Analysis
-
max time kernel
93s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10-12-2024 02:08
Behavioral task
behavioral1
Sample
dc87211d948e14a32558129345536648_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
dc87211d948e14a32558129345536648_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
dc87211d948e14a32558129345536648_JaffaCakes118.exe
-
Size
12KB
-
MD5
dc87211d948e14a32558129345536648
-
SHA1
6ea4d17c4ed9ba1cff43772c8f1cb142eadf522c
-
SHA256
5ecd0cd5e48aba41c6f4848633809f5a1e90b5d475adc7892788337a5316e8cc
-
SHA512
f5892b59ec017779f235693de783eda6dac2fc29af51ab92962f4390490c8df22dce2260d18343104fe678b936856f6e4f901b787ee0962c1335cf0b69db5cc3
-
SSDEEP
192:y/TrG62a6B10k3g4fXk1iTV3HGc7EkpAqEjvu2q9C/YpXnAITZfPtRMBSwvf78qm:yebFNw4Pk1itKkpAjjI2YpdmB978M
Malware Config
Signatures
-
Renames multiple (2180) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\drivers\gmreadme.txt dc87211d948e14a32558129345536648_JaffaCakes118.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 21 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\SecurityAndMaintenance_Error.png dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\WindowsCodecsRaw.txt dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\default.help.txt dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\@AudioToastIcon.png dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\DefaultAccountTile.png dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\MSDRM\MsoIrmProtector.ppt dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\SecurityAndMaintenance.png dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\MailContactsCalendarSync\LiveDomainList.txt dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\default.help.txt dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\default.help.txt dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\default.help.txt dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\default.help.txt dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\@AppHelpToast.png dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\@WirelessDisplayToast.png dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\MSDRM\MsoIrmProtector.xls dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\default.help.txt dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\@EnrollmentToastIcon.png dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\@VpnToastIcon.png dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\Bthprops\@BthpropsNotificationLogo.png dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\SecurityAndMaintenance_Alert.png dc87211d948e14a32558129345536648_JaffaCakes118.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AlarmsMedTile.contrast-white_scale-100.png dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.contrast-black_targetsize-40.png dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\FileExtension.targetsize-256.png dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\core_icons.png dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\Spacer\10px.png dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-32.png dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarSmallTile.scale-125.png dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\RTL\contrast-black\LargeTile.scale-200.png dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\DefaultID.pdf dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\LinkedInboxSmallTile.scale-100.png dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\OutlookMailSmallTile.scale-125.png dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-96_contrast-white.png dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-96_altform-unplated_contrast-black.png dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Square71x71Logo.scale-400.png dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-24_contrast-black.png dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Advanced-Light.scale-150.png dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-Advanced-Light.scale-200.png dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\A12_Spinner_int.gif dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\legal\jdk\relaxngcc.md dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageAppList.targetsize-36_contrast-white.png dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\AppPackageAppList.targetsize-24.png dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\OutlookMailLargeTile.scale-150.png dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailAppList.targetsize-36.png dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-white_targetsize-20.png dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-20_contrast-black.png dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\VisualElements\LogoCanary.png dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\legal\jdk\colorimaging.md dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GamesXboxHubStoreLogo.scale-200_contrast-high.png dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteAppList.targetsize-24.png dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-40_altform-unplated.png dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PROFILE\PREVIEW.GIF dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-96.png dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Win10\MicrosoftSolitaireAppList.targetsize-48_altform-unplated.png dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Videos\SmartSelect\Magic_Select_add_tool.mp4 dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\javafx\jpeg_fx.md dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-60.png dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-white_targetsize-16.png dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\ExchangeBadge.scale-200.png dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-40_altform-lightunplated.png dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_retina.png dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\node_modules\reactxp-experimental-navigation\NavigationExperimental\assets\[email protected] dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-80_altform-fullcolor.png dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-40_altform-unplated_contrast-white.png dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailAppList.targetsize-32_altform-unplated.png dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\Glyph_0xe7d6.png dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Program Files\Windows Media Player\Media Renderer\DMR_120.jpg dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Sticker_MouseNose.png dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\ShareLogo_15px.png dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Win10\MicrosoftSolitaireAppList.targetsize-256_altform-unplated_devicefamily-colorfulunplated.png dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Thumbnails\Sticker_Icon_Eye.png dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteNewNoteMedTile.scale-150.png dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteSectionGroupMedTile.scale-100.png dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\capture\shutter_button.png dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-Advanced-Light.scale-250.png dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\StoreAppList.targetsize-24.png dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\Assets\GameBarNotificationLogo.png dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\Square71x71\PaintSmallTile.scale-400.png dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSectionGroupWideTile.scale-400.png dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-40_contrast-black.png dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorWideTile.contrast-black_scale-200.png dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-80_contrast-white.png dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Edit.png dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2018.826.98.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.scale-200.png dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\dictation\SpeechOn.wav dc87211d948e14a32558129345536648_JaffaCakes118.