Malware Analysis Report

2024-10-24 18:21

Sample ID 241018-ecttxsvgrg
Target 55522c1da2cf9392d2258d90652114d2_JaffaCakes118
SHA256 b860589bc0c02e342d327a5be7a3cfe78f65f4ed0f67d06d6caa204b276add87
Tags
discovery persistence ransomware spyware stealer xorist
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

b860589bc0c02e342d327a5be7a3cfe78f65f4ed0f67d06d6caa204b276add87

Threat Level: Known bad

The file 55522c1da2cf9392d2258d90652114d2_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

discovery persistence ransomware spyware stealer xorist

Detected Xorist Ransomware

Xorist family

Renames multiple (2351) files with added filename extension

Renames multiple (2316) files with added filename extension

Drops file in Drivers directory

Reads user/profile data of web browsers

Drops startup file

Adds Run key to start application

Sets desktop wallpaper using registry

Drops file in System32 directory

Drops file in Program Files directory

Drops file in Windows directory

Unsigned PE

System Location Discovery: System Language Discovery

Modifies registry class

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-18 03:48

Signatures

Detected Xorist Ransomware

Description Indicator Process Target
N/A N/A N/A N/A

Xorist family

xorist

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-18 03:48

Reported

2024-10-18 03:50

Platform

win10v2004-20241007-en

Max time kernel

148s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe"

Signatures

Renames multiple (2351) files with added filename extension

ransomware

Drops file in Drivers directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\drivers\de-DE\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\drivers\es-ES\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\drivers\ja-JP\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\drivers\uk-UA\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\drivers\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\drivers\en-US\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\drivers\fr-FR\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\drivers\gmreadme.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\drivers\it-IT\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ld869rwRuHeO9Tw.exe" C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\et-EE\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\hu-HU\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetSecurity\it\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_UserResource\es-ES\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmsupra.inf_amd64_ed209c9a3da66777\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mssmbios.inf_amd64_9fc7fe03de136fc1\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\netrtwlane01.inf_amd64_b02695ef070d7a42\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\ntprint.inf_amd64_c62e9f8067f98247\Amd64\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WaitForSome\en-US\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\oobe\es-ES\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.ODataUtils\it-IT\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\tape.inf_amd64_bf051ca3546a5bf3\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\hr-HR\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PrintManagement\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\WindowsUpdate\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\c_battery.inf_amd64_5637e58e54fb24bb\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\lsi_sas2i.inf_amd64_b4e933c4540ad3cc\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\netr7364.inf_amd64_310ee0bc0af86ba3\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\sti.inf_amd64_096c9e42fe4749d2\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\nett4x64.inf_amd64_54eacac1858c78ab\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\urschipidea.inf_amd64_78ad1c14e33df968\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\ja-JP\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_PackageResource\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\MUI\040C\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\Speech\SpeechUX\ja-JP\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\Com\en-US\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\c_wpd.inf_amd64_0245a364d71cf6b5\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\hidbatt.inf_amd64_a6fa9bcee39a694f\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmtdkj4.inf_amd64_3bc71c4327f9f94e\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\c_hdc.inf_amd64_6e00e835fbceac58\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmnis3t.inf_amd64_9f214efed426c12a\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\net9500-x64-n650f.inf_amd64_e92c5a65e41993f9\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\spp\tokens\legacy\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetSecurity\es\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WindowsOptionalFeature\ja-JP\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\winrm\0409\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\unknown.inf_amd64_b8b0fe7bbc76405b\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\wdma_usb.inf_amd64_e879d41db6fd1ab8\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\nb-NO\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DeliveryOptimization\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\nulhpopr.inf_amd64_9839c838c72c0594\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\es-MX\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_PackageResource\en-US\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\Configuration\BaseRegistration\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\DiagSvcs\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmmotou.inf_amd64_8370fa408706074c\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\megasas35i.inf_amd64_4df7f6223ebcd28d\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\MSDRM\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ScriptResource\uk-UA\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\hdaudbus.inf_amd64_533c8d455025cc59\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmirmdm.inf_amd64_ba5b77b7d46bc10d\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\rdpbus.inf_amd64_05ebd3b4422f62ba\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\InstallShield\setupdir\0024\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ServiceResource\en-US\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\c_mcx.inf_amd64_fcbcc3807cbf63ec\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\netvwwanmp.inf_amd64_f9e30429669d7fff\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\pnpxinternetgatewaydevices.inf_amd64_82b90e51473d48ea\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetLbfo\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\da-DK\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\c_fscontinuousbackup.inf_amd64_4db9ca877f67dd36\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\c_smrdisk.inf_amd64_bbef253cecafbb1a\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\default.help.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_UserResource\en-US\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ikknaacffhkknpfh.bmp" C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\Square71x71Logo.scale-125.png C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-20_contrast-white.png C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-36_contrast-black.png C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\AppxMetadata\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\themes\dark\Info2x.png C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\NewCommentRTL.png C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\fy\LC_MESSAGES\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\1850_32x32x32.png C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNotePageSmallTile.scale-100.png C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-20_altform-unplated_contrast-white.png C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\Assets\GameBar_AppList.scale-200.png C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\RHP_icons_2x.png C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\es-es\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\it-IT\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\3039_20x20x32.png C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-white\SplashScreen.scale-400_contrast-white.png C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarAppList.targetsize-64_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubGameBar.png C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\ro-ro\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\bn_IN\LC_MESSAGES\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GamesXboxHubBadgeLogo.scale-200_contrast-white.png C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\WideTile.scale-125_contrast-black.png C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\OrientationControlFrontIndicatorHover.png C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\bg_patterns_header.png C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\pl-pl\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\RTL\contrast-black\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-256_altform-fullcolor.png C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\SplashScreen.scale-150_contrast-black.png C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\eu-ES\View3d\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PeopleSmallTile.scale-200.png C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-16_altform-lightunplated.png C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarWideTile.scale-100.png C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarWideTile.scale-125.png C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\OutlookMailWideTile.scale-125.png C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-black_targetsize-80.png C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\Logo.scale-125_contrast-black.png C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-20_contrast-black.png C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\BadgeLogo.scale-200_contrast-black.png C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\StoreWideTile.scale-200.png C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\ENUtxt.pdf C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\EBWebView\x64\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-black_scale-80.png C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-20_contrast-white.png C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\FetchingMail.scale-150.png C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\bg_patterns_header.png C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\da\LC_MESSAGES\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.NET.Native.Framework.1.7_1.7.25531.0_x64__8wekyb3d8bbwe\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_neutral_~_8wekyb3d8bbwe\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\fr-fr\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\it-it\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\HintBarEllipses.16.White.png C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ICE\THMBNAIL.PNG C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\195.png C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\ExchangeSmallTile.scale-125.png C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-125_8wekyb3d8bbwe\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_split.scale-125_8wekyb3d8bbwe\Win10\MicrosoftSolitaireWideTile.scale-125.jpg C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteAppList.targetsize-60_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\BadgeLogo.scale-400.png C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Microsoft.Membership.MeControl\Assets\OfflinePages\Scripts\Me\MeControl\offline\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\SystemApps\Microsoft.Windows.CallingShellApp_cw5n1h2txyewy\Assets\Square44x44Logo.targetsize-48.png C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-installer-engine_31bf3856ad364e35_10.0.19041.264_none_e15c1f0e12661737\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-qwave.resources_31bf3856ad364e35_10.0.19041.1_de-de_83b66c93b1b67629\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-pdc.resources_31bf3856ad364e35_10.0.19041.1_de-de_2c44c5daa3200302\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-setupapi.resources_31bf3856ad364e35_10.0.19041.1_it-it_acfca3ffe0eaab8c\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-xbox-gamecallableui.appxsetup_31bf3856ad364e35_10.0.19041.1023_none_f79b680f94668688\r\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\x86_wcf-m_smsvchost_exe_cnf_31bf3856ad364e35_10.0.19041.1_none_4e866ffd000dfd40\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_amdgpio2.inf.resources_31bf3856ad364e35_10.0.19041.1_de-de_5e26512b8e6d8fa8\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-a..xtservice.appxsetup_31bf3856ad364e35_10.0.19041.1023_none_c429f54b07aa1ba4\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-directx-dxdiagndll_31bf3856ad364e35_10.0.19041.928_none_944996301d66c5ae\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_deb6833aa5253e60\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-winsrv.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_963d202796c2872e\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-storagespaces-altspace_31bf3856ad364e35_10.0.19041.1_none_9cd773e8b774f780\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-healthcenter_31bf3856ad364e35_10.0.19041.1_none_6ba2da093792c423\SecurityAndMaintenance_Error.png C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Presentation.resources\v4.0_4.0.0.0_fr_b77a5c561934e089\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_dual_cdrom.inf_31bf3856ad364e35_10.0.19041.1_none_38c51c6c3f324b9c\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_dual_volsnap.inf_31bf3856ad364e35_10.0.19041.1_none_0e763473c963a110\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-h..learnmore.resources_31bf3856ad364e35_10.0.19041.1_de-de_d11b99c14f1a11a9\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-m...appxmain.resources_31bf3856ad364e35_10.0.19041.1_zh-tw_6470ac13a60309c8\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-s..voicecommon-onecore_31bf3856ad364e35_10.0.19041.1_none_eb3285727ee1b51f\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-hbaapi.resources_31bf3856ad364e35_10.0.19041.1_de-de_9d9e833314ab34a0\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-p..owershell.resources_31bf3856ad364e35_10.0.19041.1_de-de_f8317cae66c8aacc\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ivesyncprovisioning_31bf3856ad364e35_10.0.19041.746_none_770d9b7d4ac47893\f\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_windows-application..cts-winrt.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_15987d372575fbb7\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\x86_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_10.0.19041.1_none_6fa7e5bbaa15a17d\image1.gif C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-s..taservice.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_db0fb555c771b7bd\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_ialpssi_gpio.inf.resources_31bf3856ad364e35_10.0.19041.1_en-us_76ba7f51e7cc24d5\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Presentation.resources\v4.0_4.0.0.0_de_b77a5c561934e089\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SystemResources\Windows.UI.ShellCommon\Images\NearShare.scale-200.png C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_comsvcconfig.resources_b03f5f7f11d50a3a_4.0.15805.0_it-it_835d3ebe385afa54\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-l..alization.resources_31bf3856ad364e35_10.0.19041.1_en-us_dedb4a4b06dfd99e\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-spfileq_31bf3856ad364e35_10.0.19041.1081_none_f4196659a93ddd93\r\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\assembly\GAC_MSIL\MMCFxCommon.Resources\3.0.0.0_en_31bf3856ad364e35\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-o..tiveportal.appxmain_31bf3856ad364e35_10.0.19041.423_none_204af7ff19532470\r\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\x86_microsoft-windows-mfc40u.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_a63c154de6e4156a\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-c..ngshellapp.appxmain_31bf3856ad364e35_10.0.19041.84_none_24f8aafdaceaf0b5\Splashscreen.scale-100.png C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_it-it_9f248a35f7c12459\404-11.htm C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-mdm-adm_31bf3856ad364e35_10.0.19041.662_none_d7bee5e4f553489b\r\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_system.windows.form..alization.resources_31bf3856ad364e35_4.0.15805.0_es-es_8bbd3a4535e2eb12\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-usp_31bf3856ad364e35_10.0.19041.546_none_95486a60ebac6ca0\r\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-d..onfidence.resources_31bf3856ad364e35_10.0.19041.1_de-de_67e161fa2b5f0735\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-help-client_31bf3856ad364e35_10.0.19041.1_none_22099da5cd743768\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-ie-behaviors.resources_31bf3856ad364e35_11.0.19041.1_ja-jp_4a7e8ea9a7968b76\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-c..er.appxmain.ratings_31bf3856ad364e35_10.0.19041.1_none_ff46bbc9afee54c5\RatingStars43.contrast-black_scale-200.png C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-ratings_31bf3856ad364e35_11.0.19041.1_none_b174c6b066f29f19\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-wlanutil.resources_31bf3856ad364e35_10.0.19041.1_en-us_19ec72bf503086d4\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-proximity-commonpal_31bf3856ad364e35_10.0.19041.746_none_77b18ddf81476f08\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security.resources\v4.0_4.0.0.0_fr_b03f5f7f11d50a3a\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-securitycenter-broker_31bf3856ad364e35_10.0.19041.1_none_1130ced19cdd5598\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-w..-provider.resources_31bf3856ad364e35_10.0.19041.1_es-es_b0edcf692b0fdbdc\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\v4.0_1.0.0.0_fr_31bf3856ad364e35\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-onecore-s..chservice-component_31bf3856ad364e35_10.0.19041.1266_none_2262e67641106c48\privacy-icon.png C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-microsoftedge_31bf3856ad364e35_10.0.19041.264_none_ef195f564f00d259\Square44x44Logo.scale-400.png C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ovedevice.resources_31bf3856ad364e35_10.0.19041.1_en-us_76bcbd669813aeeb\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_07787dd7ae0cf4f6\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-o..ct-picker.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_c99b8c8b56859548\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-n..k-qos-wmi.resources_31bf3856ad364e35_10.0.19041.1_de-de_fb4790c5a958910f\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_c_volsnap.inf.resources_31bf3856ad364e35_10.0.19041.1_en-us_f10129f07919aaf9\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.19041.117_none_e0d32848ac56114e\retailDemoSecurityInclusive.html C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-w..vider-exe.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_8cd52ba97d780ce7\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_halextpl080.inf.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_9d7f4d616bbc92f3\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-dims-keyroam_31bf3856ad364e35_10.0.19041.1_none_1be9cfd6015b9878\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-d..vices-sam.resources_31bf3856ad364e35_10.0.19041.1_es-es_ca3ca8d6defbef0d\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.CryptoTorLocker2015 C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\KZXBQDZALDHFNGD C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\KZXBQDZALDHFNGD\ = "CRYPTED!" C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\KZXBQDZALDHFNGD\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ld869rwRuHeO9Tw.exe,0" C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\KZXBQDZALDHFNGD\shell C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\KZXBQDZALDHFNGD\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ld869rwRuHeO9Tw.exe" C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.CryptoTorLocker2015\ = "KZXBQDZALDHFNGD" C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\KZXBQDZALDHFNGD\DefaultIcon C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\KZXBQDZALDHFNGD\shell\open\command C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\KZXBQDZALDHFNGD\shell\open C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 22.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.27.171.150.in-addr.arpa udp

Files

C:\Program Files\7-Zip\Lang\HOW TO DECRYPT FILES.txt

MD5 de3a3b707082b03731cd74bf977523ad
SHA1 a9fcbea5239c1b8c0597c784603f3a67fcb1ffb2
SHA256 21efc99273c3b60e01b4df75dc2c96f8aeca13df0ca77374b00a2368812db6fb
SHA512 b7196c3be7230914ac2378574e3b72c9a4a4ad17d36d40a5bb93eeb4d50be72a94e397a8fd568426db85682615e2522ce1a9a4a95b5a73e5633099c4ee3ae6bf

C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif

MD5 57a830c949e2f06785a8262b23c8a733
SHA1 083ad85c2dafc16548b7f05141b888104414d379
SHA256 39f6ce804e25ec1131c30085684d368808b793a4cc71641c76912d84038f6fc4
SHA512 711cf475f6573ab7b07d75e460ed61684e703997c1fe3a42cf52dc6cfa6de6e19a8bf6a44c17579cc5ee9eea2a086d538a2227c798ec1d371588f6ccc33d92bb

C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md

MD5 04a8ce61fa75f61f12c531f777acc1b7
SHA1 073b5c13535329a7de755c74b1ed7e4a84209979
SHA256 e4ad0546626e60fea85118b12c465bda320a2654ee4292e37e87c3180781f008
SHA512 b784aa17ec8909071e254e27bb49a2009fb523064cf0568358a82bc3ef6ecd102d73fc957fac025196863b3edcc6a9e61badd0c6b5080d14568a50bd412787ea

C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md

MD5 5cb5710b38d8a3e43d9ae4d13b7d2224
SHA1 b51185b65dc7fee68d76bc412ab92c600f4e8f27
SHA256 ab7936b9287c2ce80b1d35c5c00c3ee1c4db706d73e4f2616d5517cae71a1c69
SHA512 7a50ed573cf100e65e9cbb3a0ad4cea81159e9fca0b0365ba2ba56d788230c86616a8f73afdfd091b1e7f9fc837db735c095ea33b797d4b3d2dbdf909bb09e81

C:\Program Files\Java\jre-1.8\legal\javafx\glib.md

MD5 07762e3096dbcefb6a0afd6808111210
SHA1 c19e5120484b34048059e51a9a9fde2f13be0316
SHA256 49dcfe7eca65b2418448ec7c3fd1aa69241cc1ab6f7b005031b43c0fea5f213e
SHA512 9c66b7a3245243686594ddcde22ed91a75837f098b789eaec0078e1f91be69cef1cd863c5b053c5ba7503c9e384da4b2b36eb81e1e9f9b97e2cb25cb75cd5bda

C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md

MD5 faa83b4c11f50f82f441b8fd6035e35b
SHA1 fd7ac9d667b74886210f4840461e8a6755df4c20
SHA256 b37d86a3d5a640959d61d0fca422b8b65d54d588b671dc2103e62f598d34b11a
SHA512 79ca159ac4ea32a7d101ed957df23854c36ebd6332ae9e81783238c07bcf07c43f9a61a2e9c236e4cd8bfb5ffd09b0740b6402e27003ad899d5c0f0e2e936a75

C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md

MD5 2ab6accd01fc32b10172c8b3d628c157
SHA1 4d1e8349ee2da451137f1b9b48f65e86e22ef851
SHA256 2d420dd69dfc2b7a809df4031de6d8f52c3f9230838c8da82f90d535fc02971a
SHA512 270be63c75ecfa63f8276f2b438c777e6465034c31ecc3600295b60c8dea37c1c96eba076eb99b9d56e5fb2db8d4d51cc4d55202146715c89ccb7c837d141f07

C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md

MD5 c30b94c26355a285148c70ba660358c2
SHA1 5012662a17ca464e1775bd36c1a46d8d1fbd4a91
SHA256 46e8d82e52a47e6a19264c9108413318a0c5e0e8d45ee8aa7ba5a7903ca4f9d6
SHA512 8dec8ae02daab8099b50610467708a143915b5a5728b34b2679a9557829c8d60c65953063194ff4a90b101c0b2442ef048ae65eef70a87fd97a040ac8d134e21

C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md

MD5 9a206f8efdf0151836d8c24befe3ceb5
SHA1 f9d4ed63d985aee593ba770cc5580672f587b9f3
SHA256 cbe4ce4899ca9ce60e25b4cb07eedb366cc136eb93a4f974d4616aad81046a8f
SHA512 b6ff10f80f43513e547c40e1cada5fdccc7f1464e4cb0aa16ed4d6bcf33744f3280547f1880ed05cd807e6004ec20ced0b82ccb11f6d5dfd6bc8b91166a255f2

C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md

MD5 45fcb40f7d0e3ab2a89e07340ca53bd0
SHA1 0583b4062610c40107b95cf3734911733ca602d5
SHA256 2c1ba4f0e94179ad7e8fe262c3d98275e28e5b6d93a7cee178d5b64a4ae178ad
SHA512 87f9883a0186271aa59a47d60c0eb7c7e2da5af4452141f869105b8a9c5a79b8e113faffb65c81ecf7940cd1a6f7382053b5cccbb1dafe40980e88bd8ff70737

C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md

MD5 da31ca1bcb76820d945c436f9cfe0951
SHA1 ca36dfdb7e4cb99a97f28c1f6aba80bc080f6f0b
SHA256 4cefb11c36da6d2a55c999fb0e8116f820977d12fe262ca6c09998627bdf712d
SHA512 3643014ad94fbe4710c2e40d22306677e6a49ffe91a4c184827126c766146cbec785a94161e19f0215a42eeed848dbe3138b01fbb6a8195ae8915a9064e78713

C:\Program Files\Java\jre-1.8\legal\javafx\public_suffix.md

MD5 6e1874257dfa17a52423b10c18d00bf8
SHA1 b9cb9780850bfe88d5b9853eeae55a99bd39327b
SHA256 d61d944e80fa09728de363907848315e7c5542b07c5af1bafbc05be47d30ee81
SHA512 8cbb273a580bacefc9e43c2c0a31a5514d2368c7f97eda26a82f0e2a95433784763d5868e85bc5e4159be64083136726d16a22cf65e715095db2cbb4859e4ed4

C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md

MD5 930e367e023e6aa4ef165f55f56298ff
SHA1 df57e904fc9ee0142da40575d8f2cecd40e341e5
SHA256 0169a18e1b7f68f0aafcfbb170ed1bcbdd41c94a6bfa81aede07f8eb091f814a
SHA512 2771c849147693e73b67e18e0d1a3e0ac3384e1cac9b4a4ac0418f13bc7e6d27bce64d40b70949c27da42cece5f7bf29055a923ad12d272160ba98e47c30f7a4

