Analysis
-
max time kernel
134s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
24-10-2024 06:24
Behavioral task
behavioral1
Sample
72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
-
Size
16KB
-
MD5
72ac44125353f22e5e1fcbc6432c8e58
-
SHA1
fbf12e5efb4f8ded0aba082d3855c245f13f6f21
-
SHA256
726fcc36cfdf852f0a226228d94c6257bd04f3ee6d99b95adc6fbc255fb0f315
-
SHA512
44cf444d8060afc8ae143fec477d9ca6a43c2abaa79b1f67c04d19e8232f2f140a97f0f1767dd0650d32a4a81284eb51c8d2ccc04e13c7570ffc940d9f773e01
-
SSDEEP
192:azdrr1FG1WDCgmjPZJI84WgxFkuYpMa27OYYaOCIX5jj2J/e8NrXtUA:aprr1gkDCgS084xFupVg48zrXtB
Malware Config
Signatures
-
Detected Xorist Ransomware 7 IoCs
Processes:
resource yara_rule behavioral2/memory/3012-6042-0x0000000000400000-0x000000000040E000-memory.dmp family_xorist behavioral2/memory/3012-6047-0x0000000000400000-0x000000000040E000-memory.dmp family_xorist behavioral2/memory/3012-10607-0x0000000000400000-0x000000000040E000-memory.dmp family_xorist behavioral2/memory/3012-10906-0x0000000000400000-0x000000000040E000-memory.dmp family_xorist behavioral2/memory/3012-11221-0x0000000000400000-0x000000000040E000-memory.dmp family_xorist behavioral2/memory/3012-11226-0x0000000000400000-0x000000000040E000-memory.dmp family_xorist behavioral2/memory/3012-11227-0x0000000000400000-0x000000000040E000-memory.dmp family_xorist -
Xorist Ransomware
Xorist is a ransomware first seen in 2020.
-
Renames multiple (2184) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Drivers directory 9 IoCs
Processes:
72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exedescription ioc process File created C:\Windows\SysWOW64\drivers\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\drivers\gmreadme.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe -
Drops startup file 1 IoCs
Processes:
72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\GNcWPTsYMeQ17cZ.exe" 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe -
Drops file in System32 directory 64 IoCs
Processes:
72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exedescription ioc process File created C:\Windows\SysWOW64\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Windows\SysWOW64\en-US\Licenses\Volume\Professional\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Windows\SysWOW64\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Windows\SysWOW64\InstallShield\setupdir\0009\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Windows\SysWOW64\wbem\en\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetSecurity\es\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Windows\SysWOW64\Com\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmcomp.inf_amd64_bf289615d063c627\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnms007.inf_amd64_8bbf44975c626ac5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Dism\fr\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\digitalmediadevice.inf_amd64_5b64b65052c3a32a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmsuprv.inf_amd64_696bb57f8e3bab65\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\microsoft_bluetooth_a2dp.inf_amd64_614ec8e6e63777b7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\netrtwlane.inf_amd64_20caba88bd7f0bb3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\stexstor.inf_amd64_fefc1160d15aa667\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetSecurity\fr\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WaitForSome\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Windows\SysWOW64\Configuration\Schema\MSFT_FileDirectoryConfiguration\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\ialpss2i_i2c_cnl.inf_amd64_f668309b543472eb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmnis5t.inf_amd64_c6e181de81a59b54\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\usbcciddriver.inf_amd64_400a61104320a399\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Windows\SysWOW64\IME\IMEJP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Microsoft.WSMan.Management\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ServiceResource\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmeric.inf_amd64_41ae7c84b8d94de0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mstape.inf_amd64_3e2c4fa2d4cbb487\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\netjme.inf_amd64_752bf22f1598bb7e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\sdflauncher.inf_amd64_1ea082c6cf8f6982\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\wsdscdrv.inf_amd64_416a5877e9180787\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Windows\SysWOW64\fi-FI\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmsupra.inf_amd64_ed209c9a3da66777\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Windows\SysWOW64\MUI\040C\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Windows\SysWOW64\Configuration\BaseRegistration\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\cht4vx64.inf_amd64_b03448ba0b72ec47\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\c_image.inf_amd64_31731e48047fa274\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\SecurityAndMaintenance_Alert.png 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmgen.inf_amd64_977aa23dfab87f15\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmusrsp.inf_amd64_4c83ce3a06d0048e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnms005.inf_amd64_add71423ba73e797\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnms010.inf_amd64_9e410195c3b236c9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Windows\System32\LogFiles\WMI\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\amdsata.inf_amd64_ea60132f1a9a7a62\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\oposdrv.inf_amd64_9090a824ce0d0e68\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\default.help.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Dism\en\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ArchiveResource\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\c_smrdisk.inf_amd64_bbef253cecafbb1a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Windows\SysWOW64\es-ES\Licenses\Volume\Professional\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Windows\SysWOW64\et-EE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Windows\SysWOW64\it-IT\Licenses\Volume\Professional\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Windows\SysWOW64\Dism\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\bthprint.inf_amd64_d3a88fe647d71206\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\chargearbitration.inf_amd64_a0097842bcc7e487\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetEventPacketCapture\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCClassResources\WindowsPackageCab\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WaitForAny\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmvv.inf_amd64_26dc960cc4c84207\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Windows\SysWOW64\fr-FR\Licenses\Volume\Professional\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AssignedAccess\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WaitForAny\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Windows\SysWOW64\DiagSvcs\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\msdri.inf_amd64_97bef65a8432edd4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\nett4x64.inf_amd64_54eacac1858c78ab\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe -
Processes:
resource yara_rule behavioral2/memory/3012-0-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral2/memory/3012-6042-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral2/memory/3012-6047-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral2/memory/3012-10607-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral2/memory/3012-10906-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral2/memory/3012-11221-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral2/memory/3012-11226-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral2/memory/3012-11227-0x0000000000400000-0x000000000040E000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
Processes:
