Analysis Overview
SHA256
20165d77c3851851b5df4fa23850bf02ebf990fbb80d387d0007b4ba52ac64a3
Threat Level: Known bad
The file a26906c09acbcd300aa4a7f237249282_JaffaCakes118 was found to be: Known bad.
Malicious Activity Summary
Xorist Ransomware
Detected Xorist Ransomware
Xorist family
Renames multiple (2190) files with added filename extension
Renames multiple (2170) files with added filename extension
Drops file in Drivers directory
Deletes itself
Checks computer location settings
Drops startup file
Reads user/profile data of web browsers
Loads dropped DLL
Executes dropped EXE
Indicator Removal: File Deletion
Adds Run key to start application
Sets desktop wallpaper using registry
UPX packed file
Drops file in System32 directory
Drops file in Windows directory
Drops file in Program Files directory
Unsigned PE
System Location Discovery: System Language Discovery
Enumerates physical storage devices
Suspicious use of WriteProcessMemory
Modifies registry class
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-11-26 14:22
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral2
Detonation Overview
Submitted
2024-11-26 14:22
Reported
2024-11-26 14:25
Platform
win10v2004-20241007-en
Max time kernel
150s
Max time network
140s
Command Line
Signatures
Detected Xorist Ransomware
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Xorist Ransomware
Xorist family
Renames multiple (2190) files with added filename extension
Drops file in Drivers directory
| Description | Indicator | Process | Target |
| File created | C:\Windows\SysWOW64\drivers\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\SysWOW64\drivers\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\SysWOW64\drivers\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\SysWOW64\drivers\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\drivers\gmreadme.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\SysWOW64\drivers\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\SysWOW64\drivers\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\SysWOW64\drivers\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\SysWOW64\drivers\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\a26906c09acbcd300aa4a7f237249282_JaffaCakes118.exe | N/A |
Drops startup file
| Description | Indicator | Process | Target |
| File created | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
Executes dropped EXE
Reads user/profile data of web browsers
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MD79PFRQ4de5n55.exe" | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
Indicator Removal: File Deletion
Drops file in System32 directory
| Description | Indicator | Process | Target |
| File created | C:\Windows\SysWOW64\StupitHack.exe | N/A | N/A |
| File created | C:\Windows\System32\DriverStore\FileRepository\mdmrock.inf_amd64_9b13bcc1f320d1ad\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\System32\DriverStore\FileRepository\pnpxinternetgatewaydevices.inf_amd64_82b90e51473d48ea\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\StupitHack.exe | N/A | N/A |
| File created | C:\Windows\SysWOW64\StupitHack.exe | N/A | N/A |
| File opened for modification | C:\Windows\SysWOW64\StupitHack.exe | C:\Windows\SysWOW64\StupitHack.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\StupitHack.exe | N/A | N/A |
| File created | C:\Windows\SysWOW64\StupitHack.exe | N/A | N/A |
| File opened for modification | C:\Windows\SysWOW64\StupitHack.exe | N/A | N/A |
| File created | C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_amd64_9c09bd1df352f065\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\SysWOW64\StupitHack.exe | N/A | N/A |
| File created | C:\Windows\SysWOW64\StupitHack.exe | N/A | N/A |
| File opened for modification | C:\Windows\SysWOW64\StupitHack.exe | N/A | N/A |
| File created | C:\Windows\SysWOW64\StupitHack.exe | C:\Windows\SysWOW64\StupitHack.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\StupitHack.exe | N/A | N/A |
| File opened for modification | C:\Windows\SysWOW64\StupitHack.exe | N/A | N/A |
| File created | C:\Windows\SysWOW64\StupitHack.exe | C:\Windows\SysWOW64\StupitHack.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\StupitHack.exe | C:\Windows\SysWOW64\StupitHack.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\StupitHack.exe | C:\Windows\SysWOW64\StupitHack.exe | N/A |
| File created | C:\Windows\SysWOW64\StupitHack.exe | N/A | N/A |
| File opened for modification | C:\Windows\SysWOW64\StupitHack.exe | N/A | N/A |
| File created | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_PackageResource\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\StupitHack.exe | N/A | N/A |
| File created | C:\Windows\SysWOW64\StupitHack.exe | N/A | N/A |
| File created | C:\Windows\SysWOW64\StupitHack.exe | N/A | N/A |
| File created | C:\Windows\SysWOW64\StupitHack.exe | N/A | N/A |
