Analysis
-
max time kernel
423s -
max time network
428s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
29-10-2024 05:57
Behavioral task
behavioral1
Sample
78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
-
Size
12KB
-
MD5
78333fb57f5787544e1086ec1afa7e2a
-
SHA1
ed97ce47e2d513ea809d910603885130a0020ab2
-
SHA256
e566579c89af9f90d139c687c881559b7ab5eb23279944d72c7be108cb2e7290
-
SHA512
d40797abcd95a14fca363447ad0d6eeb09259e7f39e8f8a5330e0c429d85ba7e73d22a783356684431fc6cc7b9d54c9f288d951ac6a45f49e50fbca4d6a195cc
-
SSDEEP
192:u/TrG62a6B10k3g4fXk1iTV3HGc7EkpAqEjvu2q9C/YpXnAITZfPtRM/EYev4:uebFNw4Pk1itKkpAjjI2Ypdm/8v
Malware Config
Signatures
-
Renames multiple (2499) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Drivers directory 9 IoCs
Processes:
78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exedescription ioc process File created C:\Windows\SysWOW64\drivers\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\drivers\gmreadme.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe -
Drops startup file 1 IoCs
Processes:
78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\NQT4Y7r7VZ3jI59.exe" 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe -
Drops file in System32 directory 64 IoCs
Processes:
78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exedescription ioc process File created C:\Windows\System32\DriverStore\FileRepository\ialpss2i_gpio2_glk.inf_amd64_dad1e0a2b185e32b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\netrtwlane.inf_amd64_20caba88bd7f0bb3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\odbcad32.exe 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Windows\SysWOW64\Configuration\BaseRegistration\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Windows\SysWOW64\Configuration\Schema\MSFT_FileDirectoryConfiguration\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\storufs.inf_amd64_a7a5b507fa22251e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Windows\SysWOW64\IME\SHARED\res\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmracal.inf_amd64_dd534e815632509c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Windows\SysWOW64\InstallShield\setupdir\0021\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Windows\SysWOW64\InstallShield\setupdir\0804\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\user.exe 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\nete1g3e.inf_amd64_af58b4e19562a3f9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\netpacer.inf_amd64_7d294c7fa012d315\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WindowsOptionalFeature\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\amdsbs.inf_amd64_e2a1e49127fb17ef\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\hidirkbd.inf_amd64_20ad4886826af1d2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmgl010.inf_amd64_b4f4b670a266fda5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmsii64.inf_amd64_0f02175b17cd3f66\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\fixmapi.exe 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Windows\SysWOW64\InstallShield\setupdir\0019\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\NETSTAT.EXE 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitsTransfer\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmjf56e.inf_amd64_07bca0bfd5173050\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmminij.inf_amd64_a85c8e1fe15a9532\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\netrass.inf_amd64_7f701cb29b5389d3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\fc.exe 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\MsDtc\it\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ServiceResource\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\PING.EXE 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\WSManHTTPConfig.exe 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\attrib.exe 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\c_linedisplay.inf_amd64_a720ddb820f10790\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\c_monitor.inf_amd64_f02375bf47a4adb2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\netbc64.inf_amd64_b96cdf411c43c00c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Windows\SysWOW64\ar-SA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmdyna.inf_amd64_d89605b6b478d768\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Windows\SysWOW64\InstallShield\setupdir\000b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\TSTheme.exe 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_RegistryResource\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Windows\SysWOW64\Configuration\Schema\MSFT_FileDirectoryConfiguration\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mausbhost.inf_amd64_34c86c15777c913b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\usbcir.inf_amd64_a19f675674962ae4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Windows\SysWOW64\Speech\Engines\SR\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\iscsi.inf_amd64_c089962740ea1f84\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\netsstpa.inf_amd64_e76c5387d67e3fd6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmgl004.inf_amd64_189d0189716edeb1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\prnms012.inf_amd64_707d3849370b9d23\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Windows\SysWOW64\InstallShield\setupdir\0006\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_RegistryResource\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmcrtix.inf_amd64_e3ded2b26d662526\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\wvmic_ext.inf_amd64_34d742f3550dabd2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Windows\SysWOW64\wbem\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\credwiz.exe 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\netloop.inf_amd64_762588e32974f9e8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\netwsw00.inf_amd64_24d55504ae3587aa\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\fontview.exe 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\swenum.inf_amd64_16a14542b63c02af\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\rdrleakdiag.exe 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Windows\SysWOW64\wbem\de\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\driverquery.exe 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\hidir.inf_amd64_7bf4a320e4ec8b3d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe -
Drops file in Program Files directory 64 IoCs
Processes:
78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exedescription ioc process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\RHP_icons_2x.png 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\jdk\zlib.md 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\contrast-black\MixedRealityPortalAppList.targetsize-32_altform-unplated_contrast-black.png 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\osf\office.png 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-64_altform-unplated_contrast-white.png 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\LTR\contrast-white\LargeTile.scale-100.png 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\kk-KZ\View3d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\onboarding\landing_page_search_for_friends_v1.png 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\StoreLogo.scale-200_contrast-black.png 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Place\contrast-white\MedTile.scale-125.png 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Work\contrast-black\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_neutral_split.scale-150_8wekyb3d8bbwe\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\63.png 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailAppList.targetsize-256_altform-lightunplated.png 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Car\LTR\contrast-black\LargeTile.scale-200.png 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_ffd27a_256x240.png 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsSoundRecorder_10.1906.1972.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\VoiceRecorderSplashScreen.contrast-black_scale-200.png 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Images\thumb_stats_render_sm.png 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteNotebookWideTile.scale-125.png 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Yahoo-Light.scale-125.png 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubWideTile.scale-200_contrast-black.png 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB_EURO.