Analysis
-
max time kernel
148s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
15-12-2024 03:35
Behavioral task
behavioral1
Sample
f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe
-
Size
13KB
-
MD5
f2187dc6a727dc6acd947d4f0daf057a
-
SHA1
ce01fbee72e2a99f43c693131e50f804d99e9ca4
-
SHA256
b31b3d847be6d345f5ab196c773957a6ff3a9e138897c02e0e29b753c6e75e0f
-
SHA512
774aceb5ae4ec8d621db614163d7d32889d06d12ed6594df110b59abb73c105bb44292d77a3e89ffef7cc1be7b889bf18d2dc967c11b76f80aa9a91d376cd0b0
-
SSDEEP
192:J/TrG62a6B10k3g4fXk1iTV3HGc7EkpAqEjaGpsHcxUw4h+lfPtRMHl7Qul:JebFNw4Pk1itKkpAjjJs6B40WHzl
Malware Config
Signatures
-
Renames multiple (2766) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Drivers directory 9 IoCs
description ioc Process File created C:\Windows\SysWOW64\drivers\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\drivers\gmreadme.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Windows\SysWOW64\drivers\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\System32\DriverStore\FileRepository\mdmgsm.inf_amd64_d7b1959484ec8228\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\netvchannel.inf_amd64_ba3e73aa330c95d6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Windows\SysWOW64\es-ES\Licenses\Volume\Professional\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Windows\SysWOW64\Speech\Engines\SR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Windows\SysWOW64\Speech\SpeechUX\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\en\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Windows\SysWOW64\cs-CZ\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mbtr8897w81x64.inf_amd64_0d8225e7d2696ece\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_RegistryResource\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\microsoft_bluetooth_a2dp_snk.inf_amd64_213eeba98cc6f2f4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnms005.inf_amd64_add71423ba73e797\Amd64\MSxpsPCL6-pipelineconfig.xml f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\termmou.inf_amd64_c4c8f901e3534194\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\usbprint.inf_amd64_86cdf3e1f512cca1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Windows\SysWOW64\pt-PT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmgl008.inf_amd64_c0d977e565fdc839\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmkortx.inf_amd64_93b84ecb5fd1cc85\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\smartsamd.inf_amd64_2238284d493e89f4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\rdpidd.inf_amd64_ce12c614d182f4f9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\sbp2.inf_amd64_1d08bca921956372\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmisdn.inf_amd64_ded39545dc6c301b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\netvwwanmp.inf_amd64_f9e30429669d7fff\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\v_mscdsc.inf_amd64_05925c79fbad7433\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\windowstrustedrtproxy.inf_amd64_db5be14d5e02560f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\wmiacpi.inf_amd64_4ab67656039b026b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Windows\SysWOW64\IME\IMEKR\DICTS\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\c_fscopyprotection.inf_amd64_9c108d8ac558a80d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmaiwa5.inf_amd64_8416dd97e1ecb6dc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Windows\SysWOW64\IME\SHARED\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Windows\SysWOW64\tr-TR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Diagnostics\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PnpDevice\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\VpnClient\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmnis5t.inf_amd64_c6e181de81a59b54\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Windows\SysWOW64\InstallShield\setupdir\001e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\nete1g3e.inf_amd64_af58b4e19562a3f9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\netloop.inf_amd64_762588e32974f9e8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\it-IT\Licenses\_Default\Professional\license.rtf f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Windows\System32\LogFiles\Scm\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Windows\SysWOW64\MailContactsCalendarSync\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Windows\SysWOW64\slmgr\0409\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Windows\SysWOW64\de-DE\Licenses\_Default\Professional\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\machine.inf_amd64_b748590104fe1c15\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_GroupResource\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_GroupResource\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnms012.inf_amd64_707d3849370b9d23\Amd64\MSIPP-pipelineconfig.xml f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BranchCache\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\ConfigCI\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Windows\SysWOW64\DriverStore\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\de-DE\lpeula.rtf f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmbsb.inf_amd64_0e44beb9cebe5a1e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmvv.inf_amd64_26dc960cc4c84207\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\net8187se64.inf_amd64_99a4ca261f585f17\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Windows\SysWOW64\Keywords\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Windows\SysWOW64\MUI\0407\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\c_mediumchanger.inf_amd64_69ea0d8614286224\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\c_volume.inf_amd64_a2da2b286ed77704\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Windows\SysWOW64\ko-KR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_PackageResource\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmcomp.inf_amd64_bf289615d063c627\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Windows\SysWOW64\InstallShield\setupdir\0021\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\c_sdhost.inf_amd64_b71f983cb35bfde3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Windows\System32\DriverStore\FileRepository\vsmraid.inf_amd64_3d2bbc45931b8232\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Windows\SysWOW64\oobe\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.ODataUtils\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-32_altform-unplated_contrast-white.png f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\dark\arrow-up.gif f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\Bibliography\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Paint_PDP.xml f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\GenericMailWideTile.scale-400.png f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-GoogleCloudCache.scale-125.png f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-64.png f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarSplashLogo.scale-250.png f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-40_contrast-black.png f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\RTL\contrast-black\LargeTile.scale-200.png f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\BadgeLogo.scale-150_contrast-white.png f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PeopleAppList.targetsize-80.png f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-48_altform-lightunplated_devicefamily-colorfulunplated.png f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\Autogen\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-30_contrast-black.png f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\x_2x.png f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\es-es\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-40_altform-lightunplated.png f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Windows NT\TableTextService\TableTextServiceTigrinya.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-256_altform-lightunplated.png f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-60_contrast-black.png f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-20_altform-unplated.png f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubWideTile.scale-200_contrast-white.png f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\LinkedInboxLargeTile.scale-400.png f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\Ratings\Yelp10.scale-200.png f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-48_altform-unplated.png f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\AppxMetadata\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\Weather_LogoSmall.targetsize-16.png f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\423x173\46.jpg f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\Office365LogoWLockup.scale-100.png f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-60_altform-unplated_contrast-white.png f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\1850_20x20x32.png f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Sticker_Heart.png f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailSmallTile.scale-100.png f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ca-es\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\nb-no\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteSectionGroupSmallTile.scale-150.png f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraLargeTile.contrast-white_scale-100.png f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Program Files (x86)\Windows Media Player\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_2019.19071.12548.