72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exedescription ioc process File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Square71x71Logo.scale-100.png 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteSectionLargeTile.scale-150.png 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteNewNoteLargeTile.scale-125.png 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteNotebookWideTile.scale-125.png 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-80.png 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File opened for modification C:\Program Files\7-Zip\Lang\ru.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Templates\1033\GettingStarted16\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteSectionGroupMedTile.scale-200.png 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsLargeTile.contrast-black_scale-200.png 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\ExchangeWideTile.scale-200.png 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-Advanced-Light.scale-100.png 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsSoundRecorder_10.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\VoiceRecorderWideTile.contrast-white_scale-125.png 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\20.png 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\contrast-black\MixedRealityPortalAppList.targetsize-16_altform-unplated_contrast-black.png 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\pages\winrthost.htm 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\OutlookMailMediumTile.scale-125.png 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-48.png 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\it\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageWideTile.scale-125_contrast-black.png 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\Standard.targetsize-32_contrast-white.png 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarAppList.targetsize-32.png 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\illustrations.png 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\dark\bun.png 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteNotebookLargeTile.scale-150.png 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\dark\sat_logo.png 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\GREEK.TXT 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\MedTile.scale-400_contrast-white.png 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Thumbnails\Sticker_Icon_Kiss.png 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSectionMedTile.scale-100.png 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\OutlookMailLargeTile.scale-100.png 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-40_contrast-white.png 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\apple-touch-icon-72x72-precomposed.png 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\JOURNAL\PREVIEW.GIF 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\LEVEL\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageAppList.targetsize-40_altform-unplated_contrast-white.png 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSectionSmallTile.scale-200.png 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-32_altform-unplated_contrast-white.png 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\GamesXboxHubLargeTile.scale-100.png 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ko-kr\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\zh-cn\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\javafx\webkit.md 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-40_altform-unplated_contrast-black.png 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarLargeTile.scale-400.png 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\themes\dark\sat_logo_2x.png 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Program Files\VideoLAN\VLC\locale\bn\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Program Files\VideoLAN\VLC\locale\zu\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-64_altform-unplated.png 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarMediumTile.scale-200.png 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailAppList.targetsize-40_altform-unplated.png 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\Assets\GameBar_LargeTile.scale-200.png 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\id\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-96_altform-unplated_contrast-white.png 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-GoogleCloudCache.scale-125.png 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-black_scale-180.png 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-16_altform-unplated_contrast-black.png 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Square44x44Logo.targetsize-16_altform-unplated.png 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\Square150x150Logo.scale-100.png 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\VisualElements\PrivateBrowsing_70.png 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorSmallTile.contrast-white_scale-200.png 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\Doughboy.scale-250.png 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailSmallTile.scale-100.png 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe -
Drops file in Windows directory 64 IoCs
Processes:
72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exedescription ioc process File opened for modification C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\InputApp\Assets\StoreLogo.scale-100.png 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-g..cy-gptext.resources_31bf3856ad364e35_10.0.19041.1_it-it_052a4b05ead69c1b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-telephony-phoneom_31bf3856ad364e35_10.0.19041.264_none_d18eb583d16ed6e8\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.CallingShellApp_cw5n1h2txyewy\Assets\Splashscreen.scale-400.png 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..ll-broker.resources_31bf3856ad364e35_10.0.19041.1_es-es_dd4362edb35fb713\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-spp-main_31bf3856ad364e35_10.0.19041.746_none_c240418e0bac14d2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-ui-shell-component_31bf3856ad364e35_10.0.19041.1_none_03928ee4a9e5894c\RequestedDownloadsLargeCloudIcon.contrast-black_scale-125.png 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_hyperv-isolatedvm-svc-extension_31bf3856ad364e35_10.0.19041.1266_none_ba2d7b1e644c55e4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..esslockapp.appxmain_31bf3856ad364e35_10.0.19041.844_none_15e5bfcd83a1911a\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_en-us_a323edc73bd86475\http_410.htm 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_netfx-aspnet_webadmin_wizard_res_b03f5f7f11d50a3a_10.0.19041.1_none_1ebdec675f495bbd\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..mprovider.resources_31bf3856ad364e35_10.0.19041.1_it-it_6efcd443499fba34\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..tion_service_iassam_31bf3856ad364e35_10.0.19041.746_none_59a8ae5eb289884b\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setup-mbr2gpt_31bf3856ad364e35_10.0.19041.1237_none_6b74aa3973213895\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-u..usnotificationuxexe_31bf3856ad364e35_10.0.19041.153_none_51feabe070ab84f6\OkDone_80.png 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appx-deployment-client_31bf3856ad364e35_10.0.19041.264_none_93c3704f3937c819\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-profsvc-mof.resources_31bf3856ad364e35_10.0.19041.1_de-de_278af88823dcf327\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..tartup-fveskybackup_31bf3856ad364e35_10.0.19041.746_none_868c87747a5558e4\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..lientcore.resources_31bf3856ad364e35_10.0.19041.1_de-de_ecd44f3c4e10e3a2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Windows\SystemApps\Microsoft.Windows.FilePicker_cw5n1h2txyewy\Assets\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.19041.1023_bg-bg_716e22d250901c5b\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Windows\WinSxS\msil_regasm.resources_b03f5f7f11d50a3a_10.0.19041.1_fr-fr_d0a0c6ffa4585261\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..ontroller.resources_31bf3856ad364e35_10.0.19041.1_en-us_d8e35aa9dbdf193f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-w..-protocol-component_31bf3856ad364e35_10.0.19041.84_none_e370d2aacd35e6d3\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Windows\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-quickassist_31bf3856ad364e35_10.0.19041.1266_none_72c6a00123f43c47\Quick Assist.lnk 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-speech-userexperience_31bf3856ad364e35_10.0.19041.1_none_d1fafd8eeb2a2637\Speech Misrecognition.wav 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft.grouppoli..mpleditor.resources_31bf3856ad364e35_10.0.19041.1_it-it_cf6f34899f8bd3fb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..onmanager.resources_31bf3856ad364e35_10.0.19041.1_en-us_9282db59dc3419f7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File opened for modification C:\Windows\SystemResources\Windows.UI.ShellCommon\Images\WiFiNetworkManagerWarningToast.scale-150.png 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..istration.resources_31bf3856ad364e35_10.0.19041.1_it-it_2c2b0820313203ea\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ndation-frameserver_31bf3856ad364e35_10.0.19041.1266_none_2a87945d79cbf905\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..etpc-mathrecognizer_31bf3856ad364e35_10.0.19041.746_none_9645c26eae7342e7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-e..ifiedwritefilter-ux_31bf3856ad364e35_10.0.19041.746_none_c7c6fccae233c8b7\ResetDriveSquare44x44Logo.scale-125_contrast-black.png 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..on-logger.resources_31bf3856ad364e35_10.0.19041.1_it-it_e688c9dbc6221e98\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-synchost_31bf3856ad364e35_10.0.19041.746_none_51cf02378fc26da3\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_cht4sx64.inf.