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\GamesXboxHubWideTile.scale-125_contrast-high.png 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\OutlookMailWideTile.scale-150.png 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\EmptySearch.scale-100.png 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-Yahoo-Light.scale-150.png 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Program Files\Java\jre-1.8\lib\ext\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-white_scale-180.png 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\[email protected] 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\LibrarySquare150x150Logo.scale-125.png 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\AppxMetadata\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\sendingDark.gif 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\hu-hu\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.contrast-white_targetsize-80.png 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\OutlookMailMediumTile.scale-125.png 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-60_altform-lightunplated.png 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-Outlook.scale-125.png 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\images\themeless\desktop_acrobat_logo.png 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-moreimages.png 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\StoreMedTile.scale-100.png 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\en-il\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AlarmsSmallTile.contrast-black_scale-125.png 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteSectionSmallTile.scale-125.png 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarAppList.targetsize-24_altform-unplated.png 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\GameBar_WideTile.scale-100.png 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\LTR\contrast-black\MedTile.scale-100.png 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RADIAL\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2018.826.98.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.scale-125.png 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteNotebookMedTile.scale-125.png 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\web_edge_permissions.png 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-72_contrast-black.png 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\SplashScreen.scale-125.png 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-black\PeopleSmallTile.scale-200.png 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe -
Drops file in Windows directory 64 IoCs
Processes:
78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exedescription ioc process File created C:\Windows\WinSxS\amd64_microsoft-windows-wwanradiomanager_31bf3856ad364e35_10.0.19041.746_none_1e05069df0a0b9fa\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_wvmgid.inf.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_0bc1967910361b7c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Windows\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..erservice.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_90b38923514a1ee8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..erservice.resources_31bf3856ad364e35_10.0.19041.1_en-us_a9e1a31e2b8ad7d9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.19041.1266_none_fb76f6fb7e78a373\InputApp\InputApp\Assets\SplashScreen.scale-125.png 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core.resources_31bf3856ad364e35_10.0.19041.1_de-de_e1c7c5c5782839e2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\23\storage\remote\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..fe-catsrvut-comsvcs_31bf3856ad364e35_10.0.19041.746_none_50bbaff9fead3fc2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-dafupnp_31bf3856ad364e35_10.0.19041.1_none_77ebd8bd66304295\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..-migregdb.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_1925fc8eb40b956a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..qos-pacer.resources_31bf3856ad364e35_10.0.19041.1_es-es_a107b29eb32c7d51\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ktmutil.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_05f0d4c4fcb1ed38\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Windows\WinSxS\msil_system.directoryser..protocols.resources_b03f5f7f11d50a3a_10.0.19041.1_es-es_c81e4ff826629569\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Windows\WinSxS\msil_taskscheduler.resources_31bf3856ad364e35_10.0.19041.1_it-it_088663074bca4863\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_hyperv-vmsynthstor_31bf3856ad364e35_10.0.19041.153_none_93179d83c79f443c\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-stobject.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_7a0def3fa73e2194\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..ork-setup.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_c1a630e9b03c73e4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-store-runtime_31bf3856ad364e35_10.0.19041.906_none_cf09149f9e0c2055\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft.powershel..nprovider.resources_31bf3856ad364e35_10.0.19041.1_de-de_5dabb81c64e4fcb5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-w..emassessmenttoolapi_31bf3856ad364e35_10.0.19041.746_none_cbec57388aca6a86\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-w3logsvc_31bf3856ad364e35_10.0.19041.264_none_6ce48e967146bc41\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Configuration\dd3156eef1bb1556bc78b02b7fb822c1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_c2wtsres.resources_31bf3856ad364e35_10.0.19041.1_en-us_91ee1e4d8988704e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..ectionsharingconfig_31bf3856ad364e35_10.0.19041.1_none_707bfd8a6857cf07\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mfcore_31bf3856ad364e35_10.0.19041.1288_none_6ff4f71140c21686\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ctionflow.resources_31bf3856ad364e35_10.0.19041.1_it-it_dcbb9c6feca08c0d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..memanager.resources_31bf3856ad364e35_10.0.19041.1_en-us_5a8499cf2748e5aa\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..rting-adm.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_a2698b0bd3ac09f6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-installer-executable_31bf3856ad364e35_10.0.19041.1_none_ff72825025776920\msiexec.exe 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-m..nt-browser.appxmain_31bf3856ad364e35_10.0.19041.844_none_d9eb415c5b9dbe4e\Square44x44Logo.targetsize-16_altform-unplated.png 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-photometadatahandler_31bf3856ad364e35_10.0.19041.746_none_b2bd567f78b43ac7\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\cache\Desktop\22.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_hyperv-compute-guestcomputeservice_31bf3856ad364e35_10.0.19041.264_none_6b6699b671c8f5a8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..nager-api.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_d383ab70e06443d4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-microsoftedge_31bf3856ad364e35_10.0.19041.264_none_ef195f564f00d259\MicrosoftEdgeBooksSquare150x150.png 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-u..e-ux-musscnhandlers_31bf3856ad364e35_10.0.19041.153_none_48909151fa03356f\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-management-oobe_31bf3856ad364e35_10.0.19041.207_none_504b6becabbef9fe\oobeenterpriseprovisioning-main.html 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-a..ntscontrol.appxmain_31bf3856ad364e35_10.0.19041.423_none_6c3451a09cba3850\AccountsControlHost.exe 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..name-virtualization_31bf3856ad364e35_10.0.19041.844_none_df441a3d8051d0cc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-devicecompat-adm_31bf3856ad364e35_10.0.19041.1_none_146ee29adbd1c61a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..l-keyboard-000d0c00_31bf3856ad364e35_10.0.19041.1_none_c96b345a7d8e9406\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-n..iagnosticsframework_31bf3856ad364e35_10.0.19041.746_none_c4a8b76973fa3dbc\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-rpc-ns_31bf3856ad364e35_10.0.19041.1_none_d28803a5a6fdee7b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-microsoftedge_31bf3856ad364e35_10.0.19041.264_none_ef195f564f00d259\MicrosoftEdgeSquare44x44.targetsize-48_contrast-black.png 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-systempropertiesremote_31bf3856ad364e35_10.0.19041.1_none_4ac6500cab2b2113\SystemPropertiesRemote.exe 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_uaspstor.inf.resources_31bf3856ad364e35_10.0.19041.1_it-it_cd99dde8b91b1930\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_system.runtime.caching.resources_b03f5f7f11d50a3a_4.0.15805.0_de-de_198f3718ae1e4287\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..