Malware Analysis Report

2024-10-19 10:43

Sample ID 241007-hqdlmswbrc
Target 1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118
SHA256 a30c0eeba490a6855df6aadee5d546cedc0e410752163573d95b0114c9185107
Tags
xorist discovery persistence ransomware spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

a30c0eeba490a6855df6aadee5d546cedc0e410752163573d95b0114c9185107

Threat Level: Known bad

The file 1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

xorist discovery persistence ransomware spyware stealer

Xorist family

Detected Xorist Ransomware

Renames multiple (2193) files with added filename extension

Renames multiple (2186) files with added filename extension

Drops file in Drivers directory

Drops startup file

Reads user/profile data of web browsers

Adds Run key to start application

Drops file in System32 directory

Drops file in Windows directory

Drops file in Program Files directory

Unsigned PE

System Location Discovery: System Language Discovery

Modifies registry class

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-07 06:56

Signatures

Detected Xorist Ransomware

Description Indicator Process Target
N/A N/A N/A N/A

Xorist family

xorist

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-07 06:56

Reported

2024-10-07 06:58

Platform

win7-20240903-en

Max time kernel

117s

Max time network

118s

Command Line

"C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe"

Signatures

Renames multiple (2193) files with added filename extension

ransomware

Drops file in Drivers directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\drivers\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\drivers\gmreadme.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\drivers\it-IT\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\drivers\ja-JP\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\drivers\de-DE\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\drivers\en-US\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\drivers\es-ES\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\drivers\fr-FR\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\RYiGElV1ZFlQ3US.exe" C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\System32\DriverStore\FileRepository\prnrc00b.inf_amd64_neutral_3338d41663aad5fa\Amd64\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\en-US\erofflps.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\wbem\ja-JP\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\net1yx64.inf_amd64_neutral_ed16756f950857e8\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\pt-PT\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_For.help.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_wildcards.help.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\wpdmtphw.inf_amd64_neutral_a7a22bb0bb81abb0\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\fr-FR\Licenses\_Default\HomeBasicE\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\netl260a.inf_amd64_neutral_085226e1dfe76c55\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\it-IT\Licenses\eval\UltimateE\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_transactions.help.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\sensorsalsdriver.inf_amd64_neutral_1c5bc8e71eb90127\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_environment_variables.help.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\DriverStore\es-ES\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_Continue.help.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\multiprt.inf_amd64_neutral_988a34fc912eab54\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\netbc664.inf_amd64_neutral_673d3dfb961e9b17\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\prnca00g.inf_amd64_neutral_6f76b14b2912fa55\Amd64\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\prngt002.inf_amd64_neutral_df2060d80de9ff13\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\it-IT\Licenses\_Default\HomePremium\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_script_blocks.help.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmsun1.inf_amd64_neutral_6184912bd8e5b438\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\msmouse.inf_amd64_neutral_7a5f47d3150cc0eb\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmnova.inf_amd64_neutral_b52d8db82d8c3be9\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\prnrc007.inf_amd64_neutral_2df575afa0f7d35f\Amd64\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\it-IT\Licenses\OEM\Ultimate\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\ja-JP\Licenses\_Default\ProfessionalN\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\ru-RU\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\msports.inf_amd64_neutral_fdcfb86ce78678d1\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\fr-FR\Licenses\OEM\HomePremiumE\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\IME\imekr8\dicts\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-NDIS\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mcx2.inf_amd64_neutral_8cf9cade8f7bba56\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_providers.help.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\fr-FR\Licenses\eval\HomeBasicN\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-MediaPlayer\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\it-IT\Licenses\_Default\HomeBasic\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\IME\IMETC10\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_type_operators.help.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\fr-FR\Licenses\eval\UltimateN\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_remote.help.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\winrm\0409\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_Reserved_Words.help.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_Switch.help.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\it\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\migwiz\dlmanifests\BITSExtensions-Server\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_Path_Syntax.help.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_Continue.help.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\de-DE\Licenses\eval\StarterE\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\prnbr003.inf_amd64_neutral_dff45d1d0df04caf\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\prnbr006.inf_amd64_neutral_f156853def526447\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-ActiveDirectory-WebServices-DL\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmtdkj6.inf_amd64_neutral_8087946c82068597\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_arrays.help.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitsTransfer\de-DE\about_BITS_Cmdlets.help.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\es-ES\Licenses\_Default\HomePremium\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmti.inf_amd64_neutral_4443b423d18c3ffc\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\nv_lh.inf_amd64_neutral_bc69f20e3115af59\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\wialx005.inf_amd64_neutral_5304c93e2193f237\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\fr-FR\Licenses\_Default\ProfessionalE\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmbug3.inf_amd64_neutral_7617862a9cc286da\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\ph3xibc6.inf_amd64_neutral_2818f7b3b62bdd39\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\es-ES\Licenses\eval\ProfessionalN\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\settings.html C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR7B.GIF C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\BriefcaseIconMask.bmp C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\3.png C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\id\LC_MESSAGES\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\js\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\LogoBeta.png C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\pause_down.png C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Slate\TAB_ON.GIF C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsFormTemplate.html C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_windy.png C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\flyout.html C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Push\push.png C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH01213K.JPG C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\SoftBlue\background.gif C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_bullets.gif C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\js\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-full.png C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\af.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\calendar_double.png C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\stop_collection_data.gif C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0164153.JPG C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\spacebackupicons.jpg C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_Medium.jpg C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\bandwidth.png C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0179963.JPG C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\WB00760L.GIF C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\css\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\en-US\js\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD10358_.GIF C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\circle_glass_Thumbnail.bmp C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099187.JPG C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD10307_.GIF C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\mn\LC_MESSAGES\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationRight_SelectionSubpicture.png C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\settings.html C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\btn_search_down.png C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\da.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\button_right_mouseover.png C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Common Files\System\msadc\it-IT\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\weather.html C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Title_select-highlight.png C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMain.wmv C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\31.png C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0145361.JPG C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15136_.GIF C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BrightOrange\button.gif C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\fr-FR\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToNotesBackground_PAL.wmv C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\drag.png C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\css\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsVersion1Warning.htm C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\PROOF\1033\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\images\rings-desk.png C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_left_disabled.png C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SceneButtonInset_Alpha1.png C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Desert\TAB_ON.GIF C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\winsxs\amd64_microsoft-windows-l..store-mof.resources_31bf3856ad364e35_6.1.7601.17514_es-es_e291103c53f9f2be\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_prngt004.inf_31bf3856ad364e35_6.1.7600.16385_none_a0b67189fe7a0ea1\Amd64\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\msil_microsoft.build.tasks.v3.5.resources_b03f5f7f11d50a3a_6.1.7600.16385_fr-fr_fd1b140d611031a5\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-l..-startere.resources_31bf3856ad364e35_6.1.7600.16385_de-de_6e51ec0f0869faf1\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\assembly\GAC_MSIL\System.DirectoryServices.resources\2.0.0.0_ja_b03f5f7f11d50a3a\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_fi-fi_79b34814f7ded8e5\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_6.1.7600.16385_none_cd2006602e5ee22e\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-d..cache-adm.resources_31bf3856ad364e35_6.1.7600.16385_it-it_353035dcaca59fb1\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_c1daf2c27a3d980d\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-nap-oobsha.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_8b0871790ad64eb0\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-s..foldersui.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b6b4ebe95ded7990\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.InteropServices.RuntimeInformation\v4.0_4.0.0.0__b03f5f7f11d50a3a\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_cpu.inf.resources_31bf3856ad364e35_6.1.7600.16385_it-it_dff2343f29171339\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-s..-vbscript.resources_31bf3856ad364e35_6.1.7600.16385_en-us_6bd0dc3389c765b1\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-wmpdui.resources_31bf3856ad364e35_6.1.7600.16385_en-us_d5915994377e8d86\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\wow64_microsoft-windows-htmlhelp.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_4a682ad78c5fa6ab\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-dskquota.resources_31bf3856ad364e35_6.1.7600.16385_it-it_8d85d3818b1a2c5f\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-s..structure.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_4158a5ce8ac997b9\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-m..ado15-rll.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_5b53683a963b4de7\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-m..plication.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_c02af1904fdcfa8b\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-r..iagnostic.resources_31bf3856ad364e35_6.1.7600.16385_en-us_8a371f8237ce9694\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_netirda.inf.resources_31bf3856ad364e35_6.1.7600.16385_es-es_7586b7be75c2a908\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\msil_microsoft.powershel..hicalhost.resources_31bf3856ad364e35_6.1.7601.17514_fr-fr_ecc5634fdd6d44e7\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-autofmt.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_b6e4abd54d6f16e2\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-i..egacyshim.resources_31bf3856ad364e35_6.1.7600.16385_en-us_234a859d7a661989\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_de-de_0f8ccf36b90bab3b\404-1.htm C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-onlineidcpl.resources_31bf3856ad364e35_6.1.7600.16385_en-us_de0838fde8c16c11\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_4c778c357864a2ed\about_operators.help.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-w..smenttool.resources_31bf3856ad364e35_6.1.7600.16385_de-de_4bb5103fa57f7d1f\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\assembly\GAC_MSIL\System.Web.Mobile.resources\2.0.0.0_fr_b03f5f7f11d50a3a\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\wow64_microsoft-windows-tpm-tbs-core_31bf3856ad364e35_6.1.7600.16385_none_4a6c7430e132459d\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-wimgapi.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_bbb0bd0d14cecc41\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-h..atement_r.resources_31bf3856ad364e35_6.1.7601.17514_en-us_b558e03eab75aa2b\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-ie-ratings.resources_31bf3856ad364e35_8.0.7600.16385_es-es_d037c2581aa0b073\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-wmpnss-service_31bf3856ad364e35_6.1.7601.17514_none_61acd141e5332baf\wmpnss_bw32.jpg C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-d..-charcodedictionary_31bf3856ad364e35_6.1.7600.16385_none_293725055a086a08\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Net.Http\62765bb26133f581e10bb7c866f35c83\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-s..cy-engine.resources_31bf3856ad364e35_6.1.7600.16385_es-es_c56c480796d9c091\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\inf\ASP.NET_4.0.30319\0008\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-p..tcpmondll.resources_31bf3856ad364e35_6.1.7600.16385_de-de_d2162bc9b4f4fa29\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-setupcl.resources_31bf3856ad364e35_6.1.7600.16385_es-es_f60f2fdd00cfdcbd\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-gadgets-clock_31bf3856ad364e35_6.1.7600.16385_none_3342e6899aa0557f\settings_box_bottom.png C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-gadgets-clock_31bf3856ad364e35_6.1.7600.16385_none_3342e6899aa0557f\square_h.png C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-ieframe.resources_31bf3856ad364e35_8.0.7600.16385_fr-fr_a8f853f2515a5e13\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-o..c-style-performance_31bf3856ad364e35_6.1.7600.16385_none_1d8aecb671a2bda5\720x480blacksquare.png C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\assembly\GAC_MSIL\MMCEx\3.0.0.0__31bf3856ad364e35\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_display.inf.resources_31bf3856ad364e35_6.1.7600.16385_es-es_8b846aed56c71c55\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_smartcrd.inf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_55890a4fef2f563a\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\wow64_microsoft-windows-fax-common.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_dec8a5df4207c2ce\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-t..clientsku.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_18333c0ff974d327\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_prnlx008.inf.resources_31bf3856ad364e35_6.1.7600.16385_de-de_9e27b1ff9581e77d\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\winsxs\x86_microsoft-windows-gadgets-rssfeedsgadget_31bf3856ad364e35_6.1.7600.16385_none_ab6782291b0ca7be\rss_headline_glow_flyout.png C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\x86_netfx35linq-msbuild_targetfiles_31bf3856ad364e35_6.1.7600.16385_none_12aa611e8a576b93\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-d..se-biogeodictionary_31bf3856ad364e35_6.1.7600.16385_none_3de1f44b11cbe448\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-m..ttheme-us-component_31bf3856ad364e35_6.1.7601.17514_none_b52573ad8e4c2d89\US-wp5.jpg C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_c02a16e1ae17ab94\about_functions.help.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-m..onwizardapplication_31bf3856ad364e35_6.1.7601.17514_none_22f5c6aadf559287\AppInstalled.gif C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_es-es_27c74b34efa6572d\about_remote_FAQ.help.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-a..apc-layer.resources_31bf3856ad364e35_6.1.7600.16385_es-es_21b6e6d65bd4c9c3\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-fax-common.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_48268639435a097a\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-help-secpriv.resources_31bf3856ad364e35_6.1.7600.16385_de-de_a3e2ec1ba1461fb3\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\msil_ehitvmsmusic_31bf3856ad364e35_6.1.7600.16385_none_d3b7e6bffb753b92\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\wow64_microsoft-windows-r..comserver.resources_31bf3856ad364e35_6.1.7600.16385_es-es_40087fef6e827989\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-d..utoenroll.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_e9de2ba3782f87b7\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\RRAHKKYNJVTSHLG\shell C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\RRAHKKYNJVTSHLG\shell\open C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\RRAHKKYNJVTSHLG\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\RYiGElV1ZFlQ3US.exe" C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\RRAHKKYNJVTSHLG C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\RRAHKKYNJVTSHLG\DefaultIcon C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\RRAHKKYNJVTSHLG\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\RYiGElV1ZFlQ3US.exe,0" C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\RRAHKKYNJVTSHLG\shell\open\command C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.Bl9c98vcvv C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.Bl9c98vcvv\ = "RRAHKKYNJVTSHLG" C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\RRAHKKYNJVTSHLG\ = "CRYPTED!" C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe"

Network

N/A

Files

C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\HOW TO DECRYPT FILES.txt

MD5 88de38daafc64c8ec113507d490c9d7d
SHA1 a51b5c3ee4c306b1a3ec68c0cfaaf41bef29e1e4
SHA256 f78cde7119f31d0e3ba5aafd8b932c342f5e762c5f8a1a3c7b115133c1f9f1ec
SHA512 3e3b42d9c2b42a24fe753dd2e24df8405edcc0c89bdba78bd4e20e5f83faa372a23008d0e7f568f4210a4935a68a1a03eebeb4e30954e5cb56542016295ddb71

C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif

MD5 df04943e663f25cc1c915b6dcd28552f
SHA1 68cd5574c7e213f1ad89384d66fe673695eeaa01
SHA256 2caa4056f47fe5029b33a4bd71fd871b453a2d9a1f6bf54080bcf96a1628161e
SHA512 91848776349f491a40c3d906d60222d519a651be2e13686781ce186af0affd53cc06fb22e32d0f51e1d9dd02d1c5346cfd0c350711c2876af2412e9310102ab2

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html

MD5 3ae734077b18a8ddd1d80a9500c653f0
SHA1 8e84106f2126a7a4439090b73e5407cb3883db93
SHA256 4b6ce89363b1ec7a21b6eb1dfdf614accb44bf35b98f70f477a0411ed070686b
SHA512 540a19e0f225ec44683c06488e53e679c8cc7e368a97b5c23ecdbd0abd86500c2cd37fe37c5146de37760820821c0cf856ca21c6fd79d6c3086e70917eb44d89

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html

MD5 1796bbfa3b1c87c5028e6b5029f03675
SHA1 606d2d25f3ecf65951076c9de77bc6ea83e05bd5
SHA256 8f01ee0b137344ace9670b2cca619921480d87758a1a84c4b7bea3d409ccf204
SHA512 6ad2c93c9118759eea580d9243b4c1e441ffb0b1864e187f0b38b350e1034867c45f69f4b61bfa714906bb9f75c6ddd74048302da39bd68a845014a5f8f49162

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt

MD5 3d241c1f6c53320365ee2f4da16648f5
SHA1 89c112fc20f7a79df5ed54524b2135aef5429ca5
SHA256 72bc9858f046fb4f2c775a548918f5dfc9c5661059bdfa9219b4b4d5c10bb79b
SHA512 e59de06b1ed25f2d7b66baf63dc41f78a9adf6f858cfae2881424e0c853f308b291da0abf3f776cfee0b5783bc6f4e4d8d9fcf46eeac4280b3a03255942db393

C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt

MD5 06573512904de85494f3d731b967280f
SHA1 2f4c18c5afcdcf502b7be1e2a41bce2493f3087a
SHA256 26361b8196f8d1ae24f70cb63f46b53d3072b6dcd671bc2ee965f96d1bac22b4
SHA512 a32e8dcf2059eb7b36bd57a08c6595279d5021fffbcfb6ae377d52547711dced382e82b0054136b2d9ca26b03d55b329e0241998150ad3e9372dd605c41b1792

C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME.txt

MD5 7d35c42c103870664c1395937302ef85
SHA1 1a06c8c5a2f893edf2c8f6ad7bdd6ccd7b027f81
SHA256 91087c3c38ccd4bd98aa8de8e4e115bb8a3e27b1887958ce97c39dfbd864969b
SHA512 bfab1bf7680a55a93c204ba2268f88cf08a02aa59d513a63606fca99c554e440b35605c772272688401f17e86ec44cb5e842bec361735b3c67663c34d1271460

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_OFF.GIF

MD5 569ad6fbea02fda902db544bfe5b560c
SHA1 b9f7d07750c1514bd3a81e24d5e621b942c68795
SHA256 d03a917333f025405ea893296bf0ddbf1e61600cab48b9bfa53353548cdf811c
SHA512 b76a5d688a219dd563c3dab59e3b0b45315a19eb0e55ee4bf0c95287864978e40b90575e008a3f23fc6014894273bb0cfa728a14f6b2c800605d3900d6a2b079

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_ON.GIF

MD5 3cedc7540fa583e9f12a2cfa2e1ee434
SHA1 d318f6fa6db7837b9bd55962d24eea333bd12273
SHA256 7775255f9bc33571b3d4b4aa598b27938391a7ff334fe88e268cd7636ef8653e
SHA512 497dac219a581ffebc33af36864f323fa550e67c0b5c5fac835600ca5e4a5e6f56f2c1ebb5ec26b4b8413e2e72191faf7207c0ad712403b0edcd26169ee9ff73