C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md

MD5 c30643dc666b001cb5abe4744d014d8d
SHA1 d0faebbb2dfdd8adf0ee7c67d3aa4d291f8291f7
SHA256 2482d58d9a898815cdad4f123c24f6dbb0a67750526dfd118e8b8a4156d29fb9
SHA512 edce834efe74c1cb96eac584d2e757f3415c2cdc0a75132efbdb99d34c9dbdba721e33ba6cd182ce6460bbe8e1f7c213b21887b91bfe7c30b468fe6cd9c0aafd

C:\Program Files\Java\jre-1.8\legal\jdk\icu.md

MD5 e322dfb7a06dffc8defb32227a1b3b28
SHA1 9ef5931ee85896870e68e1415eb6b34ed4e2c888
SHA256 f7644ece7b6600169d5ba689c3e0c02ee563374a341dfb02895cca5ccac2397c
SHA512 8e6662592571c9b0715e880ee330b75670d8e802d81b5444e298ecbf5977fb62b5585e11538f48e51a869a504c83829b21668cff85f88ef36affa5917b71daab

C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md

MD5 26f52d3220badcd298f500bd42e7cfd2
SHA1 81e41c7eb3fd9fa4c161245b7617353531f87da0
SHA256 7fec6070785587cef474c8d61be4029f1f32f067b60e54169d1c5417e271472a
SHA512 15707c08249dac9e64fe7b1c86953c9ead321a4f33c6a82d3e75b9a7ebf869791dc372c9896f2f6a52427e299cee04e1da5f957902a8f978b7164f790d6acd67

C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md

MD5 a00e529fe9129b1e7650a01e533dd70a
SHA1 07130515c586d71a234570d213c25e49ed2f137f
SHA256 7f26480c9363ac518a07ca7729d406176d3cceadc8df32a08eda6efe45249ea9
SHA512 e58809d61bfe4e7e3c7a4c0a63450f44038c0ebb7fd3149a97bc8bea558e48194b3bca13da827a438baebc044eaae12a03719dd1c4b5d0a3aa79a5aaa32c2fa7

C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md

MD5 b17fae1535a10739c43a47a040273d9d
SHA1 9fd5860de006e04d80fca667b809a89956a6f09f
SHA256 63e3dd9480e231671381c0dc2b8a6f9bccd19d4e96f675dc2ca1c3e2fbfd1707
SHA512 9b6c89b46ff81cc51e6e8addfe65bc47cb37c0a19099fa9e5bafbe8b1bf3f01889a15b237def41d783b0df2ba723b7d40d75769d588e9600a89c9803a2d2464e

C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md

MD5 d7e82a7e2ad7cf2adb089bc938a6f28b
SHA1 6e7730ea3bbe201fd253a950b32acc6bcdf09d28
SHA256 a0ffc0436bb31f94250cc29034231a8f5f04589015719568c1a52039bbf29a9a
SHA512 d80ac23a2e8a2e96ec9e64711e574b872b1b79a9151e1f847053e93ac69653acf2a4a80396fa2da1c7d445cd73f2fa18366306a77fa63f25dd8e115ed81015fc

C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md

MD5 094ee3ce3f2ad12eaf390314d9cb0d5b
SHA1 3c8d37e8a7e826432244bf0ac188e6071b744687
SHA256 94bf7d5541db615a1f64af1a00ec81f6545109f1579cab99774ffa65edafe3cf
SHA512 68042a5611a299a260cbf60e964558688967a7898b0165e456d1addcb96d9991ec7440cce2c2b9213cd9751a5ce48c70a17d84a21c74ffcb6905bec5fdcc4709

C:\Program Files\Java\jre-1.8\legal\jdk\libpng.md

MD5 2a4fcfc629c6fc856e89a6c42e0f22ca
SHA1 e928b728858615e287f64582b821fb28e976e720
SHA256 e5e40d3e00bb89e8c817ac12b82fb1ff35dbeb74b1a04d08976112d44cb0458e
SHA512 162db109c2b28ecedcf7567b4eb4ba44fa31c1d63523a443f0e46df5bc86d5ee27ff10bf8b5fc938b2beddddc0854df24569c442309f2f37f67495041e8730fb

C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md

MD5 4a60ea55227351845ff44606c0406f9e
SHA1 c439a01c8eb4f98ea27f57b9e63950ffbdbdb5eb
SHA256 100c386e5f190d4be95f2e249df4261a85c9812fce9b780303be0f986abb3bd7
SHA512 bc06b461685395934ffc44100cdbd284bf3f2db0ef09321f10558132e4656c0da0294d86f641f95c1ce1aa0036fbb57023b83dcd6fe6812d3cdb5353f0056594

C:\Program Files\Java\jre-1.8\legal\jdk\joni.md

MD5 0701acf83f43d24661cd80a1163bd8ba
SHA1 6f2f25c092f7154a93eaaa5e2350ad73e5e3f366
SHA256 c81d94df4efb902455e534cad0298ffc064410c84ffbb719b2ad64ebc0124edc
SHA512 fd94a08c899fb55652494991be11638f316582f491d6a2da4a529586814d27220f84d889bad628ebf52e94d23b1ad59c1aaae6b71d6802958990afa735237b95

C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md

MD5 91d59e106e864aadd5bac2d4c4a87edc
SHA1 c64de7ff0fcebea81588b4a5e7ef7690e71f9a90
SHA256 83e76e85d09e470e6154d670496eba031a928f175d85732802ae3f9ffe6d0f6e
SHA512 6e8abbd6abd8c300fdaf9c6b49a797ca954c034194e644124cb6c290c02777367fe667aa40af383f5535c1eda9cbb34fe43ad4a28786ef7b96d8d56f82bc163a

C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md

MD5 dcaa84b0934a8ace5f16da2b3c8f675d
SHA1 2ea364cf7bf9156e853d1c451d25e5429596db21
SHA256 3471becc886dbe7bebe60b414c5dde7ad977bd64c8b870dd405d12300db52df8
SHA512 87f931a2104c3c371391e1145c8a72e3b1a1b194d50398f58ac1a241214d19d778ec452ce5017369524f05aaac866e05edfde1bfc48e9308cbdebf6d22b8f8ef

C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md

MD5 f51e873763d776412d5f174b6ff7c7b8
SHA1 d277b4fb5f3b8a82d5e22ae8fb484d17c2ec440c
SHA256 564937d4b0cf3ddea6ca6f9395a0337b35ad824f3c10045a6a8812ab3b9f3b9a
SHA512 e25b39f684ae014c94f2eebda9511c15a92076e9485a8b1bf8236172be58aad7e7087034cd2442dfb7bc8e0c324c8ae4fbe40afeb577034b09d89e1a62fedede

C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md

MD5 55322f2a6b9dd767cd92ef1b87f42b49
SHA1 b6234a0a0ff5412eaac83ec7b653abcbfcb68ef5
SHA256 4e37644f07d24fea40bc88221dbad907218195a9a499a617727381e13c0c459e
SHA512 09e5a20ccf277193c54a53bf47db088cd26facfe417a94d21a743b0f9602a0c2fbdc4b7aa046654ff647c8c9b958297e25fb4c995231e168f3ed8f2242caa63c

C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md

MD5 98c531026bb4cf4ea4d379b4157b18e5
SHA1 7944d589625f11484b338bbaf308be5370b16201
SHA256 107f5356e9374b9307842dbd484d5ddd15414f157b9a5b7410348fb978d27fcf
SHA512 305ab24bfdbca49f6b655db44268f4873c792577d5fe10f5d7bc1a7a5f5d857e13df2ac547bd2284e320145cc6c3c6c6424679cbd92fdb0f972819e6ca88bd83

C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md

MD5 8b5e41856805bd4091c2445d95698569
SHA1 6887a4a567b0f6de5f5077d6b4b1a83949610198
SHA256 1133d919cb57c1a762cf4be00f1718874892cd818420bde76b60285816e4b713
SHA512 f48d60e9397e887ed69259c53e4887d71b5a4df3f566406f9b7e3dea5aa67d0a517d7680008a9070c65b824ff19fe663df4f2ababa1a9e9989d641ac6f62a88f

C:\Program Files\Java\jre-1.8\legal\jdk\dom.md

MD5 9c232d293cd967ada7cad7837b7d87e9
SHA1 ec436894f8c92298cf15dc7db1bc1f849038e416
SHA256 726701a5d3c051b108052737b652763b1417a29cd7b62759c22f820155a69a0a
SHA512 2538bafb450c71f0523b31af90e9e48beaf69b37abbc267525013eaa8b7531d70d5462a4d208326b55da939cf00815c138e8ab1cfe91b04a0a2db1071d0696b8

C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md

MD5 61df05eba895837c555131f857605d8a
SHA1 afd51ab5686a6e156d4cd46b0f4ba453de2ba7c1
SHA256 1d175404349444c3c2d30aa6bc1d493ef8271f6eb10dd7e67226b791bdf0fdbf
SHA512 d5804ef3c2c8c223aeb1335f2400b0606a93d5220537722622ddefc94f6a1956bb5b3c8009c178cdc55fff600533845eac3f495a80497a5dbe37c773f99eb5cb

C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md

MD5 be4ae324e81bc48ce5cd0a1e6e2e719e
SHA1 887c18e7f08301d4f402d9871383a990e34ade3b
SHA256 7e7793ed99353fdc5e680171e0741137a59a2b7c0d0030e59f151c3cb3dda84e
SHA512 b01d4befc11e3eae7b863be6b3b722448d464157f1f57690c1c0eb8296331cc778705ea62c6ad017c21bd109248574f88010cf709664b0a1f519a1cb0e781748

C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md

MD5 7211cc4b7843aaec13b7f5e7f0739039
SHA1 c4f023b699465963dc53462d3c96221f22ee42ef
SHA256 87c86ee6646e90d393877a9c109317ee86963357e5e077115b25388372cac3f5
SHA512 4479a92e5dae21b0b56c7d6d4e292325038935bb200b78ecdfdcfed3e1662afbc997176040d00e77611c8f08cd7eebcd9334da38d2d90c00473fbfe9796b59c9

C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md

MD5 5b683eb27d0f8059b116bdb01a2613b4
SHA1 27e0eb2cc45dd48dfbb1e3a3bcd70eed4495e3cf
SHA256 44a8b590fe69677c1ae2ced372e0add1df4e9fabdd8209fd8db281dac2467dd7
SHA512 93ecebdb98589fa8b8f1c54e88f27f533272899e8aafcabb269181215b91a48f912d7ed88ca95402c47616bde89059ea5fe1e7a98e9825db2e5e0479a8b5b50e

C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md

MD5 903c3067e879eeebcfada2b0230b0fab
SHA1 7f61e8ef4a12bee3d501de379d2d04f815613200
SHA256 52aba23d28f9cebaa58483ebfb63e94d6a604f041610cec8c99da5cbf9c12dc1
SHA512 d4fa9e9397e7d9962203ddb5d0c9ba36b3a23fc632ec7ed81bfe43ff591545b9351f48c5371a92946b51b8c7037b33ed1b8a72fac3dc4b5a6d9e4d4eed8753ba

C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md

MD5 b9d07358e884e418365da008be0238e7
SHA1 4045a6bf023f5dc7cff29bd8dd0f15ff2012dd89
SHA256 13eabec8c8900dab5b533a375432e2bb203f86c991cc3b1255ee4a77089a855d
SHA512 9e85b6458996adb6b0789a21eb1bc0e106e8ea2f9247ca6cc57ab58e2fc8a2a78c5bfddce3ab9ac12b783f78e76c75fb9eabc2a06d86c25fe9dc609ac4188c60

C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md

MD5 3961a18ba8f3d775734f2796bbaa66fa
SHA1 85d1a2344217ec330a3e2cd8b14ec2a05e383f13
SHA256 ab6ce8a3a0a7b056f30448ed7a8bf9f05cb7de015fc831585d2061d42b715193
SHA512 4ceceab05621cd5124d0055358eb10f1c64634fe224a1f0b9ce8a0a90e95b9adda2ec5e1528bd56c46c23333096d84f3af671eba26ca191f419d0edc8227b08b

C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md

MD5 1a564286a412b036d96a6f4536e21736
SHA1 13403dc348d4842c252fe6188c47bbbbf077a2df
SHA256 515a412817b0cfb996d2168bf284d413e8892ed29e87167f29d2d54516891ca2
SHA512 906aa0647ca12b442c31068a31d22181f3ad95432117300f2890f578b9ed047c9e737522e65d4ae97c1e708c317dccdb9115ba821d4fb1d278c8a1a4fc9efef9

C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md

MD5 df2fa71228a6c5da22956cd1e84949c3
SHA1 edfcc85fdddd51a7957695f3d069aa12587940f7
SHA256 6979015762ec7633fa67c5643d0083329196d782ae03a95bb3016db2588ae001
SHA512 b49fdd34daa57e61098c7366b0075301795d06d1a55b8ed75cea4adf9a8a99506e61b23ce69ca9945e55144a940b27ea5ffff131748abf248ab044e63b1f2d45

C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md

MD5 cbfb64ffab50180b397fc2f6207dfffa
SHA1 41020872384f960c18379275f588d3c8f79be2b6
SHA256 720b571c7cfdbeeac008430d908d4fb5a7168be397ff4699793fb716f45046a0
SHA512 cd930398f5f3d040fb091b398d618f6a4516b43c61559ad28912ed964e2bd21cc1c414f6f2ca912f3c07af6fd073d8e9422950be148a382493cacb738d9ed295

C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md

MD5 3607c7b46ad79f22f3b864fd3bfd5a72
SHA1 a78554f47c43ac5c375cd576cd39b1057b1c34de
SHA256 fb1645d52735bafce74756a801b57a501a658b61ccd934f6a4caed4918ebddcb
SHA512 723ad89cf4f6a438291dc0b92df9f33ec56f60e4f89bb95553a4b372f737c50ad29d4611c2a436cd045ea526cbc55895dc306930280fc49a07118c27f192bf0c

C:\Program Files\Java\jre-1.8\legal\jdk\asm.md

MD5 e8e2c9e30dc676a97bcbf4e9c81781a4
SHA1 86ae68f9ab22a60e7ef9877b0b3feb7dabcca68d
SHA256 9034c76a6050b2d15d2ab7d4078484fcd2bd5e4c1d420e43e1efbcafcb2c5d65
SHA512 28a08269a58615ab1bc9dea21ab1d11198614ee774a6d73f70518d8d3c1784c9c2e12c7b2de1f60b2b92f6c517f89951c4ac166409925ab9c77a28bf8ac49022

C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md

MD5 dc92d60dbbaef2d2bcdfcb8d0f2e5d21
SHA1 dd7a55a3a8e9c0982e24e364472d24b9211b6bce
SHA256 9c56904480d7756bd7850ad2eda2ea1320186414c905d31b129939b5b040e714
SHA512 4ea595ce95f8c23b7d8e642fe95be96376ae5ff71add28799176ff1d32631894fd42f00e8a34155cadd1d57e1955bd6a59e4b299d9ffff8404ed8279f99dd51f

C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt

MD5 c87fe9db162768b6c0381b4c0c2bbfee
SHA1 7e30a7a70c0d18323eee4dc86adf90e8f2c49008
SHA256 e9d3302f968c0e6fa517b253361d89795c88d1fc9ab8865543407d8a9377130c
SHA512 0a70cb48593c0d87e3024c40f143f3b331adb2c0d658179db2d96a59f98fcbba7aa434e12758edf2891e000273cdd42c52c6f76fa9ebb599ab56377ba4d7a6f8

C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt

MD5 4ef9eebbb5fcf838be7d8935ceae2c78
SHA1 d997c714d9e68815408ae5e9b385999801c93305
SHA256 df3f97500c1346561d432bf762f0836f29f36b041db2e58d3fc732add77a556d
SHA512 069535d0e305c80e2c299fb008986398250772528609c14055a2078abfa99c20b5f863253e866c3c51504cefbe9a24cd71a3112ab2f4f4b35e827a2af08f7a0e

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\aic_file_icons.png

MD5 0fa655a02c7758444963ca8e589e2abc
SHA1 17e4e5229c10bb21851f775ba997ddbddb10d021
SHA256 6dd73094b29127c60cb6e497ff0751c475de206f56000b45b5cbc93f72847a82
SHA512 4f92bdf7dfe4b0960954a0b7735e8ba988eae182ac928435e213db07bdf964e369fcc562e471f304f54707b5012766991c7cf433d2feac7548a496a23f7b2af6

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions2x.png

MD5 bf3fc563f901fa333308d461bc6abd82
SHA1 a8185e0a2377c4283f24fe3432789b5700f83873
SHA256 a8029026f9ebbb833ebb77b4bd2c013d59dd511c04498e226a0f23562a07a714
SHA512 9c2442576aafe33929091559ee183fa573e95c6d1f79d92eb066a97b7a2f1c314a1d5e3798bc6ead7ed8999f552379852a2de84142520309343dffcfa78f4ca4

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions.png

MD5 1601e33519cc534894fd53ebb49e8fb8
SHA1 eeebeb8992a9dc3a0f657d70cdb2d95aac5b629f
SHA256 562687736cd82d295206b367166bbcbafe642cffa5291647e76302d0d027cccf
SHA512 0974eac42017680e31e50ad906171f4baf51748764e1efa7d1b0a737fd2bf41b02007ae5c403b37c33de65fc589406dc0de13f8f6c5e41b1d7f9688ada6a5f03

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons.png

MD5 d60efc3dbb75ea0839a94560d9a0bca9
SHA1 733af187ed2cc49ff72241556f43a046193242c5
SHA256 22e93d1e941186920fbe0c715718b2189915b99e5523c0c7a37690a9a5547389
SHA512 3984262726c3073a52b36d2dcef2f7919092079e2417f11e5187a3ab0bb9e5dcce9bb5ba07fd1a42af21d75370b40096efc4aeea72753dd52cb5648c4d06010a

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons2x.png

MD5 a2beaddc3262ec5294e4bb036c549974
SHA1 aa3dba819abf679387943d813efd47aadb9f95a9
SHA256 468b6214e67f42219e2e40ceafff1f616ae1a8c518d1b6c5825fb5e95b71d027
SHA512 93eb5555630121c9e2cf0bd1973b488cf4ed3b9641cf94719376868be72edf4c250a98d2d99baa5b951b96c053a577b35377188ea378ed0d30e0e42780cd72ab

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon.png

MD5 4f12872e2943cfa3ff22a132cd094184
SHA1 d5a6095f16978237a3938d4e300ffc7f0978fc4e
SHA256 ac0cd6b431ac7d09c639d48bae16b6dbb14dffc088bc1f3b05869e4813c12829
SHA512 5545b16abf79faac2b37e943442b8ef5fe94f97f0442239602d969e51954ceabf1abdba073a204fcd96a44cf45bfde1d67bea174e90285f3c31831ab7262d97e

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_2x.png

MD5 0f2ba6537a2906a18d33e655321ae77c
SHA1 59afe58398d3158e304ad192592ec520a1a45a14
SHA256 a820311f8bbaedb268ced7dda117c8bbeaa4bfb84bcc68f897e73d71b91b2f67
SHA512 b3c80e9a910eb6e1becaf3e22fa762192abf765484a46877a96ea40ca78e3a8cdb0571813132eeacfb50bf09d5258a686cf58608a8d8277766dfdc05053efcf6

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover.png

MD5 97b0dbc55540feaa048ad1037d8f0b16
SHA1 355009b817999a85bca748d411642eaa05e6aa94
SHA256 bec2e7f99031fb567beaa48a4cdc8794ffbc04b9badda30c947830b2b898e3dc
SHA512 53c5bf6402b9db02454816eb6f56374bfa85e0551e78e44c542c100e1712b249bbc8e3954e4dc685e074c68070f8a55326e2854c2248b52a940eb578489c80f5

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover_2x.png

MD5 4acfcf4778305c7e9d6d11b5b4ee2ea0
SHA1 2a39120a7116ae6d84bdc448299576e907a96f57
SHA256 28e0e7f31748c87e14690341dd0ccf9ca0c7ba46c6d9c842f1d23e9e43148b14
SHA512 c16588c244610e9ce640306f973e7f6efdc6212cf154518c15ff1c4d49453a20d158c4c2b130cc291ccdb3b3b7d3d75db489c5585e36578ddf6a8ba1b901d8ca

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon.png

MD5 0f58b3f8534fd896bc2f89183a831b44
SHA1 fbac8ef53f0ed61a717669e8371a80ca18f4c29f
SHA256 39c17b6666c25f45c9ec66a528e972cbe8e1e13aee5711320e84c97d2271898a
SHA512 fc48a1edaf4728a6ede52149177d0836ae705c529a189888374dc105c82c615117dc19b6104f3756f941c2347b83f5334b82bc3fa91dbec1fcbd0ac09f0fea64

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png

MD5 905ecf6cbd64c6fc6e81631671664bef
SHA1 1088d4a19d7c8cb8ff66d4e6c7118eaa7cb354cc
SHA256 c693b8ff139580dbcd84a9592946ab72633e9eb4de339fef127d34404b93e409
SHA512 6f355fbf692aeb5795a18b0eb66692c495bea19246cf1ec6683eef16c57ec7d3eb3a176d802cb96f98eb51d7340db9d5ef6271c2a277ce8ec1cc4a020954c81e