-wow64-setupdll0019_31bf3856ad364e35_10.0.19041.1_none_a444f6a54f879c40\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-winrt-windowsgraphics_31bf3856ad364e35_10.0.19041.1151_none_7e9673af5a37cb00\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Printing.resources\v4.0_4.0.0.0_fr_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-smi-engine.resources_31bf3856ad364e35_10.0.19041.1_de-de_8eba0f34073fafdb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.19041.173_none_6486f23c2831aaf3\r\InputApp\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f...appxmain.resources_31bf3856ad364e35_10.0.19041.1_de-de_d5cdc4278cbb8593\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.423_none_9de80b9d881a1ebd\columnmove.png 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-pnpsysprep.resources_31bf3856ad364e35_10.0.19041.1_es-es_86da2505d58a6a6f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..ofile-cim.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_57a46b01b4298e42\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.I7676db1a#\9761aa02e459394769888f74d97b844c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-v..2provider.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_483ca4059c703dc0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-directx-direct3d11_31bf3856ad364e35_10.0.19041.1202_none_6ecd2612b74330f8\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Instrumentation\v4.0_4.0.0.0__b77a5c561934e089\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_dual_mdmgl008.inf_31bf3856ad364e35_10.0.19041.1_none_ffaa556d02508b46\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_wsdapi.resources_31bf3856ad364e35_10.0.19041.1_it-it_5dd5975bcef2f854\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe File opened for modification C:\Windows\SystemApps\microsoft.windows.narratorquickstart_8wekyb3d8bbwe\assets\NarratorUWPSquare44x44Logo.targetsize-48_contrast-white.png 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe -
Modifies registry class 10 IoCs
Processes:
78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\UIAKDSQQPLXISEE\ = "CRYPTED!" 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\UIAKDSQQPLXISEE\DefaultIcon 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\UIAKDSQQPLXISEE\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\NQT4Y7r7VZ3jI59.exe,0" 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\UIAKDSQQPLXISEE\shell\open 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd\ = "UIAKDSQQPLXISEE" 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\UIAKDSQQPLXISEE\shell 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\UIAKDSQQPLXISEE\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\NQT4Y7r7VZ3jI59.exe" 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\UIAKDSQQPLXISEE 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\UIAKDSQQPLXISEE\shell\open\command 78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\78333fb57f5787544e1086ec1afa7e2a_JaffaCakes118.exe"1⤵
- Drops file in Drivers directory
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4532
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\aic_file_icons.png
Filesize50KB
MD5c02171d9d92b2a24161eb50c733ba09a
SHA161b6ee93e7de75d27d881b443d4dbc6dc11000d0
SHA256fba366b1ada8be71ebe9b74bb3529bab0a452fa754bb15a151bf57a245f6d096
SHA5126d6b264a433ad4da397a7b08ca90bb23dea25d47769e1a30396157324624e8cc8ac01ff89dbc49f681f5a11db20e0a1e33135381b455a3bd18ab874bdd49adc4
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions.png
Filesize1KB
MD54b05c080081fa99cc4b2f69cad73adab
SHA1a899f39d5514533150400aea4b95342f78cf6b90
SHA256d37f0bd106317133bac8a627e9d61273ee372d83ac1d5fdcb66a1fe367a9ac7a
SHA512f2fd4cf0bd9ad084e03b26b86a7ae3009be556fa3995d810bc26277f5ee1c403e9c98fdf08c76097f1ceacfe23223aa05db25451139fe68f8b6997156719654d
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions2x.png
Filesize3KB
MD5fda0f3fc5c688bf2445af9d092f491fc
SHA1010631119980bcabb085c550bc38cb85cb02a6d1
SHA256a588d3bfe9dea97e0b90ccefd93c457619a2d968faa9bac20cf5f390d1819b31
SHA51270920a6dd6ec9145dc43ecc01ff0904694c15d26ee172e81892d3b8385631a90202ff3b1b1be9af7fb871df192ccf8de4de8d705a7211e7ba4838ca816f18a98
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons.png
Filesize683B
MD539b817ac8a4f147b34c9de6dc4240c86
SHA1a42cd69e20a5aca59bba1b6f6ba361c8e44e5d53
SHA2568f35fb61e1b23ec0e4c420bfe8f2c13ecff966ef1d521044728e2301b889c2f0
SHA512076864940a8ea05a34771f320bb71d6fafc094db8c9682d15c9a809425e7c3495ea8f8e2b1fa9726146280d33fade80e2a7b78da243aa98e9a5d2664d8b5d0db
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons2x.png
Filesize1KB
MD510289f80be647c3e7aa5289e71928549
SHA11fb00ee780d59029ba85055d9e917e718b875585
SHA2566a977f6c071c6504b0f8f4bc62bb2792cc047139476e7fc501766527abed933b
SHA512b04134a235e0488fdad8873f9742f092d0625fcee222fa6839ccde9221b07d82ffbe4b57bf0c5e7709c3cb2b2511a32fa298d9b99a09f4dac84f7f30237104a2
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon.png
Filesize445B
MD51900739d533cfdffc7b07935bbc1a6b1
SHA1e73ede722b0df6e8df14260ad084509816c0f674
SHA2564226764277db1a806600f78843f42b501df2546a2563b33bbc40bf120c958f33
SHA512940148a2ab5a7255afe558e5b69eaeb3ebbde7de347044a0d1d5568aa41ddb086d8a583f8025555a70447adc9777888d10bbe721c530ab1165314878547a8d36
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_2x.png
Filesize611B
MD540c7c8363041df08695b130b9d7cd2cb
SHA1e186f708f37a85d4b6bc79011b4166a91f6789c1
SHA2560f0de8ac9c2b0b6ae1f0d52ad5eebc3ca3197ac3c96452579abd6847cccfb921
SHA5129a684e85fd4b58d88fc274bf8dfe1f87b7466b3f7bad6a92acf9fe36a417dbaef8d957e131f78673aedec71d5c279c9bf36e9930f1412b21436492a74b29a711
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover.png
Filesize388B
MD547a079a5d432148908951271ab14af3d
SHA1f0346b45cbe215fe395ddf96cb5d02964f22ec7f
SHA256fd7068c8d2ef37c91179efbd80883177983b3f3786b2d7a9fba9a951373e7212
SHA51214502460f14ef22b94aba9426ddc456e4db5f2c833f9237183d76dc4838cb59456d44546930d81a63775555ff0b43131a26da35a4923d12785f4486ae5963383
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover_2x.png
Filesize552B
MD50d402bb64ab031a9755657a5a4392b8a
SHA1cf9fbbe8b34c8d5aa5abb0f15de2142dddea6729
SHA2560466d3e9fb06d4d39e3abf87a92edcf820fc56c015c90537fce6804a4d1f6ad3
SHA5128c161ba9f400402f92b9174b5cea00ba9b721fb151fc983879f12667e01f093161ce73710fcbb1fb772a24cd3a62b1b461c77011f7d39269e656a2f54ccdf0df
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon.png
Filesize388B
MD538c6522cce6b85e43517a9a819d381c6
SHA1dc0f0745508159e28d39dc00b048f9d416166e26
SHA256ca5bf55b246d3f24ef4630b40ca6cdc1b310ef5afea6fa1cfca346289341a121
SHA512c8b99edb1b7552bad7c87d419229301e894d3ad2deaec375d53ea433d6613d23c63ab8f576d7947155e1393c53a160088dbd802ccef62ea826a61cc00679dc62
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png
Filesize552B
MD5b0b14ecf91233a6bfef023c39c75b0a4
SHA1479d840b42de1170ea75b33c9d4c3da98d43a3cc
SHA256e23a2390bc801092a645106c860d64ed5d8811fa378d73b356a19b936f935272
SHA51255962227ab43b663e70071be5dec666e5de686f22f72420bcc74f9d5cd5506ff9d486804ca8f91b6ad67723681250dcb146881b38542ac1d60fc6432183a22e7
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png
Filesize388B
MD5f16fd437a8b232c302f286e79c524126
SHA1179bc5ae068d3154579de6b2767f079efa642b20
SHA2568aa9c29ed3e011bcf1418cfab73b9354cd26c4646d1f88d30f168587ba651433
SHA5122f5bee2eae44a70464981946f1dd2fa73bd49f9f7566f26713d5933e19e8751262aebec9772e0d756dcd7ac44edfbc22f8195326fc1eed5e51841deec2004c64
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover_2x.png
Filesize552B
MD554e027f66686bfd1862565b22e711df9
SHA1cc929f5d23957a922a17faf46b9642872cd2146c
SHA2566cf24d0caefea82cf3bb51925ccd30fa42fc84282c49f2d74ae4e001169343cc
SHA512f8995398b8460daa2092997b2365aed437004e17b97bf2bb33ba6acca89bafa281f97e970a107e2407f4faea1611d8b8951982b191e5684b407e7235e5774d7f
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons.png
Filesize7KB
MD5b289b7901eb30c42b1724c0862e02e8e
SHA1d633147fff554bd3abbea0325af4a069208e17ee
SHA256ad09b6352cb9fb50fe69b4855abb981a0bb162b359480d4c52d115eddc2a6b9c
SHA512bcd8e855b1bc56c77d80a6c733ac15c2629dfb02eef2c0061e68ef2e35c4b0b9c2392b3b38dd4335232ce73abe4695e28d0164657c58224bd2122395fd8e1084
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_ie8.gif
Filesize7KB
MD5b9a269c848df7d6b08bca37aee9a48ac
SHA17521b8593b6f55c4331634eb2acc92da9392e718
SHA2562bc0d44960fa8f8749f8f41e9dcdff94ded8e31761ada4ae0b0ce44955d1205b
SHA51298de3029486ff4f880e3e81468a3d55056327e06e98c7877e825be06c5dd474bad3343c28efae53c83a8c962b4f982cc0665b50c00c0142194be1994fef1cfbe
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_retina.png
Filesize15KB
MD5a1a3eb66b2b708df21ab4e3b48b6c807
SHA1ad0ef211c5772dafaa1655c8705dba94d744456b
SHA256d7211e86607a1091e640e90cd962086ffa1a37706a9ba24847fe41d623498633
SHA5128cb5725bd1522f74892a7f35eecb86a4523af6858dd1f9819a0fa326856f03fb8e5b4cf93126fb3cef8a4917ecdd7a2ad013ca6242dce9d8ec9c5b3097bc5493
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons.png.EnCiPhErEd
Filesize8KB
MD5164c0aba6f1330b08d82e53870631179
SHA188759088cf954a368a86914db93ab5c8b497b6cd
SHA2568975e4032d3ca386c694767eab79be98f349141851224dd07dd2d8830bb36e3c