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\BG_ADOBE.GIF

MD5 413f5698d7156e6e32a284ebe6e5ac3a
SHA1 8896785394896e21b46dda93f984660881cf491b
SHA256 962e28a7260f7d42b11fc8be92cf992d721addb7567f201b1154a2d123b51467
SHA512 04474fe2aae603b89e36e7e93ac3bf2580cbb80e74228439eac774114af20b4b1771f7c0d31fa2ec817fe355c7c9e6066903823e303dad1c2c4840c8f83db0e5

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Casual.gif

MD5 d117292646a12453e7b5582cc4a541ea
SHA1 d7ef02e44ce9ff4500ee8aff2173e34ff62e6a7a
SHA256 fbd8ec4929d82b0e7c6c581fa88a343028d988e94f9d6422f03b1f062535ae65
SHA512 8b6d21e86c55ca89a7e6f9ad4eead783528c4d4cb05c7b5a418fcfd99b7b095a5ca7e2af8522d5683abb88b18ddbf081887597e9a17352fdf2de68cdc150d699

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Country.gif

MD5 8aad792af7373ee17d92cdfd2d7a2ac1
SHA1 65661b9430a24792c8eaf561aea97f906579a88f
SHA256 2d969b3affb3a6551191abceacffd3adbaa713843e3eccfdce6a07b1993784fa
SHA512 8f797b4594f9b8c94b66286c0bf2583ffb3a390f061753820035c5ffdbefcc5bf04e8707938a9ce88ff601899671ea8edab005258e3802bb5fa1a3e37b20d19b

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Earthy.gif

MD5 f63b67c513817864ecd976a89e19fc99
SHA1 49e4847df6b91c47ea2d03872ff4713e951c2d9a
SHA256 89a05d288f89e82b79f64691aaf3d8fa8205cedd768b9b1904503c638323ff72
SHA512 c60cbf149c24b4766c6e06bf5b2e8ebcad3706a1ab255c668ad0d944f53492e609c0c87f4f2229255ea07c7c01fdb948387cdc7538fa8bf4e6fcb0f10ee62e27

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Groove.gif

MD5 f8b4416ac2848fe0262e5f4b989bf158
SHA1 d4d8d9b7e9b38edd990e3d6013d4c8aec5fd8068
SHA256 b4cf2ee8894287ba0f3da5a85247893e5519e2e3d977db3edc0c7f9c29bcd618
SHA512 c9ba07dafc1a9ea0604bd18d8ae195deec11eeb7398447fe137fa36785ea902631e641674370c53b4cc37d4e32d10c8d744f67a74795ddc5481778e9df4fe188

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_GreenTea.gif

MD5 7848bdf44fb668d78d19a4d3ff99948a
SHA1 69323c631a1187c24add7c3cfe259bf0b1f5b7d8
SHA256 abf988892540b7e9179da9f763464d12f65e24f3503cad35692d656896ceb5e5
SHA512 fd6b9daf56d3a5cef8a7f9803d345268dbd0588a6b3cae55e0750451daeaf47d52b0c5a41d828a124a940dff25db27b6fa2d07fde45da7a23cbfa3d0d05348b3

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_LightSpirit.gif

MD5 b89eeb5c362155dd26dcdacd12eaad5a
SHA1 bb5fdd503b81c24210827024085b029af5883213
SHA256 a0ab011d0e97f1da97658b8653620892a06c347d226de1abd88df75c1463cb1a
SHA512 6a9ac284f3122b2be257f22d3e3d4c863a7b1c4ce515a040e8078985967d63366e321a964e57fd3d7c2b51b36a36c1a8f2039e7c5864043623ddfae40e5fbef0

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_OliveGreen.gif

MD5 becb69d0debbd5cfeb4348432a3816f9
SHA1 43c10881308a29f33e28d806f4954fcb08c10200
SHA256 f44aea688e58a801f9c394c945d514d174529132a7a86fbbb5474c331faf7123
SHA512 aa936d041cd64e183abbb80214c362472ee379b8fd372a732fcff4d89502d398146bf37d665799acceafc8ba434e941248c2421a431225c2aa4dcfd2ccf5b202

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_SlateBlue.gif

MD5 e97f409fe50921ad87b82e5c877c705a
SHA1 415311d6ab339f272d2adfbb55408abfcdc68ef5
SHA256 a0ffbd052c685fcdf32375f68f4d99606d1edc910ddc693dfe2af5130452a633
SHA512 2c3157637c5610e97add6aea20f8e38da0cc6ac36df4084c5f6b51991e340d0ee31ec7426b897e9fd2d3208026686580b924d806f0f3f79548e108796b5cb319

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Premium.gif

MD5 6dfba97a2239211be4ce12311dbcb20a
SHA1 fb721cb7ff575a19def531dd08b9db8fd760763e
SHA256 eba9f474b3243e0309793f66cbf356e68640828ebbc7bf125a420813e16fd860
SHA512 e455f19ec41d2349646c2df21b09e657e36084cf230787cfbcd0ebe600e889bcf505af883795078520277c0ce2b1e099e22c54eea8c36c8edfb5f07331ee3a3c

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_TexturedBlue.gif

MD5 7e38398ce1f75907facf403527a5b342
SHA1 2c19cf32ac42b4a259fa7c47f412191f3554a481
SHA256 82d74d54fc3c2a0d40be21921f49d4e7b2a47c0f46e38d4fd77f3dff9a9bc5ab
SHA512 0dd4f7890384636ced706b3bea2f963b4a19ebec48ed7c0b33917d11e3802821538442aed25409823fc324a9de7c104088e96cb951cd39121c8ee5338d0ae689

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_VelvetRose.gif

MD5 e342d4765ea16cdc376a58a868745fc2
SHA1 4b50252df504aa51c8f5a3d713648619bd93e74e
SHA256 446e8c47cddcb93f79d1218a97e6b267050b86df8ae9a4565e6efb12711d6e14
SHA512 02a28490046b799bbdce3285894cc68f306616e5a97904ee304693748629eb9de6fedfcc868349a807d174a127a8ec9733b595d6d194a8deb163818a1752619c

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BabyBlue\BUTTON.GIF

MD5 434ee0ea5621a2d4e75750c75f288267
SHA1 8c1177427b634a8c94337377ae8f34d9cf125724
SHA256 cc57f6eab24b757da1bca26b58b93f3bf08c6e1d9fe91f269661ff228c3f195a
SHA512 9ceafd4a1f8cc39413dbb58fd823c3e003ffa2f7450beb5352a0f941efc6452e22a5c83dc6fcadebde8692b6fd7061764b669962214f8be128dbab07d775067a

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\TAB_OFF.GIF

MD5 7e029d065181cd5ce332445de3732ee4
SHA1 afc48efbf0344469c2e6b65029b2256771c496e9
SHA256 f0da052928ffaecf2eac9666e11692ade253cedddcb9c5a7df71f36888f19d44
SHA512 d094ea99e9880efe9f25ad2785611ec4b4ea954564871ca8d0000b0057b9690e309d9d24191d1351ea3fedacca7b1cda70205a13f070771684d4911bab61c379

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\TAB_ON.GIF

MD5 b6a2ee171339aacafbe7aa423568d15f
SHA1 51db6840c08f0dd702685068ca97cfe7ccc40e09
SHA256 35364a7f17794be0caf01c7ef54b2d237f3b6a1b3765ded6b8e32fb1a8fea9a9
SHA512 3d7daf38dea43cd09e0dc007e377c5be5a17ba5a6353e2156a7dbb422219abfd7b48aa95b1446a5c0c5f9608ccb4b4c091a77c35d0244ab52f6cccc7f84628b4

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\tab_on.gif

MD5 7f9e5d2e08644851da3a582230721799
SHA1 3c6f22e4bdf44ec9681faf81617d06dca8686146
SHA256 a615873fa51e849cf148ec7c36411a00a543e1fa2bece4f78c9555d3b8c79e1c
SHA512 c8f7ac5fc1005801b1a1ed24126226c12f527a7169ce14b252f2d94f0d6119fdb600be72a84972ccd0faf103add1522e08a498360b89fa440a576fa9724494e5

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\tab_off.gif

MD5 ed6b16a2d7c028702da21a075eeb4065
SHA1 7e3b98450fb95f470dca1c1a21937598d8e1afea
SHA256 caec3b77223d5e67dde35120ebfbe0ed823c16455eab8d772d74e8be86ef1b1a
SHA512 5765a71b05811175f9674e5ed99ef83fd040695a39f684de880d489f4d6d61ed25166ddcadb7dadb272916d074068cf26afcfea644c01f8b5f7ac9e173159b91

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrow.jpg

MD5 82310c2b6b582711cf32f43adf01df11
SHA1 3ccca099556a3ab2bacbfd7c987cfe92fdf09db2
SHA256 84309e7787cf809df432ce767ce8326cef6468eea45122cb9e90645d02f53618
SHA512 4e787bd3101f3588370392b5fc62e964fe0c65abe6d1fc85b5bb9fd7c7927bdee2416cf0eca41c0eeeb8e046b04974d8190e3b16ad326c04fca16beea3975486

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrowMask.bmp

MD5 4f1ea8c5cb8b63701a7c550fd0a2d641
SHA1 219d7747243b6e39ceeac99a4ca3f16b24a0c2cb
SHA256 6cb2c6fd69d641f6796cec6451cb2f634c2a6a6fb69d7e2f8dc7450bff740171
SHA512 1eba282d233ccddb7215b73abfa2c1971a82daca7d39994670fa0f988cf0a6d08541cdf5c9de7f58f58c8e22e195be803c9c35e15a8b181b329dff31c5be7755

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\attention.gif

MD5 8dd14b363a9de14862596b9ce71368e0
SHA1 45370b69844c3b5f048edaa3bdc255a118568524
SHA256 c3184b9717c980033f4d9438eaa7737d75d399fe9a8934eef2a443a647c7908f
SHA512 74cf54f63841fd810a6c5a9bfaa479f37f43179bb393bfc9cf1c44676f27483d26b4c68f78e223761c6020f16f745f2a020d08dd37bdea4c9217eddaa015674f

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_FormsHomePageBlank.gif

MD5 dc5a2dfa5a8ac342b19bda194e8737fa
SHA1 1e5c5c6b1e1208e93b680dd95c7a248fa93e233c
SHA256 fa4ca65120365f39240bbcfe857f6b5ae83f47b86260e43cf1929716449355e6
SHA512 d0b676973f11c17139fc294986c91894831496dbb4c18c29d8debb6e561ad05545ee6935b5d72325a773cfe19970f6996a9d8abf86972e15940f0cdace820c5a

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BabyBlue\HEADER.GIF

MD5 0a7cab8b4d1f9da2b8bb36befffd751a
SHA1 bc75498d72b6e3019f573ed26ad2bbf3e7d94e59
SHA256 084e2126815cc2e686b87f2da1731601106ed3a84d2955523496516b9e6eeff2
SHA512 cafdbe01802d61dff8d1be452541055476e3e2543d4b4e75b1964d93350d50dfaee81078095434b30abc0f9057600d581f97a04ca5872e5eb47f26ff3257e167

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightOrange\background.gif

MD5 64e4c9ea5fb23f06009aa5b16ca087fe
SHA1 2befd2dae6dfe6f2b53d6c949f75c7d93d28c509
SHA256 05ba7c709efd20351b792b216ccc88e7bca3a22432a2b04e4632c6459dac827a
SHA512 e7f5b5d35921247e20a84dbc2e0e7f20df2fad2b283b7982346a428702b4f3eac97b520f31e01491ba19574f174eaaba8a6eae684532a4a93a753d2495990b20

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightYellow\HEADER.GIF

MD5 ac6b94d770877ec5f57e1abac16a682a
SHA1 6b421c03ba819952c4d650ae3dc0dbf3dd057227
SHA256 650a913ef0a8e29160a443b128a1d77cd95742d19f15b53ea83783a5faeeb360
SHA512 bf476a191201a5835af60dbe7f9b7c60e219ab1129d10020759a4bcc95c9e66353a5592ddd213fecd13a3a8e3e08d8edd323a78c0e410a1ca9e85a6c5a7a3c36

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Desert\HEADER.GIF

MD5 2b29edd6506b9435d6b4af7476c94303
SHA1 27e6e37ee7559b5cd2e2c5b70fa4b4e45598d603
SHA256 2789bb4858a36c51d6759d2dd411821fdcccf3667c235b8eb6396e4b631f3c9b
SHA512 7eae5f9545f8c76c37724a7820ccd7d4e761279197ebabaeb078ec4a235730e1746af86ccb5dd07036af8889049122c09cd242bd700ef11ccdeb4443c4d44190

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\GrayCheck\HEADER.GIF

MD5 b3bf57d56e13eaec75043f1826276ead
SHA1 d58e7d4850ac3a1c9f265a97e6436339cfb94ef5
SHA256 0dfaf18a41e2c90de8c5204db06080ecb6c86f273d97890dc94a5e2bc4c9bee1
SHA512 27ff9dbcf01b6f3d04b78a5fd6378fe0d1d2b1c4aec9b280ec3794ae537425181fc8e1d12aa6ba0e01acd9d9ef895bf100f5a206912c1a1df30bbf1bb1c3b8b9

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\TAB_OFF.GIF

MD5 5065108a96e172bc58d5a4b24bcd323b
SHA1 c129ab1d48b024258e5fb6804c10510652dcc7e5
SHA256 cb2affb29f5f57a12478a60062cc12ba28d95b6655781bb11ca470ba58b137b3
SHA512 dd91d8de4784a66399fe05a49069ae4a29f81ef0fe901018d5dbd7fea0834df378dba5b3dc1b34d032770aaf8a67cf91310527d05c2c95dc3dcc07fa620903e6

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\TAB_ON.GIF

MD5 ecb89dd731d04c590242767099096a73
SHA1 66d44c139be116c4aaa486bbbd84f5ac3d1c9e42
SHA256 030c3618d3c1209e55d54188e39424513f574057eb51c9ae8a1a6fa4003ad4b4
SHA512 9fe32df7beb38ad8e4e4f889a44a1f3c3bd1d26547cd48c20145db7784d8ceabb6a6cde0da78d9645bbb9c1ce51021789db56dbfc161a432d088a8b070ab3bd1

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Oasis\HEADER.GIF

MD5 b97c027d670dac50ff38a6fd272d699c
SHA1 b2a3408cbe109a3386375a371ecd956f4898a970
SHA256 e5d19f9a22a5c55242e9111faeb692e3c094b86488244e503260f8d30bdeea3d
SHA512 9155ed41b28aae22af9fa7927a87aa041017ced319302c28c1793f556bd82ba4f52be767dcf0173afdbc49891e526f5e321c60640857242540ccf86a57375080

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\TAB_OFF.GIF

MD5 d016a26367b394e93b76957a8b28e5da
SHA1 8075286903afd86c97eea771fd53f8a1794e80e8
SHA256 dad6796d6408d4312d96f6cbd40565f9f3886c20d1c62593cb247409119eb15e
SHA512 2b6eaaa021957bef48d20c8fae086aa03df77ddf91dd161d744c107292c2b79592d400a94d64f526409c2e6969fd026a24199124ec2f331479217e338efed8f0

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\TAB_ON.GIF

MD5 9f244ba81e340d66127f3a4a07519b7c
SHA1 4656a5d4f7ebd4b05e5ea0cd7db8cbaab000bafb
SHA256 cba8950a0356ed7e2f026360a38faee13bf88d2c1244ceaa870573b4ee8886c6
SHA512 e6a728587456910eababba2eb1dd653ebf1bf6f67cc36898aface302a97058a9830d598550a5869dd3430eee74f8d9808030c7693810cf563cb6ca89e2ce59bb

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SoftBlue\background.gif

MD5 05055763f935cf9022cc828e886d1b37
SHA1 be8ac646f90c04a359306e303fdd916c3bc8733d
SHA256 46e5348391bfcdffa4ea87886f4995d78ee15b351798138d57c892afd0f243a1
SHA512 63d0bfe32aca403a2e818ba66881179253accad04497967dbb060d01b7099cf3ba9b68fd1d956f34ca0df51c7075ec94184685919d0f62cc4b62d9dc679ceb85

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SpringGreen\BUTTON.GIF

MD5 6fe334b032c45292ea4b278f082a1fc3
SHA1 d5cba29ca26e54d9a7471d13575a5a98e7bb9e77
SHA256 e93c2e049a011de6c8eb05dafb8782559a7021fa85d5a0eef0a7ffa14ef1b7ea
SHA512 ef2634860e55bf704b9aa5eec61323129d7ea20767bb27b4b91fdd10e2a877e4612bc6c59f5c11c3b2d7456160fa9b2e5e7b6a05f72dab8041e3d47986f5de7c

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\background.gif

MD5 4ddcb9ceb0422700f279f7a6b1a24489
SHA1 76006db0ba40b28a68d934f3239273ca9ba19730
SHA256 01cce9d875687d0965e12ad61b5c9ee699b716823f2b138c5fa838d8a8849718
SHA512 b15cc91d1acc87320eb0d2ba28f8b7399d2030184e98c7dee56035372baa06f68faff78b60b3191dac78041823050cacd5f601d816c7369ec8f542a26bac0542

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl\background.gif

MD5 d2a8c97ca2d2c4c4d11ec45ad9cdd162
SHA1 d1864e46f6fa62cf19a5b72701a4999e36a71c23
SHA256 920f90f0f6e45bf2a079af8797a5f01763d041a705de4d47d2deea274f820ba8
SHA512 d37b65b00e480b28260d7cca0d39b0a293cbeab9d7f190bb8c4034656fcfbed4919cc92c7a4adee0a98a4213c77efb62f86031b0490eae5f803bc245f32a9cff

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormToolImages.jpg

MD5 37febaa62b7bedfca2f7f6824d8816b5
SHA1 66020c80a557cd954138856ea8e28e804de63407
SHA256 8fdaf011d7ae41f012680db4a45c563e99e6eb7707872a26602f0250b49bb47d
SHA512 97295d53b936954f1ab956bde8c08112e393cc363c605d5206a291e8e00ebd8913aadffa9426171a59298f919ced69197d07ccde4d8d7d198ec93cbac730c79b