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.19041.1_none_ff46bbc9afee54c5\RatingStars46.contrast-black_scale-200.png dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-i..ntrolpanel.appxmain_31bf3856ad364e35_10.0.19041.1_none_d0af17ec366548f3\TinyTile.contrast-white_scale-200.png dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.1_none_75cd350cc8b5dbcf\previewTabIcon.png dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_de-de_fa3317ce4cfa58b0\pdferrorneedcredentials.html dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-servicessnapin_31bf3856ad364e35_10.0.19041.1_none_8554f027e5186b5e\services.lnk dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_netfx4-aspnet_webadmin_images_b03f5f7f11d50a3a_4.0.15805.0_none_3303de6fba37b5c7\gradient_onBlue.gif dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-ui-shellcommon-core_31bf3856ad364e35_10.0.19041.1_none_91b1f58702057373\DefaultSystemNotification.contrast-white_scale-200.png dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.AppRep.ChxApp_cw5n1h2txyewy\Assets\SmallLogo.scale-100.png dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Windows\SystemResources\Windows.UI.Shell\Images\RequestedDownloadsCloudIcon.contrast-white_scale-100.png dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-c..in.preinstalledapps_31bf3856ad364e35_10.0.19041.1_none_78045c4b5f61a56c\DefaultSquareTileLogo1.contrast-black_scale-180.png dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\it-IT\assets\ErrorPages\navcancl.htm dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Windows\SystemApps\microsoft.windows.narratorquickstart_8wekyb3d8bbwe\assets\NarratorUWPStoreLogo.scale-125.png dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-m..nt-browser.appxmain_31bf3856ad364e35_10.0.19041.1_none_b1e502c19c2a358b\BadgeLogo.contrast-white_scale-100.png dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Windows\SystemApps\Microsoft.AccountsControl_cw5n1h2txyewy\Assets\SplashScreen.Theme-Light_Scale-140.png dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.423_none_9de80b9d881a1ebd\critical.png dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-p..riencehost.appxmain_31bf3856ad364e35_10.0.19041.423_none_bfcb7b02f95b1e52\PeopleLogo.targetsize-24_altform-unplated_contrast-white.png dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy\Assets\StoreLogo.scale-100.png dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_en-us_1279c10c2d9636d4\404-7.htm dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-m..nt-browser.appxmain_31bf3856ad364e35_10.0.19041.1_none_b1e502c19c2a358b\Square310x310Logo.scale-200.png dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-ui-shell-component_31bf3856ad364e35_10.0.19041.1_none_03928ee4a9e5894c\LocationIcon.contrast-white_scale-200.png dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.CallingShellApp_cw5n1h2txyewy\Assets\wide310x150logo.scale-100_contrast-black.png dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\Assets\Icons\AppListIcon.scale-150.png dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-fileexplorer.appxmain_31bf3856ad364e35_10.0.19041.546_none_476476bb5c3a0bbc\SquareTile310x150.scale-100.png dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-ui-search_31bf3856ad364e35_10.0.19041.1_none_ab0246b6c25f7d5c\logo.contrast-black_scale-80.png dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-p..talcontrolssettings_31bf3856ad364e35_10.0.19041.964_none_d1ce1ea46e50a943\MicrosoftFamily.scale-150_contrast-white.png dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.CallingShellApp_cw5n1h2txyewy\Assets\Square44x44Logo.targetsize-20.png dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\unifiedEnrollment\views\unifiedEnrollmentOnPremAuth.html dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Windows\SystemApps\microsoft.windows.narratorquickstart_8wekyb3d8bbwe\assets\NarratorUWPStoreLogo.scale-100_contrast-white.png dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-i..ntrolpanel.appxmain_31bf3856ad364e35_10.0.19041.1_none_d0af17ec366548f3\phone.png dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Wide310x150Logo.contrast-black_scale-200.png dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-t..honyinteractiveuser_31bf3856ad364e35_10.0.19041.906_none_a6600355b5f69459\Ignore.scale-200.png dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Windows\Media\Windows Proximity Connection.wav dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\UKRAINE.TXT dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_multipoint-wmsmanager_31bf3856ad364e35_10.0.19041.1_none_d1ffdc3927836528\MultiPoint Manager.lnk dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\Assets\SquareLogo150x150.scale-400.png dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.19041.173_none_6486f23c2831aaf3\InputApp\InputApp\Assets\WideLogo310x150.scale-200.png dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-i..ntrolpanel.appxmain_31bf3856ad364e35_10.0.19041.1202_none_8f7e37524c3e1a13\TileSmall.contrast-white_scale-200.png dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.423_none_9de80b9d881a1ebd\checkmark.png dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-ui-shell-component_31bf3856ad364e35_10.0.19041.746_none_2b9acc2d69574796\LocationIcon.contrast-white_scale-125.png dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.117_none_e0d32848ac56114e\oobeeula-main.html dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.117_none_e0d32848ac56114e\tokenManagerErrorHandler.html dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-i..ntrolpanel.appxmain_31bf3856ad364e35_10.0.19041.1202_none_8f7e37524c3e1a13\UpdateRestore.png dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-n..quickstart.appxmain_31bf3856ad364e35_10.0.19041.1_none_4a388618f6365227\NarratorUWPSquare44x44Logo.targetsize-20_contrast-white.png dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-m..nt-browser.appxmain_31bf3856ad364e35_10.0.19041.844_none_d9eb415c5b9dbe4e\SplashScreen.contrast-white_scale-400.png dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_de-de_6988eb133eb82b0f\405.htm dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\views\tokenManagerErrorHandler.html dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.1_none_75cd350cc8b5dbcf\headerminimize.png dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_es-es_a2ef4aab3bff561a\defaultbrowser.htm dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-n..quickstart.appxmain_31bf3856ad364e35_10.0.19041.1_none_4a388618f6365227\NarratorUWPSplashScreen.scale-400_contrast-black.png dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\23\debugger\images\breakWorker.png dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-i..ntrolpanel.appxmain_31bf3856ad364e35_10.0.19041.1202_none_8f7e37524c3e1a13\TileSmall.contrast-black_scale-400.png dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.423_none_9de80b9d881a1ebd\scriptfileicon.png dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..in.assets.searchapp_31bf3856ad364e35_10.0.19041.1_none_501fda1ac26a3cf4\HCBlack_Search_TraySearchBox_Glyph_100.png dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.117_none_e0d32848ac56114e\oobeprovisioningstatus-main.html dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-m..nt-browser.appxmain_31bf3856ad364e35_10.0.19041.1_none_b1e502c19c2a358b\SplashScreen.contrast-white_scale-125.png dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Windows\SystemApps\Microsoft.AccountsControl_cw5n1h2txyewy\Assets\SplashScreen.Theme-Light_Scale-100.png dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-printdialog.appxmain_31bf3856ad364e35_10.0.19041.1_none_3b03b28c788655c6\splashscreen.contrast-white.png dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-ui-shellcommon-core_31bf3856ad364e35_10.0.19041.1_none_91b1f58702057373\SIMLockToast.scale-200_contrast-white.png dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\x86_netfx4-aspnet_webadmin_images_b03f5f7f11d50a3a_4.0.15805.0_none_7ab11546ceb3decd\requiredBang.gif dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Windows\Media\Ring08.wav dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-a..extservice.appxmain_31bf3856ad364e35_10.0.19041.423_none_2cade1bc915dca0d\Square150x150Logo.png dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_b4fc93ef208f3edb\403-13.htm dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-m..nt-browser.appxmain_31bf3856ad364e35_10.0.19041.844_none_d9eb415c5b9dbe4e\SplashScreen.contrast-white_scale-125.png dc87211d948e14a32558129345536648_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.423_none_9de80b9d881a1ebd\status_heap_increase.png dc87211d948e14a32558129345536648_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dc87211d948e14a32558129345536648_JaffaCakes118.exe -
