
SHA51251ebe09bd96918e0eab0414d42f2940d718a539d16b7e68d97689ac22bcce8247ccf1983ebe74152cc9ebccbb69a379f24205cd718022987960fe75ebb28352f
-
Filesize
31KB
MD5606a9b0efa7483827aa01bf177d8024f
SHA123409f7dc3ff12450ccddd323b24d34f59018ab5
SHA256d14d88923a7580ad2440d18c67b32da74e89a39ef2b122db5313d955c9d67184
SHA512d0a8380f0979e74d15c0186687c21702574f374f9d20c0b2abec6e446dcb0056462379d55528d450a2890c7eb6161c460956d9da561c5dd4950c6dbdc25b2a82
-
Filesize
34KB
MD51ff199367da573ed4c6fb38d411d4625
SHA1175576ec8932f994855c3df81f1874ceec6fa524
SHA256f2797bbb7dc2650fc16f937023ce495578aa70c5ab68592abe5adb9687498a95
SHA5122b41287eb2f0b7928ea3fdd92dde78016197184e61e3d8ec5a615510160a7ee49d4e4b4bbcc4888301fde17eceaca974c653a34897608e357dbe357c81c35b6a
-
Filesize
23KB
MD51d5dd1ee79629a666740b06eb392b122
SHA15b701557cbcda222fc0b469ab575494554296186
SHA25661e5bb49108bb3f31c81d5f413fbddab29ccc1f68850a258340458b779e42632
SHA512d1abb407ab94d831623a869df1cbb7ab4d486d712c4a1f8960c161e192eaf5a8a5390150391c60b90a10dad8a41a93580473d043677da49c8107e8a6bc4adf52
-
Filesize
2KB
MD51d3ea72f5c89f31ed6d545ec0fb8149a
SHA17737c42dcf375af7247f42bda6f41426d4b7a60c
SHA256a2ff5afd90a9dc932d186ba8d7f6b037c838915a5bb0769d1cfe2fea45618e47
SHA5129d4c6a4384a88fceec4a535ec90f8b8978d88408158b76920b63d15e81da10f13f341a8d96cd2bdeca3839ba788abc7eea5606bb52c134bf01ca4a176d3082d8
-
Filesize
1KB
MD50f3e38e7bb6e9873204d78d0cba2c294
SHA117a4a8ff31c323dc9afe0f13238761493ff59805
SHA2565bd8cf5e03f994185e859ec2cbb7f39690da5ae5ef2937edafb0db11b603055e
SHA5120b12ba91cd6954b03f31b4d899f4080ecaa70cf764df172de2491c81cac008f8131a3dce0dca00e13c61c8632f312bcb700b315a0d6ebaf98bfc7f0c901020cf
-
Filesize
3KB
MD5092a3c49101095e6c52115dd39a8bd43
SHA1fd8dfe31a379ab8137d5e64efff24fb49c6e3a84
SHA256ac93f3ce1dcbd52142e1d58fdc2712fcdb52ef5f6a1bf6c4ad9b8809b574d49e
SHA512ed65c3005983b1675be441df63ce0a794bf1e423857566ede5c7cf1309883e189f654be61162a7310985cb261db77a8c84b8e826d436cad664cbba6dab7c354b
-
Filesize
2KB
MD58cb56e534426d743785c75e9b7ded477
SHA1c7cc01ea8138b000b24edfc12d005df276542ed0
SHA256f83c90c6102a31d93f5dafb902c2cde7637076c423d7158bacf3c64ca562bc19
SHA5123bfb8abd1d0b5288a1965a0fb66e56235b8938022066e31e387502b5dbe0998785dfc1f87852eeb24ee8dc125b6ff54052698afad7e7342e7501bb2db002a249
-
Filesize
5KB
MD502fe66af1fd5081c8111aad6cfba8b9a
SHA1afcf728f7ec60aa1b073acb96dfd5ed9f043e139
SHA25611430b383ffb1965c337ef6c9f501c771292296f2747dc1c50c2d454c206a909
SHA512b51400465aaccec8d4ec8a54a9d9c00f7e6bd662a98a209f3f5f598e7d7fd20ad0004208d85d57533b6c4d49b2d53de0c687a5afcd2ef2e33c185a0f1eb5d537
-
Filesize
17KB
MD5505adea0fc0f9dc905c73392d3487407
SHA1c9f3663a3254906da05ffe74780abf426a14cc0f
SHA256fbc25d29cb3337f01d5aa95d823ebd938be15c742ddda6df3eb2ae137b4eb653
SHA512dd8a0c143885168508fcb5820da19347700d261dd68ecc7607754a1a722460ba8834242f0b0cf3d9966e0bd67c19cfcb6e07df0030036b6d8afe8809f0a7752d
-
Filesize
320KB
MD5e105d8c6fcca0d7607bbfdae2353e3e0
SHA10b0366bff376cd8a1f0fd66df40185af890eed7e
SHA25670912e5c9de8b95104a6996aa414ce6297f2812a67e061e59ac47d8174f0c356
SHA5127193654d46936f31e803aef590725439fdc85a5e82b9908fbf0d5aa77d9555677031c3237d537c5246519baff18434383792ba3065cfd2746867f1b57e4a35eb
-
Filesize
1KB
MD5afd643ede863e443551b9e51fb32c08e
SHA19b9bd692c60adbbf678e839b4228fa23f538e6d8
SHA25603a165b58f028756c91f5d6d6e5fbec0351e334f86340df20a110ffeeeb888a0
SHA512acde75dc1599c5f43216e216a0938bce57d3d071e46f469af6bffe034be4dc90a61b4f759545d7d32c296d869f072c77e9f761a829c7e9221eb11e5bc976b44e
-
Filesize
10KB
MD58692c7cd9a2a275a03e828fdfb3dfe7f
SHA1738fc3d66289c0c895ef7eecea4667fe83f8f2c2
SHA256aa17965450d2b3f7a14e7892c8605d9cfc4e1c9b9a731b6403412ace5f7705a5
SHA512b44e68b73ff221e032e9747d811c9f72664aac14ea80c8525a1cf5e33fffc4a298bb02e48f0d53ad4518581edcb60fbd1e34fe421d9178e8b62af8140d5f2e41
-
Filesize
3KB
MD52840444241b0332ad43e75bb6f2b7019
SHA121c370e2384c82a6e46d610160b4b9b07cdc6cfa
SHA256d97034af58899df0b5b3ede888cea3916bbcd8cc4a1fb9711864220408202b1f
SHA512fd453cd56585d8fa62f39f38fe2ac05e79433d03032b588f2798ba2275fce45080685da7583e17b0826ee3925891bf9e45bcb74e4d87416462061078d238642e
-
Filesize
162B
MD5bfe811ed0633ac71213aa886fa170358
SHA114c2c1975a89c1e49e474b1ddb89ab3348d34767
SHA2560860cb662b7eb7f44b2e175c4224409364ac6a368cc3eeae1253440db7c85296
SHA51245c93f3efd7c87fcd686d27aea9a7c7144c53d4f15e24e01ab3cb4aba0f598d609e757980e8fa6b03f440a6699e5b3a850af4b56854500a2c3e3d194cfd51cbc