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\RTF_BOLD.GIF

MD5 f109f35c72d658e5e8419128a642dc9f
SHA1 dab7dbff1c12e8dbdbfcad60939d4bb07c237c88
SHA256 4cbdbd14d5692e0d2e764e5d86287fe67291fdf8c7bffecc19b2aca58f16a216
SHA512 9c8dee71579cb8f5c7a00b0ea5e40c3565e8213c009683105a9c02fef1ce73627d479ab9f350ffccea17439f6e6ef878c89f9ada8253a509575fbb0285fad0d5

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_choosefont.gif

MD5 2b3a351fc1ef8d22c6c479ead02a52c9
SHA1 b0e41a386a39b25e958fa39cf82905877c0b43bb
SHA256 8d7fcff9f9d7cbdb8d8cadebb352fb393df46ed7763cbefb11b9003be9070552
SHA512 16fec2a6249aca41a265be066ca018ab2a1aecdc431d77c22868ff889855b74f0627d184ad3df2108aac21e6ef216819d224a46df42f6e3e3855aa646f8c223d

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_italic.gif

MD5 067138b7f15b3c53d2b9ec736836ad9e
SHA1 85620c9203ed84975a6e82a47584b6d89850f635
SHA256 ea551a7e47b2e92fe16e1b6e05a014c47a4a5aa94ae7d876b00a7bbbe0a7cbe8
SHA512 bd418b50235591597e1af6fa179b3f56be9ecc00cfcaf95f114a089fab8c3f368fe317fc915339dfbcd0482fe595c9120dea02848c2e6a10e07518c5459ae661

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_underline.gif

MD5 729eefa7f3c9df72ab8789eb26746cf4
SHA1 7196ca78919f5e9cbecb64d37a6cd0274b85784c
SHA256 3a42b4da4dfc773e9ff718c9f56ac47afb199ac7144bc5c4b18d72a8b6adce2e
SHA512 e85aec599cab2b79a919e009904ee1dc9e380955a0fd92d458cab26693adc839e216e717a5b6ac92b5fee9834e55484aa7e0eb4ee4b289c1af877eb0c6a73980

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\ViewHeaderPreview.jpg

MD5 67d2cab16794af766d73720d37706ff5
SHA1 e2d0b02fd00391e7092fe7b9a1a374adba299769
SHA256 b55be416bd431358ee3bb090602b2fb165eb3a7d8e6b29116c6269ce99a2cac2
SHA512 c5768be778634b7b7b6382e3d29b5662da6b2c32a0370c36f2b5cd0c3dda120c2d79e4e2e450cd96127c020c9d7be572935a0f023409d39892cb27e944cf5131

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\ADD.GIF

MD5 3e65edcfffd8b441d446ef9f36f16e07
SHA1 de6d4b69d38dc7930160bd305af3c40250b0cfa9
SHA256 d7f52e2d9b644bf5ddfe71895ec2b95b85e4d3bef426732e8c5e965cb26f9681
SHA512 6a34640d07229ef00865a398d524a40adf8a4dd8e6cdf73ab0f0558cd8936b021b66b63c9aab955ecafef618a5d211201606583b0c673f1efbd479a8fec149bc

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\CALENDAR.GIF

MD5 7ffcd7c88241805145b673f1e526c5b3
SHA1 6b72a498a4652f1018368b778537f778a59e3224
SHA256 50a5af23fc23222216cad62a468403e541de6fcb1e76083ab29bdfe332656da7
SHA512 2ba30519937941dcd8a0001261d6775edeb57a8c35dd09c72a3a424c6e7b90acb89c132e09fdae9f1c00fcc728cb545c13f0fa37a9ef6e45708337ad88bc0991

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\DELETE.GIF

MD5 e2b360b774cebda8933a8ecd2d1565ee
SHA1 2c9b0c94143b0d4208b5deb3f2138e0dd9ee4034
SHA256 277290a5c358446b8a3ce2a6bc49afa1140ebbd68105d5b6a9bec1e389f31330
SHA512 93aaf67a5387b89794e1240a860c94443e4f23ba4adb8936429c499d345806bb8b400f1c8d9b769c563f8b3197d8f6db580e78efa09d221bdbdc70fb41d843cc

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\ERROR.GIF

MD5 1131d847dbdcc6399ce2cad9f9433d83
SHA1 3cf6395104b2b81a3c0f05f4f9d7cc89a6024bdc
SHA256 1a4f999bc43204e837f62700a44fb7b3f1028c84feb075199984c068660da047
SHA512 45afa4809d9ff89b968e3474981249f4df511935a39af53658ef3b3fae9125530f6522acb96bdaf082fa85f76378891f01e78d5807e6aa939a44173edd9efc72

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIconsMask.bmp

MD5 42ea7c2d80bec8f2f0aec12d4c9f7123
SHA1 e7f713d5295f16fc4092628987019f132e1ffa3b
SHA256 1300c1deeba7598355f15c8dbf772681cf0b39db1a50c3c856ed3523825a61a2
SHA512 1f711613ab90dd88fba19fd9b5a5cbab0f9c6577c4dcd193027e47e861baf288c2afd822d0ffa6c6b2544f1c7f030ea721a65e77e7b0f05d877b2c5639c17df9

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIcons.jpg

MD5 4316e34986c15229a1e0d47aee37a3d2
SHA1 3c31a79bfabff07e7e4288960530f8255babd9ab
SHA256 ee0c2b31b15d682b4513808ba85489954d5f2c050d2cf08e2a0b38af0dcd0968
SHA512 43d9fcec25fe8462cd62ed6bf4511c22f989ed132064767477dc7bb2da91d554ae8f0f21fdcc59eefee0025c9362e6a85e1fcdd422dfea43f11a76f77761abac

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\LAUNCH.GIF

MD5 6026500b980644fb2ddd4759066f7235
SHA1 d0798c5324a45f3631279b0ef16a82bd5f2b5c49
SHA256 f75e56447f1e7eb82d6ba2c9d871c59dabcd28131b7920d17a63c3e31caec2ff
SHA512 d4eb7a75220c842aafed03a0f432194c7a959d367b7abe2f6ad1acfd6211e9b97bd9abb82c30aa75b65813285f3d763a169249dfac6fb5e8cdeaf260d05f493a

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignleft.gif

MD5 53cf053a784ec5d84956451fdbcd8572
SHA1 32e32cd92beb21246452e905a263bdd1c2616795
SHA256 abe7964debeadc49e74ac5cb8a419d63c11a0fc63fb5680c2a3cb32048b50a17
SHA512 c9839a6406697ab6433dd69d9ad9e04e819b935563b06de8d21b04e8d0ea82476dfd2a07c58618ab2585df65bbdd5578eb364de7875a5962d7b98d038815f2f5

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignright.gif

MD5 c6059bd4a2858783915f34ddcce4b357
SHA1 2f94eeefe095132784b1f0bea8eebc0fa6341f97
SHA256 2db2eae502223835ab9eb915a04c1d1dc22a79220006f6ecd67db04ee3dd4d8a
SHA512 746c7babfca5e6471d1b7cdcd79f25101b08d36a2e88bbc9b221fef7f0dc2425d1d58b2a137f943d00ddd371dd2aa18abb409908bf93ab15536ea57f8d2dcca6

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_bullets.gif

MD5 d045c84721790c42c37d84d486d2cf44
SHA1 fc4b5a554cd8714b3a8b55cabab2246ba609980f
SHA256 64254363e7bcd2c930bab64db2d7821f74d118bce7aab0ceed7af881c488f4f3
SHA512 b7a63165aa5e5ecec9252f5cd58f6c061a2336e2676eaf63d04ad17341ed5a07a5cc3d0824b1250ab9a473286de9f3bb5b59e8ffb06af384a5cf7a95663e4ca1

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_center.gif

MD5 fa254aae7d255330ae97025f6c052fbb
SHA1 16fc8cc9d9e4f6e4734193867a769bc7123366b9
SHA256 afa30e372b2961b31c6395dee4ce44e5bd4f2fd2f2bbd59e4cae6a63ee269590
SHA512 1f88a1571dfba579319d1e1bb249bfce14654c69dc3d624a52ffbf4020e78ca92970f45243329510fe61f5b39283297b6482661ec2c51f3a58a1df4fb15c872e

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_increaseindent.gif

MD5 4a05e7d775ff5f5b6c259b63c9e1d415
SHA1 8c96a18d3f9b67e18aaf651b11283ea9fd3b8e57
SHA256 c013fab02c16dcb090406c3b4fda2f3edf9804939f6a5aba97b8654a749115e9
SHA512 fb1601b1f9e02845ccbbc3dc6b9688438a099dfa2365ecfc1fe1f7bde3d41066c53b29e2e72cbe0d7557e8dbbb23f1641c3debc29bc59670b0da7f68122086e0

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_decreaseindent.gif

MD5 d873c6acdc5c1a2df5dff8366643d782
SHA1 cc17640c1a471925f09b543974680f9cf4e33dcb
SHA256 e4822a1444cfccba8c69803eacc82d2aa2fdf032467b18a97798e9df78763680
SHA512 5e9746e5b689ee6b2695d846197630f5072b4b97ac6aad033bdc1329f220f403156a7f06dda0e5da75fcd0cde272d7a4019828e36cb6402131a4482c746e490d

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_justify.gif

MD5 8179db4bba39485b6249cc57062ced40
SHA1 37a3778094b2f4691919736398d47b34e7ffcd2f
SHA256 3756e5e9718048ba93b27d68c766369d2416744f07416dde964710176af2c9dc
SHA512 4928dfd5caa46d217ac394953e19f6e69d6209ea0d8911999c997b683a2bd732f3423802c1cce6ddf694387c41bca59c8ef8356fa4f869881990dc320245503f

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_pressed.gif

MD5 64ec82436e45ef578009261bc50f147f
SHA1 5fd2c67fa09b94556700afc8316a87c6a7b5b83b
SHA256 41ef262e05a87d415c32792c8774d80bd993c3ffb6a9f3334b475abf6974d01a
SHA512 2e9a1ebb32c2f9bf2f673085181aa288c27c9fff22f4437082ff978e5b855cdd06e63d07253cc5e7568ac9fa2531fb401265294d00986f33e5b7296326755352

C:\Users\Admin\Documents\CloseDismount.xlsx

MD5 1c402ac137d1d50d00c471144ddd606b
SHA1 548f246d6f85746f3fa260d2cae98417cd401641
SHA256 ee4a1780c827e5ae06c5a333c628db6a205706f40344220ef874cfaefb696b62
SHA512 4718980aed13ef6aa5d947cb48f9d696d9571696cf130fd9a7460313921f4ebcd2303b1312fa65c633485e9da2f727f8293b195819c31fe5963f49b08268ea75

C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Windows Explorer.lnk

MD5 1aca0497707a207899dd7804984ce7ee
SHA1 46459d1c10cb6ebbadcac503b575d3574a43d3f9
SHA256 dda265ae389433e5113a1e07b1993f698372e9e8ddb9b02237c47994354b7ed0
SHA512 fbaf4c3f78ce13da90113d46af7485e37cf050b09d9770abe11ee41685e10553dd8930e64f5d10a225445a3b92084fbb994e72dc974284a26cccb3ab7e48b9b5

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\alert_lrg.gif

MD5 fc18677ca4043b0d8a93d01d39063887
SHA1 3bbe3183e7c766be774f40c61f42ec19880cef4f
SHA256 e27925ab98cb485a948fdcca19a5916815874769b5af5d3d254b7085c9581835
SHA512 73a4a24ffe48796d3db3ac761770fd81af89492bfd6e10e3b7a19838f9ae8f9da7c45902a350e8d83c55d8dad441a398a61b9b361785f37f0cbe896fe619c0bd

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\aspx_file.gif

MD5 b95280dc2d0f115eea4d02e5b67c3ed3
SHA1 bcf7fcaacb4ea2dbaf5f20f425fc2c58e0964d59
SHA256 382f29a58f6673297b2578cbd4aec4b7b6f225af83f74faaf5983334a651f97d
SHA512 ed98534e020ff950e56fb9074b8145a158d180fc9b46c1bd3ab27981ebfb8d5a84e805602c7cf409f963c9851421c88ea4277a07310b429ec0b7f360bc4008d6

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg

MD5 5f66b98035345c741845d4df520ebee6
SHA1 c73371a35aefc26303b7a7e7be729714a5f5d1e9
SHA256 23476dc0cd1f84e63d058d48011f5a38cf490600f188cf030609780e28c75c65
SHA512 8c224f8cd32a0befc6bca9e8ac1b84dd13956998c1b188c70739c8a4eb326a51d3ace66fc508722978cbd59eb8631a23dc5a11c06328e576762c8c110fa784d5

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\deselectedTab_1x1.gif

MD5 b40036cff7a236be3c05c4ced98134fb
SHA1 d7156ce9dbe28ef15470d0ae556d9bb1c8706fcc
SHA256 ff193e5888d94c897d36f0132433d46619a75c2d8b652b8cac61dc1919aceda6
SHA512 f22b2956d7093b5e61eee47f75a27f52fc0f0963ad8786e24dae878969684aa6d15d5a39d042c2960b2a41f28c3581e57f043e43d926476cccb9136599b0f46b

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg

MD5 0305f3935eb97f0e28576793fed2a454
SHA1 b6f32c3487aaa7bdd975fffdd7c97963c28b3e44
SHA256 0bc62c17bbf1aee86137cd8d36804b3f2985240c91fcdae942f1a51dae696f95
SHA512 b63c28fbca595ccaf7ba1a0462624970c214742ba60892c9c64674d6c6728398ef92a480a2d7e41b6fdaf9138574247caea959c006fe71e4a7466429d4b80a29

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\branding_Full2.gif

MD5 a084499c4b14d106dc6ae542a55148e0
SHA1 817f92e0ad9704a62385b2737829fb86c2e123f0
SHA256 7ced6b3f05d22fb22e7a2c96df13d9e1f7d2297961a55dcd49205f43aef2f17e
SHA512 b5e42547152eb17e3dd60a10d04bcb8bbd9bcd96c9c02baf741aaba29b8990d7e0f0fa7738c7294cd0d19ccaacde66adf3ed1cc8ad74ee6c9930a01183e25e88

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\headerGRADIENT_Tall.gif

MD5 8961e7d295079a3da8de9c5aa4a819ba
SHA1 934731afc0065c164ab45335f216790b0ab119b0
SHA256 c5240b6a850c5116fc7806e010930a63fa28f629ca363868dcad746dcc3c10ed
SHA512 562b630c5d6df67711413001b6824a7a4bf8205a8b4e0562f249bbe02ca3eb170a9c75e4fd74cf1ab129d8942329a38b142f605d9f7a54fb7b07b3961068eb74

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\gradient_onWhite.gif

MD5 7d79542dbeafaa523f55e565365e65d2
SHA1 448c53227bd2a68744801f4861dac88d58be27b3
SHA256 f87964bb48f948ed7fc49858a39a17ae0c7a8b55b0a4cc0037ec6f6b4d5ea335
SHA512 f0203bb57c1c36852b7ceb90c28310de4448a004b1ed784d37ab05f7e18886ece077886b50c6f7c2f250c0196df8cea92c3e84e577bc43bb494b121d2ba25795

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\gradient_onBlue.gif

MD5 757b8dd52893816d18acd53747bfb0bc
SHA1 bac3e7b9b85b233e713b8dfbc5c3ad45c6d99d2c
SHA256 ef562177487f2e8375c153bda7afd567272aa3892b8db33ad6da1f1ec581eb6b
SHA512 874700a1a4f8fc5a88209a9778bc2e0594742db9d88638b72228f75c01f6aad723568b3e59da8175253052d2cb9534a0f94689e02758598bb94c943fc3011a33

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\folder.gif

MD5 537383f503195b2885e38cea448ed5f7
SHA1 73bad596c39249e5aceab4cc66ddf5c7e116858b
SHA256 28ca666cbdea89bd23c1262dfb262f6b171a462c50b4b6a2864a34a9f6124f29
SHA512 8f39e25c5df04854a73f9c3625ecd06a17a3ec1c83a905a91af7d9ec3be20e61febaf1243f59b67d98bb32af4a9bf0186ed9788e4ee12cf8f2405dcb82775fbd

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\help.jpg

MD5 4bd333d90abaa611759c63702460a97e
SHA1 1bc0aa55c84b4cec249011659d1dd378e8827224
SHA256 09a860d631b024dff2ee0286417757f888a21115221c1c7fa8b31cf22b0449e3
SHA512 40968cc945139f23e587c8b7990f036d3f61e385bd2eab1d8580ec4125ff30d2889dd5e45b8ad5df9c567e778b8d8d34e6b78d66dbf6b8050cbd9922bf08c439

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\selectedTab_rightCorner.gif

MD5 26b44f78f18fc0b219e29871667efde5
SHA1 74746f735cfaa9c2b9e217821dc61a5ec0000433
SHA256 2f40ad49d115567740919bfe99eb0e179d68ee53628b3aabcce265c355cffe53
SHA512 83eea8ab21a74333dbb2a5871ebcc45f4acaf21c3a1bb4ab3c5d5cc8888ba52fa08a131a123e3091e72160dff7ea51f3e66b76362ae268658123f20bff4eed3a

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\selectedTab_leftCorner.gif

MD5 e14c7cadfd93f3f1c3aeca220474adfd
SHA1 1d043b314289718d395f86016f5a56898b95b7b3
SHA256 854a3d06095ceb965d0fd3c2b275e4b84cedc05f93c3abedcbbcf2afcf0c1348
SHA512 a7633878c664da07c7bef1293e4ebfd185a1f4acdecf5ebc49b0a3ab103da16980427e17026920a5c3435c6793e02a32f358e99df14fb45ded2d0ca3edb5043d

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\requiredBang.gif

MD5 c0a36b230311e53a684d35670a60d347
SHA1 3aef9426ceb9e6d32110a87e1a34382df520da4d
SHA256 b882c41e9a17264effae0a81103677a351248c3d9c9687b8f33b832428caaafb
SHA512 cf3124b8e9a6e5f75a861522e47d56e21b07007e1819a8874938e0a6f2503478eae00cfb512d5a13977ba6136c61b5fcf00bb099751d130162d8a23a6b235be2