| File opened for modification | C:\Windows\SysWOW64\StupitHack.exe | C:\Windows\SysWOW64\StupitHack.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\StupitHack.exe | C:\Windows\SysWOW64\StupitHack.exe | N/A |
| File created | C:\Windows\System32\DriverStore\FileRepository\e2xw10x64.inf_amd64_04c2ae40613a06ff\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\SysWOW64\StupitHack.exe | N/A | N/A |
| File created | C:\Windows\SysWOW64\StupitHack.exe | N/A | N/A |
| File created | C:\Windows\SysWOW64\StupitHack.exe | N/A | N/A |
| File opened for modification | C:\Windows\SysWOW64\StupitHack.exe | N/A | N/A |
| File created | C:\Windows\SysWOW64\StupitHack.exe | C:\Windows\SysWOW64\StupitHack.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\StupitHack.exe | C:\Windows\SysWOW64\StupitHack.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\StupitHack.exe | C:\Windows\SysWOW64\StupitHack.exe | N/A |
| File created | C:\Windows\SysWOW64\StupitHack.exe | N/A | N/A |
| File opened for modification | C:\Windows\SysWOW64\StupitHack.exe | N/A | N/A |
| File opened for modification | C:\Windows\SysWOW64\StupitHack.exe | N/A | N/A |
| File created | C:\Windows\SysWOW64\StupitHack.exe | N/A | N/A |
| File opened for modification | C:\Windows\SysWOW64\StupitHack.exe | N/A | N/A |
| File opened for modification | C:\Windows\SysWOW64\StupitHack.exe | C:\Windows\SysWOW64\StupitHack.exe | N/A |
| File created | C:\Windows\SysWOW64\MUI\0C0A\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WaitForSome\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\StupitHack.exe | N/A | N/A |
| File created | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\MsDtc\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\SysWOW64\StupitHack.exe | C:\Windows\SysWOW64\StupitHack.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\StupitHack.exe | C:\Windows\SysWOW64\StupitHack.exe | N/A |
| File created | C:\Windows\SysWOW64\StupitHack.exe | N/A | N/A |
| File opened for modification | C:\Windows\SysWOW64\StupitHack.exe | N/A | N/A |
| File opened for modification | C:\Windows\SysWOW64\StupitHack.exe | N/A | N/A |
| File opened for modification | C:\Windows\SysWOW64\StupitHack.exe | N/A | N/A |
| File opened for modification | C:\Windows\SysWOW64\StupitHack.exe | N/A | N/A |
| File created | C:\Windows\SysWOW64\StupitHack.exe | N/A | N/A |
| File created | C:\Windows\SysWOW64\StupitHack.exe | N/A | N/A |
| File created | C:\Windows\SysWOW64\StupitHack.exe | N/A | N/A |
| File opened for modification | C:\Windows\SysWOW64\StupitHack.exe | N/A | N/A |
| File opened for modification | C:\Windows\SysWOW64\StupitHack.exe | C:\Windows\SysWOW64\StupitHack.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\StupitHack.exe | C:\Windows\SysWOW64\StupitHack.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\StupitHack.exe | N/A | N/A |
| File opened for modification | C:\Windows\SysWOW64\StupitHack.exe | C:\Windows\SysWOW64\StupitHack.exe | N/A |
| File created | C:\Windows\SysWOW64\Com\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\SysWOW64\StupitHack.exe | C:\Windows\SysWOW64\StupitHack.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\StupitHack.exe | N/A | N/A |
Sets desktop wallpaper using registry
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pcfhhknppceehkpc.bmp" | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
UPX packed file
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Drops file in Program Files directory
| Description | Indicator | Process | Target |
| File opened for modification | C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\Assets\GameBar_AppList.targetsize-48_altform-unplated.png | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File opened for modification | C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\Assets\ValueProp_Shadow.png | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\ja-jp\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File opened for modification | C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-black_scale-180.png | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File opened for modification | C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\MedTile.scale-400_contrast-black.png | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File opened for modification | C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\ThirdPartyNotices\ThirdPartyNotices.html | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File opened for modification | C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-white_scale-140.png | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\en-GB\View3d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\en-ae\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File opened for modification | C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\StoreWideTile.scale-200.png | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File opened for modification | C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-64.png | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RIPPLE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File opened for modification | C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Dial\RotateVerticallyOverlay.png | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File opened for modification | C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteSectionGroupMedTile.scale-100.png | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File opened for modification | C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\GamesXboxHubSplashScreen.scale-100.png | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File opened for modification | C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\BadgeLogo.scale-100_contrast-white.png | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File opened for modification | C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\ImmersiveControl_Button_Click_Sound.wav | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\cs-cz\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File opened for modification | C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-white_targetsize-96_altform-unplated.png | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File opened for modification | C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailAppList.targetsize-36_altform-lightunplated.png | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File opened for modification | C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-72_altform-unplated.png | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\sv-se\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File opened for modification | C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSectionGroupLargeTile.scale-100.png | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\review_email.gif | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Program Files\WindowsApps\Microsoft.ZuneVideo_2019.19071.19011.0_neutral_~_8wekyb3d8bbwe\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons.png | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File opened for modification | C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Collections\contrast-white\MedTile.scale-125_contrast-white.png | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File opened for modification | C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\GenericMailLargeTile.scale-150.png | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File opened for modification | C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-72.png | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ro-ro\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File opened for modification | C:\Program Files\7-Zip\Lang\vi.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File opened for modification | C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-white_scale-180.png | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ko-kr\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\themes\dark\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File opened for modification | C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteAppList.scale-200.png | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File opened for modification | C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailAppList.targetsize-40.png | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\de-de\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File opened for modification | C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-black_targetsize-32.png | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\themes\dark\adobe_sign_tag_retina.png | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\text_2x.png | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\en-il\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File opened for modification | C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_2019.19071.12548.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\PhotosSmallTile.contrast-black_scale-125.png | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File opened for modification | C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedStoreLogo.scale-100.png | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File opened for modification | C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-60_altform-unplated.png | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\AppxMetadata\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File opened for modification | C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-white_targetsize-256.png | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_GB\README_en_GB.