-
Filesize
1KB
MD5435de340e5e08087324e7d971738e37d
SHA13f56dc7297a504efe3779a054c59174451d1e783
SHA256c3348f1ec3b4ad916737ff9033ee2b12bd3925281a499b22ea24469a03fe97a0
SHA5128baa9ac6ed9cf233db51afebbcbb78d006ec0624c45d8ab42975888f4b84f93a69ad7323e4a5fd2a6dcda5302834b2c2d2d061ad557aa33fac6387eef93418f3
-
Filesize
3KB
MD5eab1433ed69b23510cf7dae18e523fd8
SHA19c279eddafc07d194b2dd48243240a4c4d083f6a
SHA256edcea884d8f052048789dfe893045bb6a81b592bc9a5438f6eb54fcec0b2d59b
SHA512282ad7cdf1d90362edd67042134f6f1ef4e90e0ca7e2e1da26fc3c1856229831e58c6d3cc0cb32e64e6fe2767cc26a53123a23b2f88d422e5fb2c12f4063f6b1
-
Filesize
1KB
MD509b1cfd58c7d2d64e932a7ccad1f6d83
SHA18bbf995aadd8ee9fe961822b097875ac1dfbaa5a
SHA256a65f0f03041d43bd0f41125162668cbaf7c29c020917617c415326618c989f00
SHA5124232f2d60750d0ab6766a0d567bbd633816356e0076b5d8e52f07975685e90d54a510d33e74562d65d85c390d03ef3aad9dc84b56a83a7397429490927f1af4f
-
Filesize
28KB
MD5eeff7b6e1340b5613daecc32af93503d
SHA19558d97ea55d57a3985752acbc77e631a80bff29
SHA256028ef2ace8db6cc8339e17533b8a5519a168861ce49a6088e16f519cf1a7126d
SHA512faecab64911f2a26bb4ed4176b95ee5e7215a8a22326ced4119c78f93dd7e4e91d1d2cbe8ba0a3a84b4ac609022031640286809aeee4011e7e7b9ac4694ada22
-
Filesize
2KB
MD540e89ec454f1e5bdfe66a174035f5dc1
SHA1f56956d550a785d24a69ae8aac53b83773d283f5
SHA256196b82b5cbbc8df67da126ac9c2d729b6630cfe38e5a76033f1af5e2aa625f3f
SHA5120a9ccc6c89c6227f10be753ab42473e8d8225f7979c1cb01c8c74fdf860ac68090db2f9320d0f5dc2d645645daa5246802c6757351395ca80ffa7bec1f91ae85
-
Filesize
1KB
MD5bd406600677e518dacf0c17ed3c21354
SHA1e0b3dfcdc03480cebb31df0d283ddc4af0a076e8
SHA256d0e073e13c7e3d3ea03ee4d15aa7b2aa7e541ce96ee332b7cb7191095e10ebc1
SHA512891c8ba636885d8f714d1526a43fb20f27516ea92efd2510e52454b3d42cb4d562daa226fb8416147aec5a99f12be255f2f68a68506b255cc39f7b8453afdce3
-
Filesize
2KB
MD52e2f5f69f8bcf5bc6ec96c80fb49ed96
SHA19cbb60718d244142d77bc013c688d995f2649194
SHA2566713a43e31e29051aa3f76ad293c7baadca0c7b0b32d68f76a81b1e4d094f532
SHA5123e548606d03d922a6b17c54baf8f6f919ac29d78d5351e80a7f4ef1fe22469bbd126e7141028c6a70e96708a6ba8af40e52e25752e03601b0a36a2916c7cab66
-
Filesize
1KB
MD59da3aa4058cc1dc56ffc6af5f07cea0e
SHA1a70aed13d90f8f8b3938228765e9f627abacfded
SHA25695b67c666cd48f5a26ab9df197fdac44c8ec115608491187a2c22f365db6e383
SHA5121e28fa62cf0d2c105f848f1ace72acf3f60eecda9259cc80b8ecdbbd0a567979a5e6519512858f6e3b8ba08163623347ffdfdf9617aec80c76293ecd6dedf14c
-
Filesize
1KB
MD58919e5f4beb4e3f60d2c3b3d1fa95179
SHA158c51940ebd93d6a44ca87e9c4dbbe67f979fedf
SHA256f8ca68ff5d7b6b269fc11f6af160e0a1677ce27fc0662a3629f283c0cd0231cf
SHA512e8831184a49b10e9ca4eb115dc79901f21e99b0c32e5b606532056b82b8bfe8525849d7a6130cbd5308706e4b23c5a55aebd1fe0cfdb92b8e64b59003b96b4c2
-
Filesize
1KB
MD562c61a86e3796ba2af1162f7a6fface1
SHA17352ffcb0f598fa2e12cf6c40e6cf00897dd9e09
SHA256032b25690199953de2211996641e05ddfd11f5dd0020cfac3bc5d1b7a83b6234
SHA512905b0e630f00b415fdb0f3d541a34cb0525b272a94a2012b9abc989cde10e0e89ee6fd0e8cf00106dd74c1190f1bc3d18628ea60fce42fd7ad4463b362d6f7e2
-
Filesize
3KB
MD55e9ce88e91a1a10bee6bbfbe8e2cfd09
SHA1108e0c2d29ff69e3d56d412e224a4a9afacf07bc
SHA256790c3e13c11ff53e975144cfb7688aad3a4b0e055d9c0e804358da4263624388
SHA512f34b6f48965b46e374c06350a02e5c0399fc6d2724afb40a97c09b474c354c38cf8dfd56a309ee2ab5041edefd5c44f9ebd3aa8788f2a29372d5d623f6898680
-
Filesize
2KB
MD52a557d0c8cd66eecbf1ff1c2f18371d7
SHA1a34add0beae4259b2346bb05a9563d134770fed8
SHA256db94fdfb72b03d3f7561c1fc696177c7fca41b8712999a613cde61490c85cdc3
SHA5123ff00a444dae0dd97214b52f8fc64a84854366dfcd25ea5359387ce65f4c8c69c34c411cf783fd48e57854f88c37cc9bc5531341345cb2dc32d49c0600e1ab30
-
Filesize
6KB
MD525aa5e12a3d0a7cb56e3d4a768f5d7ac
SHA1ad64ef46452e3b086fa2b3404c93f14122089035
SHA256c30150a8c27dcc63e06e7678800d2f583246ca9293bf83ee6bb4d69845a529f7
SHA512f53c8d667a362c75116d5d9181260d346016f6091f8c2dcfe8affb8d37bbb2b2f583a9518ba3dd8e1a0ca527f04c0e60a81a538c21f2b3f44e0b36329d61af7e
-
Filesize
5KB
MD577595ca1f3d8fa44453936759ba9610c
SHA11a506afd095685613e6965dd29b183b837816cc1
SHA256e81e94aabe5f91822f20a303c14f77a751381aa8430d12a23f135bcbc2250516
SHA512444051ac4d8672f1b846cc0bcb4d718dac620b76239d5b8e2f6fa6c1dbb4cceb0d76b567b91d48e50ab7e368f1c565d06c1aff92fa4bbdb051115cd399e259d2
-
Filesize
3KB
MD5c5be1db86faf3bc48aa760671f9621c2