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\image2.gif

MD5 642a4f7bda16af066f503a5f102088dd
SHA1 e1536dfdfe9d1e6ed495d04ecdd3e9d1ba4dabc5
SHA256 478ae124c83ab5d9dcef2f90606e7f5614f1a72ac3509221ee456d6b38e47465
SHA512 078b0be1ee69cbcf320200640d8c66f2776e6065a866789ca7610f577df49748487ae0edd695820cddc22b8c79ef50fa57ef4f2fd4d4320e770716a2e2b8c880

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\image1.gif

MD5 65ad39bf7b613ed2991b768c5a53a6bb
SHA1 f74e404612b32cef39de33727652708873d825ef
SHA256 7bff5df8f5c5e87bc4e4a9cee04de9d14c3e9e23b0f60563f2352a38c39b01ed
SHA512 18f22e62d8c7fe432aac8e26609c125ce5eba94889c8cf581311dccd7caa2f73d35f6825b39c05f16e131fd771d645eb79c06f4c279a4f0f51231567abf46ff3

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\HelpIcon_solid.gif

MD5 88c97f9ae243554565e8def5cab285c8
SHA1 d30a0eabb88af9ff4cd3554072675965b094304b
SHA256 f675696fdc11ddc4a99fc45c82b70665def2cd9eb47feca3372ea36679d3253c
SHA512 d5a0bc47578f6d5df36654f33d3df293e52f1c6312583a273ff1746176a4507ba5cb4e0e7c237ab19ae2d0d8215c47907e2763422d42e52b35b1b9a52eef474a

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\unSelectedTab_rightCorner.gif

MD5 feb5b28daa7551890e6a6397b7e93bde
SHA1 a7b20c3fb24cd64ecca2a4a1f43f4bcb184e8abf
SHA256 39772bc872af06c80efd8cc80a0023a02fa2a8532a9bd392b503501550e44918
SHA512 f35366347505f6fc856e61d2457ae63da08444ad0fc6f8d6ee0f21acca80f0abbf8d88147d18d6ed6138aa69cb7d001e7076fde0457a99b372d06a27cb2b654e

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\unSelectedTab_leftCorner.gif

MD5 69212e15dc2754acfb98f4fa6939a194
SHA1 4c4cac7d83176f40c2cee3dad96a41e7d306fdd8
SHA256 3528ecd2134a99c8ed567453257ea29504f1b96744546c339f622abf855b8074
SHA512 b4900e2c21dba35f5f4d3eeb5deaea4b2e7256b6cf84f2ebd34cc7fec19499dfe64f69002ebf970b7103d591aeec469be22d7970934892dcaf936c63618a640a

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg

MD5 ebf4afc630984bee8d56d68a63ca540b
SHA1 f415d41514c38f3bb1581c43f3ff5bc275870590
SHA256 b1eaf5fc907db4aee35549cac6866755cd51610a463abec89b4c62d2d781f760
SHA512 f63a802ce39e4a25e1cff9de9212cd546df38c5d9f35ed69cc9025175c782546c3f0ccf4b8506a3d8e400f7e9f6a6a3990d7f6ae10d4b9a72ee862790b31d6f7

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\yellowCORNER.gif

MD5 3d8afe0e5ee0a2e3eca1f1ba36736578
SHA1 a2189ca542eef367336ef3fe6637c093f7f64a2d
SHA256 92d74e36a166d280fc2df176b0cbe38cac3346f84324df00922aa099d26d126f
SHA512 94db04e298ef1e796f793d2ee30dcd6baef04b4ec5a540ed2a23c5ca83c6f7ddf794f5aaf6d55a943de3d21e55bb3ff84e6bbaacda994cd14150c85f056088ad

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-07 06:56

Reported

2024-10-07 06:58

Platform

win10v2004-20240802-en

Max time kernel

95s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe"

Signatures

Renames multiple (2186) files with added filename extension

ransomware

Drops file in Drivers directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\drivers\uk-UA\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\drivers\de-DE\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\drivers\en-US\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\drivers\fr-FR\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\drivers\gmreadme.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\drivers\ja-JP\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\drivers\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\drivers\es-ES\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\drivers\it-IT\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\RYiGElV1ZFlQ3US.exe" C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\System32\DriverStore\FileRepository\unknown.inf_amd64_b8b0fe7bbc76405b\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\InstallShield\setupdir\0804\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\Nui\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\setup\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_UserResource\es-ES\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_UserResource\ja-JP\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mgtdyn.inf_amd64_a6235e923dc4047c\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\microsoft_bluetooth_hfp_hf.inf_amd64_0c00f8f3a465c9a4\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmcxpv6.inf_amd64_46a3b42507e9d29e\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmgl009.inf_amd64_3bab34655afeb7e4\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmjf56e.inf_amd64_07bca0bfd5173050\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\msmouse.inf_amd64_1793a485b491b199\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\netloop.inf_amd64_762588e32974f9e8\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_PackageResource\de-DE\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\Configuration\Schema\MSFT_FileDirectoryConfiguration\fr-FR\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\image.inf_amd64_d2006c0517ddc60c\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\InstallShield\setupdir\0007\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCClassResources\WindowsPackageCab\uk-UA\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\prnms012.inf_amd64_707d3849370b9d23\Amd64\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\tsprint.inf_amd64_6066bc96a5f28b44\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\ntprint.inf_amd64_c62e9f8067f98247\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\it-IT\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\c_securitydevices.inf_amd64_f10a5650b96630b9\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmags64.inf_amd64_767b2d723d0fe83b\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\ipmidrv.inf_amd64_ddb154dfd1a1c33d\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\prnge001.inf_amd64_1daeee8f3aa30fcb\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\en\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\IME\IMEKR\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\migration\de-DE\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\de-DE\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\Configuration\BaseRegistration\fr-FR\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\c_volsnap.inf_amd64_47e3741bbf4d6b06\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\usb.inf_amd64_683fd853c8b8a4db\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\Speech\Engines\SR\fr-FR\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmc26a.inf_amd64_dd85a83bc442ed33\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmminij.inf_amd64_a85c8e1fe15a9532\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\@AudioToastIcon.png C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\netrasa.inf_amd64_1bdf7a435cb3580d\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\hiddigi.inf_amd64_dde7255b040ac897\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\prnms002.inf_amd64_2176cc45624119a9\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ServiceResource\it-IT\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_UserResource\it-IT\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\winrm\0409\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\@WirelessDisplayToast.png C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\de-DE\Licenses\_Default\Professional\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmiodat.inf_amd64_95e01117eb9c1bd2\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmtdkj5.inf_amd64_6f327fe9ac4fdb28\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmtdkj6.inf_amd64_5a503c811e650e70\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\netr7364.inf_amd64_310ee0bc0af86ba3\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\nettcpip.inf_amd64_96215b82eaa40fd5\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\prnms004.inf_amd64_c28ee88ec1bd4178\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\bthspp.inf_amd64_bdb56f181ef6934c\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\eaphost.inf_amd64_d37080dfb66d830b\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_RoleResource\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\en-US\Licenses\_Default\Professional\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\fr-FR\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\virtualdisplayadapter.inf_amd64_bcc7550a6e285f92\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\ws3cap.inf_amd64_6cf8ea2249844b50\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Archive\de-DE\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\XPSViewer\it-IT\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\Configuration\BaseRegistration\es-ES\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmaiwat.inf_amd64_3bb2e5702f25a518\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmnttd6.inf_amd64_28e2bee7229aaf9f\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-20_altform-fullcolor.png C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraSmallTile.contrast-white_scale-100.png C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-40.png C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\AppPackageBadgeLogo.scale-100_contrast-white.png C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-96_altform-unplated_contrast-black.png C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.scale-150_contrast-white.png C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\themes\dark\AddressBook2x.png C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\ClientLangPack2019_eula.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\StoreMedTile.scale-100.png C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\lv-LV\View3d\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\RTL\contrast-black\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\icons.png C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\210x173\19.jpg C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\EmptyView-Dark.scale-400.png C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\themes\dark\sat_logo.png C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\MixedRealityPortalMedTile.scale-100_contrast-black.png C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Microsoft.UI.Xaml\Assets\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BLUEPRNT\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\WideTile.scale-125_contrast-white.png C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsSoundRecorder_10.1906.1972.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\VoiceRecorderWideTile.contrast-white_scale-200.png C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\check-mark-1x.png C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Program Files\Microsoft Office\Office16\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\MEDIA\ARROW.WAV C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Filters\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\ScreenSketchSquare310x310Logo.scale-100_contrast-white.png C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\Standard.targetsize-16_contrast-black.png C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\ImmersiveControl_Button_Click_Sound.wav C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Thumbnails\Sticker_Icon_TeethSmile.png C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\8041_48x48x32.png C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-white\WideTile.scale-100_contrast-white.png C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\uk-ua\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\CancelFluent.White.png C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\ja\LC_MESSAGES\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\423x173\32.jpg C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\MusicStoreLogo.scale-100_contrast-white.png C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-black\PeopleMedTile.scale-200.png C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-24_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailAppList.scale-150.png C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailMediumTile.scale-150.png C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\LiveTiles\avatar310x150.png C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\hi_contrast\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\MEDIA\BOMB.WAV C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-16_contrast-black.png C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteNotebookSmallTile.scale-150.png C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-30_altform-unplated_contrast-black.png C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\LinkedInboxWideTile.scale-100.png C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\StoreAppList.targetsize-256.png C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\ko\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\LargeTile.scale-400.png C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\MixedRealityPortalAppList.targetsize-36_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Transit\contrast-black\WideTile.scale-200.png C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\pl-pl\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\server_ok.gif C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\201.png C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-100_kzf8qxf38zg5c\Assets\Images\SkypeAppList.scale-100.png C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Collections\contrast-white\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\Dynamic.pdf C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-64_contrast-white.png C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-36_contrast-black.png C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubMedTile.scale-100_contrast-high.png C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\WinSxS\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.19041.1_da-dk_c6bdf9af39b53c71\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-microsoftedge_31bf3856ad364e35_10.0.19041.264_none_ef195f564f00d259\MicrosoftEdgeSquare44x44.targetsize-96_contrast-black.png C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-programs-adm.resources_31bf3856ad364e35_10.0.19041.1_it-it_7601663311181957\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\msil_servicemodelreg.resources_b03f5f7f11d50a3a_10.0.19041.1_it-it_8f5e7c3a4729c03e\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-s..-credprov.resources_31bf3856ad364e35_10.0.19041.1_it-it_63bd30014e962b7d\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\msil_microsoft.virtualiz..anagement.resources_31bf3856ad364e35_10.0.19041.1_es-es_9699788651ee4192\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\2 - Search.lnk C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\fr-FR\assets\ErrorPages\forbidframingedge.htm C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_10.0.19041.906_hu-hu_b30e0faea5f58f4e\f\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft.visualbasic.compatibility_b03f5f7f11d50a3a_4.0.15805.0_none_486a35ec8062581d\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_dual_c_receiptprinter.inf_31bf3856ad364e35_10.0.19041.1_none_9395b3e23533c747\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-autochk.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_2e4f5d594e323b83\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-m..agnostics.resources_31bf3856ad364e35_10.0.19041.1_es-es_e2d407b3504fb761\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-p..dlinetool.resources_31bf3856ad364e35_10.0.19041.1_en-us_523f85cfbbcf9ba8\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-powershell-exe_31bf3856ad364e35_10.0.19041.546_none_470f45b46101edfb\r\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-csrss.resources_31bf3856ad364e35_10.0.19041.1_en-us_9ad6c2ecb52ee77b\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SrpUxSnapIn.resources\v4.0_10.0.0.0_en_31bf3856ad364e35\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-i..-nlsbuild.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_cf02eb2420511d8f\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-iis-legacysnapin_31bf3856ad364e35_10.0.19041.906_none_5f45625010b4cd19\IIS6 Manager.lnk C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.423_none_9de80b9d881a1ebd\previewTabIcon.png C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Xml.ReaderWriter\v4.0_4.0.0.0__b03f5f7f11d50a3a\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-c...appxmain.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_fbfcf54bdfd614fe\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework.resources\v4.0_4.0.0.0_fr_31bf3856ad364e35\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SystemApps\Microsoft.Windows.CallingShellApp_cw5n1h2txyewy\Assets\square150x150logo.scale-200.png C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-v..edstorage.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_30efe7fb9fc513fc\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-quickassist_31bf3856ad364e35_10.0.19041.1266_none_72c6a00123f43c47\f\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-graphicscapture_31bf3856ad364e35_10.0.19041.488_none_4c6be18809eafacf\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-authorizationmanagerui_31bf3856ad364e35_10.0.19041.746_none_0a27ebbb92d57ff6\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-advapi32_31bf3856ad364e35_10.0.19041.1052_none_58231fde3ba3571c\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..l.desktop.searchapp_31bf3856ad364e35_10.0.19041.1_none_37a8fc596f462cbc\3.html C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-portabledevices-winrt_31bf3856ad364e35_10.0.19041.746_none_a2de9eddb7b517d7\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-graphics-dispbroker_31bf3856ad364e35_10.0.19041.1_none_2de17f6415b06654\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-explorerframe_31bf3856ad364e35_10.0.19041.1023_none_41a96a435d5614dd\f\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-sendmail.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_523b4df349069c27\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\assembly\GAC_MSIL\System.Data.Services.Design.Resources\3.5.0.0_es_b77a5c561934e089\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-deploymentcsps_31bf3856ad364e35_10.0.19041.746_none_4c096bd75d4397f3\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-eventcollector_31bf3856ad364e35_10.0.19041.662_none_d8ed4acdd3960fad\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-ie-runtimeutilities_31bf3856ad364e35_11.0.19041.1266_none_0a763c249f8ae050\r\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SystemApps\microsoft.windows.narratorquickstart_8wekyb3d8bbwe\assets\NarratorUWPStoreLogo.scale-125.png C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-defaultdevicemanager_31bf3856ad364e35_10.0.19041.1_none_16831bad73fad121\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\x86_microsoft-windows-b..onment-dvd-etfsboot_31bf3856ad364e35_10.0.19041.1_none_dc4e5ab15169832e\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-g..linetools.resources_31bf3856ad364e35_10.0.19041.117_en-us_722d861e05188bb1\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_dual_bth.inf_31bf3856ad364e35_10.0.19041.1202_none_cefdd1e9348cdbd9\f\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-0000041d_31bf3856ad364e35_10.0.19041.1_none_b3d10930f50b408b\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\msil_microsoft.web.manag..iisclient.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_d2fa36005d227269\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-n..agerdesktopprovider_31bf3856ad364e35_10.0.19041.746_none_1ae2e5bd00736b2e\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.423_none_9de80b9d881a1ebd\memoryAnalyzer.html C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-s..-credprov.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_d3f9eefeec7e49f4\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft.windows.winhttpcom_31bf3856ad364e35_5.1.19041.1151_none_86a7242c685a6e10\r\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-printing-wsdahost_31bf3856ad364e35_10.0.19041.1_none_bd3ab63067b3989f\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-e..atibility.resources_31bf3856ad364e35_10.0.19041.1_es-es_3bdabac823ecaa6d\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-n..orkcenter.resources_31bf3856ad364e35_10.0.19041.1_en-us_691a5550ab496ddb\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-a..encontent-component_31bf3856ad364e35_10.0.19041.746_none_9d6a15cc08b26e02\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.ppt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.DataVisualization\v4.0_4.0.0.0__31bf3856ad364e35\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-d..tion-mgmt.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_c26f2b2c4036a894\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-winre-grouppolicy_31bf3856ad364e35_10.0.19041.1_none_0dd2ee2658054302\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-wmi-stdprov-provider_31bf3856ad364e35_10.0.19041.1_none_fed416f69a4d9e16\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_64\Policy.1.0.Microsoft.Interop.Security.AzRoles\v4.0_10.0.19041.1__31bf3856ad364e35\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-eventviewer.resources_31bf3856ad364e35_10.0.19041.1_en-us_da9719030926a2b0\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-g..licy-admin-scrptadm_31bf3856ad364e35_10.0.19041.572_none_af3e65d3c3bcb920\f\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-i..ntrolpanel.appxmain_31bf3856ad364e35_10.0.19041.1_none_d0af17ec366548f3\wide.AppsRtl.png C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_windows-defender-group-policy_31bf3856ad364e35_10.0.19041.1023_none_8f2ec9f1354c97d7\f\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.Bl9c98vcvv C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\RRAHKKYNJVTSHLG\DefaultIcon C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\RRAHKKYNJVTSHLG\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\RYiGElV1ZFlQ3US.exe,0" C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\RRAHKKYNJVTSHLG\shell\open C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.Bl9c98vcvv\ = "RRAHKKYNJVTSHLG" C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\RRAHKKYNJVTSHLG C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\RRAHKKYNJVTSHLG\ = "CRYPTED!" C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\RRAHKKYNJVTSHLG\shell\open\command C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\RRAHKKYNJVTSHLG\shell C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\RRAHKKYNJVTSHLG\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\RYiGElV1ZFlQ3US.exe" C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\1c18a0f35e1eb39e130eeeb12163701d_JaffaCakes118.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 98.117.19.2.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp

Files

C:\Program Files\7-Zip\Lang\HOW TO DECRYPT FILES.txt

MD5 88de38daafc64c8ec113507d490c9d7d
SHA1 a51b5c3ee4c306b1a3ec68c0cfaaf41bef29e1e4
SHA256 f78cde7119f31d0e3ba5aafd8b932c342f5e762c5f8a1a3c7b115133c1f9f1ec
SHA512 3e3b42d9c2b42a24fe753dd2e24df8405edcc0c89bdba78bd4e20e5f83faa372a23008d0e7f568f4210a4935a68a1a03eebeb4e30954e5cb56542016295ddb71

C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif

MD5 df04943e663f25cc1c915b6dcd28552f
SHA1 68cd5574c7e213f1ad89384d66fe673695eeaa01
SHA256 2caa4056f47fe5029b33a4bd71fd871b453a2d9a1f6bf54080bcf96a1628161e
SHA512 91848776349f491a40c3d906d60222d519a651be2e13686781ce186af0affd53cc06fb22e32d0f51e1d9dd02d1c5346cfd0c350711c2876af2412e9310102ab2