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_e7130d01644fc8d0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..y-ntmarta.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_e22198696ca7acd5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..frastructure-client_31bf3856ad364e35_10.0.19041.1_none_0c5043de76a7d97e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File opened for modification C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\de-DE\assets\ErrorPages\invalidcert.htm 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_mdmbtmdm.inf.resources_31bf3856ad364e35_10.0.19041.1_es-es_665c49f46f4f66b9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_amdsata.inf.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_24ee3e67a8522a71\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_amdsbs.inf.resources_31bf3856ad364e35_10.0.19041.1_es-es_8044278104f4ac65\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-diskpart_31bf3856ad364e35_10.0.19041.964_none_46ba1386f4ce2b0b\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..onal-keyboard-kbdus_31bf3856ad364e35_10.0.19041.546_none_67000d82a7c2a372\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-msxml60.resources_31bf3856ad364e35_10.0.19041.1_de-de_ece8342b6c3b172b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Cmdletization.OData.Resources\v4.0_3.0.0.0_es_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wsp-fileserver_31bf3856ad364e35_10.0.19041.1202_none_ae02f5c0bff8da39\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..apc-layer.resources_31bf3856ad364e35_10.0.19041.1_en-us_7be7a5cee15a57f2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-kdscli.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_0eb68ad442383147\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..vices-bpa.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_96bb659ad243a387\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dims.resources_31bf3856ad364e35_10.0.19041.1_de-de_22da4572ecd28af8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-t..honyinteractiveuser_31bf3856ad364e35_10.0.19041.264_none_a61d15efb6291d40\YourPhoneCallingToast.scale-150_contrast-black.png 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-updatepolicy.resources_31bf3856ad364e35_10.0.19041.1_en-us_ad9ca73025205e39\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft.security...gement.policyengine_31bf3856ad364e35_10.0.19041.746_none_0b2e52494db526ec\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_netfx-shfusion_dll_b03f5f7f11d50a3a_10.0.19041.1_none_d413b92c48c2acf3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-cryptext-dll.resources_31bf3856ad364e35_10.0.19041.1_it-it_b20e57281fbf45c5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.1_none_75cd350cc8b5dbcf\BreadcrumbScrollLeftHover.png 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-r..ienttools.resources_31bf3856ad364e35_10.0.19041.1_it-it_446d88c72b9afdc3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..iprovider.resources_31bf3856ad364e35_10.0.19041.1_en-us_8c7ca8bc3d6c201b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-c..termanagementsnapin_31bf3856ad364e35_10.0.19041.746_none_290f6af7d5263efa\Computer Management.lnk 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-directui.resources_31bf3856ad364e35_10.0.19041.1_ru-ru_6d3e93e7d64555ea\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-fileexplorer.appxmain_31bf3856ad364e35_10.0.19041.546_none_476476bb5c3a0bbc\SquareTile44x44.targetsize-96_altform-unplated_devicefamily-colorfulunplated.png 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe -
Modifies registry class 10 IoCs
Processes:
72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\JCJNKHJASLNTBGZ\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\GNcWPTsYMeQ17cZ.exe,0" 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\JCJNKHJASLNTBGZ\shell\open\command 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd\ = "JCJNKHJASLNTBGZ" 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\JCJNKHJASLNTBGZ 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\JCJNKHJASLNTBGZ\DefaultIcon 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\JCJNKHJASLNTBGZ\shell 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\JCJNKHJASLNTBGZ\shell\open 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\JCJNKHJASLNTBGZ\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\GNcWPTsYMeQ17cZ.exe" 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\JCJNKHJASLNTBGZ\ = "CRYPTED!" 72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\72ac44125353f22e5e1fcbc6432c8e58_JaffaCakes118.exe"1⤵
- Drops file in Drivers directory
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3012
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\aic_file_icons.png
Filesize50KB
MD594f6a63ea99178366fd82587181935c7
SHA131dc0f0f4f559484abd8dab2c98413b6d59896bb
SHA256dae52e39ced324d31677129ee60ea044caef41fd7629c053e09d20bce57a4b8f
SHA512698c9d5aed4f1dadb943ae3d4162f123f07a4f2358eaf528f749093be29d892b26df10f410471fd175d845cadd8ecfb9848fd8027b0898dd9e15a6eebd45e86f
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions.png
Filesize1KB
MD5efa7c554a896810ddd2365ae170beb5f
SHA176795fa678065b9bd13942b6e148d6ee013fa1c1
SHA256bc04021ae8c78df8bfe50d05a040faf14d121077a2e1f8ac4e7fe90c96804555
SHA5123257996d2e0d450c1fbfb51add003c66f215cf533ac99316b7b047d6e69e7f7dc95fbab0d9992d4b9a00d3dc6219c47f3be56ce7987a09ebe007426952f2b260
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions2x.png
Filesize3KB
MD50356c0637e9638a08c1bcb0d6c3798bf
SHA177ddcfe544492b6bce7b555d71d0666a94f9996a
SHA25623c475df1c02463c3459f13cf611ab3f67370b5688a35f890b3d2bb4350fea7a
SHA512390b92352e22957a01dc59ec110e768eae6b6579ccf4424de5fcb581087028ec053544be921b09e7f1671427aad5757ad171762b2a741510f5aabd05a0822c2d
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons.png
Filesize683B
MD5738444dfd467772b26ae7fe5a9f7095c
SHA112cdcd9041efbf5bbe9f0b0e905f08129e94372f
SHA2564598f47ddbb3fd95afa2c28ef48794fd278954059ba7ff87fb6f399c8123c617
SHA5127127abe79bb9a264b6e8de6f2df3ef1f5b51b8804c6cff53b3b868b4eca78c9c741c336f342fe1537f0939a3259383e4fd0edb1aee511817df63f664ae0b1659
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons2x.png
Filesize1KB
MD541580aca1756c5ac7fdf37e0db835917
SHA12602644683c614410a1ad1d5b64c635f42f3e1eb
SHA25666d809b9d8e356a641b2099ed689dffda359e2124bab2f590e0d1c30b5554ab7
SHA51222a0e89f75ab3893419630d5a595112b8206b1f08435776d64a5a0fae26b0f308419ce6bc194e23a24c99824499af4558d9c7232ec6e2472191e5b1b96fb345f
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon.png
Filesize445B
MD571d03f43cc632ab87d20007b066f2cdf
SHA193cafd82ff75b912d3aa54fa0bce37a51cf853ed
SHA2568c6c62a11eadb70c849f1e268c2466e535ae492fcd4529497938aca1fddb4dda
SHA51263af6be5acb464890b6a98d0e39ac6a31e9d550a0576e5eb47657bf8776b61269d10380ac2c5e96510b93b275bbdd05a9d3be57bbb1913837a0127e3905fe752
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_2x.png
Filesize611B
MD5ce4d1a86ab2836c0c06b83bbe8a9bce4
SHA19c28a3bd2199594d7b5a21d97d1175407bb0c97f
SHA2564e720ca49f2e982a03f8230090ee8c4cf64f5371032cce7dac21ef1437fe7f7d
SHA5126a8d0f8a5b5826e4e489bac2fe329a6a7b69531917adbe5db704278404ac542b1bd40c683046235f5931824b7fce4a51de0fe3fbc92f667a79a440afa7ce9037
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover.png
Filesize388B
MD52f302d76d26c39ba701abd0d3403bf6a
SHA1b4e225d2c495af566666825ea59fd8954ae7788a
SHA256913e825a66dcc26ed12f0fea64ecd7b45022a3da9fe31f9c8950670f6823c9b8
SHA51262b17c181c60697f70e7a09420e5c90523a21622d2f2f948262c301c596ce5c8e9311d194ab78117cfea1c6dbf24b75bc4b2e089162cb59bd55547e51537dfde
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover_2x.png
Filesize552B
MD5864bf0a4ef8332e0c79ae9ae71fc2fa2
SHA161ea8655fe15f6e9e61fee8b47b9f15f2a68f9b1
SHA2563e2d83a07aab9a33dc445081bf7d5c8f5fe90694e5cedded7f5f55f9ab3836ab
SHA512c786a7723dd9ee7f959d45a701813678355bae6f56524e9098733b9101436f6caa62fb0b90aba85bc1d467e0d0cb34870313d542f285d0e54c41f9b6b1975078
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon.png
Filesize388B
MD54266f7894e97271e325f0bd02588c4b5