SHA129ea39a3cac4e2e8b2d5152d0ab0df47c0a95137
SHA2561c563e89afedbcb5b23fb63070c6037dad690ca92e3641be60570167593d671c
SHA5120a883f64d065f241d7a08d22d13faec918b3911e55801d550b3ebd859ecc56a104180cd3a2e3e4c621c54e3e6c16abb5f5c9ef79c8f384b49c43fc125ea49e00
-
Filesize
2KB
MD5d0bb369031fab801ab26ff0f11a8297f
SHA14135d6ac3bc8dc27105828e8bc830b417439a66a
SHA256c657c1fd07c1eb2a0633d9d4e0fd516740bfd74effd8b984152158ba0534ba95
SHA512f9e0c5ec407f6168a9bb981c6ec8073165abdc5b1d8c41cbd719187889d165cf0e8fd894861040913286eb38eb44fe51585aa508d1380aaee50b3b7bc5272e30
-
Filesize
2KB
MD54ee0902e8dfe0592c1743c81062ee045
SHA14090d2ed7ed7e0938a9d63a1c34def54d14e7096
SHA256c2260974e4935d3ce7e179687d57354aeca90218d93691be034a07f472a325f7
SHA5120d5c99ff635b66b5cf2208831c74c2472aab5283acd96bf439bb0b7426e73203a12cad192e05e1d51a6cd048a223956f92715eef878a83d683b65499f54c6793
-
Filesize
1KB
MD5b821e714ec5fda174bb7ac4bc3ea7c7e
SHA19148c3b3153e33b57a6927074c4016fd6925d5a2
SHA2567a485cbd2cab9158dca010a33e1870226f6f66288f3b560f2815237669b344e7
SHA5120fb43bacaa5e23b9841777cece5c6212615705e165c8820b356ddd80033aa90445eab6df1a8ee384bea2ffdada3d553c6b1faed3ab4b819b9f7f5beb2276fff6
-
Filesize
1KB
MD58323076034a6c39be754accdd29db225
SHA1b1c79b06398ebd3f3a368de9a868d798a749c4e2
SHA256f01cecba4a8650f1955c628d2046fb6ea7effdae3f36918efa74a8fe3afa0f1b
SHA51273e159772a8aa8115c9a517a195c25be021ed9816c51add53177a3190ebbe8f3f6d50a6056d9f952e3303bd98c124ca8ee9317d8a3d1478630f2c6ae03253616
-
Filesize
11KB
MD504f1945661dc0ee496e662edd1d29767
SHA195ffb948f39f82b1ef8783912ac68479f2794d47
SHA2569384c98aa0cc31e9bd147eb6741d5835e1bc091928a4de941fb90021fa10594c
SHA512ce37c4b00153c7180dd44d51b93033f1c58688cb8e041391ce647615a0c85d7fae91fb8d73d8a6a03fcd25a247c1650e168c932c577cf2aa3980d61b2faf7cf5
-
Filesize
1KB
MD58ad8677eb2d463a35404b78b09ef29dc
SHA168b1866091160a115816a0c8f8dcf00a42873b39
SHA2567b41fec8f5e6fde11fd6cc4273e999c1ce05678d17c063539c5d20630e1a9294
SHA512abfaa8e052446e584eba684bee7194aecffe60167c6b1a57129ade452a661f410f8e949508576341150326c747720e653205431af6d449f29852114f4808ff3f
-
Filesize
2KB
MD50a87b5ccedcc9443cfff5d9c6ac52282
SHA1b2cf1689933b2ef7203bea5c9db6ac4f32ec2a35
SHA256bf5236fd6867592aeb60f283ddfd830370e158834e8ab20a79fd4b26fa2ed268
SHA5128f5a01308907a1426cc3781cd28cc367881aea5886e8b40edb1e3e24902ae938d14f0410166b87e8af8f319a33a4c5bc8750ff73b6540945b0e850eb53e5fd43
-
Filesize
11KB
MD5c75d94410ca0a147bf5ae73d6b903d9a
SHA19e1f350e3b428d56a208c526adfe4e35b413a0c4
SHA2565e6a350266eb893a91482bbfc7a261dc36cf50db0b0d06c2d43f11169038a07c
SHA5123cf023f09776aa2f2a193752210292a171ed081cfa4639cbc70ad06c3e2b21a8b5d2d1daf1d6794d27c13e5ba4d0a6837e0da8e2c2d8a1d2256320dad0386c60
-
Filesize
11KB
MD53e86e7411fec3fb4a8f368aed909465d
SHA129c59443bd71eddff6d6f7a6bdcceea18cd458fa
SHA256c91c3db5afbd2a06b3eb237f1f5d1c4b3f6a4330046b60c3409a12141ac4f596
SHA512f543e250c3b9fd154e729d74946836b6f77aecd4f659d51514e6553f18fc39cdba2bb7d05e47e820eb3b9d99ca8e07b117c88cd8fabdc1b2ed8b414586b9d566
-
Filesize
11KB
MD5a98c73e4c9e878596bdeb25faa120223
SHA133929f10a9acc5a3dbae7a91fd5920de8d3c2f1b
SHA256ffa4f1627a1c414dd58aa08587f370041e770ba41eb4216dcac8449b570e5361
SHA5125c9fd68abcfe6b9704431db624c9bd4d52f35de609bde56b91e07524e5dea76572fdf5d38bb6fa50d0a63ec6df922c9e0e142c3e5fdf97aece05fe9c8c58ad58
-
Filesize
1011B
MD5b547dff1ef5a7c8a4c2b658fc4cccd2d
SHA15b9769712afa778ff98c6ec62a62dc44221c9a91
SHA2565b9958fcbdc147012b5d49325b2c5730d8b5055781ec17803e464214ec312d99
SHA512eafefed7fc72ab6d3979e724744901a3bf580135373215ef1be6a72e5bfa5d049993ac3b671f12512d0a657ae6d59410a685fcf9d03248998e4053454c7b754c
-
Filesize
42B
MD5fa50f1f6862281fe8c6875f9bbe00930
SHA140bba308bd4765d6ada23577225f08184f0e3a88
SHA256c4e9d86b08143c78a1f085df7182cc200e7eecbdd5dc8a77e67d698897211522
SHA51248597ce1f02cda0f0231f132de6f5ed02358e36e9c3af058f347dacd76c0a1d94ee2c5ed606ec4eb6dc358145d53e876b8694fc68029331b2f64ad5d3bc53396
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727662721799026.txt
Filesize77KB
MD5f1fdd6a77ed4ab8a74a605eedce52cb4
SHA13577a258242bfd0a14710d0e0316ff6f6783eb94
SHA256bf13fc29540bccd6090054b72cb1f742d960bb094412c4c4099377898bcf976c
SHA51278e75408236a7c4cdd5d15356662c5a24f7e264b7c14365b038b23532d040e322542e88eba16ba4d41a5582c8ce16c04a53fb338ccbaf3dbbf7c54b40316afa8
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727663191189319.txt
Filesize47KB