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\PhotosLargeTile.scale-100.png f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GamesXboxHubLargeTile.scale-200.png f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_neutral_split.scale-125_8wekyb3d8bbwe\images\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\RTL\contrast-black\SmallTile.scale-200.png f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-48_contrast-white.png f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\nb-no\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailMediumTile.scale-400.png f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\de-de\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\css\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Cartridges\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteAppList.targetsize-30_altform-unplated.png f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-64_altform-unplated_contrast-white.png f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\bg1a.jpg f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\LinkedInboxMediumTile.scale-125.png f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.scale-400_contrast-black.png f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\trace.png f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Program Files\VideoLAN\VLC\locale\or_IN\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\SmallTile.scale-150_contrast-white.png f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\MixedRealityPortalStoreLogo.scale-125.png f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nager-adm.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_4a42b216383aa9a4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..fications.resources_31bf3856ad364e35_10.0.19041.1_de-de_5f62429dbd124202\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-cryptxml.resources_31bf3856ad364e35_10.0.19041.1_es-es_225883fd4325c2e2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.19041.906_ro-ro_6bff4a7f0ff97122\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-services-svchost_31bf3856ad364e35_10.0.19041.546_none_93b4a0a1641d085c\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-trkwks.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_3e131bb414d5e8bd\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-w..nkobjcore.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_b051086052b81881\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-explorer-shortcuts_31bf3856ad364e35_10.0.19041.1_none_6da8f779b049952c\05 - Device Manager.lnk f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.423_none_9de80b9d881a1ebd\libraryCodeIcon.png f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..ar-wizard.resources_31bf3856ad364e35_10.0.19041.1_en-us_99f7681a50b408e1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-syncsettings_31bf3856ad364e35_10.0.19041.1202_none_0a85d29e13d6bc20\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.19041.546_de-de_1ffe9f42dfdf278e\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-remoteassistance-exe_31bf3856ad364e35_10.0.19041.1_none_ed4924afa14354c2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Windows\WinSxS\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.19041.1_el-gr_78f993560d286ca3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\inclusiveOobe\view\oobeenterpriseprovisioning-main.html f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..zard-task.resources_31bf3856ad364e35_10.0.19041.1_de-de_93e09aa7a4d174ad\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-advapi32_31bf3856ad364e35_10.0.19041.1052_none_6277ca3070041917\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File opened for modification C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\fr-FR\assets\ErrorPages\navcancl.htm f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-p..riencehost.appxmain_31bf3856ad364e35_10.0.19041.1_none_97b0a47239f6db64\PeopleLogo.targetsize-40_altform-unplated.png f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..gbinaries.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_744fd835e07b80ab\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..languages.resources_31bf3856ad364e35_10.0.19041.1_en-gb_61455d639cf26591\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..communication-winrt_31bf3856ad364e35_10.0.19041.746_none_dca4b5461dafb31b\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wmvdecod_31bf3856ad364e35_10.0.19041.1_none_82d03c27b40e6ae3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Windows\WinSxS\x86_microsoft-windows-s..-binaries.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_ddcd2fb40bffee6f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..itefilter.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_20e5151b922a7eae\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-rastapi_31bf3856ad364e35_10.0.19041.1_none_c4d537dd193a87bf\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_net7400-x64-n650.inf.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_f0f5642209a27d2f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-font-embedding_31bf3856ad364e35_10.0.19041.264_none_9df66e7bb235e234\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tapicore_31bf3856ad364e35_10.0.19041.746_none_c2332356a565df1c\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-miracast-receiver-api_31bf3856ad364e35_10.0.19041.746_none_f0f047a9abed5c0d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\x86_netfx-aspnet_uninstallpersistsql_b03f5f7f11d50a3a_10.0.19041.1_none_9f52886e7ba2c371\UninstallPersistSqlState.sql f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.GPowerShell.Resources\v4.0_3.0.0.0_ja_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_dual_mdmmhzel.inf_31bf3856ad364e35_10.0.19041.1_none_9f3c37adfae7ab47\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..management-coredpus_31bf3856ad364e35_10.0.19041.789_none_f00b638561c37d1f\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..indowsuiinputinking_31bf3856ad364e35_10.0.19041.964_none_cd503dcb4207c819\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft.windows.r..owershell.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_483acb9efea3cd46\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..omerfeedbackmanager_31bf3856ad364e35_10.0.19041.1_none_9224c91b2d8eed57\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-p..econsumer.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_9a7ce02ef73966bb\Rules.System.Network.xml f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-scripting-jscript_31bf3856ad364e35_11.0.19041.264_none_a4799d6c7f7a472c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-help-datalayer_31bf3856ad364e35_10.0.19041.746_none_a2b3f28a7d262dfe\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.1_none_75cd350cc8b5dbcf\i_start.png f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.423_none_9de80b9d881a1ebd\addXHRBreakpoint.png f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-devicecenter.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_44344cd8024ee1bf\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\AppConfig\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_hyperv-commandline-tool_31bf3856ad364e35_10.0.19041.1_none_e2f75fda217d5015\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..ayingsessionmanager_31bf3856ad364e35_10.0.19041.746_none_6344049ee013f218\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-onex_31bf3856ad364e35_10.0.19041.1_none_5bbc2970bcb926cd\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_ialpss2i_i2c_bxt_p.inf.resources_31bf3856ad364e35_10.0.19041.1_de-de_2728a1282da563c7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00011009_31bf3856ad364e35_10.0.19041.1_none_43cede33f3ea380b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-microsoftedge_31bf3856ad364e35_10.0.19041.264_none_ef195f564f00d259\MicrosoftEdgeBooksSquare150x150.png f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_system.runtime.dura..nstancing.resources_31bf3856ad364e35_4.0.15805.0_de-de_9788d9ff3d8066db\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-netcfg.resources_31bf3856ad364e35_10.0.19041.1_de-de_44f3b896d1c628fc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..odbcloggingbinaries_31bf3856ad364e35_10.0.19041.1_none_db9b05e7278d28f2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..esources-mrmindexer_31bf3856ad364e35_10.0.19041.264_none_46982d372e36f203\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wmvxencd_31bf3856ad364e35_10.0.19041.1_none_09d58e7a0e38d4a6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-microsoftedge_31bf3856ad364e35_10.0.19041.264_none_ef195f564f00d259\NewWindowIcon.scale-400.png f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-directui.resources_31bf3856ad364e35_10.0.19041.1_es-mx_3074710fb85bf18e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Data.Entity.Build.Tasks.resources\v4.0_4.0.0.0_es_b03f5f7f11d50a3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File opened for modification C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\de-DE\assets\ErrorPages\pdferrormfnotfound.html f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..okerplugin.appxmain_31bf3856ad364e35_10.0.19041.1_none_11b2da2074e7d6e4\PasswordExpiry.scale-400.png f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-x..ectdialog.appxsetup_31bf3856ad364e35_10.0.19041.1023_none_fe2a3fc32038c1d1\r\AppxBlockMap.xml f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.1266_none_777e4c5802d14c18\retailDemoMsa.html f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Windows\WinSxS\wow64_windows-gaming-input-winrt_31bf3856ad364e35_10.0.19041.746_none_fb318affc6ac79b2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..space-launcher-tool_31bf3856ad364e35_10.0.19041.746_none_948bc3f58c193023\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe -
Modifies registry class 10 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.BoX_12 f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AWAKKOIYADHWLKX f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AWAKKOIYADHWLKX\ = "CRYPTED!" f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AWAKKOIYADHWLKX\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Lld7V0hq2775mf4.exe" f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.BoX_12\ = "AWAKKOIYADHWLKX" f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AWAKKOIYADHWLKX\DefaultIcon f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AWAKKOIYADHWLKX\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Lld7V0hq2775mf4.exe,0" f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AWAKKOIYADHWLKX\shell\open\command f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AWAKKOIYADHWLKX\shell f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AWAKKOIYADHWLKX\shell\open f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f2187dc6a727dc6acd947d4f0daf057a_JaffaCakes118.exe"1⤵
- Drops file in Drivers directory
- Drops startup file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4900
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\aic_file_icons.png
Filesize50KB
MD5709ce7ace34549c3acd2dca9ce12802e
SHA1ff10b593e6be923e57c6c3278d6443320a3a51bb
SHA2562fa56c989be81edc58e5ab489cfc2999b7a32d0d1235842c84754ee70afef579
SHA51269374f2273817878a79bbe8dd4bc44a6da310c208442dddfb186fc36ec725d8fe0edbe1f0557611cc5ce1a35bb38f36c40f5fe9247c20783fe131e8246495562
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions.png
Filesize1KB
MD5b781308baf1ae89b5f7eeaea231b0201
SHA1a14d1c13d8615670ed5d35b3d832f04f48d0c6ed
SHA256e3eb28a4e2481d69c2f876c39b1dee312b6318f77bd64592fd5c2177b4580b20
SHA51257fba73ce4f5c80bdca9599cba7c8eb63bdd48415711ad7567f044d0afffb2a0c9abfacac5b7fa876b5912a4e5cb0cdc67ac6384235afc3940e7dfd9b75cbeb1
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions2x.png
Filesize3KB
MD5a54ae95caca06b56c5483e3d341caa6c
SHA101352e0961c57d3424ecd7b337493e719d07f235
SHA25681329129b31c55338b9e843bc42befffbc4c03786da6390b4d5ff261ba591c10
SHA512b383370cdd802ead0c0ec999e7732b41d1824f1944ee0cbad1b6d812d296c762086affe4831c52865909eceb71a90a98b1780cba631015accdc4f317675f3653
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons.png
Filesize683B
MD5c0cf00d4ed4a00b5fd19306da7a8c1fa
SHA1b4637fcbf5e1f4a8ffaab0c55f19966b4067dd6c
SHA256b3ac1c21d0e0b10a2ea98a95ac62ed696b6408f3a38bc5737f6f7b4661360a94
SHA51277797290d5a15654f57159d4d8b265bb4ebe9a04604f77a1de7eff763d0c850280d31fae13d30efa985dda38566d4f6f9f076b7c1f581f438e7e331a52c3bc8b
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons2x.png
Filesize1KB
MD51e1263d880a5382ba8e3e272ed1b54c3
SHA107b2f9ae15dae41cc5dc1a966f29bf1a668ad788
SHA2568af952db1bc97cd838dc0b1336d8d8fd83625ec1bcb1e05abb95e33d6a6ff7b1
SHA51260f2faf948216366f643d590324b3b27310ddbde708364bd6afc9778d8f82dd27d00dd8ed964d96562334289103c2a3103f5e171a9a2d97ef6406b7ff5adaad7
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon.png
Filesize445B
MD519205975f16cf6364d20ab1715decf68
SHA1a9821be87bd9c1d79b8849706fc8265b3c080f9d
SHA25620d3a9d1a10607691b17388a6b6a2d7ad39a0ea2b2243ec2af0eefc803a0da97
SHA5125411cc946f0a55e33d9528408d172df587e6b477b1be72853cf57536153c45682e79922ed6125d4051ec8e633808dc184e7a300c99f05e1f12bd36099854ec9f
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_2x.png
Filesize611B
MD5483e8df7586a4d24bd22f6ee27c610e9
SHA18583db34904a86b344f7616a11d47069e46309c7
SHA2564734aff08e31d92ba889e36a22cb0edd83519aa96e5242fa69bd12008df2f8c3
SHA51296fb087beecf0dcfba0b5d943abb2ed3e2fb8cef6090e9532ba1c5afb2846537d881da8982b85e90dd5c6a04faeba1bf1fabb15dba0a21fd446d795e7522c034
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover.png
Filesize388B
MD54680dab4ce69333849684e4c929c2bf9
SHA116dd98080ebd65459ec4c732deec461ad6af022e
SHA256d843b87c36c3859264e52e36d6c59780a4e3072b3852a9edecdf1d177945b8b9
SHA5121d578ee23d546fcc84e34346b97126e777d7ab689c4f75d31eabe16ad16a7f9cf806c4568d433408d06b8bfcc65c1b598c662459090b110caee2579efc29bf38
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover_2x.png
Filesize552B
MD5d89562911069bba73e01a2444e865e32
SHA1ae8fae78d2fc253a87bc834073e7dfc8b45038d2
SHA256705a2802c1ef46facc7b7d0c7252ae5b89b667ac9e98eb7a148540c1031c4454
SHA512168abef617d409b5b0d1bebd7f8a0478e58fb2c55fe80a67ca53f135e6ee718d76d6a34275a6ee7f5311b1acc36c242ab7b4ca098e502c0e7860f283c419300e
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon.png
Filesize388B
MD5347c97cd623ca49e20903d6ed9bc0725
SHA1ce5f367503679a53fdc1f5602d279daac3d58a23
SHA2562d7c9c03883eb6c49e1eef3df97e71ff54df40ea10f7ed8b85add7a8a1405956
SHA51227ca71bc4b3f77ac42afc7ab6f4f104dfc91b7fba6473e1049acd4ac4c7a65975427bab01877d861a977ac4f9b693e0cf46d2179a01fe6b9e56adeca414d262a
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png
Filesize552B
MD5985c6a48e9925c1d3f59248fa9a4f2bf
SHA141b350b960f14f7f1a2e6fc983cd770150882442
SHA256023ffe37efac9064a2ee00c4d6944daff6e910e72c8a8ec6ddf2a6e7235d7100
SHA512763cb244b4115f3f29f2994baf9109417ad0ede5f4e0793bbf96089fbb4861bf399dd7086fdd9059b59266cf2f9550740cc92fa14c0420e4d1dcfe10b92bea09
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png
Filesize388B
MD5a651849d029a4d666a139886773ba3ec
SHA1ada3b72cd1700c814369b66fdb4a453e1c4cffae
SHA256e8ca233de93952198eb0c2a3f75c617493385345eda9907c188cb80ef9bd1353
SHA51233d1b800f1335c6fa3e464910389fb91758976917390c464b205e5c35ace7bb118b42a57ad89f6b30b0cbf66487857636b1a795e5a6d2c53864ba8339bfbb32a
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover_2x.png
Filesize552B
MD5d400eda7146152d0c07521483aea8009
SHA17b5e186fa2ea0fe2c7e72a3224f98fd934f3977f
SHA2562fd99fe1918759899ff6f2c61903cd5841490b8597cfdda812d55fcf53356e39
SHA5121014e18c1595f8edea96d998d5a16e42992c0b0b177371b07c62b61404ac65b6b2dfe3a1851d53cf569ee19eddb866022ccf60a21db381d21ff8e799efc40955
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons.png
Filesize7KB
MD547b3424606a8de2034d6082ec81d5119
SHA1c38d826752fbc781d319f8359e55bf467b740396
SHA256564b5294928280b1e1f5dc13b63da033f53adcb02f84c2b6153be4670e37edd4
SHA5125b8f9e6b651ee32c3323b28dd43b4695871ae3c3dc46cdb7a6f2f4f144d7c6443caac38c4f88db914219b3bbae02b6b838ac25c30bee5a79ad6620d06b36a6e5
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_ie8.gif
Filesize7KB
MD56c7ab7a76ceff69274dc5a356bd23a69
SHA1ae1742c2cbfd1fa3488a3eef03fd5ff0da2ebe89
SHA256360ac09a16d2aba21f168ed9bc89c1f5e7df2db14bdbd334bea90e36ead5502c
SHA5120c0f60d6a8adb8292f6725ed1f683e5a39c4be46e516693dff8fe0ee02c0fa7ab55ae621f6ac6cbaae33ae74415a9259634cf3c09e1e2ae5a27a48e3d749f729
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_retina.png
Filesize15KB
MD5b473e7f6578586abe4cf47abf169acb3
SHA1f5f781703017e6117ac1b1daa43f6b672b34542d
SHA2566047a1d3c1e20d3875afe290feed98c4d25ef2e08f83c59f66894ce3b6339daa
SHA51294c7ee423746e49ed86c0e35fc25293b300ddf3e8ecffdfc1826be863383b5216dbd6cd416fb40aac452f7b06ad0a8b30bebec5309881e29fceb5b404586c37c
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons.png
Filesize8KB
MD5d81593e52f7753112b2f6c1222ef2bb5
SHA1476686d09d8c8c04956cd76ffde6e69a8f54211c
SHA25677e444892dda3405b8ad4b4187e8b07030bceb1fc51428b9fcfbe27d5e2552f5
SHA512d3af2827d62725b842e3ea96010c45479f63740482d33cc148d5ba59cb433b1479980f8faae965577b14a2fac477a4b07873af5ad6b962a5caa425a0e5ca72d9
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons_retina.png
Filesize17KB
MD58beba0feacace5b89441f6699a332f47
SHA195d88db0bf09f5b507d784e408768e2e5f2cf3f9
SHA256e6e008f9cd85563a219557ce33c262140cf52acf169e9a7a90b738a218e4476f
SHA512e3e0b3346074c6544ed008dac922fb8d001d50d504b09a86fafc949ef4eae0ec247732f9da60cdebe99e0c312e1ac2a35e5c4a8107dde560b96bd1bdc2b93496
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_pattern_RHP.png
Filesize179B
MD508d0482069533380240553fdd8845926
SHA1e0b0f7055efd10694e409b27ba75e0fd0e3ab9ad
SHA2567ce8aa2779933a0902031a89045e8b710642c1f63995d84d4c35208fd52618a7
SHA512b574db5292443153a173bd319f346378caa606e2a2446d0be3803e7c86e9264f5eca86768886d8e72104b0fcd09d3a02f1766df76eefbefdf925776eb51ab98e
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_patterns_header.png
Filesize703B
MD51932fc2c0362db74415061c7ca111766
SHA13f6df4760ee59d047b7ba07bce42b5b238e0ca15
SHA256d0b4a97e162321b22fb3dc7d5134eb9e7f16ec456ed5e2725e77d1113045fbd7
SHA512ea5f8c8c53950d33f35b284b18b13e281c44a25a7cb6d21874fa342e19ce70a98c785d678d81c4ff36235d77135e5451df6a7b325f56a5d424bb6e937bc58421
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations.png
Filesize8KB
MD5f70f7bccec836d39db83d4f811057253
SHA1081acd0286f53171892256f21eaf0394c84d7386
SHA25632b0476ce0f70f1452486252c266e0987b8182988f4c30c99dedeeef13f7b146
SHA512ca65a856e910480130a07c9bdbb352aa6f98ec39795a09958b02dc4a14c66965570fd90226598d294780bd3fe146687e14109b05028133b71edc1f1356971c09
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations_retina.png
Filesize19KB
MD5838edb4c7c3e2e4bf3db9aaf576f62d2