C:\Program Files\Java\jre-1.8\legal\javafx\glib.md

MD5 c506394aedbb4c2068ac6f4ad1b96f05
SHA1 29c7098dd7179ec409121f6bdcf9304196b878ae
SHA256 dcec6e866d227872a0b3e14ec4eed9b2f9928fa38a1d4ab56f7ca1923c3ff928
SHA512 c42f8dc299fca268db5c9594959a5dad2338e91c46f41b53f710c08d59fc07b05a081b497e9f2c8f99ec64b7707a0d32e922894d0aeb8bc403b846829d976774

C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md

MD5 97d87f55b2d6d5c6ded5a16c09c86935
SHA1 631791c8a530b52a40b9b79333847c1cc87bbf72
SHA256 a7b8da6fb34a9c91bc4bc2d921c205dc4142ac7cbcf0e96845a7f8db4d4a7e1c
SHA512 265acfbfddd051e016e78e88df6aadea461aa041ba6da7abfc2eebef9d04af4d9d0e53cace0d9b77981bde7617e74bafb180ec6134c3be388a775d39254fc0eb

C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md

MD5 b09d99087c8a0506f1e03630c508041d
SHA1 2ad0ccac35ad29546bc1f9cb84c03241344b1919
SHA256 a20734a7d3353e640c2595ccced9e7a368304e8546c5583d8414967e3d75dafe
SHA512 c2da83c3de16f42c49394f6ed5a4f3784b879d8268b774b7bc6b6d7c779345fb06eafab4921340c72aff5fa4b525c1f40fb6c5e432f6172fd4aa8915cf57223b

C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md

MD5 0c469dffa8dd91a4731f9e432422a30a
SHA1 794c2e24e4b8cb6e88d69dd2ee1763a3f1d0001a
SHA256 aca7cb2fab20d35a1526819727fcb5278d73804bbf11bde250ea1fbba8d5746f
SHA512 7182d9a84d7f047dafe18e351528ccc9103ee89579f2b2cf852b846647faa7af9eed574a6679bd8b183b447b592bfe80086ab2ae91920bf7f6538d216a4a7bd8

C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md

MD5 ddee5bb4b029a3707d4dbccc8891e191
SHA1 3949771bb968f9de173ce21a1199e15af194121a
SHA256 32c6f5196ec41158416cb657a6f9314d9e725c1349e543e7b93b5199cee17e45
SHA512 0d7128d7b455ae1270d996dc1a96e1254b8b737f907a91a1f035239703f8b7519a6c786770624cce56a14d30e1faf71edebeaed7b98cb14b12cc27e42932d68a

C:\Program Files\Java\jre-1.8\legal\jdk\asm.md

MD5 cd2ccf48cac19a208890c7b429dcda40
SHA1 08b7769c82a4338805aecf36b8e7872ef460c31e
SHA256 daa85217c7ba56311f05ed93de1fd6b8fafa0be2e21ba724b452f231e27282d9
SHA512 76a3c728f053d8cbd62ed4826442f60dc3a68a8e45c0b3fee1ebc5758b39436c3181c24d4edf06363056a4762c33ea46c3f624e8eb8d21d155e3c02ccb19d4a2

C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md

MD5 13c51a249e1306c6ca1fb9bfd16727f7
SHA1 405e8c58a7e8c04c201bb4bf1ef05cd793b807f6
SHA256 3b8cffcdf724a37d45104f03620f2a74549b5bfabf7d6f51f1d1e33d2876aa31
SHA512 6c015667822063473f31467b9a592b2f002928f1d28a600ef810f76a4424b9cf354d3c8e9f736080cbe489e1b96a4aec33da04b6aeff5413c7b06612ce4b07c6

C:\Program Files\Java\jre-1.8\legal\javafx\public_suffix.md

MD5 8e9125f72a052a3952464486af6920bf
SHA1 db75c3313fbe1d51fd0a0b966e6cca6aed4204db
SHA256 f6863d4de54e6642e4c974024faa45843284f9d2e4470220c88e74fdec283f90
SHA512 1a7eb5ff830e3bfc2b2bf8c9f8524ea315cd753eb99fbbb99370f1284d416a266990eb32392bfb7b6ce73a7e84d8cfa9783ab3f60ac24e26388899efade44aba

C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md

MD5 8359950229b3853bd3cc45a915b24462
SHA1 00eb57ef52dbf4091685253d628bf0030f067dc7
SHA256 ffdd6a2dfdf1c161f53a76cfd157c870339cfe258279d1feaed5054e5a41deb9
SHA512 d6ce19dbecdf9190dbc731e41c406b8e668c4bff23fe0ee0db5e3c4ceb0199032527b5bea42695f1cdb8286c6f87468a21c6588486d6ea67e45c56963f9f8e06

C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md

MD5 7264c3d087e1c02bdb140de3562f99ea
SHA1 fbeb6bf206a0e62807a78907a1d3fd89c5372201
SHA256 669ede48203cc301d423ece2e14be218c8dc8384a8b0966a1fe104c64f3152ff
SHA512 1987274d72b510e96eac58d061bcb8f681a60478e67dea9e5cc787e7e35688c8bfb48fc91f88c659b096ae99f8e9a7a00290cf3451e1ca6d39fba8e30619ccf7

C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md

MD5 109e4d7fdce991ffe6c4b04bcdea95c2
SHA1 4d98c0722f6375adb698cd662eb924a3f2cdf44d
SHA256 9d5fedb35e80f2ac0422ebcedd0414b5cce118a2457bf1b5dd53b6d952b200cd
SHA512 5a85be5c14aca73bd44999e5d76b5b4b712ac4bbdb0d6cbc7c5b2d396e326aa2e33405993dcf74df1e85d0739e360880c280b0b50d15c6b5b66e4bbaa4a85ed0

C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md

MD5 ab6381b2667ba0be9c72f1fe558a2e71
SHA1 ee079e669121030e9de81801edff83a01ec2ae6e
SHA256 710f22bb1dc120d1a7c068e178e9ebb806cd748fbd3bacac72e1596784bcb9f3
SHA512 536b5075990ea37a0339eac8cbc57df32388e50b5005e02cabeeb2b414b3b8e7f1243b93563120e0ff29fb7e69145f2ef07f2bc88eb5277e68d062c353225ea7

C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md

MD5 61eeb9425b7da188366e6a25013fc819
SHA1 32cef8f25adc39e46817dc9ce4c426548aece121
SHA256 650dc8a4cfe7c66e66fbfa202f742fb3bb1986a70ce4432c140f878b2b4eb700
SHA512 1faf17a9ce674fa28c3c73345f810f1bf5115820885773d2ac068481e77426ff305be9f93a9694b3ef97edfb9ca948896a161e1d4f43464624cdf1d38160b74a

C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md

MD5 446f8f0cd049abf36e00561937e57bf3
SHA1 7837fa3ccc557de9e13f46d9b3c4dbec7003fb45
SHA256 b941b3801e657183e1895d7e517e5978d6f018ec23de41171c50735e04ed8858
SHA512 359c1339b554dfb5961fa1a45fd923ab1d2060c9176669893839d7ffbe71d70332dba4e8e2e94ed2fb296eeb4c36301586d396672bc4f163d3d2887d19dccc57

C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md

MD5 072e9b31236e3c2fe9bed0de50dad181
SHA1 3962b7d9a9bc8c78d97c04bbd887814af2d0e573
SHA256 3d4ac1b376eb57fec46f1042c1122bd8270e4b76701c0c3910559a32561c4373
SHA512 c7e1d7970a5a1f4779d7d7a7ce3456ba22abcb8ab8bd7369c56a4abb76c76b018f21df1c75a923e853bd005a09b4d6cbf8f1ea24457941526c764be38f71a181

C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md

MD5 e4b47d9b53deb0db4670190dda796963
SHA1 597128e9d45f4211c789299b8b562da953cf09f7
SHA256 a479fa4fe62472c2e95e3670deeacfd9dd9842ba383498ae1cfe176196d810eb
SHA512 4a99c6ac8b9dbe22850a1612fb28a5d31551ed17cc206325e016d9bcb0241cbf98143470909c77862fbccd0d0f654885d5ec8a937dfebd46862ac6554fd915ae

C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md

MD5 1fbfbbce09e5254aa05732984fad179d
SHA1 a4a0f532078b2631a645b105cacd54757f017527
SHA256 deacc20f2314a3ab9032062a5ea61edec8369eab729d74d05dd33d72955bb90d
SHA512 5fc00d038f2750d57d264bcd31f2f8dc1db5973f34c899f2e5551da42de3c02d69af5b4dd90e9a28711ff56d09b5a728f082996663f263ffaee2458d9c3978ea

C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md

MD5 2555dbb6231633b8f7ca97657bcd2b65
SHA1 2834e993363d1779d78eba5c27060b82c7c6d901
SHA256 566b4a5b052a165dc53943b7eb7af75a07c8354e3b25445917993b2b1187c333
SHA512 91ad29bbff0c454d72325269a6ac202e9f07093b15d0f1f973c6d7913dde3090e787dd9c0e6d2adcb21687bd5fecd4b3bc89f0170d3afec43b9380b80874fde4

C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md

MD5 241d0eb25a46fc38ebc5581c2313b0d8
SHA1 b5186b75d266787f288c1dce705b19ffe38db782
SHA256 8aa154ca7a28878f6f540db3500137125db881f4deb2610056e17bcc6931e1e3
SHA512 640ec9c8259e883c26ac4dc50deea04f0c1bf77a8577af74f7bca04a1898e276f06b08f71e8e98ab29ccedaa0dd1d98fc18a1bea8d8b3614583a9ab7189ffacb

C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md

MD5 a9b6c48bae0c259911f4b6091a303f08
SHA1 c6f078da9a2ce4c925ab82df25a138a66bf1fdf3
SHA256 877423dcbfc11cdcb79622410310e8c2bf66b992abce6076fcf18e6f4f933a95
SHA512 7f72b74ff6f005c31924136103bc210426564073dd6c4608d580fc5bf0dfdfa1d82207cd429e3f75517fa2f6cc267a18240b452a8e88d515790323c4dc9afb8d

C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md

MD5 d1102344d3a60c2ab9ba689b9a79abe5
SHA1 b3cb2a9b2383e9d34c3fe311902db84c8481add1
SHA256 92900fa2ef628cf034d0e59239178afea0108faf3e6722581dd0b41dc3afa262
SHA512 2a98d5b31f157b7d51276acf4cac802c4e81a7200c2075044704f040e2dab5464c8cad6be8cea3ebdda88877563a37b96d6750293e52dda1ae481d9a24b6b870

C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md

MD5 0a7f909d86e7328c3fb70d5d54554933
SHA1 7c55da98c2ef080c70d2710aa7ee75f5048eebb9
SHA256 6630761bf06f687bb70566f5ea39cda90295ddb69f4d29c8aec77984ec34a47d
SHA512 896a4ec9b6ee951321400b65fca0e9f28d89634114048708f3a881e42816d410bd46f0381d4e09dcff47323a5aab64e6aeea20c86d05ed6bfdffdc73dce23726

C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md

MD5 13205677879cc2248b73a4ed5fee007c
SHA1 b2618c1deaa5b7cae42209774ab1352ffabcd528
SHA256 234e049bddd3848cc5d05e96d1619ce0e8eeb28d48bc604a2758f9b9807f25f4
SHA512 42a31f174b66155fa6842e36582695c7663ea25bcd7de4a946d21d4c431945fb067f6c507160b71e51df5c67f95264c53cabce889e8312f9a1072086a75c2a00

C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md

MD5 88de0e272b0893cb60099d2491dde72b
SHA1 a355b577820fe87bcaca929580debf56deaaa786
SHA256 7eb6384ca6ea387153c70e15c6ce479230cc2ce382ed6163638d539bcb63b36c
SHA512 d6c3800708e815915894db2ff0249bbb105c2eacc0eb689c940fde3e7c4fe84368c75a648a748e68b7ecd16fac488d60842920ff6b98bf0dd68b505c4079fd74

C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md

MD5 a69da3806b4fa2185243fc44c18b9aab
SHA1 1e75aa466a0d9de1783e8de22c9815b20d3b81d8
SHA256 70e75e57bc8278154be88994cbd8ba48bf73d6aebb546a300789da29905c048c
SHA512 f3d7c454d6ffd3f3260b243ca843896bfd6389b784c6a20ba9a4660ad8c4b394dbb9f9df6c8df70e353761b7f36a640bc46eadf62fe1b4baba189abdfc2c7b0b

C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md

MD5 0d7563b7dc7e7819c9962ba4876489cb
SHA1 3a3144bcd4473665b9c72d43a2034739ea0ec588
SHA256 1aa2da4eea2b4ed42587281de716e6f63a2a4abc639da53732b0d76733216196
SHA512 ee831a5100ebd9af7ab3938084ab5ad2b3557b8bc18c97c7144af5dcecd2923c2d795bb4c49bc71b5996b319e652ba40051562773c9baed0232918b5fca81bb9

C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md

MD5 900bb89adcad51c72fbf6a076dded38b
SHA1 da02d88beb476a59c5d09a167999abb1fcf07937
SHA256 509dd41d23d930da87931717cc4921fd7f86d782ed7a4762c3c814ca5b04bc8a
SHA512 f32ac3e72f46290954534b05d0601bd48b429288f9387315eceba88e12c8a69c4f8f0637c7db295e4992d82ebad1e98be6817620ac2a7b00c22ddc7231c63d39

C:\Program Files\Java\jre-1.8\legal\jdk\libpng.md

MD5 59c73f0010c59694440fc0e94986df6b
SHA1 63f6d5bba8d6b578f829d4cf754dd6aaf7c3da03
SHA256 5ed182c941ffb756004f64109f4d56ddb3ceef7dd9533fef0f97df6f7a916cc5
SHA512 8934016adae4bf7a938a0e55b25f73b1d6e25b76766e76f4a86331c6490a2be847d5361aaa0ef3b4d0cc17f558a458ec6bc07f84d7a7f3069e21e340df3b09be

C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md

MD5 88b248e3daef6babae0d34c3417a2590
SHA1 2ac170b6fc62273642672ca7ff8ac12b9d04f7ad
SHA256 64dc9d7ef8c8ff93fc9db7f4e2704ab3c6b78c17d771e70aceb5b15311741b9d
SHA512 3cda46f255a49f9d6b1a45dd9197484da356dd097907beaeb95ee5469e6e35d0a90fb2e0d5cb1adbfb49340dddda337bde8e298df72df28e0b9c1859cc0d036a

C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md

MD5 397ab2a42f5699acc89aec8873f27f21
SHA1 1d126a2acb0bfaa5c0e32ce02da86d28ed733ab8
SHA256 cc2cddb4432ac25ff8a92e38fd0381ea3c77f617df7599cc74ede0339db533b3
SHA512 8fcc4d601cbd47300e03d01d426fe7e47389312a1d8afdeb7b055c15cc7cd19b147f225b64774c0a3a1fbccd2f7ce3fe03f35a2942c66dc6d4e85f4ea226386b

C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md

MD5 82f5a14e31aaed8bab7043b02cd556a6
SHA1 2432d1735452e6c88dea8b870fc9775ede34d3fb
SHA256 d1a69d907f16e97ddbddfa71051afaeefac6a94a11474b0a29a7f4baf32af32e
SHA512 f1303ebc7e39d6a67064b643c5e8bdc3ebb9243f4168762bef872454ab8a34c53a33f9b2ba81a45ff7658137056afdc21f956a4d0ab0c28d21ebc3c9bbf471da

C:\Program Files\Java\jre-1.8\legal\jdk\joni.md

MD5 80ce78edf607dbb0cf9b2186252954f7
SHA1 974700382e5240c6b01118cbf1c64f515ac7591a
SHA256 b1df93e630ff77523949b590a9e7c793bc143af893fe0dfcd52bad4c9201b54f
SHA512 ebbec40176bbbad00112bb2587ab38c15426c4509bee414835338e99e2704896467304be9f68ebd0183ab6055dafc50d0bd78fea1bd12d5cdfb37912db9f9b3e

C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md

MD5 7914f5a3c97ac0cdeb8047d156668937
SHA1 216bd5237a08bc335d7c99b3c50f8d14dfa3dfec
SHA256 8169402cbbf7236b7d9008795cb54e4c9c983aaab98db700d72e2520fdd31c67
SHA512 b083178dbffa1f74fd27cb7ce3e74de04ff3c048314f0db0373621e1f97d4d6e741bdcdac45473de569c64606cf4408cd63caa348eeae4808de2fb264e4ed301

C:\Program Files\Java\jre-1.8\legal\jdk\icu.md

MD5 9c49b7b88e681453e8f708dfebec6568
SHA1 b52ec3e72b57ee50ac54b30cf0ebdf50204e9175
SHA256 2e94763f1d844bb5a46aacc8a7d5b8f91f7448a57774267c0cec78596727d558
SHA512 ae15ff0da59411c20c640afcbc9186328361b6b9e9fb856aff75f12f055ec287a1cbbbba8af2e3dcee3675d2b84694b706fd5b9a2a93287eb8bfbf5df7fd1573

C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md

MD5 7a78299612fe1d798e7b6e5b04d15813
SHA1 f6d09e18dae81c77dd7c1e706f2556d1fca39169
SHA256 2cc9813576b7b030afb995365276b348e7821fe3efa0be062df5ac8a82023ab5
SHA512 4efbb3f19e72caa16d6b3b437a08d2c4611418388f86c0e14dedeaefb44b8ec6f16cfecc0f1b3fcf328cc058b01d45e1cc4e8d4acb1944f61f143dfdf906b3f8

C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md

MD5 4e46459eeab4d44a8065c5e72fbdca57
SHA1 4e1b983d64807a9f4dcdd15ed5507a2071e8f953
SHA256 66abb187e2f4b5a8dde1326519656d0992ebe84566e57dc75cc971cbf2f5e8bb
SHA512 737c55a17f4f64fe47e92165d09ab75687277e632ba57d86a0567b62a472540f26eaab76f0f45ac30f71e76e0c1637fc85c190357d0b345a99ee6515a00ecf04