SHA1a06eb517ab4f5b5f9851f6acbafea5cb40c9aaf3
SHA25602e505cc5423368b15deb986ce3664f85af4cc7c986c6980a4d3b7df351ef0c3
SHA512d484a8dde49a4abffa782e9a2303df73f243c21376ff913ab636bede59b5974c4b4fecb15694c86a9a5945fc0a12f879c72d65bee0159a47cd7d7e6b7dd54679
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png
Filesize552B
MD58165a61c4b870b8f102fbf559b2f30c6
SHA16c2bc7effa1988d991a08be0b520c23da74e042f
SHA25623330b5586a4d0a73295b5d7f6dd45b7f0fe6bf00075c23a61131ce37109e018
SHA5126fb5ef9d69e212a74ba75160b332abcd8f83681650ceda7a57597ba045d3469bc0c022cbc85b5bd9c3afd499622c3cb961c785bf12ae4f0392ccdaaddea30a90
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png
Filesize388B
MD5a9e76af50f55e4039035e7c283198158
SHA1f65851a2b1d1ed15a5862e502816d84d670599a8
SHA25610e89ef192a9178085e8694bf0a874d2b380c9f627ea24b499079fd47976c167
SHA5129ebc2bbecdab02223caa894965855a9738778dbff59ae340f72fca9f68674b371051d2ebdd9190c591675fcd75cd614ff17b168244857e5539acfb0092317e43
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover_2x.png
Filesize552B
MD57804b73171e0a2995d6b478fb2fe609c
SHA18d6a4564f137579d39679aaf85ce24bf5dee7a44
SHA2564fc1114f3a6785e20de11a4a420abf1341fc903f7a16e03877a5d9411f1bd736
SHA5124c37ff05153957634a2efeca5810da32799b6986bdc37b1a38db5ed40e38b50552a54fc953c858061c58c647d9ff5d58b5902726eb521e9ec8a0736bda268a40
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons.png
Filesize7KB
MD58e60b89bc473d4ecaf2d2db35d052208
SHA170038724b50400d888e71e4bafb78c6ac2aba697
SHA2567ad47c85d6a1ef343ba32dbbcc86adf22da36967c3efeac62769d7bb91de5916
SHA5128edbed23e43acc763f69e798a81970c50502f6d2cb13185a4c2b3f990ae4e36b58eb991c6ae5d23ec7eb13e107c98ce5d810e0f0722496780b7e8f320c3c07c8
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_ie8.gif
Filesize7KB
MD5f35dbeb4d1cea5adfafa45a7fd7dd81e
SHA1e3f8920d071a99ae0e713d186fe6c494e179519f
SHA256948b3f076b544e5809ead48d5ec9f1801de5a0572af3a2fed572119f547200fe
SHA512156422d3d709319c2fbbe97b05958cfb485c76ab98a737a713ec0f0e7eecb43dd643af1579e249dd7f3ae06b88da60c1b6762176abf1ab58c65549e0276d455f
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_retina.png
Filesize15KB
MD5a9bdfa62f21a9c6c74f5cab53a438386
SHA1a762fb7f230702920079e0f915a261a480a8758e
SHA256dd1fecd9a539bd4730a2c7993b9a2dba8357b9e29217864ae7d3fbfa71887e84
SHA512c82e20f09c2d60ca8fc382d4d20702ea124bfe71dd34c7efa80d957fdbcfdcbc7abef37f25cfc374006ef9bbdbeca39c7a67abfdf07a05d8d9365e3a79fed5c4
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons.png
Filesize8KB
MD546c7da46d8dccfaf82e6cc5660085182
SHA130c5bbea36bbd5092bdc264fe4d98810a6cebf1c
SHA256e7982bc598db1b0f09740297d3487a62b21311559d0e9f38058061d5dcdbcdd6
SHA512969ed7fcd1733f8800bd84c6d2f4bee2c0b8155633b300966dcd70c177ba5fd0200495d2b08c266e4b355e9421d8abed2f1abbb3d72e923ff663eb5c835dc755
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons_retina.png
Filesize17KB
MD5af470b8978922e0cfa656f347d37ec96
SHA1ac3e90a73dff8339589eb99d15da45b68cbd2502
SHA256e1977d37dfbdf39d1fedff265f1fe78b0030402d28f06983c147a0816af35a8b
SHA5124f3349659ed7c8269b8cd1353d17e00d31cd3f84b7a8dfc8f606bb446a820463fe56e5fb4155017c15d91307fcb563c8df6ed2f26c3c072e276f850c0d58dc06
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_pattern_RHP.png
Filesize179B
MD5a4a9c1aaaab75b89872e92bf9198a0e2
SHA173b37affcb284929727ba8b2f6a1c9829015edd1
SHA256ed6d11982af40dbddad98a14859b5bc630876e273f9092ea1f9c474d67bd31bc
SHA5125173bd3cd8a21f33f5f0fcb741deadb86eefd0c0e1fd786cd552acf7071cbac77a1487fa8dd0a2d9dc53d4d45ac3a36cecdf1fe28b55681a6d5dac6d016892ac
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_patterns_header.png
Filesize703B
MD5e18800ce785a7c608579e47b369776db
SHA1682697d1e856e80c063978b7bcded262a50ffb22
SHA256d51afc49e6234a438a8fadb7bc0ac6188322178c1a84705b3749867dfb86a10d
SHA512c0491d23b09f668442815d2051b99640c403571c593246d7b0e2933cb75d9a1562016a64fdfd1b99c12e2e8310d77db119bb21a56f32347a31f1915e25cd9d1c
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations.png
Filesize8KB
MD5188c88513d78a41682b6288ab222ba52
SHA103d256183050ec4c7c54978c0a75a696f91a8f30
SHA256ca9d5f8a7bcab6a21973be3bbd1ae60b1057675b91e7ae15477f62efe3825a22
SHA512e95cf433470c6150273dc9e100284d1a5b0b2cfa61ce1021f6d71008d4bd730690935e0a0cd860836cb86f79258dbfa248e421932bf8537de1c6696ea1400e6c
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations_retina.png
Filesize19KB
MD5e3e83904bc3bfb948c3fd0891deca254
SHA1775fbd6fd879474691a0846aae03975a72f5b704
SHA25697371b374e53519384f62da529f60c5b1f786b79f115b69b768f702565b4cc28
SHA512b890872d6894c34c82b239ea51edeb3c04439b458178ebbe322877bce527893050dde874de65e3b505c5d9833a29391c521f4b89a5784bbb2191c2a917b68870
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\faf_icons.png.EnCiPhErEd
Filesize6KB
MD53f72c3ca592ea6253872e61af2c0fcbf
SHA1072de84fe57cfd4dbf7207dff4439ab773388647
SHA2566473cb30eb82ef3d038a72bf55f002b78e5835f58fb05511bb5d51b54c6c495f
SHA5123ce9a3895fb59757b31643d1f770ad786c048a2c6a2e3d17e2ba530c5fa0a6e4d01413d9f4975d30226bdfddc78623b6dd9b35df73279a259e6047d53822d543
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\bun.png
Filesize2KB
MD515e20f6e246d8b5f977d9157bdcbccae
SHA12df8e1dbc5381dfd4a10adefa0188f4fef1df321
SHA25687b76128c041b5dcda3960c5af2451af161ba1820261226de991e6539e951d12
SHA5121455d3b5c0cee20e6d6b4097007a7ea6cd0c8ccda60c96e800404145d84c12d69984f7e4e1c12a791c00f26c7dbc117e56921e72e0ea6faceee92c9a011e9529
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview.png
Filesize2KB
MD5209a06a10cfec6c9b73e877e9d9495d1
SHA1c780ecd572bb426f9f314c529abf74388912cd9d
SHA256b31ebf2f6daebe845ad445bcc2b9616823a1364c4681bb0bcaf8cf55be8c18a3
SHA512483956fe4468f5787e6048bdeede0afae3ecffba625a8f30ee19046b9960118ce4c3e9739c244a906a75174e51939c86c770b5ae90730afc32241d93a3f15bfb
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview2x.png
Filesize4KB
MD5604a4071f0fab0f34968a7a010f5583b
SHA186eb9cdfde17589c91c1946faf881e233a394ab5
SHA256ad168aaf1a6f645c4116f79d23a1827fd3427bebc91d890d1b3e239d84dcea3b
SHA512edad1f36c7aef289b63e47c1c6d4ce508974702809830efccfeddfed12c9bd31a3a2f1c6a30a2186b6413f7b0e5ac8c7abe1bd39b9ee8555c2b96566f16bbc5b
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small.png.EnCiPhErEd
Filesize289B
MD5b8bb988f127339e6c7399a62e6649800
SHA12ffd89983a04504b6a78a137e1c0b67ceb910f27
SHA2568f8b3f9f52e98bb3d991c8e4bde1388b8c2d432c1b4b32a0dc851790582d6386
SHA51284edb50f34fce65bfb227b2b55675bbb341f665a108e4ef6203637381492c8fddba157bfda07c2a93e2dc3ba588bc2d24eec6ed1179dfe36ad9ed0e95cb84ec2
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small2x.png
Filesize385B
MD521fdd9c9ef4e34e576f02ede1408006a
SHA1dc8eab9a1c98c997e17fde66394389499a7f94a0
SHA25646a9ddf44ff3770043cffff3dbb67f1a2b705b5729cec0fd71f31c2084aa5a61
SHA512c057966d3c940aecb0d762f41a60f78d7ddada295bdf2187e222e382a1e3376e570ff2e852e983f239bebb134a00dd6165e19f7d72c51ba41561e8c405d73a38
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\illustrations.png
Filesize4KB
MD5481c5193e79e6277fb2677f8c5073819
SHA1adedaf8d6b23fa06d0850074f30504b8e2e09980
SHA2567417abeccce42808f5711d553ed03cfeab3e832a9acc7c13e9b853fd51726838
SHA512feb1877a1f5035d9cbae4c4e5bd35bee1e2095dfaac753a8a5b1016ad2adc66359da0338a1dc616c0e0fd70f6e3a2ab0a32efbcab543556f0f498ee4c91540ed
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\nub.png
Filesize1003B
MD58631d4b891f8cc07bb9b92301cbfe97b
SHA19bd2dd891043f881fe942104811f6172f653ef50
SHA2560a0524637fac9ba957cbdfed6bc56c45e70b61b2adb8a2738ccf38589c48f39f
SHA512e9768adcb7b378beedb59931d51a6b246851b551793b8ea81af17548423d66dd4c789b25523fc6cff04f2864da81adda737af892151afac6e38c73fd3825004b
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons.png
Filesize1KB
MD51fa4428a081a9808f8bdedf39d2176ce
SHA18a1db57c03359909f37066fb0165cb46ec574efe
SHA256ef50fde200654a0e3ecf98fd599cdfcce675dda6e49e7ddddf37d7d281e9c99e
SHA512929ad157be235b55d51c7ba6621d4a60b1949d40441e69ebcbd575d1900e77ed890278ef68407b508fe7edc2db3544679622d5add668d8d313003120de31cc00
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons2x.png
Filesize2KB
MD579a24a6aaf3d45574a0a9be7507e334b
SHA16fa8acfb8e731d7e2b52fe1d240818ba437c5d0b
SHA25619fa505ff2290d16ff88e557880954fbe3ce06a7040d34a5cbc04965fdf7395e
SHA51244e1c6e146b4396fef44eafb3af84132dc21891528887c856a48d7e32415ba901ec8b082a16a0d04d8b2b52111eed23aa53487efade1d9bc43812481539aa0e0
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adc_logo.png
Filesize3KB
MD5c0cbbce912050ea5d4e9c37035d338fc
SHA1d37ed1bd1d2546b6be6cc38d99337f365b3a560c
SHA256632285510e38207d4852b62844e5d0fb62bb6fae84ad0283c59bacd0368d2154
SHA51262fb447f446a494b5da1a0a2347f8ab316418cd12e017fc8d15f8c7f000df4e0125f35bad567f4704c1041bc31646dbba02c7cceb61315e5e31cfec3cc1983dd
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adobe_spinner.gif
Filesize556B
MD51589138840fd4f1d87040d911f14fbe6
SHA1493d6be997cf83c76c2d5912b044d6b76d5e06fb