Modifies registry class 10 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HQPJXVFOZRYXUFB\shell\open\command dc87211d948e14a32558129345536648_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HQPJXVFOZRYXUFB\shell dc87211d948e14a32558129345536648_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\HQPJXVFOZRYXUFB\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ydvtLsBE87mu4yn.exe" dc87211d948e14a32558129345536648_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd dc87211d948e14a32558129345536648_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd\ = "HQPJXVFOZRYXUFB" dc87211d948e14a32558129345536648_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\HQPJXVFOZRYXUFB\ = "CRYPTED!" dc87211d948e14a32558129345536648_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HQPJXVFOZRYXUFB\DefaultIcon dc87211d948e14a32558129345536648_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\HQPJXVFOZRYXUFB\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ydvtLsBE87mu4yn.exe,0" dc87211d948e14a32558129345536648_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HQPJXVFOZRYXUFB dc87211d948e14a32558129345536648_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\HQPJXVFOZRYXUFB\shell\open dc87211d948e14a32558129345536648_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\dc87211d948e14a32558129345536648_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\dc87211d948e14a32558129345536648_JaffaCakes118.exe"1⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:408
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\aic_file_icons.png
Filesize50KB
MD5f0ebfe9cc46a010fbb47e795c396f2c5
SHA1f0a14f07bf27037b0b11c9fa54670a68dc2a900f
SHA256a879190f47cc445c1b882cf689c13ad384d7be1c6504cf0b8ab2e46f3b42cf1f
SHA512164ccbf4cde43c5e74b4ac3289ce6599d3a8e0949068572d69184cbfe7e37cbf4bda0c7d5e8d7a15a0e4348b04fda26a237e5640a13456a8a2ee58b8da42e931
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions.png
Filesize1KB
MD52218a16c614071aa0e64740808a48bc5
SHA1271092ef0c18eecd76548af14e37cb997de830b0
SHA256d775cffd4c0c0944f07ab5a3504e732e1002dc798c5e9b975ab12cd4a230e678
SHA51223202b005f5514831c07257d07260b68be2c01be9b075b5ec69bcafaa9df998b7d41f7c9e27291937f864ae5ac9e5e1e63cfb7affe4987879bde19acc55c3b01
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions2x.png
Filesize3KB
MD52a88966407ed3fe82e28bbc03ff764d1
SHA104199856189aecdd7936df8bafe8b63cc88f852b
SHA256a15390bfd52a9bdd3289df8cbc69b61cdeae8c49dedf3ece1cc46f604b4be2ba
SHA512c1f947cc8c577f19a98838178a1150d6fa0dc24b86de5fff6a15ca813f3d541d7a2b844d57ad79573a9c849afb5e6d517e97f3ef813f7a907538accf013d2eb0
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons.png
Filesize683B
MD5cf3ae53b4e02dbded9f59a37c40a81e0
SHA120b386f7d2f8a93a7a2a7d680b107ca4dcd40645
SHA256529f188fdce935a54f3527ea755cc12b9e534e3f939aa7454a64499c44800697
SHA512c802932a11d2464ade35cba957f7416bc1fd73ef55ea5813027cf500a5228c1c2fc4527cc789269218e26007a995bb9e273032a34db0eab7a27d1daab76a09be
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons2x.png
Filesize1KB
MD50e3943f917021b162b197f466ba071cf
SHA11e5554d919df3561edd6a2b59c7c19bef0c78ef3
SHA25656599ac99c62a66982b78de6e7f1d19fd14357f8ca84d612e4a9e350c7f12c30
SHA512380c99a3e9af45eff38f352ccd3ebdb4c75fb0cddeb4ca10d9a96fb3eff248ac8b82705a13cd13a4cbac59c6473934b176125fc4f1635497b12314903fe3efd1
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon.png
Filesize445B
MD5c2f99bf977bf1f2e38172088feb7038b
SHA1dab720578f70835eab0e1d9ebc095d6e32a06007
SHA25624b0c6c3964b59c766576a417e1b54f940a793d340c5eda97c4fe3f46072488c
SHA51216c2aa4f1d4b2c46bbbba28fb2354ace478d273374045f86f9c135ca9a8970496c4bc5b22689e7d9fa25f855a0c14ae614cd98ec81ff1f8a78b2fd62401171e0
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_2x.png
Filesize611B
MD55e39f1c3724665893bb55a085e5281eb
SHA113edfa659ebfb9cd774d8d0926b56bf62bd4fc8d
SHA256dfa3d639aded1af1b6a0a24a3fb98c76f1731a97f677febe6348b61f61f7f71d
SHA512a5233096e5ed413ca0a91d8be721ccb91d987bd7ee5d589ecbed08f45a93a04a71349b84c912063fa19feab3b097819e05125390091fa3f5edce4ed06641f753
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover.png
Filesize388B
MD502c71f734b479f4aca4420fbc0d0a20c
SHA1a8f32095e0e697236aecb58b0f29f35e70980914
SHA256ee5672fa7819c0154cc15f0c6b4decf5ee13e9edc51721f42963a86aafb5d4a7
SHA5129bbe4b61251a50f4b01bd15f0a668709524d742e90cd88293e6138b3fff9359613532d8da261c704a3aafb27aa893c647fcba0483b79dc9840297d55e15061ee
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover_2x.png
Filesize552B
MD526be882b563d616d413ae3f6367a34f3
SHA11f7c00ac557bcd577ec2ed998ba243b159624586
SHA2566cf3b8abf70c14f2c48b138559959d82a71cac06fe4db28a43da315b89a8758c
SHA512ccc13dc492f9640cb9b1cfb9bb7fabfa5f8940676f728b898de5cc520e9968a5d8e80d514832ea1f5d2889cdb5f8683bd1fab58be2818908d5a74f564f253e08
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon.png
Filesize388B
MD5c67e57d24cfb4d864689b6006c1705bd
SHA1a3501636513af4225e9f73c3f87d846ca7438230
SHA2564e1a6d11583b648001f3971b4af1db1e2997502149c0cf3157dc4d01b61786d0
SHA512d91650a9909d394e6b40495c1503d89c9fe1788658053efaa84af4bc8fba6a95032934a00c93ef44184be7ae8469fba3e7acef9046352b861e9c9a9dc62d2074
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png
Filesize552B
MD5baa21da3931d2d096d5560fb7d40a810
SHA1754d77a7e2d112713680dd0a20b67a2dc630dc9e
SHA2564f9b5d0514a5373f921649eb7c13cfc0117470bc8e940d60f7288895f37e592b
SHA5128a5d3a372d970ffb55b86fbaf3b8ca185cd325f1ec9578a448c0cf7fe66fae0cd25ea5d36dba9bc0aa2433f55e8211b4abff35dd06b85b6b3b990c470c0b575e
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png
Filesize388B
MD50b9bd95889ce4f6ec28e8648f688d2b9
SHA19ea4cae3f7d47c2bc0d986cd7f1dd5e2b4751c25
SHA25624d69aedbf502be2d5243de102ac317e436d92155339d92bada7be513e095d8c
SHA5129d980415483e88d738d1e8f4b4fbf35fdb3f8bebfb12e8bb50d422497b54f22e1f32a3e8ea40a42d139075b3c5099497f57d7f7c6d0805860d386d1b91f75f7d
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover_2x.png
Filesize552B
MD5287f6aa56c3a4ae855b868d313d6737e
SHA148aafb297feea0ce7d177c844a399951e71bc856
SHA25638c36a7a85b45eb75b4c55da1a402dbeeaf9cdd0a04814870416ac37cb6f1093
SHA5123655a1a76136dc27df5760842faed1e0467e92bdb68226b19bbf75f8652be560f27ea70e2c5ed58c61acef3ddbac85e8e5e2ffe9c3a689509278217db832f24d
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons.png
Filesize7KB
MD54281c86794f8e611a48f469eeef2fd40
SHA122a4063be2c747669bf65045afc4c24bf4c230c1
SHA2560320de8c01ca4f5096624d5f3a7503c54a2545ca683c7f203e8c84a25d0244f9
SHA512131066cd243a51277c0d1c08ab6597423c99efb8c151811ab88af43eeedd64b022064799907857397ef708c4e2b6979d6d933ae9a4e3f82c3805f21ce7871fc7
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_ie8.gif
Filesize7KB
MD5146262da53b03d9688415b454c66e4b5
SHA1b43c2db1661035c02a5e6e8b2c29048df242904f
SHA256975c274cbdc59c0b235e3ca001a08954ded0ff84e66667f30b26bd25aba95440
SHA5127825e0de19e777b3b7fd3ab61781e23c28343c4c029b00f88093593c1ca8748d9e13a28174a24ec023e678f39bf2641e8e74cb65b4b7740bf1c7351ca39f667d
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_retina.png
Filesize15KB
MD556a6f327f07d67fd3a656f76083b0d0a
SHA140762df765bf3c443b935d1eb7bebfa8350dec89
SHA256690e130e29b11452ca54fc030c3458965ec02bd5372c1b3fb67e3c89d15170e3
SHA5125629e10e4e7d3277be00724311908b3b18df9112428fd9f480f4e4b90051fe4e32139e10045ae6a73edf3b0ea2961d3d643d16f62a3c20ec5add2bfebab00318
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons.png
Filesize8KB
MD5830914a7ea27b124f5be864b5048163b
SHA1dad04ed98172fd50da951131dfcc7f9e81ebf76c
SHA256a2527878398b5621af07ba09b361feb46f6a5497d49b45bccf0b8143bc7b2812