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png

MD5 54a80ae71328fcb35771a8e9bef09bc0
SHA1 75c9b36b7b38858d8cf47d5b2698b39e830d88ac
SHA256 6c783d7f8665d6e618f4dbcbf32f91c2acecc07c9523d8c830ad914da957f875
SHA512 ca32b7058e0f4a5c2ef9d2a3d32269ab1aff93ca4a5a5e1059d6ec36b3890400e5dd2693ea3bd58a57399de401fe7b0ad41d5245cb55b086323c974deb3affcb

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover_2x.png

MD5 6db3f03780f83f5c9abf129781434254
SHA1 857bec99b1c7dd55742e4511b241a683e1294ea4
SHA256 58cda660a59c46b018f349f060588f2bb45dfd92add72399b69512fe57775cde
SHA512 5801af98a20656495eed59bd0f3f349439d00424e2123c64692233ad836d3c6d3509b52c486302026a85afe0c4fd5462a2f877b4f9d843ec12c3e7cfbe292a70

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons.png

MD5 89a37c11b34b59f32caa821d889dafa6
SHA1 6d2e8eef34e29529cd500d73b0015a3e97d6640c
SHA256 ce1f0f96597cb6eb2c20011e790c9b4b76b5190e79998055ecdbe893b0274f99
SHA512 43961533aa39c69494ae90a52e4dfc653839ae200042267c0814cb4ca2399df85668976a18cafe8c182cea8dc7be740d1398a3294c25ebbffb4655820143def6

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_ie8.gif

MD5 3d4c2243d7160964c123a06dd7b912ae
SHA1 8bbc60fbbb9f8f91d11d2b4000e06f9a7c030dd7
SHA256 f7a5f784ef3843900d87524a12dfd1663e778957ed3b98404e5470376950eba0
SHA512 f06dc8a731355edb2a2f469cb1534b9ff4df856cc75483af610856d2def7d5a2de36c9bef29edfd16929192fae6c67a33262435618f30f139b9080675da44174

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_retina.png

MD5 dc5845467e9574d6a00a3305143bb533
SHA1 3d22c371479eb1e44377c47f01d223ac08de92e5
SHA256 44e3e5ccc9394148f32e7c1eb9de49f4cfbbe5ef6552de3b05d70b3be4863c57
SHA512 5359fe74fc406abaf5861072025f50f58d1af989a1b12d8a7a661b88239fd62fe67876d45d1c8355c77e0807ea0b077446e7ff8c1c4b13d8cccc252eb2722aae

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons.png

MD5 d4468a87f6693c143a95485397a081bf
SHA1 7457ca8288a69736f426053647456f21265c02f5
SHA256 05f353657368d084f666ad916400de336d883ff7f08092753869eb6d08a3dd57
SHA512 70732035e8b70d3ea25992277f9912fb38aba5164bfb4e2b6dcb260904576f4abdd7c0745cd3f0071d4726d045d4e8c1d3377acbd75c464266aef073764dc13f

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons_retina.png

MD5 9d7e55a9d649c97020fb75ee3c563359
SHA1 b9fde6ab32032b72244ee885eb72934b5c24a23c
SHA256 9cd228bdd63d8268eaa921d72bc3d3fa66c8b007cf275631f378749cb24a949f
SHA512 b9e717a656bb46f03c2e76d57ae5270c5d75dbcc9f3023e4a24094c6cf8702d2148e270b20dd560aa9ae46fcb55a1ee7219c254a9df763566507802b1e02d8eb

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_patterns_header.png

MD5 1333d06d27dfcd89ab798154b318765b
SHA1 cb87c537e084787b3e6804b1277f6020b8277a56
SHA256 a5dd63883811f09aeb57af96299c3adec30047aa15264feadf611471e552ae28
SHA512 a50f796246d5c230ee57f04e09c9d963ae4a8af609183915ffa630b73125b64dd0043589f4688f09f97ff120ea34a91bc2bab2cd3a589eb3c0b5c206415c8e86

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_pattern_RHP.png

MD5 1846c9f6b494980db59172f800c8f5da
SHA1 9edcb105d88eedc0a54bf15149c29625fed81f12
SHA256 2789e898e495662f5b929860e8570cd0b2b57916067ad7514775b8ac942a508a
SHA512 f52423b54c79c3e11eb0455b88e47d28c32b98e0385ed5c83e26c23dd0058960276c166fdda4f01c76ff3c368f8e7d4d7ca76493072f1743743db3c038ea6064

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations.png

MD5 28e3ab9ab77e7597744e32aced326580
SHA1 2cedc61e52bd49462e6bcdf85dd1a9a25fab0a99
SHA256 9b5ce3d9f49a3ed0a18320ca648e965655e0496f3e41b003467facc4c1c5bbcb
SHA512 f1968f6ab14a32df6e6a37ce11fc54ea577fe8aa7204ec2be7dadb8535b015f74a339b7f4e8421ca9793782f56771a30853486afecafd442217edc7c58497ab3

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations_retina.png

MD5 644ed7b0861549709cf76efc672d6ce6
SHA1 9f6370c8fd9af4b009cd7fbfe7a62243633f5054
SHA256 4f1284a56d3861b976286e54016cfccb22596385209a54637ddd9ecab2fb063b
SHA512 83540376ce591fed508247e560d9728b4e292fd4d83a885b3ee773838510c95460e3ee99c9237f499a28f2e986850b9fb9e4f758f013b93032717df4503dd638

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\progress.gif

MD5 2343450a63f063d124b7d74257ea2cf7
SHA1 c94d475326d69f3893d03e6b9958666d2e3b02e9
SHA256 f84c76878f1675887561c27a16b40165a355dc4dde96bad9ac1175e5b0d405b5
SHA512 71c4dbc53840a5a32734d04a3106c02d2f14bfa5ec06a6962b007033bf9e1bf5b21c58c629cd756a48c58cbcac7252691f8cc92130422843127a31a3794f811f

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\faf_icons.png

MD5 5c230afeb0a8afe1968dbb10b9c64610
SHA1 466b3c0d96f886418d7cd4db441565640faa2244
SHA256 20165b09408c1d03da62a5c86bc5fab0416c893356c214d4f80449d61ee9fb64
SHA512 56e88e3917c4930bf26e5bec036c57b15908de16f9869409d7a275153d26b1ee848ac62f6f7dccc47aac2c3fc5179a6ff7c051c11c2805afddd4bb672e229735

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small2x.png

MD5 af5397dbc408cdb6f5ef2fb0791c4b01
SHA1 3e739518a37a9ab701501ec50abc1d5557a02fe7
SHA256 721e0032665add400a0b6dff1127ed02e52753926450a54ae3e91bf034b6892c
SHA512 d259d86f5ddf98c887f46ba82a8c35257719704b82860050fb1e1650eaf1f2f1846873dff34385899a6767e84fcf0296569bd27e931bfe26b1dd05c001472a5c

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small.png

MD5 86977068884e4eb365fc5f0b9d663d5e
SHA1 89e5131e4518bd66ec35603489d92f0b50d14ee7
SHA256 61a06d9e44370c312fcbb2057c8160d7838d877c86b14a827752fe2cee417b4c
SHA512 9c4427d9855763d7f767fbb8c04b46d451a3f9676e625bb15243b84bfaaaea38f7abc22e94940ec466650d6a277655f5ac2d83ab46ac6d2cb3720a62f40f5c8a

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview2x.png

MD5 619b33308b4941bfd793f066a8c76fc5
SHA1 da663e3b524f5398ed8954ac9cbd48a59bca32df
SHA256 4480b533f8e4bf94c5d1fbf50e8540d19251eca2a723d5cc8e880fc598db8dde
SHA512 e8c22376dde2504ebdd3bd0ad4137f3b06dd4665d7acb8f6f74938d73b5be7ab75adf64ac4b36a9769f4b02a068d790b158b7e38d6d6a4066f9d4b23cb090f57

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview.png

MD5 fc4540a5406adba425c299e4cf29e3c6
SHA1 e1002e44823ad392caaf7e5f9f843c5de572efce
SHA256 99c0876e323c53b860804e02dcc92f714b20e04a84e48c079116719ab0307967
SHA512 5cbf47a8c4eda03ee73e77ab394b236a1ad0bf992f33e53c25f87ccdf04570f86628dd263c92916f8e89998441c0ee6874386703107dcb5f291ee65e9d9032b3

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\bun.png

MD5 8137a0a2da891105651099c010cf7a5e
SHA1 f3c0ff7460f714bfa41c7f42f9b6a78efd5720d9
SHA256 40745f7fa68bb9c952b55f1215fc8c8d58632fb1b032e0754c54309101a0597d
SHA512 4fd78305b78d316a0630b823e2829e2c0512a7ced6075f72654ca24416c922c4846621033dc77ed3f138dbe0eef4c5f08d3c38509dd767da395a39b4c3c3a9c6

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons2x.png

MD5 aff0d746a423fb590fcadc50f54d7f3e
SHA1 101dc0d50c79cd10d1235f79a0e1794830866310
SHA256 7e6de442f04d0df7633ff63c865042247d50497baa58884d5dbf711e8a557493
SHA512 ea2203c51b5423e7459db09764caad5c8de70689dc4e28d57d842386337923a58dc9ad965a75c29b5409e084ef61a31330862425ed4b40066b998f6ed15de1af

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons.png

MD5 b253f180480dc9de3f7bff95dabab1ea
SHA1 86e1fed0683c8ecbde8992e73659182532c26474
SHA256 1c8c12baeb1be6d9f0bd75be7839958ea38ebe8e28919a3a7f06344ee7868bdd
SHA512 b470156c2bb043daaaaf2254c98557b46f6c397cc1a8dd6fd68dd7820e40025898ccdaa7fedf5981b62798d0b24094ca45a1ba1ddeabdbafe9e87532d9e4a7ba

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\nub.png

MD5 c1e5ddce631b7eba5deffca4e4b2311e
SHA1 e1c460419bbd2b2af50bcd9a343e9aaa8b2b2456
SHA256 a10618000a2ae5b58456a30d2d2a39c2437779a2ef519734ef9678d9121dd166
SHA512 d6fefab3a6be585b619d412c446340d1d17dd816c57ca3b2d912e39f838bf3831e64be5fa72f80bfe986cb28fe64339ffb9c3a8304f3943760650960c2958715

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\illustrations.png

MD5 b21063e8c8aa5645a8634e87976a73bf
SHA1 4df3bf4de84f7d755198a55fb54fa66448a50b62
SHA256 e56510ad5892c2ce772f74fcd7535d49672db966a3982a6ada76f9d48d35bb87
SHA512 feb13e0de4e74dc54335f5ac20cfaf1e70623ed8b9e80b6b5490b59eba624522ba661d0921c0dd18a16daa5ba7b6e7cf34d94b57e83fea479f72a8af8d43d4fe

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adc_logo.png

MD5 bb623d28042841b780503083ef7e25d7
SHA1 ff02cb8a9efe747c31baee6fc3a4f6a2673a09bb
SHA256 37a0de436983eb4622f75f6ec360edd4c99defa2f0c18ae18fb5d34e10ec165e
SHA512 4c92b75ddc9954fc0e4404661d7dc4fe5601da5f3fffaafe7d46cf2b66a3b0ece64dd27a3b7cadcefa25fb58afc3d6a7442f4ab76190d45cfccc81d2b795a45c

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adobe_spinner.gif

MD5 3dcdbfb58125cc7b84adc46adce2a857
SHA1 f1833da52c590f69a9126e36fac48540dc59a129
SHA256 8cf0e3086f9a77849d1f43d06cda13f63885db2451e71202fb570845130e572d
SHA512 5e0192e096fcdc9129f2c708a5924e6b8092a7b204bfa5b00c8755eb91cbe06995163291673eb8d86e7e5c8318711f85bc731e918cb555b7104de11409617086

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\logo_retina.png

MD5 b6aa54e784ef123388cfb62a80505c04
SHA1 de7cac2dacf6157d39bb9f548590d19882b74f2e
SHA256 ad8298e95b1aaaa9c26f9927192b4564bd2e2428c2f03c448d53b671902a8e34
SHA512 f54d8a0136ba0ee0de7491b49ee643f00beec8915760112727b4d5d24e30860a4f58c7d376bb0b14227453f6655486037a4794c8d7d21aa07ab2fd03c83ee7be

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo.png

MD5 ce490cad37c2038ecc6e57087c87a774
SHA1 4fc9951c271053216e922b9dc07e19e5acfc3f56
SHA256 167db846758a595e593a1018991296df05531b0deab413c15c65a891fee66627
SHA512 2fe0ecb80cc10756a78164c43247d31e1be015a01d200d201a15320c623a4aabf34454925742613d503ba2fea723d30b7e07c534e6232acddf68c0338172acd0

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo_2x.png

MD5 35c7dcb21dcfb4d76d31a9dbc250f094
SHA1 5d75c4dbe58d219427cdf086b97ad4a9dfa42a90
SHA256 1800c9e2a28a2b266c179dd9b013021ba300df8f7071c2d46352663505dbb3e2
SHA512 809249773bc91a0ddc9ec66940e74b1b8d8f2cd0b0ebe9e4a37c9ec66c0cdc3f339a81cd3558c2eab91b7168304a837cc32ee4777d7e3c7a8ceee48adbb6c062

C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB_EURO.txt

MD5 c8a614a6fda80a0440e9f4b2450129c9
SHA1 d67b030fd1895b3a0188212f08eac8b01c87358b
SHA256 f7dde1f898054c382c61d67c8c984678f38162a6bf9aa0877a84e4560d086439
SHA512 997211db1192dc65d2feaa8923bd4034108e53b43b63b6d7d10fe2133f1c6f643229374fd81f7eb879e42e67c72b86b53ec491b8f8a3ce554786754401660afb

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727658720680492.txt

MD5 490c7a7fe40715120fd88c70047f0e23
SHA1 d44134997918cae663c04f48f47ceebee1977737
SHA256 c591e87e138cdf707ec70ce6449d5237482298448161b6c15ea58d49520e7c42
SHA512 adb5982348177cdc8f80de7c0ff4c792478882ab02b221da7939a983108b72d5268d2adf64661f33b5cd6bbeecb5a542a8e722f2609a203a4630e5e80d1e16d3

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727659161166784.txt

MD5 dff814510af3250d1726d48846f63bf7
SHA1 5711128a3cf2a899ada12c413b588e6e67817843
SHA256 dae44cef0d9a985fc1172824ee6f23e74fcf4b4250b24b1a87dd0e8a498d4188
SHA512 919eb11389bf07c07858967730d3031774f6416134c92f417e2b3f12063e91e2f6aad0353752957c49b6c5dc4ab92329270ad50658676759e2e5d97a90ef21aa

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727665191668352.txt

MD5 d80a5315ac03d88f34f3873535d581b0
SHA1 87cd09bb23a438ae26e1d8b86e06474653a020f1
SHA256 d9b4d7887cd6d9f5a175f697968fa2ce4090c5aaf85a9696949bd393baf463b2
SHA512 6b4b5b7eb49dcbd144589fbdfaa591e86d3714fa43ba5ddccc575dc5ab33895fac43cdd4b85f1bdb7a5e7dc9556025f858f3ebc1f58a514cb490a37e6788b2a2

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727688804020994.txt

MD5 858ae0b2c5081a843a3268ecabbc4504
SHA1 b7396d11a6b5f047da9f386c3c0020e6ab1eb4f3
SHA256 129e590acc5d7b993feb9fbd70b14988d865aff6fb9b883cac374c0a42125780
SHA512 97408cbb68891c459b45bdf527a7c667044873b63df9ec6af494899da70241b9a941a749983ca6e24721b3a2b1d96d43ecb6eef097cf51496b49536d30a20804

C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\File Explorer.lnk

MD5 8b32df1a4e72fdd156f5d04ae6354f88
SHA1 1780b4e9a8f9401b57070d75a7f46e57a2df78a9
SHA256 60abf90216ff093b9133544e39f79db14a967e88a7cfc0245d983eb9d10a2fa6
SHA512 4e76762e6de23ba87f4e4c25b304f0d11afb47fdbe43907dc95750c22459ed549f935d00982670b996f8557b0d9b815230444a29cac77e8606740b2711060551

C:\vcredist2010_x86.log.html

MD5 49faaecc3a6e5da87c45cb87d720e128
SHA1 84a6702ce9168091a2f2f4ec14db163ff114c6ce
SHA256 f12330e5ac2aaa00dc853490c2b4cdfbe0886f94f35c6d4fed8611ece159fe40
SHA512 1d438b124f385dd31a37939970cb5a33edb4415dff113843f2b24bc2305de8607d446023c5b8e37ff14cec7fc731e169e5e53c406810432ec6de5f7986a1a866

C:\Windows\Microsoft.NET\Framework\v3.5\SQL\fr\DropSqlPersistenceProviderLogic.sql

MD5 eb45050384f460b8359de2fc6c20ba15
SHA1 499ba6dbfa2b7a21187b6d05f6f647cdfeb3e230
SHA256 dc714b27f7d06b502d6c0a3fde5c25f8de910c563f8c53236e875ac5c5da7563
SHA512 35abd26db6eff92da3c9255cddb249afe50deacc90dd6b4c3c9b5768ac3da6d88cfb2a7adbc8c31bd37a7346c485e53de4e84caae1d8b0a358ef4138a3f132ff

C:\Windows\Microsoft.NET\Framework\v3.5\SQL\fr\SqlPersistenceProviderLogic.sql

MD5 62e40c4abaf9bb39463c526abaffb4a7
SHA1 f85a9e1d35fc457f67588ccb47216dbd8434bfac
SHA256 cb876db64268be8ab0d4aa924d1fc2b32c0f4304a17a319b717e39145277efbd
SHA512 03160dae2e382ce820a08a181a83c31f020dd31815986308f5aefbd43cfcc740096b004a64714e4128ca208e9089b8f67c25b598926343767d40121524cb6599

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\alert_lrg.gif

MD5 e841b85ca7a8599d0f049b58727bff89
SHA1 747944e20f878a203faa0f0646edf9507d3456cc
SHA256 1bc9f4a76a209a063197e6c98786fe46e97a85c6e9fee3e806a45d146dd45d46
SHA512 c8b0380a57c10b22a08e6c4842a195c6b8ca0cf02a62e35a5112c81ffa20632e864ec0c12f329fd3816a8a21b052eff56011e82def3059631088414e9743326f

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg

MD5 dd95eb82af1cb745b2ca4c3301a5d937
SHA1 4bb7c2af7ca9dcc0e482f65aeecec3556b4056b5
SHA256 5865461ad13d737ea9e915e788f957eb87b0fb42f69330d6f1b6e4eb73cd1687
SHA512 671f4c939cb5268315d9fc1b766538037f33e77dac9ec810124c04b40f401d14a1d62d4f8bb3646b8a7ba9c6f3f16ec863af308697248357fdab934314436b80

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\aspx_file.gif

MD5 e87496333cad95b8e46106d6df381cdc
SHA1 58e0307579cc8268f72d7fbbc1cf541685024999
SHA256 682cdd99930d4a45de6730d5a7eb27726dd70a63d71d2e87f43f33dfed49bb97
SHA512 74ac90b467302b4dcb2b50752ebc3a1ef230f90b884258a6917bc9c6d8714ac0e238ed8c464fa2e9634b358f139dead052851bfeb13b1b293946619553526d56

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\branding_Full2.gif

MD5 4e20fa35bcbf9f033b49d59e54acea7f
SHA1 186956e9223bcb506cba537ef5ff57551c2188d1
SHA256 82ff24a31c042ea6930c70c2fe200de83c9b4ccfe08d29744b9bace629d4a6a2
SHA512 d91aa67998896668f4479fefd6823aa97c0d77d58b0d085fc0bdeeb20c58baa360ddb3402bdd7f37310f4869e296d88c73a609cb578758672197c1f0800bb25e

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg

MD5 f5ca0a72e88687188f532d8187ce1c03
SHA1 e621b26daf130cf5831ae115b1caa6bc35cbcfec
SHA256 b1d3778117a3d17e122b53cd09722593eb46ce8a8b7f81b38329d6c1c89c5a9e
SHA512 efc5cd587c4053f5c9e2d6c7c9eeca86c5235ed30d00bb049c1c57632d246fdd9dea922d80bb1ae8ef868f83f7d0e186cd2d88192a77f69034bfda6153c222fa

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\folder.gif

MD5 2e41ebef7742876009d1fb72f3ce19d8
SHA1 f5c031e2f4e9870d6d0249cab70813a165df54bf
SHA256 d43826bce1d5f3c9faf9f7b1205500b1309b34d24e42ecf0e2f1f3ff0d5d9a3b
SHA512 aaecb12b6cada85043c626d183568a06ab0e64c2853b9c1bb40ff5d42716cdb690a7d28a1a512d17398253fe9ea0244bd4ec46e553eba62fe8c92eb1d1bf2cac

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\gradient_onBlue.gif

MD5 a259c3ac00e96cf08d2275548b1cb876
SHA1 a2e9f00db0ca38ae43981f7382f798b626b805a2
SHA256 841f0fd2181138316e809298be2cc522fd9fa723afa5e5992ddc50952ff9c054
SHA512 48883922d20013bda59c8d3fbaea40d36b06b387c935cac6784511912cca91a1be3669e6ae2fae96f54aa9511d8388a7b6eba4892b430346c737536365e4aa06