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Program Files (x86)\Common Files\Microsoft Shared\ink\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Program Files (x86)\Common Files\System\Ole DB\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File opened for modification | C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\Weather_TileMediumSquare.scale-100.png | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File opened for modification | C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Win10\Classic\Klondike.Large.png | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File opened for modification | C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-64_contrast-black.png | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\node_modules\reactxp-experimental-navigation\NavigationExperimental\assets\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File opened for modification | C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\LargeTile.scale-150_contrast-black.png | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File opened for modification | C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\StoreAppList.scale-200.png | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\es\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\fi-fi\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\1033\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File opened for modification | C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\Square71x71\PaintSmallTile.scale-150.png | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File opened for modification | C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\ScreenSketchSquare310x310Logo.scale-100_contrast-white.png | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
Drops file in Windows directory
| Description | Indicator | Process | Target |
| File created | C:\Windows\WinSxS\amd64_microsoft-windows-i..hancementmanagement_31bf3856ad364e35_10.0.19041.264_none_262bc7b233c1d05e\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\WinSxS\amd64_microsoft-windows-directui.resources_31bf3856ad364e35_10.0.19041.1_da-dk_7e0110fe948bf9e4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmwp.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_d9215e46435b05ba\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\WinSxS\amd64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_10.0.19041.1_none_15114cf4ffe3136a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\WinSxS\amd64_microsoft-windows-w..s-service.resources_31bf3856ad364e35_10.0.19041.1_de-de_186d4d64f2d75743\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File opened for modification | C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-debug.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_8db8f5dd3a6a6b3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\WinSxS\amd64_microsoft-windows-c..rlauncher.resources_31bf3856ad364e35_10.0.19041.1_de-de_50d963028d3c601f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\WinSxS\amd64_microsoft-windows-defrag-adminui_31bf3856ad364e35_10.0.19041.746_none_770f598aef14382e\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\WinSxS\amd64_microsoft-windows-n..orkstatus.resources_31bf3856ad364e35_10.0.19041.1_en-us_371f6e25bf6cea98\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\WinSxS\amd64_microsoft-windows-shenzhouttsvoicecommon_31bf3856ad364e35_10.0.19041.1052_none_f102642afd21e47a\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\WinSxS\wow64_microsoft-windows-mediafoundation-mfsvr_31bf3856ad364e35_10.0.19041.153_none_a6fd395b4e3ef24e\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\WinSxS\wow64_microsoft-windows-n..ider-infrastructure_31bf3856ad364e35_10.0.19041.546_none_946b321b2260f332\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\v4.0_1.0.0.0_fr_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\WinSxS\wow64_windows-application..-appcontracts-winrt_31bf3856ad364e35_10.0.19041.1081_none_0a512a946737140b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\WinSxS\amd64_vdrvroot.inf.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_35ecf141accffabc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\WinSxS\amd64_windows-defender-service.resources_31bf3856ad364e35_10.0.19041.964_en-us_4d9efc8c65da4384\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\WinSxS\amd64_windows-media-speech-winrt.resources_31bf3856ad364e35_10.0.19041.789_da-dk_9bc6f58302dbd449\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File opened for modification | C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_cd2d1cde69f392b4\acr_error.htm | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\WinSxS\amd64_microsoft-windows-m..ndation-mftranscode_31bf3856ad364e35_10.0.19041.1_none_75295a6a3248871f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\WinSxS\amd64_microsoft-windows-s..ates-english-update_31bf3856ad364e35_10.0.19041.1_none_7589dc4fe9ce57c8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\WinSxS\amd64_microsoft-windows-x..jectdialog.appxmain_31bf3856ad364e35_10.0.19041.423_none_d93ee361fbbc8f0a\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\WinSxS\msil_microsoft.iis.power...provider.