SHA512145eef9fc218abb4d656286fcd397c5752bf57a36682058082143f9a1618dac9bd167cba150d251aed1ed81a319d510899e55286c4725c7a21bfead6a1c4abf2
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons_retina.png
Filesize17KB
MD58b808404cbbbb9088641a65ed0118499
SHA1422cd36f5a0badfeb6456ce50ac6e94c7b4adccd
SHA2564e3c32a11fe687f62723f2285537dfebfcdbfdb78405c7323ba4570cfe9f508e
SHA512149a74893e833226050df795c4f5286462ce321f4243876df3267260fdfef7b1b4d7474231c7aa8c5a7e53de943b8b33d4f99c05e041abfb0ee204aedfd88d2c
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_pattern_RHP.png
Filesize179B
MD5b007e873515388566c0aecb5bd2a9d0f
SHA11790f43e95044e0482d1641e66c1f69253eb4ca1
SHA25635dc1790ffd4c2575af7eae6862e5bec72423e3103a07c5bd1841fe7a9d378eb
SHA512dab576e92ca5cedbfeeadf07623d1f01da3fd1dad9f345f8aa7aebc4915be46fdf350ec925e306ef1df41e62c01b405a71432307e73f4fc1d419cba66e3eb722
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_patterns_header.png
Filesize703B
MD5c74593234dec059faa3eb29352f980b0
SHA1a3c99b1138a50b9e9bad01e63d4ef5cdd1e52050
SHA2561492af17ba16b11fd7cbfecd3746e5a30d2c0b847d6a2806db93a162ebf63d1b
SHA512dabfa8622d7d8354b46f7feaf6f55d4549c642aa931c10fc7ad4a730905d087cbe20159739179afc25c019d9945caace54eda494d29f9b5712d275816268ab8a
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations.png
Filesize8KB
MD59d9f9331d4cba981013b906176255672
SHA1655a4a8b225137fe457a8db25cbacde35c45d667
SHA25634b8edb8e84d730e0746963a981ad6b0391a65504740b107a06f7349bbc62a72
SHA512ca26eef7b37536130177b61259eaa4798f96f826df6814938edb54112d6d3b2ca2e92dd98732d223bc8f3106b2ec4edb81b774b837563317d431f096fdb5b1f0
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations_retina.png
Filesize19KB
MD561a3f637c8e4224dc23ca6d59f324998
SHA10c1f4bbf9bb04cdaa24cc291b0810dd76b6833b8
SHA256318d034e5fc3152130558b2cb0986ecd2c1a388de2034e5f77b9177959c264a5
SHA5123731a5181124c903619c1d3fb08ffbe0cbde9e6e449ebaa4fff87cdb6939192997cf51a4f2035989880aa97a006cd44d867e53b0e1a5e4dc881bf4399811b932
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\faf_icons.png
Filesize6KB
MD59660284aa7d93657c5e474f574b8ef56
SHA1ed8dbe9993a64abc928ecb2d2acab824fdae4edd
SHA256317311b724b4c9a125b08d83fdc67ee95326d202f1fdc4461dfa5bfea8904381
SHA51290f321983052dd3f3a0de460a7a79a61bde790a049ce0f07eb9943eb8239070e8e825472cb77efa0b2287f111ab650b65fbc1502facbe0af0a2e7dd4b64b5117
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\bun.png
Filesize2KB
MD57fad4b5a08f2a4a28da0d015839f7299
SHA1893b83e0daf2e85a3998f165562adf2b3acf72a6
SHA25658a329df67ff891982770043d9ea94b3ad2986f2694b4721aee10b05861999ee
SHA5125400d9e5112a3293a893d2c908a4ee084bde5ea5477c9c23c4dc7f0c6b2345bbc064974380a979d75ca47954881566a7e1593143d8567cd2e4e75b10f2e8b250
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview.png
Filesize2KB
MD5e5275cf2cf26856fafc47c040dc8586a
SHA19527d56414735c20313978da0e9e70ac7c6fca8c
SHA256f94e2b7f120c483a4eaef9fb92697fa2bc3b26b9954b1e855fe59438a9384fdd
SHA5123a73c9e02782f1600d952507ee81e055e7a0b48a27820ba75726c174730d4f78c19c55120ca802ac9371232d9e5894ae71ace39311ff00991ffb09c2a8e87ae9
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview2x.png
Filesize4KB
MD5bd94ba4d6244a9cf8923fe2e3e0df6d2
SHA12b0992360a6a0ccad41e1c148ee7850282edc12a
SHA25644a19836da788c17aaeb19108cb7243e9a2ec8d2ec58d77c3821456a71850000
SHA51251308d0b10235b90eae0ffa77c255dbe5821b8a876b06ee5a2a74ba32ad0a60820bc406a2684488fcd6a360a7b8af187b1479255abc9a44dea7cca3bb935aaba
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small.png
Filesize289B
MD52e3597bd34b9153a1000843cfd9e843e
SHA1ebbbf8270fe3b30fc3e17e5c58ba365b83d5d977
SHA256b3e057cdbef7fd7f2fb0efead377f3903fc00e3cef972384d355225b19e9bd6a
SHA512d675e2ac95fa6ae7a64f8cf3d6f6fbf5368c314bc5e6171b30de06a7ea66b1fbdf72325a3ce5299ec1b3347b402595f203bfbc59b44ec5523e136a8ba5a5fa6c
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small2x.png
Filesize385B
MD5a8f953769877f47192fe775780de34ad
SHA1b0ac78b5e0c040f136ee91ad323fcbc0400ee638
SHA25680175a3b730717bd5a869f38eb3a4fbc4b51f5a0f98950059aeaf089d319ed08
SHA5125801621beb88ced79460cd238ed7f3745957b2871c3c89ad4dbf67c8695faccec4c2330e3b14a5736092e0066ecc5eb9a795ef873fc2b5d423ba34c22e07bb02
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\illustrations.png
Filesize4KB
MD55c9a419f4529126e32fa1148b57b5791
SHA17d73b406ec15286349b9ab8c1ed695b32e15093b
SHA256f818f9c8ff093604c302c3055b63245a28042332c713aa759b7585763637aed9
SHA512af5308d6256da3a9e58c5fe5bf6cb90ef7d6c7933971402e0a82831f8b63bc8aaae1aea732f036aac0536c5e9a62bc4f95d1de127eebb206f2b0756567cee332
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\nub.png
Filesize1003B
MD59841cdfe72cfc52ab00d913ad7e5ea95
SHA143a57077e334c273cce4d6e074a28c0cee32a547
SHA25617c089363b1696328890838f61e5168bb6d144f04fd6b5d31a20297de071c806
SHA512bd1d315d691f3c17254b616fecae8f7f6c955fba2f4087439645250b051864fc27808ebf1b798f5e4f324e2737d41b41a2e1b64c2baf0fb6d5aaf299ad5c0462
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons.png
Filesize1KB
MD5701781ead7cf137b2beb4d7b16fdbacd
SHA10cf16f9650dc226998057369c9de12823c981285
SHA256bd38da0265a8682a4a73d84c32026b6a6473511e0f92ffe3133c2ac8c9fb3764
SHA51264e39c84be74ad73434f1ffd9661bb08a853687ca07366099a20ecf1109b2627110fb5c0c4b59484fbab2d20f935e8a5a1171fefcc6744c6ea0d51fbf382d23f
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons2x.png
Filesize2KB
MD5c77684e6394790db042d1a5abb9ef4d8
SHA1499a22be378c2e969ea6b175c6d0358e72d0e496
SHA256937dbe1964cb0dbbcbccc0ca04315b2dba7fcf1eb5c14f7d6452664d959e9804
SHA512e8cdb6192ed72efaec1b607f6b201378893430ad00fbce41d8d5aed26ce16d38ceee7b6e460b7b88a7d09a2bf49fd3074e49aa6eb59aae878feb6e8f3c2a79d0
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adc_logo.png
Filesize3KB
MD5373aa4668a60b5e62be2e3aeb10a0662
SHA1c8c74e6c791f320bedfaedca2d41c0dff004e2c5
SHA2568bbef3ea448b7266847408317b06884af7d4d0e2698677e64772b6fb26fc2fc5
SHA5123cc9ffa2a8279caba8c7c3cd72cd0750a13ed1775c07ca05a7cda810e2c2c998593912dac0536bcf04920d4a07eb69eea6bf88b222323e25515d0a4227603088
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adobe_spinner.gif
Filesize556B
MD520812d83a29624a0a3e90df201a5d4cc
SHA1c957b7862ee1f633eddce17b5063d975149ddbb5
SHA25658dd578d1aa4ca987ade1ccff983e867aedd67f460eb5e6b961e764fb148ea0b
SHA51202e39998c14304954db81fe434dcb178e923057db48fb2c87848772d4f68947028c5297c0824b56abed3364817a0429fc862fd6e1eb96ec3cb5e934c7ab0886e
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\logo_retina.png
Filesize6KB
MD5a3f7db497eeb211041dd52ab6209fdcf
SHA1f14f764266d5afb7966d086d0d39ec1d4c9ec551
SHA25618c83eb68384dd142d5a43e294ddb677c2f9967f1c4075a25e8010ddf70527d0
SHA5120fc541e0bb04b7b8fec56d4ffecead02c0ea875e9f9293be5db0cab1df61e0798a292a0e16636f00b347df6ad7d26791a2414172d508bf2a5280ca360c41b8df
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo.png
Filesize826B
MD59721e6a39653d8e52d9160f98baf996a
SHA1736d8d0faa191a15a8562e5e735ad68bd6811db9
SHA256ec68e64089395861ec322b3eea17c57630fd0febda17b3cec314dee252566008
SHA5120d1f053d6e41106d5f049c1d3baa5412885a21ec0c7738ea163dc8527a44105ae9920d9268a36bfbb11a96ac29094d7f28ae7ac74a59bd985bd6e0e39cab2c09
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo_2x.png
Filesize1KB
MD5d656eca885de89715d830791261bdb0c
SHA12b5136c3445187679e2d67651d7273839f5504e7
SHA2563dc556572f7d32047ff5e5ff185624b6ad350fa9d12050f45ffe6968d662785e
SHA5121b4e51c92e14d36733e490b2cde45ddfd9cb72d673b2cb2b41f54b94f1d8a5618374b9120234f27618ea725a52f843e644e92ab2b7de16d6297d12f643817c50
-
C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB_EURO.txt
Filesize32KB
MD590611d7970dfb24267f57f93518f72b2
SHA12d34d704b8e2d25ce4748e57d845011deeac2e98
SHA2560eedcce831f77d2639db9ea055080da44a19a01d4855ce79487c7481a0c9c892
SHA5128e842460ee3d2905c748a33c691edf02ec71a91e80698166b3df49d5b60c2e47f77e985dc9c07b8f15cf89399b5b72280e2ad7cb99b4224e11faf0f30db46b07
-
Filesize
153B
MD530883770f0e1b85be83484db85ca75a8
SHA1df45a077c6ab817b1a4935d8b33a574715ffb09e
SHA256b88069b671b8cac359edc1afddc82204bb54836923420902a950b7b005d9574c
SHA512fdf733776b21c61f3cf0c4928efbe5b011747a9c513e838484c608ff933d6de4765ba83d2794584122ce5e82e52f2717a6e55a656cc94d0b469c551f73427a94
-
Filesize
190B
MD5c3b4abaffc2eefd0795276c020231ca3
SHA1c7af238fa2d8c306a5bbef8fa34fbe9f37b0c197
SHA256229563f5902c2a9a783cae8d1de6c29cbff659b78de38d79c924cc4d91f5424e