SHA5121a693976ef2b54912ec980d595a7e20d9be4bb5f70dd8e1d7c0151f73e96c1d7978062734837d9eb5b89c4bf59659218eaffe086a68acff3801593a6b512c0f3
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons_retina.png
Filesize17KB
MD5d9ba950beedaf9238ba63954ebe80083
SHA19b35edc51591faf92fb6e984ef158eaefae6a591
SHA25604b05e321c15ec550fe1b4384dc3f9ff8ca26b1a39b9d43458636ed75a4c45de
SHA512797c04262d7b7d6c766631adba6cb4eed83fada452a7036b60603e58139b5eab32d6a3d7e6a1d402e708b0692fdc59a573a6f1d75a3a2fd675629a62e0e98256
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_pattern_RHP.png
Filesize179B
MD5e033e49cf232a32f86124880e8b73102
SHA189c3f638437279114549e57a61f1ce8bad1faeff
SHA2564e8a0b1b40e06b84daf9fb1ca4398d5ba24bbf328b35963ec522de30b4935d2c
SHA5127e47d30ee2b4242c3c78651e4c0a174199028eae2a9bf2dbe2d8e4c6aba443ee1ecb8f3527a3258944b25b1275621286cb8a60dc2f7aa7691f50c89be4733c59
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_patterns_header.png
Filesize703B
MD55223b87837d919b456ce277d747efedb
SHA1b676321e83ed2d0355e141a0c1935470d6dba121
SHA25699ffba1b12f971b6e4f9486799f2735e772958225db95f53a962bda4e448c022
SHA512cb7305691a29b1a6c1329cdc55677de3390dad660bcf48d9871a8ee708e34fe81c1cbd5c5cab8ea7ed46d38b77816660c97e97627ef1bbc22b5d21e9592fbdd5
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations.png
Filesize8KB
MD50501dad09470c513c9528177b05eb1ca
SHA1313659152cc081a666effd92702c5b077eaec2ab
SHA256955cc882501d53a3036dfa4c62a80db157cd5aa83f9c3880cdf32e2fdc9c4ab4
SHA512123c1370ae0631c74ffc97ba32e8c088ae49133b7cd6cc53707744b82a3b7d0543fe3e6d4db1f2a8fd29007d136f62a0b295b199ac95ca54ae19d9bee9ad10c0
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations_retina.png
Filesize19KB
MD5c21c2dfc6648bb157fbbb7c4ae47d10c
SHA19ec66631b0d549f47a2752d79fbc797ba9475838
SHA2565c6393252284d311e9ad4f5c6185f8fc3e3733480b49b30b1fd994462915d64e
SHA512ef47ca7806bb54502e7ccee9aef541ac855aefb0c58630e683b49844296a6e1528b1ff79a05d3df1b0c67a4d4ccfea4b1d0cf801b21974bf1342a66fba5abd9e
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\faf_icons.png
Filesize6KB
MD58e91033bd471adfbcab0d382a5d6d493
SHA170a2c8b43517568163703ed291d8f0358e459816
SHA2567b08eeb4549f373eef278f6585fca92ac20658d0153b8517244805186d117e91
SHA51299d59289335dafe3eccb5e980d3fa4a0647f84bba388092608d7fa3ec99245d278886e6cd6027a1ca84e5b8c7c97769a7af5d85bf8258d836a5b29f6a131e466
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\bun.png
Filesize2KB
MD5c8d24bb3074335ee9d7afaf8c2120288
SHA16475d6938fbf71f771c908026a5a12b583ec3f9d
SHA25674ec4146704c6f5bdbbf9aff94efea6ead9d3ebec8d1ec971b6bc7b3772a890a
SHA5120a9103074228a1615424217385a52610cbd035eff851d090bee2a4e43f9d3ef64728f7bd66e71f30b8d4b9272195b27378edb66e6a9f897bd40d5732ae3fb89a
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview.png
Filesize2KB
MD52c00b994f69f50d06fd16547dcf86676
SHA11b9850b3a6ec24efd3ae10bad8fc06bac081fad0
SHA2567ea0fa89be2ac224cf6c1dc64f53a6cbc7c0a82275aee28d2bb2c4928b3e1e61
SHA512cc8d965cd414af0b05799ecf70904ddf2b84f3ebb98ae0656cfbaf03aa891f824ff3660eb31ff48bb8a9d639fc245f56829a6d4adec0ed97a7aefae9fccddd51
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview2x.png
Filesize4KB
MD589c0c472620c786c69f702c3128d8bd5
SHA115b6cd3db8e15e01a9e636f140ec9ea67a4ea0c2
SHA2565d9cd1d10e766b149eaa85b053f1a5ea0a40ad9e1bea92ff4594048ff80588e0
SHA512391ab0f5c3a505b7f52583ea77dc0a1b4698410a024ff1dd7b98d1d60caf18e0c4527d0e0373424367ba7cf67e2ed00dcfd995ae59af71f0fe6c53a8b177ab67
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small.png
Filesize289B
MD5c09b09491acaccda03d5bf91d3905c1b
SHA13fb22c9044f77a5da841ac360edc576f573ba297
SHA256d8f1b413057faa1e73e7231c99d0797f550e6e996a37ad03888895b0fed1b5b9
SHA51229bb96806f13297f9c924db4ecc7a74dfa7ede91243e25e3a5edeecd06b00e69a36dd65159e1840e570f4710385993b35025c09219a582cd0d1e608c7f38de1c
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small2x.png
Filesize385B
MD5f9926cb51a5882b035132b2f8ed87a32
SHA1b65e9e3e6d67a4373e6423452d33e5f8815b942b
SHA2561afe6b3aee359e7a21bad6f6093aeb9af3017b545eabd4c01ba7712bfa2c7882
SHA5128ed90dad4633c4919f9c7b217a255f4f5ca0d30eb42a6c85156cd177c74ce44a20fc6e756ca7dd29f4d19bd75bbce640d89cd5c8831db544663b7065ff138f38
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\illustrations.png
Filesize4KB
MD5127dee81bc53044e2ebbb9becdd56093
SHA197e00378e76fb0272b2f4108d3041c830dd93be9
SHA256c84e43a13b4d63855096e998ff30c8ea9c95ebaf380b8e20e1a60da2c8654263
SHA512bb92dcf6241eacbe24190ad4ddd09c877aa840d3cf59f408a421f56b1328bdcfc31a99c9f3ee0856c4ebd61c5f9a9337d9b96afb3fc17ed2d48b6ed6f8c9a6e8
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\nub.png
Filesize1003B
MD570f6b890e0c3dc8ac80674dff6f3f808
SHA15fd166222ed60dd5fbdfe8853612839cfc1fa0e6
SHA25649b63aa8c8de447b0f5bf16b5680ff1888e792f748d14e2490eea6f8999540fe
SHA5125138832b6b19d5362cd02c75b9e224a3854892941401a48bafa344bcceff4f6f30236402f382473f30d680182444953f68538c507b2444da47e3e4980fbdb519
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons.png
Filesize1KB
MD531976097d8b4af5df524ac4cd916043f
SHA1522a120155f998fcc26768bce52545f39be11599
SHA25650511b79fb34746b2379157e842ea136e53e4fc57e037fa4fc2e6cd326736a67
SHA512a2dba5fb45c9e7a1f0414e96c868660f20427739a1002d4cec4738d41d6141b820210dc4dcb6369cf602071def4299ede1f0ee7184c09eeff6613ccc7850194b
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons2x.png
Filesize2KB
MD59503bcc0bff53db220743e6afaa7af23
SHA199cffbefc263df305456ee9d0f0cdb2bed211d20
SHA25620c45a00d97c32ebbb0b1aea40efa28d50ac2310dfdd270a6543fe8e753f0d43
SHA512136c04b9b3ce7b17088cb19565d7257a0841477b189016a6e5513bd5da11fc58532945ef92ab7ee5490204b1b0cc2a478f8058e4b6226a6d11e647792785f256
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adc_logo.png
Filesize3KB
MD5d4d37097c6623568db86b878991ecbfd
SHA17f90c71a1efff29b3f1bab3c6a3eeb28a923a257
SHA256eb9fedb7c365ab71181b0332f58d55384f6c7e91057b2b440496c779acc5e106
SHA51256172db887ad44eb49d4fcda7a91fa77c251516ee8d7fb0d436b8dd525071d2d263a3fc0b287a6cd71f6d9889ec5e0a609595d60bfe361e14fe67da14d818a77
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adobe_spinner.gif
Filesize556B
MD57fbf67133a99b0ad5ecee25e8c96c399
SHA1d386ab42cf1bff6fb3fda7da248a12394dbf6440
SHA2564511e8f4c2cd5a78d1a7261740ec45c582ac3a70662fb5d388b4a01f0c27fd26
SHA512400cc62af68e2d27f190864640847c60646aa869ebf076c24c628dc134ba747cd86ad3622beaf0eda47c2f5855b06228f1e4465d7fe73b80deef7fe9101558ab
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\logo_retina.png
Filesize6KB
MD52fc5847896420f2445cbeec62e29a7d9
SHA131ade3e51ed97b58151dac19c383deaff703c9dd
SHA2566f345ac29c40fff9219b05d057f2cd621800052111d84d36f7c60b3a9556013d
SHA512e7a6939c69ba3cb2df4776eea9fbf37ec10f3c8f46ca50de15bc63844f160036db8a0e461b172b30aab6e6e44d44fb82d7128a39c27e7d0aafe492875d634648
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo.png
Filesize826B
MD5dd552c5bf71eb7536f57bfbadf768ebe
SHA1057d0f0ec7bad419897e5fa6c4d86ea6b4067978
SHA25634e54b254c17d6940de8184834f07c6098a0ce6ebafda7936b99119ff1de0ad5
SHA512a8e8b08a968bbd0c943ace95d20e3010e69cf41e17f5c5a8aab530361a306ea9163989ac3bcb76dd2245dcd117a793de75acb3da0d141648ceae14aaf920851e
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo_2x.png
Filesize1KB
MD54656dfbc57123ca60dd98772d2b42a77
SHA15859a3193f7f0d6353725ce0e57bd23a6a4e6e83
SHA256d13a6277e71cc00e32a677751ea47d8ef1ca7f64b25b75e1bb35b193760c2d7e
SHA512da31a76706ac42c352ff8bedfffcefd30b542d86b44876b5c51d1f5bbd762d20b716a628b1adeddaa19e8dbc5d808de8bcb2951672413df94521ce81cffe3929
-
C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB_EURO.txt
Filesize32KB
MD5b77e3779945849bb07b1d049eb92594f
SHA1b8f653f05ae72057118d581e99b1d31dc988b5de
SHA25657c2e5403e1b964f74a6708bdf77fa45f844aca213651172030688d6aaa0d451
SHA5126eba61798a3f7e1643f09ed7f075a07e4dbc7d3497e181c8a56e18e56674eaaf32694aa6ae3ba25855240301562e5fc0f80f5a7f79bde290d1732b01c6543157
-
Filesize
436B
MD540ddd4aa2da1380a355d0959da892895
SHA1a5ca6e445d0983feb6580dec3ca377a1e53bfd6c
SHA2568ed0cc377c8b7d1cb41d65f5cd7eb254523ef7d78f43b8e592469dd9f759d225
SHA5124e3185b7127f9e94d3036902ff58baeac074e0923cc4e90e746cdd5c62fff13f0e6c640634389aad12f785d40a210b96fb652030fdd47d216ac6219222481d8d
-
Filesize
153B
MD5880b4511e2af1f6c0e8d80f8bb19569f
SHA17838c729fb01916aa12e26a0ff90e3f143eb4e0f
SHA256a20b9c21d24e6f54b26ce185e6e9690171cabe63d618ceb811a49f952566bb74
SHA51291be3a77b82cba342abe9d1b88823d5a130fd35f5775129bc1a8aa059292963779b2d15ac3b634801055ae5aeb2b9af0c07e450441b6556d60c4a4db411c50e2
-
Filesize
190B
MD5ea1693426563a161c0d4fefcf3b97049
SHA1a27c3cc4ce95e6baf3d43b25936441bb51b2502b
SHA25641f30dd44ece154a71b67d705a2e2e5cae71426a6d1729c8fd1a8a97146ee057
SHA5128b43730e11ba75aff3b1c91989be26b5fb8fb70a5a6bd70f2f92488a909fbc77e94289c27ff3487ac9efe32115318e0168169349fbc1768bf15e1c9c2869ad89
-
Filesize
190B
MD56b7b379fdbec9da7558f6d44f969ff28
SHA1b679ff78c4c01b4a8c9f3e9ea231e87ed34dae20
SHA2561654eea8cccfb1d2eedd98e02d8d33b3034ae15412156af2b4f0e712e3e29093