C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md

MD5 4b8a38dafb7b3c02683f1fa2cc46fb97
SHA1 fd7b23de46567320637ad1c349dbf171a9ded05e
SHA256 1f3e77e735027a67b85eaafef6a8bc698ee9956aa24b43368729626df0b6cfbc
SHA512 cd07a07a4bd0f13715381a0286cf8bc880351d9a261c78baebca101cda2d740a210013c943dbdae60f83e8e9467cf9813cffae643305ce5a6c370f696bed42ad

C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md

MD5 fd5ae1f8b08dbeff61f4cabc7a9b217e
SHA1 be3190f827191cc8bdfc7f58ea2f46a0dff2f9bd
SHA256 f7e25852970b00e611fa561eaf21176664aba5ec6b1f8c3d405d46c0cc2f1ddf
SHA512 e91cc39b687347bd9c7bc86e15a7132bea9481fc4a20232d05351d164d8c0ddc8f105c3345c87482d929423cd18d3b9dcac84a11116dc02391edb129636640b8

C:\Program Files\Java\jre-1.8\legal\jdk\dom.md

MD5 223d588731b97cdb7969e9a66010c9e0
SHA1 def3a8dbfcc2f5e4c21eb02f90c12d135029a914
SHA256 097e05e8018cea5f74b00ccd635147d1198617b180930a98a896cad38e73092e
SHA512 65e08fdc27ce22acc7b3f2b4e24b4349bbcf13577c1ed4228836a1416fba00193adf8ec71dfd2172f084339c313a56799f4c6a768ab5f42dfce1e342377a7e44

C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md

MD5 eb63c2a8f753b444e57935c099c81f8c
SHA1 0f4d66dabcaa468dca3a20c22abab4d259ed106d
SHA256 928a3c6cf008cd29f24af76c4dcea256c838c8ff38d9a70ed4db4362efa32536
SHA512 3fae00a98664bba955d8f2d6e0cb925fefe9a512abb8f6fb75785b53b4d159b7a332b908fbb50815827f38294016f56fd4d67c9ec65d40abb566add9338af503

C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md

MD5 8906814dcbd0dfcda614e5abcd93294b
SHA1 a196e033b222f448a8a9f4a4059262a9477815b6
SHA256 a14df0c1ed66dd5d65feda216af7b95020de6433bde20014adac4163470f5805
SHA512 74c12c2ddba1d171d2ef26284970c46590c7ea85ff0676dc03f8f885e2f0b483c43adeaf8c805b83df43054d4a34a4d61eb1f97c6c993efd4c0628bcebeee659

C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt

MD5 dfac3205258ab328e13625fe28206073
SHA1 ddb0075ce6525e502fdfc591c90aa7325a2ec31f
SHA256 511556b7766434e063f40e8fb5a095d8a902dc64d2300a1c9a5657d5b194f311
SHA512 af38cdd645c5237fe7c7a7006ba3ae310346f026b8510ce119c463a57e62dc98c6493a46e2efca82f2a605c773657442d5fe2c5b2962faa4c368ab1f76651483

C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt

MD5 bb2efe53f68427734b852a88cc0189f6
SHA1 4fd906236a5347cb14ac79d85824e9d0c4c60cd3
SHA256 5f9bbb4760e5cd5f36a80c8b1671f0cb03a9da18ee68298f8c4d1766c9a91103
SHA512 7e7f2f77f0089bf3c06ef39f41fba78e3a9c555d779d95cc8cb97d0fc3344eac9193d79acf99d31591b4c2876c82dadf6531737f0f3942568280dd0e051a39ed

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\aic_file_icons.png

MD5 c486e67e0e5e0731b50428dc7c562622
SHA1 c0152b8be06bf23903fefe9a9a475f6533beffef
SHA256 6ed87a04178a934bb6e314dffcec82aa1872338896aebccd027d0a4366bab842
SHA512 d84002f942262580a2ad48ba986780855a132fe2bc749ce8033db42d71c75b1de114c0038999b500ae455fcbb5b54eb0e0f00c884727b68c5b0c8bacc381dbe9

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions.png

MD5 9690520836bba662205baa7c9bab8a1f
SHA1 4b22f810e1b1a36c9de26c74f3d9145d6616c4f2
SHA256 9f40a8c1ec36cc82022443f680207524c839f979cbcd9c01f8802ac69ef22f93
SHA512 ea6fbb7202c5abcf9bf9ad0e3832277ebb8da270de4ba05fff90033fc9ee51eb6cd6afffe10556f4b60fb2841015758ab792e2c5b9e6b52e7bd6dc7d6b3b2701

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions2x.png

MD5 da29106db8c8034e72fcbd83474ce080
SHA1 507ccc49c420370a5fc50817fec14bddc58da812
SHA256 3c97229963014bcf65c481b4e07baead91ba21a770978f95e405e246d6e09041
SHA512 d15eaa55fa2e182e153d53136f5c7e7d7e5b5a1ac74ebad900569537315b1c6d0f8c40c1ce29dc18edd7dc28bb205fb95894bef0f636d3eaaaca344aa6a4e5f8

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons2x.png

MD5 2d352ad0eb2cb368b975f153e35659ff
SHA1 eb6ec680c9673163db31345fda0df24a21c3d37a
SHA256 d1919ed2861e781e94c344896d741690c7667802cc6d8d3084aa2a7601ea5ad8
SHA512 5868506fbac05fde6a00aa4827b238f54a901f4414876729982006622fbc4b504e6c21163ee181b93317996294b8d35f8e50409e854533b473c9c4c5f45962c4

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover_2x.png

MD5 65feeced779242e6f6511ded49720475
SHA1 e0abb699a64893efa3e23b831bcf4311e3c01ae0
SHA256 58ef4c91757bf630e25293fb8c1560d9c1742991b9e5a5f2a1dd704a19eceafc
SHA512 afbf5aa5142dc7fac7789be7858d53639788cb7fe87f8393040c207372bb5365a326a252abfff0dab690567b780cccad78f73c8a696b9a648759933e9434bdbc

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png

MD5 fe25e9a650e2716631324471af8d400f
SHA1 33b0b8b8cad78937126866b4b75757c8f725b16d
SHA256 8f5a6c44a3aa0653ea912af77714d5fc6b72d8771497eac64a8001e9c1f6c8d9
SHA512 48914cbc9e344b18cb332c2d68cb234a1c774a414e9e33b6231bb0cdde4241625c67c73c18ef29065d994799f4d16a6e2cfc910e3923e9020bbbd70c43136e48

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png

MD5 95b1a3b87bb2e451a358344b0dd96e55
SHA1 004341d22bfa1a0e078e8c21389fa13682783917
SHA256 35a3deda177a5345a0236d29bc518353886e72df929118b34414add84d350576
SHA512 0eb11b5172063a14cf478132ed2e2465a7b575e6bde4b0df20852f1bf7baccaf22e4ae25d03fd7199ad4c03bfb5054a15d65ef4035185859d403ad6df6ef1665

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon.png

MD5 7b3cd5083d788faca3fc99a221968124
SHA1 dfda658c881ff4996b039914915cb19ad0bdb608
SHA256 425419d9bde058718ed4c5c6d0ba55850edd2cafdd94a936da3e45363a229dd6
SHA512 1874f8c5ea791ee3e48fe692c9a5d6e82726ec3e63323eaf9bbb625905a3c34acd4491f3fede32e7784042618231d1df197a2a197fc279a96ddae5f232d69583

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover_2x.png

MD5 3d8e940b55b854b5c6e31f44d8eb1995
SHA1 88ce302e6b8d8d2f6e15c3dfafacc3c48b1afc1c
SHA256 44a21013b67d84b04e4be15b9965d70549185e204d1c1618ae29b5567ed62124
SHA512 cab9ce2f2151e39bbcac6e24d189b13f41adbf31dd108af7fda366f142e44f146a2e7a36e6c64bfa4a329f82675089e1fffce1d09647b357518f53be57882983

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover.png

MD5 7f6afcc7069185487c4430fcf0a32807
SHA1 2cc15c4705ca949acc451bd7cf04209cf11a8bb3
SHA256 c5831954a9acabf5b4f9e9fcb00135cbf3e260db6ec2bef35bb2a6a77c8b3973
SHA512 16f5f64e7d840befbe651849573d5ef3701ed39b3e77f13654266ac9ad104f785f6cea62079ed2c77fa0f8b14dd60e6cec9f133e81dacdc8c2af046cc6df433d

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_2x.png.Bl9c98vcvv

MD5 8d48b36fa2d2b194f0c54516d008e5ec
SHA1 4625e5c0636c0e626b2b8b9621cb7fbe4ed87d7a
SHA256 06c2716cf62aa39a57ccf4b7ffc591c7f2ee72b3fa8b35f03da9ac10c5f73931
SHA512 f225b5ba26baf8db408eb49a893244f4d2ba11460877bf6f377d59d0636cd9e565d89d19babbc08dc265f9bd84f1024f5baf9515eaa6705aa9e2da252efe216c

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon.png

MD5 410ecaecbed60c0d69657a47ebf53cf9
SHA1 26d627c37e1937443916648d12eda2fd6a7bc655
SHA256 28bb4a399cf1e6f5a65854b8810ecd9382f9311323124e596f899a3eb2a59f87
SHA512 78b79b66632fa8819c0a5e13fd3fc658da8dd04e6a7f255e122bfc165609a870b11adc4f903fc2ec092f8c1d8ca094abe3a44de1478d5f3bd69d4d0b90985f93

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons.png

MD5 9f70478add08ed5e5a573f3a9d347499
SHA1 7b937202d07b5b69e5cf5db607b56a33421ba1d1
SHA256 36b019109cfccb75fdebf982d1aa8380c6f2871f529e6b99dbf74b50433aebe5
SHA512 56db005437c87c520ba073d2bc189c94bd25a9ad84689bb5ff178075e3fa2e635132b47bbee7cf1c40de82ca8cab4a930f9436a15c1e08d8311a256b72ebae34

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons.png

MD5 02720c5a7a4c68dbb46a68e04b07513c
SHA1 8cbbdba33b05904912582086bb4b6c743dd87e2a
SHA256 fa94d44657a8c74275e5c2770e67dc925cdf1cd6344a4b32f7ef22c27bcb097e
SHA512 af397855cee2f0f0fb9f5ca75a45f0c44e5b145ceff0cdf5335342e1e9dfdbdc2153cdc7499c42721b2f5b1d14a99ccb14748203dcef05b6023356fbf44b65c9

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_ie8.gif

MD5 122e87c702bce30e26ed05b93a09d4a0
SHA1 0db00e94e6c05d464a408d817b2d5dd49d7b8f95
SHA256 b90c42a456a5b37b54810488f525f63cdf2035b60c60f0c1d47509e9715549c3
SHA512 2b755615ec34ab3139fdac4ad7021c96763e7002865228fea41757879a7a6184ac6b9ac3fa1431d9439322957c3b9640d3f968c7c326a1b23a45160338fa2bfe

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_retina.png

MD5 b2f0a8c33a177ef7dd0dedcfaa94d2c9
SHA1 07b9d4c3cd1f1a978ed9cce954dc856fbd1d23d7
SHA256 7e1c9ad4d82881829c6ac5668af65bca5fc98d1b01b486222dba57b2e54f1a44
SHA512 ad65b1fa2e4d075151f1538815e2d0fcf8c3dbbed490f11ccf33952e1f2aebafbbf3d426c0318786fcefab56b817c4ade976f36fcb19cc7cdff186629d8ad0c2

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons.png

MD5 1c8260c09b9229ab92a9a3c1c03f66eb
SHA1 d4b055dd9f9753e79347246c4c8b08fb92955bd5
SHA256 5359d1a66c25e5781f299df79f4e946958a7285900a3450c04e721bbbf0c9171
SHA512 a2b2df0f2d16212fbb087c0d8a21cd8e1f191ab824895d77cc4a5f3e4b3f66ca79300cbec213585131b122888ce36339ba6eb2a81d92efaae2e2915c17498d7a

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons_retina.png

MD5 8a217343c64123d06fa9785f4505733a
SHA1 131ee5e2128cbf5a45b8d5a985fe499911931659
SHA256 8a2743bd6d71e843454ac0f02891780a89ea7ca39f2667548a921e0a5517756d
SHA512 8837830076c9b9da87b41f2259feaaf946c952bfd1c9dfaeb819bb828a0bcdfa0f5771fc978f342d5d144dc4bdcc4ad433be4df76db1069b6345799d019cdc0b

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_patterns_header.png

MD5 d26237e084b0efa0ac2221752322b89c
SHA1 8e86bbad305a924d15cff0c9a9aa4655f91ea423
SHA256 268f4df039c0a9b405bb6af0b1cb1b272028eec8b4d87a1dd2aaaf07dec16245
SHA512 86ac3c8db8b1f7465faa10b06c5d8f00d1477ffa6a4f1e33e2af1211aff1b99ac0f06ae329cfca528fdde5ab66fa8aba85e29ca28ce06d66f16f812c97981841

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_pattern_RHP.png

MD5 ad01e98a5bad59f12a9903ac51684804
SHA1 af575235eed587283440e63b8a6d9f5d02d842cd
SHA256 a6c65b97c70a20b7d507e719b98e4d0eb4ae85d57606f5127fe5e394ef1f4068
SHA512 6d85975fe8e8ededdc5a35274d26a04f15f4efa071eb30d78cee0fb0434bd901c1851b1f348555a5d8b43d5c0a1a46c7e3dc0bcb71124d6fe0d4c24b1ce6f79b

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations.png

MD5 414a471bcba5314217627660561e8866
SHA1 faaf1b92999bb6c3c7ea80a968e10fa3afa86be0
SHA256 21c66390d8d10d60f3c590927c7a960f93caf2d339a4a6d107ffb2d8c9182484
SHA512 8a4037390389c5eb89cf926198f87b7d5c73ee5a01af3873a0e4de9bf1a428385ad87981eb557f5fcf1ccc39a987b8cc8ef93e9c462de5b0d3b7e786dd7a90d3

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations_retina.png

MD5 9891851ae178cd7c6158c35fe5a3c193
SHA1 61336ed229f442c0ef2ff95bc39839691c4bf8c8
SHA256 fa2a8da342afa08a63cd067c92d40c3820f9e89899c6a9ce9ab453528068b665
SHA512 793b6847919c2a6a78e3d9fb4fc51bd8ac1a3b440afc56f8c2104f5e0fdd114b5b2849940822dbb61e900c042eb46d6231509b036997207c5ab5d6ce22105832

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\faf_icons.png

MD5 7c6e794cfe0a7b4daed255857ff9b14d
SHA1 700ad12ac548e830dd3c19726db78a8f3be7ac8d
SHA256 4773b01ab272cce93391643b1bddaee4ac223f018b24fe752e888365014343e5
SHA512 98a4a59933844827d5d28e26c01b302ce95fd5a9e943004c315e70dd6e4bc1b86e0728061a1b9238447bcfbbdcae8ffd7d996717036bc411bafa6613b1adfc27

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\bun.png

MD5 34d75f5b27c3c6c25d2cd9dfd0d1a6ac
SHA1 b4116bd104909a8c0d7d76ad5623b137e36fc694
SHA256 094279b650a0cc8436b7f6c253cac0edabcbe099825d854eb401e2b891b27b74
SHA512 669bb255a06987ad2c73213bfd6640aea4a695db14aa1b7a27f25059cf03dcc115e3d57ab4f949e8e3a27561c6f0d7be8fe705ecc05a30a8d711aa8658974c60

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview.png

MD5 eed44777be87c1f5851a5548cca6f551
SHA1 f53e9e1d67feeb6fc5b23d0d495789d402deff37
SHA256 979716fb57090c64ab26cc9227bcfd18698b3c46c9732fc3a3eacbed3d4a5c35
SHA512 b1f05256e4c88046e09c19c9f750d200b020022b592b589dfcc500700a81ac4fcdc8fc6a9f5c1a4e69e12109e936137914dce02c5106eb30a119fa9e848f73a1

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview2x.png

MD5 4cc9c03ad014298debc98db857fc7bad
SHA1 e341a3822206eded38dd2f4e89ea86254dff226c
SHA256 9752686ecc0ff621c93872a1ab139116ba9d5ab187123d55fe0665715ea09382
SHA512 8f0579f5747bc2509d4ffdaaeebb230e1b117b908e5f0b8b076fc657f7ced3a43d4ec108281f2fe242d27a5fbcf082a485dbedf8590c900ebbc84d0103a0a955

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small.png

MD5 dd7f14abded97eca8c4f05a1d00500a3
SHA1 7b97ed4065cc22c9827629ce4685f0622f08e8a1
SHA256 9036a3ef33d60789267102db589454511f75ecd46cf18d1c7171c1fb0af6ff30
SHA512 2b08b55f1134a46e2304c80a5a581aa889d2d9dcf3b44d6457c21b88a27fd0d06f88a8652f2251171d12b7866fffbb07528f155a15eab7884d4b8b5475b8323e

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small2x.png

MD5 b39f720f1a08c45a001ae8857ac3ba4b
SHA1 cd679be598286b6d82e2dc1930908767bb3cfaed
SHA256 03a91c4916f1a1cce94bfc1fdde2fde030ddee1b80d346b49355584866e143de
SHA512 2d521568a8804aebd79d35fdb4c9e7c15b064ab66b7298ffc5ceb4561f708b1d95184f7e5bb8bf84b2e0abdee3c4ad9ad5413055957ac1b7d2b0a98aee44d736

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\illustrations.png

MD5 627a9016067ba18477e75c89f34a15f5
SHA1 622c141a5b94fa0e510ea5fd5923e7884ef17e38
SHA256 86378a567828a538df66a2de563405a617dd8c20d07ee5418c19df6958f81918
SHA512 d0ffd2c269a7cbee4fb0463dd3533417a365d28f7b60be9aa4ef651e82ce3a8b77d4e7c4e62acc706cd114a7e527be7d7da559845185b04d5ec87ad1d266cedd