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\gradient_onWhite.gif

MD5 be9fe65fbfc61621793bf89536f7954a
SHA1 6f53058bb15ed6eeffb365f173d4a4eee0e81f9a
SHA256 c6a5a8060eae79d8ef967bf18665b9e977c6fdcd64cc03669f64dea5cd85414d
SHA512 d54dcf9d1b6fc0a85be546e54cee057d58d3263162b8d77932185394df0d247cf63f2f2e80209220930618dca65c347b7f5769941399c89206459efe84a21ea8

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\headerGRADIENT_Tall.gif

MD5 9b0bd05208a5ba2020033788e7979a04
SHA1 bd12653cf4ba32db4d739792e847dc2f086aa816
SHA256 2c3b78fceba0aabe7113a0de3d6703bb14dc346c93f7dc14bd5ee81fefdc84b7
SHA512 1f16daa98b9e4255e5e1628f42d21934bdd94c136af0008ead70d9f0f4f6470481d153e96791037911f2054348fa4fc891208a80051da351f46e72a057b02d14

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\help.jpg

MD5 3ccfaf44d005819cef439334920bb340
SHA1 e0c78ac672e10ad655f6360e115f72ef77048f42
SHA256 18bbb6ab207ff52badfb6fb38636e865934764f4eac24428799917656fa517da
SHA512 37da0d2bd7534d26e2863c768d5e3f6116eab944664126c53edb977f649604703320dffb4060d7d995631a2adf18f11f2054ea19571b464fe0c095e9063bd236

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\HelpIcon_solid.gif

MD5 77621ad0db95cd7aa3b18331bb78e8d2
SHA1 6c7d3cde5521aa243d8ccb9af2d2345e4f361799
SHA256 5da7bf87988f29b04517ba7b20c1058702a2011e675d765a95783d4cd3da5090
SHA512 2c27ddc88d62a30533cf4d9b08d465eade79c37b2c4168cfd383dfeff11ba671ab1b86e26741e9f4379593f2c9b0904a045283202a298e14ba270e706cdafd6a

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\image1.gif

MD5 82f1bfedce7e7b611760ffcf22993cd8
SHA1 9a5214ebefcd028524e63b7556e39c627ac74846
SHA256 509a26b2811348cda04734de3bcb6cf1c9b75c1f2e39f2ae775c319ceab75fcd
SHA512 f13c666af9cbbeab71c03338a941732d039a670c7b7a8904159ec130a59bb3508ec61fbc5153558ee424013e3e5a79f6cf5e92afaaf7e98d2ba30bb83421c44b

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\image2.gif

MD5 b51a56346d58b0fac59af274ff3279a9
SHA1 339e23d11069a2f8e4d82cd93294838996303fc8
SHA256 b229020ad39a2b4707f34f31bacfba9d1e9d465be20d8dd3ae9765c25b85c494
SHA512 a9882acf4e56a7543001d0a8d61dea92c19dd264f6c7c0b559eb84e673bcc58f05e8717b686e96d14113219a379d27a33f50008525a3a961d9ebd6050f0212d2

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\requiredBang.gif

MD5 441faf5cb3be6e74380fbc118dc50aed
SHA1 9ab30ba04d852d1fe87d0ade6e5471e0fc0882ff
SHA256 f850cec607088830be8084ac4207dc137d81d5ec3b2b1b6b12cd53600ebde6aa
SHA512 27295068852229e2607390149d7c47efd5781ed947f1a05b897ee3ae34e2159dc73d7609defd3c5da298a0bc6b6127aa5bbfcf595f9db9559b8f250e0040dbc0

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg

MD5 eac6b774af88cd2ccf20983b32687982
SHA1 6a577f56531e5ce18849d633db3821cd947e8aab
SHA256 67cd596e4b11850054916be44e50077c1c2c46c0c7727718aacd199a93dc50d0
SHA512 8c03f5b17f6262c866edf31f1cd23f703b8a2dcff9c6b9b6fd3117844632630a249a3cf5ee747fefc47bf9bec31c6a9cc1f8b0dac2d46f084a6e6fc4d753da25

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\yellowCORNER.gif

MD5 819a8e49f1223052d4e30cd9b97c973d
SHA1 b180a701732381c8181c2aa934736f2fa6976feb
SHA256 f1950f445c0a2c561ec4ee234527aba545e09a0261b905069fe4ed82589e6ce9
SHA512 2f11de6bf9ad373ded1ead2d5be8064f645adbd9a75d324f7306fb541bc743634a59618895d41a990264d392441010692294a941a37cdeeec08b14dcc7db0591

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallCommon.sql

MD5 2f5e2f5eb831c19fe8c45cbd207eb65b
SHA1 ec94349e8b057d70b1f184a25b58d21f518537c6
SHA256 1472725202e817a3d6cf400d018a66369622be0c987c5404358ec2ba7b1de172
SHA512 1c4704c087e52c824a7fb47a09919f9449c11e2b29876e71c440394e5fcca931440b26d7f76a89fe1efa2f6cab82b44b593fd985510081f055648aeda2ea9f45

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallMembership.sql

MD5 347df849cae49b62f220f52688bc7ae4
SHA1 deab52ca391ab902fa39302bc073ce218bd9d63f
SHA256 e8480828262f4a9f4d24217a2bb6ad991e1c5e94debfe2d3dfd3ccbcb94e164d
SHA512 cad254dce3cfba470acb9dbadfedb18b3a48879a1799857ecee77b376c59cef486d022510d914f9122522c4cbef019615fefa76e46aea171e668e612134c6f6e

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallPersistSqlState.sql

MD5 ad7aaa67b6f2e63d205d97da8f36c82c
SHA1 6abdb36d9781217ce6c17ec31dccf15bed9faf45
SHA256 e5ca1ccbf1fbbde25d797d10785d0d7acada9b048887d6bc963546abd47b2f39
SHA512 209fce4301c82deb3726bef9adb966a9d9ddaa5f763285f11d41cf41d3ab751bd927890a2fff41c88723e6269940822b9badc1e711e2d40be41b69cad3033cd7

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallPersonalization.sql

MD5 a86ea9ab1938f10f9693ea5555a5c69c
SHA1 19fbf46161306ba06656c5fa6bd709b9b1f892f7
SHA256 f831aa223985c7e4a55ae094dd82da43939fc6257efbaad6aab291a5fd46492d
SHA512 cea451d976454bf49c04d807ca0a4f42331c358823325d0893ede025d90c2d4794decbd7e02c5032a60952e5adb7f83fca883d5fd8381e8cc221be708b6b9b4f

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallProfile.SQL

MD5 c53df44f083a63ae9dd2d5b06dd7a012
SHA1 854546fe3b52a93f743bbdce985c79f27b0c215c
SHA256 2cba2497a7b5ff73dcc3d86edff23a5d8c352c86222b6f81894a34a51635ccff
SHA512 a71e58ffc61d435c4fdd29014578d66636ea7ef31d7874bcef20d7200cbb4a51cd4d594ed34c42cdbba033d0d57e0d997d7438bc0cb256459330548e13a90d83

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallRoles.sql

MD5 6a3a8256f36a153d65fcba43fbbff37f
SHA1 17b79c20f63daf1e72af9d87bc26193eb31a29f9
SHA256 cd11c2a12e9e188ac188157e96989c2a8429f0e404954c9fc9d33e940c8ed00d
SHA512 989c7aecf304f36452650a80b29fe00ecf06f623e10ab44a2fe1e2b0687d5519eb7bb9f17014254fe665c94ebc18acaf85113715a85e1d8b6d33fb2ba724319a

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallSqlState.sql

MD5 30c5a1180cf5cf312d5f9e592d573e85
SHA1 30a0b03be30ac9e1f65a36e9ccc6174d15def1e7
SHA256 b01aa06ff2e4bc6073363588f875a52f9cf976bbf2208021f8af83c95787a675
SHA512 13acf9ced245848702b1e469d0a4aca5a45a59c9858cc2c472a4535ee29c47b5ddab8f8bb55063d1dcf3ba135a89234c89b68b80d9fe116d7cae1e1c0075ef7c

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallSqlStateTemplate.sql

MD5 918fbd1d2041c7d1e4ce2246bb41cd15
SHA1 f2d0e578263738fd655f118bec0c4fc273cf9395
SHA256 665b76832f9881f1fb7a643ca69590df8d9fb194493afc81d1849d1be9f1c8d9
SHA512 14d6af03a1283b1c892dc7e250c4251d7ecdfa7f269dafddf55d66eca55ccfe7cf6c762ba00956c1aef5c7cfa11034607dcdbc712e6bab63a846dabe43cf8f05

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallWebEventSqlProvider.sql

MD5 3f8527e01176f9dc52cc37ef973256e5
SHA1 d1a932256ef9de61aad199693244eb38ba4a2a18
SHA256 d988faf1a1f903d16c7437bd0ed1b60ac0d8562ce579ab533d188b5793d1f96b
SHA512 e573b45a3ce8194298fe7cc61a6a7e730fa998bddabdf4019697429161d910dff827498f1c96a697908dc568214c95d08a2289bb962dc080ce85e64197d0d8ef

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallCommon.sql

MD5 01742d1c533dd3c1f4cc209eb26823d9
SHA1 72a84f81b0b53f754f794e070fad381080ae404b
SHA256 e129c64254a19dab17659ea515edeb97c76d6d3db5efb9d35bfe22f3d9f92a0e
SHA512 e53b70eeb81879714c0e8c3fd74634dd2cf20c82bffef218fcb2ed741451a0eeff70560c4fb8726ab6976a5f163e671e88ecccde2fb1bac7ce5defff3aac1fb3

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallWebEventSqlProvider.sql

MD5 180fba033218b528a4613ef7d049c283
SHA1 c09b9a25d60304f7d1045959e083298a006aa5b2
SHA256 461175c174063d0bd5088437b948fd3c48eacb19dce70d579e83c269b487d7cc
SHA512 91aaf26982a5c99997e524d06c93d6154512b222b991604a0bda26dcea74466923c0cd21649281828e085f4b73d48057c0e80ba19b70938933b775099c0658bd

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallSqlStateTemplate.sql

MD5 a182309970f6381106eb78c5323e450b
SHA1 2dd1656756bf1dcd27a029c3ec72efe0ef4dd462
SHA256 8852f69921e30f55940ecba38967c9f6a463edcc3c2e2db3d545172023cb8f29
SHA512 964873e3134c60a77e106642aa8ccc6ac0eee6fc2f0d0b9d6040c64400e3a8a98100f594d1fd2ece82806364fdf9aa8d062435a9021bb80a6098cde0dc0d658e

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallSqlState.sql

MD5 30c69867898b89e64209cd32f799f0b8
SHA1 2e4683bd9c9986492564bcfb9884c1868e3fe3ee
SHA256 e178ab75d6524539a9c5f89d8b1e4f847e66b0b225767b2afe6a5d93e9784dec
SHA512 672277a2323200ab614996ccb268edad23c8b3571fa323e0543b51ef9976bd2f4bd4e6e1e1a3afcf69ebca973cd2861c59ae8d55b1db4edeedafa5695ceb5e96

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallRoles.sql

MD5 d7679b06ea3ecbdd56212b6e6e5ed99b
SHA1 7e21ec0198f0740baf544ac172f0eeb69f4df4a6
SHA256 52088e8a2ceb737e6b01ab275f06c84406a36f2c5ca481e53eca2f874ec32c8d
SHA512 ac9d6eddaf473be09a371be9b7e8c5ef2519e61e3031532ad34f49fb28daffb9a5b8382633ebc316321262bbac125bc217d4264422363b594515924bb0c5b27e

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UnInstallProfile.SQL

MD5 bffa741d6728a267dab7f91f69bfce3f
SHA1 b9b30edfbfb9b7383aa9c243c6ae7ea60a416bef
SHA256 aadf222b34bdb651709603ef6e5ae03cbbe7cb9ab2e602dc45f1e9ef171cb7e5
SHA512 d960dc2c101b59621e471c268d3686c625869174c8bca3cbc1519ca340db8b1cd4491e4d3bb330da462ffb87459566ec56e21f3690329dc19babd5a27941f89d

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallPersonalization.sql

MD5 3b3e1960c944512e3c73c9b1b929ef01
SHA1 2579db5774dd6264cf4333bd063192ef2fe59a21
SHA256 a13ab5d9121980fa262db14982a9f5c43b9e71037698407499c79b26f9fab620
SHA512 240effca032f23895e332d5fc5065b67c8909562a775f727136a81ef11ecd0749fbd1f0653a1ddc232a4b5b7329bdec1128fed1cbc661f4520bcd5e014858b1a

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallPersistSqlState.sql

MD5 0850a128de1a82cc5f9a0a17881c1f6e
SHA1 cbf573c2f4fba4b6ac0b0ebee0a14296aedd2de8
SHA256 ede516cd783c0a2c6dd96d553ad8b2b9b1e822812762c6f4c6a53f3986d17254
SHA512 8012b9d8db14a8bed99b74f03d8305e938f20162716479d8f4dacbd318b9e98df519fd5b24d6267c5c34561875cbed9e3e25bf675f18f090de076ff23ceeff6c

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallMembership.sql

MD5 d86d414de312bc13e74fb9d4ceb5c260
SHA1 e10281827b477b052037e567c8ac9a220dd97d2f
SHA256 da421342e6991d6d6ebdabb51be7e07997cbdaf2e12cfb1b1c49f34713d9e769
SHA512 0d0dae34820e19408097282732f99ea03d3c57a14daf1f5dff8ba1acb793feb14ffa009cb417f3321b68946a131aa76b03ae45c422cd3c3e81e33d0b11c28ac9

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SQL\en\SqlPersistenceService_Logic.sql

MD5 90b0cabb51844f14482d16f8f462570f
SHA1 7c0156ae6142af88c9a3c8ae4cbedd869070a0b9
SHA256 930ab5f94640fd3a208b52220a34899e952bd63bf79e8052ae86996660ec4c4e
SHA512 978b2729b4670c8fc71e4d61c090a5963007832c4eba2f30e30cf53cf17ca0ad05a8ca1e1cf7c99b576d6ea7a26ceb909d061277234ff538b1de9add1c9b5d2d

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SQL\en\SqlPersistenceService_Schema.sql

MD5 eacb7bc7db1a9066ba9e328650f1a872
SHA1 52a37ed5a366eb191a9543a7b65a09e90e3ee344
SHA256 bc5390eb9a58c1192764554db53216fcad1aebc6ee027b0d79fac646edea84aa
SHA512 603fe9b71640e82a73f2f5ade0a827f11df789da1c81e0d6058df66b954034ce3c83b8ee181f9a6885ec503c45d3819661356acba4dfe3db0798cdfd13d70768

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SQL\en\Tracking_Logic.sql

MD5 26d88cbc4f4ec65e960eaa3fc3cc1ac4
SHA1 7b3dbd9bdae7fc7946ca9e27c2a0d5d9a6d8a5e7
SHA256 bb308c19646aad0083ea4b6e8a17bf6bf2f70e43e6c1882555585b1667ed07e8
SHA512 7896ae0bef3782e322d273cfa9ef21be1f28fb7f64573c0e429c0443bd847b1a0bf36cfadea7f64817e8dd9968204a8cfd1448b27ed9c0746caeb18e4074effe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SQL\en\Tracking_Schema.sql

MD5 a5f02f79f67873187936065ffe01b4f3
SHA1 3147e67aaa752e8c4be17e970f33aeb7250ad27d
SHA256 3d2f288bc88b484338ee61f339d353897ad80b4d8fb095ff731d9d1ec26ded6c
SHA512 47fc44c34bf67557310f262e866e0bc181bdd7b419c0c1bc587c3f2cf81551fe8f9dcb809bea876e8ee22e72a1070017d56aaf4188388965541fc51966667df3

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group1\1 - Desktop.lnk

MD5 d6e06d66809475cee634ce41e1892633
SHA1 6970a603908f68672b4daadcc1247760da3afba0
SHA256 e3cc64a26a6f652502fc27b6199b0d2738fc8f701dc5273109b868628eb79f81
SHA512 f3791a0c519fbfeee998cf311291609623d8e38399fc1f51a9c3d29b885dde8802d8d6e1c06da19d6de22d5e611cafcc1a691867156dc65a5ea90bfb010b6252

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\1 - Run.lnk

MD5 fd08a85824d1eed0fa8b5d344c159968
SHA1 6b9dcd4f4d7c1090342cb880e4aa73b2f52ec2a7
SHA256 eddea8e5e721cbdb806caf8ea02ebf9fb018cbd0d284048e778b81804006bca0
SHA512 51d641ef51a33c9eb7ac942b6dc730767e6595a2de926cb57d2c4695382066f85ef16f7e43f7c8aafd41819449708129c93d375ade61aedb92415d8a429358c3

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\3 - Windows Explorer.lnk

MD5 41c8e1c9777930575baad062aba21c91
SHA1 f3f0838c21f9b59ab0c0f3e87dad6e97bf91ceb2
SHA256 0fdb7b9154f70d87efff2de2288a5b2d017fcd286c0f79d2efc64be9f041e9f2
SHA512 fe99316983426af18de7acd1e1d505ce61279bc9641e4c9abde485aeab8e3ad40b113ecb5ab35377cc109577e2615ce06ec5a2b869719fb8364a49900527830a

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\2 - Search.lnk

MD5 829646cc5ed9f5fb435ab2e61bcfa8fb
SHA1 6bdfa79c609a3912767ddc8c4d0d562197e87736
SHA256 0eab908d326599bbbb7f42426a92caaa073f831d5303e93a1ab3fba4f34edc3e
SHA512 76630a4bb4ae3609e88b097cb434190b19254f926c9ae95d011e3d7431b2fd33a2435c361dfa91be716fbd757e73405aaf066117de9c5f6254d78a37128f6603

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\4 - Control Panel.lnk

MD5 79771edb2dc0bc4f8c896f60d0cc8ac2
SHA1 b614162e5da0a8f57f290b35922d7f280b8affd2
SHA256 5e42dccae04c05054719d1d23e5f9303f2b266f80ac6ec43b7c6f35a9af25c9a
SHA512 9539feb5df345c4392c8097d246bcc41eb262d2603589599bdf0b1ad673b06a4e95f3ee1c26cf3e2bec674be3286256a045132d3b88151f788f43acf7d608640

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\01 - Command Prompt.lnk

MD5 dad3bb97df4f2b9c6f8e06373c019409
SHA1 7fbc7add69836b24da4609e49b96c075aae12727
SHA256 16c27c4075d40de3b901ee22a14277ab989b99fa96cb95def3c0d987d9928c05
SHA512 e99ebe43502b37f01a482912ad8b771c6b64cfa05053c958f874e21257649133eacc0f9a6f87bce0ace39c1aeaa8256a0b6245a91f81b36f5eb707e9a37dfd08

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\01a - Windows PowerShell.lnk

MD5 0b2510a28014da8d8fc20b58b93cf2fe
SHA1 e4b13459bc793449575fc77c543a5df25299d3fb
SHA256 85aef602fea806ac6657e055965e35891ad689dfc6928b70f3842b5328189ab9
SHA512 d4a8f639c778f0ea3824a603746f29aec0bfb4adad03a2b1de3cfbf899adbd6c8da58710e1dfdfe028341f990c8ed8acc0451f225caafe7ca31d0fff90558430

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\5 - Task Manager.lnk

MD5 5596b5b1fec692b8538c3bb9f5bf8494
SHA1 31598b64960f53cd9ede5e9084c74c8a1b612af2
SHA256 64890381d9715c0a3402b90d16dd39af46480c3dae7b95f8f05223f831cdd68f
SHA512 fd9991aff8257d3264f1177b480e542f796fc77b69488571fb49b52e54b0fb351279c5aaf9b730baeaf3bb0a7940a16fdbc2ed0d646ccff8b04cf175a76fcf90

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\02a - Windows PowerShell.lnk

MD5 1dde611707c0eddb12b8a7dd8165994f
SHA1 c9980d500d02567f6bc2fe26e951a0bfc4be1e20
SHA256 cf00c7709aa94cd90ffd2fd777df91a94c724787e0c865aa14d4ce7a6175529b
SHA512 fe329b8b9e716eddf30c7a1bc35e6e390c974482092d58bd84d0422f09c48fedf0686c75d4e0c2c7b6492046beb18ff34e2ce7b88dea68a09621de05f43ff020

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\02 - Command Prompt.lnk

MD5 bc44972a98c986ff1e1edbc60821567f
SHA1 f810f632ea08127ebfad81d5f8b9ddec3a5f24ce
SHA256 638bf739837c4b23fa3cbf0d35f16c82de785ab849530f01a4a0e951358a3946
SHA512 a3178640255cb650118971567a114696a695ff9dc1f01127eead060db4333326cd32ad764901a5e3cec6a6169e2e9c0ce1b82d89805287fc0ea3e4fd7508dd3f

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\03 - Computer Management.lnk