SHA512fa7635dc9b7083204f503ece4b3054b1f838de14239e499d243138c37fb430efe2a7b222cc587a0b98d9f93ad87ec5dce15614c40a475fe00f76b833a7493376
-
Filesize
1KB
MD526cfb1a4e1d082ce37a482ed7f56f896
SHA1754120c783737ff7f42160185bd362f28c188e6a
SHA2563abb65abe60dad01b286011ffbf2aa50a1de7a6ab417947ae9b2bf01320bf4cb
SHA5123fbea8143defa08cb08d682d7d92fa0ecd379d74dbed1cbc041414001f32be68c54747a7f243cad09aa3e91bc28a55d7617cc8e09199338ec3991c3b721e532f
-
Filesize
31KB
MD532aea47794d8bb5e31a67308ba5d6321
SHA10b6ec157fe477c54737108875cbada4e43c24e5c
SHA256cbd26b12c639485c7b6b97e95c5747b0da641df9d8ec2fa1ca6281ceaac6ac4b
SHA51274a322e779c74b692c4234fce16ef373fd69fb8f80ba3ec6291eec56eac3a40471b8dd9cf28d6e8880829208b4fdbffcf4814327cfd69133cbd3abebfb7fcea6
-
Filesize
34KB
MD5595ebc9086b64aa3b0f4d666c0a86d86
SHA1ed664bac794a558ae02202ee798763c31629a156
SHA25630777f2f3ec7fb38fa9b94f1f6358e69656afadef84f8edac16a004c884f3d2e
SHA512a52bb90dd8b3ffbda7254f1b5a27c927a8948b88fbaf86da0bc820692c782c127250e32f3e325e19a2356c6dfdd911e7aac1e756fbff21e921eb917436750927
-
Filesize
23KB
MD50b4973be888e78c6cdedd2810a841b30
SHA1906e30e1eb7f8775cf041ee875c542de1e4fbc5a
SHA256bac7b06ba7f86857dbad8528e5316ef3d5953fb69a15c09b72cbcd58c6c7fc70
SHA512b722764da5028bbb51355c5cedf209d8adec8774ea1525ef2b6126b781065a04c9e9bf843282909cde4b09bf1102c2ce44ed087703197b1da4e7afdca2312180
-
Filesize
2KB
MD5cb769133b238e7ecf9778f906baee3b0
SHA1ec4219dbfd151902d9490c0d8a4e7a97109d1add
SHA256b5a83f9808e170aad3d342f57a962bb36c1b799e87fc1311e10e70a34b7db0dc
SHA5124feedc3665c2c95ec6bc6f6b28f97177e58d16142eb316282b0fe80b4bf19967fd3d50a804f482d30186e05db0ef7c28b77bbd32f317479af98257312f5015dd
-
Filesize
1KB
MD5a945e696193a9f59fb5a809a7ed91dbd
SHA1c6b46def5f97d648169648c98525515565cccef3
SHA2562f4d4e73ea8a076c01ba52dc69a56a9b1481d3daeac6462f403cf30355eef9a3
SHA5120c334012bdbacbb233103bbd59eb4993da6e4650414f0de2aa291415e5a994ffa38a3f097d6e8da37753fe322b48b1151dc086f785e7a332fd2f0c9abbdb07cd
-
Filesize
3KB
MD5832b5801b29a9219bf354f7e780b1513
SHA1937113d3758d7a5473f88c8589bd790b9e287e11
SHA256ce70811b523fac813672f9e1dc3b899059d81dcb5f456173c8adef331640c3b4
SHA512d0a21cf937cd18a55e8b11135ea94724963340886223ce670b007e106f61dc0f6572b1f4bf6a91e4cdae992fe243c40d516be9e70341eb5329c8f58b2316553b
-
Filesize
2KB
MD56f4df8a948be84ed6edee70930e3e3bc
SHA144899420a92438fe121dbd616c7506049e6037b1
SHA2561b24a80eb0d29f46948ce35de9f67a1340ced5f23fdf95481295246f95dc2f26
SHA5123510a620c83bae26b60ed51484193e7b7d3f33d5fd22a9e988b7d323f702391c233a0ca53d946c5ff091872c38cc240ee6042206d7f977e9fb7f208977a05ba5
-
Filesize
5KB
MD5678a1d8f223e6bc516537eb2173e6777
SHA1a728cae99082d5f09f1f6384abb572cc16a7f884
SHA256777dfc6136569d424a3198968ff4b1f051273bbf99c1c5a9c548f1ce63277daf
SHA512d06a522aaefaf94a4e2fd287c171dbaa992d383cfb577e72615e55ac16a3ea812207f94c11db4dde4feb3c4af2971f9ac9e902b6b9ea4d9e5e1e2bd3be1149cb
-
Filesize
17KB
MD56bfc372c2f6986bcdab47caafe15c332
SHA145c2d7dd4d1a75cd34ae0505a2ccec3761072948
SHA256faed16f90b72a879c34ac13ecef046234fad4ed10aa0c6785a8884aa38e03075
SHA512ce5b61ff19f7bac2bb84099a9341c30f5f4d0290d5cc394cb8786cc5d7833333b3ce28e72a4f3740a6aee39ff0274ae7ae5513b6212324150ae44f0bd503d3f2
-
Filesize
320KB
MD57212f0f7919e1fcfe525dc013091e17d
SHA18bab8aff2f08fa10adacc4d862e45e0e02b73ded
SHA25600354f9295af0626c3ededd0e530cb2a56d7e8850bd793aaa63dbcefab2c0b4c
SHA51258cc68f964bedeef33784cae1ac13504133740f72565c9d4efaa8b18be23308c6743493839ac097977cbcf0968dbe325497c5fcb6cae23f0c330b0729871ad0c
-
Filesize
1KB
MD577df4917d56c73dd25c1a7422f18cd59
SHA19a8b7396061170d22a3de9dffaf5f4c0eebccdf8
SHA256e228246a6f0d738b143b685ce3dfe72399d543afcce702531b84dcc03da404dc
SHA512a586be255eb857be3d47a7f447acd6023095c3c1fbc4c7bc463b2f49f489397f2318c57657f7f59b09522e462260cde0985192fffe05f5ee154f457a7ae5415f
-
Filesize
10KB
MD5c8d018a3464754ad7b890619ca797f45
SHA1e0174d51aec4b25d4a917718571cb63c1f757d2f
SHA25662f2e6039d073cdd96c4650a1502b1801054a932901cbddcc707fad1733d824a
SHA5128f11b6fdaef28aaf8e36004d62700ac21da9e6be1a89a3f506ffe68833d84328fd9848dd9c9b492c70289743234e04dc7dbd02b8772ab457729a29f3b6634f8c
-
Filesize
3KB
MD54c9e891a20454161bdfa2ea8e80131a0
SHA1a0da238e3a4347ac5746249d0c60585ea1f30d0d
SHA25677c90566f0da901e2713c0cc42909b7b770f1b5dc6882623f57784cb8a147578
SHA5124f55b969f7c388f9d9418a99e325d9719dd110bdcae0d3829a29891f9baeac188956dea9079a90ed1ba337b505d6dc15687c2ca5288c40f89d9e8023f89a38a8
-
Filesize
162B
MD50908d257374f5f3564d8a66d134d4bfe
SHA13b9e362a8d10601bab9d8699061041b7f16cd31d
SHA2563bc20a4f77bfd8bf4e1b4f606a353d6d59e1ef5575d0aeb6fb0b398b7a3e497f
SHA512e87086c16a0655552ef9a0da53d6f349e550d633f2c054a5f76af4293d1f766918cfc253edf4ab70d01402830df9dbfdf5af820e6715c77b031576a239090896
-
Filesize
1KB
MD512695f63c102e6403afd6d4cdd4378db
SHA1a5844b4026dbc90bb929ac722a4625181557994e
SHA256c671c2e6b0313d16a6f2d2b9df0a7f52e5376917989bfb449e0c5c7a6cde4a60
SHA512d0c9fa988035b2a73afe13160adff57d4d91e754a110d31a5c3c3c499af1e98f361a49d709cfdfe6d855e5b90ab89786821b565b6fd0b092496308da85459e9c
-
Filesize
3KB
MD51f44b2ac283d444d9d2f206c610e1c7c
SHA149a21a8e1c5c718d42c45c38a95f1db420546ced
SHA256b6ee533dfc569b0a7832da316c46f9d1f1be6bc2b95b1a738de19519abfeda0e
SHA512dd9a9d4c79d8aa36f3e8b6f995462ed3afd0a4a34d3c46e227b9edc55496ccfc8047d23919935fbc5b14eccec903bbebfce392d01858c20cd50d34095f88f7e7
-
Filesize
1KB
MD591ee6ebfe4cb6f0f295c044a35b5fbd6
SHA18a1157cb6ad61638e6e8099d74a93577a09dde7f
SHA2566bac4766c225194b17a3cbde04c496199c60033ea9e079753e4cdce7c03e5428
SHA51258b31f0e55cf33f1cd87efd9ce8e403431d20bc31eae8fbd56d39cb2eca5fe14cb48766e377c1a42482295fd4bec972f97a6b8843745c0601b5bc3de80cad259
-
Filesize
28KB
MD5aa9211e5085baea1e56884bc0331ee5c
SHA10d473673731701807f5857ec81ee3342323320cb
SHA256d30158432e8f345fdb8738859b6b7d0c1328a8205212a5b88d784aafcbc5405e
SHA512a82ddbdf8e60d2ea44a2cabf9cbe47566db79405a09c052e38d18b0686c503b9ea21701af565747cc30202fb36327b49f6663882013b582716a9801f1a201d2d
-
Filesize
2KB
MD5a329e9c8b5d58eaf15001da9f32b66a9
SHA103c9febb0f4b98dc372f0f578bd10a69b44f3ef6
SHA256cf9faec9d18cda38027224ed71dc6c99bb002d2b2d708fd9ed930f5c3117eb1a
SHA512424cba10f7e56fe3ec4c2112e780af6b909817971b5d26dd139e9d3fa2d2931a9af7701995d647ea702598765addae59b10454e7040e492cc78ed4053057b80c
-
Filesize
1KB
MD5af79898871bdc4606acb72830b2fa0a9
SHA1458908e1705d453d3cc2346b34403cfaff6b7042
SHA256a2c9f63d8a70ee8049f3e5f3d409e004d467abec0b7406c29ecb2db7d8fe5e9f
SHA512a3b12f10d6fd1e7fb13084c05bb69f3f6d870b538b27c41f7b2c7829290f952243ed967f965468928fea2d3d37120bce213dab5f0e83b174b7772c1035058769
-
Filesize
2KB
MD50ce3575258dc25fdc03b87396be31ad4
SHA13e163ecec7f5a6a6ed84844a478a76f24e3e3d43
SHA25614a4a63f541a1a46ae99a90f35d1e38a88087fbd1b887190d07d8016c22cbf37
SHA512d60623dea88064ce7f0a29dadd8ac6eda065d67bce3bf83b7a203639c3e6f8358b1205cf6c351803e9ad7b20612f54880f6d2a8b44c1f60dcc7a2e44f97429ef
-
Filesize
1KB
MD5ee17fc6558737d1c08090fd97451ef6f
SHA1424f4835de3f88c63d73605e5f2c012c899a6b89
SHA2565c67e370f7b038faa14e038f6fb0586cede18278965b57adb0ff5ec5d4bcd94c
SHA5129b8029852f8e6b8cf79709c238dd84eabe9229f3ac67bd07f60a1ec5de5bbb8fa64f935be951520319c6e6415c3e43a2b2678835a6b0302fa6f26f826403872f
-
Filesize
1KB
MD5df5c7d177b6853dfe18b1440a0e5d092
SHA1b89577136cdc334018b51001012c4384b3042a60
SHA256b065514e5a369bb34317b4fc95b19c017e96c237e0055b3c644a84cbdf2a71db
SHA512db5d31f08e8554001270d4394275596e1615d53a318a5ab789e3a7e726d26f5d6123d1685231878496169a03c7b21b820c031682f20bae556707e8ffa1ab8cdf
-
Filesize
1KB
MD5102894fa81bbfc7619d87dd8ff3058fb
SHA15de33b41397b6a7b9308c3ffcdfaa3a07d94b8fe
SHA256ae97bf17da6a4dc5f0d49f181d0503deeeb7b5ccc3f98e7ccdf2e63c3b2aaf18
SHA51242cfbe1d8fe7b34c43ef37d78ab84b877dca11ef612c48d77dcacb6fcea994b632fad201acb23be1157374ab3c37a844639a525c9628e5ed5dcaacba757f2b7a
-
Filesize
3KB
MD556b5c21322d05270f1c404d81f40a4c1
SHA1d81b5bd058c2b712c52e2f8816ce781da36bbfb3
SHA256200c58b741171b862003ab1be5b65d46d07d8f9660d4255ab1dbb005a0ae140c
SHA512541eaed853530e5ba63e579af57d6dd44427e6ada0f0198b783acf5572f06994b27375f35b6fe948d9cdb59d23e5731dd76678fedfbac0c51a9514162ebec8d1
-
Filesize
2KB
MD57693b9df52dd61c6b8789942dce2097f
SHA169c70ab34fccecdc2f54d89a5262cf4740137a10
SHA256aa26790030fbfe74fa502ba51d753eb6e88ab59b13d49de21c0cb4e48928c8ce
SHA512a24c3ac490a8356f65f06716a11d54794c64eea873e9f87784c0ddcfe8e7a5240dd50091f5b67e89d2d286039d26e026ea997912e7b22f86661a1e4d753f298a
-
Filesize
6KB
MD5b65ac410f01f4b1ed1c4fd46d8ef0caf
SHA10e8fc8f36eec65110dbd6d63cd79ee0259b111e3
SHA256dca63a0b0592156161730920b19bbf2bb4d99574055ef29e2584b04000988dec
SHA51247709f788ed9e5298f267f2dcf0ffa4e628281061b2ffd6e4277d7ab33d39399463c5a7a22ec7b265d56d30656ad14238a6e4c9583778f4124d84c1e0e884692
-
Filesize
5KB
MD57d99581f3c22cd7e963b412a11c581e3
SHA1fe536b446c966cf3d72912b5c46330a247cef550
SHA256269a9a3f7b71ae05453d3115640990f211e44abf2788647eebafb284a3ce2b0d
SHA5129c0729480130ffe191495fb4fd82647034e0b489c3bffca7882e1eeb3654910de7ef321f21d9f05f3d7423ef63e8fae81d739ab0b893d85b0eb3fd8f0b0027a2
-
Filesize
3KB
MD51a7a7bfb87660875d85dc6d03a162af3