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\nub.png

MD5 aa8a74d90d26fbf6473e24cd500a2a0c
SHA1 473ff20b61e6404a216ed1b15a5047f764fb0941
SHA256 58b6adfc8f2ab31dfc9e59faa6b370be392882e058e356a6a067c99eacb6d1c0
SHA512 edf57be569f82adb61354bf44a97afd717f559a08c887b9e3f8dc535c328bda3b99ded0b46bb203b0ef61b25190b1df3293df4c3858107ad9595f1be878f400a

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons.png

MD5 9c5c484ed2418dcba3b482d600a890e5
SHA1 e784fadf947ea2c16d08d4cac218f7167e3ff48f
SHA256 9802606a3e491a8f8ce2d56aef2c1fea923a536c7db480f63fd2f441dac3da33
SHA512 acc878d5e2e3f15111140fa08da0d3b9905c7065e17e5d59d8d6886c77b18d98c4691be4a3100334b285c36ad092ada56c5b33ef398f7c1797975272752672a3

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons2x.png

MD5 a1c088f92ec0b51fe47e3361a685c7c3
SHA1 bc751185890217b392cccefeaeb83dc7603079bf
SHA256 c103e95f9a69fd89cafe3a6d20813ec13305379cb852ffed8c07332a9fee01fe
SHA512 44d7cd1d935f5ffd7aa21174ff537bd348473d9b9e579da212cb63bc2c8800ac9bbd19f370a46bacc5285f90cf9305cc801f02035cddb405b78a15e424ddee78

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adc_logo.png

MD5 e1623552db78036f49f76ff9718db7fb
SHA1 e64ed60c9836c600202d663a2b1843d01332de87
SHA256 7d83391498653cdd2f1ec74b70bdb19df56a42e2f6275710f2647faf748899c6
SHA512 fd3e6c52a5b85b225689e147f45f4cfa738bc3d753b9cd72db066adf595ab20db00b82350bbb6fcb6602d18ee599c04140f5889506b764485b24599f66ce516d

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adobe_spinner.gif

MD5 9fb50d424b31885bcc2d89113c0e5aad
SHA1 b889dcb78e161cc3aca30e48b6af64f9a0e744e5
SHA256 a8938fe35fe61a2e3d5d19c47e5c0f8d0c92f13ee08a51101c8c3c174f98c4a3
SHA512 c700d4185024a8f6abd46a1fcfde141d0519a419893738ab42bd9606749c4dd670fcd95d314572e37396b70f4d2c7d0e475c4b3765ac12bff41a1e32fe659662

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\logo_retina.png

MD5 547eea0620c9b2e89cc632ad88e9a99a
SHA1 cd7032190b078626c950950111e993ec7c25b519
SHA256 9a2e38fb0a8a8493a5707927e080953186a3fbf4d616ae30a1a478f8dc107d49
SHA512 e9b65e9297dfdb793a1fd832eb2288b2e88e5d80a8c569d0590db8ec42b72d7d4272bd5e044ce0d371627661cb41f7b39563ebe3aded99d3c74016a869cae600

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo.png

MD5 3bd7360ea6a505ea88abb00863f9db4b
SHA1 c2eac4730f7612fa55f9255e00d4a0de6e545bcc
SHA256 b7561ab328cb9b463e92be21a4afefa6edc7348bf78582087c21ee0eeb3bb398
SHA512 13ee50d9bc99435f52e0b8ec04b1d9d8743b2396ab7762d8cac8b6988a12c734a6aaad60d3a5af62bf118bdbea29d20ef2b39c3b09fecec40220ad16242fd116

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo_2x.png

MD5 31c5fa5b325357534387602fe784eb26
SHA1 1fb16f758cbc87fa27956dade1009c784e8aa26e
SHA256 2fbbbf499525527b89d9b55ef9bfc7f63af70ad2c7538500882d43de97ec06b9
SHA512 6a35507076620a222bd3bcfd093702f0504bc0918f84b1e0483049d71826064d40a76569da02b0ba848dce4b02559efe6b50985edb35c59877cb4ce5313ac3f5

C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB_EURO.txt

MD5 c39ad1a7dd5c95973ce7bc484fbbbdd4
SHA1 e0e74b04d643236c72716341fad85690185f69f6
SHA256 d0bdc5b9bb503badd39851a196e7fb90e1689ab1fe2c0e7e4ce7b43b10f046ec
SHA512 7ab9992c48cf1df1f48125509913d4adc45d5ef5afd3cb6687cfbecb9347eba725b5a725d14f52923c29cd2bda4a3de2655e2a69ae35ce4f4965181855330795

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133670762450082308.txt

MD5 7c57250c2a9ee8186beaced6d4e0ff1c
SHA1 50d67593241d4ef28519b8aabea2537b016040c1
SHA256 1f711b239fa839e4567cc9ffc5178a6b3fe10fc67774cdb8b2afcb5bdee71b8f
SHA512 341c1379e9a641ad98e7419d51e5442b27307e6bc4c3719b8cbfc9479fdb58eedade717ce57e0c17c1f406cbfbddbb38565ccff28dfc660b38003f22499907ee

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133670756572311376.txt

MD5 9f5ed114121063546527bad6121cd85a
SHA1 09f21c6d11505fb5fa658b0ca0edb7c3e344f335
SHA256 5d345a5660d6dccf7e427a68d8345fbca08d94b1af81e9e8dc0a14cec2e48bfd
SHA512 3f27d2240c2705361b335e4a31e9ea20f09badbd92aa0cdb0061498c9734d69c3d40d7f2ce78e7399ea6d19df5bca447abffe3ae78b441c790bddc8a3a20883b

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133670754108717962.txt

MD5 3750b73077bbabaaac9bb9f73288b271
SHA1 a78f31d6e44e9e9bfba5507c8826ed12ccff9dcc
SHA256 c4ad11e2d18b512851ce6c978b9188f5caf20b227f77324f7c4eb97b7fdb691c
SHA512 75f80af185f1a7983c835c9177da96481a0d855dfb6682792a1513bb4513bf04aed3004d828f6397c28fca66fe7f998032340b8534dbd9ae66036b95cbd845fa

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133670764101374726.txt

MD5 58e7e7ae9857839025c1b5976f8d4a05
SHA1 b3f16553624a3f990b140bcc21de4a42103a7597
SHA256 83c9c259a003b3117c03cb31262e18ee1ea5e025dd2e2bbb06809d4d18694d24
SHA512 6306a6cd499a01786375cb575e38705854d29de30b7acfb4978c5eb4254d171a45f547b38ce979caea521021392728ad4243a6ee2515b9bb243e8736442d3cbb

C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\File Explorer.lnk

MD5 8701c431b11ace57ae6237b5095a2078
SHA1 c40d42c1d9f37692ec387715cd81c6b0c3326b31
SHA256 dc5164a80e1d65deaf078c4671c32cb0953ac1c4fd083ef6a5ec5be52c8ec76f
SHA512 97fa328626e463da595ff556789ea4c804b4a839db4ea3a38f5a8499a7f5405202ce938e0f0fc3925b3416bab8a718b5cd7ddc7d41fa771600297e5c19bff91e

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\alert_lrg.gif

MD5 fc18677ca4043b0d8a93d01d39063887
SHA1 3bbe3183e7c766be774f40c61f42ec19880cef4f
SHA256 e27925ab98cb485a948fdcca19a5916815874769b5af5d3d254b7085c9581835
SHA512 73a4a24ffe48796d3db3ac761770fd81af89492bfd6e10e3b7a19838f9ae8f9da7c45902a350e8d83c55d8dad441a398a61b9b361785f37f0cbe896fe619c0bd

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg

MD5 5f66b98035345c741845d4df520ebee6
SHA1 c73371a35aefc26303b7a7e7be729714a5f5d1e9
SHA256 23476dc0cd1f84e63d058d48011f5a38cf490600f188cf030609780e28c75c65
SHA512 8c224f8cd32a0befc6bca9e8ac1b84dd13956998c1b188c70739c8a4eb326a51d3ace66fc508722978cbd59eb8631a23dc5a11c06328e576762c8c110fa784d5

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\aspx_file.gif

MD5 b95280dc2d0f115eea4d02e5b67c3ed3
SHA1 bcf7fcaacb4ea2dbaf5f20f425fc2c58e0964d59
SHA256 382f29a58f6673297b2578cbd4aec4b7b6f225af83f74faaf5983334a651f97d
SHA512 ed98534e020ff950e56fb9074b8145a158d180fc9b46c1bd3ab27981ebfb8d5a84e805602c7cf409f963c9851421c88ea4277a07310b429ec0b7f360bc4008d6

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\branding_Full2.gif

MD5 a084499c4b14d106dc6ae542a55148e0
SHA1 817f92e0ad9704a62385b2737829fb86c2e123f0
SHA256 7ced6b3f05d22fb22e7a2c96df13d9e1f7d2297961a55dcd49205f43aef2f17e
SHA512 b5e42547152eb17e3dd60a10d04bcb8bbd9bcd96c9c02baf741aaba29b8990d7e0f0fa7738c7294cd0d19ccaacde66adf3ed1cc8ad74ee6c9930a01183e25e88

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\deselectedTab_1x1.gif

MD5 b40036cff7a236be3c05c4ced98134fb
SHA1 d7156ce9dbe28ef15470d0ae556d9bb1c8706fcc
SHA256 ff193e5888d94c897d36f0132433d46619a75c2d8b652b8cac61dc1919aceda6
SHA512 f22b2956d7093b5e61eee47f75a27f52fc0f0963ad8786e24dae878969684aa6d15d5a39d042c2960b2a41f28c3581e57f043e43d926476cccb9136599b0f46b

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\folder.gif

MD5 537383f503195b2885e38cea448ed5f7
SHA1 73bad596c39249e5aceab4cc66ddf5c7e116858b
SHA256 28ca666cbdea89bd23c1262dfb262f6b171a462c50b4b6a2864a34a9f6124f29
SHA512 8f39e25c5df04854a73f9c3625ecd06a17a3ec1c83a905a91af7d9ec3be20e61febaf1243f59b67d98bb32af4a9bf0186ed9788e4ee12cf8f2405dcb82775fbd

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\headerGRADIENT_Tall.gif

MD5 8961e7d295079a3da8de9c5aa4a819ba
SHA1 934731afc0065c164ab45335f216790b0ab119b0
SHA256 c5240b6a850c5116fc7806e010930a63fa28f629ca363868dcad746dcc3c10ed
SHA512 562b630c5d6df67711413001b6824a7a4bf8205a8b4e0562f249bbe02ca3eb170a9c75e4fd74cf1ab129d8942329a38b142f605d9f7a54fb7b07b3961068eb74

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\HelpIcon_solid.gif

MD5 88c97f9ae243554565e8def5cab285c8
SHA1 d30a0eabb88af9ff4cd3554072675965b094304b
SHA256 f675696fdc11ddc4a99fc45c82b70665def2cd9eb47feca3372ea36679d3253c
SHA512 d5a0bc47578f6d5df36654f33d3df293e52f1c6312583a273ff1746176a4507ba5cb4e0e7c237ab19ae2d0d8215c47907e2763422d42e52b35b1b9a52eef474a

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\help.jpg

MD5 4bd333d90abaa611759c63702460a97e
SHA1 1bc0aa55c84b4cec249011659d1dd378e8827224
SHA256 09a860d631b024dff2ee0286417757f888a21115221c1c7fa8b31cf22b0449e3
SHA512 40968cc945139f23e587c8b7990f036d3f61e385bd2eab1d8580ec4125ff30d2889dd5e45b8ad5df9c567e778b8d8d34e6b78d66dbf6b8050cbd9922bf08c439

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\image2.gif

MD5 642a4f7bda16af066f503a5f102088dd
SHA1 e1536dfdfe9d1e6ed495d04ecdd3e9d1ba4dabc5
SHA256 478ae124c83ab5d9dcef2f90606e7f5614f1a72ac3509221ee456d6b38e47465
SHA512 078b0be1ee69cbcf320200640d8c66f2776e6065a866789ca7610f577df49748487ae0edd695820cddc22b8c79ef50fa57ef4f2fd4d4320e770716a2e2b8c880

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\image1.gif

MD5 65ad39bf7b613ed2991b768c5a53a6bb
SHA1 f74e404612b32cef39de33727652708873d825ef
SHA256 7bff5df8f5c5e87bc4e4a9cee04de9d14c3e9e23b0f60563f2352a38c39b01ed
SHA512 18f22e62d8c7fe432aac8e26609c125ce5eba94889c8cf581311dccd7caa2f73d35f6825b39c05f16e131fd771d645eb79c06f4c279a4f0f51231567abf46ff3

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\gradient_onWhite.gif

MD5 7d79542dbeafaa523f55e565365e65d2
SHA1 448c53227bd2a68744801f4861dac88d58be27b3
SHA256 f87964bb48f948ed7fc49858a39a17ae0c7a8b55b0a4cc0037ec6f6b4d5ea335
SHA512 f0203bb57c1c36852b7ceb90c28310de4448a004b1ed784d37ab05f7e18886ece077886b50c6f7c2f250c0196df8cea92c3e84e577bc43bb494b121d2ba25795

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\requiredBang.gif

MD5 c0a36b230311e53a684d35670a60d347
SHA1 3aef9426ceb9e6d32110a87e1a34382df520da4d
SHA256 b882c41e9a17264effae0a81103677a351248c3d9c9687b8f33b832428caaafb
SHA512 cf3124b8e9a6e5f75a861522e47d56e21b07007e1819a8874938e0a6f2503478eae00cfb512d5a13977ba6136c61b5fcf00bb099751d130162d8a23a6b235be2

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\selectedTab_rightCorner.gif

MD5 26b44f78f18fc0b219e29871667efde5
SHA1 74746f735cfaa9c2b9e217821dc61a5ec0000433
SHA256 2f40ad49d115567740919bfe99eb0e179d68ee53628b3aabcce265c355cffe53
SHA512 83eea8ab21a74333dbb2a5871ebcc45f4acaf21c3a1bb4ab3c5d5cc8888ba52fa08a131a123e3091e72160dff7ea51f3e66b76362ae268658123f20bff4eed3a

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg

MD5 ebf4afc630984bee8d56d68a63ca540b
SHA1 f415d41514c38f3bb1581c43f3ff5bc275870590
SHA256 b1eaf5fc907db4aee35549cac6866755cd51610a463abec89b4c62d2d781f760
SHA512 f63a802ce39e4a25e1cff9de9212cd546df38c5d9f35ed69cc9025175c782546c3f0ccf4b8506a3d8e400f7e9f6a6a3990d7f6ae10d4b9a72ee862790b31d6f7

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\selectedTab_leftCorner.gif

MD5 e14c7cadfd93f3f1c3aeca220474adfd
SHA1 1d043b314289718d395f86016f5a56898b95b7b3
SHA256 854a3d06095ceb965d0fd3c2b275e4b84cedc05f93c3abedcbbcf2afcf0c1348
SHA512 a7633878c664da07c7bef1293e4ebfd185a1f4acdecf5ebc49b0a3ab103da16980427e17026920a5c3435c6793e02a32f358e99df14fb45ded2d0ca3edb5043d

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\unSelectedTab_rightCorner.gif

MD5 feb5b28daa7551890e6a6397b7e93bde
SHA1 a7b20c3fb24cd64ecca2a4a1f43f4bcb184e8abf
SHA256 39772bc872af06c80efd8cc80a0023a02fa2a8532a9bd392b503501550e44918
SHA512 f35366347505f6fc856e61d2457ae63da08444ad0fc6f8d6ee0f21acca80f0abbf8d88147d18d6ed6138aa69cb7d001e7076fde0457a99b372d06a27cb2b654e

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\unSelectedTab_leftCorner.gif

MD5 69212e15dc2754acfb98f4fa6939a194
SHA1 4c4cac7d83176f40c2cee3dad96a41e7d306fdd8
SHA256 3528ecd2134a99c8ed567453257ea29504f1b96744546c339f622abf855b8074
SHA512 b4900e2c21dba35f5f4d3eeb5deaea4b2e7256b6cf84f2ebd34cc7fec19499dfe64f69002ebf970b7103d591aeec469be22d7970934892dcaf936c63618a640a

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\gradient_onBlue.gif

MD5 757b8dd52893816d18acd53747bfb0bc
SHA1 bac3e7b9b85b233e713b8dfbc5c3ad45c6d99d2c
SHA256 ef562177487f2e8375c153bda7afd567272aa3892b8db33ad6da1f1ec581eb6b
SHA512 874700a1a4f8fc5a88209a9778bc2e0594742db9d88638b72228f75c01f6aad723568b3e59da8175253052d2cb9534a0f94689e02758598bb94c943fc3011a33

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg

MD5 0305f3935eb97f0e28576793fed2a454
SHA1 b6f32c3487aaa7bdd975fffdd7c97963c28b3e44
SHA256 0bc62c17bbf1aee86137cd8d36804b3f2985240c91fcdae942f1a51dae696f95
SHA512 b63c28fbca595ccaf7ba1a0462624970c214742ba60892c9c64674d6c6728398ef92a480a2d7e41b6fdaf9138574247caea959c006fe71e4a7466429d4b80a29

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\yellowCORNER.gif

MD5 3d8afe0e5ee0a2e3eca1f1ba36736578
SHA1 a2189ca542eef367336ef3fe6637c093f7f64a2d
SHA256 92d74e36a166d280fc2df176b0cbe38cac3346f84324df00922aa099d26d126f
SHA512 94db04e298ef1e796f793d2ee30dcd6baef04b4ec5a540ed2a23c5ca83c6f7ddf794f5aaf6d55a943de3d21e55bb3ff84e6bbaacda994cd14150c85f056088ad

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\02 - Command Prompt.lnk

MD5 2e0d2e635971b26d8d168c53f7573822
SHA1 1e7bc7cfcecb8475cca4136dc19297fcab9ba0ec
SHA256 fc546df56831d72e4727a6245b14b1670aa6d11ce16c244b1c3641cd2963350f
SHA512 5986ee1a92185389128b6557e871277d421433c8c39dc36cc3ed95d4877b954a74e42431f691d16d9c7781d769ac348474a47c01deb5780064daa1a3408d9400