SHA192fa7efe1a0333f22261803442fa08436877cedd
SHA25621df637295f7435454282558f24476dbd26d7677b4d9f7a0800a4e288984b8c1
SHA512568a321895b317b5c82a92c28a7685b15e380ef5e0436731c378c0ac5a7455580e33fd9e5057a063dd14cd35fefc0b60b4ce4982c2589a25266bb6f0bccb1416
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\faf_icons.png
Filesize6KB
MD5b1078a4eaf576fcf63307854b1ef8a16
SHA1d98d0b8245cf10f6bf28ee0775555a6fedfebf7a
SHA256a74a3fd6119beee7303e621c393dabead8a09fd7619a0e470a479c8417800dc4
SHA51258671d75df3a301274f0618c1d28355748051f802eb420c34fea2c1b02ca4de98bf15ade631769e521e13a1e906a1fafc92ac98c188c3d97cf5b75e5a25b4f66
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\bun.png
Filesize2KB
MD537eb9985610e37e3f129fe9a4a9db00f
SHA156e15e7f4434e0f0836973a3351f936391637a60
SHA2560e744d22cad3b030f828010c2e2dbd39ddac440665987a00252b6fd491abad0c
SHA5129581051a8aa71a483974b255203f3e36817e48bd1d834a65455292cabf0e166cc242dc0a69190057190b3e42529a5925290106168b65ead7c381b4a420d533f2
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview.png
Filesize2KB
MD56106e6d4b7048deddb432418dcd0c2b0
SHA1327e8d31cccba1b514082d172f29ac6ca5b13f71
SHA25647bd64142cc3f4dff3f64eec4bbb795e347527a2628e9761200e4ddc16f23ccc
SHA512777a967923f90c2b5c846aeff497c9d3f00acf51855ab8d0f31b9e867bb39d053b9c39b3656183090891cc9cf6568de7c7e8e3bc93482b94f3295d87c4e78a72
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview2x.png
Filesize4KB
MD5df5854b9bc6fe8a1194beeb8d2c86d80
SHA1d8ba6c6862be4a72f56329334f32dfa79eb6b6a8
SHA25697f8980ad0b3f99a3acbb879c8e4885c857516632450c45b9d66e3f6a2fb15cc
SHA512107658d9f1bec73d4895b3d97e0c554be4866d1342b4505efd3097aa55ac3b2642c54353fe9c292cee978be58ffa5846f41ab03dedfec332a90314256a23ff5c
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small.png
Filesize289B
MD54a60a768e0a79f93c2c263410df89a47
SHA1913a6fe14541d5172c8dbd7217d7ca9f4d89dfde
SHA2564734b6b76d3caae67dd723f5bc78f82cda5035cd3268b65a44d3888aa71f7904
SHA512d3864478bab3fff1dddb333238665e68134ac7e43debc9f0d3376e050b1db0e4ec021f8ad7eb1ba844718f50483640ad224878822ccccd73487ec50ad3bc7925
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small2x.png
Filesize385B
MD5646e9ccf45a51c424497943f7fccd6dd
SHA1ddd808f97f28021d5f268f13bc5eb545102fa6e3
SHA256d287375a1176d2bfa952e7afed0beed8f1a978052a88a90a838d079429e002de
SHA512f8cd4021c802b8ef7c0ccd5d9187ef1c0911e01c15fe832114c546eff928786ce45fc1f8511d9f94c35c40564bfc73e590bd744e5f0a62834168c58a18512293
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\illustrations.png
Filesize4KB
MD597f7b51b1e100f1eb09a1bc8c1d370c8
SHA1b66ad8f7168132caf1bc583cd1a6bfd68ff1920a
SHA2565093ca5fa138a9728dc4b3b89b357d6f594bc3e36a59d4b323fc0c6238eca97d
SHA512bf7f215872ce26837f3477fa3270cb7622d32945e0f31e59e22ab37e0e95f4aa0d6460f203d28a86439e4925646791bb65e59672ce3d31a57df72f278b457240
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\nub.png
Filesize1003B
MD5c4c55505f348ae64e89b859344db4922
SHA11012e1ef8a2adc35268774b9a8b5f47f79708555
SHA256b59bdc2d060c54eae870856988978175b91dface3e7df55cfe1031077d84ef4f
SHA512f21e40f59448d088ff3253a0a2f28f3874bca7b4c3f2e5d93c4244e1b50581c960c9ee2ee4fc53d64462bd1064cfba0c34ad65446fcfff9a6f483b1feacf4c12
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons.png
Filesize1KB
MD5ec461aed0cfb84e1a3cc5660a0994886
SHA12e648c3d6329f378a46245708ea9aa973a6c1f5e
SHA25623648f0a237c7c2379e23365e77851e156e1d4b53cc83f777422d982bd637d05
SHA51267cf71c58a8685bf104b4ea4dabf2e8c59755f77209e46b0f17527857cd7a7ffe5a04c8d326d8314f1b661a4553b13f4877ff5f1262fc10ca1a1c899981e35e8
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons2x.png
Filesize2KB
MD593a4fd1617a39d59c3b8b5940f0cebe9
SHA1f2d4d6dcb6a5c90963fb51901804884e5683b001
SHA25655a50a6a09348edcbedb0f3089b053d8d7b29dcccc4b684e996cc1dfc082e336
SHA512c32c6fcbf1579ef731a65708612e3fc97898a356cd7f6beac67ef786243c4c882708e0e6c9ca5a3e3261b546ca3cb281ea9cf9957482f89b54c64077cd761e32
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adc_logo.png
Filesize3KB
MD56403d7c48a77bb8af0308f782b347e83
SHA16edb83f506ad5e61ea3b117985e488823fd13307
SHA256fcfb49b4b02e296b726adf2d15af6e1aa15bba0abcd404d3c9e03b30487f7b61
SHA512fc43fbcbcca727180305f8313170168943c5c2e43988a894264170ff05642ee01367ba4f446deb319acdddba2196340745b8711eed8c4b3fd9b13de7abab17b4
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adobe_spinner.gif
Filesize556B
MD57cdc51728e4c103859eadfe0e3d1134d
SHA1c6f03aa3a18f09b8a25325efe246689fb5729f85
SHA256c73c4677da9d601e545f2310ebc1fdae9319b83459b0173955cc6b9b3ea1062a
SHA5128766018eb40ceece86773d1e4cf25a3eae0e8d68b1dd6c9a0a9e488f519d1f968e9768187ca268dceb6a347538b52659a6e160a226860edafc74c1e3287b4edb
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\logo_retina.png
Filesize6KB
MD5a7ee0944b102b6bf09202ecc4327979f
SHA13ad27c9b52ff570746ff6d19b4c248bff2b43e07
SHA256fe08edfa38c0a47c44ae884c0851bbd9657050eaf18caea9cd2fd4dc034ea5b2
SHA5126395653e368ccd9760127181e0d5bab460bff47b5649b017a8e5e4ac30044533b4cd32d0be525276544d2a14025414fd86b598d6fd49f78439fd92bafe290e99
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo.png
Filesize826B
MD5c9f0acd75a414803a0f4e9f8e377374b
SHA16ba07eb2ace581696d3386bf391d228590351be9
SHA25655ac7c631b75887e1d09b0405e6d7f4c1484233e22efe3746b0d550843b2a4d0
SHA5121c8d07746fae30b183924fbb6405a3fe6d8249e498232df268dbe6ec8716f1bfede5c261b2e2a8c6c2dec8c462f5d9137ddde4ffbc92cadcff7145e3444a47ad
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo_2x.png
Filesize1KB
MD53628955df7bcefc4fbefcabd2f6258b8
SHA163c2012f83b4849ce2cfc23777777ef2921b083d
SHA256d0bff361ba2cdbf046ac7b672e31575c33b6d311650a71e7fe30efa8f7b265e0
SHA5123bda60e4fe0d5343940602ee921d1d3bf71d430e4f2111f1a3ba291a23a291704513877f5b04f836f342c2ad2a1809f88fa8cf480b438a019dadc2c4bc2701d9
-
C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB_EURO.txt
Filesize32KB
MD594c2a147c3d1de77c41b32b9ea110d19
SHA10ddde9bf87e07219e4e56879dd6c3c4e42d57ebe
SHA256c485441c9d41520ee4b4b9e6101fd36f588b96985f704cdc93a34c5d76e4fad0
SHA512fbcdb00ad164955a43be03f06cca8c37c01994f528a198f59cae8552bbdfa2761ba603df62d9c81cdac9731a13f4d5ddff768f2c6e957287f19a39a088fe25a7
-
Filesize
962B
MD536001bca10d5e5a1d8de4295bdc4f31f
SHA1941c80149232d99d34ccdc00c5b5232eb2f9086a
SHA256fd63fcfcc28130a2b6054c678b98aae8378788b55364ffec192fede79cd9a447
SHA51286c47e7ef718ded4c6066475571ce44a38eb71d6ac64b50b5b1989a7df765ed5ca82e5d40c532aa25bee41898d053497772aebf2a772a56b0596d3a7532be1af
-
Filesize
153B
MD5e9b7c2654481697388bc65f14ddc490b
SHA1c2ef2394f2a7485fbdcf245d4dc915d91a555228
SHA2562e45f0d36026e447eb72a0eacd2a1bd8c5995b65f31426ecbf53ced93b9ce287
SHA5126916c093a7714c71fcef4b63f25f48b53a3acb5594603900d6a8c6fe68f8562812bc63bda9e80ee32a21a69674d55d882981861281a0872cc1c0997dccbba0ba
-
Filesize
190B
MD585b96619aec783b22bf1fd0eb0564a9e
SHA1dfa8736298a0f755a9f7cb23c61d56dd3ef49729
SHA256354d88c5894a74338dfe3a9dc10fb64587c9f500a89100eb409c11f0addb6995
SHA5124e6e7b1acede30259a0fea037dfc6e6ced258c987482e9e3fd2014663593c83f5096840e6c5e8695b130724446d833d77d5b0537c1bec3ba8425c8085b87eed5
-
Filesize
190B
MD56040006078e2cc1dad63befe06985cfe
SHA1fe1466413135d41306d069ed8da63f5b19520060
SHA256fb2c6116f7daf7c31f52ad627ed81a188f8ed9579a9899a6df2e1b572b262e94
SHA512be499b16c3c97b9e62b22909a446aaab80bbc5e46071f60fa2c600717751894973c962e6e20ffa2f977eb4892752c9c22aeebbcd2cd7704307bdfe96b0dc3fe0
-
Filesize
1KB
MD5cb82db1689218f2605ce67c70aed0633
SHA1e37a9d1f4f51936d284bd580aba8b403cf0afcb8
SHA2563db805edc08de48695e1b67d7d4fb0d0e6db1e87ba7e66291ee44d8e557fb6b7
SHA512352004af332c15cba6f67e21ce7ef8422d782bae938024d9b2c5d0b3be445df5e127967c2c5c75312999d19d50dbea97780ebdd23f4c686ff8f959962810bc8f
-
Filesize
31KB
MD567f8851faad57d014a05a55abeb54714
SHA1b6cbf35645faa48d3a90bee4e167c13b9d0abade
SHA2563d1ecde85843c4d2e8a03b291350742b4183a0910fa2e10a52bb4d3ca5566c53
SHA512c81ca8a37d261b97874e5effcf5f90446d20272d5e866af3095d5d2be4debb16bb67f85b0f6c794ca0d206e18e70a69726bd31950071b70eefff1209c19c5f60
-
Filesize
34KB
MD501b471c186e3d6f57b6b171b4fa1b217
SHA1692968d84be8a135b06e76cf32a8d5b14fa9b17c
SHA2564e9f1be51c325afbc0c7dcd10320c22d3fad9029641496df06adf55ebef5ec33
SHA512fe14a477e017f81d27b216fd4c88ad9fe5a5194123c0500d7efec9ae851ba1315c597e409a14a8104011f15a96720e3bda6a14da9123ea12c43a7457cb5ce2ba
-
Filesize
23KB
MD58da24da3223233b58cc3408e4482ec44
SHA1af7200c92189a763e55a357e2a3a980eeef7b306
SHA2567229a06a5414d7f930783bc770b510c945e690e18c25e7aea770c266f192d7c2
SHA51248b65952c9c205ec685b72661d96bd05c71c2cb7d275b69e70d4fa8e1c8f44aaf5fc5f0d0777d9f3ec27e716efc5102c51272396c91de36da795ffbc2385d89b
-
Filesize
2KB
MD5ab269f874ce2324739d0f3b87a2ca607
SHA15a0b160c898b05008280a84b71e050dcc2d19db8
SHA256c14adfb2243debecdbe150789723cd1b14fa62d29be5ad8f031cf9fcb2ab51ed
SHA5121843e800093881b6df04448c50498d9456f914e2fbb629cd4514c2504a36bc8b71713f8fd1219e9b64d246c6467a57f9c15f425c4ea21769ae5d5e088c860b93
-
Filesize
1KB
MD51f0bce3fd44793f2fb2411e10038e2b7
SHA11161bccc076eb78725f3959100445d8947ee99de
SHA2567744e4ea1be888877947d64e28b80ca528582427ed3aa412379f6fb9ce6b8178
SHA5128f51ba6bbc1f54501f02f592b893e0ce7ef4e233ab7d363b7657745ba4ebbfdb5512986a67d74a92d6d5d9ba8221b645fc4aeeb5c5521be247dbd9b8706371f4
-
Filesize
3KB
MD56226211574cfeea71b76edc8e81b19cc
SHA16b704e306b70b4c96e10164595016df32eb7d640
SHA2563db14609cad157abb9fdcb717e3225c9f0d8c8f49f17c2788d8ab5eadb85fb2a
SHA5121186f58c56af0f5ea4aec8df89eeaa1794b646d6c1e7549ee2a91217975127a1f709f69c3296fa9d885b87aca1776eeb2c9a6bea5406ac085758874b84e152e1
-
Filesize
2KB
MD5c9513afb385650457df31e273ff3eb10
SHA16dacf89a4540f5ac4a230aeb266a8032bd0cc846