SHA161cfbe3784bc2d6b08d8ce2d60b503ff6739dc18
SHA256876b90fc93585a79a485318a28d10884cdb6bfcefed9fda5242800ef2f543fca
SHA5124472a4203a3cfe28a0fff01368a559618d88d87c8c931aad4d567e03df785232977082c9596f72abd15977aef5464f2d7c97ab3972366cabd531e891cf879ffd
-
Filesize
2KB
MD557bfd652a35fb23431ad657c739bccff
SHA129f42bf7597e03b8b913d09aa407104d781ea664
SHA256f0075ec90ac082b1d8ed14e9e7d0782369c6886c7c2adee4cef88c04e048a99e
SHA512b3bd6f6decb3e2b7c6903ff7f562d72d31dd379a054f7548803e2667e5c0a6690cc4c40f87c690de3808c60a390410a7a42220e551af989d475af01ab79d584c
-
Filesize
2KB
MD559d0ced06cabb56ec90e617fb568f59f
SHA1edd657c79a37eb2befe5f7596ccdb497bc92bf94
SHA256a4fb93a36a315e1d366298a66314c504f5e0632dbb857c57f215e88ccdb2c517
SHA512df9977afa9b9ad72ee4126b3f49cec5bd508e5c73110ce6bbed44cfc9e0d6ac99fa19d2bfe658d5722cb249ef14b40958c211d9228dff9e5d3f9cf9f4f1d1682
-
Filesize
1KB
MD583cfb4a5d3b65aba7ed8d2deb2d4cc02
SHA12a0647c3459ad575ba26602e60880a4705ab4fa3
SHA25645bdb813c0df5ec18ed63e23f6cde75f699a6f4b5d9a012250c7847d77dbe273
SHA512131cbb4524dcd1a5ad9dd466c6042df2d4614f3d0a118ae0c98c30efb21accfe3c94933fbcfe5e276e27baa9aa939d2c58390c4e60e7f16d5900c5d70f3c1a66
-
Filesize
1KB
MD515690842fc3cf7205f3acc5880db188b
SHA1bd21dc79bb4d52cc25aab2a910da86b6e09edd30
SHA256738b18e5d75355505bb3a6c5bff2a945d70250cfcf12d32a2ef45c49bd8f40f9
SHA512aedd9cd4367ec763ab4d76142a7f52af13abda151bf75d488a558ce81bd3ec4e42b980c214ea89c314da19371e7508cfbca4073d12ed9925fa2a741f5f1a0ba0
-
Filesize
11KB
MD51a0369e2c3d714dccdf7805a904d195e
SHA1f90ac8c8d26d5a160731cf4c658659c44561abde
SHA256a252211c3a69d3438b23558c1fc97a8eb569aa71ba49f62fdd4e1d463769ffb1
SHA512e5baeee39c0d2b05deeed7614413f9481de5b3ef470b65cfa4fb14f71b12d027fb0c7f933bd61d620f4edc0db8f1caae8f8be4573d05405eaed0d0b24e7db51b
-
Filesize
1KB
MD50fb36d4903ab9e1a307bf494800ef521
SHA1dbdc3d1edcb01e601d5008caefc5302b4704687b
SHA256e668b50f23b071dabdd5b2bc56928d5e8228ad2e96e94763a3f7bb12944f96e3
SHA512cb6be7686f7619a1a44807ef2821c2d46a025259e4647d504d716e76d7f697dccf1f33f9886837932c47deb6858f97fb50327ed73da5514d0b2ba1ad511b924e
-
Filesize
2KB
MD51405a117bbbca7032c531e37f7f51061
SHA1dbe6779e2cb94e31aee26569710354c2802306be
SHA2569fd397a1ed8818b1c17030c9bc40f957d6ef8c9b6fe22a9bf2afcac1718830a5
SHA51233c72cdc26405e0dde95386cec18caa83d70f26c3f17f5cb311d50b4d364dcc5dccfc9b25fdd59d9b6ebeef2e2d18e5e1763ec6b045e9b9fd83c7bf52f685e30
-
Filesize
11KB
MD56c73e42f7c7fb68120734d071814aef4
SHA1fa80ce6b1b95cfa27a18f93bfdaa9f3f9d251907
SHA256f8ffcded894c884cf61b40da98e1b3540846a7b5f3c5aad9a812b14f575d018e
SHA5120d1b12837638316cadaa4351488d081419cd0c1697ba680ef37fa3cc497ed1da5d2e92ca1fa903a41fffc60b729b85ec31391d0720dc2acd0b7a5558a346e590
-
Filesize
11KB
MD5d9a02f4535c36ca242f83b74e06f0dc4
SHA16c50967e7b3d5ccf2423fd7954eb74990899ef31
SHA256832d67ed8a033c753836e69c59def29b06dfc0d0cad2403132821e147b521949
SHA512d31b393b20f6787ee45644e7b7188efe885d9d04ca96c93e4c927acdb11dbc982cd2563c93d344c133039f18f0cbbd897301fe26732eec1345eafacc3893cc91
-
Filesize
11KB
MD5377d4e6345eda9890c53489f03ddc24c
SHA1762059c83ac09c9a10f25959090a6f98e886d8a5
SHA25624d81bb84ade1a016df03564dc6974398c46dedb66c9ac66f68dc08ea1c89a86
SHA5122d85531153cacec4b53e9b513600444a5436187342d87d979d35c738f11a363475aa80ea0d3c6a7946725d54fe04d948d5d307237d95c0e89d9349935323b289
-
Filesize
1011B
MD5bc15015bb87494565e8f2437b3f37d53
SHA11943228aef229bfdc5bb8de5fd597717500fb998
SHA2565bffb1853be60420527594c63c34c81b45d0314e252221511372789e85223904
SHA512de0c80eae0e6efbdb7ef9ad03d912202788d036d5771713b023626c56aaa7f51c69e25c8b06bbd6f51238cbd3dd5abe5e086871a2136f6d1bd56e4083d0a37b1
-
Filesize
42B
MD5170ef1c4af5cd82344159d4fb029ff75
SHA1bfe9f52143dd7cef1169c06a005cd7db5b0f70a7
SHA256bdba9fcfb1d4db5331746fe8a4683e7e7396d81967e743ac56cb60c932d98430
SHA512c0ebe6a4c9a8446456c0d99534c8828e3aaf74c82f7d097712945e6807e8a349d01eeb1f267c5102139acbdc1ace37cf0124ffa60200ae9d7e19f1b32dd71376
-
C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe
Filesize1014KB
MD5ffc5a928918ea7703c0d8fabe9527cc0
SHA1c86eaf18a465b64070988489a87c409c2fea6f0c
SHA256d1f8c52512fe2c4e9c11def916228d652a981add7bf97e7c131abcbe3d4caea8
SHA51281d6e62940bb263ed828b181c3ef4267c6041c60e8980df31a235b896a8cc531cc8d6f4dc0e144abdf78dc39443d66f66ee4b06bef5b8726d0434690df0fdcde
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{b95b8eab-e6a2-4c08-9f4f-97f5d723e16b}\0.0.filtertrie.intermediate.txt
Filesize28KB
MD55185deaad793410d0ab4a67997221176
SHA19f3b2db19a910e90530ed4c5686effb7adf5e002
SHA256f457bfacf88d755d5b4c074ffae4845dfc5b126fe4e9150824c8aa727e29a282
SHA5121e2473ee9f47747d82e96a2cd44087df91ade1f40a0499bde5b16d8f1de811dbc997afe7ceb9e28bb76277065fff6d39eec50bf212c5dd9021240e9e980b78b9
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727655840085328.txt
Filesize77KB
MD57bfd8b052c130c9e06ee1770a09ca254
SHA17338ef3608062aa27091257f4f6293fa3bb74753
SHA256bcdd393dea0d45b4403d821d7e55a8832bf19d81109d1367c4b20458c6308191
SHA512272a08d6f05511a06e798a1107be78d2a09e7f89e9875478536ba0b0dae7164a0e97bea7e7b1eef72dc95fa5581ea979e7d6466361dd6e5f624c1beba1fe6ef0
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727656363999749.txt
Filesize47KB
MD54f6ccdf0c66a535107cdcb2385f64901
SHA1168e13986e5daa12696db98f4f025a76e05bc228
SHA256b62e53976a185b5f7ae1c9aeeefe6a4f9e5d014f75669c1b809f176cb3f41034
SHA512d49947c9ef77f48db8e4e4b81c69961ccdf8e1762057345cf5ba2985a833a541cf197ec94aa5c7a84e430e4240764305cac63ba7f8c9ec636e9fa43dfccd8801
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727662640605367.txt
Filesize63KB
MD50ef12f2a6b1bc9573948a6f20eef3af9
SHA13e017005b12e3bb60129a006bb9506b26afe0a57
SHA2563734e16a9858ddeb1bd73aa83938f520972a8f1084784d3ee35c409d55d81f23
SHA51292190132270ab90cef526ca6eaeaf4414e2420ddaad5d24e722bfa2d673251933ff515768290c777c6bbe088f8072fbef7b1608809a54b74b937f6d0ae1ea4b6
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727665714398674.txt
Filesize74KB
MD51b2222b10753c0d67921216b6aef68f0
SHA1037aab00b819d13b0e92cdf335027f535576eed9
SHA256bda771aeb65e46a5ffa791688ead273a6c5ac5498862c4cc6dcbb2d8a5bdd18c
SHA512aa6c227c0a9f4e3718c5ebbf85776e1f5cb0a0706ce4a7789fe6adff0eaecb247b8df9bde8e42af082037c6c4666cc11987ce8304176807215fdaed526a8922b
-
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\File Explorer.lnk
Filesize407B
MD5c0baf52a6303e54017501952579eea7e
SHA117a3b360dd3b25c76792f5468c110080931d2eb1
SHA2565a268dc5531782ac1ac55d9a6faa514ddd34df925f9c8cd2015ec09f40fdbe13
SHA5126a86ae6e4dc97f6df3a74752ed9b03f7b1c7c8ac3d00a91d8d5819b1ef394de9b5e744dc20d9993f114068e85b50f2a853beab681316427721eed7dff4a40dfc
-
Filesize
21KB
MD54e55f8204570dbf4da2d473fdc46a7c6
SHA10e38aa669be1b277c48a8c11e13342d624d11112
SHA256cb15279573140a204cf4beff8ce54e42d40d407361fde618a0ce36907135e141
SHA5129990a9cbd0c71cde22be219353dec2ce5257f19fb5011e9f8a5bd6c6cf8cf6bf09939adaf1aef054c5d6a6c1b6570bfdadec57c6487f74b8036f58383d61b472
-
Filesize
1KB
MD574ec63d3ada8eb15ffd92d0a3105be81
SHA1cdee8ff6bbd56da7e05c8ae719e7438481ac83e5
SHA2568bd75e5f26a3bf7e37ee51e1e2bf7efa68ed060292847a0350c648a0bea21f5a
SHA5120c5f8e576cf58f6354d81e2ef9b3432f594a77acdb34395a39d3c4ed685eeec0892c1189587491945cb277cd9d79ddd339e5de8c42388d0141580c4cf5511472
-
Filesize
952B
MD5024ce5830f4a61944c7da2798daf33d7
SHA19a13dd996e5d8f773db84357fcfeaa7a99286d49
SHA256fae139d5a6310e443784bc8141f3168c266193c9d091027e7cf728f617a2c0c3
SHA512360d7bd7532f7a20f368bafdcea9c4a8e6fd15960b7fbb444f77966d710afdad30d8948aac510f6f0ed5adcf7297599329c00fce21ee84d8aecae37c67efc77a
-
Filesize
121B
MD52a5fa5c31ff6de966ea9a93e1af4342b
SHA1b09a2310fbc1c9f8a8c86a645e30b06cc79d43cf
SHA256d353c0bb29df1e7ecb957ada706c3a1608927a63e8dee38d8f2106e24c330cb1
SHA5121bdb7a9864441e4d10b18fcca944e0becf8da6865ea885bd9099561c5f8a06d556c9d82c59a95461a0785d6de572afe7f51e2d00cd34c46399f5570b8d0e7d3d
-
Filesize
1KB
MD5103383a9c7afa2d7067cbe08b79bacbb
SHA1e38c2a10515b35818d1d7a0da366e8a50416616f
SHA256447e448608530848dffa8319608881e13a1a5d6f6f98f3c9a263e36a6f78d9ca
SHA51213a5d2ea329afb492f127d19cdd8157885ea5e4208f216fcc3b838856203117eda7e41438509470ace48015067203ff5106ba893254e986ab3ca26cbaa0d8c24
-
Filesize
8KB
MD54bbb1fa3783bb4a3ea4618b4fd2f4c26
SHA19b9bc01cba6f9a9be1d2f66092cc6072a22c702c
SHA256b324f22dc032ba0b8e7ed53956a7f729beb6b2d80e2910cd487f1e7a9399a457
SHA51211a039fe2a87d1b18dbd919d69dd24fbb918cb8666af26ed9786023501d91d834344e548a990656a3dba31a6e715e93e1f94dc0ca7022c02b58c10238165a8d4
-
Filesize
61B
MD5e46721de334f54cd6c5fec188e5dea30
SHA1d4177564cc58495ad9e4616a43cf20e215e8519a
SHA2563bb4540109becab54cb14b1dba4f10471857ca34f5cfcfc44e6b082252fe25c3
SHA51232c963872eeb8132845169d498a866679538904f6a6d709f56160c8f8af4474a581b8dfab68a7e07234fea1567e027053547f78f3f3176b1315be2d64fd3b362
-
Filesize
914B
MD5b1cdcfe3c7b66b2537ec7c6755f2c114
SHA1de1d2aa3df52c99227dffc28f80d0004b9fa8263
SHA25680f59671e2d02714ee8065137a36d23c022ea0f123084f97d08c2c8e99f7c11d
SHA512515aeb7ba8bb46de0621e7da879f5d13dda0e7b9281f694dedf80c116d13dc6ce021d39fd97c2bd47072df1d000e7ce467c804e576dfea68c2533dc0bd68c59b