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\02a - Windows PowerShell.lnk.Bl9c98vcvv

MD5 c28f71237b96acb5158ca49c905f2c27
SHA1 033c6cdd169bd085debc184124d3466d6b30a19d
SHA256 e5df877ec681fee35d81826ef84d179d23fef8d0fb45a68c74b58ce23b0c6996
SHA512 10bca5fa5b8689ed259a7d78b4114162690f3944b22ab05d46d100319c6e92c1c7db0a3760f4e7eeae8c8d6030e1d5a096ccd42d631af7e214b32c4749777338

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\01a - Windows PowerShell.lnk

MD5 52eb1e6c341d492d6f4fbc0d1eca6918
SHA1 09226f86db935fdcb1fe4039869e73d48f0a64e6
SHA256 66a5e636ec551180feff8f023c2bef54be0a44c4c26a7362571c938dba541666
SHA512 5251c2381cd51891ec675d01b15c5b4690fe7cf103dbe6db5c4a65a089836603b15eac6929f46343932b152919ce42e747d75a2a9bfb830361f2386e57598edb

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\01 - Command Prompt.lnk

MD5 15b3dfd4952dcd83b700a50032a3d9b0
SHA1 9741ab9a5164024adf94f81e51c45874f61812a4
SHA256 326b4196223a591dd8b6626a0da7571e22cc4cc3642f6292c366d82ee77d8058
SHA512 98a156e641cf21d8dd2c9b44a45dbae2a75630d5fb641d23d7ff6bdfda0e05d025f858c7b6a0317f7b2f4395d0dad120f68042bd5585b392120dd429b63ae849

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\03 - Computer Management.lnk

MD5 0fe86bf21018e0bcfc0cba17ab51fcfb
SHA1 e42600137853b3ffb848ec1d31e63bff20349795
SHA256 d593cd299db907457d036acba2c3003beec8a1885b90f317f2ffa550a5fad674
SHA512 6397d56d8a9e466f5ff92827336e108a783b26225f2e04d6631b31b87583bc8920bd048a604250a8a90054678ea58e10bcf984c8aa1ddde8e92e3354393556fc

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\5 - Task Manager.lnk

MD5 b0f8055fa406e39fb675a8a2b6aafe0d
SHA1 a2680507362be708ccd09bb4c52d6130c7e508f2
SHA256 0bb72c310a8473eefa2db2cdc776595e3e3247c806af8e58e3c4407fa654d8fa
SHA512 da75b80809271b838f847cbd6f2cfffcead90966067b2d81ccf0f944268982f2061f751c2e4b01517d77b0bb8aa28c4cd69d60604d0043244f16bb79cde5f094

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\04 - Disk Management.lnk

MD5 d1a0a3745ee89ff6e22e8bb6e93fffee
SHA1 d969c93df99f47fa69bafc30a1c4e8370055c40f
SHA256 834dd93b98c3da2eb73402c406762b72e26264d02309aa4c65c91f28604ba6ae
SHA512 6e90d2399fee3f3b0a746ca386f38933e409a37ef5251c973eb56a9da6ed610404554a18272a720cd7ea489f68a9be2d18d81260ad483882250cb9d8e5ae398d

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\4 - Control Panel.lnk

MD5 d514cba913bd9e02b412cf783eedd738
SHA1 7d90a71be6f8bd09836bbd7dd5a9a45afe395fd5
SHA256 eb01af350d3c5d5429da2a04c51bd8cca343d6c578e7184a77ae53478eaa09fe
SHA512 f3cd33f5e3e010579972de618a15bf4371bccbf1b335ed08b9e3ccf74bfe1e6b8adfba08d6a8d7767bd0031439e86c8c93198746c0b3c8d9572735e7080ded92

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\3 - Windows Explorer.lnk

MD5 37cebafa127d49d52736aab5b7f814e7
SHA1 e4b211f188ff4280aad3aad38ad16164a2238e30
SHA256 cce1c0c87f03da03397dabc0735013d54ddc27345f5c3127633ee495be0f63dd
SHA512 aab516d71b871e29f0d03c089dd1cfb0d49a1e7ff8158fadee8bd328328b3165a19004d31ce68d6159c7e18d9eb40b665f0841ccd0fb5e3843295358c5003dff

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\2 - Search.lnk

MD5 801e211fbfff7d79acba416296aaf2a0
SHA1 c48e4c333afcd76569fc8a947821dfb089a60941
SHA256 4d0c2e3dc0008c4b182f9f032b383a1efc6c073736487a79dcae0c6bb21f4a7e
SHA512 c09f09c4fdaf7bb1686b28ccbccc801fe74d30aa744afd847a0cb52acded721f473785bae6b9df6966ebee5951ee0720159c7a47bfbcaeeabefda4ced630c62a

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\1 - Run.lnk

MD5 be08c0f206f9b58055fe9deceb58c1d7
SHA1 24ab347239b1c78005984a083c2b0dd07798aed6
SHA256 f7cf7ca8a19401718cd05167b0a052762e0b2e63e57dc109ffff21b271f2e5f4
SHA512 8978c89b6c5fda76fe9c225d8d6bdefc8d815a690d703f1097610d46adb65217e2351e1c3f9acd811539fd6b15a0f9eaced6dcc02fc3be800fae1e61aa31e398

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group1\1 - Desktop.lnk

MD5 a824b12529ed935ac7677ee8cab75b6b
SHA1 4cdf566ecfa4fc721e493b607ebbd99aacd4a80f
SHA256 87ef1861e499d5430672e1600b9745badd7c49495f12d3883e61cd0c6d6ecfd8
SHA512 570f404ca9605952296b0f5ae2d024dc4bdabbd53d4106aea952277836762ab8279a30456796dc268184992e9dfffe6cea4431fd2a1f53e89f07c5160cd156fd

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\09 - Mobility Center.lnk

MD5 685e74367ff157b000bafb89004f8e38
SHA1 6b5d607122037d1148024b9aae50627941f83a6c
SHA256 a59d324c2ccd09ae327ddfe83b2c927b6f9b429616471598ac9100a4845992ec
SHA512 60bc6ba63ae741570d0aa1f4cb406aeed513d3dc84b0bec4268cc93a25217d0e01d485accce1f1f9602322c9ddf085e169f2e68c321f1dd9a37b845e00cd102d

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\08 - PowerAndSleep.lnk

MD5 1cbe8e293aeeb9c8a0ab601eec9c5bb0
SHA1 12d9507d7049066c6535530484d58722ead01d08
SHA256 bc1ce2bc4dbfef0d09646b976fdfec3691c12647ac0fa619cbf08e4b3d72dedc
SHA512 2a4d236f74560d15356cfceee94a1c0d8af18d3a442a5308896929db71c58c723b717f5d230a29ac6e06661fc0add4d55dc3848986ef2b0837e5a2a7c1e0bcb6

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\07 - Event Viewer.lnk

MD5 2796297089ff34b458fdeb6c55919c43
SHA1 40bc75e439f760624774f5119c8ecccac61e9257
SHA256 b05bd16644443d3a1072f72a1681655eebb58ee244edb6c37c6dad5cd3554148
SHA512 a9b1a5bab14e0df5c046580952d2eef7d28fabbe9620c6edff5cb7762cf2c7bbf726618f95394267146101e298dc85d8f2855c59f82830dba34f81a209ffdd6b

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\06 - SystemAbout.lnk

MD5 cd7bdb5bbf9907a6854c9cc0de8d96c9
SHA1 088fdc07b8a5f73d3eb0d6e94bb27a787504e303
SHA256 892b9b0be97d2c35373c5ec8a7668ca048512df4d66900b04555694dcceef17b
SHA512 3dbae981a5dec9129a1c726589d63514126e5111f36651b8a8e14ac00129ff7f1be173199d453e9db0e9d106a68faa661fe9b8594529cc4033ec217148018a2f

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\05 - Device Manager.lnk

MD5 177745b10c7aa48586535ffbcb1615cb
SHA1 dd1edaf4abadd7efb1599c4df5c9085daa408bb4
SHA256 3ecdf5241e30e9a57f21209a3901df430abdeb40f2acc5bbe207f664f440eeed
SHA512 1278ba9889c59d6aed429f06ab9bcc66c845e3d5ec45523c23d22f24607c9ff82d5919b0e0dd02762f0d58b1f60de4015b7b1c2695502396d72e30e658a8833f

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\04-1 - NetworkStatus.lnk

MD5 c0296e5e6f0dd0689da739f359eaca4e
SHA1 c09ecbf9e1b11aafa1fae4a0651972ae26beed14
SHA256 b8ebe96b7152e3778b97851962cec5fa9e398621526348cb1fc53769d0b1f823
SHA512 3a4517b6ab7f19d2bf447ab9ec27b6cc29cdd5b2333f195b7acede2161940cbc2d4abc51e2d44acd359ee2cca63e965fa1b4962cf9a6b45be6291bfd4ce91ceb

C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Run.lnk

MD5 27acc3e8df44f6abf12977bb64a160c2
SHA1 0cd28631f107c6a33211cab859a013dcc4bb0bca
SHA256 b8260c096efb106aac4f2b978b9f31855faf6a9d9a992ca3cfa80ed1fe78228e
SHA512 1e9958e22fd9189b09177b6e7a9b7e933ecb75edf5a64c2484d27ec28fc04a035b8c67e6e1ffbd8c4afcca1b9c5e18ac1abf3b3057f4aa8d4c16dc517e30a2b0

C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Control Panel.lnk

MD5 c31695319e801ab59e9a6ddd76556090
SHA1 d69bf6fabb7710837302a0d327894d542f26ecc8
SHA256 e838b23e543a4db434dec79b5bdb2db88edbcda25b143432f5f4bf93bed94a78
SHA512 85d832ae76ed20fd14fe16341cc20daa122911893353aacf898c69165fe4ddf5c51ad197c569047117e96f2db95f6cc393e30d775affdffdfcfca7f1bd59b8b8

C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\computer.lnk

MD5 2479e78731b17f24b7b5958749f07b4b
SHA1 379e5d94475f8d8d8bcb6f346fb4aea54a7511c1
SHA256 d336eb0647e805dd0db97af2adc1cbb043f23dbc11bd4e67c5f107ce585a3811
SHA512 de3f584ad1056058fd2ae6d560c841703d441b2b78094bbae7397fb8eaf69a63b4c7e9a8d8f02b5232ed6a531d693c81ae9b4a33c462112cdc475ea82cdfb5d6

C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Command Prompt.lnk

MD5 a2a39bc981c9d38377018476f09979f4
SHA1 35c91aa6932b5b8363ba1a7ff937665b45ccfd86
SHA256 e32797bb74f4d4da92859f976c8557675b698caa3b51fc33f2a62b02f36bfa02
SHA512 b68d42c51d068425e0aed9c702cd0f61b5329ce5f38ab9d7f29688057ade60285a9181d7318397f2c4845df640bc1444ae96691f567ce01391b28dd6161103cc

C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Administrative Tools.lnk

MD5 b2cbaf9aa921dd39042abffd505c2fc8
SHA1 3df7cea93d5a61693192e947573b8efd3682b9c1
SHA256 f007fa7bc3c69faeede20ebe4409278aa26835ed2b2ab6f3f018050a945c28bd
SHA512 8cd8fb32dfc76df4812771cc8972621cbdf755108bfd7bd5c340a6b314c62c0270374e661607caa40fa2c20d9e9078f34d1815c64903e4c4bf6ceebe56be2734

C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk

MD5 b032dbc7a42d42b70ac666adff3f3552
SHA1 63843846433f8d85003421d66b5689eb3892d616
SHA256 c7b7457bfaa4c4177312a966846e690d29d010a9b7e3d7087bea302371cd62fc
SHA512 8dbd10d2811737dec726fce1547543192c160742ef91e86ffc107b35c8a2e44f363e6fd55f4e3d4803b4dc844642233913dc0fb119c0a67c06c843f06217a749

C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk

MD5 cde4056dfc6f273e8790c8a06f44a8c4
SHA1 3a5f243ca512bcbd721875f79501ac478bdea5c3
SHA256 29cf41dc34391726285288b889adc44e8355775e1c326d462845b96126e2fa1a
SHA512 f5ad73b305d527d8ffe41149e3a5d971d57385123915e93980a318925474fa0501d73fb08965ac800f87dddb6cf179fc847768dd23b438631328e3dede2344e4

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\10 - AppsAndFeatures.lnk

MD5 b1512c6dff9594ca112453ffde723c49
SHA1 cf9b2e84b460e5bfecf88a25b2d814300c30414f
SHA256 c5896f8522258f06396d6d83c478ab2f2c70f8284722a3e6cdd9a5409a911f73
SHA512 63e45ec28741ccd7c501587dc0f6b6ccab5425fdd38df77a3f0d4a212c23e79b6489d0f497205d6755b9cd0e212e4a4cc37552ac1743b64fa732236b3451b53c

C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\On-Screen Keyboard.lnk

MD5 1519a6a440aa1ba5ca35070b6a47e759
SHA1 2eb2ae6d792e52dd6648a8756bf52323b64b92c5
SHA256 11a95c9103d6af28c2510fbfb07815ad0b5d55f043fb2db9efdf0b0e305ecf2f
SHA512 d919808fac4763b740e286b59db2beac54b623b38c474edb42ccce4cf14e4753c7917521afd4fde3f637633daeea985089d8bc9e71d111ebb9f80a7e3d597842

C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Narrator.lnk

MD5 73ff90c85c2a4f4259b175338aff2be7
SHA1 bbec18c4ed1137b39101b7501864eba2e0072cf9
SHA256 e8066111e95d4199bd4080e15fca45beaed591665c0174a23d4631deeebfc473
SHA512 96b34da518ff26fbac59c163a14f6df7befc375881f9a3895660601329dabc653d2fe67525aa9b1556bd9feb4e59133938fee31e583780c6e16e00cd19111497

C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Magnify.lnk

MD5 1e3171a0bc67b74cb1daf101ac3697f5
SHA1 c4d4d612bc81c4b24758ecd2ebec21fdc44ccb64
SHA256 86405363a8808574686f2a06b794b1621459bf346ebafa025aff552868084f4b
SHA512 16a86d581f765f745bdffb7c05eff0290664521ded16bb500b3bd2b5958acd95275c0f785092a3f4f507a61402a481e018f1d19b7893ce761cb7f955617be61f

C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk

MD5 4db8b347bc9ae9a1d0b532460d976913
SHA1 13fa894250d23af232e92e2b530a9e8e5526369b
SHA256 f4d062c80312ef7ebf7e7990c29931b8ac94618a5b39a4089e5dc42b99aeddb4
SHA512 b0554562b6909f1d6b0249627a22c10fe9c8af523c02cec617ea35128a0e0ca116e6a999692b53ce9d459105c2a62da402620189163fd2ad13699c6e18ca6557

C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell (x86).lnk

MD5 eb1835d55d2f928c4da36ff26e37aa59
SHA1 87bba452d8d82cb61c6acadda09a8c231db50682
SHA256 c8b48e494141d6dd1500c6aea0380e241f8042abfb170775986047cf61ee2a64
SHA512 67f6de6ea705ade4632d131d44a2ffc9d8712015e960c354a9773c6ec84ab24b2b2b1e4bbd292313345ec0d565966475b3c5fac510f2e4751061515db67d3636

C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png

MD5 4a30450d32bc8407341732553fbb0a50
SHA1 aae1c55b7e4a51817b9956e9b6d364aea54e8f39
SHA256 880422099bd744bc36bbe74dfc64f1f608bc92ae35cb0017359fc24c180a886f
SHA512 be947a06185a69b7033c999a09383672f213ab6434f55cd4f44b809e2abccc33714af18783ffd93bcf174d646ff365cec4e726280f33fe1fd5c87ef9444d14f2

C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_contrast-white.png

MD5 2601fbe604adc00a3c283668c205d375
SHA1 92adbac0c21e7d510591dbbb55c5b065f55f6047
SHA256 78a601fd2d7499fda61c160e4141672017fd5019da36f1247a8fb1a4f77f09f1
SHA512 3fb200a72bf9b957c33f9369c5fab52d82bb45a7e88fdc9d194d4dfbfe2e6c6a2cc49170a5dbd9c38f7c49db4210f687f1eabddc54569b9808b081bf0d4c0ff5

C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square44x44Logo.targetsize-44_contrast-white.png

MD5 8ff31026b019fcf278fe062ff42a1f9f
SHA1 c94de40bd7d745106c4d99d7740f2f3bfa885eb4
SHA256 a23bb626c15e6399f57df5cb6538cec44345d08ecdf0bb6002cea1c473867015
SHA512 df3213674a581daf4a46be1e71e946f2e06eb0f2eb92a023a3f86d949b040f548d18b18a514a73a624ee74f33f3e020a5b3b427d3f306bbce7254b327b21ae54

C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png

MD5 458cff5a7c5d1ee1c51156ebf11771c8
SHA1 1156a0ea90df555515f5eb8db5152eedaabdd96a
SHA256 1cd37b97f3ffd4af054c03366f10eb386704ddd037f8c52eb4ccf9c5327d937f
SHA512 04ea9033da7ea0f0450f82ab67385981cb87b8c0589fdb5af48eecb13935b61da37f85d1f50e6a01d934b1ba5b49c853fee7d1ef70b08456e111df3c944b6045

C:\Windows\WinSxS\wow64_microsoft-windows-onedrive-setup_31bf3856ad364e35_10.0.19041.1_none_e585f901f9ce93e6\OneDrive.lnk

MD5 057e34ab60d61f325982b48ebcad8831
SHA1 086cc1b0e7036202668bf5b7121c7c6fca93fd59
SHA256 fdfce2f5e42ed2b899cbb1d9f808b8584727e04967f1c8644a5f847708f6c598
SHA512 fdf4fd37417ed7b8cffc02695347b6ab4392708fb66f5ab5d4306091fd9afaed8969773b9edebda5ba3f38a22dfa3e255176275e25abe99d08df8186d806f28d