SHA2562c2e06d600fcecc54839f38ce8074c2b31dd3185b5f5e03f92ffdebd3a8edf22
SHA5125f999a3091af4f280d99f2f30017cb24ee83ea8529bbe763e641fc2edbf134730fca362f2988dbe68644fd7f419d07eed25eecfedcc4f54bb9a4c270bb9914a3
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\logo_retina.png
Filesize6KB
MD52804e7779ed624c9797f7c034c580b31
SHA1b5d640510f200cec5061daee10750b8c3fa2e98a
SHA256de4c646fc7ae2d5b3612d6bfee64eda7d28c07603023c8a1c0118d1cefab4d85
SHA512db378f1acd104f87efb7feb8da42117b3cdf3f72421e1d08086efa575ccf725d525fd9151eeef17126c9dc369ae3ca5244d70347252f89bacd5afc1ecf32f012
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo.png
Filesize826B
MD55896f1a4ef46eba3958de8c5dbf81858
SHA181cfee0cff091fabfe53f87972d2b963c94e3542
SHA2567702064ada50bfc1b99533a0908ceb66cabec1b0880cd0ea2d75646301b75555
SHA512dbf925c3287df94311545be4875d3ade7621d789124c8e0f4a6c3ddcad0179d72ef408fd826db3a48cd7f48d37725d27b1967b28fe5856e0ef5986856c0c7f12
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo_2x.png
Filesize1KB
MD56da30c83cb826524cd1ecd8fa924a6fa
SHA17db592b652b63280b04ecf47b570d5ce9b505e00
SHA2566a2072c79755f3cabaa06dfe99f6407b85924ddc79af6145ee83dcb4a8f6b03d
SHA51225bdc7aecb7dd4325d8695a55383f48506aba90a2e378e8eb1f5705453ccfdb96d6c00c02f4f8f3807305bd1fa7fac44b035839beba555ed040086ce667e6caf
-
C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB_EURO.txt
Filesize32KB
MD5157054fd8bf66bf5e0a6967ee95b61bc
SHA15031bb8d3023de02bedffe22c2c7024f81bdf761
SHA2564adb986dcce408dd57ebe494ba51f6ec6360a924a38e50ea8168faa3eadff3e9
SHA51282644ff90c08707862751f2d5b290910b8d394834bc7dff36d2fa720457afc45354cd31b732dd36a6489ed493ac16d16abc68d2b3665eb992e3ff1401066d63d
-
Filesize
546B
MD56f648ef72a22a7904da3de08fd4a07b2
SHA16dcd74b159f584c64375b97d291497ffbc7d34bb
SHA256c210bf789f938a56da9dce3d5875d54c05f9cec2946a35ec8eb3b36d13a47912
SHA512c0a5c9d8f852eec7dc40dce74346c66e85eecd2f21524a5ab3ef88d938d373fadbf93d171c0883b081ec1a998180a949ba1d33510751baa2e81661d2cc2c3ec4
-
Filesize
153B
MD5f99f517a9d62044a6ba96e5514ce99e6
SHA159d39f93c7f3a6469361e25f335f8115d3cb8248
SHA2563216891a9fedb9e9a02e4fc32b56c2ab5f8b6ea013e27e1d8ca26e7f05642961
SHA512100f3118f495aaf087fb638314a5572b5ff06b147d206c6ae7f5b6551b97e39a514338709313c224acce7b2f735adbc51701676712eeba50fd681b86465f8c2f
-
Filesize
190B
MD52f66fe8d3f8ded2765e3455a43af5faf
SHA1b30eec945177b65f5de21a7ffea40f12a5e59600
SHA25620e6a1960082a96466b2a78c5f6892fca99ca466c41d473352c85eadd7dfac47
SHA51293d449c574657dfd69da81a1698d368e1609310e4de4049fa31a413bdb558effdb399e764259d09a40828c4d6e2371e59aa31088fca7be2ab30853936de78bbb
-
Filesize
190B
MD501c0a0f5d8cefffedc8ab9a0005d6d27
SHA1a72408f17cc56e0cad5435ea444b51fcf7fb421f
SHA25641c8a8a0d4ae7a59becca19774cc4771221db8ec46e9dfd0df35e22809c3e4a1
SHA512061c6da5b02bb3a771a46dadc16df5c6b5b6f996e423ca9401b985c16403ef192b74401a3b5911478206c244e68cc6c9ce4242e5b5e56184dd0affab199b013f
-
Filesize
1KB
MD5c61f23b5064d8ace52c7a9d2a1f9d6f5
SHA1c542cc794fbaf99f357296e21fec5b03cf6c422f
SHA256fca9f9e32eb67b0b48dda2e7d91fe2d95009af4ee9bd5cdbaa86d2e5a8797b9c
SHA51258ecf5f2a35776b2c3b3a92b5dafd454805944b652b9aefe566ce6ca2cc99152f31f6be18fdf6da45b6d909f0d51ca0a9bedb1a7e9141c44cc9c9269910ce2a0
-
Filesize
31KB
MD512ad81c0c89e19ceafdd317fcd2769b2
SHA1a76a74fb2dba8111f6e58283f8701c5551ae4044
SHA256b302a590431a881da2e4af6641c95d495c5bd878d0394b4fa211b4353b080cc3
SHA512c76c035b08257e08a8661c6aa58f021dcc2f957ae0a8bb40d55706a6ed5d51249009bd23707903704a610ba28dc5145c421146f76a87bff0a6ad3e7da274cea2
-
Filesize
34KB
MD593431e201fa7cdc547a8760ec6e66172
SHA17eb9b7ebd2e73eb36172fa2ada49009e3785b215
SHA2565758e6948c6eed2e4ce50dcc82f14b144bca3e65d068da1358878021a06d1087
SHA512d8098b865e247f2bb3d7ccb3c37af41ae6ff78273f7fddfee626783c1a2e9e4e50c87b9cedaf8488ec8b1514a73ec597c77587f2d69f6d4f9801b6d887e2090b
-
Filesize
23KB
MD58e8b032e0191e6547d134912394236fd
SHA1141104987db64d95dd0808e246638bf161c80464
SHA256e01303be9a422d33cd64bdeb7bad0a088131ee2e0aebef32db9ed414ac6777b5
SHA512afa19ef2883290d483161e03c01766174b0757cc49386775cdfe46093d72c55f010d47387ec454e8411ebdd9918757c9e6503b1b14836649c74af84df05ccb1b
-
Filesize
2KB
MD5c26a8789205086eaff5126881cd994e0
SHA1dc41eb24def8cfc232a96128ff0c526f3c430ac1
SHA256ce204b722902befee63b7e1d1bfe9981630d6c6d8b20ee721e9de9f120316127
SHA5126782a86aba9ffb2d4795565411b18353c800d9bb69f9a9f04e9e5c915bd8a4f24d90c85ae09563af1818eaf406a5bf67fe9637f9de83cc4f522321106dcfbb33
-
Filesize
1KB
MD56e2d68e2ae9ad84ead8ae1d4dc9ad398
SHA1bde90b0d5c11d76e35b49480749679443e4c6137
SHA2565fea6042b73d0325aa22842f1b706b1e7e140265175b9b62a4b1e56f3e1ef460
SHA51228b7ec575c4fdcf4a79d7940de2562e3415394678143b5effd887c128e3666ac641c2e9f82bec79656ac2076a44a599316e3ad1c76d49eb72cc3e27b8050191d
-
Filesize
3KB
MD576b8a1e47f54048dbfa66c446d69a4c4
SHA139fc432bbf946f264583e1309fc7a70271339f23
SHA25610147d2609a5c01a1a927647c3628671988f653fb0078a77813891eef5917640
SHA5123aa34fe5b43abb9eb2ee9908a39e061b35fd083ac2ff489473742d75bf84d526556cccce4e3970c76377893293386c6e3d1454ad531e34d9f48b050aac3ac36d
-
Filesize
2KB
MD5791f352d03252db98f8e515071fab2ff
SHA130ebe87703c558a4cdc2291804c2ad798b760413
SHA25636737b279d36a47ca2b816b1cfa64d93f29bd9eaad57476d21ffb1c7ab598a40
SHA512390fde73c9fa9afaefb968df5b7ee99e277353379471660590e38b42c99d0525ace52188355a23e36c4d758368e23ab5bf1326105fd7d301098beba041c571e1
-
Filesize
5KB
MD5c21d0bacccc825dc2fc6903f1cd27ded
SHA1b42e35e7a4eee92a0c87586a86b3a8b739a8e506
SHA2563b6237d584abbd8efba8000470faa2151ab5b0ece50bb179dcf7d9429e19b730
SHA5128d34af00b2d4e3cd41a972564f9f4c5361d40ce83eb04ecb97d5e0bbdeaaa9f1dd01f6e6703dbcf6f60d1d18ac5e1cc3e002c041248a9523d4a609c08d0b6f50
-
Filesize
17KB
MD51812d70257f4322227ab32deb1c3b641
SHA173f39d0f420bf37818a6bbffbe632beefd1cb8e4
SHA2567e72c2ab91547179dd9ef4e58014afa2538bdf7f08855a9f2f58249213effb52
SHA5125fcf6b82bc7b02b2e4b9a262d8fb9e6a215d303ce252dfdfb663a9d07a3a8645b033cdb25528fa60bcfec561f5c183334c76b6121fbb7ff36e854347d490ca31
-
Filesize
320KB
MD59e01186ba6ea3a57e16c3fc6db317486
SHA1c87fb0fd92adf763f61026408a633bec0e3933cd
SHA256f276a348855d5468e91ec6af9a6f3ac6e603af831efad15d15626ae9271cc096
SHA51201600b30b27acaf9871e96e44994905492bfe26d06d1fb3afca72700f7efc4b5c4e44df054984c88102d435b5d6482f77376a5e083e5934c15b3d8cdfaead840
-
Filesize
1KB
MD5c8577bcec9758155d5e326292f90f1a8
SHA1d3ead5b8f8d612c777b98108cb67b666581b15aa
SHA256a67de0664d9fa2856ad2c7f01553bc7863c731164151e688da0fe24449d50414
SHA5127c954349c290faf121b3c0c7d752dff3269a1e0888090299f13da5940dbc22e261a0f5401530c3fa45bc31b0f47a18efbd0fe53a54fc6700cee766ed08f20091
-
Filesize
10KB
MD58f94b63898ed5c8545fbd4bd9af1f95b
SHA10c7ae8f401031af215a46e9f34f6e64b186932f8
SHA25665eab31b300ce45f96d46ab4e8cf4cbf0a1e22f86fbb2769a3b15e65c5d347f7
SHA51209818ee7c20e7c8a80979634e3144ec4cadbe73b2a2affc6f530ef50b313553dc672bcfa521799a2fbb4ededaaa127c60488e58d7d4b1d375ca74fddfc468105
-
Filesize
3KB
MD5ea6b2b5c3b42d54b6d6b63afafb8325d
SHA1114ffb9f23f0bfe7bb32957668f5d1d46c603a70
SHA256b12bcbaab8a53845a28b3a9fd054d5feb106e04dd8a845555b95545878f09deb
SHA512e4b9a762ba0b0d88ff1eb3a02f8280207b2f387d767a0fc8634a33ef02e393ee52ebb3c1b7c6c9e2930148b8a6786e7aef92aab07e966a19a96b861b77716959
-
Filesize
162B
MD5e731cc92872ef61eaa299ddea4807124
SHA1c40382086ebdbc517f130625d72348b879e60c36
SHA256fe919e967071f3da87b632278a53f94263f61a9fd7d38d2724926b970ab475ab
SHA512cfc923b30bded6a7172cd6d488076fb031cca2e63cde746c077e569b1cba9a4905a148f622450090ce40bff02852d9d528517c1817e5ffa430c8b84b535d7cdd
-
Filesize
1KB
MD5e38a6c1cfc4d27686970e550b15dac73
SHA1bfafab72050b1063f3e196b9239f71d12b5ff3ad
SHA256906fa0848e7d6301e340dcacb6b882679f7dccb16d87dec94409d4e7159323d7
SHA51296b273b89efc80214f623eae59b1c465ace7540d0222b658ea1dcecef0a7efc12f2a6e0d7d2eff0e1d186341de4af2399ba2a969bea16aa87ef98efcbabb0153
-
Filesize
3KB
MD535254b82f147a444d66b68f8cb229e84
SHA11471f41f6b3f93511af0776b7d4bd92a36989bb3
SHA256f106c6614d16a2ec5f01dcf7a1454152d0c16c347930a2eee9205ac5c94c5f83
SHA512c302e58e9bb6bccdb6d7821dac97584329086b1b5bed105ec42696ec05cd466f78118c6933d682a157cd4df24f4f67f1851763d6e0ff04533b4661a2892c4114
-
Filesize
1KB
MD587f1a3960aad99153b101e20fd022164
SHA158ae7e52c5bcb2b585a25bcc21b8bc70424ee054
SHA256c6f0bea195ca662e4f2ee6b8f52c764b0edf87cd42d3a8c32a034b5ab8aa7f09
SHA51250dd0d38293d637fcc1d10b0efee4b893e43a43e1aeacad696ee28809726752730566c7b393b9fa71d9eb0af3fd8f8e527c7c3ce08bef339a1dbfee107c1f431
-
Filesize
28KB
MD5cbae8036b0883d3b6729112af69872dd
SHA134059759a75639516c720812fb8411d72cb1591f
SHA256270a4913b75a6d52322310a352cea9640b6270bf6e8d7835fdc92ae857918ad8
SHA512096a732f25ab29370a54e5be6eff070d06a61920ca1bebd1d40e4858594cf434c7c3ddf3c8f35be513d73403077fe6382cdc25843cdcd78d5021cba55593f7d7
-
Filesize
2KB
MD5236e6066a32dcfac3b1cb7cd96b5a946
SHA156cb27662339eed5981f6d45730cce7a0fd7936c
SHA256e2f080aa26199c73257be013704e3fb65cfc5a222c6712a5327daf49e5342668