-
Filesize
90B
MD5fe807b17ba2794415ae2b8aefe29762e
SHA1fdc0812d93eb99a1c1fa93a604c1b6401fb53122
SHA256933b2f8e9832d4fd7e530d30f1777273704717fd4ad9eaff59f36f3a43635399
SHA51290548c7a354c1c55f3f8ac9ecd6afb7c3ef8edd696aef6eb94463ccdbb6a5294ac0868133966cd256db4ee11492db038fa7353e233334217bf826c84a2275e86
-
Filesize
90B
MD5a6853c30abef18286e4802c543edc315
SHA1992c2eaa630709480ec9edadf5daa2da736da554
SHA2565e216ea566d608d08b971dd1ed63b48633b40ffe407d51238c7cc7588042c03b
SHA512b949a9e20e725badf87903b3b18636f37fe0659d81d9c76bf9e53362ca96184c6b8b9b4d771316e545c1babf07bbcc9854100cd81160a52898dd0c90273442a5
-
Filesize
328B
MD5209da4fda1f5823bcab181a8de82895c
SHA164788a9625929d9ff2941452c6b7492f00416b2a
SHA25633642040d64a3740ac761618ec8d2f37c671da0f684a637dacb8a81ab470df23
SHA51268fdbe15519bb95b66dfab7db42f535182a6d915e742f75432c8f8ceef50b3ac8fbf0b10c62cc1c885bfdd6b3c110f3b2d6c7147371a46f5fba01efa75ed4467
-
Filesize
1KB
MD5b72636fe7164caff3c25f984f8c47eb8
SHA13ac2e1a7de60e380cac73801e7f91ee57a7eaa66
SHA256e7f3143e8590b49df338ccbbe314dc67bfe98d2f8004dd20c172c6e0a23d5dd4
SHA51289dfaa98ec777639bd6af7c107752829492b72c9c2d3c7629c96360ad6fcb655e887e5f4a8242aebc466bc5bb2d17835682cab1d053379f45a343386a312137c
-
Filesize
162B
MD581e4f2b7ec2f750a703cea9e3433e694
SHA19ed7e250dd8f275c91ee27db0fb6439d2b463b4e
SHA2569c507343d8db5d161bb3b820a9846fabc727d664b66eca8d666ef61cc8898aba
SHA51219c5ee40523eab3eec63eaf799153ac7c1ca808e4d7fabd6db12bdc600ddc04ff7d2aa485f7186007b1f87923e84dfcf15976ed0adb5c78e7e8ceeaac4d576ae
-
Filesize
586B
MD52c04705c210258979274b866c93b9de7
SHA1f91d95ab3e23c55dbeb58554c14bae48a5c2b969
SHA25665fd2d1c23fc82b0e6122874d74d733eebe55683d5377502f7ceb4561a148dc2
SHA51276b4e9fd4156ff6e5e15a8313319d3d3a061433f39e9684f9f7b394a44f308c481c2512fe2757917bd80cd22ffb336f85d446ca9ca9c5e69b40318398d704908
-
Filesize
124B
MD55a048c6e758f84805511c2a78139eacc
SHA136407b4cbfa320f649416eb9c49002831cd47937
SHA2560cc1b84b07467707e0fa03933892b5bdce5858a6af60b3af631219e4437168aa
SHA51287efbed215fcbf13862129c26e05f3cb9328f93e1bcabccfeb057153422d7ffebed4be01dead215ad405cfbdba7e851911021a3f69dd07a94859d54c44dca4ed
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\selectedTab_leftCorner.gif
Filesize65B
MD502f2e0bd33e119e5b8eec0cab98c4c23
SHA1004fe61df69009e122d9a879b430c1c3f2de7bc2
SHA256e4d37e8c94171018dfcb88d7a21f25597bea395a5b1f801e049c178d836478e3
SHA512e09b480f56c9091c441ee73f92f7a9a02fc07cccfda17273512ec2fe40a71b5543a33dd763af1268fcb140583cf0b1817a942de66a9bcbeb23a8a026c5b3ba78
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\selectedTab_rightCorner.gif
Filesize65B
MD576aa27b810e10705e5c51fc0df447525
SHA1a7b2e220e131ca059f50cf7938ac69081a556340
SHA256b72055754696cfe781f9b3ca5125a94619a3b97b8718ce4f51407440e07045a5
SHA512e1a67eaa8812f1b31e5e3ebdcde3942731eeb4e5842510f802a7456eeae78a8a3c4cb1c753199d2ba28f38f7d96ef9626d49e3c831974af7958a8b951337ee9b
-
Filesize
8KB
MD59d92acf14a9638a2cada2aec21d5a452
SHA109f9a202a8a35cb7f138a781077ede75333d9ca9
SHA2566a63c0e3c2198b5528cd6f157e9718f5e902241a8687688d43cec7e5bfd40c25
SHA51228021c31269af16802e8db367a0a05bdb545dbbc619630ab9471e2f31de542b57fd13dacaf31abb72a8d1a3ca715a70717d29552e4c2820fe1e259b5934681da
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\unSelectedTab_leftCorner.gif
Filesize65B
MD52828fbda72760c8282c0ff7e99fc3a3f
SHA10696cdd724c807331f2531314b0df5cce5fc1dd6
SHA2560cb0d5f98ebd2a401fddf1bde390d17881e8f907ab446d9a12e424e9dbde3bd5
SHA512f0107334f8cde7b3ed2ec2f30bd7ba8946b9d3ce0a7c91cc23166bb35b6870bc58a5fa32ffff609756992ef2f10eeae71847467213e2e448c83737b1be3c0deb
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\unSelectedTab_rightCorner.gif
Filesize65B
MD5b171891bcf8af64f858b7428379601d8
SHA1c9f41091b973e8e5f19a028663b7fd172c21d377
SHA256a13fcb988cc157ada04186a41633ffc5d012cff63a8cc270d2c3d7d2ca8be7ef
SHA5124967fc22dfbca055d9f25b3accba62332d8e78b77d528a65ca16a64aa0e158e3263ffcf3dc5674ce672607bac89c4c4c37ff6267f13be9ba48da73d34649e8ce
-
Filesize
880B
MD56a019fa63ca0acc5475fb12b5f1a2a76
SHA1e7877795e95382f93d911a8b604d0c9cc811e940
SHA2564eecdb268c1b93667768f5e649da746fb356e50b81275eec131c7caa1779f6b8
SHA512da75b5d0bc1a412f6b80722cf07a493e5a2f3ebbea732f5018dee2006fe00b28bdcb52f77e5e16580ccdc1cfde4486d96091b5bf601e9c8779495d4952d00073
-
Filesize
49B
MD5679ac571ad10f44d1596903f99e2da78
SHA1fd23e45208e3f42a517cb4665f5f51cb7b2b3f39
SHA2567b17f4eddd3103c3272d259eb44dfbfb5e14185c52bde92d9562c3e4dc4dbfff
SHA5126973f9c277599681937e320b205df6f319d47c821968a07ae99adf5de8d7170c2ccfb24ccce8c999c875ca360e927fb4549cb18954d8872100eb9ea0abf3712d
-
Filesize
1KB
MD5d8805c56dfdd4190b3eaa0376289278d
SHA167c45535f5b2ef18b9f47e6676ef1decbe127f5c
SHA256b0bd4e1286dac09097f6184636332f8a8e1eccf7a0aa9a17827e8bc2919ec298
SHA512820cfe4d34858fe00fd121edb97c156de8b330645fabb1343ac90a307af85837a05e4333713b76f28d8146b9ba84518eaff0a352110fda19f903232716204339
-
Filesize
1KB
MD5d6d5f9a868a8b557a0c726b8cb01a03d
SHA1d50b5e30c444c86b84b9e52f30162928541ceadf
SHA2569074736aaaabd6f0dfb8a66cddfb76a9705df2c7bb8814752361d70295d9b0a4
SHA5127d58877a7948f5e2c4e164715cc492fb6a43be58e5ad3c94b10d91cb662e663c2b775d4cbbed9308f72de7df5a2d9d157795978a7400be3723181eb7ff35558f
-
Filesize
1KB
MD5ff8297f671d8cc8e5f2f3c1032ba59ba
SHA15505b6c9b4822568a97ae3ed7f94ed81ea90fda5
SHA25603bedccfe3fe3ea0e7d94eb3b8173ee847e214a5e9ce754b4d05e43984c92b16
SHA5123d629fec8a8f6599c24c41d8b4ca75bb75e9a79490017baf3cb4ccb428b200525bbee01fe9c1d9a19f72c9a7ebbaafdee5486e9854e51e33ed385bd546d672e5
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\3 - Windows Explorer.lnk
Filesize1KB
MD5c59045d81e58a76bb7586c1a1635cc6a
SHA12ba5dd4d1729cd7260b29e83fcb082e694e88e42
SHA256f32a02bd1866c1152f6d045d0f168e9d12e002c38c59650cfe7bcdc38160e35c
SHA5120d77bd27fc6b2432a42ec85c05849fdb9421b83fafe83cafa81bc83eadad4ea7cb943a983b53e8a1ca706cca4f708b2b88cf2a7725b17d2ad932ab639df37698
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\4 - Control Panel.lnk
Filesize1KB
MD53784c08cec6cd6ad4ecdbc5f5412e03e
SHA157a85982aa5e2f8f38f37c9f9b93ad6575a6477d
SHA2560c2fdff99fc51c34acf534d39dd964a13dd17830b99d97cca4cf8ef574a4aafa
SHA5125ae26f143ae7a68bde279d2c9db6936a4092972180d6cf6cba66ba6ad36aefcf83f96b1d6a602a214a5f355002ce4d9e4805c814fc9a97afda822f449a08f710
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\5 - Task Manager.lnk
Filesize1021B
MD5d3de530a4f01533734f4b25aa2b0bae9
SHA185a1db64331deaa4db7c21f5c9ff21dabd8b0c99
SHA256192590e344441bc6b64765ccfc9905ca67c56d7c67fca3c599e6bd350c3171d3
SHA51248c42c7fb6b79360882932e9c31b62cd0ad357558855cab6c53565b825b47b8b4ba5666b8f68a3fb5e8a22aa71d72173d29a1fdb536e4577365a0d516664f390
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\01 - Command Prompt.lnk
Filesize1015B
MD57308c3bd1b0ec476d411b73daaff705d
SHA132e9da8fdee3944e63115d3fd82be3b66f9423a7
SHA25681c0d7c16a054e5f4e77b533ed0363e4a9ea82b4bf0200f789b7b6e6227d1d7e
SHA5125448abc37e6aab3cd4bd589e3086ba84d74a2972ec6ed7ec04d6e04df90afe216d1339b4e4f8ebb36f1d0f87b7762197e1a931639152113e4cb78d87169fc74d
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\01a - Windows PowerShell.lnk
Filesize1KB
MD5b321bb7521b3c1c7be360fdeb68a7758
SHA12fbfdfed914f4eb61498dbaad5d35969527a617e
SHA256836b0fa0872ae20f2068ec71d1a54b6d36f56ef39f591a95b35636b8f426d12a
SHA51288782fe7a392d65ed9bb65cff3e575e64dc4d1bf4c59b1000c13f9ba90ea0f825699507a24f9359ab4d8beee0b876f3795dee8cffd6bd02f171e74f4bb9d874e
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\02 - Command Prompt.lnk
Filesize1KB
MD521d7ffe092c7de9992a4a0a8c9dd9053
SHA1170882ce09e48bef82ccffe1f2de5bdf50d8cd3b
SHA2567fe6c062573755747df2264b9c67d7add5144511e1deaf41cf0241e9d94bd68f
SHA5127591e10070169d93eed90f9de9e99d1392ae6e70c5a89755bf42c507263729275e6be425bc5e54e91082900493abe685c6d5e788d7a4db2b49e81aa6751eecf9
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\02a - Windows PowerShell.lnk
Filesize1KB
MD58136d1aa7406806511ec436defa0ee44
SHA1b8af8f40ad0897f7f5978e88e1c493275ed9599e
SHA2560a130d724b693a9c9787987a0f33db4b1d7863cea56a4b65bb2c9beb0be1ba7e
SHA512d3ef6e8ce2d1f1082ebef1bef7cebec08516082131f4739984395e4935048e978ed61c7a4a84e38b760eb96e20908cecf9a9b8263173a835da56169786df5f65
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\03 - Computer Management.lnk
Filesize1015B
MD572ef5c0ad3010535b500f474118d4837
SHA163931dada811c28eba8cece5a41881660725297b
SHA25649073310100addfc84c62e0ffecc76074e2ce61f807f8cec74a4361fafc22ea4
SHA512699bd20d52099a9a8286e7a45e40df6e33abbe16320302375d152bb887cf17fdf4b19fd9e5a005f030cc9239a2fb920a621e7c9ed5d317571d203e47e7a0bd66
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\04 - Disk Management.lnk
Filesize1015B
MD55ae5e687e7c9276533f214273d67b420
SHA17b75b410cba53805bb573a352449e1ac0daeacdc
SHA2562a949a2f49bbd5ba7c1b1b8c9bc8c8be185d2be32255b9ee58e3c45ce6e2b662
SHA512b5973e9564da693090785b9e25059e0a072a5c5bc0c661b65ebf776a257692028808dfbf0826aa81b4e4adeabd6819e5e615e4c420a34d39c26bf319b375cfe0