MD55409c0b19afd71776d79e8613fcb825e
SHA1bc62b395cc734a91c0ade84c96e97529297458af
SHA2569b5d926c7b045346b65262e791185a8af53db2a30b23ed520d65179b2e6d4ed6
SHA512c155ac5f2c1e65855ee63ade2991fe2f698b03e99a4ed107865f515fd37fc9fa73a54c42e021fa66645fcde28eb4ecbf9e3586f5a778d9c9a10fe057186cdbf2
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727670188807600.txt
Filesize63KB
MD5c6a74d78dad17c0551db6ed64eef2cf1
SHA1374a69f8e52a0aa51d0ccdb04519eca42c87ecc0
SHA256bc196d4676d20b775a9b45f4c87b7a2709423934972543f2bf54c904c9411850
SHA5125b83864116513b7212e9d7a9a327efcae63805eb475921a16954060a66dda9dfdd25e59850c9b1a808070236434965b35eb291e5ca72b334f7b0ca0099abfc17
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727672984949051.txt
Filesize74KB
MD5911f70282ac1e69b5c9522bba2643fd1
SHA15edec6b585fc5e8d9d0e6a3701fdaf70090188bc
SHA256facdb761cbf5a1c46b9fb37168ff523424b410c4ae051809bb2f5d5145bcdfe0
SHA512b6ca5c2fcb7e888cd6168827fdb36bfa6286b03fb0976cc283ab46d118082256db96e75c9126f571956b0eb18b171aca0f5d79bc316c245ce4047c6a7760d728
-
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\File Explorer.lnk
Filesize407B
MD5931b5a3f8cf61515219431347c07ad77
SHA1b649cebf796669ee9d39652b3c4c7b0f1b3e304e
SHA256123f3335e52d9aba2fea1f981b993352fab05e1beedd5ee8e2f8a8d648294daf
SHA512250dae98790e1392207afbe6f7e4b462c0ff1c9048289e5637cc24fe58949bdd9b6393c34b10c52800c14dcfa67b93afab22c09f550421303705cd692f30a379
-
Filesize
21KB
MD5a020bb28bd35fb03f367946b4faef444
SHA1d28c059f65960f8a812f08906bb1b75662317004
SHA2566e657a8dcb8338a48860a04a7bac4f5fda6f4cb67fc7765032bbf394d40c95ff
SHA5128f1865a86250c2de1dd6959e61d23fc5904167d97648aca558d755ed93f13124b5a05c2679382106bf986452e3c78704540b511a37985b6cc0d5973c022be5f2
-
Filesize
1KB
MD51460db39e48809697d3ba5e675e44aaa
SHA13a6a7954c5bee8ec192cac49da32daa20b68ee40
SHA256b5bf8bd3be1ec2ec951a05dcd0a3b830365aa6adaee9a1bef4c4636b996b7ea0
SHA5128dfe019557ceceae9a35175ffb38152857c532c15617ba1203f379356d2e8e43918f64cfdd575c7abbab242851b755a28d22deab04631393dbbbfeb90f9b7b8b
-
Filesize
952B
MD57c9bf5da1c349c270c334f553e9f59dc
SHA1470555da3fc3b416035a9ea6e76309cffe700603
SHA2565e8b1ace18acc03e54ce8d7950c1063ea0cd962d8a879cd69b16a0b49880d800
SHA5124590553d7cb465f7a6b0151ba8c073aaf99b63d3e311a5be5987c682bddd58a6f253149c0f5943dd78a282bafae429b3b3247052c3fa7ff0f0d0158df4aeb187
-
Filesize
121B
MD536a3f40b0a1dd2196f4acf3deab70a24
SHA1afcf55ce3ebe2ef39efa816bce8bb2b7b4ac7ff2
SHA25654f57a6d0b84f50b0985689a39aa5957d05b95024fbd052ded5985d4d3de8ca7
SHA512e78e7108673257c829bb92896cdde4c5ce1dd34543c725cae3009c794078023e0f8eda84ae6d6265af5304b012b5b820febeefd4dd81800ecf8862f11820f644
-
Filesize
1KB
MD586e6c0fe465279f0aed32810180900f0
SHA1701b620cfe8fe50b41901b2bac427c4fa2780816
SHA2567f6edeee0bf26373516d03c513dc5d474cb0609f70d375a431b9bc43659f1993
SHA5120d43ca0f4eaed9a122f31147f48be2ff5012751725f699e5a05d45e8389ed8bd387a9b6b1c38e263b93fa7d33da56c9d2b1620a998fb6e563fb4779d5cc8bcdd
-
Filesize
8KB
MD560a572ad1bde9f702c5e3c9335ab09e3
SHA15f7e8383a934762316d1d41888b3a7394c4dd085
SHA256448e5d4a8adbf750840b3ac9858369583f0b4f3cdf0ba41a8fbdcd16ff3d97a9
SHA512d8630e023068e0f277187f70fd1446cfd9244a5e49e3268b9037966411cb451b49e3cf9dafbe363456af1f9a604cc311ab2298736558315a589e8ada2c65f6f3
-
Filesize
61B
MD5e7c9c85f5f4d62c65c31acf49842320d
SHA14307d892d4255939a79ec70865e8d4230ea6e9d4
SHA2568e12cd0290d025231f50646753ffbcb2a436691ca3ded8550cce1ee781e46cc2
SHA5122086dee0ce633ac79bf4e8cf8fafb750f1f119f4f24635bd30475b3bb581ff5f84c28991d9da97edc1299c7cd186732f5a09ca757c148596115da0f9062dc85a
-
Filesize
914B
MD5773d07547f47e381629d2c3a41b6947d
SHA10f36939f18bb6c3b85dac66027e84ea9e6828a38
SHA25638ed93714e8b54c12ad02210bf47a15a88d70c71c987d81a1c60d79aae4b65ae
SHA512042552c3ac84c8c9bdd273a8f90d5f6d46f7e65df192f916fb049920f5bc0abbfe9309645ee2aa838e79283ce2fae6060282bd3ec88c880ca0263ac0af688087
-
Filesize
90B
MD57a8a32d97111cfa2b1d4c72cca943636
SHA1bf825267627fe94aac445673277ad6d40f31fafc
SHA256055348c654b7ad120831d2c53c0d260e28469f099b70c1e47d0465101cfe2833
SHA512da5393c8e10808fa8f05140958493c063d20ab4058d38da83b841809b9673bf13bf03fb2aa06d131f89905a671300c6b82ba5641e4b99a45de70534947845f42
-
Filesize
90B
MD5c18e42fd079450d9acef51832f19c807
SHA160f113a0600c0cfbf896db2ed982562337126e23
SHA2562e3ab0f306cf390afbd4c29b7b173d24177b657efe9d1e10f129893b6eec22e8