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_e932e117878b426a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\assembly\GAC_MSIL\UIAutomationTypes.Resources\3.0.0.0_es_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_2d3b6ea159ff4dae\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File opened for modification | C:\Windows\WinSxS\amd64_microsoft-windows-ui-shellcommon-core_31bf3856ad364e35_10.0.19041.1_none_91b1f58702057373\CellularToast.scale-400_contrast-white.png | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\WinSxS\amd64_microsoft-windows-notepad.resources_31bf3856ad364e35_10.0.19041.1_es-es_d3a242796e7e97b0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\WinSxS\amd64_microsoft-windows-s..diosettingshandlers_31bf3856ad364e35_10.0.19041.746_none_bacaf9eec0055626\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\WinSxS\msil_microsoft.virtualiz..nt.common.resources_31bf3856ad364e35_10.0.19041.1_es-es_4211d899b571f102\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\WinSxS\amd64_microsoft-windows-cleanmgr.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_b64a50542afd543e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File opened for modification | C:\Windows\WinSxS\amd64_microsoft-windows-m..nt-browser.appxmain_31bf3856ad364e35_10.0.19041.844_none_d9eb415c5b9dbe4e\Square71x71Logo.contrast-white_scale-200.png | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\WinSxS\amd64_microsoft-windows-p..rtmonitor-tcpmondll_31bf3856ad364e35_10.0.19041.264_none_b08e3e3d06047dc4\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\WinSxS\amd64_microsoft-windows-p..tcpmondll.resources_31bf3856ad364e35_10.0.19041.1_en-us_d5031d9f297f85c2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File opened for modification | C:\Windows\WinSxS\amd64_microsoft-windows-s..ast-black.searchapp_31bf3856ad364e35_10.0.19041.1_none_e479c512c8bfeb66\AppListIcon.targetsize-16_altform-unplated.png | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\SystemApps\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\pris\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\WinSxS\x86_netfx-mscorrc_res_dll_b03f5f7f11d50a3a_10.0.19041.1_none_b10fc8572d498e50\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\WinSxS\x86_microsoft-windows-p..reensaver.resources_31bf3856ad364e35_10.0.19041.1_de-de_c1b8af4ac86844bc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\WinSxS\amd64_microsoft-onecore-u..lter-mgmt.resources_31bf3856ad364e35_10.0.19041.1_en-us_cfde1148aafaf969\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\WinSxS\amd64_microsoft-windows-fodhelper-ux.resources_31bf3856ad364e35_10.0.19041.1_it-it_eca97e9509560b36\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\WinSxS\amd64_microsoft-windows-i..gbinaries.resources_31bf3856ad364e35_10.0.19041.1_es-es_e94a5dd9dfbc24b5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\WinSxS\amd64_net819xp.inf.resources_31bf3856ad364e35_10.0.19041.1_it-it_5cfe2c89ee08709a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\WinSxS\amd64_dual_wvmic_guestinterface.inf_31bf3856ad364e35_10.0.19041.1_none_a3750aa62b1952d1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\WinSxS\amd64_microsoft-windows-powershell-exe_31bf3856ad364e35_10.0.19041.1_none_1f070c37a19029ff\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\WinSxS\amd64_microsoft.hyperv.schema_31bf3856ad364e35_10.0.19041.488_none_a82f565621f4835e\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\WinSxS\amd64_microsoft-onecore-c..dexperiencehost-api_31bf3856ad364e35_10.0.19041.264_none_9d11423d6f8d473e\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\WinSxS\amd64_microsoft-windows-browserservice-netapi_31bf3856ad364e35_10.0.19041.1_none_e37e715d37185736\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\WinSxS\amd64_microsoft-windows-iis-metabase.resources_31bf3856ad364e35_10.0.19041.1_it-it_cb4893e894e031fb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\WinSxS\amd64_microsoft-windows-s..omponents.resources_31bf3856ad364e35_10.0.19041.1151_en-us_0e8ac7c8d3abe00f\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\WinSxS\amd64_microsoft-windows-userdataaccess-cemapi_31bf3856ad364e35_10.0.19041.1_none_38bbcecd3c71af70\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\WinSxS\msil_system.web.entity.resources_b77a5c561934e089_10.0.19041.1_de-de_5035e9482686c669\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\WinSxS\wow64_microsoft-windows-i..rvice_mof.