SHA512b7e5c85cec8e43361453b78492cf42cf304afd71827f507f7142ea0c9359b33bb00bd84072cf0fa10c090a9f84958e1f0f51fd0bb190d15df2ccaf2e02bb82bd
-
Filesize
190B
MD5c22abb656240a7ead724ab536e5304a9
SHA17a2f30169c839b97d7a768753ea368acd60177f6
SHA2564541ebe7f06a1746e8c945ebb50e21e38b4d8998bab8a01f5e41f8bae3552bb1
SHA512527115b12247f2c9e42ae8f19e37c88e964f2eee01f6e5f01ed9a48c00f4277be188232966cd0989a7bf83f2ab20403e12e35365d84e406e258c7d57d7848293
-
Filesize
1KB
MD57d81df0b5a0cc26611180ff024b6d63a
SHA196f07b6dcbcacf3be15292f28630a2882b0013a9
SHA2560c8d072e4bfc3e7a274dfa7063ff62899d304c2a60bb060937f3174bfb266ee4
SHA5121338dc5fce1185fa5b3af7e81d06fa41896ae9277a8bf8fbce5267eeafc71255bcb4d8342cc486d231527e1c85b832c59b7ee6173b53dc6c54b29583f65ee1e5
-
Filesize
31KB
MD5b3b66d0ce4b3b3404b1425990b06654e
SHA1b3281b438144303f23ed9a5bea2b20a6d35f4012
SHA256d6a1547daec3698d5db5ef23c6327c7e29f22ed31d4705c02833f54448bf98f2
SHA5125fc733cc1f14002348a13686edbb7de0b24c786c160d6173d91ed4e5a8d688f0237c970d558666b955b8bf3e26a11f989d0f5762b7b383beef42846a0d25a95e
-
Filesize
34KB
MD561e15aa864300507e0b0a832d8e28504
SHA1930697406d3c53e3ad10d5ed059a0f5a42e01231
SHA256b5d0a7fc5f8b06abc04a5843be206eb2224738e11a075388f5a8d2e4a2cbffe8
SHA5122daf38e66452d18d6420febe843dc7b776dcf3c8a711cca500e2bbe0c07f1fc03c1d9d079725a990e26a8595cfc0f6701a66b7ee32483c13633f89ecd3c03e7a
-
Filesize
23KB
MD557ecc8cb787eea7ed14771554dcd1e5b
SHA1b1530a0aced83d99d24ca1c1a61c58cdd9e9b97c
SHA25638c84b3eb481219bb12bd7c4bb21f75a4dabc8afe496bd57a02d2922be94e0e6
SHA5129f14f18b02b1242c89b105a00cbe74c60ddadf110aa77b38eceac59d27c86eac550d4892c22ed08277353c158901c2f4f3119e0f9540c677f62d614a25bee548
-
Filesize
2KB
MD5dba422763386e2c70dd5b8ae4ba5ab28
SHA14350300cdaa32b56881f42ab436a2fce5d828746
SHA2568ad4b1b4dd9f1c20694969475b9199fa7a064fc5c1d72367ce0a6e346d442a82
SHA51226e703a39be3030f892ffcd2358d0a43a1becc66dd24d958600c737ff4d8f1a0420d581614e27169b6032b5fe5f9a584e58e2ba31abd388047726ef5c8e3df03
-
Filesize
1KB
MD5a3946aeedc92ed6b1b7f14a743395c0a
SHA178efb5d7b9a48452fd3bab2f932aaa1b108a3543
SHA2565afe9fa1b5dc36a2bd5bbc6661469dc524f532bc5dca441440937aad5d757194
SHA512decc1613ee5113f859b7f62828bb25f264b3c63015431ff7d98a53345e1302289ea1fe59bd4c80f5ec08e2aab7d4f9de9d9b2e791a1a06d54e67fac7f994c201
-
Filesize
3KB
MD5647d7eb03dcbabfe00242d85bb9482a2
SHA1203d4f8d0398970cbcc7d5bdb88b24e861a0f518
SHA2565eb460ec4c5376a75bc1f31c01918892c923b3a7d1b63a04577398118d8f646a
SHA512fb104d9156a72e4753cac4ad628f80a0bed679f3d1f8cfa4db305a1946fd0fad10381fccda0b971e22ffe52ae201daabd352c60930d0f1746ea5f34f5899c741
-
Filesize
2KB
MD5f0e18bc4e26dedf0e069cdcf8df10b74
SHA10e375e0e502d65ac8b92f85beed259798c18bacb
SHA2568f9e2d7a9e9f1c734c05f33cb298f276244889922812a0481f147eff17386383
SHA512132a1c7e7ee00ea2b7d662cbf495a85b98dd2fd05cb36ee021f607dcbf092b9b23716c964f14afaa59dc0084b3d9fef0fef9fb7dd91ae72e39e45cdcfbe71b08
-
Filesize
5KB
MD5d18c5627fd24ace45e764ffa16e61148
SHA1529cf53481637ce710142a60d9fe432042c666e7
SHA2565bc2859af92fd9701e4e1aa0ce320a820c9d5ec2eb4875820ab3e3b6f7696c4f
SHA512463935cb22c9064c3cf1b51cad303a4376fbce1c1e1daaa5337741a91cd9ae77f7398acc5fb535330ee2f22e0cc46bbdd70b291cb1cfb21e059536bb8758956e
-
Filesize
17KB
MD5b6e177d6c26d67d4b9ad529db2747a7c
SHA111af47711ab2b89d760e3ca5e4185c08a744a478
SHA256b64e0b23f45acd4372f281b98fbd5c9631ff48f26d102bdc15f6d0d680188a5c
SHA51213a6808f57919ba1bb82a38f1e2a28f1658a9b07ab2ef2970f7618c3d72c082fbe99852ab2ff9740830262e648a267c3189a9f63cd41f718c48386eb3e95d8af
-
Filesize
320KB
MD5d0b754964a5a6ef84f37a041de37b993
SHA1627197d8c4dc2873d88a96f7c779bf48a850161d
SHA25675628710cd98764c15531bde9753533e45b16ce3abfb1aadd6371ee0be2e8c8f
SHA512189b2423272cbbc24d54beb248b3ea252f665655cfb3befa58600babaebefd539885bb980e3c38167e64e664e3e64a50575e841c19fa2496844b98c81edb9ee3
-
Filesize
1KB
MD542a96652cf63d5acc843f77881cf044b
SHA1518f997fec270f958a745d29bddfe2633cc40f1c
SHA2567fdfdf174438ddda1b22af49476a72dc80893e5ec754f984f72af152994f5080
SHA512e89ccfdfaecf828ae5b3f3da1fbae7b1b3532bf81e8543e629f79559afb0ad90bd7bd6a760019213cb1a085c36ad0740b124ec07b480a55c5bc169fe02330f91
-
Filesize
10KB
MD57c771ffd6ad36ee977cf7eb5c9d6c255
SHA10b0c9007876a6f65c5d54a918224b66f82a28710
SHA256c4878400d804b41acbea8f37603a5261388da5593c07aaa5b24825fbd724bb93
SHA5120de8e7839b66bae2698a32aaa58a9d81ee21749ad302413c56a2a3da374923871c4f36fb76d11cdd61620d211b481ffb2c0523c3273230ccb842bfb69be44f52
-
Filesize
3KB
MD59e5242a21aa17da307805c32110ebef4
SHA12b37ff16bd78931c443c0501003e298c409ed713
SHA25627faeea3e40a3a227c7db75480bf1cfed50d48aca97525056b669e3c14ef3ab3
SHA5120778c1e461f5b0f8df7c433ecc98e490cf8bdcaedddd60d9e9786a4140a852d0eee3c0b741571d72867709da0d624047c4934b5e7d8615b697bd9c09428d93e1
-
Filesize
162B
MD569baaabf78ac7c4a4a3f676e852b3e04
SHA1d73546a5fcfd3122a482e886e1b3128e1d648aeb
SHA2565a30a0d4ed369ccc821a6f290cdc82c73ba1878f76cbe6ff618e36309d9bd018
SHA512154e1a828a4f5af12feff82378f9b612397ecd9d132f7217bd7a4308d3f9b5765ffcd9872248b4b9cfcf5047980db8e3ec7892e56593b4229507f4b77c918e69
-
Filesize
1KB
MD5e9ae872069e43f0d0bdee6baaccf0f41
SHA192a903c1f8c968e7c7aa8d13fbb4e2ec3ddd97de
SHA2562931cf94635b63ce7a9bdf4f405abe7cf5c6ecc713ade28ec86345d2bb9db6a1
SHA51233408f7162bf1bed9f3da16b2995ea15a1fd83733d9be5e6f398c86be33caf8ecc7e39f74fe35a53aa6e1fce50aca8a67df2ef8dcbfcb1668ccc216652d18e37
-
Filesize
3KB
MD5c2389e2b3011a716a6caa6d8b6eda314
SHA12be23df43a4192ec88d823b519c2b783c4c4b642
SHA256969d3a296c213de6a8511d08a827f8a10335fc66a7e95626afc4e8897d6d8c17
SHA51269839160f56947ae2ba2fa05347080ebb515c3ee86d85e0b41767d851ae515babf721d7fe2759d4f58d2f8b7e7e2195f029853928a1b08724c66628bbe43893d
-
Filesize
1KB
MD5bed8b6abc44526be993218db5f13c294
SHA1fa5c748603eefb1aa4f1a08bcd20342123b35837
SHA2567ea7b53b7ca3dbbbe39b7d941d0c2756c2859a2e82d690ede93b84ce683fe5f4
SHA51286a8f406614a617589a6b99d26951355d714ec67b463ef8026f093363123b10ec5ee108bd6ab9a6766d7b45f194520eff77134d0403ad3d3cf185783f20038b3
-
Filesize
28KB
MD533c62aff8db07688d454cec685bc7ea2
SHA1014a0a48a1563dceef2b1775f7752b5f060951e9
SHA2565a873a4999edf7574775119f4bbd56db2e0d9083601c39c69914f3293c05422c
SHA512baddfd92e91be847e358144dc5e6ace9f789daf2ce49ed8f1a516e64a9b60cc5e06692a63c43996812d28c3fef5efb7d9ee3edeb55074923f1f5dc0d399f8f4b
-
Filesize
2KB
MD57f8f8759c1c69b8a680346a751e96396
SHA1c5b5a6e047f7fb323b4cc9a7eaf476fef36fc5d9
SHA256042bd03ec5d19ce5af74834a189020133ac41b45cfef42f8b8a18aed886f5f06
SHA5128ede6d964d4f288bc4b4866041aeaf2b4aa0097946707868754187e28e210dd00705951ef8db1d7b7cf85c52a3bfa14745a22434a5bb7c2870bb9bdd58879e65
-
Filesize
1KB
MD57d859a94b74cd9e1e5bf0ba5a7366de3
SHA1beb2377d73ae1edf08968cde9819bb1ef1d7ebba
SHA2568c5d8e3ef675aaa02788d16fe6996a57c782d5407c209ea400279bddcf995c5f
SHA512b4be645df237c715fab3b82977e73b1eda108204556e2de3a6da968bad69f104d7e87dbd8ab4e6fdb69708c7034ce731cdfc10f848b7778e5b2bd4df5d10a046
-
Filesize
2KB
MD549b62938d9130960e5ca40f7238c3049
SHA1d66b797324d6d21c2568f749327855e9936c1962
SHA256136ff9f75aecae6b41427bbf737ff50ca9a83f63786188ddd9f85702d084eb54
SHA51207f4c6033f6f13ea68b524b1a26465613698697407c4c16406a60b1a7e402cc1697d2f1b63d2fbf3cb2a3cbd903f6ed6980e1d724347fe1da2f52fdb8d633da5
-
Filesize
1KB
MD5d3a3de37c592fc9c0c82d59d17b01100
SHA160ff9f5854bfd6253549a40a0b243212b028f173
SHA2567c75dfb2a62be46e851472f9153ab14ba0c817465ebbc5a35b3d75140ad68d3f
SHA51240df2347dd0c132c4fdc48877afbb200ad41734dfd9241a1b3e06030f359abb41bc7ce30f477f0391e2d706d6aed0291c1de13ff24fd92286b338cf12bef3af8
-
Filesize
1KB
MD5ac9e41ef79c4efb302105fa5b19a6cc7
SHA1acdd38f0408ade9ec59d25fdc7322f255c5b4977
SHA25623b98805ed26067a55c942ee3f592cbe23894508b461d7651551b3079d6b5b59
SHA5125fc975e8b05a7611b2ec44c126a07e8485a328c8afaa86c03fb7ead6dec4a72a8afa6cc1b535e814b5e09151a3f28d4e4cce988cd48c052bacf3622752bffcf1
-
Filesize
1KB
MD596b46fdef916760636f0753a35086b89
SHA1806ec4c2ababd1307487c3bf28f6c87defae01e4
SHA2567ae4e079a29ac7b2fd8954bd74feeca5e180684154828a61de744193d632ebf4
SHA512dd7937781f33ea375aa393921e357d629bbace6da13800c8140d6e25eea2af9735aed160a435c842505f06ae47a8eba16cc29dcb45ac48ec0c39a72fedbaaa61
-
Filesize
3KB
MD5a67645e6d1a7b49e2df69ac017b2771f
SHA134a94ed8d4b5bc0c1c421042d544517c86e0c3cc
SHA25613398d77c47eb7040cdc53b43c8b8eb9f9a1e5a7b025cdd76c0d4342fa81a83c