SHA512cb9a0bf0ca20c656f00b34a23a01afee12fc8078586d20f6a0dc78c39182155f821a917a14ef9756882c79ec27c86801612aa04a7ea0d7bfd7afd9d26daa14b4
-
Filesize
328B
MD5efb0ea957deac176d69a9b308b74b4e6
SHA13d777c666f8a5b0d9935cc4eea7e55400325e035
SHA2562e93095604d6b1231d0a5246af2e9703ab604e85b6ff22a8ab16fb85a72fc8f0
SHA5125a1f26641e911a17d3e4e350399e5a026be73bf03ce6bcd38ca24f25652008a2acccffbde3d5e5e0291a56482e20fb2c95dd62ba3ef7b5d36b1b433433aebe69
-
Filesize
1KB
MD5180076facef7816ce6473b3060f825a7
SHA1ea1d8fb79e96c42a6251b1435fc746546bc50a13
SHA25656336b8c7c5624c4ff6807ef754431749a8e49dc506247516c92294b8b6009d4
SHA5124805edbebc66d89bc521560ce2c2dbf88023b608a5274bf7b05a87b20e0c3d76e150cbbd3bedfaf166089f64b42a27a65e85c628b05d2081e1de7f015ec6b099
-
Filesize
162B
MD5cc36c0eb353da99d7bd74e50d6936c28
SHA1ff3ca9160b56915fb42cb1a38a368126715e9e72
SHA256217347c58c413ce4be41efa7be1e68bcc94ad12b608ee44b3dafc25a6ecd455e
SHA5126964926a8512d3d0d4cd633eeb6f784d5a7ed544699ff331b6e7f80eae3b8e26875fc72a89c71b7fb1428169f913e20488ee2c74a50c09cd0157c41f731cc031
-
Filesize
586B
MD5a004b0668d0ebface583523e6d7ad241
SHA1f3e1fbf9e6dca294aefac7d9e34b53966f2681cb
SHA256662e096be08b8e82e8aa39e6deb7b95e1d52d213ca5879178da2226a74c5b284
SHA5123569a24f2b3a55bc1f68ef80172a007c9f6ec4d2d51c9bdaa6b9e1e015b7145c56a643611c8b4939ba4f50d6d1a6dfc72d704e70c4576be489244f5a05abaaed
-
Filesize
124B
MD5803d54daa282f21be1152996aee9a2cd
SHA1ca4fe19b5632d669f3fca3eca7335c94f66c2bf4
SHA25617b0a4a0f1657872cbe1a3118c2d62f52849631b45dae43be4b9f692f58db8d7
SHA5126aa406e34766a8e9ee635179906b55a3583b6ab81a44f777f64aeb5b3566189f443cab6d8ad62ae16cae96b52be62354f43bbba421b62314f636bfacd436d1b4
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\selectedTab_leftCorner.gif
Filesize65B
MD52dfa1c99a049073a4c9505bd935effa2
SHA1b0741e17de03f1764d7f2f32aad41d19484f834d
SHA2568a84304686f35c24ec6b46b4a8ca16ce003dc2f38a13f75c0660571ec0ce1cec
SHA512d7491bc882643a5fe7dd6359599a2505ee53240c600dcb8f24cfe9dba14f87f6dea3842c9cebf7e07b2675bb6e12b7d24d5e56aca84c372341f79b729189ec5e
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\selectedTab_rightCorner.gif
Filesize65B
MD5a26905f1803d640b46f11df11bdce796
SHA18738620276cde66a037c41d0d87b7052c30e87ea
SHA2566068f4efa77101ee6104cd6ab52b457989502d304fd39e01a20d0dfacacb24bb
SHA512c38d3a3f0f104b061aa9935fcf4540a47301574a8a54d71b5479108943d1f9124e44a6096b5c4964aea46b165418dd4369f8d930d4ed8a19261da965543a0419
-
Filesize
8KB
MD5d4795c5698ad24feda0e59f83d580b23
SHA1221a6ceb847d7f70b14065eebf1e510f62bda8c2
SHA2566bb30eb5f649f46f86dc29c1b4b55243ff4fecf5920dc804bc0f77759136da2f
SHA512cc7a6619e2c0d603467f32bc94845fe5276d60b700698098e3e65cbc42a7dc13054cb9b3e144dec35519ce1031f7b7eecb341b73ea1f3b4afe349eca120abfad
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\unSelectedTab_leftCorner.gif
Filesize65B
MD567fb765610c8abf76888e7495ab06336
SHA1a5a84df7407f11cd843f1c4dbf6454d9be957c95
SHA2568422b56e579f6e042c2797ecde2f90a309b1b9bdb7d6a28d68c17b9a12c03cb3
SHA512c73db2c48f17a5634cbfee81e879138675dcfb7ab23fe6e8ed7535126dea2decc7a8707938419c8e0a970525046ae92a633534359a1c8a578e19fb2469c14c46
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\unSelectedTab_rightCorner.gif
Filesize65B
MD509541b880b28fcdbe91fa78b2e26e0db
SHA1c0ae4c3b10b65556b8760faa68f8e149cb63933a
SHA256a859f10c6975880b2dd4830513bc1084b4eca069a9a8ff489453b703973d5d7e
SHA5127903a75c2604c00cd2de9df38d74039272076c6939fc241326b52d4904555820d58eca5d22a253488e01e395f1a36c38edc739c41429bcc8f04f85951983c12a
-
Filesize
880B
MD5cbf19257d583410b336eeb203273acda
SHA10118e2952b901132bc9b9c1211f628c9a0ff6adb
SHA25613ee275b05640d6db78114d6634028b7b4b2bb573f45c304d8e96d537c87b17b
SHA51201a3c5b838aeef1f38546487202e2b6cd2a03c845ecbfb8e3bc29f3c983a5f3f33396338e1d809ff96315ed87c452bcb68045e32d69ba27a504715ea59831d93
-
Filesize
49B
MD51bc0708738f800231c2f2fb48b3b9509
SHA10b59fff429f22e8cf7f885b327e48041281b20d7
SHA25678b881ba9e3b61685fe049e795f829792e9debb549c3ece91a2d1296f9fd71e9
SHA512a727108ce70a2cb117ffad9815a14a5ab0aaba637ab7cc1969c8d20abc721710fe1948ebf2c6d594a706436fbf58e933702b40a1f26c2c34fb3a94b9b24efdea
-
Filesize
1KB
MD58fe32e98f8d2132c8c36503236ccc2b8
SHA17be72643a99da2d872a8b52f87255b51a7ba600f
SHA256972bbffd1c99bd95046c5f2e0ef7acfad80576d410aa09aaf124b63a43092e0f
SHA5120000f4e4c9b8d808aa922715e4d600841b3b66c389c5a488265015f3c03554ed44d414005045fcef8d9b880529ae93b9545158797d0179dbfc0a7219e443ac01