MD5 058e69c3bf0ee4ad362c99b647b50681
SHA1 270c4be62ee0485143e17140a89b5c1d7783976f
SHA256 e8d2973e04227648e081c5ac547e0b8c1ae87eaf941fffcc63895a45d6512999
SHA512 4afba80e4765391a1b1a8d7e07c5f170d12ad31939132ea2aff1042167ca6781e934eecae8f7b5d20fb500be054de40e36d9d12c5e7a87a3fece977ac635bc48

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\04 - Disk Management.lnk

MD5 20b4a58517f84e35b70ecbbd4b8adb93
SHA1 cb8dca157e5f2c02dc0b9b531cdf4b123989b3c0
SHA256 447513fc2008b28b4a8fd6cd79a154bd35de1dcd6b15f0938673b21b96b6b669
SHA512 f1b3d6ea6c64c78ada90a60f40ca4ef15abb0f983522264028e830a344224eeb7e8788e8c6b4d7e5f8d84367b9d39259ed2178dfe3f2f4e7093cd5463cb65f1d

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\04-1 - NetworkStatus.lnk

MD5 0cd0169498d337a24e364c1cea0d27be
SHA1 89009b12d652a7ff29e780c4e7d0ad46228cc87f
SHA256 7ee8888dbd561f230f0b775282cb494443617e45b2b1a2ed49724f6c748301e6
SHA512 92328e075fd49cc44bcd89705a0d638b400ecaa7e24302ba8be0b5e3dfc362a7848c1b4ef8c4c720bdcda3ec127d05b8256bd4eaaa109f308564430eeb49b07d

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\05 - Device Manager.lnk

MD5 715df31b9f1f5c1863a7b8fd061247e4
SHA1 cd771185afc0d3c61b1250cf56989e5dfa9644ad
SHA256 789dfb113e9cc459641f3cf2cd78e3a14a9e1188eb3fdf10fddf987a59ea93c1
SHA512 ff5079613e978f01a84aa094a3bde6019b99fe2be835bba211579452c289a357968326c6d1c8e4cb1f62d0bbe186eb295211259753517d529852b91d3c3be7cc

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\06 - SystemAbout.lnk

MD5 7a8ef053a0ec1eb7b54fbd699844d20d
SHA1 867e720ee1a4716a308f91661cf4dbbb89157d4b
SHA256 bc222f98183e22932455baf722cfc9a795286efa613ddaa86d9dc75374ba45cc
SHA512 779da29e90118a02832d853f2dbccba98fbeb5942e89625f8b4f63cabd1701f6f8e5889a344ce991aca280837940119b2905374ff04686575fba3f01bf4652b7

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\07 - Event Viewer.lnk

MD5 bc5c8c276c6baae49f324dce9195e858
SHA1 ca4b3d05d030fea91e2c847c21f9627beae8240c
SHA256 d10d7556419d8a39f7cec8a71b6ddf48019870991a407d695143fd255d942c84
SHA512 adefc1cb67c733d73b2552f0fcac318f5c691d1f544baeb5c38c00847258862e6eba06fe4e743a85b93089947be6e1a6237a962785c23e79f365b25b2fc130a2

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\08 - PowerAndSleep.lnk

MD5 8864996c7dea4f6ed1d315096524894d
SHA1 4f32b03284b3ecba0e3a9f0ec75743434d22a4c1
SHA256 19eb169621078a4101b2de7cb7a9594b98e232d7487d139066b3b18b242fb794
SHA512 40db22baa513f6648dfb31b17504b4a8b9f6e8a7d3e491a1356617e274706a4ec5215fe19ebc27691c15ca4063866373f966493e5fc0c7f493310e38967b8763

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\09 - Mobility Center.lnk

MD5 e8b7424d2d16f647441570c03bd78a1d
SHA1 4d9fd7065959b081a98d722636beafcd0db11149
SHA256 8eb37062982232a35c385b8f089f6eaa436e545cbf2a0adb7d0a8494699617ef
SHA512 6c6a5ff151c971b7c93095e75cae8d01b951c615ba482f228952aad0c778892dcb292edf2dec9f10826e8e30ad2efa392c59bdd8ee84dc8a70fe873c0f004a68

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\10 - AppsAndFeatures.lnk

MD5 f5c64fab3fb65f7050b3b19090334a34
SHA1 3ec9c4fefbb181ed756469116754e3ff7a0714a6
SHA256 dda1d351dc32fd669d4b66b930be83c8a04a306c23b161d2d608b2d57308fd97
SHA512 12dccebdb727fe9c669004f80a54f4ee7fbf1c031d8e4a92c68573b4c7cb7eb20a66657e50651b64926137fe049fa458fe1647ce41aa4e3fdb766b533635763e

C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk

MD5 d8e89bebc73798ca21437245b4557e1a
SHA1 4fc955bfe18791f805db63618022f31ce3ab3f8f
SHA256 c198a4bbd00abc6b092c1613221789f4b2b2a0269142de964a534345fb2a765a
SHA512 b96872ba8442706a176ff3b92c506fb737b2c997e3f4b8eb89d0ce611b1a659d94969f8659c44cfd7394ded4efb4308803fcfe7e0afd0d936b01f9fcd1f738a1

C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk

MD5 75d943e19ff42cf784fd3e6c798ff355
SHA1 4c9179362358f17baa25733e1d4df0609f78c64d
SHA256 aaca1d5ff43f0b9c7b3bc8ce1f89c46792d36c490fd5280a35f6dff5de7fd04c
SHA512 fb8beba6f6feefc862893bdc04d8cc882e07444e8c52d975669903963a91aadb8350741571d2101a1c4c98463b1e609fb3772870e69c3892ac868e6fe94f2695

C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Narrator.lnk

MD5 bf9b0d6f56e7157b95737df0cc747641
SHA1 8d70d7f2dd2b3a0f9df6e6b34024644dafa27e6c
SHA256 e13be769c08cb095baa87f6be39507f5eb390d8e65a0be448f80c5a44b1b4d23
SHA512 3dbad4606c8cb08167112448196422aacabb1ad16b6b2d78e23e181f4d9bfbeaec138accabb7e1a4beae4b6a530509da7787218dc13b62b8df0506a5ec7e7990

C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Magnify.lnk

MD5 f3a251639c88fff4eda16837d1c8affa
SHA1 02c136ce497996468e55f76d791ae2c09b03025c
SHA256 d3bf719216b11c65523dd39c4cbd052dc65b8790252b7fec575ba29991375c48
SHA512 cedbfbec2cd74f658da70196644ac9870e658c95c59d7767a07e7ed8890a1db1d19e1fea1f8e680b1fede4e31c0739aad030ccb9f347eca04afc5b679ec98498

C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\On-Screen Keyboard.lnk

MD5 98b258731acff1683768500b6b129fc3
SHA1 a6b131944775f77af52d4035146712ef92313657
SHA256 8c7c88e9b6de6c7b531fca54e31cbc7a92b8b38c99a004107cf4fc779c855cc3
SHA512 edc8e89f545318592503bf7d9a1b8a15acc17a76350087d3bfd86ecb2abc44496acfd2be8d5ad81159542109d3fd3adf24a74ddb9f597aa21068dafe72f5460d

C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Administrative Tools.lnk

MD5 eb2410563c93d73926facfa066bfdb6f
SHA1 1d5abf362f0c267b760e1114af5fe81a2c7d5390
SHA256 49e7726d51bd91d3811e2cb81d4d94e0014ddd92c55dcdfb2194be97fb4c9a8d
SHA512 8fc775551aa331520a97634d997c1075194c960df2f4d23c9f5f91ab95de1ec14d7f949486fd06952943057d8cad9857d331674bb39933271fe2ee9e362226a6

C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Command Prompt.lnk

MD5 cf1e737b92a6a16395f5f3cd595e9265
SHA1 0ed1c3dcb82ee30f0851e191cf6bb95c717ef5ed
SHA256 061a6fdefd7ecbc1e88b94ab2969da4de9ad2af0b378404b7baccb589d6046d5
SHA512 6780cfabd6e996adaf5c5143013333136e4dc3b77391ee496968e9e7bce650372d4183bed0b949984bb4a0fda062e623446991ba4e5b1369fe7e71e2d343d2b1

C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\computer.lnk

MD5 cb75d7234d2f1b14de2940f793bcc74a
SHA1 a202e191914279a49d43802f36cfa6d305ed24f3
SHA256 3244ac2af6854c52ba9e2e0b5581604511e8463620996644251ee99fd46e9fb5
SHA512 0b23d80318508fc95c8c9bee359facbccff34686740db0170af3857bcb5c8cdc3a2c91ca9556e9da0451c9cc59342245191426c9558a5f3d767651bb0e7c4fa3

C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Run.lnk

MD5 d69bbc30b07e82e958acb87130435acb
SHA1 53ba05ab6f6b6f542a5bc279ce97aa9c588359df
SHA256 b54060697eedf1ea753b5e45c81e502306f8bc229d4df9e3a38408238ff95f34
SHA512 448af740ffecf7bb8ce01b593121c15957bf42c14c89ea7fa796ddb50980a63a5ef11dc8f4b6398de26eb71876c5d9b6fed890d9a38c81dceeff17bad71dfcc9

C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk

MD5 f306f65014d12dedab5a5340ec60f94a
SHA1 121b24504f42b73910b3c1d0b4203c759f29acae
SHA256 b5bcbfed4680634090aeac9cf1fc70d1e72846bf0242ca1ed6fe88054dd703a7
SHA512 03fcb95cc1c8c3d69b26c5f484f2818f051bae8ad1c225b648483ba68b3c06107e30ba53a3c6c34c9764c71e665ec763bc858e4b5b4741aedc92c99244ec313d

C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell (x86).lnk

MD5 3ff73947c07524164c633283db31ef48
SHA1 f8d20e99b6c80e1558ba5162388bb5bc807aeecb
SHA256 d5164bb218498a5b30ca943e87c8cc9a83e2bcefdd0f33f52921db0e5f99ec38
SHA512 ec70c50a35d21f4a68259601b656a96c455d5e03867ad8543201b4c96c46b58ff25dc2e9226e23cdc90bf0be012d0f0de73391b2216a1e62768a0f109e84c336

C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Control Panel.lnk

MD5 1f9bcf5f9e2290bdfc1b8f6c5d4af708
SHA1 ff0f9708df4880a7b09c93322e904693bcea8ee1
SHA256 32bd5abf8d86052ca9ca4277853bc1c3018f467486e00cab33931c1850d637c3
SHA512 d192a4ede90a1968d635f001027f1746ae96b1e42c01a2352d6988463817b5f72c77faa4228451bf91afc40b8ac84f53aa8b74aed3c6c1957f7b91f96bebab7e

C:\Windows\WinSxS\amd64_microsoft-windows-quickassist_31bf3856ad364e35_10.0.19041.1_none_b3f1d9ff0e206c99\Quick Assist.lnk

MD5 dcc575d29b412041be273c9ee0729806
SHA1 85702620489231ed1c1829a9899c3efb72686321
SHA256 94e0fef9aecbbe627f8562b6164ac12829bf148f4e23510a752f5a3d53ea6b32
SHA512 1677bbdf395f0df40c5f45ba1f1d67345b580595f6e824b048d56bc8c40484a09aac336d6560e635d2ec4a18b9909f03c9e6b99047ae4637578a18093f8e51fe

C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png

MD5 fa551e41c42b920a61d7d239dfdc3414
SHA1 74f9b0ace251a8ef8d827c6cf8be1464f0cd1208
SHA256 d1c596c3b316166be6e11f1a7836d02375d0475041d12e65c1d5d4b4de1e5926
SHA512 ecee257bfc67eb82b358d15edef8b19ef31f72f0a269f0a307e0012cf668baf3a95a6d768c8b6241f5dae659c0cb0222460129bfa2bf3ede445ef2f423afbb28

C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_contrast-white.png

MD5 437353c9dbc738c7e67f3755169997e4
SHA1 048507376ef8a856f604c1852861b5ff8b161804
SHA256 e1598c9a5c04f83f4eab075e14de275004aad79d7d391ae48e25fb22ab36fdbc
SHA512 9d97a19e9f3a0bd43e6b9dba2eaae89e31c64d0221019fc28398ec4626323ab18b34571b32e060102c4af388f2fc7a53be9babdb8422886f8b401ae1a717bd61

C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\squaretile-sdk.png

MD5 6198b7ba00be74c6985d3839cf0b433f
SHA1 42b3fb77bb7b93d12464718847086358c1b7c495
SHA256 4b288c879a0b7a1ca6a9d5a1680a94a926c66362162282739320b832311edf06
SHA512 d8e92cfaebd29526430dd31fcca7a650eabea324f805e960f99ca67384d53023eaf69d6487677c68ceffbbcc538f3aac4b3b734e90c3dd93f8f2700faaf5a786

C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square44x44Logo.targetsize-44_contrast-white.png

MD5 c4be1ce9dc39fb83fd5a2d617c2a4837
SHA1 eca34cd429eaf350804bce704d19ea61c74fd54a
SHA256 403a36ada7f7579d09670f9b98e7dafec1c2e1beecc5fd26ee6b5fd0b4f2505c
SHA512 3e736e36954c970143a82baa806fa88a36db812d09c08a6ab4d19a78e6d0fd2c42c6b8e59b62f7f4c3fc7806f5b1d9f30e934b404de6465e9280300b034fd64e

C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png

MD5 55c082e5c753a3be7704ddf066d0e895
SHA1 ced13c44a19f82b143b033378d601f93b1de3388
SHA256 e45f697a81e1cbd46046a50597ba9af08e1d8311647d62a17402cc418b0f63e8
SHA512 8a7dff042cf53601adb5212f9bc6a21e48de61faf38096def0a733188e22b57d0141a7b2885ab426f76c40c73ed92fb0ef80abf0e469c83a7c14166a6830a0eb

C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\squaretile-sdk.png

MD5 cc732d0bd874a5559714f32366affe1a
SHA1 b1b7b5585059d53f44d8e0dbfc260472ab658c71
SHA256 a836ae986ad1fdf66b57b8f55eac652b146a474835c2c0ee3a6afc945bd60bed
SHA512 3d9324b6ff7f7db2248f609f2364c515e39985e7db154df70926194ea141cc67a8283b8ec91b0c0f71b97476755cd272ab6af1d5b44c37f1b5821c91d18d4890

C:\Windows\WinSxS\amd64_microsoft-windows-t..minalservicesclient_31bf3856ad364e35_10.0.19041.1_none_03cd5b18c0751679\Remote Desktop Connection.lnk

MD5 27eccac46911147bf1e8bc7a730f67b3
SHA1 4dc7f515188ad12af8e221121c3dcc901d731706
SHA256 9c714f974b8083e63cbb6beb40b3c14d6eb69bd365420a3b5b2f82eebbb5ce4b
SHA512 4c2144a2529208a4b3a0b82c92f8d16aeb7824c7b682dbda190e6af0a10c4c890277070a1977d5cc7cee473d1efa5555e6b3da5c22e7f2614a460b641a608202

C:\Windows\WinSxS\wow64_microsoft-windows-onedrive-setup_31bf3856ad364e35_10.0.19041.1_none_e585f901f9ce93e6\OneDrive.lnk

MD5 6118450a0158591446f0b517880a858c
SHA1 5f2212cffb59d2d3b79210e6834904606eb65054
SHA256 f018e2f7bced508ccd64f579d22930007828ade5fde08c442c9d0c14b1ba6b7a
SHA512 78d4dd56c67cff814b1476fbb99ce9844ef0287ed778fae297b637c4073220c10636180e938d6fbb203831fefe360b8913ee25c9f193e12fa307106ade731e72

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-18 03:48

Reported

2024-10-18 03:50

Platform

win7-20241010-en

Max time kernel

126s

Max time network

19s

Command Line

"C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe"