SHA5129007e78eb31d047cd4fea481a4784ee07439d846cad2636c4bf0a574402fb6fcecd0d31c9fe479241b68993c339c04196445c4f9fae2633ac8c15700ae84f4b3
-
Filesize
2KB
MD519772ee2244269adc6e67f55ad8f03c7
SHA1d4d6cf7d778a8bbdf3a1f270b07b2636b8db2992
SHA256021b37c901c95409e1f2040f4260773075e74520a120e6498577b50bee3148de
SHA512bc7e387058a9df274047460233a963bf5d0354899f24368d3e2b7ecb47d15cac95a70c9024cf73a987fc0d88af0f9957b0289308717add1be7c8f6228b30922a
-
Filesize
6KB
MD5127cb47adb25174ea24f0f893ab4b64f
SHA1a57ace4a39d851afb453c6ea06d174a3af53cc1c
SHA2561723c9d983394f1a9c4c948e28b6634e35b610672a41713165cfba8cbb8c2c8f
SHA512a52ea86f302b95119e4537ba50e44f0a26e777bc646d3456e9852ec6a3cfe53d77407cc0bd6c0a7c83ba90f0d870d3fe3223185493836697f44b35b7d300a060
-
Filesize
5KB
MD590bde531c8051db324d409609868a40d
SHA102fb8a374c2ffdb5b74b1ec804bea4402f2bdba8
SHA256456c7b925760d8d2369b4ed26bcb72a54ea2d07d644ca0e66be28577f0d2d709
SHA51215a2ce61c86ea0d31673f5af2169eb3fffa3d412e0f106e528120cd085f2d513fccd6f22b8c10fc4b6ad5cf766c736ca8d57d73b1cb189b4ee647623d0c23a5c
-
Filesize
3KB
MD59d10df9d04d9a553badb4f53c9c2932a
SHA166733a382a1c246244a4447de5e7037bdd9ae70a
SHA2569190678ec37502184cd7d64fd55d153132b394ab3809f95ad74087faefff7e64
SHA512745be38c49ee7e7ffd064af1e12064aa291afe3e93e332528ca12127eaa53a99b8eb43dfb102f04a21dcfac6acda90104e6b67f5f8b753388b98e04346995384
-
Filesize
2KB
MD570b0f425381072790242cc2f43224a88
SHA13997e6487e12fe1e4ed819668cc6f09e1693e2a1
SHA256d11e41150ca70740a88b9bc560d1a559350e3b25194c715531444370ec1c0f16
SHA512dca9912126db6fe4bab57d1886d997bb4ac6cf1c744a010ce885c18d024eeb42d12fd8397acd26d1550ccba340f26761b942daeaa01a0d8b16985f16e301e7cb
-
Filesize
2KB
MD5b6fe9d44cb68252005f1cb0df3048129
SHA12c286ee156545b5ea61fff87a5c5c897cae2117a
SHA256dc6994232a3b6e79494102430080a27784f809304c68b5791299418893b46deb
SHA512b85a5cf90b0ef44c8c5cf3f2d69e5f3aa9aaa9c573798bb90487eb59138153e8070ca08304d09a86ba6f28abc3062eef5961a09a4063b4cfc0a6559130eaae65
-
Filesize
1KB
MD53af51b6522be4b7db37a886ea6d747a5
SHA1025e6efe6fbcdbbaadc15f7679a5e641e56af57b
SHA256174407322e102ab8f8f9c96150f88df8dd7c633a715f91aee7c916d9a22d02de
SHA512426d3c39645e6dec2735c257c65179208cbc778e9e46915a3f767e821f2d6384248715844a1b7c3116902dca44392dce5ec54e377f13192558eb1c05df520191
-
Filesize
1KB
MD591f1c63230d517b96c6b52be459530cf
SHA1fe8505dc14f75ab6ed9ad095c7fe32e79f2dc74a
SHA2569e682d4276227c8d0924e6fd81043b99c0e40531a5a52c5a863c937b60041677
SHA51293661a6292b1570f181555c574f210fe6bd0ed385c6e135d2b7eb5ed820a08301c583bb0c0d576cf53b767eb0242170a294af6e69f967b2fdeeeab6efb737a20
-
Filesize
11KB
MD5c27324bcd3eb30bae330a5f8cc9d3513
SHA14e69347e903ab7405371a587392512cbd53df9eb
SHA256759cc85a4de46971d2904594adec949f2d153246c85cec564f6fb4124ba9dae9
SHA512fda1b40d09d6d30ab14e8473b98cebf1b245fd3ba93c2b360e3079c491e1f0d7648538cd9941a6506e0c4f91d2b2bd3779b606759b9b24d5b24eae9ddfd1f3c6
-
Filesize
1KB
MD5d36c045f13090e45c09f15d29ba721b8
SHA1a79f91299b5a17be6bdf82516807cbee1d160dd4
SHA2568803bc5325ccc8c01b152c36cbf736d5b7e9f4cb5a472bab2d55ac23c99304fd
SHA5122aff346fdd2f9fe2ef10a1c5a327e290a07be8cbbe9a3150914a1b06361b3f77ee69638109c7308bfb27baae3a07e537312716f1f0ce42efeda94eb88264a11b
-
Filesize
2KB
MD593503c97be02817251251dd0c2e0b590
SHA1893d52895144a1a708496b289c96348d1cdea4dc
SHA2565deee15478186662b620895429a3af902befe70f495ba4983f926d8ff41ae15e
SHA5120fa810c7cdfb94679520ea8a8f44f08c7c22f9669fc0391ae09e8bdc1209a9baa74be90d3bad24461f07dd6db30856f0a40883fc1474d8a0dad22b809a0463f9
-
Filesize
11KB
MD500a3285da34303deb609b653f811371e
SHA17f0903d3407255e7ee8d9218a2d2ce46f8af9568
SHA2561aa9b3796481bba7a99777e5d6cc95fed6e5140ab4815becf55f8a4047fd1114
SHA5123e5940e55991d171d5f41c453288aa5a29f3ed1fd6f1de554338c4ec2c90c2a0a65a122a7a750bf5d60ecd02b580836a9d4f27a2ca0516d855404fffdc8dff5a
-
Filesize
11KB
MD5104b0a39083ec4f26c14087e962ddc40
SHA1875559875e72f40b567ed6b7be403625c432943c
SHA25686b3983cc84a612d22e5703779d083fb1beb29829995cd340c94dec2a89ef1be
SHA512b951df6392c160efc9220ed8f88963d5055f924bac34c27c73fec2e45d50e7ae84dc6e855504da243fd24adf88114eabff8af73c68e295e9a5acbc014f3b7571
-
Filesize
11KB
MD50ad2d6919c23c01c908db2921ed63c9d
SHA15ff870cd0f93dc66d1b14e186d0691391088fef4
SHA256aea1b91120758a080fbffe231eb2c70860a4c67d970ca6d1d23561f328e6e2e4
SHA512a5971274acd7d62c91ed948c7398f092e0b83f23b77284aa67b0681e31116ea75d1388a703cf95269445ca696cf32e70315d28a0dc2f7bebb9404fc89170dd3b
-
Filesize
1011B
MD5b4f0e87b24d2516355ee81edcff52837
SHA153a5fef0f672c8d8d446bffd897c1d82a0bf2dfb
SHA256a9b831a21455e321165812e643159019b3c02368ad9d0d88aecb75efe1f4e015
SHA51214ca9e77fc0f5a7a797f7dd4291d09f2450608f4d58b54273c9f57e552f23f06df5d0c87ef4d1d914860d1a013a6a5d35782e126bba77fee36e9ddaa86ddc804
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727656120098725.txt
Filesize77KB
MD50beb5a15935be1b991a883a2d2980e55
SHA1091ceb6a62b6daa63b240aee72c8aad63210b945
SHA25604923339d5a1b35f5cf6f65b99a2b25058b78b87950db512ce0f560453d6d429
SHA512d7875a61c22570612176014934bf20f7929cc5a8c31dc3ade29df0ce36913946fb08bf3dd9c2da550bcaaad6494757641327ddea4194267acac5f26fbb017bc7
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727656590293648.txt
Filesize47KB
MD5173a93a21590ccc92f53e0ad67dd44c7
SHA1c80ad151a401f98cb552babe533d09004a806841
SHA2564d026fe0ee505a514c6fb84cf405ab67c252f3a1775db8b089b9da5bf9135dbd
SHA5123dcb9df5296875d13a60e2c12dff44515a1ef1c8f0c6b4d18aa074581225f9a8be89a307eced8aaa39c6e1f19ea3282498281ae2b9104692b50ef602233e2e50
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727663328721506.txt
Filesize63KB
MD534a96d62220c18276d6b99ec80a9cece
SHA12ce78a1836c61bb7480d168ea965930198ed8115
SHA25609743dcc3e9b5803d48d949c02d222be068734486f595e0fec855487e19fa0aa
SHA5124642437cdd71447a3b11d784a9ead2733d47ce781b00ce0c1d1e61de11151052e2d9c45e463510bac34bccd66606cb43a76c374ffa0131962ef00dc9bbc4fa41
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727666039184869.txt
Filesize74KB
MD53daca02c6c7cb6ffceab581fe39db4f4
SHA17a97569be9a230ba9efe0eac416ab9e720879a3d
SHA25666b2276514c831742d42fb2a5fe63bf453382e6b507dacf80d0607a5edf15af9
SHA5125f5ee5851aa1dbd0169ddc245bee833a3eed2501faf8b95699935f2fcd39b11345ad3faba3c78ef51051cf9350eaafad4a2a08b4b1be8aa431e122bb2b1d427a
-
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\File Explorer.lnk
Filesize407B
MD5e8fc15e1f178d589f2486eefc4bd2b1e
SHA1f429b39cae4c18cf599dd9a25b2c19ac43d1d4d0
SHA256b1c6161d549c6015cbf271c62ea87430c2b75cf38c075665a4f7ca12121cbc53
SHA512c6139d29683dc26a3eba9d6e6d2386d2cd0e77cdec129e4b871770ead8f91ac7898448c15d2e59a5a5f65feb8bfff14420a2e68d57a3f15bc4b158136234fd7a
-
Filesize
21KB
MD5bae356a53dd616e2305f3d35bf86da74
SHA13391a0b8a405695822a9637325bd6d91a2139606
SHA2566d3d34c95db7b104db9171432e8df2c22220bee7a6d690e5a8a434080bab1505
SHA51276d4cf2680db091a7633ef9c8889739162ab0635b0cd7756afbb4cff0e64b4e6877514b4703d4a8a53daa590aa410974a56c152e25614f29650c31bda589925f
-
Filesize
1KB
MD561fbb673e97a2ce3626ab12c77064ea8
SHA172b53951d51b59f41e79a958c66d7d5d9f98fc02
SHA2565873383f47bb38b137ee9f49992f9ed36dc800b29b031486e39f24285c8337a2
SHA512eb2f0acc956982054c8de8feb7d94c3a5facea1f65c3ae78a839e9007d43afe340d91340de48b7c745f50215744a28df1bfbab81ec9242becd8ddee561ed7d60
-
Filesize
952B
MD5006b3ee77fe3444b0b122773a7aa9cab
SHA1d20888ede89314151fda19cec58455d92889cce0
SHA25635de815cffb44a4a0e5156f138b0097d1d16eceb6baeed338e5ad8b5c9efd165
SHA5129e6eeb2f8452d070610b6ad44ffe09cd30febc635ef9befd228b7207f8fd822051f9c19736ae436c51b26a9153c988a5541edd20a246853aefd015cbd8df42fa
-
Filesize
121B
MD51585c34aa27122899f042a6939ab639b
SHA19dc13348d55dcef9855cb06734cf0282ee7c5812
SHA2563d82493b651199b8895d4861b2a591b55d6408b52723a157a4162cfb10b9fbf7
SHA512bc87fb0d88cba610b924bb056d20e4c5edcdec6b242750ead7855b5afd0b3350e77d5e66750707bd7201d5b30304ddba1cd486acdef95c016cd8d7f712bbc308
-
Filesize
1KB
MD5a8b3ce8a4b80c309f179e28d49c7220b
SHA1ebeaa9aa064dcece8474813f0b5e832cb0832d83
SHA256ca98da6f83b744fd59829d25b9f852a9f789a76cc1c1af212ae9609539546c09
SHA51272bf307afa99e846810b80b57b4585314e24411874a7f86875b8a0c97be0768b1734723c4cc8c19bfc0b39a5ce007117c9d5e9412400ea2785df680ff14693ae
-
Filesize
8KB
MD546ed512cb90f7a90ad6aaa3c51ce9309
SHA14ff88cacfff33df528345689e69744ed9dd43579
SHA256d08764eba562570ab9591b8d80a5fc14a946e3743eb4cf85b26643ebb41c52b6