SHA2566bd85ef38abb9813dc0cd6a44710a9af8aad26ad8c8441532663473adf2600dd
SHA512f17d5e0443104d5e4192036238463eb88f46a8d0d4eb018e7372284cf88240ece56eac3b5468b8dbe053d32cc6c8e7be279703a8d5d2d10428d80f50a26b8a85
-
Filesize
5KB
MD5fd0819c1e2aaafd4d4f5ad695f5f546d
SHA1e98841c449a962520b07f7967c17cfc8ecab1445
SHA2567c11cbcf281ed424f3329e42252bd6796f42552fa0f9055b60feacdfcf70f9f3
SHA512e6a106c3753d7040ae03ec1e1ca546ba96b5f3e220f40e57ad2bbb56af354074f67df8454bc8169889587b2420679bf7822d830ebc4f9cb7c96dddc7211318e8
-
Filesize
17KB
MD5a87dcd7235d014fb4ba5f9e44db0fed6
SHA1046ed12fca7f744c239d5d43051839204291174d
SHA2563da3bd58162fbe3eb0c5a9fca66d4829605c0999f2a5fc38e5c4587aab46ac5a
SHA512e173d557afa88b636470aa47cfc34e037eba0384766025c4c62b2291c179aa33efa38cd654c969394c8d1b06efa83b130e078c07cc717f30113f1a841f8c138c
-
Filesize
320KB
MD529e571f5e4299e960605a2e2c12e7962
SHA1372466bfe1d3952a1cd1281b799aaac0bd3ea058
SHA256ba66f7e40c48eb46c3b864b3e78a433b7b31aca49a16d73de4e4d70ac967c6ee
SHA512e50a5303c502f99851d4c341d3688fd4b3c41134d6adb76be498eec2860512d941074d489741c1c17f025736e195b8e1f330f7c3f30ae45bea912fad003cb30d
-
Filesize
1KB
MD51212318fa61dc273396e47212618d80a
SHA1ed023bfa0c5f647be57973e4d22d8fec51b78c05
SHA256adae647930ac98bc156f6529acd5c2157e4bc5addd4e795863bf44ebc054247a
SHA512443dbb6b1b5cd254d9776b709416bba5f694bff484cff8c9b9d14cf7a9b1cfb1b5fbe7dd07aaf31ab6934a78c4f202ae1262f6be42a32fd2ed37fa033fdfebb6
-
Filesize
10KB
MD59983fb0e69b5aeab63cc76bba39b984f
SHA1a9ed3339ef7c85ce8523d0aa6cbf5a60fd98a486
SHA25633f5ab9180fd05305189bff54a229c496e9769e92b8e1e3069b78d0996b66912
SHA5129c1127f8677586ab9dd976b0e58e4f218b93a56ae11beb36d637ad29c19c13332b2c9974eeed41d3db996fd8a4e1e402fe8766e38da9663abb530cdd706832bc
-
Filesize
3KB
MD578681593ec5b7673aec1bc5a8d6dbc82
SHA1f55aafda40f9cfeead78a6b6f09c8dee2234e799
SHA2568dd6c0cd045cccb3d8ee94dce8f37d93515afa5621e0adf1de502e2f453cdce5
SHA51254c0754da8624637649f53331448320ae39f54ec1a7234a4153211ca5a2c265d02d9444c2fcf1d8f2df82cb57405e72fc3c59ff08746846f55e4d81871450b2a
-
Filesize
162B
MD54d70a280b260eab2ebdc574eae9df2b7
SHA14e5975a4c9b8831e0b35a2489b4e5d172f17f61f
SHA256bf5a6f4e21333b8d0ec45a611eff7027f647a6fd7d994b4b8393b4685c437ea8
SHA512625d69d9486c766d39ffa3d84ab4eb486713b40697b5ff67a0ab70a2a3f5239b0bbc1f1764b7b1daaa8cc3ecc3eee765e396e7d2c0b335cf634248481c22a26b
-
Filesize
1KB
MD551b3a4dddd72036df535f3ed4a2b5ca1
SHA12e87512fcbe848e78b5d7e13fe16a28fce2d4104
SHA2568620a6fcf160f760fdf894a09959e64e54f61eaf34cef3cb390114401c515bfa
SHA512a3c3a209529588da7a99db65310137759cfec17445354065c2cd012b5ca747594887e9c15e408c333f4d839cb3532553ae2d01e0f1eb394b58d766e0ab130d85
-
Filesize
3KB
MD5549aca7e040d92335570eaa816dee79f
SHA1b1723e064b0783e14595afa0e5c2f90868f7544a
SHA2566ce99b1768b061d83374a8edf867600cd77ec5397bd7d0ea58244cfa245ab5f6
SHA512d6ff9871801c1ef73831f34ff1d5449da3046ed9d632da8955c8374992047da04e141b7e6ddfc9c88caa6b429c45d2e560dbd8fa304975e24f5343c8057ea85d
-
Filesize
1KB
MD5df42246e7eedf457f14dda20135e3c2a
SHA1a1dbd232fab5298eb55659790573c1a1fa4d0d32
SHA256e1323f10f1715462adb53f00ce0ff7e86be4c1c95f7cc1baeb41df5c242befe5
SHA51204f1cf1faeef415c4f2b257b0a6e5ea1ef1987eee73bcc158e831013cc6d068d3a4cc8b130adeeb7d6556d73407d6d0a61fd66edf2e1835892b8f3682ca4a1db
-
Filesize
28KB
MD50e5c9e47abac8ebc59867bf0d9d26588
SHA1ff2089740e5f177fd14504f7d32761be0c36c65e
SHA256b98a54fa8b13849e47edbb037a34aafcd9d57cfb11545cf697bd44b6f62f6cd9
SHA512479260b019f377620de307fc67e57a3a4a6b53fe315241d340a71399316b5ad86b6344b9b7e4bc12098cca6f0411fd83dfa95554197e6efee9510c4238d993da
-
Filesize
2KB
MD541ef1eae398d9b069e3e4653a3b8237d
SHA12ebc4133a36da5def4d3fd30ef880fd58cb9dc74
SHA2569f866f4ae9650de055adc9ddb0224198a64f6a3ca8c77329231f63acb963b2d9
SHA512721585ae096bbfb956a3b5416c41177a8de796d57a291c2ba60f89b9d67a5bf5d63e275dd9eb8ef8d2fd75735f02f77a98c9e95d9d27c734abe144d5e99d6cc7
-
Filesize
1KB
MD5a3cd752bc6fee4d6c0b2faf2ad8251fb
SHA1f3cae2487b8d9dcbbd31582db4feef2e63fc0ab5
SHA25632c8fe174a63f50380dbefd7ef55288ceee1f420b086245a370d2ea1ad1a4642
SHA512d9cb47832f51d066ae0cf151429469c29831df00f13711ad02c69b3fa7f1e218ab472ae868255cad605715f22d510549274a09a76eb76e84c9ad426df43d6924
-
Filesize
2KB
MD5b9e542c16937086951ddf34ce0820978
SHA16b7bde6264f20058779c696fa11a0d38b5d0df99
SHA25663866cbd6b2ad4b6b2d7ec5d2913967861e4c44a4a677df77d0cef2e5f26b121
SHA5126a675fb4792fe92ffd0feca0db00207167b06d1b0c026f32c1b1bbc7af39116de6e3fca616ec5043ddd33cbe4b502dc5f45f34279e152fedc3bce1609a654cd7
-
Filesize
1KB
MD565dcb8ab6868c38695d0b7d434ff4ad9
SHA1a964d7442c314d048d0cd5f3a14c1c4b222f0041
SHA2562989041bdabfcec572b7edf21c5602e23b12e52f1659ce61aee5c7341e926453
SHA51294352a3f43c725d72716c0a2c71318479bb41746598ae861d2c4d015ec4b3d742226929fa533ad19f2fa8bf9a1e2c05edfd1efdaa964454d984fa1e328fb29bc
-
Filesize
1KB
MD54180905ee5f3ec4506179e19c80b0361
SHA1f318e2702b1840aee99f59bef3ab8dc560875e0a
SHA25646a26dcb860ec53db31d86c5277c163feafe9a26d925b15199d490c33f061ebc
SHA5126fa35cfffa7319a9c0211d82731f6471f24b41783e0c7fe378f3381380cc9e03613ca48475730c9941ba410eef3feb75aa8b614bffd4af3a8009b9dd36e485f0
-
Filesize
1KB
MD5229a14eff5cc4e561df17a7df09571b4
SHA15739da02bac85c1d167915fc409293350f1cf370
SHA256ff71d785cb7a9add0f890f2a773cbe08b9e2e1b00e9a52e056e4a7a36c6fc0da
SHA51226fadb6969c1860d195be9351483a52e3cf92d80375c3f81a34ce2ca969c855eb52984fb88d5d281760df33dfc37643e9ef967ca41d1319ac3e8661f4e8475b1
-
Filesize
3KB
MD5bb206266c911ff5430cd9667f6c72b46
SHA169fcce6d2c016880c32509d340fa8856548fcf6d
SHA2566df96da59097d7bc84f57ae4842d7fc2a48550c4e9e85f2b34968dc74e88d017
SHA5128f1da4a809268bb8bed546ad5e567aef2b0d0ffd4a107cb4d32f282b0c9fa80e33c9e6b7bd4841769090a2ba6e60b35983caba10e09b8f749e20dc3af18b2c5c
-
Filesize
2KB
MD58650340faef968be141548b9447cde3b
SHA1ed2a11eac3b5cdbe4d1eb7e22646df692b4d85b7
SHA2564f734ede9aa4c65131641f1252dd46e6e798c40f3e98ddb0993049074e1bf2eb
SHA51208635969dd623d886c5a6417305aed7ef47cf7080df4056644e0055defaac7c152f084d41a13ddd7a91186a03a5dfe4268e3fbc976edbc1b631c53f33e362b6b
-
Filesize
6KB
MD5db32af5299905cad2233924f62c631e2
SHA121b569493ac1cf5149c9299a0c1888c5fef30f36
SHA2564c51081a6b10339328348e7ad6bee220cbae38f816c88516067f95a01f354d1a
SHA512fc32b3dc48595b621a32e23bb1d4d2fb41abf38084f12965fead46e73b1891f56f18e8a062112aee71c712bd7378b3720ad65d42867cd653d31e51d394f55fa4
-
Filesize
5KB
MD5726d35f025ef25e87d27ec0772d550c5
SHA176e1153eda7d4d963ebe186416e302afcc52a305
SHA256cd0ed4fba6afd2e7b5e7e7e7b4c9e22359adfb104963f9c9a99394a28b43cf01
SHA5122088f047a566508d265ec1e365abf9f58b0fbafc868d8b2bbc73e6212ea729f75f36af5de83729cd265653c31114b350f59156b055616babf545f98e3b1982ad
-
Filesize
3KB
MD5000a3c47680332ccaf7a9502a0f67221
SHA17accb3d93a486e64478057e257debac8eff32f87
SHA2563fc0277b0ee6c4fbc547c138364dc8f2720c940d5f99f90b7e089ccc24c9f3d5
SHA51293d9cfab5fbbaf2a1b8db66cc7a908e8800822ea6ee4753c317d319c67dede46a77971be9d60fcf810a76ca7a499b4a55e05c8ffbf53fbf8f5b7d7a5ddea9716
-
Filesize
2KB
MD596bc2037a69e5c5359bd66c37b400e28
SHA1c3e81bf9bc076603241d347d82229613ae05d996
SHA256550168dfec5c248bb2d74b1fefd357ce91e22d936c097db1b93c4c5fdf2bfd64
SHA5127320e3f57d181744b8567dea3c14710a6fd6bb99a240d090544a1b588273ae10217aa52da655e6f7a72580b72ed901cf76e8b0983fdbfa519b1c18b70ce424c2
-
Filesize
2KB
MD5e7ca4886c085d354c9313a83e3e402e9
SHA179b1f3857f177e728681408767eef8447757e144
SHA256bb6a9b5a0a9c2a0711b2babb717fb99133ac914ac2ba4812788781eb4e6f7012
SHA51254b1f49ab959937be7e45e18ddfe71572f6881f8258b4023832e76c42c4ed7ad86850d7b8c213376aff0e136c7cd864eb7bea5f838a7c95ceadc017e475ed612
-
Filesize
1KB
MD5ab635cd060f4bb35c50e7e9f5140cd75
SHA17da1f344953f93488bcb0490e07890d790d5d2e8
SHA25647518ee89cebaf0d105b2d1cf049c7f826b9d8faa5357f9a5b9aea3d1fc26760
SHA512cddf355cf656cea85e176eb60f2bc56f75662fc4e8e8fc02becac24728670d4ea130a63124de29a40c84245f99c7a78b23fa409df0fe3ee2532c01d4e49d56f3
-
Filesize
1KB
MD5e75e990465f38cde103a7ecc2a139763
SHA19482526464dcec6f42d19d31aac8b1667f354ab2
SHA25682980da4b8ac791e0b7ed9686adfaecaee61798f2bd4077008e389ac8305d38a
SHA512b16da6f0b9cb34d4c7a9cdc998b5194c9421a57a637002dd10a231ddb9ca1b3482ebcfcde33a197b849bf5b6a73ccb6c992c42e2332f1f5b59de72802c6fe0d1
-
Filesize
11KB
MD5e962d85ec8cb471fc3dde61d0430b1f3
SHA1263c5796f83dd434f499199aa37bc40eea2e0401
SHA2562a4c924bd17f03d954f870b5e37e1b6b5e60239b2e420259b1bb222bf817a23b
SHA512ba23f45306907990087f0570022574c4ac9a3997a7ed3329ce3c96dfd22fa03cea2712becf9c4926686f52826700b5243a6d5547f6aa4c6c482fab51b88b768d
-
Filesize
1KB
MD59d387d544c431784ed297bf454337ae3
SHA13c924a88d621179107ee2708d2dd34e44e7ec092
SHA2562c00623f0a2f04a21baf81e1cf6a0873a45e0e681bd28ccf7ea13c79cd32610f
SHA512fe91c7d6e47eec2cea2f19ca8003426f1c14a8834e6af8f91cd46948bd6577f4eaaf61501165515d9616139778e53e9a71a983698dfe9f9656466e2d4e74f46d
-
Filesize
2KB
MD57a8f5c8258ce8086fdb9c4523d2d725e
SHA1f8085c7909c454481f81796f9c360e9f6f05a473
SHA256ef2620850d3798700ea50ded20d0c6747196e7980590e1609ecded364f020a82
SHA5124c5e994dc0625ff2454477048521031f82abfe55c41ae885f47de89c069fdcc69821008a8f8d266270a690e7aace008c4446f0f82681f97447ed83c922b3df28
-
Filesize
11KB
MD5269188c469352a37fbada66e1a1e927d
SHA12eed0bb6a98c7471344bbbe1ab89fdeaaef339de
SHA256e0067731a21247e9cc96627682d28a8d41b430b5c0f027ce2d6c55df6d9ed128
SHA512b3bf94b2d955d7df68158aa518f61315cb27d7b5033b4c588bfedf74ffd92d60a5537f1fa9f7ce2c71894ff167af0520ab2aa998747e56be09c50920d05f89fe
-
Filesize
11KB
MD550f2e1e9c9e4e7985d4d8f288186ba7a
SHA10f1b65d990537b3ec47e350a92e689886df4a481
SHA25672e2c4a1ba4f84b345b4098591fd1ea64d67a471f47f70fad838c5b18409709f
SHA512b66a0ae05b3f46972bb01bebcd5bd65873d745c114f3039a65260a750d1bdc623534f605d9cc6bd3532ac09ff10b913c6114ac8a9efcbb441b129ded9e516b99