SHA5120beb9ea7e5c82986ccf9f9dc994b1b0e5bd5edeace149a5b14126b250bf4ee460b1395a31e00adfc71c847b0433e49c7e5c2f18583a67cee21f2feb0531b21a5
-
Filesize
1KB
MD5eeee4b9ccc2dec1ab54f110425c61fa2
SHA139fe26d6c40e1e813ff63c7d620995d417b2f5c8
SHA25603dff40e7b9d5cff5815113d9cf4e61db0a47819b2cf354279dc83846af501cb
SHA512ad4da652ae791245cc468f2a8cf48e474bda5b4a2afff70a8c151620e5b44c51f894a08edc4ce0a2d3877e7467ee20f9936aba4db6338f905fb0f5f14c34d39b
-
Filesize
2KB
MD55c8986effcd3bdfbe9cc73ce7970cd03
SHA1f784da9b6cb6524a2896fe1075069f1428af5df8
SHA256a5cfdb02179fe9545316646cc1929f001c9a527c457ff3c2a4ab9791bfd56113
SHA512c181c47300eed4d03e45247e20cca405b1702239c12e41c390a1c029e2b4fe18cf2a4f891a2329d49ba3a0a659917e09a74950edd25cd55cd01d9a2d22dca35a
-
Filesize
1KB
MD5e000c0f0e9cc528697346c2b0f021751
SHA160c70a2c8a9f74ecf32c2f4b8079d559918d57e0
SHA2564e81695d7cedb3217f207411737825f75ddbc92a1ba1a434098f8e4f0c437386
SHA51208ccb4de395b4fe0dc4d9ce389c73ec0a813101d78e671a9aab70521e811860f31b4e2439e64490ed2bc4caba0d72e1433f9d57d1572f35279218a3a213767e4
-
Filesize
1KB
MD52cae4959dd6cea2c884ebe12ddf80fcf
SHA1d652e03eb80d975f663f9f18d3b35d4e926fb32c
SHA2567107938aa41501883428937c5855464eba04e48f0628231da0a3ca648d8b1227
SHA5123539e56ff1f5c48eb3d09d4a84316b5031c3cb061d03596320a23a5995492839f89adcd6836c888394d4b14bbbdcc1c9b212a396e7b5ea5f6943778cde49a35d
-
Filesize
1KB
MD52d4d9fdb47fbeedaf5f5814ba51e7ba4
SHA15d9ada906befa15fa3e3ec5b4cb4feed3a9dc9f6
SHA256fbbe25740142f58c15cc861447524eadb699ce7ae08438d2c55e4616872462f8
SHA512c56fbab959bcb652473db26ae5192d046b5345617a85dba39a3fa9a51ae0b267dab6ba8af4e0cbd33f7c2152be411be00ade9e42abae06ae73510ee7696f09d7
-
Filesize
3KB
MD5159a936162c07629765c38e5a67bce52
SHA1e17d0c687c8c8c9432856510dbda534e06853cb2
SHA25605e1a77b21cc273e34715bd17dd249ae23b5257d9b10e5971e44a06c1daf0ad3
SHA5122cdc37b897c6b913cd8e45bf916bcbb0d91677796c31e0f60b28e3de4995e75ce31a66e2957538635ff6ff15c6b21d65fe246d79a74d6eaa790ff661908f5878
-
Filesize
2KB
MD5096a0e55ff6d4aa624680e365fa05fa9
SHA189dcb5bde03953783a6dec7d9528d0dfa7e6bb29
SHA256031b6f5c9653bdd22b3cd844325038a4269b7e6f757a7cea9349a1a25a4d1b88
SHA51288afcc4b8a2299d75837de042a2cf839a9f9c2847ef87f429a5bf7f37754bb25aa7b6834ca044483b04752bca813db67ed240e8ea4379d6670e026bb193a8eda
-
Filesize
6KB
MD5760bfce3e33aa829236ea16810957b11
SHA192fd322c4756b08aeaff060b99d077b739b1364c
SHA256e96c3e09a791996a13e79db189decd1ccecf215519159ec2719c0bbdb68e5633
SHA512fef98086dac1e026f93ffb789624ea77181ea18ec708fa7b0e63f4b5ed6b6ec698bd7dea128e64de172b9a869f3168ed16b49c5e02a12246fe77da5b5254ec0c
-
Filesize
5KB
MD511c2773ae4f6c922300f3dafa02e3137
SHA13f3df23c411bfd39a7eae5a7b420153504faafee
SHA256eb98f2fac9e4793c07061678c43b77925eababd2f0de5f943285d06391ecbd9f
SHA512f7dc9b4c7bc02a2d0230b65499e692f1454af0f75d478a03c1bf3e3c2994981cf9dd3af1cf478e02e601f7ebd96621a0c19e30dd31336dc127799f24e38f4959
-
Filesize
3KB
MD57879594139b3d984065fae756465d400
SHA1dd9e568168254631d37284b7c6bbcbfb340d3202
SHA256188fcef05daaf4c829b6dc929519c0b267aa652803da026f39a3dd9ff07e6b76
SHA512a5535e743af08b006c4c396f710e23515d577da1afdebefef54ebbcc8ab0b26e77e14abccfdf743582185fecff8b045dd3c480257133efb9a6844063713157bf
-
Filesize
2KB
MD5fad3ed29347b5ec83e89003bc7eec4cc
SHA1d0abe76aa10f1e8e88f9be47163ce39e84ae2d8a
SHA256b6b90713cc51784e2981fe60c22c14a527c666008a0343222e992a2a2a52ac50
SHA5121bf30a7fdf174bc8df356024e2bcb5471642a4d8166e7546eb1d3ee56dd92d0698cdf7590ef6313d6d24fda80e264b5f7343dc4a2d3563408c9b953960f1336f
-
Filesize
2KB
MD5933e22bd4da6eee411c2a42b076269fd
SHA14ab0cb5790f3646c81589800ffd84b46afccb206
SHA2567ed7533292f759caa6eda35235cd094df17f97d9d033344bacab74149ae1cea9
SHA51283fffdbe861094f5713f2012fc1ac034484f956fc9c33e0e78f6ced11f78c31018905f549c760e44bee96b38e24b03f1073f8838530be22d4649a6bb6dbd0b78
-
Filesize
1KB
MD5ef3f7007eef7c6f242aea0499dffdbb4
SHA158c988d82301408be8ce9fd66f7d163427fe18b4
SHA25633584bde8e8f648d57ca596902efef58acd10a0f1f360b32e637a2b95342af18
SHA512bcffa6b83a338e361f44aab24df1d26143a3bf1dd7b985924f4b2b1ddaa3ed6bbb177abd16916984fe8935ab1fb71fa58d05a66de2e8dcaff20ce9df879d6f05
-
Filesize
1KB
MD57d01419d408dc0fc7cfe51e59abff322
SHA1f64852bfe8ef7b9067e08cffd5714527bb6d9bb2
SHA256a07c0354b2adb1fbaadd3d603e9679a35870fbbbd4e7298c462be0398b6f9410
SHA5123ea314dbb7c309c089193ed15bf880067604c3cff7e812b88d31292144de274c5bb83299cf54605d741dfdc67e66a42f0eec8297cfce83f20bcb0ef73acf3edc
-
Filesize
11KB
MD54329f453c269911aefebf33d0f65f7a8
SHA134694c445fb967a101b2de74f128b162bb300f7f
SHA256a281d74c2e8480ba7645ab73556ca6e987655a46efda1bb0074f8de10dd6c9d8
SHA5121927744ce46a625071de5e7c197578e11955b829530e529ee1db96f4b8737fab0e1f2638e30e1af3838b74a0508e4fdce2bcdd1d0f812b547c3a0b31065a396a
-
Filesize
1KB
MD56ff6ba48f3c9aadea72b2011ce12e350
SHA198a4d37da17bc6c6c5f468fcb0ae9c977891b333
SHA256b7bd896cfd1689d9b1d6f67389412ba35dcd32551f0f38cedb8e8b1377e8067b
SHA512828a65ab3c4e363fffed6fd1b75c5c5db722039b0008b7b9d5f7de3e6816854d831173aa301b2df24685b2af1da94d5db3a272ed4c88fee0b35a7ce7f8629896
-
Filesize
2KB
MD59c7bbcc040d265271f153c67dfa4e2cd
SHA1d1c71b086ac9ac32537113b05248605813942d7c
SHA256905e2a4bb112ef9dcc2a00f43d73d21b4cea9868e8b08957000912b784d4b153
SHA512b95ea8529c1b55346ca95fda999cd566630083e48d3b325c8907b4118c59eb1004a40eabd3ce108ae3df8a893c96f22799f54938c185ca623c9c2a1f5ae58f8b
-
Filesize
11KB
MD5c59d1091cb9c08869022d359bbda1d10
SHA15cbe6d8c3844539c415ad1dd21f8cff48c7f0cd1
SHA256073284ef450471aa5c17da8098ed395017f658b0899f4325b19b17ee19addb85
SHA51236c3f30b475bc91b5a1f491d728af0a535b3dfcfdecef18dee261449335dc77555cd3b928adc77c896bef5346f9de52e21432729df6e611fb47f25d38385198f
-
Filesize
11KB
MD5a1bb091b9785db647554271a8b1a238b
SHA1a33fbd4ad0dff1ba182758b3f7849b22dd537e15
SHA2569b3e58ded57b9856dd6b7d3af774487371884742d2b00f887babc6ff1b7e5579
SHA512c4ac927bef3f65443475ee5ccd9e1e868b60b8cfab449b4fcea49c05056f26b7550b610d7afa1772b71f6a0da23a1676edd18a3417f9570acfed70ee9ebd02a7
-
Filesize
11KB
MD5be2a916bf667eb32b3e9a1240738920e
SHA1028dafd591b961446e397aff23119576734080b6
SHA256238b610827f7fd1a7988f30259164bb896c9bd369767e6f11a3be603d6953991
SHA512328032a98e5f2b3920dffc522d3e5807112f91fcc810a0b80311137e288f35a08f7a0c2903e83ee7c8ee02bbf03bddd021067c9b87f0acc7caf1aaee44ba8375
-
Filesize
1011B
MD57912d921ea1c5817609ef33d195fe250
SHA19b9f6aff13ce825c60ddde2b3a1a87943dba1690
SHA2569e2f7471475a90ac2299254768d23b3c5c08b482048680f57f22cde3b475dc26
SHA5125ec15cdc6ae73540d54b971017690438160db0b5329cc28e72308a5f4a405bc653329c746134e3a4c7a487c6e4d4e8996ad2a744a3756f3c29ade6f4cfa76278
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727658720680492.txt
Filesize77KB
MD560c99b1d7d5394d02d6a4f5049541ebd
SHA1689ecb23a76cc83e09552716842b853ef7e9c273
SHA2569aa8360cae588f1d79e91e8c3b39917fb645e36d24ad0fa33e775bc30f3a19d2
SHA51234642b54e6ffa616c782c9bcb256bbbeaf3f001d80d67a71e00f926ea9c80298dcce682155013b36e486927b3dc32256cbcf7a10edbef14d73b13101dd601283
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727659161166784.txt
Filesize47KB
MD5a9194ea0f7fe37bb7de298be783d69d9
SHA18bb725bcba0a44ec1c1ad5c976562d3100d4faa7
SHA2566ef636b11ff902657eba83f23e016d51ae360fef144c8edeafc5432afdb98344
SHA5128d59fda66d1bcbfe0cb7da7bfae72ecef2bcef8c62f22819597ca47325c41165a1cb80ad933653c121f155606355f5edac7232e23f995e8ce50703fdb616af68
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727665191668352.txt
Filesize63KB
MD5b46d5a5edf910ffcd16195e41989bcfa
SHA1ff63b377e426e8c08d30bfb2bd37cb5ced8f4cbd
SHA256b06a1286067e0e054f8f5e70b456e9be33595e54985df5f48ff0787b5ab3c1e8
SHA512af3277115efe63a6aec4cee85960765fa32e8eb32009b8bb9777f79b1059799ce025d9dff9b27d67a4bf69fecb065377ea799bb2556f49643dee075a571d2603
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727667861810871.txt
Filesize74KB
MD5635b71873df1976c29122df831570f6a
SHA1c5e0102f61557357baa645cb78830d2cf6eceaf0
SHA256dbe27d8466970206097d1defb0f12f2da715c74bacd64116b61d98a374f0fa05
SHA512a5d0ba41e373842197f427529f4d04aa99ccc661d01b1e458c1e4c196948f4f94fa7b46fafbaadb74b54dcfdacdb3c84aaccc6d2bb64ca9be315a48b9d00aef7
-
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\File Explorer.lnk
Filesize407B
MD587619ecf40553358f2c74c491afc1925
SHA10fe1c09c028e5b4200380d70fdf2cf0e027e2f34
SHA256b5cdf89be0f5a2b6e95932203b819a3546572b05d57ad78ee1c249c97ffb6493
SHA5129a92ed8d118a657a907a94d498301bea49e465d26f6970501b5f0228aea5fd908e43d0a54ee97f4d6e7c9a1dc93e134d69f3a363ffe1ce8f7f1d3650eab0c1ee
-
Filesize
21KB
MD55045fb57000d2eba0b6493db4776bdcd
SHA1f5b82e684f4ef3b8308072726a3d2d78a6d2d57a
SHA256d24b0b6902aba9a08ebaff2a4d1650372566e38c22e16c7e6680869a0cb2bb29
SHA51296b687fd46a8ae07cc118c6048a63f3a9690e4d7653ce50ee8a32a575fc712d60f3c9e8c225e3553467f096987a658857cf89a8e44a3afce2c806b396a0a34e8
-
Filesize
1KB
MD51adacf2cdae6b6d9ad82fe1bd73721b4
SHA1b11ad374423beea4934834cdfb5d4af4ea015fa9
SHA256c3b2892ade1d41e80163b79f6028a312963f524f1c388d4bf27448ec83034869