-
Filesize
1KB
MD5730293fa614bd4ff96df3fdf39206506
SHA182d4a127f6ad9f5fbe06e1d3e4bdb5d3046861e8
SHA256656c262863f200527ebe6bac5046de40d3480ffc7950c42f9a19a9f0c88d7710
SHA512e9aaaf75df9225140243608ce6a69c79ceefbaa707861b990362540d8f475660a154ef9e37377ebc686211e06a57f0300d16a60859474591c23cbf7badfffec2
-
Filesize
1KB
MD5af8888565653e17b69eec6e395c89be0
SHA18165395e5af5b9b52841eda5d57782dcb6c16ba2
SHA256d45ec3d74f2362673ecc4cb716d6ad21f3c22f7f9d57b4a4fe2590a5b0945bda
SHA5128e20f3f064ab74928dc93f29895777bbc906be8a087638090cd1386d12f3bd75102ab1fd598c64a584912497ed3a9992291c2eebc5d92684f1c7dc7ce0e4464d
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\3 - Windows Explorer.lnk
Filesize1KB
MD54baa8beba8773d59c6cbb06ec59bbc21
SHA1cfb7a0b1082e136734815fe157226321603d331e
SHA25672b0284327275beb55cd47a13891038892f9d7be2e3103869957c6a8b2afdc28
SHA51228d609de4603a43aaca35ba5ff6e72516386c96b0d21c9fb7591b6c966176dc1025236233e76e34f890c80be93369bbf5042fdcc14f7c4d5db6f0e9552f64061
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\4 - Control Panel.lnk
Filesize1KB
MD55831d4dac6462c97e1052c6b41cbb7e0
SHA1d980a979578b296b4751314b69c5d46566f839aa
SHA256c504aba448c8c7e46d629d87136b8cefdb1b2b7badd5498eb50795bbc1d717d1
SHA512254137c1259eeb957a9be5d01b90aeea436a968faf86fad4c96a671ba8513d1f76a0920280fd443d8a8ec9a9750ab123e469f9d874d3877f9d3002a134ae284a
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\5 - Task Manager.lnk
Filesize1021B
MD5e9bb63ef18aa61437f9d4370f584d84e
SHA1922c764dc13100b0653baa005dc77715d1ffc1d4
SHA25669564e8415e742b9caacc5dcf1e154c3bdfba3b9af540aef43e48dca13a55ca4
SHA51226898c5467a7049638ae00f8dbd8a2e3631cfe62c36366e6744af452b907f33a9a9a51a052fd199628b40ea7af0759e0239638168c05dcef02753a90cfe8b180
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\01 - Command Prompt.lnk
Filesize1015B
MD5ea99ada2b8430a74cc74ee5d4d00e5b4
SHA159f61995b7c242e43853e6b9b525e34a0f19ef91
SHA2562572a3807264bcd6c60fc7823e3db9f4731c37a0beeab8108ef78d7b203df67c
SHA512aac63267f81f3a97d9f696c24394d3e0179d91fcff797c837183f9bb48b1540857eb1b350c3f8a3681a5ff94ff2f314c413093bc5f429ceb5caa6ccf625e571f
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\01a - Windows PowerShell.lnk
Filesize1KB
MD518a6880d38349e4cf239f6092f7a01ab
SHA100a1f554923c30f4bafe01d86786bce78f10509b
SHA256b3f5874f162acc49c73f2065ff536f208eeb5388702b85d2ae7fa37f602a85ef
SHA512669fefad80b3ce8bad7c4c4bb721cb0d51e2a7ce32f6320042bef3a07566e968ecca13f1e18f29f902a32c244c20e4503d4f760f00982ae3d3003645da66216c
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\02 - Command Prompt.lnk
Filesize1KB
MD50627e4dea439a0e845a98e4134dfa35d
SHA1472e7f13b83c23e6d503aaf3f4a6ad389a93a58a
SHA256ad3694a81e05f8a51aa774430b816c6acdf0ad06b6855dc68a688d818eb2317d
SHA512d700e666cfe682c5ed281885c4aa7f3501933d7c34c167ee3af8f660c898e5a165ca17cb3a5b38e1bdad6a9c928a9b742e86ce2fe48ae1d9c8ac6d6d7ca0d87f
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\02a - Windows PowerShell.lnk
Filesize1KB
MD551cae131d462b7d4d9540db45a02c24d
SHA1b7ccdaca8d1357a222f818510249952c83e40293
SHA256cbb957e5717208b1e8929f0eb240ba518630bd37f516eb910b954a30a6ac5317
SHA512ca5ec067dcd25d65909f7efa73af3c6f184e965d8b896c1d2778b82bc06f7fe4dae1931e040f439d159166c5895a43b87e29a71fbd7eef89b34a6eede252bb56
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\03 - Computer Management.lnk
Filesize1015B
MD5c692b92d86f139d1493a996470309961
SHA1e63c0599b05dc0563a761b1c0d1e4a17042894ac
SHA2568f6fcbad2e220b96ad387bb04fbd2b2bcb2a81b504febfb308b1a052a8b5444a
SHA5123b2d47ab7ca92ed61ed59968e024a3bdaaa934974e4b869be063e7dcd5e0ade1222969020908ea99e512c5d81a5a497b9b6f418a141832de8dc63c063d257cc1
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\04 - Disk Management.lnk
Filesize1015B
MD518d11185371933dadd6e8fcd7a154968
SHA10da206fe00b352975fa3b6e6ec7211e2afdd8975
SHA2562626011e601a295d3b2b0e2f8efbc24b65e2c09c59cb52491c3c526a5763bc7b
SHA512ca4c57a7f7157d3060dd825d725502e709894df7f05e3eb742e58200e6e689840876ea30a5bb35719ce3f8fef6b5e60adc3b2ce5478fc49cb8f6e010f470e3eb
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\04-1 - NetworkStatus.lnk
Filesize1KB
MD58062c02b7c75966213203ce394588c3e
SHA1983837041751f32f08de1c0c27f4c05757befb60
SHA2566ad79ccc1b40dbbd12b9ac5084702fb909f7847b96c967e3d8e798bc1aac1f00