SHA5120c4a0f3b8eb12f58f3fa74ac5fcd03bcc08e43b9fc14e9ba5fd071fcd004b79ec8e373d923e65b6f4d302f9f69b8607fb0dc00b2532f3f892e6483ad907cd881
-
Filesize
914B
MD50b63e598a460707ca49ae49666e7ab81
SHA1064303db4488dc7e5191bc7fead2ff6b996fc4b5
SHA256860ca6292187c1b08be29b1b6ca976b4ec22ab49f60dfeef4b6e493d4bed716c
SHA5123fa5eefd4410fc91cd8e96c0711bf51f3c9361917344f8d6226dd48ca77653c1ef1f07d3675d0f25a7f56ca0af17cf3b7791483d2035c21269bddd7fe356dc62
-
Filesize
90B
MD5d8ec9a3ffa43f24cd9130434d16f4211
SHA1442e38779590235da0eef7e7feacd0fa2c575e88
SHA256e631ffe072efa27d130762914aa82e47e9202991c82dbbc95e4a763e9352c5bf
SHA512854d269e4d57a4204f7055361e98e576584e3e79bef3d315955b97c0214858410dba882102025ec41d51fad8566563ed740b1a2fdc568ab079da247ce44b19ca
-
Filesize
90B
MD526c733452e86360378e1c23a44ffeb9e
SHA1706ac4f12586a5b8f03ab769ec578118cf1e1584
SHA2560d4148a345635dc5f2dac33a6afc87900bea603730ed4b7b2f1779fba3196a2b
SHA512af6f1eb5a802533047ce0073e2ad278b4f019ec08311da208f4df9f0c82222a17c89e37d35441562ebe5b9170a3681dbed9a5a7f104606466bf9d14411e83e82
-
Filesize
328B
MD55e06e867120e297439ebd00499ba414f
SHA1166615c610d75bd602e8cb96f26bdd27223aa73b
SHA2565b4eb189d2ef00e774438d6f5e5af8568bd6a951069e8b288c993ea9444324ef
SHA5122173c89fc6ac7716d8932102d24bdafe186796eab51a2b946498641bfe21d86320d86ade8088476ee948bc06ef79ee7b48a2fcaea1dac7bc787d8a6a55e8de6f
-
Filesize
1KB
MD527c96ecd196a152f9a1bf2fed186ff2c
SHA1ea545044bbfc7c8f8eeba9dd520d07a8fb1bda47
SHA25623a9917cb8100bd4fe32beec29651205db8ef47857eabdff06652027f24ea25e
SHA5129cb41725080df0bf470940d66ef804c8387c3324322512bff4fe6c7c1fc1374c8710d29a99e1fd243e403746fe1a7c7c41f97071aabc6824873d2c245037c521
-
Filesize
162B
MD5d0830efeffb74e5531ab7766909315df
SHA1a66779a791710915bf4e78687d197c67bed558f2
SHA2566adf1b4827a82f016565138c49a0c6aa801c052a78f91fcf729a5fcfa1e24684
SHA512f52a475d4eb2e722c3708bed45d2ebdd665d133b856e004bb0bacf4738d949071a0127d4fd80bb4d395b4ea8a486b3bfcd298983aba8882aa5a6f9ac68dd7000
-
Filesize
586B
MD57bfdb742aa3c63e82f0b43d408c71c2e
SHA1549909dcf81624caa77285cda7c03aa7869a50a6
SHA256c7dfc32d059f12482e2f262a9e9e8eea420224ac0c3ec50c29189e7b59922893
SHA51290f6890b967eb05da3f62129a1830511a90e5fd310cc8fd3030b069c8ce411325d970e3332d3a951baa5ca93a667acb5e2c98875d998e6ab724f01ba3143de13
-
Filesize
124B
MD5f9a8900f6f13f8f875a10c913ea85eee
SHA15b5191f404b16472b994caa87a39e2d690c2ef12
SHA2560be0649b16a000140a1cb3ac82e24dd4114106decbe711e57e4934ff72a6323d
SHA51279a306d69176847f274649534f887df9810cd98500df4999ec9937d9261923fd7168cb0b40e064a0677f1817efdca5a44be7ee149ea555b37b27c549a61a6642
-
Filesize
8KB
MD57e4eb644f9e5d9667781c6971b6506d9
SHA1b32f27cde88f4eac57c2d01384e0998dc28caf94
SHA256bf607f18b22aba724303df5d1edb58692adf0d4d784224303681c3890a24d066
SHA512e55e26bd4fdd68e3ddadfc661f58b44dba4d0debefc59d9b082a6e4012b46d3a338b0741ca1be877ffdb7b09c8f171b079d46aa6444d5c5e253957748ac0b5f5
-
Filesize
880B
MD53658770f0aafc68aeb15a0e257137ac3
SHA12acf8041297a364dedd81661912b91152d5dc2d3
SHA2561601fd892f6820e012e08ee0283b7d9e1aa6db8dc7692f9e3a3a0e6ac24a018e
SHA5126667ea885e56751136c1e8104b59d4fc17293f25f240a43e01cb156692fed8c03820a7c3512d519a0fc1ab93d0609f52065f11d843ffbca4fbfedd0abe0d406c
-
Filesize
1KB
MD5923d47beb9390c91cfc538049e7b691f
SHA1988947abced3a73d04112fcd375ac24cbc1f3ff6
SHA2562f5435e6e91c4f8b1bbea1690592dfb0f94a416c268b24356190b2bd4e43d096
SHA512f5f250e61b86fe3eab10ca2b29724b5d7d6e7308a782fef6a65b43db17ca015b92c4795a24997508669947101b7eb4f3f3f9981cec2920d36a42bed1064f0acf
-
Filesize
1KB
MD5c17792b6fb371fcc976261e1939e9328
SHA1c5447cbf6bbcca48833f3a2e13d12cc77252544c
SHA256f4eba9653b0d61b0b3295871dccbcbe8eaec5186eb78b596aa8057ccaed5a019
SHA512dcf3898b5a7cb8aed6607cd94859f836b9c44312fb2a01bf05be49ab555ffc25b39f5a4b9a60a47cd4e6e3ef930730c75c42bfbff5f84e2774191e746dd81d01
-
Filesize
1KB
MD5b4b4f028fe90fa6c975f975b81c974c1
SHA1d0275f04373f2cbfd084b05733b376d1683bb440
SHA25689bc818253ea32ba7e665428c104d0516168640a8c1b9b58d1e86a95e1651bb3
SHA512eb7ad5e8127811e2e9d17e0b80d8a51d9c1458dc73f873c4b21e1ca0b429df93f1ea32bc44dec15525a17a99909072e6b0f1e05c06a6df79b7f04a2f27d5cdd2
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\3 - Windows Explorer.lnk
Filesize1KB
MD5ef2e6de907780a33d5df03490bd22a94
SHA1814df9aa4e9a0956362e76b9ad76dd6ae4c2871c
SHA256980aa7fb6d4f4c52b7a79a0325ecbea9232b30f74e8368c5efe0853cdc31ac9e
SHA512f46496071ba61f38fb466873717c2ff02473eb3f6b6c1073bbe64b76be414d881c66610e3b2a3aacb8a638b6ffed2fa9b35f6f4692d4014f3c395ed8e15d2af5
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\4 - Control Panel.lnk
Filesize1KB
MD553b154eec401a90382ed898cbaa68b6a
SHA1db4fd9393887ce4668d66f3710f6b43fa07f5e4c
SHA256b991065ff87d89ad61aa122a9a3fa19153cda144efb46b4776ab453f765414be
SHA512960380af18b053affe844eda107d53e09860100c75506bc5141bc8933d561f8b9a30ecdd896628e442ded862c6ecc9620ab8bff617e10f28da09fcc1de75eeca
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\5 - Task Manager.lnk
Filesize1021B
MD57173afcfbfd0ecdab5ec8c0674b8aa1b
SHA17cbf9daac4414bcf57c0d3f4593190e9c5431a26
SHA256b55c0e6ded8bae0ddefaf4b02bbba0734aa6d65d624c0daf0dbfa62b10d0fd5c
SHA5120b1b4e0c254c9286cc1c08f2438bbbfd6dcf7861791cd2ba029d3881993ad1b0018dee158a2f88c2266a809a45423de03e954ff160673d1345131c9a767a2659
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\01 - Command Prompt.lnk
Filesize1015B
MD521736db8048b2a8542ac451ca50576ce
SHA19f807adb3f0c4100a4e8f960476dcab8f675af99
SHA256f2ac80c6c2ecee807ed240170110c1de950e3b30ff2c862b5b01181a73edad3d
SHA512e43f88a549f8b35ea542f73481fafcf38b14227c2f74373cd21bc19ed3e67ca5e5997aac82040d62ffb940ef354af8af74d98b9b976274c710465ee1053682b5
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\01a - Windows PowerShell.lnk
Filesize1KB
MD5f0ce4e4a8922dc3a380888ee03e5eef0
SHA1ccbed4b885f7ff220786eac5c753f6a21f269051
SHA2567fc04a22085404c2763e22506e1fcb744fde2d5a03f5db6e9931356a4117fb83
SHA512125d1a45cd8c66cc50e20ebcfe14efb6f03a536608a455cf855bd6d9ea0d1537fad036ff7e604c66be81e5bb55dff0142c33f8f099c3b2e0ec3da454f95efa4b
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\02 - Command Prompt.lnk
Filesize1KB
MD58560ee8cba35d0f9a9de22df8647937c
SHA1a0038b31108597ba73b6b637fe958ade6283cc36
SHA256dd066ef867e61650aa6b1f47c6fdbbcf7353902fdf01cb8c709d3287bba7af84
SHA5128fbcfdff1c0a4b9e74beeb8d6d0e6d75208be311565ae34407d5a88eadfd948553db49196a6e1e445a2f8083ccb94600b338ebea3df46983935f552162644475
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\02a - Windows PowerShell.lnk
Filesize1KB
MD554e1d3e0ed4404b16aad77f048024b67
SHA1908962f58c987b3d892ad722cf84db6c13fff3ee
SHA2564745ab81b89b61430d3d4bbe27ca971d5c133cd5ae0bf63f34eae306dd30e5a6
SHA512632efc624a93d16c6b430042b7015f173e05526dec10005680d66616075967cc9999f80f5c5be346224b4ce89abbf60eecee745fb89974159d1e6cc1e11e18d9
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\03 - Computer Management.lnk
Filesize1015B
MD5bb48474e7524b717200ab81b45f938d7
SHA1759fbbc7f85f95027d5b62aad0293e5f0a7d93f6
SHA256da2c0a5d9d16dfc16e81977d1215aad7cd8305699b640bc8fbbd124a362b587b
SHA512cf2a620b6224b199695c6ea7304593de1b5463cce3ffcec413791b4f739bbc5a06782aacc9543fc1b5986bf82c5292bdd1c1e6bfa96863ca2e755dd461814d55
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\04 - Disk Management.lnk
Filesize1015B
MD5f1ef4c16fc41c4d63f84175b8b46b242
SHA1d4ac0ef362835473cbe0e25348be8e077e4818bb
SHA256a2e480c8a2ef440daf86586fbb054188f7956dd06762b1e712fd5fca75f82447
SHA5120aecedf12e67e8217656c99aa630aeb66e813997eac75fd24fe229d9b58c70721e05caefde567a30a72d64bce41d197a370f483fa9809c3849c1977e714c13c5
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\04-1 - NetworkStatus.lnk
Filesize1KB
MD52ad87778fcb0adaf4aa706aaaa738b91
SHA1f2816a27fd493ac4577aec15d0de2a361c1f2b4e
SHA2564c78233a9df39a4287dcddbbbc83a97eb93f56f302d3fab760668a5ae5a1fbfa
SHA51278864e4bd3b146b98e9df8aff73dc79de0ac0a23c992036c4e498b5da12d112ca8e07d5fa8e3684a0733a9a11a8cd7558d45dc2a86ad20fc51455f67c088d7b4
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\05 - Device Manager.lnk
Filesize1KB
MD5d651dd163cdbe95f9062f2e7741fa3ed
SHA1568e5831e42a0fe170fe9c3d332e1237034e31be
SHA256859f5b5ed8e53a69bf4f56777aa25af3ee937face86458e394bb38568c973fdd
SHA51272a642164d7fc02acbca67021786bdf4512ec46785e3d57204390f14e2546d8764bc7dfc81bd5e1cbc6a37b33f5d368d508ed51aaffeca15c919a4c4cb5ee62c