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_1447a2258289b923\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\WinSxS\wow64_microsoft-windows-s..ative-serverbox-isv_31bf3856ad364e35_10.0.19041.1_none_b55c875ed22d28bb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.S0f8e494c#\6d056f3fff70a663755a1120dd61d6e3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\WinSxS\msil_microsoft.windowsau...commands.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_770b14145c527c1e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\WinSxS\amd64_microsoft-windows-psmcoreserver_31bf3856ad364e35_10.0.19041.662_none_88b10bbde167d52a\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\WinSxS\amd64_microsoft-windows-wimgapi.resources_31bf3856ad364e35_10.0.19041.1_en-us_cf48a18a5fdfb544\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\WinSxS\amd64_system.componentmodel.typeconverter_b03f5f7f11d50a3a_4.0.15805.0_none_ca5cbef901aaac52\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\WinSxS\amd64_microsoft-windows-b..servicing.resources_31bf3856ad364e35_10.0.19041.1_it-it_aeca62b57fb4ea0b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\WinSxS\wow64_microsoft-windows-aarsvc_31bf3856ad364e35_10.0.19041.1266_none_e20a2c618eea3856\n\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\WinSxS\amd64_microsoft-windows-p..l-message.resources_31bf3856ad364e35_10.0.19041.1_en-us_f65d4067627622e9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\WinSxS\amd64_microsoft-windows-font-fms.resources_31bf3856ad364e35_10.0.19041.1_pt-pt_baf3b18f122c4a5b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\WinSxS\wow64_microsoft-windows-directui.resources_31bf3856ad364e35_10.0.19041.1023_pt-br_eef506143c1bff6a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\WinSxS\wow64_microsoft-windows-webservices_31bf3856ad364e35_10.0.19041.546_none_f6ca498bc1e24c44\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File opened for modification | C:\Windows\SystemApps\Microsoft.Windows.FileExplorer_cw5n1h2txyewy\Assets\SquareTile44x44.targetsize-96_altform-unplated_contrast-black_devicefamily-colorfulunplated.png | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
Enumerates physical storage devices
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\StupitHack.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\StupitHack.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\StupitHack.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\StupitHack.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\StupitHack.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\StupitHack.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\StupitHack.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\StupitHack.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\StupitHack.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\StupitHack.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\StupitHack.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\StupitHack.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\StupitHack.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
Modifies registry class
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\GCUJCNQFTQMECRU\DefaultIcon | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\GCUJCNQFTQMECRU\shell\open | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\GCUJCNQFTQMECRU\ = "CRYPTED!" | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\GCUJCNQFTQMECRU\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MD79PFRQ4de5n55.exe,0" | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\GCUJCNQFTQMECRU\shell\open\command | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\GCUJCNQFTQMECRU\shell | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\GCUJCNQFTQMECRU\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MD79PFRQ4de5n55.exe" | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd11143 | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd11143\ = "GCUJCNQFTQMECRU" | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\GCUJCNQFTQMECRU | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\a26906c09acbcd300aa4a7f237249282_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a26906c09acbcd300aa4a7f237249282_JaffaCakes118.exe"
C:\Users\Admin\AppData\Local\Temp\Pizdec.exe
"C:\Users\Admin\AppData\Local\Temp\Pizdec.exe"
C:\Users\Admin\AppData\Local\Temp\StupitHack.exe
"C:\Users\Admin\AppData\Local\Temp\StupitHack.exe"
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\a26906c09acbcd300aa4a7f237249282_JaffaCakes118.exe" >> NUL
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.214.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 232.168.11.51.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 75.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 209.205.72.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 56.163.245.4.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 241.42.69.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 107.12.20.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 30.243.111.52.in-addr.arpa | udp |