SHA5126b61333571892e7f05102f0cf07f34c53fe7bb16bf4f90cb60009b81809e2efa1d3abfbe0c49987db091b928bd31bc013510a1e69f6bd418d19e812f73fb01d7
-
Filesize
952B
MD5f690ff8f1a3fa6157c8b4c5757074fbd
SHA1a06aedc04dd3ac525561985e223c6d59a12ff1d1
SHA256b52bda519d461d2cdadec6b9e55467a285cd2d0fc16146934a2e40f283377c27
SHA51225ba47cfc074827bf3986d0f1e993491363984d62d423e50212844455b5dcbefaceb2ac40ae8579e60cc91e1c92ad62c962e799d4cb5e01cf2ae5c90f31a06cf
-
Filesize
121B
MD5a530742394e42076d12a656c62e713ff
SHA135f804e3da6801c74fd3f89b013cb154688ebed6
SHA25698f7fbbbf1e522289bf85bd1041b7a000a75a26506148bf1c4ade3dc5cdf4293
SHA512c5649a1025f517cf023dc5ec6bc63f0dab8448cc5b01fc6fa49a6491c6241c0796d2349353b577f5445eb5254178d2c8f12d6a63265e3be4b5a3df56ef89ef36
-
Filesize
1KB
MD5eb1130fbbdde8679c783de428d40459c
SHA1b5aa5acb5c5ed87452a209a2fcc43b65e9eb7c17
SHA256ab3bae093e87f682d46bfe57f1fce7644719240a1ad001510576d2c9ffb7ee90
SHA512065ceed4938857cfaeee5fe889c2cc706c7bc51d773a3e82bfcebc29826d708e5cecb29a0b8868643f213f86bee66c3cb6e1abdc8a62406eb141d04be6ec17fa
-
Filesize
8KB
MD58932eb3d8d98be3d6b7b816f9b4c0451
SHA1db4c03ef9d1589db0397d90a8ad5f3d2205cf035
SHA256ee2bdaa1fe5f183bbedd703682d5b07ca62830555bf8b20d8883ddd5483b5f81
SHA5124fcd1ca131c3e932bedcbcbbfd56a08d7035296ecab392ca27787b885063a5d65f3b95e1b991d425c445f60586b3bd334def157500cd440beb4958cdeeea11a9
-
Filesize
914B
MD5d02f250b3d163e8667201ac3d22120a4
SHA1c53d171ccfe80b49214c4d4698fd48f26a40fc77
SHA256a4277c1b5434bd3543fec53f3a49547f9e08e235b068eb0661e2ab8e1330cec3
SHA5124d609a7e0acf23671030fecc01da013e6fc69ad48bba19b5f01d7eca2e1a5d8a2856fa308d878308c21270ff67431145c44962bc8efdaaad81a1648f55036a09
-
Filesize
90B
MD5f0e4931ff203bb8f312c220ea7288e52
SHA151e463906e2b9cf85da5d4610aa859f4ac9480a2
SHA25648cbafb9dffd320a878aa4220383e2d61c27027ea9c4b39dcb6cb94a5379dc0f
SHA512d086a205007a19ee9eb1c5eae7fdeb41912c97fed59bfdd98812c9af0077d28c75bee571e702f53488d006e245c58558c37cfb9f3413a553b7fa464f1dd710ba
-
Filesize
90B
MD503d03e51e67959e9455df43c06bf58ea
SHA1a360804bffe0dddfcfd692dbe5b2b977207673b2
SHA25630e7fad37d3498dfc5da9f21cfc57496b2ca43be39a90f9eed2bc6f1ce62b0f0
SHA512f4c58b2ce4c53401cf7b0936268e589d097931c3adb174aefe4eee553653bf825d599c1db3298af43a0187c1acdd417716a696d50ee762d5f075d2dd1e5457de
-
Filesize
328B
MD593b6a746956237bd0a4cb2c056bd7f12
SHA1d51602b5c2a10308c58397d58fc934b54dc13535
SHA25628d9da29ddac12cfa49ebad9d26d7dfe822a947864ad68ebbe3a70ad728f2168
SHA5121305bd5b8d60b3295f2914854e2455e2161452932fc3d4ffd9e7d85fff592ff92bad0f8aaeee836685090d270a62f5646c45930f361c23d2e750c8d1374a5d94
-
Filesize
1KB
MD577bfa2b6d0f3357b523912f66a2d3fda
SHA13d1d9dd1815fbf273bf9192181bfac55c39a2a51
SHA256e491d17e6d41efb534ec224abc42764c4c59917fca6a48cd09fad6c01ec7d5ac
SHA51283b398bbffb018fd9b3a058ab52b7c49e380801304422b77c2cbe18500614e8b2c7e159505f2c08d6b711f75e6930b18322208852f56d51841719978897118c4
-
Filesize
162B
MD5d94aa698224d3c806c512be368d747e3
SHA1abb2ba77fbb3dc23298feeb96d60b0f5c67d4b94
SHA256bb7ba5f7ba5762a5664ab18c3bb4863d9ff118cb6c6ca4e515056983014e0a32
SHA5124309c3e8f226e832cf68e9de2c8d324023b92bde385229b54330cf113a95a124a8493b0d7e75e6e314dad6f1f49af3f827695b754b013b67fb0015de522898e9
-
Filesize
586B
MD528aa555accaf835adfb8031bb9b9b69c
SHA1baded71e444e155d76b11954aa859a1c657729fd
SHA25677916e19fc970aac1f38891440604ea3311752ba17794cce99d082a5d7b3d630
SHA512b4997e8055ffa2a8234e71d15a142e2a52e482d2bc874b1a4abde172fb86b91da47dabb2ca2ae91ee08e722315fff5c0ff6eaf20b97fb8021f4cd3c43ea4eb58
-
Filesize
124B
MD59671317bf2072377df40b0b0113a99ed
SHA13eb6295495848a2a5622a70b9b321e4a8d81f39f
SHA256562c3d3e1e99079a61be54568fa6e2f8e616f0cfeee6863fc90ad21305398713
SHA5120e58c6b3fc0848f83c1f4df45a205eef7927539163e0a98781d0422192c5af56c8ba35f46a289ce4746f506871c3027530e8f6897e10d2cde68d4612d2bd1813
-
Filesize
8KB
MD5fa4cda5e2fe8b69aa1a92d03e9934223
SHA172d69c52c24af369bfc2edd6ed11099f28375b3a
SHA256018881290b2d1fcca6fcf7252612c317af6fc99b8f20a7d46d35fe6df8ef4509
SHA5121953a29be80527c0d8aecbd1e7891b78dda6c23f6931b806a5ccc73942282b913abd4863547f0e28dd9183d032854ffe14f233d912810f58074bf67cd7539a73
-
Filesize
880B
MD5ef239de90088e1d350b01f820fb6ba17
SHA147c157ae8f766b540398b27eb096e0a4767542dd
SHA2564a17b86b63ec28714d1064990bd7030a091c090af8361a79ba41a83a0e569add
SHA512f418b4826de2d79401eab395fd987fb5b0ec4b8b8ff52b0f70c168a5256e762fb4f050df6f64f037d55e3f85286aa3ee72595115259e5f03aa98956e0caf6540
-
Filesize
1KB
MD59f93feddedd0ac9a6688e3f56df12ef7
SHA1d92c3e810449b8bc0e29787c3a42869bac0161c3
SHA2568695ac58e020d220014e1be82ff252c5427af702472827278ff67a39aa9457eb
SHA512b147e74c7f7671506d13fbb9730ed112e5dd7f1b8f2d89ed01ed579046158651adc65c68a06a2fcadabee913ebbd2e2d9a95ee85f4320a24a8b14f7e0d6d93ae
-
Filesize
1KB
MD5c406f0fd5e6cdce4174645cf9543283e
SHA14842dea0f43264a046f199ff24bb7dcaa2dacf69
SHA25690de9d650de93d43e09a0ad9497dce4d52efff5403edff145380a62cf977d676
SHA512cc34127c5f3d239e3e0bf82b3627cd1dff01a840945e5aa0ebcd981c2dd8fabc05523ac482bc4618c3f07bf31270126a3f938b2eee62084f66764542ed6ace4a
-
Filesize
1KB
MD568b2ee4ac55545050063325d980bfab0
SHA172cb1eb84346f2002111bb3832f56959f4c407ac
SHA256e5d288eee35c121e1865a40701811f79635ebeecea263d642a40450bad18d759
SHA512d01473e3f3d8ab3ba6216c437597f8da7424dca2609395fb6c88dfde008928953a7cf876a6046b2b974e857dd6261e2ca975757e248a7305946d8d9400e033f5
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\3 - Windows Explorer.lnk
Filesize1KB
MD5d8879e97121117b950fca061303ab412
SHA13dab22b3b737c46b19e52ebf4f5653f2dc4bd465
SHA256701d3947dc0211971bb08d3d6362c683ad6e02579b7cf6bf536b20c4f256ab52
SHA512932b8586d2ac4e4acfde0e5df652331744c3a92f3fd71bf5b865e17566565adb13f7fbc4d3a9fdcadc09d4f2e6014781e9ad9e099c0d6b8d06eee7f934f5b7a5
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\4 - Control Panel.lnk
Filesize1KB
MD550c9856572bbd54cb823782ffa8a7f64
SHA1348837651046efa6f4d4812392ab9c39843d5ccf
SHA2561161de4ae166ee5048332ecc02c6ac48324494a81f54238627cc2f4c58c03b27
SHA5120b81f517ed2cca345c5d6949039873fd0178dbc671a9ab00c2c1643a003221f36194315a9cd634ae37acb90031c7d241440685b8e27a71995900791e7a82fdb4
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\5 - Task Manager.lnk
Filesize1021B
MD5d09a8608f3780e83eb309724e6aee809
SHA17afc1f637514f21246e4f2156758f809b07648b2
SHA256dd91f99d660ab30ac6c1c35d606e60213b0fe5077f9da8a0113ab96ff29ffba1
SHA51229e298b6d748d11a85b6c1758192d36fa4841cf6908e058f7c52354c98dd2c6918911c9a66a8ca95bc4b4f0c0c0c8a4d2abbca0aa67a724f7a5830cd435e19fa
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\01 - Command Prompt.lnk
Filesize1015B
MD5c2ee7c4c89b2c627f9eb71cb4b4b4465
SHA1eab4995596e1419fc00ec374e11f192828b721ea
SHA2567b7dfc76943776b3ae4c5af663985045e6ddd811eb87aa03cfdab9d2631f1743
SHA5128c5c438193bfb60462f0c82931e0eefa2985c621a2bb66668fa86222eb93ca5fba91c141df53a38d56479c54fd9c3303ecb8bf8bd3ec385c248ac31aa0efaede
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\01a - Windows PowerShell.lnk
Filesize1KB
MD55b60eae7b5a689e392bbce27febc3858
SHA1f2342c34a03de3fd01ebaa29a5b9955f1e56492a
SHA256da643777b1cec5fc6ac12d5616e0b147d74e3570acf2a23978af2428a2afed00
SHA5124790b049fa51802f5bc660eea53a4ad41de2e6752813459735e8de667a780d41d088c8a3fb6f9e52a563f0a4f648595fa2715bdaee8c1a9b5862cf26def26c70
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\02 - Command Prompt.lnk
Filesize1KB
MD55545bd4c46fb9b81ebd608d109f906e3
SHA155eb3187e84d47b260154b4405d4ee471e0ed5c9
SHA25610e8fd714865e45d64f3d5ef546b0850c87aa74c028ef90d5b20e138c70c9574
SHA512799d4964a1595f12001b5d342d7dcfe1935f8166066b932435859d754e95af5bdbb92413fd433820c974e3517698fe8c34e9058b2c630549815261f443af19b5
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\02a - Windows PowerShell.lnk
Filesize1KB
MD5cdc6204c9d3a83df00539c6ebd343d45
SHA1cc18ad613664b84f20eb733ff5c7b8c4cd8937e1
SHA25627d3970463cb66c847b74affb78eee5a9b5d9607793ad65b681dd106cee3c140
SHA512b4f8669d038ee7f2376d9e084b3eb0d82a1fdcb4c619b8b229d76ff15452425e4a4460f8ba8e5850766b656824cd0fcc854d7f643a0d8cf95537ef2545a29b07
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\03 - Computer Management.lnk
Filesize1015B
MD5d992c137239647d17a7d1ea16c3b5f6a
SHA18b418bd8906fc238df27dd72cf5c213a71b764d2
SHA256dacb8c18d7b4b48678b0c8b97becbaeaf28f5b718681288cffefa2ac9ee07cb1
SHA512d485b3551bffba4c9c12dff89bc265bb44f8d2afe87a348a669b8f7a33c94fa0242b352f2275fb1ed82cac275c0c948edd202ae9c64744d8845ceec73111ace0
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\04 - Disk Management.lnk
Filesize1015B
MD5d8306822d97e293666caff0bc1353a4b
SHA1031a49bc0dd8f1a6a47ebe7a32477b93c328b6c2
SHA2564feddd3b7c3142254d3d41cf4d5c1849a2d5b83971904f7565cd939d93d29148
SHA51239b36eb570e7544c44256f9a6926974a5839ef89097b68ab6611ebd75c0af61c255766be1b105d0e7f3f86e3d57b0baa229e9180472ad2f46b4368cefa8f788b
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\04-1 - NetworkStatus.lnk
Filesize1KB
MD5e3a39e1a44803abfff21fd0ade6b7d46
SHA12f8084a48e5b34e3249c20c519b13d2f4cbebc7d