SHA5122074649531ee1d24f84d8132e9383c53100e1350716accdc84343a37a16018414e2aa7bb580b353aa8dacec91b1c2cf367568328f176930ebda515d5c47ddd06
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\05 - Device Manager.lnk
Filesize1KB
MD52f0fd3743f89059397d37c4880ff614a
SHA15d3cf51e8a9a1d1c8850edf3471d0814a15e4924
SHA256ae847d2b764e281e256a7ca988b4352009aefd671488a5787d506e7141eb92a8
SHA512a3f5bca61d14b742023946205a2575bb6aa7b444280dc71ea39d82ac906f504a3e28847d510fda815685907db8d03f2e2cb8cde28f00e3117cad701008befbc9
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\06 - SystemAbout.lnk
Filesize1KB
MD5d05a20aa0cc2db47eb2ba1b5c6034fbe
SHA119d7ecb96fb8cf57d75c9e58f48a32af41965743
SHA256c22bb48d4cce235fac4a2cb26c91ef72a00cc50c5b95a92d3e477f0b9fcee1ca
SHA5125b11ac475b917a029047a4c8e2552823940c392315c2cb86d25c95c18481527af24a55cb8afe3a3439133fb87187e13a7fb375dca7089e31a0bd6c4df7a04e57
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\07 - Event Viewer.lnk
Filesize1015B
MD554a386c3e677cec704070436ead1f0d8
SHA18f7f9554c0cedd87934fa5dd87d648b2f6293f25
SHA256ed2ca8412d96c456903754338cb385bdb6c7d83c3bc5ae323d95e6b6e4091742
SHA512e2780b0f733c88b86968e29fe251dc8739356f5d66acc45203f989159574145cde7054485fccdde8fdc43b84de86b6403a4266bf45535f969336e4a9a1b3ba3a
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\08 - PowerAndSleep.lnk
Filesize1KB
MD576b5d780788230cf587bae30cdf3ac7a
SHA18ad14494243f10962a6c125a25184cd144c17e95
SHA25621a8c8e5235d54458100e84d0a6e1a7222414fa520ff5faebf2cf148a6999035
SHA5124d26b3ae0cfd426f23d5330fa1fb51678c86cfeec11cd370adb65ad326f9791782488d601486dbef79a98f10d27f187dc7ba54791a384fa01416f26f4cd99e68
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\09 - Mobility Center.lnk
Filesize1015B
MD58d28500a1e2948120e3238ad1b7b49d7
SHA1ccdbd2c86c32d301fbcbc9ba599138cc9f872dc4
SHA256a0ca13503edd32db4a313e552bf4c2c7173afaf5fbc9a28771b9cf9820513475
SHA51239268ef212faf6fc160022044ee7a39337d87dbec2cc00b9a8d993e6df640fb1337cd03fb61aa0c58a5453256a55a19e192a8cb13881b496bf46069736f77a40
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\10 - AppsAndFeatures.lnk
Filesize1KB
MD57ca41d30cb174a1e2ad97032d381479c
SHA195a5c1174690032955384741ab37cf8513cc675f
SHA256d4b39d3deaf50e68cac834dab8d8bec4fa5e26ee963db8b892e1c5b0c51fc0c4
SHA51227fa32501a0bd0af37a77e3c1e9c0a8c6c19c457fb2c617848db728d9659a1d52e7e57e138e24cbb11f73e80446901662b682370f62e881147cb0ab9a7c9bafc
-
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk
Filesize352B
MD58670dbe48a40f4fe86d6de8a2f8a607f
SHA102c0392087810b488a35b7ffa7a8f24d2baf16a7
SHA2565bbc099f120a8a8b7c3094791733ff3fc2bd3c6e1d22f7c037cedb7fe1734273
SHA51295da0fceb44a3cde052c31792290536b73338a7af6b52661fed7d5f3198c3431253dea1aa1ec479f7a319d5625a98e4a945275076fcdfbcafe71cac3583467e0
-
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk
Filesize334B
MD583be4eb1c8a55a7803da9537bec33bfd
SHA1f41bcdc2aefef239a811b6f428ca87cb357c6e77
SHA25619c6eeebae31d7879cc81c0d6476703290873a506ab55be0691957add80a8a25
SHA512b37230a6c080f580c0ba269840bb3d161f82a61bc50650c5f48530264f0c3f118947e212498c1c9749f9e913dda1217932537132d459ae5db169ed0f1f2814a6
-
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Magnify.lnk
Filesize1KB
MD5295ed63b2badf18df085c503d0832d11
SHA10561540f0d2aa3d60e157c761808a7ba1ce723a4
SHA256c33fb5b624e68905bbee3d69d75b6799b22a2840761936a0946a83dfa7253f68
SHA512f605f0d524a5ef3082de626b7d3e6e68abfd1ba23c57e41bbc46291d2f3577c220fa3fc5f2bb625d2afef85ab978069ccca3db3fda6cb64affce1b89276c4df7
-
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Narrator.lnk
Filesize1KB
MD5ae227696476800ea187990a61a670da7
SHA13448a701212bda7bc3879985ff830d158c09a845
SHA256b5867226b4c21a7c0ae0339c231e33206f2d32e5fe4fbc215533c49feba37986
SHA51277a48cb69d3b83a082f60d87a7b6280a6b325a6baa8a94bba13638722474864bc211bd93e4dbf0d80941c4ee03c28adbc8e8db046a4ebfbd4ee45d6522edd29f
-
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\On-Screen Keyboard.lnk
Filesize1KB
MD5180c702c5f7adb5f52f9d662114d587a
SHA1638380c1c728a5c6132c2ba997f207542f575dcf
SHA256e694b845cf49d21dc126f6eef3107913f34364f2412cbb10b169e82796080669
SHA512d8287879ae89a9bfcbf3c0d7247542738d7a2dee4251c2a5190300b4e0775d34d9628ceac1d17a62fbe4c1e935f439ca4c9800c0d99a7b7d4f609b79235bf262
-
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Administrative Tools.lnk
Filesize1KB
MD510f60721021cc3871034542ea0ea9bed
SHA1459195aa25ddb94cd7658b497a975b00238fcc58