Files
C:\Users\Admin\AppData\Local\Temp\Pizdec.exe
| MD5 | 50c7c57e78e9d7b62abc477640ad52bc |
| SHA1 | b6940cb51c59037c8882c8655faff8b4abd36de6 |
| SHA256 | 8d416efbba749ad336169c94865b8f061f27ab14d3c7532ce65a1ee66a30da91 |
| SHA512 | db438be083930ce83d9af38db4aeaa328a6d8bde2d431485c47712b1f67cc0a6a414ee8c58ade03488c74e7968ee6b05d5f2fdaae86c745203c490e5d6452976 |
memory/4160-12-0x0000000000400000-0x0000000000414000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\StupitHack.exe
| MD5 | 4b46a0763cc3a4d5e8425c710ed89d4f |
| SHA1 | 3edd04e111cba5406ee286db3f7c970ef34d7c53 |
| SHA256 | 8dbc58dc724a2c25d2b4d46ee528bc3007f1260afedb71c4cef6f9325d60b627 |
| SHA512 | 1ebba09fa4eb8fbeaa976458c0eaa52f7f5622b522d9d17f815e6c27a5d458bd343fddf1807f7f17c7623ef87f6e439375b9477dd1050c25a2e9f1f33dabcbbb |
memory/4940-18-0x0000000000400000-0x0000000000455000-memory.dmp
C:\Program Files\7-Zip\Lang\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt
| MD5 | e1729097a23480f095671534ca826c69 |
| SHA1 | 2fa21ac0be0059c42344ea7ba1c2a82ca794e265 |
| SHA256 | fe7a9dce50a1cce7cbda97bb8a30e2065b54317ef3e753dc4901495d5a2b3124 |
| SHA512 | f17e4d46bfa962df72d3ae4dc96b8e02702ad30fa955fd3887bfbf4deefbcd45f0906a4ca30821efc3c95687765edd2565a509c52986912f5e5902e9b71dc146 |
memory/4940-150-0x0000000000400000-0x0000000000455000-memory.dmp
memory/5024-158-0x0000000000400000-0x0000000000455000-memory.dmp
memory/2308-233-0x0000000000400000-0x0000000000455000-memory.dmp
memory/2108-269-0x0000000000400000-0x0000000000455000-memory.dmp
memory/5024-145-0x0000000000400000-0x0000000000455000-memory.dmp
memory/2456-330-0x0000000000400000-0x0000000000455000-memory.dmp
memory/1328-329-0x0000000000400000-0x0000000000455000-memory.dmp
memory/4460-346-0x0000000000400000-0x0000000000455000-memory.dmp
memory/2456-343-0x0000000000400000-0x0000000000455000-memory.dmp
memory/4460-356-0x0000000000400000-0x0000000000455000-memory.dmp
memory/4076-361-0x0000000000400000-0x0000000000455000-memory.dmp
memory/2200-368-0x0000000000400000-0x0000000000455000-memory.dmp
memory/4160-367-0x0000000000400000-0x0000000000414000-memory.dmp
memory/5104-360-0x0000000000400000-0x0000000000455000-memory.dmp
memory/5104-364-0x0000000000400000-0x0000000000455000-memory.dmp
memory/2200-404-0x0000000000400000-0x0000000000455000-memory.dmp
memory/740-413-0x0000000000400000-0x0000000000455000-memory.dmp
memory/740-421-0x0000000000400000-0x0000000000455000-memory.dmp
memory/3624-415-0x0000000000400000-0x0000000000455000-memory.dmp
memory/4500-480-0x0000000000400000-0x0000000000455000-memory.dmp
memory/3428-475-0x0000000000400000-0x0000000000455000-memory.dmp
memory/2524-486-0x0000000000400000-0x0000000000455000-memory.dmp
memory/2488-541-0x0000000000400000-0x0000000000455000-memory.dmp
memory/2488-588-0x0000000000400000-0x0000000000455000-memory.dmp
memory/968-591-0x0000000000400000-0x0000000000455000-memory.dmp
memory/2332-493-0x0000000000400000-0x0000000000455000-memory.dmp
memory/2524-491-0x0000000000400000-0x0000000000455000-memory.dmp
memory/2332-488-0x0000000000400000-0x0000000000455000-memory.dmp
memory/4500-485-0x0000000000400000-0x0000000000455000-memory.dmp
memory/3428-468-0x0000000000400000-0x0000000000455000-memory.dmp
memory/1280-467-0x0000000000400000-0x0000000000455000-memory.dmp
C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif
| MD5 | a11be41db4b3b8d31d269d6cb82e7e62 |
| SHA1 | a3d48811affcad19ec140eace2ef7e5cc5ea83c3 |
| SHA256 | a4006db8376722c698457875f3d3788aa8c1086776b4b1f8fe70ff8bdf9dacb7 |
| SHA512 | dc385e6c6a717f4aea1ba3aa14209132c9f0fcbbac444dec112b60f896029c9192df2e25a9f5d78ddbd7dc5224708fc27debbcb5bc9dd28d35de477cfcb702b0 |
memory/2160-627-0x0000000000400000-0x0000000000455000-memory.dmp
memory/4412-691-0x0000000000400000-0x0000000000455000-memory.dmp
memory/4948-742-0x0000000000400000-0x0000000000455000-memory.dmp
C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md
| MD5 | 2c9dc476bbb74266c6d11169fa322441 |
| SHA1 | 3df18b3d3ad59d4aaa607e887ef84cb7f62aaf14 |
| SHA256 | f2621ccf8d02c825d34d2bb0879cfa6bd9ba2575558b8269e0cff49a4bf5f2c2 |
| SHA512 | 998a98912c0fa639cf9eae0de64baee45df8ec072de49e83798e2ece5afec58c496a7c1157834d6351a48a1862642be61dd58ee8b79a085c801590fabcdc32dc |
C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md
| MD5 | b8bf6c4db89071bf44483ccfe2d9ca94 |
| SHA1 | 9bf3ded3e280b8c466d1708f71f6221109666e23 |
| SHA256 | b38b264c68d94386bb5d48b4f16609c595b5d1e29a61f4f0817d26166518cb16 |
| SHA512 | bafb66b1892a977b049722ef3d9407618f57137a6b570de83cee0df8fbc22007d3139d91aa81267e802cb345c5f8cdb35cb051645cf2795d530116f69e938260 |
C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md