-
Filesize
11KB
MD5f805202d5134e8b4e8de070d78ed4499
SHA1b4a6739e44b41bedfd43de23d3d4f64dc62fcaf4
SHA2564d358c221d8facb8fe0d524be672c96483ef8c0038c92f83cba67bd0da0b8bb4
SHA5123f7da3f4e9b1623cf5e0d0dbc06f67d2eb4b95b46ebd51efdfb5881d68e94644cdcb9a735f66c269c2a2cfe776d25e9903aaf33bf7efecf6d447a8170bbd4562
-
Filesize
1011B
MD5b2668bbc85758aa5eeaebd75535d8a2c
SHA1848e662226c228092f25e5c440ff67517d508ad7
SHA256a6125c7e75de160b56f118926a658dcf189bb7be76405f725c00fdd349d4c841
SHA5128a928cfcfe15412171c5c23eaed047c20b51c5b2f418f66e121cbe1a0f373740466956f53dc0938547ccbe4f3720b06a597517d1274dc3ae092ca825fe4e392a
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727656120098725.txt
Filesize77KB
MD55064b967d49a84198df359fe8c52e9d4
SHA16e769b5b10295ab8dd5d0aa4d84b2f522fba8332
SHA256c05a3a1ecb019e022bd0680f592838c8cd4a0dcb00483c740e880578fcfee75c
SHA5123cba7d85b2bbde84435e656b872075c6aca382d610db2b9cb1dd3d0c307f7a9c16dd41a6162f7c5cd537cfa23835f50479fd75ec272d802ba19bb2c2d518eefb
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727656590293648.txt
Filesize47KB
MD50587475a183b94730d9365cd8859a985
SHA1a379ef148f5b048f5a096e012d2ca7ca0817280c
SHA256f909d812a57d1b5994056b09dcbcabee56e9216a63f86f3eddebd87631b19973
SHA51237955576554aa2ff1e90b06ea70d8a225fdafa3a4b81eccc4f0fc62473426f4e7fc21713bc3e01f40e3fc4f095a00b4d08e6bd0d8b612a29fb42347717aaf806
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727663328721506.txt
Filesize63KB
MD5cf3cb7ea21696703596a1dea52070a81
SHA1755385f7e25f43e4677ce50d634183300aeba8e1
SHA2563b6fb9be90700b0724ad306f67629e7dd10adf198f4d3f840c4852954cd47c7e
SHA512e603c1bf9438b0016f677dd8e87f1435ead9e807cc24d3b61df9f584a85022832e48ab4ee15da2183d30a72d1f4e04dd7e594061e33e8524659883c268a7430a
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727666039184869.txt
Filesize74KB
MD57669a0c9fdb509ea3dc0c1cf4af311e2
SHA1f4fabd4f360300847d408b64bf743c3d6d592995
SHA2569ed06dad6332dfae3175657e94b72195f0d8be0af5a1dc5f2371cd69a6f6e16c
SHA512987f68fbca638d078bbf6fc941dbba23bfc8b5a867e8053ab87fe8779fcc2503c25fd04c3c9c7163ea9d6c0f10833876a9b0b5e03b798acf2c95085cc80f802d
-
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\File Explorer.lnk
Filesize407B
MD5ab1ce192be2a8396ca38ae12cc2e62d3
SHA16786348c0a6aeb8725bc64e6797daa28cc594a7d
SHA256ec02b23ea6915f448c759c7d03df5352d003e219e21a68391f79764bf4957c41
SHA5129225a701ac59f8229a231deb571593532f65ee15ac17a8aa54caca5cbb42ede83936ea68f503c52babd3795c8f4f47cf862f6436f291474f745b61134cf01919
-
Filesize
317B
MD5d876d626553067b450e73f2624bff2c9
SHA1246191b2fd13a26dd6715334cd01b8473968d861
SHA256573040854b28ea76df92b0c9edd865da9d0995d0b588d6c3c2b5f10b871bd038
SHA512e5d97def6272a109a13de6101c161750feb77a0c4c2c46d7ef0e07689732a8a37d89ebb029192cdad412d939c564277a78d844df5f680823bf05096074f2d41c
-
Filesize
21KB
MD57858b6fbb6bf7406b2cfd2f00a510992
SHA122bb1bae4922cde29e7742b9f417d08bef1ad049
SHA25646f414e540253ccc1ec56e060c67eded0c7c3b13a7078c9b1217d4cd9d2383f4
SHA51271c39f2925daf83acfb11baf950315805d2981a288b6dc47903a57f1e89a8b15fb8965773858c00008dabecea79d1417a35448d3f7132c46be3b36bd6457d7cf
-
Filesize
1KB
MD5fd493915445adb7db2abfd0eb046a92f
SHA14657dca9c0e76b8a8f0285797fe73b5fc0e2884c
SHA25690009ed04d1afaa77867abf25b5c46376518a5b3e40bcf9cfbc093fd793b7a10
SHA51217ca8ee798a9d7e98ebf14bc2dc22e7a4d1f693e115027d6ccd27fc59f54cf9471e031919b13174a7149c8be20057d2c08a3b03f8399a027f28bc7900c42fa42
-
Filesize
952B
MD5f8f8a527a7e9e933a3edf0b6bbd55aae
SHA1478f385b526a28f6e3cc4138d8ac3fb3e82c854b
SHA2569d4505cf9a3b187c59e14278fd1e36e9a4c4f75c0cfe73023b2e802541e89dc2
SHA51217c0bf1515efba890f590503626712880ff32b1e51a4813a0a5bc4e032993efc2fb04bdfd07218d40612a553a6b2e550993f0422a8a1fd8e61f3bbdf50e4e7f9
-
Filesize
121B
MD58d9fd349896feb3b0a7578547a67a063
SHA1d4c6714206f67187a0f981c5390f8efb910a03e5
SHA256186c3658375a953cc82c9735a6109587783d38c24715df8fd9dc051fc12e4f60
SHA5124ff9b04830ad5689187701c3d7af72ee053f6705c9b06374bd346bd6d29a89d5eb1ba513cd6df91d79bc43d6ffac4705173112c3b6aa4abb41093de4b522fbc0
-
Filesize
1KB
MD558be6a2f152d66e8068fd9513a991f10
SHA1b9654a153fdc35d62e808c8dda66d3990cd9a6da
SHA2565f4ea710e87b7ced99d1406baad16abb9d63ed6cc1f9c7e97ce98d343bdcdd3d
SHA512f056a2af4b518f240218e51b1519240dad8ce2670070043d9120b5122c5689768149885ddcf87d831ad7b3b06b0d433069da009327299e2143e397e6b8644040
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg.BoX_12
Filesize8KB
MD5c5d62736bdab60d231f4545e8a61c58d
SHA1022933692050adbd4de27345e7df51ef89658fe2
SHA256d9522d83d02ed76378fc1fc658b9892015446d55717a3b68ea458cd8c1f99247
SHA51212a58c3c94876ff26ae4d44a333ba03904027131d70f7034d4c4c8f4e91f3364206e4f70695ff6e492815ca9dc9e3fa0f08d841d344d2944ceb8ccd102d468a2
-
Filesize
914B
MD559db5f980fbea3fb17eeee25ca3357df
SHA1a3b77529a4341b5a5dae8b757aab155e0e390d40
SHA256c38c99b4375551b00416d9e948594567673b0b032526908d8a9ad2c15aef467a
SHA512561b677010d2980df80306b5c54667d228937d2e569faf59f03b0b489029f8f555ca571c4c936e241b16dd1806465bd368b8851ebacfaafc56a7abf271f12361
-
Filesize
90B
MD5435a7d0a8ffb995138b68ae1b83b0103
SHA16d58d94d2588688f35c0eb74c4f5ba7efc50c091
SHA256eb363739f1a3552750c219cce7c3412ab5f437ae1ed6cac3b53adf5b0620a232
SHA5121921f0b80bbcc5019cfc4993072bc7878d9399e84cb20614f807e18f45221c7d44d21fdbee1e30df8cceb0d0f68f0091e49bf1865eebb575ed757d820326757d
-
Filesize
90B
MD5a4858bdfc6a8c2f77c7666b9cba76f0c
SHA13d6bc50e18d155c41261435546c028e9bfac5d9d
SHA256524d28a45b8635deaef0e96cbeb656e30e3c2a3089519d3c0b87ebfe1960c4de
SHA51292d56756f47453801b0645769a4590fcf2e03847f054f65d875c2c6e891c34b7b379719e8096a804a41bb5e9697fa19dd7e2af79ec1430430db5ae9214140b66
-
Filesize
328B
MD59e2863b6f3afbc2195fc2b9926bad24f
SHA1a3efab4ad0aa242c483225f09cd093f50a70ba2e
SHA256869daae98b6889db4651120da3769659d82d783bcd9fa092db378c626a5a70f5
SHA51226d32fc9481691e2f3f6d8114cda89f66414cd1482c17bf62dc64243482b34ccf4896fe68db7f47ee067bebf1438525144bd69af5941017f1bf74206a09ab314
-
Filesize
1KB
MD5d9d02a2e3b17a7f6b4e3443c2404c1e1
SHA1a4a96033bdab8be4a6d079b999ef1ba67e5539a4
SHA256e2d842608387131c4dce6ce014527c7ab07b38cf0d73ad8d02269f370ba28486
SHA512ed7ba14c5c377cbb5f499d7a366d89e25cd11dc8b0822566f41e900707051d019405b3f5ecec7382c6a9f583a022c3c735da100a9ac2d1e02a5def36d1eeb10b
-
Filesize
162B
MD5b50d81587510148cef60b6ea4877450d
SHA190e512ce446534acb298da821f924d0d8bda3c42
SHA2560530e14dba9f036ef82202bfff33c99b75ca83c22b58a7f3ed846232813beb61
SHA51204fde9cc010cecc4a5384a37fda185d9d4cede2e669226749dd395052318c9bde18efd66249567838418e207a1a76de2afa2a650ec8ec25b43c7cc27fa34e934
-
Filesize
586B
MD59f2cc43203a437fb7d189d9f6c038322
SHA177b17e7ce83a332293323b1b3190f63dde761ae3
SHA2564d27e3a08437a202bd07e655d15686b1df89cb4fc4d658b4eb619dcc2e5b929c
SHA5127ca3c9c52b5acebe4eb034872e85f5e621693c66076d74fae62e222b4284f46ac91b6f9143f031d26a91b071774aed997d7ef745b239868e29cc6ac75005d9c4
-
Filesize
124B
MD505336bc13ae62c8a310155a3da38ceae
SHA1b99ce6f50d358ed37858565662ccbc10c3370f56
SHA25690285368d0af25ce0ff807b2b015283c6d8292decfdd04a1d79a811a00cdf984
SHA5129443be8b3298cf9cdcdf63de16b5ec282a17232a2e8acddf1fa0f86a0c1015e832100c13c4da214c6cef5ee6890fb4206fc01a9e58cd0a50359499c364da7f69
-
Filesize
8KB
MD5dedccdc256805ded9d1b545c1e52efa4
SHA1a662a7d86f9e23a54d0faea3ae7f1ac6f6d024ae
SHA2568caa83fb6ff7eef2804b0b3901164cb2d01628f602c52d58e482895e02bb9f58
SHA5124a9dc6d1e3015a982ecdb73e84aab5f43252c66bc11beafc5ca4a7d796e9bd8ce098855cb373de092021baa1e5730d2d238b638a25b8d212840c1122aec4f52c
-
Filesize
880B
MD58bf15be59350927bf916cfe81e694fdc
SHA178bc3006f9c9fdf3e97430bcec50034bf0affca2
SHA2560116730b84a6e1602d42d6744e08abc5b31a1308d3cf84eb0ce57512ea6759ac
SHA512ae4f6f64bba34f2e96a3cb4a5ce154d1cbf3dbd008827ed48a8ad8b4d7dad4a2e538b52d59934544a22aae025f7006e1bcc67c1276a4184cabba8ef5af514485
-
Filesize
24KB
MD56206313f42edbc6290f70447c08619a0
SHA1a98d6a081625641680317e14b437c871521ee3dd
SHA25654a58b995b8f8b761a19426ed0eec3b6366a79b9bd5d17268f97248667de1640
SHA51276f046cd86ebf9033b13f46942dac916c79c056936e6a81c9d2a3250f5e6b87064a5e50d22ea868a5b6270fbd9e33342f78f98b103f573a6373a8823e96e9b4f
-
Filesize
54KB
MD5391dd193a3d7b204b52d9a930115069d
SHA103974ad9f5e39ab0af08b91347ab3b382c35004d
SHA2560bf50dd29490409a2659502615f2d99936a2466def2190d37224656256aebd7f
SHA512fee5ef2aeccb41c39117c6b182a1119213bef9682270f81b164478cc8a108e6ab53dc0fb96c8a94a4ecebf4b453b202ee7d515d27525a6fc6209a45ece0688f6
-
Filesize
51KB
MD5cbc82c93b75a1e9f22f4014ba48252a4
SHA1a6734f037c003b72a5777ccc95cada7f657d69e7
SHA2566fa9279c248108df15e5da42de36ba54273fa1dfc3db07cc85d49cd0c8e65dd7
SHA5125583b816d884e51c622c950f531ba393539c3474d9065a48791c7beb023b2eaeab093e18ee57fc43ccf45ee94485fec44a13c19ff90d79b11df40e119e63c075
-
Filesize
34KB
MD541711336899978183e2ff784d0c6cbf1
SHA1956ea45515232089ff7e44aa30c80c24294621b8
SHA2560f4ed97e0492d5a576f0a11e449c5ac5dc9a11a36205115b8172828a15e0644f
SHA512723c2208244a3ba4ec06ffd6baeeff5cc43fdeb5ba4a033b39a880c9470eb45e5810709d89f7fbc107ec44926fd4c75ba263ae4e5cc0740835067d7d2fd97bb5
-
Filesize
20KB
MD51e6ab0720d3bc475fe54551fe08afaf3
SHA1d83c8aed6dbf197fafef236f60dfb9eb0bff725b
SHA256e885f3a04da4a028f83b81dd861a2f8b9a09cadecb37f456597e6bfbac12e452
SHA512124e9139828b0f87f167923fa35adeca39b0011852d836761e7a35e128fcd06abecc5c38b55f5dbdeb4ec8b3c670935151bff9efe873bcc659c89ff822b1e6c6
-
Filesize
33KB
MD56160f9a77ef01107d938e59bd6ffe6b4
SHA1b9ffece2a6feb4f79e8a7cd1ce2247739f295e39
SHA2568d6be2e92f0bfde497fd2a3ec2965c2f106fa1b3bc68bbdafe449cb1cc1493b3
SHA512f28f5c244c9ed9e225512057172fb51317d8a3f83ae15b94543d2b81408d00ef96abded2182819c93f7ef5b0cb90b40d9ab7204dbd1fc902329b2a229420cc5e