Signatures

Renames multiple (2316) files with added filename extension

ransomware

Drops file in Drivers directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\drivers\en-US\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\drivers\es-ES\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\drivers\fr-FR\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\drivers\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\drivers\gmreadme.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\drivers\it-IT\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\drivers\ja-JP\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\drivers\de-DE\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ld869rwRuHeO9Tw.exe" C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\System32\DriverStore\FileRepository\prnkm005.inf_amd64_neutral_c03c9e328608873e\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_environment_variables.help.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\netl160a.inf_amd64_neutral_f8bdd2cbac28a8fd\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\de-DE\Licenses\_Default\Enterprise\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\prnbr002.inf_amd64_neutral_db1d8c9efda9b3c0\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\ja-JP\Licenses\_Default\ProfessionalN\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\migwiz\PostMigRes\Web\base_images\System.gif C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_script_internationalization.help.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-RasServer-MigPlugin\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\migwiz\PostMigRes\Web\base_images\ClickDownNormal.gif C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_format.ps1xml.help.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\prnbr002.inf_amd64_neutral_db1d8c9efda9b3c0\Amd64\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\ql40xx2.inf_amd64_neutral_b95932400326817e\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmnis2u.inf_amd64_neutral_de46607a02fe2552\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\prnca00i.inf_amd64_neutral_09ff5ee0a0cf0233\Amd64\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\fr-FR\Licenses\OEM\StarterE\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_hash_tables.help.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmjf56e.inf_amd64_neutral_328dabbf0aeed9bc\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\prnbr009.inf_amd64_neutral_fd2ac5b9c40bd465\Amd64\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\et-EE\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\ph3xibc12.inf_amd64_neutral_ff7295ba5a46d63f\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\es-ES\Licenses\OEM\ProfessionalN\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_pssession_details.help.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\prnsv004.inf_amd64_neutral_fc4526bbfbd5feb1\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\es-ES\Licenses\OEM\HomeBasic\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\ja-JP\Licenses\eval\ProfessionalE\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-ActiveDirectory-WebServices-DL\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_type_operators.help.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_format.ps1xml.help.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmarch.inf_amd64_neutral_4261401e3170ebfb\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\prnbr006.inf_amd64_neutral_f156853def526447\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\sti.inf_amd64_neutral_9d9a7113099a28a2\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_parameters.help.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_Redirection.help.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\flpydisk.inf_amd64_neutral_f54222cc59267e1e\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmbr00a.inf_amd64_neutral_aa4f0850ff03674e\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\prnok302.inf_amd64_ja-jp_708c81a8b0ad8846\Amd64\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\it-IT\Licenses\eval\Starter\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_Automatic_Variables.help.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\de\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_amd64_neutral_668286aa35d55928\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\ja-JP\Licenses\_Default\EnterpriseE\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_Comment_Based_Help.help.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_modules.help.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\prnrc303.inf_amd64_ja-jp_b0dcc6693f67451a\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\migwiz\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\winrm\040C\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\ks.inf_amd64_neutral_2b583ce4a6a029a1\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmagm64.inf_amd64_neutral_ef322a8cc2738a9b\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_arrays.help.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\tape.inf_amd64_neutral_c6a6811d3d827dba\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\fr-FR\Licenses\eval\Starter\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\migration\WSMT\rras\dlmanifests\Microsoft-Windows-RasServer-MigPlugin\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\MUI\0407\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\prnle004.inf_amd64_neutral_beb9bf23b7202bff\Amd64\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_Return.help.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_Session_Configurations.help.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\de-DE\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\es-ES\Licenses\_Default\HomeBasicE\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\fr-FR\Licenses\eval\HomeBasicE\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\it\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_Comment_Based_Help.help.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_prompts.help.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hjnacehknpcfikna.bmp" C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\Words.pdf C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ECLIPSE\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_Casual.gif C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Windows NT\TableTextService\ja-JP\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\mr.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\form_responses.gif C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Program Files\Microsoft Games\Purble Place\it-IT\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\access\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0145895.JPG C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\buttonUp_On.png C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0148309.JPG C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\ViewHeaderPreview.jpg C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Monet.jpg C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_corner_top_right.png C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21364_.GIF C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD15302_.GIF C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_Buttongraphic.png C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_foggy.png C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\images\reveal_hov.png C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\id\LC_MESSAGES\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked-loading.png C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\EmptyDatabase.zip C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\olh001.htm C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\SoftBlue\TAB_OFF.GIF C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Americana\TAB_OFF.GIF C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationRight_ButtonGraphic.png C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BREEZE\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\QUAD\PREVIEW.GIF C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0101866.BMP C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0202045.JPG C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationUp_SelectionSubpicture.png C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Program Files\Java\jre7\bin\plugin2\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Program Files\Microsoft Games\Multiplayer\Backgammon\es-ES\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Program Files\Microsoft Games\Multiplayer\Spades\it-IT\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\STRTEDGE\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RIPPLE\THMBNAIL.PNG C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH01179J.JPG C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\d3d11\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\reveal_hov.png C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_gray_thunderstorm.png C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\ended_review_or_form.gif C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR1F.GIF C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\attention.gif C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\es\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\timer_over.png C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00171_.GIF C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH01607U.BMP C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\ELPHRG01.WAV C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\images\bPrev-disable.png C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\14.png C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\kn\LC_MESSAGES\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\J0115836.GIF C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MEDIA\PUSH.WAV C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Windows Defender\de-DE\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsPreviewTemplate.html C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\background.png C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\winsxs\x86_microsoft-windows-d..entsnapin.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_1f442ea698705799\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\assembly\GAC_MSIL\System.DirectoryServices.AccountManagement\3.5.0.0__b77a5c561934e089\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Windows\Performance\WinSAT\Clip_480_5sec_6mbps_h264.mp4 C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_netr28ux.inf.resources_31bf3856ad364e35_6.1.7600.16385_de-de_5550642744c2dcc7\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-m..nistrator.resources_31bf3856ad364e35_6.1.7600.16385_es-es_b4f3bd8b9b817f90\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-m..splay-cpl.resources_31bf3856ad364e35_6.1.7600.16385_es-es_3d3d80da66f582a3\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-main.resources_31bf3856ad364e35_6.1.7600.16385_en-us_ad7a885e4314c58b\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-cleanmgr.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_e89ba9cb6f9dcbc3\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_prnbr003.inf.resources_31bf3856ad364e35_6.1.7600.16385_de-de_cb5615c491ff5304\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ca7ec133e2786d8f\about_environment_variables.help.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_es-es_b8490213a810a8a5\403-8.htm C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_de-de_7f0b185800a159c3\about_remote_jobs.help.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-directwrite.resources_31bf3856ad364e35_7.1.7601.16492_fi-fi_23882454ace900c2\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Windows\winsxs\x86_microsoft-windows-gadgets-clock_31bf3856ad364e35_6.1.7600.16385_none_d7244b05e242e449\system_settings.png C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\assembly\NativeImages_v2.0.50727_64\PresentationFramewo#\1badf57680aebab32f17bc080876b61d\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-t..shell-adm.resources_31bf3856ad364e35_6.1.7600.16385_it-it_fe68f514b890400e\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_ph3xibc11.inf_31bf3856ad364e35_6.1.7600.16385_none_3bc5d976e6440be5\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-i..converter.resources_31bf3856ad364e35_8.0.7600.16385_fr-fr_0821fb4c2461fee0\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-peerdist.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_9b89faf20b1c0148\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_rdvgwddm.inf.resources_31bf3856ad364e35_6.1.7601.17514_es-es_96492366c41713aa\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_es-es_27c74b34efa6572d\about_split.help.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-a..apc-layer.resources_31bf3856ad364e35_6.1.7600.16385_it-it_ae96531c25d8c5a3\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-networkcenter_31bf3856ad364e35_6.1.7601.17514_none_93bf831def70cc80\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-shacct_31bf3856ad364e35_6.1.7601.17514_none_242839193814d663\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\msil_system.runtime.remoting.resources_b77a5c561934e089_6.1.7600.16385_it-it_00d935abb10ea99e\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-c..n-comrepl.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_a9142181f8e64ace\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-diskpart.resources_31bf3856ad364e35_6.1.7600.16385_de-de_277d1b6cb03cbe8b\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-s..spp-tools.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_cb414a40d328b0e1\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-scanprofiles.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_a6b2c5bc94701aa8\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-a..ecore-acm.resources_31bf3856ad364e35_6.1.7600.16385_de-de_0cb3073d2ecf8808\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_de-de_0f8ccf36b90bab3b\404-4.htm C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\wow64_microsoft-windows-oleaccrc.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_09252ff637951494\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-stickynotes.resources_31bf3856ad364e35_6.1.7600.16385_en-us_567f6e855a658d02\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\wow64_microsoft-windows-appid.resources_31bf3856ad364e35_6.1.7600.16385_en-us_9c7424fcfaec8d6b\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\wow64_microsoft-windows-storprop.resources_31bf3856ad364e35_6.1.7601.17514_de-de_882cadf458ac205f\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Windows\winsxs\x86_microsoft-windows-g..ets-slideshowgadget_31bf3856ad364e35_6.1.7600.16385_none_253e8c58002c48e1\play_down.png C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-r..lelevated.resources_31bf3856ad364e35_6.1.7600.16385_it-it_5acae4bdd4a85c2a\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\wow64_microsoft-windows-p..econsumer.resources_31bf3856ad364e35_6.1.7600.16385_en-us_1c05266de8a7a982\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-a..mecontrol.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_0bde965abf387612\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Windows\winsxs\x86_microsoft-windows-g..ets-slideshowgadget_31bf3856ad364e35_6.1.7600.16385_none_253e8c58002c48e1\pause_down.png C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-c..omplus-ui.resources_31bf3856ad364e35_6.1.7600.16385_de-de_4bbf55d3818495b7\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-i..ional-codepage-1361_31bf3856ad364e35_6.1.7600.16385_none_7da022f32445383e\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_netfx35linq-vb_compiler_orcas_31bf3856ad364e35_6.1.7601.17514_none_f4285a06060032a9\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-i..ional-codepage-1250_31bf3856ad364e35_6.1.7600.16385_none_210f16bf6c318f89\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\assembly\NativeImages_v4.0.30319_32\UIAutomationProvider\3bfcfe12488f0a2285f5f08274cbc13f\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-i..ingconfig.resources_31bf3856ad364e35_6.1.7600.16385_de-de_1e16a13410c46dd2\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_de-de_0f8ccf36b90bab3b\404-14.htm C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-s..on-wizard-framework_31bf3856ad364e35_6.1.7601.17514_none_1478eaa56818c3c0\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\wow64_microsoft-windows-p..ll-events.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_7802df3065a94f62\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-p..topeerdrt.resources_31bf3856ad364e35_6.1.7600.16385_es-es_259154a3a31d63d8\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\x86_netfx35linq-system.web.routing_31bf3856ad364e35_6.1.7601.17514_none_fd1c2b9df8518df3\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\assembly\GAC_MSIL\System.Web.DynamicData.Design.resources\3.5.0.0_ja_31bf3856ad364e35\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-d..ment-core.resources_31bf3856ad364e35_6.1.7600.16385_es-es_6db201f5db13dd71\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-dims-keyroam.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_b81eae384c698287\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_mdmracal.inf_31bf3856ad364e35_6.1.7600.16385_none_94654f616d035e4d\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-help-legapp.resources_31bf3856ad364e35_6.1.7600.16385_it-it_6c81f55919af8fd2\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-tpm-adm_31bf3856ad364e35_6.1.7600.16385_none_47f0687a93cc8b71\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-v..kprovider.resources_31bf3856ad364e35_6.1.7600.16385_en-us_310eba4283ecd151\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-hlink.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_55c131c9c47c8396\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_subsystem-for-unix-..lications.resources_31bf3856ad364e35_6.1.7600.16385_en-us_8002fc80e6c60075\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\msil_system.web.entity.design.resources_b77a5c561934e089_6.1.7601.17514_de-de_c5bad6a78437ba67\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_umpass.inf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_2587d188972e129d\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-b..fessional.resources_31bf3856ad364e35_6.1.7601.17514_en-us_090436357cf6c2b9\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-w..ty-client.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_14f92bf9e03a1646\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.CryptoTorLocker2015\ = "KZXBQDZALDHFNGD" C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\KZXBQDZALDHFNGD\ = "CRYPTED!" C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\KZXBQDZALDHFNGD\shell C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\KZXBQDZALDHFNGD\shell\open C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.CryptoTorLocker2015 C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\KZXBQDZALDHFNGD C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\KZXBQDZALDHFNGD\DefaultIcon C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\KZXBQDZALDHFNGD\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ld869rwRuHeO9Tw.exe,0" C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\KZXBQDZALDHFNGD\shell\open\command C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\KZXBQDZALDHFNGD\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ld869rwRuHeO9Tw.exe" C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\55522c1da2cf9392d2258d90652114d2_JaffaCakes118.exe"

Network

N/A

Files

C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\HOW TO DECRYPT FILES.txt

MD5 de3a3b707082b03731cd74bf977523ad
SHA1 a9fcbea5239c1b8c0597c784603f3a67fcb1ffb2
SHA256 21efc99273c3b60e01b4df75dc2c96f8aeca13df0ca77374b00a2368812db6fb
SHA512 b7196c3be7230914ac2378574e3b72c9a4a4ad17d36d40a5bb93eeb4d50be72a94e397a8fd568426db85682615e2522ce1a9a4a95b5a73e5633099c4ee3ae6bf

C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif

MD5 57a830c949e2f06785a8262b23c8a733
SHA1 083ad85c2dafc16548b7f05141b888104414d379
SHA256 39f6ce804e25ec1131c30085684d368808b793a4cc71641c76912d84038f6fc4
SHA512 711cf475f6573ab7b07d75e460ed61684e703997c1fe3a42cf52dc6cfa6de6e19a8bf6a44c17579cc5ee9eea2a086d538a2227c798ec1d371588f6ccc33d92bb

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html

MD5 38f98c109a2c1a5b6739bc81268c13af
SHA1 9e12019d407f0b1bbb8aa88eb2f823bc21e6a390
SHA256 8ab0fa048eef4442cc15885666d9cac6cb90cb2a8d20d8408cdef8f5bd35ad56
SHA512 5b8cb3857597c12bc1926b5dcff56cb4489cb32e73fd5c6985f285ef01fe86ecaf3d8b8be5cf4bb5ccd3467cb7f6987d418f2fcd75d0e614df8ec00fb904eb42

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html

MD5 7948a8ba37b47213c32abdcfc3846a29
SHA1 f086fe246b1077888e254bd3113a49fe65b2e173
SHA256 e9d440d0262bb118bf9b80d9549c5d706e51d41b3229fe419f41ce6d1576d818
SHA512 9d27000003a8b39ba966cdebbd8935cebbc527003bd56fdfad59530a1fdf3acb7d47742803a0c8de60d9633c1086ef973d2815ee2135f4e4c44ef22d672b77d5

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt

MD5 383c482a636802db9a99d43276e87e97
SHA1 8f8c2b3030c8d6fc7af6a54302e88aa441fef1ac
SHA256 c52b7fe97dd298f855de24cee1de6930c07db3a32ee397096caabae7e8b6be88
SHA512 2cc6c8e05bf52ad40f348ab383dad1015aeaccb4b9dd620fbd0ede54b1a723ec2ec4cc7376b9e6f2166dee83e41c44d3d31be23f3a58a1dedd4742412569407e

C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt

MD5 dc81c89a0fdc6c79fd233d002979db62
SHA1 bc68d7fd647dffbcc796c1337244fd76dab2afbd
SHA256 bb3d4c16b9c7b9a64a29ea6f9ac13ad90d74079ac4a6301d037021e4a75aa43a
SHA512 ec61a53f2932d1f30de6ff55b3a0ef9104d177efa59c901966776722f4a020797e5a9648aa70ba73ebc7e91f3216e0fa83943529d29293fb0e6e4ab200d8d285

C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME.txt

MD5 fd32ad39b6b3a2b1ef0d5439b0d9bb5c
SHA1 eeed56ae7d5ddf1d79784bb87ab1608624bfc540
SHA256 bf29388fcfdbd7ba0026865560fcae5d6945d23e6953a9ced846e3383177f81f
SHA512 f6c83418df5f700a7424f11f0187c12bfdbe140ba356a39505d16a1e4d809894f300c095421c4cd44ca20f3902b2f5b70b1313626633e799e761fd433710725b

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_ON.GIF

MD5 ec7dc1b9e9f053055369cd3f25092b90
SHA1 70b14962ecee0c4134cd4467291c35a8f3716d0e
SHA256 d63fcc143b12e19bcea3734a9c929e56c93397bba47c19d9b79cbdcf21e83ae4
SHA512 318feff90c0c8130891c515644130e78344b8ced5ee1354034c79e68f2ffb978cd9a73dac780b2833a4d0b38afcfe2eccdcd00b4e4a7bf1bd9571b44989f5985

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_OFF.GIF

MD5 cefd12249a8366ff0154ee471b08a31e
SHA1 3348dae218b0d32ebaa629bda68ac7b59ba3d4f2
SHA256 1a375ae37399bfaeebdea494386f3a6783dcbcda155e26edfad897edf76ea026
SHA512 541301ce269a184382fd9619bd2caafaa8cda35140322dbbcdd7b380ced4c11212fe1386bc2ac1f86ddd2693f75973ec5bf94675dd40055e388ba31a7a56ecae

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\BG_ADOBE.GIF

MD5 14a4941c94817d377a727bc27095f66b
SHA1 994913eb07affbd0f75d0634285f070de848443f
SHA256 708fbb5e8e6aedea750a8a9451438d3bc7dbb3177fcaf3b14e26f691259649d9
SHA512 b2f7a15242961c2bdf534b352dbf5fa8293d742a7e44ab7d9c7993a6671147c281a2edf80a28b5b3b86751c536d0c516ad2495eae5b0d7466b76caa78da2375b

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Casual.gif

MD5 a29233b7a716d1781ad3e1464b77cf99
SHA1 fa5080259cc2b24cf312d68c4d2f1ff756110b52
SHA256 92a8d81e455252e187f25c54c6abc5a86b9824ca0eee0031ea618a60b7624df9
SHA512 68daf24ed4e03245545a84281184d159a7d5370629a30088f2e9a0e5cd905ee49ae64394153c30e2f47227813da5fa41cc92a22af1b8e1d3016f29b33aad9eea

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Country.gif

MD5 22be573fd73e2c7ff4fd03fcb47dee24
SHA1 ec54f8f672378f7fce0601256ca797449882fa95
SHA256 52a8ce30b0db12a6b470fdbf2566d345f2536ae1f8ee1eb3fddd712e456be474
SHA512 6581bd911fb439e7bab51c0f40a7a5c1ecf52fc54075599bff99e7df79c92baa712baf4c857bff84e620fc983754b906c4a6ad4d0f33e02b03e0032bffa3c18e

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Earthy.gif

MD5 3c34290f6f4eae0728ca9ca7d87ced14
SHA1 c19d3217e516d1ebb85428931b1cd31620902600
SHA256 8c7fc0e3888bdbe07af8d8cee20fed8287bd4c54f7165982f439ef4be0218fe1
SHA512 c297de3d9b88062b477b709cd348e6b778cfdacc2ab64dfa3c14d923c0ce9f5c82db0f52b7a1ee307518299732faf4ef62eaa0d237499f08fe183575a77d6d94

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_GreenTea.gif

MD5 14a26774deb785b6791dd5ef1f69b169
SHA1 bdb76c3473cddb35a0bdae5d116945c39d474ea6
SHA256 f38058ce05ca81e82f5047a5754df56495a9855d2079a02c74c16c22e9812ad5
SHA512 9ac5a6f042435f6ff8f096ac220fa43cc08e633d114398d9f860c8bea39bb01e2b46cfd2c4e8e3ca95c7f50247c6fc76458ec35bd8bd7ae47e42512286a74d5c

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Groove.gif

MD5 0b1a0591faeb402f99a8cd53e5bdf41e
SHA1 d37dc96b016d2a55604c23157184d96241d1125a
SHA256 9f26c2f6ed00bf293ed14ed8a8c1b0e2cdb1d2a010cb1dc3cdc8325ebafeb59d
SHA512 67e61bcb75025e1bf224b8511f1bfb740434c2ac4d279359d8e6bf037fe2f71990c57375f5bd30fdbee93c9b8929816968fb019a8c154722bba5bacc3599d05c

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_LightSpirit.gif

MD5 3a87e3ddd89c0028f5429854014a585c
SHA1 4aa382183506ecaf46b16f4de176fd2d66fed8aa
SHA256 2a1683dbfb18a39ec8ad5965874cdf1c15bc0e0b2c2b67b3cc881a3aa798ada0
SHA512 d9c55428f0605bcdc0b3690433ef9b99ecf50dd5bab4889af279b85ec425b4c7167baf7f99d41a8a56e9279c999e4718048d412a3d588b9be4030ee933fe987e

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_OliveGreen.gif

MD5 492e0f9e006ac1820e5622a4e545fb73
SHA1 4c08ea6d43b143854d01e0f3332ec42e3c732dda
SHA256 107fb23b3b419458ac92e122b802af53638d6808529f0939960c2865644cae73
SHA512 3dc8ba423be623137227b366866be21f67d2523a93c140d5f37ffd8e0225067330036a4dee1e567bb138eff634ad6ce5e99ad09d34b28a6eb64f83bc97e09953

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Premium.gif

MD5 907a158e6210764ca7b001a822051c3b
SHA1 4489c4d8f0d14f8b9b57f5a25fc29ff76d80c6b9
SHA256 46f1126d774a3e33ad4db237a2c192afe509b8dba5aa5f1faf45de64daa3fdff
SHA512 12847c28931d803d0d392f52bcc48707c0e70a59a3e05cfdc214ab9651cb4aa7e8c1f383a343fc8ceb639ecc409c808cfc4bf6ee0e328b71b9dc7f9602ba2977

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_SlateBlue.gif

MD5 5bf87c0cf82181868a566b5ccab3dd7a
SHA1 dc0887971ce17eb926c458bb424737a557bb028d
SHA256 1bf59736e99830fb982970e531f40674947ab08da59d8c4e62faa5c186f53814
SHA512 47ac584e0748710168c62a8b43abc3262114d71d078f50a6baebdd3ca3e0e31ca9a41a8b65405db19d0eb8726268bcca9964467a83125a849710e61c71b0d207

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_TexturedBlue.gif

MD5 4a28db3ac3eac0eaedadb823676136da
SHA1 4067231d20e4f113950836b707ed3e0137dea85b
SHA256 4ed08c0ebd9a6c39a7e851c0d6aef7795d7b0a57a66b4f302809308dca7c4966
SHA512 a72933075b8635582fece90021238bffe6027e7287d1a7698f93958dba575870d6806f421917f9fdb3a533a0438fb6156769b355b863b2c7a2211514631141d5

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_VelvetRose.gif

MD5 398f28272be3adfabfd76e9348a54f1e
SHA1 4caf2f78a8fb083f11654e79b123dc8c78ad3ab7
SHA256 722dbc0b7ddfaf394cbead65b0337646538f9075ca1b09913b0ef2d8d313f448
SHA512 12e0e8f698ed2554242f3ec9ce4c69270f5de16324e6b51561cb1548c9ebe2c5466b30360d26c9437b6a7a1286dcf83c73d6f32a2585bb9d311a69dc3837dc18

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BabyBlue\BUTTON.GIF

MD5 533f2be325c3b9a9149c9eab6ae723e4
SHA1 2047891b3827529a3fc0f929e517e867f6102c86
SHA256 5e022a5972a0e7fb879687cfbe09a9d218ddccd8b415e0cba5913cdda030d1c6
SHA512 84d7bd05b5e09bd951ab9a79b65b0d659c4ad213474da81145e6055c810484ac5c0bb685792c3cdd1ff823f66bf7e3873e026cdd5fef172c77b7ecec01c729f6

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\TAB_OFF.GIF

MD5 c8d46423ea2627948c1156bd6af8f6f7
SHA1 fbc5d7089ba4f5fe56739f5f6675d28d4505e997
SHA256 ac5d35162824730c6ef53435a9760ebf170d5433acf23992eaf2a76bbf392f62
SHA512 ce5459c1b21ebeaf1f0efca6a29c0e938f768ccbf629e365cb3a24dc6392b44b0e99b09079358f36a6980436b489abc4ea707bc5fb74efd7283c223745e26f13

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\TAB_ON.GIF

MD5 7f2d6fed64bc6315c71e7c9fdfa3b954
SHA1 fd0066b427f4a8080fc41ea949987434c1387138
SHA256 8fd6bb1f8b0a992435ac8209a78f793a74b147db8e15a786852fac3b3f8e35a4
SHA512 93fcfaa64ca2b7352d0fcc663cc37a8c3922bc0652e1e3be50a0e375c24dd5fd6a0f8fb37f1882de8eabff5e41698f0d8748ce02c5670c9c56e047508874827f

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrow.jpg

MD5 d5e27683050e21fcb000fa3e9fbb15ed
SHA1 bc8cfe0f8814ad2ae6ccd2aacca8d6f1bf6d32d9
SHA256 367098fa65f72829e47d6708f76ef3aba420d5381f18f6f4ae7997f580079248
SHA512 1227d3c432e4f60cce9fed6d42e8f7103744383863a748a79028119dcd667b530c6d4afa8d61f07ded52fc40f50a8e8b9a2b8866c65f71da944e4e9ec42bb95a

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrowMask.bmp

MD5 53f1ab7650657f5272d1fa4f421088a1
SHA1 82f42a4322f169fdd9d4ecc30e677652dc0db1e4
SHA256 0ccbf763cd79cfe383afd4014e81d285d5addf6689cecebb596b2a42eb32964d
SHA512 4e9d130bbf4649594f6bb66081beadbb9bde194b0b919795461114b76bd81df38a6d359da06a18a917880245c046df2ef0e2244fbb5fc1b3ccbb0cf26666ed91

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\attention.gif

MD5 c432446b67ad3878e17c842e2e1d0c69
SHA1 9a9cd58fa7c7f48410dad19823a9f1399cec76bc
SHA256 b10cbb8b0730eeb6f45e4f4ba0fd7c2037de62847675692e7f0b4e87e190ebef
SHA512 7064360845b2b30e98204f3b2188e007a1e4c973dad73e677c3df0a1856dad0df926ade5baccdc721e2df6065c87e7b46c46f78065c1dd0c68d627636f7c9ab8