SHA256fe91f98adbc9516e90a745a5af3ab0ca836aa5e15a1329f05801eab35233b492
SHA5121aa6fe23b6942e0f72d7fe1b7a17473b39497105d2390dae7d6968c6d6f5d01b445562c603542921147c8e2b88a77ecee8dbf9c6539de0ea2f94ccbf7bbcf108
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\05 - Device Manager.lnk
Filesize1KB
MD516daca036e6ffd638058c3dd084a2334
SHA1693405e2297731c42fadbb93d657fe63e106331a
SHA2561ba0337a138102d51da638b86ce6e9b53141e4722f674c710ac26189825aa6f8
SHA51261172aed44735dbc0a4d0f5165c5be32ddbb5d4d5ffba4a2d0a21cc27147786ec272b7cdfe9f709cd6f0092f6fd28feb804b1176fce46af840f9d0ae875b6b25
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\06 - SystemAbout.lnk
Filesize1KB
MD5f8b6647e83ae480cb9bc028a71ff2fc3
SHA15c20138ea6eef77f81d940deda0f361a020adce2
SHA2560bc65071b84b2e657c5f54e73128d24da62d11f8eda146caedcd6d4befd48fcd
SHA512b0c6728263cbc1ed472929ac1effa9b592235a82a40e7277882a6ad4e9767c011ca4441a1fd5ea0464c227c76b6be70f2c922c1bccdf201044cb5e1fa4b0a6c7
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\07 - Event Viewer.lnk
Filesize1015B
MD53759b1e60c1cfa682ce150c104303914
SHA1763f595dd3b37b0245d38c2255f3ff063dfda7d9
SHA256362ae5df63ca0e9dfeb84df1b7ae7f06fab555686b15fc4a22785fc49fa87360
SHA512465db531b54039328df9d76326c2224992dc369fd7603341719fb367ecfe0ce51e47510261f8f6be4c298c8ab815ce9f3e978688514564f38e925d095eb65315
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\08 - PowerAndSleep.lnk
Filesize1KB
MD5be4fcd9d909cbf101025286b4b5f37de
SHA17fd3d622e25946cb7ea8f0b26384f168acf5199a
SHA2566b5e9f3992e204662ca34654aabf817342d90546cce7583fb1b8aad38857936f
SHA512ab277f06eddb90ac6e654ba056170a8528dc32e41ce5f01e881f01b48816516d9efe0aa318f410e7bd157d563d74571b6a9d60abc5294c26b742722ac1844213
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\09 - Mobility Center.lnk
Filesize1015B
MD5764b71f8f2773e172da6c2ddc7ba6122
SHA15641fde13c0b87659f208b89351ce46a0fcc1d3a
SHA256f6dfd43e6a909ab9f74b961cf7059366ef3e014fc2538a654e4c0574a9d9c1d2
SHA512b20933e1d0053b9430c0b652391fcdac98c0b3848074450e9eee25e97d1a5ade43c506697b0e85f851cc036174e620e5749941a1ca2b9aec3e01a33b39d0a444
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\10 - AppsAndFeatures.lnk
Filesize1KB
MD50376b2d2b4b59dd5a3a46ef43918ad16
SHA1a36401b16751c4f8b93b74f8eb2e10cc148bc4eb
SHA25602a2a9746cbe0ccda6af55a2571d4f8bd86d33e768492b33a108a70451f42be6
SHA512b5e8d4639af5919c4bdc6498c553d64fb91c91e7e2c6400bd3f8ec0d98e14121aa3cf7cd567594b64430a15f6fc4e361f8d2889576ed26fd3a077270b44327d7
-
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk
Filesize352B
MD544fc159631baa8839930e611ad27a0cb
SHA1c89dec066719c22f9aa766fc7622a07019ed6ede
SHA2560cafc3a740d1648d09f9ed996ccdec5001b256cdf6018067ecc0cf3dad09a057
SHA5129e63c64177f5dc1c56a0fb8e6ba20d51c9b0eb3806ee3e897567598f3a6278530b246e2ea28e268ac21234592f6b0a46de3ecf9e796049db1e9b5cff4329f03a
-
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk
Filesize334B
MD58ff88e7fb76748e1b0e0289c2afeafbe
SHA1ff74dce2ec2ca13292ce407a78e78bcf66c51bb4
SHA256c725d77c9189227293509638130fa3df37c258f2798896adee8a970ac7be0a8f
SHA512b610f98e5e5793486058b8db0b6e7381d9f481841daf2e5377cbbc273ca309d3bd0336fa42d92ad6b414b2eabe502adbda7ea376991caabc70cf77c8c8602e2e
-
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Magnify.lnk
Filesize1KB
MD58dee0a72a6bde81f81901ff6998d9d90
SHA1f98ac65885f2b74f668cf6043450fba3b69e39f4
SHA25658a574ecd05d84bc299c3af248952cd50e181a5fce3837ca330e7961b23ded8b
SHA51251b5632d5629600a22fce5c6a8efb196421c7235edfcc7bef228293cd480f45b7bfeb42eff16a504d625b80f534e23c83154f53769bcdb899be06c7f1a8daa90
-
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Narrator.lnk
Filesize1KB
MD5df7765cd4ee2d46ed428b396751204b2
SHA1fbb349ecb1fb19a283c5b8dfa2a09286d1989e19
SHA2565c432b8faed0619764a275e553ce466c8f4a95c424625d95a99afe7b1058987a
SHA512cef9da9361bb67e1f42955cc85f25a110710ad2cff4f46354228dbcbb5c16235033988de6ce5fbb497771a9f193e3f76713019e426de447d469b96fc0a412a92
-
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\On-Screen Keyboard.lnk
Filesize1KB
MD57df89030362d4ee5a5883612efc67112
SHA13710a8f6680c2a28d8c42ef41f6a644d3dcf4b1d
SHA256f2094d9601c8bda5572d3a423af3e6009b2543e300b7a90f69609f2855b27281
SHA512af81759738e44f5bc7a2ce2109a0498077a1836fe97f15dbc71efaa5a2c65ed62935bf8c2b24c782dae31b149562c42f1a8e9e1f142967bfb47d21aa29e55601
-
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Administrative Tools.lnk
Filesize1KB
MD557d17c4703dc1084cbefefd5bc19cc34
SHA171dc1a92cc274901a1b537410dd915f15e7fd977
SHA2564c13b4a7a57f94e77b0402bc4779378d99e788efebae038e181c267b73b50486
SHA512048eb249e89a2fe707f31e5a2b9a78e8f6409142fdeb04e17ce659dd05ff885caf3bafbf5682850f1ef99afede3c8b7761d26b87e7a48f1852056e473ad8eb57
-
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Command Prompt.lnk
Filesize1KB
MD59aa853132a878b4edc3e4945b375f8c2
SHA1e46d309b8a4c9199d966c02e613b4c894ac3e9c0
SHA25694439feca529cbec1d9cf080e67304f1989eb4e3f820328f3fdb4bf190bb64d9
SHA5129fc9d59d6e9f7d0d2a3be50335749e6d1d9f6d7bd79921fc063faa0d682f8a91953c0ff21002daba96703096aa7d533990fe23aa91ace2a3f1fe7ea9eb2ca784
-
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Control Panel.lnk
Filesize405B
MD519d94794c224f11e37c5f8e21e08dfdd
SHA164a98fc7797ed1f065ce87ab08e258afedf40f9b
SHA256ad02d1c5a9ca1b5329d649f82537286799df9781d436dae4a6359281fb46e613
SHA5120f33d91f8ac26960299cac900bd87db127545252bda520bae57318643eed3ddc0fa756114bb305eb5a320a828e91791a15ed4d9b4a7ce1d76001186218707d08
-
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Run.lnk
Filesize409B
MD5dc6a8cd11e5ddb444f20a31597b03bb8
SHA13f62ba759c2e1907b1b9ac3f08e2c2a5b10e09d5
SHA256999f28a913458a0fbe8e9fd203d131bc8fc0b820280cb668e5f5e322138b1796
SHA512b9f20ad14d51aa4fa55437fb426d4a13209e67ed9ec0dec09f99d82c0f738b29511d689554a9302428f0d702429a075665913553e27d963228e786435d3ffcf2
-
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\computer.lnk
Filesize335B
MD5ccfbf27e4469fddee25733ddef775374
SHA1e3cdf1943f59a12a177acf8ac0e9d46e6e4b1109
SHA256828003af8cb5d775ecd05374b025f8c20f34bb66c751dee8f670e56750f17cb5
SHA512e9bcd93ade724373930993f97723e79162445525f5c38e27370bb4ed76a1612736b975aeba156fc82dab2b702cad596cccf74bd3b77b7edbdaf44c552bbc867f
-
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell (x86).lnk
Filesize2KB
MD543018aa4a6758e3dfa491a42beb3b368
SHA132f0b3d4913ad30d1c9ba5835f803e7e8c60e751
SHA256c5f177ced6ca139e93cd21482bb151874c26f9a0507b4595aa2b6f4c90d9ffab
SHA5122400c7a72602afe99f9e7b5669a3e65f2cd3088f50482dca6e463f6181abf365aa363aab2904c09b0d3cbe6836c29443a8ff8dce121ffb857ee07ed1e6766ddd
-
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk
Filesize2KB
MD5ddbf5668ffd14a4ff0e3f6cc407debf9
SHA1521b3aa78e6abfc1ffe7699b20c95fad826735db
SHA2565c5c5fc6823d93d17600198ea519d49063f36f73af3b865d1e80118248f04331
SHA512c4609d99bc75f48fd020217c7f929e3202a2ea6fec670064a65b112e91b2f44f55707f53481a651bf6ea26364a03011bd397107733ed3284a972327db4170f5f
-
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png
Filesize296B
MD5522314484c5cca93f9c8f14c6c81bc29
SHA12c301632de9ff0dfa3deb1df223331383ebe9dba
SHA25639b931ad6a4077a9e7bfa374dc959711627362652777d75abfecfb04e3d3aa22
SHA512245c0abffaf24ac9b56b622cd0587c6049073700e5192cbdfd885a18adfffeea21c6e55454abdb49e81c1e9f1a43afbecaca43a9dc034afa1105f941f4cc44b9
-
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_contrast-white.png
Filesize276B
MD55f82ecb768ea52ff8fd49977fa7ef048
SHA1e7f7a994996fb6211e8bc9fb88513191f8cd5679
SHA25669c729350bab6849c4e13dd8f3f7d12ab06ef17a6873f92b87510edac6fdc77a
SHA512a286dfc7b9db956e0b038a2e7a3c3e3d6fddc67fb4bf785ee9f5fa0783e64d1bfbcb1922bbd05c33a3cea8e0f76b0dd43d66fff966e7371ad463a2d503037cec
-
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png
Filesize296B
MD5f406276ad837da11112a97fd4d8f4ae9
SHA1fa46fc7b64a3b76670c833dd4712b051b0cf2b5f
SHA256978c4fc44c563f1a031fc85acb334f889cdd1974886ef33b6dd08f953636673e
SHA512eb96284407791c0833aa54cacef19ce3c2e6a8df8b5ad66f0930c9137782aded5b9c369594bb71f441dde0bd806e249d9f4c5e782d68e90d735c86b00622fa38
-
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square44x44Logo.targetsize-44_contrast-white.png
Filesize276B
MD56ec126626f34fd9843dda85ef42b95e8
SHA196529222b3574497ed6ae4a86f7f491f42fe9c48
SHA2565db4dcd9e028b814310d703a642a120bddaf00db723954ba68e5e0fc162222be
SHA512546e034df0098c9e81f8e2bc2a39f7c5c3cc7a3a53377cf0825046d559111ef1d49060b67a02db6310787bcc1c853819d544c6a1e5b62a3fc2cb37b21047fe1f
-
C:\Windows\WinSxS\wow64_microsoft-windows-onedrive-setup_31bf3856ad364e35_10.0.19041.1_none_e585f901f9ce93e6\OneDrive.lnk
Filesize1KB
MD5923efcd32f536ecb43b14e4fba8be3c8
SHA1cdae707c777d178754b91358d2e1dbf6f85051b2
SHA2566e89dc0351897740bf26fad1bd818e791efa4fe1d0badaee3250090ce1f7575f
SHA51263ff0643d14adcf66f1b5a52596a18c3958f78dff0f5cbd5dda0fe75a904c8e04a6f3b6c09489b058e1ce225b57dc6b9293caeaf39e6d7480c0b28b578e413bc