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\04-1 - NetworkStatus.lnk
Filesize1KB
MD547520a093c05d898127333498b9389f8
SHA1ccc4278b840e505431063cc384daae2a27512772
SHA25622ff4dda2fb9a82ac85a5fa3de7e2065ada7c773a7e25dab6e68f1f3dbba5444
SHA5129853e18d53bdb93b47e02482f1983a9bed9875b116012b8e222ef79de1022ef4408e9f867aa6431df082e5ef82f0d2b3b1d22c62d56806e766d707e291cbf49b
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\05 - Device Manager.lnk
Filesize1KB
MD552e7641fe2e221cc041ae7e235338280
SHA16ee09b571861f84461046ee965e8981376bdb479
SHA25658668f3354ae4e8129932e4006a026fc1f5f821a040538a6e4873c16e505fb27
SHA5123a2e0241ab6a83b33862f3ee2be1d711a6c08c9b1ec1bd1111cf3e8451ed03709db94679b63fd74b1256b36ffc09fd4e84aa21212768ad87c3bf88da4aee596e
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\06 - SystemAbout.lnk
Filesize1KB
MD5a3a25b0da0915af9ebad11d4ed758199
SHA167c8c1c7ccfdb1ca42a8d11a480efd4fce7158de
SHA256cae06c53fd85ef5d44fdadac7c6f8e9b1d693f4885f5a39f1823edd2e6138cec
SHA5129145a75a0d4c5a76391f91a2d774cc887d6f2dc191a75e53714e9e81aaca343703b5b7ab0f9d746bf9bb24fafe4c94d1f37c6995cd35ae547068868db159a7b0
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\07 - Event Viewer.lnk
Filesize1015B
MD5c5de7d6f6526d539e9198845fa755f9b
SHA17e144de47bf8bcf96f3fe93d4979f79d29f2b103
SHA256fcaec953371c4e341415251895055850a1f09a0535c9c3095f4cd354e692b072
SHA512bd7415d086d2a47915b1a107407672f1fdd58261153f3967cbb459df886dbb5fa7c354b9794f6e488e8cf1b14476fab57d2269e01a1c113446ed16b09e93eb24
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\08 - PowerAndSleep.lnk
Filesize1KB
MD549b323e362e9e4f3527ea810ff2f9dba
SHA1cb8d811cd2737fc4cc3a2a800a90e7eb4ccfeaca
SHA2565318690f3ddc6aaf2ccf96c10a2d3766de73fdf46b98bc9f302f604d5291aa73
SHA512a706305198fd7c7b2edcdbe7ec8e9d73ca6e24da0aef39a988e8969ab9447d19af761756bccebcd96adf79e1063c9e8183d1ad6f7e4408f1815f6935e20444dc
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\09 - Mobility Center.lnk
Filesize1015B
MD5edc9e75027a3f2669f679762617844a7
SHA1f4c2a01aebe11280f10a75cfd414c51be500cd3f
SHA25610eb34269e5b4b513b55069ddadc46ac4aa907cdca7b5d8520d94a0a3b84ecab
SHA5122e045fd8f0664ab5b6e9a2528997d6dc3c603b28904723862bf9f9b867088d4caa0b40692cea87e24fed835a244bf9abee26c2075f2504312ad6fc77727d6d56
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\10 - AppsAndFeatures.lnk
Filesize1KB
MD578bac97a4ff0ac2d936c953b625c6fb5
SHA11f8b1d9982520d956bd0d8c8c230b9cf0d7f8216
SHA256db4380a6fb06a54900ea8b9c23be1688263b2bac0518faec1ccfe4927b6cc154
SHA5121d87ad521f96e6465e74ffdc73714cfcb302cbea3d5862c7a91f76a82f7eaf6d90489f433ff716799a4cbbf30154b5f402d630d4e49053d9e3be2526d2fc1bbe
-
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk
Filesize352B
MD588a04c3c12c811cf6af1b3e0006e0d11
SHA1a73c6feeefbf3babdd9f7f137a2cb5dd53857a29
SHA2562524fead34555a41430cb412b6e27cb7c51c30ab98eaeb0adf3387ee8c17dada
SHA5123da71d70cf10004bbe6c4a34b4110c4a3f53544d34b957bbcd02d712fab88bd1fa5992e896554f539c183a83e1170144db079980b8572b0c35ca45bc930102a0
-
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk
Filesize334B
MD573a21674c0ddafbd85725d1d9ea90cae
SHA139980c9f61dab259d8a2ebb7e2aa10e5fe9313cc
SHA256ff3a2d6df83cb58624c7ef491361f00fd3038a48aa6451652d4ea1d7a17e4d74
SHA51203824e8594f78e1372e697d2c3fa291d41184f6c75b6703a3e22dc124036b7a518987994bea32ef67f2b17f52953941c209e3bc57dc10f5864f4ba8089aa491a
-
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Magnify.lnk
Filesize1KB
MD5978752d92a5d689d69507ba6fc172ac8
SHA1c54e1044109e98b1d0e9aa2afa8c26b798bb3a8b
SHA25655ef51c9361e984befb055ef16d7451961f96b7347ec428214b0cc2144c50c59
SHA512516c2d386d90956368efb36fda4297ee97ed97187bf6dc5645b921ab308870ade023fe2335d703b4bd394951cddd8fc89df1553bf899bbbdf3b34b3db9dbdf1e
-
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Narrator.lnk
Filesize1KB
MD5b41d37c6079902c6dace40ead47d4784
SHA19ead48836bc83f36c0b61fd1b98c1ced7da42581
SHA256708995271f02576f9f2e3e5b9a31398f8137c52e402871b65e64f8da5870fc42
SHA51227fc7d020fbf4d3d50f0cbd8fe08d6af2f3a8d698fd550cef2384ace3b01b8c3602b0123b767a1fb10e6fb97a7f867ab14144a341f2fe520e48cbdae82ba308b
-
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\On-Screen Keyboard.lnk
Filesize1KB
MD592afa7b1fbb79a8656a5068a4f8bcc22
SHA1c85aba8b94fd6908d592eeea49c6d39ee454d521
SHA256fd21c27dec50d9e308a3054a4db6c942ba525bee2bfb2f5384e0ac70c9fa7b0c
SHA51227721e21ca7d8cdb8618fc5d74d9615a845d70775de3b80fcf822fedea835ed13c414a73c347ad5e1ad2fc5b453c77e5ba3fbd71fe8e1f53525894a7742c800d
-
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Administrative Tools.lnk
Filesize1KB
MD5d7e957f90fe48d687c88d506b7dabc16
SHA15da08dca9c5f6df48cf3e56b92ea52588048fa13
SHA2564ed09b7ba833a2ad0f9d81efeb15f7128b5cde5f6b95130a6879dabe13ff3b33
SHA5125766a3d01d45a2a6922b6ec164c5b05e80edeb2df1254b77e7a1b3ac895bdc29d2fc2cadc08382692a0d703a9d8ea07308139af43c112c95ea4aa627605557b0
-
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Command Prompt.lnk
Filesize1KB
MD509ba72c44952a31064ec89625eb8119a
SHA17becd2440f4f4842e931dc0a89b8149c2ec7b77c
SHA256fe913fbb460718490f2dfca52c081fb02249f09f193ebdf4dc9f5b7d8c41dba1
SHA512482e39672822b729b8991b979d8fd5677532f3d7f8d617df5a658488709586cbb4c4734982bfb135c44fffd79a92c8b4033a4e8e53f38c3c8cb86b0b13de14c2
-
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Control Panel.lnk
Filesize405B
MD5aff91ed750d1043216ace3d7a6436451
SHA16e70143f3d63d8d0612674ead544c36a855b51b1
SHA256902032a67e07e367779053f2efd125fd6ee19f7bee46c539afe594e99b6a988d
SHA51265a6e50e59784dc5e601fef6da60d258c5e2d85276490edb4dbc9fe66f7e0849485ec308221219123038e42ae74542452e9a70297fa1287941922f6259bd95dd
-
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Run.lnk
Filesize409B
MD5fec53eb8a3b2a7a8977a97c64d3dbda7
SHA18691716090a50ade694456e3c555c68d6e928851
SHA256b1d5c80457fd4de1d6e67441a986c2957c7f07ea332c27d4453d3832fc8e490f
SHA5123ee8781ed4dc6dd19aa0756313d42dd6a617fda6ad4f6fad4befdd4a40b2847da552776cff9063779d5bb50ebd3f620fa4a528cdd871b19f12a282169e48835c
-
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\computer.lnk
Filesize335B
MD5a0c10f339ad7032b72de9e9b96dd9cd7
SHA11c30ab9544520d27e866dce6d10f0db963147b5c
SHA256f54fa801ee976495d6822002fcf919c035189460618cba06eeace98d534ff362
SHA512c57dd180682dcc5c0db3dace1552c0e64ccf12ddb3cdcbb40d9c8bdf1fe82f7c047b2b15a9f6c72f8c3cf77c8294b4ce31992b58e1d39dd666c15de1d6a36c33
-
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell (x86).lnk
Filesize2KB
MD58264bdd7615a445fcb92d10f11839695
SHA1db75032faad740e4afa328ea179a51aed2582dfd
SHA256e91006ecbf43477de3515e9c43e7431c4b295902b8ba12f935d1d72fd5b5fb19
SHA512661e26ca3ef4744db01ed84e4d6766ebb2b7ad5dae18a2ab372a73cb8c45099131cdefd30a185a6629a7cba49271c241b55a1a9d63865b15e12d35967c2b1a6b
-
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk
Filesize2KB
MD53727f246702f9ceb16cde93a5b91dfdf
SHA10c6b8dd8855401e0f7ae46731ab273d5424d322b
SHA25626c803846fbcca499fdbab2dd21b7c1c9ec46f014a36339213d10ab86a15d7e2
SHA5127c6f00f4a71d36be62a575b9e8a1d9cecc7a713bf49d50d7c99b19a043665ea76825ae1c3e91b8dcea7d41d6242aeb792f5c7ae6c925a78fd7737517548f16b5
-
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png
Filesize296B
MD5de21c36b4a7062e5fc99082067391b37
SHA112d96775beda8c9124765d0b98e77cd3d282ee95
SHA2565739cd84ecf323dac7c01ae5dcd580711c7e51c1d60a822485d067f497e3d791
SHA512b4fedfbb28433872772337ee98d0cc13bd6e257b4b07f97dc8b6a92cd7c3aae7c8b77b5b3186d937e6f861955bfd911460ba53c3985f1f182c75f3919d14d884
-
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_contrast-white.png
Filesize276B
MD51a40ea01e02a236b27e0dc3990b33b44
SHA16c7f1fd18073e0aa6577173d09fd08cce09fc40b
SHA2569582664916d890ab1b412e063ccec6a3e4f49b083ba4e7f7ab0468ebdbb8663b
SHA5124e2f3420e1d8bb1fdf4844a50d450539ca80f0e662b08e0d7da7c6c912e03afbec58c387b68cf4c18c13fe171453f6c7332ca77b601b3f1f594b5443c9e80e1a
-
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png
Filesize296B
MD55b47e1281c8ea76f8a26b1c69c9fa30c
SHA121e9a843ed9e94565970c20ae44dd6940057ec3c
SHA2564fe100f83afd2286baf8a06f8d2fc78c8eaeb6c4a08349e6a442ac068305485f
SHA512d05786d606c065eb92a8a9d0c017674fc76187940957bac413121355440a88f06a29499fe6bbed37edf5696d7624760a4e60a75ce65a7376f277f54edb562594
-
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square44x44Logo.targetsize-44_contrast-white.png
Filesize276B
MD52285cf901320d77d5444ff557d775fc4
SHA1e143db1a794db0b729a23e07f2acc53b331229f8
SHA256fce47a463f587e165e5be9d19fd7b301fd5c1ed5b6338b7993e5c5cdc19a96f5
SHA5128e0db846c2d8bd7337057a38ba32559dcf5af4b2e1a3eeaf1a0f3e370ac80cc7515bedee396f36988cead3762ce654d2532990b9f0fcd1cdc7d0b89f7858c6d4
-
C:\Windows\WinSxS\wow64_microsoft-windows-onedrive-setup_31bf3856ad364e35_10.0.19041.1_none_e585f901f9ce93e6\OneDrive.lnk
Filesize1KB
MD5ae8dfde61f6f3348c1946866724b8716
SHA1fb37a0b639e8c25ea19f4f0941f8dee8b3b44246
SHA256d51ec6382ff98b361c91907b0231b23ac07e72b2cc206c9ebde164bcd32213bb
SHA5122e818c6a4665461b6b4c8a9b8906084bfc32b3f3c59e89d6757875b070c5568d988e339aeedf812da6ed42140b03156ded827d525a94a262099bba1b78d0e540