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_FormsHomePageBlank.gif

MD5 9f0ba2a36a3082be519d274d78526a7b
SHA1 0ffaaf835ee187049686124c7f9ddba212a8f619
SHA256 0c9ef77a02daba5e35de529810611fa0c07e0919b20c09fdcb3f78f19bb1a27d
SHA512 2c1bec723f33649f55c29c96647d4a7e9c805386fcf0c012358cd7049ba5ba222e1c744bb1d91184f5149c924d2b86e21ffac4dfeae48166f2b7e3ed59174079

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BabyBlue\HEADER.GIF

MD5 4809d0695cead8aeb404b8f2aaf83dc4
SHA1 2f02f63758cff105d7c8e7df9e8b785cd8cdc0ac
SHA256 22c5ea682a07fa83850973286572884cbeb80bfcd1d8b9fd5cfb68c13fe58b20
SHA512 2195e36fdac54e6bb0ab117a0d5c2b43d143ce21cc2004b8c3c09439bd3e3b8c0266e41395bb300e86e2701e08d687c709b65c4a30ff5d0e8eb33294efe7dcc3

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightOrange\background.gif

MD5 46f2a4b0457b60f4ea4c4bcbe2504f2a
SHA1 df3fdfe7485a49f0d1d991239585a416799b2456
SHA256 b8664e4776ca024187e47fdf014a1362f3dd02f13bebc8adf0e80fd7993cbec1
SHA512 9feaa518dc3301ee987b4f9b71b580958c08c7fac5e302f91620c4dc724d0c9a38cfc8aabc087e283b062c34f209816a1e8799142b963b18193fb0d376854e58

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightYellow\HEADER.GIF

MD5 a21bc3dcbecdc11fd296e5cf46f44c43
SHA1 030ccc7431c25aed652741d4808f5882a1049feb
SHA256 fd0c137dd52e9c0d986971f58247f6765cf1c52e27bdd5f06a01a7f0272423af
SHA512 3b78b7f134549c72549ffebf651bf85f3b8b1fc1371accb9f7be0fad431bbb76687c4b0324a490cda80ab990c9ca6562704d48424803c904d04ab7d780adbe6b

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Desert\HEADER.GIF

MD5 4988c45f53c9e57312d486d07ca4e909
SHA1 96a7a636a526048a2bf1a0442034349fa93e02ae
SHA256 710dbd7cf31c1ac196513c3455c20fa12fc22dc43be16e98e356e607c8d2e79d
SHA512 a21d493fca27c9b0eb1318e45e2e119f38026dc076c56874355c1f2f3fd2bb0483d5f52144e92de6b810f7ce3c0b653d0909bd44d43541b0b469221aebba297f

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\GrayCheck\HEADER.GIF

MD5 b5372027ce92cbb150826dcd4cbf00e3
SHA1 03f7fad0c91bef12c5d67e4ffe46006d499aff67
SHA256 eb386b54ad33f0fb9108fcdcefd6e4752151c0725abfccfff15564a61679f4c3
SHA512 857e8aa52e4a2a72929cdc78a6f3743041ed1b5a7323bce3220a0891f3238467762132048211c0cda62a1faa27dee9102579ba1c1a8af28eb5ccb2aad489bb51

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\TAB_OFF.GIF

MD5 cdaea752d04262c5141a34938f4eafb3
SHA1 d3ff3a63bb4a484663233f8d9a81b4b7a5f3c49b
SHA256 ce004943dc0dae80814d02a0b57f8926b4832d10a310a7fc309651bee9a78df8
SHA512 9c0f0333fc350023b38ad4726a649fb864aed9a45c75456029a6562cb8c78cb963f59fd821ee65e44a4665303b66d8c047beda464262a6c4cda1d228b54fc0c7

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\TAB_ON.GIF

MD5 747f84123e54e76c5a81264ab4cb8525
SHA1 d26b8a886188dc549d13732ea248bb8f10967788
SHA256 c794690e1f66050712f4fd03d57406636f95b801bcad8dea1e6d54473e960323
SHA512 6bd49ac02a30f97ca22a3c7ab89909afc43047a91d10045720d772b9c93a206708badf449c8df46c6067ebb9d63ff28c5f042a148df0d59ef74ed1ccbf121852

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Oasis\HEADER.GIF

MD5 e2af228e6b46ddf27534b57fb43385e6
SHA1 68e9c6e6abebfc02e87c029a8c483aab0901cd35
SHA256 f5fc87804dfcdf5db84f4542e3e6bebedc62597111bf4211c71a9d3375f8915c
SHA512 7d8a95191e768fd32e2160a0ad14bb6f1affd957e8f3ee481ad447cc1c826068dbbfeb16c84fd1c829e6e56b8372c58ce2e58860df3ac550618ea923b84c2471

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\TAB_OFF.GIF

MD5 152b5b54e61bb329ea5289304384332f
SHA1 d3dc4955282ea41890130ff47c3c909a6ea63a33
SHA256 15ddcf6e82bec42d33ad2feb0fc16037b3dd5a38c45ef9350e5a248b7c985a01
SHA512 b51c61e937383d81f3a8d6fe51c0dadbc5fb6910a10f5f67317fc40820a8c7923878459c9091a97ff248989980b5afd2999cbf6ed38fe25ee2dee9f70c1d7cdd

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\TAB_ON.GIF

MD5 6410bea46eaae6720b7725a3753a84ea
SHA1 787dbe13f9e181546d8e239359b460c174283f38
SHA256 7a9c48220d3b09f0099e0d2b331069c76d763d39f453eed8e606bceea9f4d784
SHA512 16ae92f5d165b37b0642188d7aa2e63f1e4867ddfded7760728b4018a22a07ea3320c937f19cb559add5f6f6587f51b800eff91ecbfdf53230efdd5213e0dbfa

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SoftBlue\background.gif

MD5 e5588bec3a03d5a1b9ebee8048ccc7d8
SHA1 90ec8137d90129d9a5ac4a19ddf6cadd04d2cb69
SHA256 954256225cfea55d1f07710645fde442241175684142d4bb77c28484ed058db4
SHA512 2fb09eb74230f854cad10c38b72e2b3a20e1942396a62d912dac1769be506709317036507c8553e49c771eab04d613a883d058eabd785bd765a7b7fd46276472

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SpringGreen\BUTTON.GIF

MD5 da6edbbd6f9b111151edfcdb1eaf2333
SHA1 b102cb0f9131c52c9688e163c55fd9f93b15ffda
SHA256 20ebe5319352d11039d8314d2e8909ab94e6a1907b8ce8795def73ae30fffd48
SHA512 0a23a3b3b1e94493f9fbeb49fc1df1d9db72550a55ad897094431795f561c896ca79dbfd37114b7d959c39c5d7b8c8f43182fb7f52df6cd139715260b8aad57a

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\background.gif

MD5 71ce17ee97473b90deaaa86f2bc9fc6e
SHA1 1c1bb7b261e478acff43c38f45cb8b6705a4a1f3
SHA256 41be77e318effc7c42997b26f2dac88b76771c1cf5cf78e05d4b3995bec2c2d3
SHA512 bd5ad618c6c375649cc4ee780010d8506b88da0cdb4c5e9892ac4bef673b96f10b64ef843787b1994bdeab9f84f1953d8e4cb3835037f65d55089bf7d47599e0

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\TAB_ON.GIF

MD5 58e21dd664ef25fe883754aac4a35455
SHA1 b371ff3a88502d70f79128bb8da265339491afb0
SHA256 fff5ff194d37a6869dd250c5a88c4a5f11faec0bb9f76a465c0eceb0ae144ddc
SHA512 b1cb4628f942ba741b92cf61cc35aa02cee91e9d502e89accc66616e453a6fcf709bc595ca7fb3f6530d51235436019294a979e87dfe5604eb4358bcd410b927

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\TAB_OFF.GIF

MD5 5b724dc8e30dd4fa31e86156dae0aa74
SHA1 f3fc2cb17509c945333a3417a919b29d021fe4c6
SHA256 aa7c068883f0272d51c51e908c295065c023adaa71f5f2fcdeb3225a44f08324
SHA512 aef2942910399fb8e6f1227e37ef196a06237c5cac4eb8bb523a298dd3595b608558c9141bf3d1e4837e3ff2664b233e99aa1d0b065173928820467d2bd0bd6a

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\HEADER.GIF

MD5 93d96e913d3311cf40a662a8cf950d97
SHA1 4ebf31ada723699459658e0068048c42adbc3f4f
SHA256 eaddb84651f9f350545f50db54ae8309171f56a6953879f3a027f3cfe0dd62a8
SHA512 7a39daf77870a940a8f9e6503705d9f0c1e9908163785701da66a2f9b8e37365d314892fccfe305e2808e7ec79b57d28e5657e6b0d2a7d8da54281972f4bc5e7

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl\background.gif

MD5 7f184abdd298166dfc409acd2b47ea27
SHA1 4ed4464e674a0b7017252257974cbc47fad3affa
SHA256 0ba8501f6ed7736a0beb23838d641cb068c60165c905e8c92ad34a63c17741b4
SHA512 a6402ede53ffd7ac0e0e827d7fff792cc497d55bcffd858e0ec5b221372d1a16469fbede282fa312dedf54f1b9dda1a087c64712e38e0b5bf709e8b4274bb81e

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl\HEADER.GIF

MD5 14212551e3f93d2e823a1b3cd848c9a4
SHA1 43d524e516cbd3000032eaae90af8657ac947f2a
SHA256 643fcef557808072085c4b22fc6337339bab3efbb3ec94aa229dfd18b1dd7c3d
SHA512 f086349eaa53770e6c455bc115d33e14fa3be51aba4fb304632598eed3b1c01962ec92d9b95abd5247cd1dc4dd33bff3bec5141aa065b9db5012b508a384aa6f

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormToolImages.jpg

MD5 3af3bb6bc06b6f135acf1f7be7caf590
SHA1 11c5b10f32587f360c7a062ac66163f69077b444
SHA256 f43fc318cd6d670273b546cb135519924f83181cd0f8a7c9ef6367293ee01019
SHA512 30517f07fef2ff578cd26369e5a05916d4acd9bf8cb8d7d181cd0413c03194aea842ba40970ee8e8b50fa4a6c6430cdbf45e1ebdad9ff91583df21b5f4b09e04

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\RTF_BOLD.GIF

MD5 0eed268a7884c2bad2ef2ad2a134d5be
SHA1 15f534c9fb21d3436daa828f63d4b9567b16b1aa
SHA256 08b3be554389ad52a72a1eb8bd1bd2096138ffde451fdf31f5164116d5d08b9a
SHA512 93f02b85a94faf15ec3c9c9c6bfac931250c83eb4b6faaa703350a6923ae008ec29d59aed9b7539f4e0a1df16303fa54c397f44520acf57ac93fa5ca6237210a

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_choosefont.gif

MD5 50e131098d07143f00ef1f9ca5093bcd
SHA1 f88d3f0c0290c787dc48b014305715e75c3b367f
SHA256 a0df530f68d1fcb1970a5feb8dd95ae15a1e8ef28b7206d18f784844e92143fc
SHA512 33d2af680a178795bc238ce179e47feb745017c4d75406e5ea9b00a8d5c039140c3f4c2f0cd452a129c972a2b997cf19a4269506c67b46827f993f9ccd659846

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_italic.gif

MD5 3e49510b2391c977f7297f956fb8f9da
SHA1 801822bc098f82c2686fffd3712c4825903327c1
SHA256 cd67fad45614ac96bfb92404db6993f02e0d37045f6d21c0d67b932439881d11
SHA512 cdaef0a42329f33e6e85da0b94a2d74ea3a4f280ec9804e1a8fae31062e64e8b01ebdb99530a492bbc86a6b0f111577665243ff1b4f410fef714cdbb9cda8c81

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_underline.gif

MD5 bb002368a059b69568ba46b252c3cf32
SHA1 6605ae262e4ed13e511e0ee025ffa372dcd8ac74
SHA256 ebf11b8d1451b76d80456c3294b0a27814edd3503ad13e1a2017525786cfcd70
SHA512 1062699a47cf5b75d9d334422cb0719984227b923f58ec26f46ae694aeddeac5ca60b05263e59c9de03255b58b4a1376570fa1271e0f2806caa75810b9c17929

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\ViewHeaderPreview.jpg

MD5 84cb3932097f37fb2363a3de69994123
SHA1 cd007d46a7d4a538a2f13f5e19e6cb1c9ca62ba9
SHA256 c60b96367124b8ff8fd5ba38ac509c9edaaa7a38868991be11b608a9d2cb4bdf
SHA512 1c9537a664c4578876de92547202a0fb47e7cc7d007862d160b5eb3d230966551573df4354c97012f2794bd2d710f9b08e2ddd031a5ecf648b86ce7e12c0b203

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\ADD.GIF

MD5 6b7850535345001e9470b786947e2d55
SHA1 55f731649a90fabfb7d439083d0d7879481e6c74
SHA256 d3d93da4c3b37e55fa1e1c44e003ad22b4fbe946f25a066fd6a65d4ac65299cb
SHA512 ed2a9e276ad83e689de06097514f833e47d296ac770f714e054fc0701e537d909fbf25c5ab70a52787695d5c24e9252263f3a7a4d26ba7b14b7a187cd4e3f11c

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\CALENDAR.GIF

MD5 9d46f26294783131e416e0b230543665
SHA1 7274055e525fddb4ea08b398a9af42f534b0dc4c
SHA256 2aad05c7b2ff1e4010c56856fa9d534ccd60271a7e79c70d892162ea6b0cf029
SHA512 6550978a84239472c89c8cd9c0f7fd62400ea355b0ce23a02d460f22118317d8ba2ff1a975824e837414cf4ae1f28123348f5b4ead7d23e52d0114a014c473a7

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\DELETE.GIF

MD5 469cccd8a3cb6837b9000133ad9f994b
SHA1 ef3c8d662eae0ad9a9d8e20d48957304381ed5e8
SHA256 d8d46fcf594d41bfef96dc33af0d133a2fa3f43e44a9bb71c511f3d7d5a5620d
SHA512 693b41490c991de4166e78f33968ddf52258808ad070eeed6ad9c2f211c866edff0d876c5c2d2f17aecf447d8a7ce5217453f68f539c0ad292f193689e125ce7

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\ERROR.GIF

MD5 87f39aa33de6146a06e3b935020b6631
SHA1 e484aceaa7f198261db9293d61a634821f3f4de6
SHA256 4853fdfbc470340f94cd7065daac805bea850eca34261cce56636ef1ff947d94
SHA512 569f5bdb6b02f6431fe506649d59b224dc56eeaa4a604dbc6af971c14bc520318d51e42c3ac94fa94d537e415075ae79056f214040ef876cf4767bcb037a64b4

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIconsMask.bmp

MD5 342278e9319b37e075773ea2fe62db06
SHA1 2deaef38fa9478ec860ddedb9ebc458bdd71b800
SHA256 06cec502d5da15b6406179109a27de18765d646ca5c99268ee8c52ef164d2e0b
SHA512 ed64880fd6c093818db268f1e1494e067d983bdadcec9206d263c121be61fcc0fc3e26b1b52b747871c92eaf6642f8293f2d7ff326fb71b66bcac93937f4196b

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIcons.jpg

MD5 52b2a6dc694d7fbf70a0b68749c0173d
SHA1 de7831cc9f14ea40cb025e3648540aa985711be7
SHA256 1acabbd7984e194cd02b1a91e2e3cfd73c67997d1e9fef0a3eb112c50534ecf1
SHA512 4bf2138dc44cff0a799539d1de243e4f9956833c13197fe5c209c7a237f8da9f3f7e3de7a012b2341b883151a34889e6cd2080e05bd2069b3d37c628c2c6bab7

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\LAUNCH.GIF

MD5 0abf362e345d0707c34b96d56ec84c35
SHA1 33af14bd0daf1f6e253cf858186ef0d15b1150ba
SHA256 26b8a73cd4d8087d4ec603d21df4305afaa4335c77c7199e72173e848194b8fe
SHA512 d0897d185556b509ff2a49f4005741aadf9fb3ec6a032226d362ead223d6e53776299d61825cc7c5694c2322c361235a792ac2a87310d72be2751bcbb0190087

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignleft.gif

MD5 198d5b671781d36def3f043c122d602b
SHA1 c5ec9c4129d495d6866d46f2dab9731ae9f5f15a
SHA256 45e44b8026e7f43a323e5beaf32bb7576ca485ff6fb9335a969fa3dfc3739b7b
SHA512 48dcc7033f7d434ecf3f951133375917c94bdafa9658867e1dccf78d565a9d69353d82ef8f32ccffc200a1f44f361a3c8d8402cda720879acc149ac15c67d8ea

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignright.gif

MD5 5c41b3fde7d28f3cf7e13a29f9e004ef
SHA1 72de878a87eb108ec12594ef0185266f65b5e175
SHA256 c90a9a5373a59afce2756371db29e6c79c1d88a37282e7c3bd4cb380c2398da2
SHA512 e77c124aa9ca3dd6d43338e8b81236c94905d77e0878b854e3c5e3a40baaa0f484706b9879a14d196d26ba340acbe63796b4f0d3f5c53fd1a2a785841d1fdd16

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_center.gif

MD5 642f0f2e7492b383cd0f2e0b75eca15b
SHA1 c3b6ade2cb8a3754522c4bf0392e8937be23f7a2
SHA256 cf06397c3854cdda76146f73e02e11eb996b37e4c6a413f7ad0462b134e798bf
SHA512 e008e736e8e38746cad554bae65d14845ede49eeb4b4e15a1680620aa8035c241c2b63d26e069762ce4535037eb7c2f4cff429381245a6eac41f999c0965f9df

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_bullets.gif

MD5 f5c5407197d7322d26d75bc3816cf0e3
SHA1 04fbcf505c9579a4645c9d3c5795ce644fc5740a
SHA256 a37cdf2172bdb8809e0686011610b6fc9d9409b88c3018f1dab8e0ac9693ef5e
SHA512 004ef4b247a9db9da28c87b8cca47ff8e50a2c938c3330a5067f86043a99387aef2f55fce72cda66eaa18697fbd2a876ce2c8adfe313b8981f38d2e2f7ec7f59

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_increaseindent.gif

MD5 5885db0a25de918c17c241466cd08348
SHA1 8a05e19b687bfa2133b6a2774d9b93b00c93028a
SHA256 a2f8960ef70a4d43dbd39c629e5624b0013df2ef0aa86a1d10749e25f492ce83
SHA512 bf3d59dfc05d5fae1c6247771fe0be390a55f07c06b830f665c14d4d37c79289b7ebe7daaea54357191bf5ac0b43ce7ecaaabc73b4df262b86d0bd3b54744f5e

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_decreaseindent.gif

MD5 e158bbf14e5cc4493d09ae445613a5b9
SHA1 f5cec7b44e7bbb6ce51befce4f4b017babf9dad0
SHA256 6134944ea4d326d9f384043a9e058e7dcba7278a6e4eeb6e28939df2ea69d66a
SHA512 9817a4929b1c408d819e703bffc37492d52ad6009a68deae4b28fbd104f5693686413635a2fc69536bad1cd651cb396414bb3618eed657dd9d2541ef81ee19c3

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_pressed.gif

MD5 1bf1331f3f8a3b427f6c76c9eb2e1d33
SHA1 69e5d37f92894a7430feb1258c373ab563027a17
SHA256 b541a33c4a00436e451dfdf582e4428b28f197900e17645345ecca42884c8ee5
SHA512 9c60fa51cee129eb76e81b08ef63754a8e132f82725b43a63136b9e9fef2a9ff50c35957a0e3f2e76efeceb2777f274d6a4e677440ac3d9f2b447849060ba637

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_justify.gif

MD5 75a8ea25ac0096f9686259b284853aa3
SHA1 3a6de889578e6e4ab521a50ae78211d2892ff472
SHA256 4c760ff48b5f28e7727701befec69787ae684a9eb5e381d97cd4a364c9ce7022
SHA512 36272979c2bbf855f09eea1d926ae0c836a0a920f49f876d4f719dc0d507a9f23f2ab1cfb926591f53007da90f65ff161d105311041322097e70defba574e0ab

C:\Users\Admin\Documents\RenameSelect.xlsx

MD5 e6aaaff92fef72e768d383ef26c2e386
SHA1 dacfbb437ff39ff527942bbf8bd7428224092d86
SHA256 82414e7382e5e417d6d862ccb90a2cfd83867c68c8a0ddf37d0ebad985c7eb45
SHA512 7a67317175bf4f32edf8f88e1524f0e9846af75768db223ca9ee0f13e40048fa6c73de1a3814332b56bba2774c3a85b2af954e054d2a64c21881aa18e34ac3e1

C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Windows Explorer.lnk

MD5 55eb30eefea881c64907150731204ee2
SHA1 1b28b455a000d446979005887879253c51a7eb62
SHA256 8a7e6161d8951761c01a18a92fe7f65330b286fc6b70a9307516d54abc7cc20a
SHA512 95193d7dd7a5b27490f8d543a64112c9578eb7b34f2c5ce3fc72e89d233ec69747ed2e4b3c74fc1087668d9d1fb7ad19fd988660ceff0602acc54087c38b8850