-
Filesize
50KB
MD59902cf76f2da1264564104e0e867ab9e
SHA15ea55dbe171d12a1d32df0c8242e40fe08a33110
SHA2560309b9a3d92c7d8713995bc0c020e1ac191e1f4f3a0b830f9a35b7ce749b041f
SHA51230c46aaaaf7c6a1802f653e14205c2ddfb79c01486f43dd0c536431a835ca7d11d2054f87754c76af5c5daa5df4bedd3702df75b9330c3ece60d17a02f3adb68
-
Filesize
52KB
MD5cf1b6dd6301bbd1298d778178607c17b
SHA13c649cdb6db9d1de4951af41b04a3d885169136b
SHA2561d987454a530221fb2ca6e5606b1338444f078950183e0649fc6b9fee063cae9
SHA5128ed90c3bd6eec24701e9ad00e48379e245c504d3d76093d749d269ad01458b249191ad8d22f25fc08cb11251db6e09cd7c90b52ccb03793df7326a66429e90c7
-
Filesize
6KB
MD568b8d369a3f0541855edb9bd0a373292
SHA1a305cae020c84e3ebe0f6c2c35cacf80d8f2997a
SHA256b0585e8ae8cfc90a1d33e54f9e7fd551b02234ffc365e43b264f03c8f4064b38
SHA5121da9ec30589cd7c0b6c54111e787cb738be00b310360cd1ef4b3908993af894a62a5ca5831861156404801af52f4a9e16ee563d54f721f9be94885da99da7721
-
Filesize
4KB
MD5bcfe372e3cdcf419b178a29b3c507b54
SHA139dd659ab2c4fe4868e9eb69e104ff4731756951
SHA256d9b395e2b7ab93969dfdec7272647dceec5fcd9290a156086f2941c82b2aedf8
SHA5123edc144973a0bcd27ed08762f1cee46e07227905a0b9b48c87a3f9066fff229b6d23f25e541aff5aced7872fc675e3d0c994017f9ecf30e467ed3ddc3f5cad69
-
Filesize
3KB
MD553c9842b68aa51279adf06cdb35c7c86
SHA12cf8dc196e3f4f4e7576154ac7f900852202d365
SHA2560b7b5dd22fbf05c5fc26f976bd2ebfe9cd6b560175fd44ed3f9e7de30918503f
SHA5123cd38c56daa922b95a9af39299eb8cf7dacef8c7b51e5df7abb0f345af725f4ec82c5d1b6b4b37f3bb68b068f0a55cd18ce413fe466a4e0fb2cb5f2c0d7038e4
-
Filesize
6KB
MD5e375e4f9c08ddbcd4ef8e5041fe8e7c8
SHA124a5b319fcad133b9269b6481916cca56b887f6d
SHA256bb643c56f8468f7aed647c6de6553eb8b1e61b4ea419feef20a0e91e5c35c9e6
SHA5124fb3b0241491a9d413baceb9fa2468e31a2224fec06cdc80ccb28273b55e70de8440c1782adfdc8c3b21d8273869dfd7dfd6c561ec5533b4f2561f480434cc81
-
Filesize
9KB
MD5fb299b78ae25ad25947ed77a3b979358
SHA145d33a172b525689c051976b0fef938efab67fe2
SHA2569230ae5743faae3552d6cfcb34067e35fc06c0b1ac2aa9ec358655187c6c2e41
SHA512c0e98a7eabd8c8b3845bdb6b981860d551bf35071e114794150478648e24d09c4f9d3f6c3f96656352ea37ea149bb34a49ef4f52b54be416a7ef2a478fa054f6
-
Filesize
7KB
MD58cb7a13f954e54f7ae2b4407ee312d1e
SHA1f7f9f5c4267ae3549f164aab0789c96ea2e27109
SHA256eb8a43ea365a7602a483d69f0860cd469d8bf1feb768c12df1095f79b39d0d16
SHA51258eb90bd0ee51ee7decf58f02740ce6a793c6b31c05f888a638228545243d863316f27e0803f3e531c04413933e3d964cb5d4a8670b5e6a7ec7451941bb2f977
-
Filesize
5KB
MD5bebfd7155f0e7b16c0430962c4ef468c
SHA19f73b4352ccac26320d6c729bfb9666750c8f001
SHA2562a50b34f42f3e267615fce9135bc677d57c0c0ed6796f32694922be0b368cfd5
SHA5122616ff59cfc8a3fa83267945d2deb68ea5e60fa5abc430628a33865da4fa97d8431820183cb8b9bc825b68e3654ec5afdec937f2446eab57f90e9f0d765aa19d
-
Filesize
9KB
MD55cbe2e75c7f1882e836ca5efe81f1d67
SHA18db9aebfd87a2c04bb8fff7adc24cb4200ff729a
SHA2569c4fca395ce9cdd6354dc99c71df985c917cc0900f9993fb83002c56785ce2f7
SHA5122319997ca4a19c50b18dd32dfa4f0d1ccaadfea6483865ace81509e186e0d281bac144b1f5539e644010d23f0fd7f903ee4de1181f77a5d6421a682aa4668870
-
Filesize
11KB
MD50815d8b4e98bfc863f3847db5dff9397
SHA1d9eb8d9b3023c3119b87888a34fa756142a4a6cc
SHA256cc12b8a35d3d6136dac7dc373e59eca0e6dbf10413b7f65766d1eb913e03ca55
SHA512d01e5377b086adcc66fda4fe936f34bd48a6acf9a5ccef12905bb4c014508bc79b2cda8518ac53b5f057dbeff4e052130c3da24153ad35ed4aea8ca7e590f4da
-
Filesize
2KB
MD5e246c2269d0f25227e4da9eca828aed0
SHA18924c56d6af4edb403cca800e69066856a0d15bb
SHA25669f39657a5b417b571e6024ee3b3d1fd38747f85b35b6049dc65f13af0fdfe48
SHA51282e4e3f6a25c09a60cf1ad289c7c09c268b75cb6c8c2da4650980aee7b2369e392fcdeef7a48cd96742a7dfb9ab8fb07579266b7a70d6df3166bc5d3d14a6b0a
-
Filesize
23KB
MD5cdea4f2e70cab5650bf702020041ad6c
SHA166d63421b6a363ed2d0f134374892151c7b3611b
SHA256bc93dee3879ad2ec508ef55a48972437cb7ebac7fbe1332873d60cc8fa68142c
SHA51200b9b934599283906b39d91462309fa8e56ed05eced731c2e5a7c62db70d809ac11cb8d2ebdfef0eba88c6050fb46e7ef311891e86f6d1eb2ae6c46b41b7033f
-
Filesize
4KB
MD5a8d802048d062e2ac7c72f10c6bfa661
SHA133d925f25a7fc0d439f722460daa712c4193f809
SHA2563dbe6c52881d117c0f17cb487df38e1745b6e4a88d24896d21044ea64b77d3b1
SHA51201962a3f98b98b37d33eb1caf0b1822a4892388b987d3bdf383c202340b8fc9751a8303e7f4aab62b446c77b7aaa21eee1502ae1f6dd32cd336d21f43c483b18
-
Filesize
372KB
MD57462ab27094feae793646d8ca0308d1d
SHA1f6e5a3cc25b9d72f2653e2ee3496e0c99b2e859e
SHA25648bdcb889e926d07f5e8d4de772eae11d31f7a1475d9921789f2af0d8b549abf
SHA512203dc2cf30b7c515a6301be0774403ba0dfeb91cf9b5282ba4d50fce79b210df8a422467fb358f3ce55fcd4fe7f7870fbe61e30b2d948a7385540e16bd83178b
-
Filesize
49KB
MD54df3aea2a96cddfedd0cd0db3962259a
SHA16af9d97be4dcf3369e6d33587096cc37257e8555
SHA256509c5095c17b45fdaa7bc826cefb8a4381fff3b7ba23167b467340167030f326
SHA512bb1321427649f645a1ed45b9c4c65e52cc37758b645ce93d64454c495a0716fc9aa6644757087a197088286aa385297ec9b8d3a5cfdd58a20f3161c3367a9a50
-
Filesize
2KB
MD558053e7994708c0c30c2688ad2c58aa8
SHA12990dfad4464fc96554d5cff815e5c81d1314fd1
SHA2568bda25a746f228f2c09a4e37764e1df4038afd7f1aba1bf5e3d515ab3d905e4f
SHA51242309a457a8bd1a9502cfc7405e72e89ca724f69c80d528404ec2897b7a86e9e6706f950cc7a80a4d78b2fd888a24fddbf5f9f1279ca46ed29fba160f8efee9c
-
Filesize
13KB
MD54cd3c2da09e21acc8f4147c6c740a78b
SHA1040425b094c6e0ba091b0edd1b92a81c96ef8a9b
SHA25671a3a34cb5b992f935c343c27090335c518a6ee22f16088fce6dcc1bdc28e9b5
SHA51254ca0367e03aae1eb90838d6f36be11b743e536b0b93720e8169124d43268078f19b8de18b8622eaef011c2ac3eac6ffd0f88c7f56041da7271b2dad11191053
-
Filesize
62KB
MD59bef2d97bd3019fad66f92263051a66b
SHA167ca57080b59c9d2335522c69229c7af278b5eb8
SHA2569684640b5287788b2ed312d65a8f62ee7fbd0e7068f314cc25d58e208131bc0f
SHA512b34277f5551268829284dd243c18cd913ae44e6c8d8f6cf4d3632c07f0341d3be8a06ad50fffe1b410710858a5b88a9e8bd15d5b32797f2f857febf744a87e56
-
Filesize
1KB
MD517b2e2b622435153ae9985fc3619644b
SHA18b28e41b0836f2940c133f9ac4f83a12fb1718a6
SHA256baa0802375604745cadc12f6eca98cfb93f48e42ba8ec751ea4854b341e2bf7d
SHA512227b60650688a4a19b2a36daf06a1b6fdd0a74cae1f2db7b077b2806a501d537c9e779f029a7697b22272f228199df612533fdcf1c2405cbc2a57e5798394ff0
-
Filesize
1KB
MD50383036fd7bf877283c5bbe18b1593b2
SHA1bd4384da3a71a6a318fe30e3fc53cca15d7b2895
SHA256315f23603acee8e91678b1a10867c064546eeadd9022d041c61498a4fd7e1625
SHA5128a35c95208686ee805576cdeb769839c3c54ae09a780ba248b8e0730c491c3b914fc9742d6b9d859653d6038a1db607e6c98fee125d052dd01e27efeb22730b5
-
Filesize
1KB
MD528757d4978bd1dc62674da7d1235f77b
SHA1dda685235dc139b1af6beaeded23b11ce967761b
SHA2568a030d04e222b535f2a50811018cb8fb5b14d9dada14b9cbf8c51650a3d43398
SHA512c67328831fa51ce77edd4e577efcc0283718b13a01e3f02612bfd4d96302f1b41dc9b42a6d2a05131aecb65d111729cb147f072294bf45edcf7e14e8b2a655c2
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\3 - Windows Explorer.lnk
Filesize1KB
MD5e882fbb1d88c7fce7da170339f3f12a0
SHA18379b2dc147cb8a706619736a794f68f7b45a65d
SHA256f7ad6071aed77998c2514bfe1b80d61c7400e668823cd082f90b17cdcbfed7eb
SHA512f35d9438e7f43cffb6385708c25bf6a601fa62abce55172fb960d9d01bc7b5a6369bafbdfca0ced10710238a0ba8a717941b2dcd740974a9c283c6016b993394
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\4 - Control Panel.lnk
Filesize1KB
MD5b706452c2bfef5560bc66cb32784d666
SHA15f588c7d9ffaa863b81137fd27535c13b2064581
SHA25613de5bb4733e7bc827b9d9c404ae53bb9742a0ad653cc63f9b951a9db608c0e1
SHA512c9f66be60c9c5be2ba277b775be561a24c164e2868dc41446093788479a933585a89bde005d3718f9c9e114c39984e08493bb3a06baaf4d916f8ccfa5c997bb4
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\5 - Task Manager.lnk
Filesize1021B
MD5c434430a53025ba140e470efe1096bae
SHA1e1960482179c086badb148c9574877eef3e32c06
SHA256f3d5a8be0b1990a7356f10572403f75673358bdd4ecde7cb440c5641359ae0bc
SHA5121bdbae4eeb5e9b94b075750ec6da8c1f42562f0ee15111ce92f1dc81da8d0ed5a6e4c60443cb8a022bd36d733fdc0600f6fb9bbb0ce8992fe3ac8c6ca706a2a0
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\01 - Command Prompt.lnk
Filesize1015B
MD5417d818656f165220241ee23920215ab
SHA1dd532f33f7f7bdefb2ff4d03f9a1f19697120c30
SHA256146f8afdb26d5ff7f529503095d6970529ad428c82baa2f4bc45541d6f7565cb
SHA512d7286f12e8a2a39af1e16d7fb3e3d3643bba28536780cb336863faeea38418a7201a2b2014bcd30c7855eb5ce9a6fae0feac1134c957114389c7674e8becc375
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\01a - Windows PowerShell.lnk
Filesize1KB
MD53392dd1730e5b11bf6fb38d10fd9d949
SHA1064d5463eb357885e08be6780e147b1cbd5b15f6
SHA25653810bd9eb8b725697eb7deca235f68f87f47c55ab421c5c35049b685355a03f
SHA512d8357d053eb454f6d9de827c4ec9d183cfc90036acd9129a796a0fa4dee4a203163b57fad6ba7879676cd431de733f80392105d12aafcc97c5c0038d46467a6e
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\02 - Command Prompt.lnk
Filesize1KB
MD5ae034928a91cef7849469cfd71e866a2
SHA10b2dcb94a2c4330d880d5f52f8e5a718e8506634
SHA256f39b430fd1eed773fb2799826f18fee41e988b4d553b0fe4a536fb2533c5b6e3
SHA51206c591c816124bea5b617c3708e360245d79fccc049f810f2164a0972f4748a523d21d1b1cefec0a2dfd4e8804cde81089fdb6bc941041bd1c0ee1cc78a9ebe2
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\02a - Windows PowerShell.lnk
Filesize1KB
MD5ca2fe2a7113a6ad4eb7682a1460c8334
SHA1d3788b76e25b42305f1139edb8fcea8dbad33068
SHA2562de16c33030775c98f9e16019c3caea083cebee60f2d396a69cc12df4eb0a85d
SHA5128daa5e44ad269ea1ff81e7ba9ba06268773c8e33555175c8759801726458b20a384004216f01d9232852cb2604dd6e8389ff6c2c17cb3d30f61b6fb280008ddb
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\03 - Computer Management.lnk
Filesize1015B
MD5bc3a3c627f9b2f81af004b29224cb9ee
SHA107d249816e014ac98873723db445f5ced5a48218