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\06 - SystemAbout.lnk
Filesize1KB
MD52a901a9f378b92c1156de36264c43b86
SHA1f70140ea77703e934c55950128d38703ec0c49ae
SHA256c6262d8178655f5700010ad926c11b0d241cd2c2770a1157b2c7aab5e19b189a
SHA5124ae887130c50b07e379224aaedccb2f295c58c41e282cf9cb661489346cacf98e43350d5540913f88c7221ecfc0fb5739b07cc9fd0ed12539bc70cbbc3c0371c
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\07 - Event Viewer.lnk
Filesize1015B
MD53871867228c44a6cf9fb474044aa6f6e
SHA1fe2de48b66448216f7d9c956b803a544bbb86a34
SHA256aa022f362d841582eba211b8bf28f206698818f8afa524355639511d02cf958c
SHA5121256471b47313d36fb4233f12f9614a3fd8f41f5e76456f0a390f3deb6c42b2e6f2140da812303b17dba09cd8561aefd93ca4b063eabe22f7ac1b844f311cd57
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\08 - PowerAndSleep.lnk
Filesize1KB
MD5808ec2dcd040401efee1b132986d8a5b
SHA107087c7ecc4e7337f648c9ad0add66bd7384d955
SHA2566cfd653a949d4b96db8d701105809bcc46d2e3ccb0c39ab1d7ed6d6199aa7fcc
SHA512a7d4191c5cb24af02baabd84199a8b7d45c2a4d6dca29c3ab3264a18d60b2deed42d69353f0f49eb99fd9721735888adb4096ddba7241c1709b9d196e7078900
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\09 - Mobility Center.lnk
Filesize1015B
MD54fd20819a277f16a3ec3d63800722f91
SHA1956b1b12a30ece5497e067fdb493a6748ce77d9a
SHA2566a4f4262030ebcda2587d1d9ee7ba35213e9b9aa186c6b4f04da900361e835dd
SHA512eaec9bc45c669a2d30195b099b9768dd5ed2e9d8084ee5cf3ed42f1b8c4b86548c5ae44711244e7700abd43b373183a439a483be0716e7e10b45231a67100918
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\10 - AppsAndFeatures.lnk
Filesize1KB
MD58c3a815a637c01ba0b140a96ef0ce05c
SHA114007b3df02c9ea5f316d2462c40707c713b0ceb
SHA256971d537090e452cf5cf9561aa3b548442eac75a7ed31d8238469d53c819dfc94
SHA512cfc7e470642f2fc9f4e381306ef88d8a356cfaf8eb0ae259515b212c8dcf861b2664562e739bc777fd97477270fdb6dc94c9c2fd0c05d0ed0ef72f1ecbdba766
-
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk
Filesize352B
MD5affdb3bd2860a7439911950fda0a2695
SHA1f33b1b8b58fe81ab1e36fc90b229a89abbca602c
SHA2566f99652c181c1dc46c5649dbc901f9b9f832c2d177514aba99ab3a8894356c87
SHA512f7d7285dd66be85c7e2b92cbabb661ede8480ecbe7a5ba5975448c9fc341857cc650d2c007654ce330119dea931551c91689cbf215a4a8e0e179174d85132da0
-
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk
Filesize334B
MD5fc19ab9ffb759da1e277093fa4277fa9
SHA191046f226cb08626b0f17b5d2e4d482792cd89e6
SHA2569e6045e113998de047eb3f75bf2f94eca86815c48628b6f0b6c478923c632536
SHA5121a263abb49b17c4cedd9ae86117dad5b89e4109cf80eee1850379ce029247eb30f50a3bfe81558ac824503e2e0da5c3f34a09728f80644d4c055719953f1b5cf
-
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Magnify.lnk
Filesize1KB
MD5e9ddd66c04514c5c50c65b98c1a2e280
SHA13124091f16705309742acdc81270cae70ea754d1
SHA256e295a031894a2c2dc3c2d87d583848b1689126d34e4d09e40821a5fcdd5246e2
SHA512bbf702c499c4f1ff18d1cd3f2e71b54f64bebe035a1e4e2a054a83b9bd561de539089a1bcd1c28a4d5a1199647aae1b2aeadfeaec879f6ca736f117372fa6439
-
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Narrator.lnk
Filesize1KB
MD559a13b7d5147edee3375324c562f1935
SHA1fcbea87be21904d1a406fe733601a2e4f156fdde
SHA256e6be03ade30d03b856ace872c32fb87269bed5db03712683db6c7acf2b972210
SHA512f4cb67f08941e635b21aa194fa82ee3f13025f86151c831c9df301ab514ab77318aca32452c529eec04d5c595c03e7a3f8892d8d298b8958901b15f2dc4973fd
-
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\On-Screen Keyboard.lnk
Filesize1KB
MD56f8cdec2fb7440d6e85255596614d297
SHA12da588da90d3ea6f7015137b246e19bdee0a2b3d
SHA256b43b4b65b352fd6ab319c79add15178d20fad09b5756a968dc231c037d9b2c07
SHA5120b411fa3e861b817c4a21109e56a71b0e7aeb5fd267a8cea4670d3f459d2352238d092a5721d3dfce5f43a76af309980341686780aa8580c868c32a04459adfa
-
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Administrative Tools.lnk
Filesize1KB
MD5d5437e24ea8d929f75043d3263d36e57
SHA120fbac15b99ed73fb5320f1baa0f195691d60d0e
SHA2563f5ee50e030f2714189194d08f40ac3d75e4ec835902220a0323eaa2737ee9f6
SHA512fd5c0b79a463b871210612429fdbe48865bc769a09525512655311dbacf9e8a8f69cf568bc7ebc12bd3504d47ca34d678d4fd809ecfcbf1a02be25fdceb8ce03
-
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Command Prompt.lnk
Filesize1KB
MD547cc469f295a323f3479edca2e459884
SHA10f44e9cb7474b6623b790546e9d119a54976e2a3
SHA25652b8986ea840c77c3b79461526db28b5031b6c82217e6bd31eb4d1857e6e7cfa
SHA5125540f68f08ac4d03c2c149592561844a7d9bdad8d4fb4957c688a609e98acad4c107ca25e6a5a10fd73097e9d74f4bf86b2bfa6ae484bc439d0a5c880f3f699a
-
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Control Panel.lnk
Filesize405B
MD52f098a59406a2c04e7dc7e01421a9bef
SHA10c3717ce4146d0f5d4652d852bc179b6621ab38f
SHA25688509aaa25550419877d7baaf3c35fd7cf6776775b83853c680a0c3945ec7320
SHA5129a5e9d1eb9f144e30133a16568dc818274b35387d351397109846ee2605e85e6dbdc7bba28ebad0ad78bb8d9afa378cb0f4adc8bcb329d1d78cf2f983c31e6c7
-
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Run.lnk
Filesize409B
MD52e247b8d631c69a4383cb7b7dd0be69d
SHA15bc39aefa6422c14760eccfd1a2bfdf634942935
SHA2567d0b4dc9cff1f04e4d00971b0d7bfe465e50d70987ff5241105fee1766d8a659
SHA512938700f0447c09473dba8ab0a3312000894c3260b0e2a41b41915911bd313da4a511433bd103b918312f300577e8eb090a03192dc8dfee6d08d602467d75ab8b
-
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\computer.lnk
Filesize335B
MD5216605f3f5b2c535e84835bd78be606c
SHA1db83e556686d2fcfa96473362c095a6874f1acf6
SHA256af04af68c97e93d70f0891fd9c6920ed074235d908471ddcaa8743db004f1ed7
SHA512062f006c43de192e080eaf5bc98fad66ad96698aa3252b57f0e066a0f5d09e46cb5e628157b7af771d525b7a5cc89b65f050e18e74783b7f625218b23e951be7
-
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell (x86).lnk
Filesize2KB
MD5a82efe264b908995b9a41aa664263d88
SHA1c3ab01974bbb918a350b38a12ef96742a49c6792
SHA2567cb7b11da2dac02d7b5f148f9b17e1170c79fe17ff533c0a7234a69fae687a87
SHA51218d654867b7645855540309cd3827f7141945bb2ca50fbe9068a986eca14845720c71ba0b6eefd9b9231bc2daeeb59e6100886d22d1fbd8073bc23c796184d2e
-
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk
Filesize2KB
MD556d97f1cda6ab3a4ba8d335e28ca148f
SHA18354f2a0280a7dabafea9390dc526a3beb5d26f3
SHA256dc987bf66f0083fd8913a39e0bb132a22726a2224bf4096633f0bdf05806c916
SHA5125994cc3e11af79a43d432026c13f59604a38f337acda7ea9bfb70e3e51842c41eb7319d219ca68b75db6d8d018c5bbaf2b0cb1db0f4c1906b50dad4ff9f4192d
-
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png
Filesize296B
MD5fcfad7ee8d8144f11bdb92b7da1f4e43
SHA18ec12f39b925e61b9888c9ac0350575117c046f5
SHA256d0b4236156ff71841a6e41f31f760462d678a5701fd754c39fcf7354745377c7
SHA512b9e28d78b4d2f202ba193d08bb08d2c578f212e9bc4874839187a11e829ae669f7571e5455762bde4f66a0b357fb131729b40ce7824d9eab31c5cf3231a9a73c
-
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_contrast-white.png
Filesize276B
MD53f6027944666b31d4b9768d01b5413f3
SHA18943a9fafb22ea419488ae025d91f24e01f6ee46
SHA256ffc33e7db2bdc4cb0f8f91c61c26ba0f6fe0861201c5bb4580d7a3cde98b6f77
SHA5128ac93ab65c1bce97691c397c77fb453c5cb1af8c2449aab9dc7baee2bea624361680f7948f5142c076992012a356384fbb74727365fa63f218262545ab75a75b
-
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png
Filesize296B
MD5458ddaaa2bfd662f676ea882167c8e78
SHA1423ddfc46f530287a679657ed0fb41806c48aaad
SHA25644e29594d99379179a6aa66adc01ad191e7e1b68909a616617ce423eec6ef5dd
SHA512c172e0efe3784af6e5ec062a5b7818e8315ccf4afa0e51c14e2b37cb55a3e7885ebfdb3f802cb8653d1766a7b07b2ab359e61dd978411874ba2745ea38a45e22
-
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square44x44Logo.targetsize-44_contrast-white.png
Filesize276B
MD541ac6628f47e09181d089ab2e6b5bfee
SHA1d50fd6feb2dfaab02e7fcefdea930fca9c82dd15
SHA256b088ef9db5770b1a4aa704b40d3f7087e25aaeefb87d334a405b8e8a28adad07
SHA512489d7f4e25df0cebf1e9fe8143f589dc440e36afe29264da8b61422c4d3926250b4bc2187729239e24e9dc16cb43ddb2774ba2cfb2ff0b41871619f1da1d4151
-
C:\Windows\WinSxS\wow64_microsoft-windows-onedrive-setup_31bf3856ad364e35_10.0.19041.1_none_e585f901f9ce93e6\OneDrive.lnk
Filesize1KB
MD56f80c60792bc37604e104b7d9791e020
SHA1a589d071c81d330a5ade35948a3a19413f7f897b
SHA2561cee5192ab0e0bc211d1604eb3b4bc2b6a86271e8fb3abd1152573e734026440
SHA51274102a75b19cc3e3a27fbe6154364b7dff4edc16cb981c86b3e9f823439487f6be7ce41a4202ebf3e554bf8690383ac65c26730eb9467cdb2e231a6060428043