C:\vcredist2010_x86.log.html

MD5 738d7a7370f040a43b7ecf67a6b50ec4
SHA1 0a1d922802e97d1d4ece5db5e74af93866996c19
SHA256 2e1a7a401d3dc38eea2adeec8b4b51a6e246044b7de969b8baaa4972ec95d8b8
SHA512 2c7c0b2b8b8c7f0565ceb065930d4943c4a8df345eb9c7abf6cc69f98f9f99caf2941f2ce43379b234a3787942b5b42775454578e1b5db283f2c810b702c3810

C:\Windows\Microsoft.NET\Framework\v3.5\SQL\fr\DropSqlPersistenceProviderLogic.sql

MD5 eb45050384f460b8359de2fc6c20ba15
SHA1 499ba6dbfa2b7a21187b6d05f6f647cdfeb3e230
SHA256 dc714b27f7d06b502d6c0a3fde5c25f8de910c563f8c53236e875ac5c5da7563
SHA512 35abd26db6eff92da3c9255cddb249afe50deacc90dd6b4c3c9b5768ac3da6d88cfb2a7adbc8c31bd37a7346c485e53de4e84caae1d8b0a358ef4138a3f132ff

C:\Windows\Microsoft.NET\Framework\v3.5\SQL\fr\SqlPersistenceProviderLogic.sql

MD5 62e40c4abaf9bb39463c526abaffb4a7
SHA1 f85a9e1d35fc457f67588ccb47216dbd8434bfac
SHA256 cb876db64268be8ab0d4aa924d1fc2b32c0f4304a17a319b717e39145277efbd
SHA512 03160dae2e382ce820a08a181a83c31f020dd31815986308f5aefbd43cfcc740096b004a64714e4128ca208e9089b8f67c25b598926343767d40121524cb6599

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallCommon.sql

MD5 2f5e2f5eb831c19fe8c45cbd207eb65b
SHA1 ec94349e8b057d70b1f184a25b58d21f518537c6
SHA256 1472725202e817a3d6cf400d018a66369622be0c987c5404358ec2ba7b1de172
SHA512 1c4704c087e52c824a7fb47a09919f9449c11e2b29876e71c440394e5fcca931440b26d7f76a89fe1efa2f6cab82b44b593fd985510081f055648aeda2ea9f45

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallMembership.sql.CryptoTorLocker2015

MD5 347df849cae49b62f220f52688bc7ae4
SHA1 deab52ca391ab902fa39302bc073ce218bd9d63f
SHA256 e8480828262f4a9f4d24217a2bb6ad991e1c5e94debfe2d3dfd3ccbcb94e164d
SHA512 cad254dce3cfba470acb9dbadfedb18b3a48879a1799857ecee77b376c59cef486d022510d914f9122522c4cbef019615fefa76e46aea171e668e612134c6f6e

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallPersistSqlState.sql

MD5 ad7aaa67b6f2e63d205d97da8f36c82c
SHA1 6abdb36d9781217ce6c17ec31dccf15bed9faf45
SHA256 e5ca1ccbf1fbbde25d797d10785d0d7acada9b048887d6bc963546abd47b2f39
SHA512 209fce4301c82deb3726bef9adb966a9d9ddaa5f763285f11d41cf41d3ab751bd927890a2fff41c88723e6269940822b9badc1e711e2d40be41b69cad3033cd7

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallPersonalization.sql

MD5 a86ea9ab1938f10f9693ea5555a5c69c
SHA1 19fbf46161306ba06656c5fa6bd709b9b1f892f7
SHA256 f831aa223985c7e4a55ae094dd82da43939fc6257efbaad6aab291a5fd46492d
SHA512 cea451d976454bf49c04d807ca0a4f42331c358823325d0893ede025d90c2d4794decbd7e02c5032a60952e5adb7f83fca883d5fd8381e8cc221be708b6b9b4f

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallProfile.SQL

MD5 c53df44f083a63ae9dd2d5b06dd7a012
SHA1 854546fe3b52a93f743bbdce985c79f27b0c215c
SHA256 2cba2497a7b5ff73dcc3d86edff23a5d8c352c86222b6f81894a34a51635ccff
SHA512 a71e58ffc61d435c4fdd29014578d66636ea7ef31d7874bcef20d7200cbb4a51cd4d594ed34c42cdbba033d0d57e0d997d7438bc0cb256459330548e13a90d83

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallRoles.sql

MD5 6a3a8256f36a153d65fcba43fbbff37f
SHA1 17b79c20f63daf1e72af9d87bc26193eb31a29f9
SHA256 cd11c2a12e9e188ac188157e96989c2a8429f0e404954c9fc9d33e940c8ed00d
SHA512 989c7aecf304f36452650a80b29fe00ecf06f623e10ab44a2fe1e2b0687d5519eb7bb9f17014254fe665c94ebc18acaf85113715a85e1d8b6d33fb2ba724319a

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallSqlState.sql

MD5 30c5a1180cf5cf312d5f9e592d573e85
SHA1 30a0b03be30ac9e1f65a36e9ccc6174d15def1e7
SHA256 b01aa06ff2e4bc6073363588f875a52f9cf976bbf2208021f8af83c95787a675
SHA512 13acf9ced245848702b1e469d0a4aca5a45a59c9858cc2c472a4535ee29c47b5ddab8f8bb55063d1dcf3ba135a89234c89b68b80d9fe116d7cae1e1c0075ef7c

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallSqlStateTemplate.sql

MD5 918fbd1d2041c7d1e4ce2246bb41cd15
SHA1 f2d0e578263738fd655f118bec0c4fc273cf9395
SHA256 665b76832f9881f1fb7a643ca69590df8d9fb194493afc81d1849d1be9f1c8d9
SHA512 14d6af03a1283b1c892dc7e250c4251d7ecdfa7f269dafddf55d66eca55ccfe7cf6c762ba00956c1aef5c7cfa11034607dcdbc712e6bab63a846dabe43cf8f05

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallWebEventSqlProvider.sql

MD5 3f8527e01176f9dc52cc37ef973256e5
SHA1 d1a932256ef9de61aad199693244eb38ba4a2a18
SHA256 d988faf1a1f903d16c7437bd0ed1b60ac0d8562ce579ab533d188b5793d1f96b
SHA512 e573b45a3ce8194298fe7cc61a6a7e730fa998bddabdf4019697429161d910dff827498f1c96a697908dc568214c95d08a2289bb962dc080ce85e64197d0d8ef

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallCommon.sql

MD5 01742d1c533dd3c1f4cc209eb26823d9
SHA1 72a84f81b0b53f754f794e070fad381080ae404b
SHA256 e129c64254a19dab17659ea515edeb97c76d6d3db5efb9d35bfe22f3d9f92a0e
SHA512 e53b70eeb81879714c0e8c3fd74634dd2cf20c82bffef218fcb2ed741451a0eeff70560c4fb8726ab6976a5f163e671e88ecccde2fb1bac7ce5defff3aac1fb3

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallMembership.sql

MD5 d86d414de312bc13e74fb9d4ceb5c260
SHA1 e10281827b477b052037e567c8ac9a220dd97d2f
SHA256 da421342e6991d6d6ebdabb51be7e07997cbdaf2e12cfb1b1c49f34713d9e769
SHA512 0d0dae34820e19408097282732f99ea03d3c57a14daf1f5dff8ba1acb793feb14ffa009cb417f3321b68946a131aa76b03ae45c422cd3c3e81e33d0b11c28ac9

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallPersistSqlState.sql

MD5 0850a128de1a82cc5f9a0a17881c1f6e
SHA1 cbf573c2f4fba4b6ac0b0ebee0a14296aedd2de8
SHA256 ede516cd783c0a2c6dd96d553ad8b2b9b1e822812762c6f4c6a53f3986d17254
SHA512 8012b9d8db14a8bed99b74f03d8305e938f20162716479d8f4dacbd318b9e98df519fd5b24d6267c5c34561875cbed9e3e25bf675f18f090de076ff23ceeff6c

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallPersonalization.sql

MD5 3b3e1960c944512e3c73c9b1b929ef01
SHA1 2579db5774dd6264cf4333bd063192ef2fe59a21
SHA256 a13ab5d9121980fa262db14982a9f5c43b9e71037698407499c79b26f9fab620
SHA512 240effca032f23895e332d5fc5065b67c8909562a775f727136a81ef11ecd0749fbd1f0653a1ddc232a4b5b7329bdec1128fed1cbc661f4520bcd5e014858b1a

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UnInstallProfile.SQL

MD5 bffa741d6728a267dab7f91f69bfce3f
SHA1 b9b30edfbfb9b7383aa9c243c6ae7ea60a416bef
SHA256 aadf222b34bdb651709603ef6e5ae03cbbe7cb9ab2e602dc45f1e9ef171cb7e5
SHA512 d960dc2c101b59621e471c268d3686c625869174c8bca3cbc1519ca340db8b1cd4491e4d3bb330da462ffb87459566ec56e21f3690329dc19babd5a27941f89d

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallRoles.sql

MD5 d7679b06ea3ecbdd56212b6e6e5ed99b
SHA1 7e21ec0198f0740baf544ac172f0eeb69f4df4a6
SHA256 52088e8a2ceb737e6b01ab275f06c84406a36f2c5ca481e53eca2f874ec32c8d
SHA512 ac9d6eddaf473be09a371be9b7e8c5ef2519e61e3031532ad34f49fb28daffb9a5b8382633ebc316321262bbac125bc217d4264422363b594515924bb0c5b27e

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallSqlState.sql

MD5 30c69867898b89e64209cd32f799f0b8
SHA1 2e4683bd9c9986492564bcfb9884c1868e3fe3ee
SHA256 e178ab75d6524539a9c5f89d8b1e4f847e66b0b225767b2afe6a5d93e9784dec
SHA512 672277a2323200ab614996ccb268edad23c8b3571fa323e0543b51ef9976bd2f4bd4e6e1e1a3afcf69ebca973cd2861c59ae8d55b1db4edeedafa5695ceb5e96

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallSqlStateTemplate.sql

MD5 a182309970f6381106eb78c5323e450b
SHA1 2dd1656756bf1dcd27a029c3ec72efe0ef4dd462
SHA256 8852f69921e30f55940ecba38967c9f6a463edcc3c2e2db3d545172023cb8f29
SHA512 964873e3134c60a77e106642aa8ccc6ac0eee6fc2f0d0b9d6040c64400e3a8a98100f594d1fd2ece82806364fdf9aa8d062435a9021bb80a6098cde0dc0d658e

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallWebEventSqlProvider.sql.CryptoTorLocker2015

MD5 180fba033218b528a4613ef7d049c283
SHA1 c09b9a25d60304f7d1045959e083298a006aa5b2
SHA256 461175c174063d0bd5088437b948fd3c48eacb19dce70d579e83c269b487d7cc
SHA512 91aaf26982a5c99997e524d06c93d6154512b222b991604a0bda26dcea74466923c0cd21649281828e085f4b73d48057c0e80ba19b70938933b775099c0658bd

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\alert_lrg.gif

MD5 e841b85ca7a8599d0f049b58727bff89
SHA1 747944e20f878a203faa0f0646edf9507d3456cc
SHA256 1bc9f4a76a209a063197e6c98786fe46e97a85c6e9fee3e806a45d146dd45d46
SHA512 c8b0380a57c10b22a08e6c4842a195c6b8ca0cf02a62e35a5112c81ffa20632e864ec0c12f329fd3816a8a21b052eff56011e82def3059631088414e9743326f

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg

MD5 dd95eb82af1cb745b2ca4c3301a5d937
SHA1 4bb7c2af7ca9dcc0e482f65aeecec3556b4056b5
SHA256 5865461ad13d737ea9e915e788f957eb87b0fb42f69330d6f1b6e4eb73cd1687
SHA512 671f4c939cb5268315d9fc1b766538037f33e77dac9ec810124c04b40f401d14a1d62d4f8bb3646b8a7ba9c6f3f16ec863af308697248357fdab934314436b80

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\aspx_file.gif

MD5 e87496333cad95b8e46106d6df381cdc
SHA1 58e0307579cc8268f72d7fbbc1cf541685024999
SHA256 682cdd99930d4a45de6730d5a7eb27726dd70a63d71d2e87f43f33dfed49bb97
SHA512 74ac90b467302b4dcb2b50752ebc3a1ef230f90b884258a6917bc9c6d8714ac0e238ed8c464fa2e9634b358f139dead052851bfeb13b1b293946619553526d56

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg

MD5 f5ca0a72e88687188f532d8187ce1c03
SHA1 e621b26daf130cf5831ae115b1caa6bc35cbcfec
SHA256 b1d3778117a3d17e122b53cd09722593eb46ce8a8b7f81b38329d6c1c89c5a9e
SHA512 efc5cd587c4053f5c9e2d6c7c9eeca86c5235ed30d00bb049c1c57632d246fdd9dea922d80bb1ae8ef868f83f7d0e186cd2d88192a77f69034bfda6153c222fa

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\HelpIcon_solid.gif

MD5 77621ad0db95cd7aa3b18331bb78e8d2
SHA1 6c7d3cde5521aa243d8ccb9af2d2345e4f361799
SHA256 5da7bf87988f29b04517ba7b20c1058702a2011e675d765a95783d4cd3da5090
SHA512 2c27ddc88d62a30533cf4d9b08d465eade79c37b2c4168cfd383dfeff11ba671ab1b86e26741e9f4379593f2c9b0904a045283202a298e14ba270e706cdafd6a

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\help.jpg

MD5 3ccfaf44d005819cef439334920bb340
SHA1 e0c78ac672e10ad655f6360e115f72ef77048f42
SHA256 18bbb6ab207ff52badfb6fb38636e865934764f4eac24428799917656fa517da
SHA512 37da0d2bd7534d26e2863c768d5e3f6116eab944664126c53edb977f649604703320dffb4060d7d995631a2adf18f11f2054ea19571b464fe0c095e9063bd236

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\headerGRADIENT_Tall.gif

MD5 9b0bd05208a5ba2020033788e7979a04
SHA1 bd12653cf4ba32db4d739792e847dc2f086aa816
SHA256 2c3b78fceba0aabe7113a0de3d6703bb14dc346c93f7dc14bd5ee81fefdc84b7
SHA512 1f16daa98b9e4255e5e1628f42d21934bdd94c136af0008ead70d9f0f4f6470481d153e96791037911f2054348fa4fc891208a80051da351f46e72a057b02d14

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\gradient_onWhite.gif

MD5 be9fe65fbfc61621793bf89536f7954a
SHA1 6f53058bb15ed6eeffb365f173d4a4eee0e81f9a
SHA256 c6a5a8060eae79d8ef967bf18665b9e977c6fdcd64cc03669f64dea5cd85414d
SHA512 d54dcf9d1b6fc0a85be546e54cee057d58d3263162b8d77932185394df0d247cf63f2f2e80209220930618dca65c347b7f5769941399c89206459efe84a21ea8

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\gradient_onBlue.gif

MD5 a259c3ac00e96cf08d2275548b1cb876
SHA1 a2e9f00db0ca38ae43981f7382f798b626b805a2
SHA256 841f0fd2181138316e809298be2cc522fd9fa723afa5e5992ddc50952ff9c054
SHA512 48883922d20013bda59c8d3fbaea40d36b06b387c935cac6784511912cca91a1be3669e6ae2fae96f54aa9511d8388a7b6eba4892b430346c737536365e4aa06

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\folder.gif

MD5 2e41ebef7742876009d1fb72f3ce19d8
SHA1 f5c031e2f4e9870d6d0249cab70813a165df54bf
SHA256 d43826bce1d5f3c9faf9f7b1205500b1309b34d24e42ecf0e2f1f3ff0d5d9a3b
SHA512 aaecb12b6cada85043c626d183568a06ab0e64c2853b9c1bb40ff5d42716cdb690a7d28a1a512d17398253fe9ea0244bd4ec46e553eba62fe8c92eb1d1bf2cac

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\branding_Full2.gif

MD5 4e20fa35bcbf9f033b49d59e54acea7f
SHA1 186956e9223bcb506cba537ef5ff57551c2188d1
SHA256 82ff24a31c042ea6930c70c2fe200de83c9b4ccfe08d29744b9bace629d4a6a2
SHA512 d91aa67998896668f4479fefd6823aa97c0d77d58b0d085fc0bdeeb20c58baa360ddb3402bdd7f37310f4869e296d88c73a609cb578758672197c1f0800bb25e

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\image2.gif

MD5 b51a56346d58b0fac59af274ff3279a9
SHA1 339e23d11069a2f8e4d82cd93294838996303fc8
SHA256 b229020ad39a2b4707f34f31bacfba9d1e9d465be20d8dd3ae9765c25b85c494
SHA512 a9882acf4e56a7543001d0a8d61dea92c19dd264f6c7c0b559eb84e673bcc58f05e8717b686e96d14113219a379d27a33f50008525a3a961d9ebd6050f0212d2

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\yellowCORNER.gif

MD5 819a8e49f1223052d4e30cd9b97c973d
SHA1 b180a701732381c8181c2aa934736f2fa6976feb
SHA256 f1950f445c0a2c561ec4ee234527aba545e09a0261b905069fe4ed82589e6ce9
SHA512 2f11de6bf9ad373ded1ead2d5be8064f645adbd9a75d324f7306fb541bc743634a59618895d41a990264d392441010692294a941a37cdeeec08b14dcc7db0591

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg

MD5 eac6b774af88cd2ccf20983b32687982
SHA1 6a577f56531e5ce18849d633db3821cd947e8aab
SHA256 67cd596e4b11850054916be44e50077c1c2c46c0c7727718aacd199a93dc50d0
SHA512 8c03f5b17f6262c866edf31f1cd23f703b8a2dcff9c6b9b6fd3117844632630a249a3cf5ee747fefc47bf9bec31c6a9cc1f8b0dac2d46f084a6e6fc4d753da25

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\requiredBang.gif

MD5 441faf5cb3be6e74380fbc118dc50aed
SHA1 9ab30ba04d852d1fe87d0ade6e5471e0fc0882ff
SHA256 f850cec607088830be8084ac4207dc137d81d5ec3b2b1b6b12cd53600ebde6aa
SHA512 27295068852229e2607390149d7c47efd5781ed947f1a05b897ee3ae34e2159dc73d7609defd3c5da298a0bc6b6127aa5bbfcf595f9db9559b8f250e0040dbc0

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\image1.gif

MD5 82f1bfedce7e7b611760ffcf22993cd8
SHA1 9a5214ebefcd028524e63b7556e39c627ac74846
SHA256 509a26b2811348cda04734de3bcb6cf1c9b75c1f2e39f2ae775c319ceab75fcd
SHA512 f13c666af9cbbeab71c03338a941732d039a670c7b7a8904159ec130a59bb3508ec61fbc5153558ee424013e3e5a79f6cf5e92afaaf7e98d2ba30bb83421c44b

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SQL\en\SqlPersistenceService_Logic.sql

MD5 90b0cabb51844f14482d16f8f462570f
SHA1 7c0156ae6142af88c9a3c8ae4cbedd869070a0b9
SHA256 930ab5f94640fd3a208b52220a34899e952bd63bf79e8052ae86996660ec4c4e
SHA512 978b2729b4670c8fc71e4d61c090a5963007832c4eba2f30e30cf53cf17ca0ad05a8ca1e1cf7c99b576d6ea7a26ceb909d061277234ff538b1de9add1c9b5d2d

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SQL\en\SqlPersistenceService_Schema.sql

MD5 eacb7bc7db1a9066ba9e328650f1a872
SHA1 52a37ed5a366eb191a9543a7b65a09e90e3ee344
SHA256 bc5390eb9a58c1192764554db53216fcad1aebc6ee027b0d79fac646edea84aa
SHA512 603fe9b71640e82a73f2f5ade0a827f11df789da1c81e0d6058df66b954034ce3c83b8ee181f9a6885ec503c45d3819661356acba4dfe3db0798cdfd13d70768

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SQL\en\Tracking_Logic.sql

MD5 26d88cbc4f4ec65e960eaa3fc3cc1ac4
SHA1 7b3dbd9bdae7fc7946ca9e27c2a0d5d9a6d8a5e7
SHA256 bb308c19646aad0083ea4b6e8a17bf6bf2f70e43e6c1882555585b1667ed07e8
SHA512 7896ae0bef3782e322d273cfa9ef21be1f28fb7f64573c0e429c0443bd847b1a0bf36cfadea7f64817e8dd9968204a8cfd1448b27ed9c0746caeb18e4074effe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SQL\en\Tracking_Schema.sql

MD5 a5f02f79f67873187936065ffe01b4f3
SHA1 3147e67aaa752e8c4be17e970f33aeb7250ad27d
SHA256 3d2f288bc88b484338ee61f339d353897ad80b4d8fb095ff731d9d1ec26ded6c
SHA512 47fc44c34bf67557310f262e866e0bc181bdd7b419c0c1bc587c3f2cf81551fe8f9dcb809bea876e8ee22e72a1070017d56aaf4188388965541fc51966667df3