SHA25652d73ddb1f1afc204a896b70736595d76c6203bee79a86a30c2a30c0913ad40a
SHA5126841b4e4a7c76ad900243f31dc60f7bf8db11c3e5a32e963a9fcce5974547d9ea47a7c6dd32586778af988e55ed492b227bdbc06c271840bfa245e32fd4f6238
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\04 - Disk Management.lnk
Filesize1015B
MD53e5fa08e091b9cec709f6c922e0e9d37
SHA1d1faff0bbce6b4a11ec519b4292fddafb3674f4f
SHA25688eed061f8a1727e07b500292d074a5f2e3d7442073de6a097337159b6430fcc
SHA5120276742486f9018b22f86205c57c7dd5974ff3067bef5a454d709c9209b29811c65fc9d1bc7d1136e61d614bd77c0c62e3688c4b823b089c60b30f4dab53a01b
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\04-1 - NetworkStatus.lnk
Filesize1KB
MD50e30b6795d3c50d050c94ef28ebc7f42
SHA1731240f28795af27e7467f6b9006b299f7dab63f
SHA2561f91a117815163814851e0c7f2cfa6409957023a2171ed975958726be4de9c57
SHA512a8fefb21515059887c812349eb4518db0c161b816f57bea22d3aadca9b6b89a1674f0c37331b44d3938083a46bc5aa77217784cfd5d3175154942f28cbf5fa39
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\05 - Device Manager.lnk
Filesize1KB
MD5af4843755c2230993114a7f131a0fa0d
SHA1facc9027518a81ca100297b1a27b9d3d5598f176
SHA256e7a93b9200dbcb6b5ea0a5715bebbc855083d0d0cd687e07f451d78cd35b71bd
SHA51289cd6a7388fc1998df9aa6c8fedb19cddc7b945b91a76e75eac93229c514bd8c8efb5742cc36e0d9726c3604e9fc84d24e03802310da41a9d9dfa33d1e13302f
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\06 - SystemAbout.lnk
Filesize1KB
MD5203eda5cb32b7c0f4509ef9920460577
SHA100472fd819b7c8c2dd02369ccdb50f020817277f
SHA2569f835481c5ab54d4fb46754b0b66e1adb9bcfe48290f6e0e91fee5ee549a4a99
SHA512b7ff37378aaa6d6f16154b63716aa73b7373a7e909d1a8df1c49bf472cf6ca08c671ac395e3fb0600ef7be3d8b424f811564205b7ae7a35b6f83577cc062823c
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\07 - Event Viewer.lnk
Filesize1015B
MD50b8411844a1241ce1a57ad252a30c56e
SHA193089976118ae7e020f1b58e82122aa90ef07e50
SHA256ac47adccb8a09802c0656160c6e5e908b7d815613f8e2671e6d190c5aa4f936b
SHA512d3370a069465c9010f1c843657441624ea7b7f8f0bfee0cc0f4253f3fa840025cd80e81b1538ea606efe48f25cc21022bcd2cb2da5b45c4aa7b9970722d5bfbb
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\08 - PowerAndSleep.lnk
Filesize1KB
MD515bbc0e15e3d6836c36343c6aa3555a4
SHA1ff3a45eda88e92a7a6c743d6735f7469df56e65a
SHA256a3c5d1a02b65562608316cf81efbfebc609e6e4a8a292ff6af14ee1e222281d8
SHA512cdae6a8004245d0793bf22aded0977400d44b99fd17284ed11cc42277f479dece9245c43682a53b293fe6a234d7e6d194df57969e88ac0fafe1705b925d8129d
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\09 - Mobility Center.lnk
Filesize1015B
MD5674a1a7a64253c87c0795b3644f0aec7
SHA1ac6b49506251218d0344f66b65e1f2953b9c82c1
SHA2562d0dcdf6a66cde28e0669879e22462b1973b2d0fed4c62d9ebbcfbcd5681253b
SHA5121aa4fae06fb460dbce25ad56472276e0fd1dfac6dbdd53d007dff5e4aa875221cd1169e106f63389e84dbc70ce1f23a8cd744b17f5aa38c14f6a49e6f40767f0
-
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\10 - AppsAndFeatures.lnk
Filesize1KB
MD5685d1cce71c48cdaa022a54d8207453e
SHA1029058db4e85eed4795565d54879a9e369637e60
SHA256e7c7ba7b0bb93a3e5c288654735edffd8e89ee5252f813ce097fd287d42a8b5f
SHA51267875270b9a4bcb44b73befe4e44c24f51b8983f903d11f77b79f8e3ceaad61837ffbf7ecc870c85a5746d97a104f2a64730c39024c52711e2156b810a809fea
-
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk
Filesize352B
MD595be49359df03625aff395da6fe6513f
SHA111407fb7e0466431fa9b08bd15a8648c22d1abf5
SHA2564f7a4595edf7b9388e3de7378ccfbf58f4a7205d34e836f5da5441c3f35ccf8a
SHA51227745e50ee0f06cc86f4838ce63074116a3956178274b31011debead499db6d67dbc82f8d1ec2494cf0b1096207c7c353894aae420230d888ad9fa02f7f8d393
-
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk
Filesize334B
MD597d6512f27c2dd24dc415bb54961a26a
SHA15fb22f6b71fe8b35915d0bdd8e82bf1fd3739bed
SHA25666a26a4320c04c198fcec3514c87b35c04feaebf5f034973e72cd835602e193e
SHA5123000a6c5e136d8e2cb7846f7127ea20c6dd6b93d3f262e6cac3d6c4e1de76757c32f75933c96243072a4dd5a6a7ab1bf55abc0eb717e3dd22a44bc0b14e5ce38
-
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Magnify.lnk
Filesize1KB
MD55300dcbb6d4133ef782e3eb89718de54
SHA143914edd7a6ecc8a0607e804f7d7bb856a141810
SHA256701fecf974a1e23e81c7887aa6356d4db2cfb7caf3aad0a8411dc2b3e03e2129
SHA5120113c57dcc878bafea0bb7d4ef33e12859a711053aea6612ae6bc9fead0bc6fc02484c4ae8464eb29ddf1908873920961011c4c704f42a9c6eaf28f101ef3d22
-
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Narrator.lnk
Filesize1KB
MD5ea243ae9cd4b47988cca95edb0ef6e67
SHA17eaceac932deed2cc9c8771e7bece59a287b9b41
SHA256e1ab316960b4b57988173384bbef13aea3613865f0ab576a17c98759184bd68a
SHA512fc529ce67f8773a97ca4b3181cff31664bc481e379760ac43e772be5f57425af1ec6628fa9a8cf23ae8932088406d0ebe1bcb0d58289b7147b9767e9344f485a
-
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\On-Screen Keyboard.lnk
Filesize1KB
MD5fdd62f492af5be3379d27229d7023022
SHA105e52705b0902edceb523595bfad8909d841cc0e
SHA2564c094b56108a6149bf9d16613d1e79c2ce815f6f575fa2f4d0f7cff281e40db5
SHA51205682edde5e1d46d7c5fe4b98976db0fbfda8226f6b77a02d2ccd96c629fa168cfb05fd8532055988c0d5cdbc0d96f051df3e46c3b686457e2cbea9fc10d8d79
-
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Administrative Tools.lnk
Filesize1KB
MD51c24246f10a4226fd7b56f24f81092ad
SHA1c7e836deaf267a18d5d61d087f7f4616e6d4f2c8
SHA256e6f8634260b14ccf1e85e688f02f696fa5d578d09ebbdf4f49846197b0e5a569
SHA512b1ce1109611e43be4e70dcc8a2ada656015cd2b9ea62e1687a80e19b497e28c8d85af6f6a56ef87892296a84a614a1b8ba20707135a73bdfc5508b9bd020b430
-
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Command Prompt.lnk
Filesize1KB
MD5a301fca5b7ddc53fcc7d4647326b25ed
SHA1c1e4632bfee92b79ab16fa13916072db82479f4b
SHA2564f96dd523f34185d54199d32af1b01104c59e22894c869dd47210cae1f58d2dc
SHA512eacd225077ebde7c2260eebe10bf0e11b4a9510af8f0358d90846a1338ea79a96b56bd4a0ff3729ade38a427cf26172e7c828ad7cd35eb7a5046a8eef14776c5
-
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Control Panel.lnk
Filesize405B
MD50630ce5d824aea77517c0333a5fbacb0
SHA10e982f02fdc3452952fca8642959b454b95c1415
SHA256bcf3ecdacd3bae327aacc1c9106193005840ec9eb97cb6121fd7f2c85aa74cbe
SHA5120a62245731b77ff3fbf067893cfb8e347e0e8698f59fd95245a63a7c27539ac74bf2fd9967eaf0e47be33302bec896775d59602ae5579046714e13b778a80b8c
-
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Run.lnk
Filesize409B
MD55215bcd0e6362466ad3df72d8c182f28
SHA17f88c86932bec8baf866e0f518f48789cf71bc66
SHA2562208b2bf739ecc5a1caba2a173220b0430b8a185d745cd90a609b511e0627948
SHA5123768b28191878de09056aab0cb2a64af7235214bb11b91be0c8623dea6d38d80155a0b387eea4ab0b389e383c77460455b97399f55a4d183eb5a48347f4230d5
-
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\computer.lnk
Filesize335B
MD5fdaa45e42bfcdf189877d6c1869f59b3
SHA1eb43260893ba40a3164ae7ca78ab3c4d0b29eacc
SHA2569666815b9bb2497a52e812052994deb98447a57fb7eb0d6a201d5913f1df4fa6
SHA512db8f9482293e946d24fb685a8d3f44a842d96bcae7bce17fd9b923a1cccfb52243e57bfdbe6fa67b0d584e0a82952fc1cace01eec37d9f2f5e53b91f7202b067
-
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell (x86).lnk
Filesize2KB
MD5ad89510ba51a453b6a0c6dc70fc093ed
SHA19239ac806c51d020b941ef3cd5e17c09dd59cde1
SHA256b68f8c3c5d375740a85a04d9f21cfb6199567caa492f4b4f9acefd454896e099
SHA5126ba7d105b4dc545b295ee4fd3996533e6967287df3f52352c972ba0d5480394e21333593dbccaa09b8591ccc3421d2e11705cad85ed0ee65aa50a25864016406
-
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk
Filesize2KB
MD578a3653f73cd9325a54eff6deda4c6b5
SHA12c18f0b1edc43b6f95b98541c22d1d9dfac56cde
SHA256f26c455d86a4114e2e1ffe7e92165e5edaec006fd803be0150260c0a78b97ffc
SHA512ea7870b3366dce2f920d4fcf5b284ad428cd170c079a682999d3e591967132908cd324de82219ef481b4943022d37d5c830699d1c4f8a508bb9f193f99a6c0fa
-
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png
Filesize296B
MD5bc3814ecf1743338ad45357427b44bb3
SHA1568da5177095e8cfc37ca5f4146a2553f8841f8e
SHA256841df50e15ad613164acc35f90c62af8be6e06c489987af9942b542537131fd4
SHA5129b5869cf8848182cac0c3c6b0e233141d040d823123de141519396ad96c51e448013b47dd288d451979d24cd3c143c8c66d26f3bf941c74fea96339d87ef2cfa
-
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_contrast-white.png
Filesize276B
MD556015742b9b43ed12a4423378b917a22
SHA144a7c4d69da0d8479582f3625971bd16384cafb5
SHA25653b53465c55499bb5840a730fe10794c93e6b554cfd2bf90339b81184b620dc5
SHA512f783eebe6b3000b1c87811ed9bb2590f4cd80818ab300c16dc1348f1b56f9b7e7103d461974b6447e1985ec5149fe5dc1520d3541eb01d29594c2cece9c78da2
-
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png
Filesize296B
MD52f70ee642f4be2e411fb9fec0d6a5c8f
SHA100c971c9bd4b27498544b82a7c4d2616d7c6e522
SHA256974fce5e397c45cc1574e00d7f6c39dd669259a735bf72babe9f95301faad53b
SHA5124fe10c5ed08e101597208b9de4dca27fbe15ee24093a4d5b8203e5c68561377983aba6ad4e08ca1322ddc9f04f025f5bd9cf80beb69a2e90c729b1c445f76e61
-
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square44x44Logo.targetsize-44_contrast-white.png
Filesize276B
MD51e0e556f15c7dc7b5e376421683e26c8
SHA104af967c7adc212aa704da9dc203f9abb9620d35
SHA256b0bcefc79a443eecf100004843e010741cb1a5af81faa335d66c1d7efa701dda
SHA5126fba672978eeedc0f698fc2da6b571ec53ecbaa0cd276b5925bace9ac2aa7b283761f4c81051174bb9ec1511975e5b01e17bf7a45637b7480e2b1f16f2674698
-
C:\Windows\WinSxS\wow64_microsoft-windows-onedrive-setup_31bf3856ad364e35_10.0.19041.1_none_e585f901f9ce93e6\OneDrive.lnk
Filesize1KB
MD50b863caaee968fde95003f1fb29af9c5
SHA132db34d1767f584a7be3051b479779da90ee0203
SHA25600b90fa5da2c95ec4f284059d15b72ea2a0bb1458bff0e79b5ef2cd4c743e042
SHA512ed4597c8f7cce0dce1e4a3e0e8e6182ae545f3ea001c095ed4f4bf3977e5417135475724de7bc2038ada18e983f0de3779845b6e20a3011c4a8abd832e7e2858