SHA25674dd1eaf9b603517100d3a938f532594fccbc221f4ec0a48f69b0c4dc108ffb4
SHA512987ea10cf3a43bf9b401b21ae64765f277048894efc91bea3e45e7566cdf4cadf3f45a02ca4674a89e278e279eb633239e85e7df4d31d79b5bc583abc3864f7d
-
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Command Prompt.lnk
Filesize1KB
MD512578fe16ca13a510855feed234c3445
SHA11707ee67f299ca27493135fee6108e5885a1a4d9
SHA256ca1e1751f4f2aa3bd4a67b0c495b1c5b52e999108856e1d5ddffb746613cdf6c
SHA512788412d3881be585e7d9c3d0347f18c029da21fdbab08a1d1a4b65e7d2b40c54d4e3c25cd2d39127cd5a082be0088df2ce8d2abd642caa253fe66b5583697db3
-
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Control Panel.lnk
Filesize405B
MD55fb7632587949a9710bb4d501ccc34d5
SHA1a39fe3a4c549c85a0fc9f5625d9dd7ecb996a676
SHA2567d55477fe1b2d6f6342b33150b561b9c130d882a1a6f1b2db437b96df41e0ffb
SHA512341d422dd3017fdd1cdd0fe3f83831d974794e522cd6609202d9ea8a7f9a789673ad8143561a858b623b2440b35dc3d8d045a8c552e670729121621d3a12b67b
-
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Run.lnk
Filesize409B
MD505a73553a577c977768f72af54b8a3f6
SHA1ab4bba44edf77132f5a22ef0014f49b4d74954cc
SHA256eff4516d9e432fca14878e7ec6c649c98f5531d559d67779457b6b793a3301dd
SHA512d2f22a296507bc4499159698cae599058491b7dea1294963b689209d1356b50fcfbd1eb05c68983751ee00ce43d948d4b6cccbcd3d117100eb6c1e5acd8d934a
-
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\computer.lnk
Filesize335B
MD511411fbc729d2406d0abdce47af9c254
SHA1725ddc512bfd4232cfe58f1fd1d69f35f09ced8f
SHA2562975ae8b292501e07359005693d6f9195d674ccf41bc4719126c2073bf735d76
SHA5120ab068f36f85ba608a5078b0721ce3e0758a5f94dfdc0cd20bb8b8b8371ac9e153b273392034168aa1bfe7a49c923bae4315ef1b88778f820e3c45339ee656dd
-
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell (x86).lnk
Filesize2KB
MD571916c2c4bf76151fe42feaf701b533a
SHA15890ea199c7ec2a1c7fb4bf0717d4506b837e39c
SHA256d560e465270773c40ccbb1bab89730642732d79cb5502f1183d8469c9b6751f0
SHA512d3e81ee764539b4a9ddfab910b7f7793f6027c66a88f1f104e09f8038aaca076347dad301d83a4e2a79dfc1bbd680bde2fa85421855941b7dd2e108d1ecb9583
-
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk
Filesize2KB
MD50bcd387e90f0fdcda71be68a059607c1
SHA121da8d5341096b8e312769e89b689c4c66440302
SHA256704e62a770fbdfd12e9736e79b3a18a700c54f3acd3de705b643100330d2d400
SHA512ddb0c06a261cb88fc289e7ba8ddf7c445898f3275cc689a0e734932f816814436970c0778bf1a9b9c4de837fcc239d9fcf12a76c63ab9072415bb3cd42ff8f58
-
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png
Filesize296B
MD565d810709f4f24a05b70f0024fc15d87
SHA19e86cc4232e9db520747ad4923ddbf58819ea002
SHA256bf2f548da973a8e80f6d75ba27fa01795a6913020cf257a682f465b823aec598
SHA512bcf073bfc07f7452a673c6ad1987ea85a3793220868f200f3f71548039607b2cacd5c805b085f816dff4a82d77fbf08ac00e618023c7c13956524f978c481e89
-
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_contrast-white.png
Filesize276B
MD584abf1443aa6033971d38f6c547b0d67
SHA1b96ba5a5fd44a651d36d46eea2cc1b843c628dff
SHA2565f0404aca15c6197c8b6101b84decc76aab28a9136b2cebc9142eff390fd6fd3
SHA512271a7424720b880c95b51739269867c40edad4db030c4ea13ddd46336e708ee6129843d9ae97c95d93aea60ed7e54f2b7db3142f9a481ee6ba2dab32dcbb0932
-
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png
Filesize296B
MD532a1d1a0040ff6232ee842cd9dc66e16
SHA1c9113857a12717b8accfe87dc76bb706b8e5a9d8
SHA25667a691f8e9104f06e04401bfef17620f67f8c801e8dfe06ea6e50412add5f47a
SHA5121656c1055b92765f0c4fbba1a96208609f7019f4fc87a753c6292bd93b512c0d8ec8419a85d7b666b87936072cf4115cbc1380f7fcb6312498d4ce2f5bef6346
-
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square44x44Logo.targetsize-44_contrast-white.png
Filesize276B
MD525013c7f376aa7f8d65cecefb1e29dca
SHA13833eb0c7692ded3e9edcfcf6452bbc9fd188835
SHA256783c63a12f682707463cd0eeec972f00ef616a210d03aba42f47c39d45bd56f1
SHA5127d2c2ecbb9e44dfd05fb268018567133847a473705d806cef01a43bef36c534ab914b92f02a31de01efb34c00b6ead77f39f000a28c98e54738296b71f9dd5b3
-
C:\Windows\WinSxS\wow64_microsoft-windows-onedrive-setup_31bf3856ad364e35_10.0.19041.1_none_e585f901f9ce93e6\OneDrive.lnk
Filesize1KB
MD5d8989a645382f483f78b459dfdd464c3
SHA1d0f9751c453b00760ba3c6ac4fbfe40e63b9e4bb
SHA256c6b8a058604e407eba5be2c63d167d783c899f057eceb6e89813ded29ac54769
SHA512d84d812fdb19d0202db97c34f1f407d6f95006e13d9e560a972a7d61851290fb0652a22eac62f9da026f666537ce98f0bd0f1fea9a615857b1762a163ac72534