| MD5 | 424803d070e6f71e2ddaeec8f914be0e |
| SHA1 | 2ef8b37338123e5e3c4accc9f2ed3c8c7c642dfd |
| SHA256 | 40bbad07227e73ed9236d6289cfd156a851f3a0063f1cf8e278a84c3e2f64db0 |
| SHA512 | 1a319d6eab9474717d3d0eb400b446013b39f241f0216d50b06792d913d1c83923635ba51982f768c1015d080ba61b7a57832839676ea49d03d431645ec68ab3 |
C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md
| MD5 | d1536bd8a6fef57e62e9b8d9589b0e89 |
| SHA1 | 12cca1b49ee76dd3fbaf9eeb5f4d329d1d0e92b3 |
| SHA256 | 50880fbf19ce02fa36b95577870ec5c32924a6887b4bb8ee4773a13ae441486c |
| SHA512 | 76f5dd1870dcfb3a3bee5bda8b4deac4c08ff55b31e3cd6a0d97fb5cd5dca81a0d98aa395d2192a5ab63fdf14d22d743b52a6504fc9cbcc87972cea0754010bb |
C:\Program Files\Java\jre-1.8\legal\jdk\asm.md
| MD5 | 951377dd0353552fea57fcfda1d4f795 |
| SHA1 | 90f30ede22b76bdb74109af13284363350c8f689 |
| SHA256 | dbec97d815a4594dc6ed77976bb247d8ca7f4941ef695ce0501977ea3341fefc |
| SHA512 | 133c2246186b686ade5eb4c97cc79882f52e7531162265914f026d9db5289af477ecc5d6f0a973abad4a61bc20f3dd3ec0870493b2de8409e2acb95e510f5c28 |
C:\Program Files\Java\jre-1.8\legal\javafx\public_suffix.md
| MD5 | aa5adf4c6a3582956428903a5e451a40 |
| SHA1 | 69eb265d79fc5db0e98ef72ac6422ecdf85924a0 |
| SHA256 | de4efa4d5878e190a144a077a1c1f9a6c67de5b6a27a9369bd00fcc0f208d005 |
| SHA512 | aa645b55ff8ce67958641f2857a36ce2379b5dfb0148804720203df1e1483132a4c3a68d8953ab41a49903f10f872cf459d3080cd38d8f029e97b416e357ccb0 |
C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md
| MD5 | c835590fcd521a515ce262637fa34ce3 |
| SHA1 | ea1f5f58b9dc8d1f9679ffaea75347f264b2df35 |
| SHA256 | bf5ed064dca9d031caa834f7ad553ca8a1d3b04b2c317f34455af8df9a557e15 |
| SHA512 | e26b389519e97af1f7fdc0961084de31d4823e1fb6051c21299fe7f8f4299c0b19bffb72410ba51669ed1b65d914be8b20117cc2227b557cd85969bfcb38ead6 |
C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md
| MD5 | 4d04b2712837a26b6f5243e7d1ec245e |
| SHA1 | 2f0d90dc4ae6dee884612f67a305bc337acfb331 |
| SHA256 | 57489d6b127c8f5fdfee687c447e830d7e73778169ec5b536ae2e817ef9cfdba |
| SHA512 | d08bfe6eff77d541e08cfe3d1814a71254985c0a1aa2a6cab62308f2e10546f2cf456fd713ad16a5065ddf1f1ef04d78dbc4f5ae87363212b3c972c8bed8a8ef |
C:\Program Files\Java\jre-1.8\legal\jdk\dom.md
| MD5 | c191c4ba3b92250b472ddae3a3ddbf74 |
| SHA1 | 5b47b5d828161ffc668c1c93187d64fe232c5672 |
| SHA256 | b0847db957625f64a66fff7f5c85d0ab900fc774034f618500a71dcc3d2911e1 |
| SHA512 | ef43c2d2d6c0a2a49ad5e19a30df1036fa1e99fb64355e0a930a5b0c9d60961a408f22db5b5e71326ace3757e634ea4ebdbeb704f1c2a38e73a95d1525911503 |
C:\Program Files\Java\jre-1.8\legal\jdk\joni.md
| MD5 | d0f76c0e3b1141e78fc34f495a39cfce |
| SHA1 | 6f3b3ac9119a6403b646db867a66f11acf6373de |
| SHA256 | c0f78712fcd8409fdf282c9d9a4f2c29231d1505e8b4392e4fb87fbecb87010b |
| SHA512 | 1d1f09cce0f48945549b353d64bdafba22a019dfb6a41594b8f59f9602d033b3dbe42ed7befdc2de1640a594debead174638506c06187f202d71f11a558c4682 |
C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md
| MD5 | 92bac6a87e0c6b8dc0219ac15dadeaa1 |
| SHA1 | 2fe46d94f877a2ae1649f320255ae10ea15c400a |
| SHA256 | a3ff60d79288bd42c5f92171f8ba854ddb544170ad30af2b19ad3a4a902a4546 |
| SHA512 | 255c53a1d6751a8f0b2bdde3304e2cb355cf4af944fac51fa139f9d3ff79586e9589494913d8cf781114c3d18ba18ad8031ed5a581a3d7405c28710affab1858 |
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md
| MD5 | 5adc35d88ff4a45c90d606772eaa22e2 |
| SHA1 | 6e563ae6e79fcfc9c52b70078e86a5553de567f1 |
| SHA256 | 1423ac65a6b00a9c9f73acaa5033913fe55cac7088d82279813b6c50bd7c3c63 |
| SHA512 | 206ece3093da4de6a115ffff9daafba7376e653653c9b01139b4c29dfa73cb5bc62d196820e5a039fdb72eecd145c4b6046ebeb9e10c2be2c22d7b3bc7828eb5 |
C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md
| MD5 | 5ee8ea767c9984cab1cc09987221971a |
| SHA1 | aad99f30282a2fbe21009932751c3dfa0865249d |
| SHA256 | 240faea879cffaa3df60a3bd6477601baec72349c71596e55b64553866cf8911 |
| SHA512 | 8f971f5be5f69a09ddefca153f6fc98d51bac804cbbf629e648eadec4a496c1312120721ebe7349827dc36da1fdf0d7776b9019a204ecd21edba7c5b6761ad90 |
memory/3536-810-0x0000000000400000-0x0000000000455000-memory.dmp
C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md
| MD5 | 527bd6d49cc62ab4efa3f48cf7e53265 |
| SHA1 | 57d21fb2ca92e62ae52e0f73049ab407ccda54ac |
| SHA256 | 85c1819897694349120a0689b63810de4f7b345c495bdef70056f6889d0fd5ac |
| SHA512 | bd2c95680424a4b3d6a4e9976f246caf5c6e7a0638115997f7b459c54043e83d7236fdc3cd19b7d560370eec1775e0ee14b7064f9f200aec06d9d385a779c871 |
C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md
| MD5 | a141fe7920b04db3d030d365d1a7b3ee |
| SHA1 | b965acbd93b27b68a232d0428b56aa85e4451ced |
| SHA256 | 40337b77f9bbba3187e1f74a6fea11375f3cc1c77c08849452628352ddaa52cd |
| SHA512 | ffcd5eb78c7e0616d08318a9ab51f6148d457c5c0c90f1929bb169134476b0a3f6d1e7bea1eb13d17c05e9fea6c1de7c60aa0d5ee734e2ac7144baaeb12c40f8 |
C:\Program Files\Java\jre-1.8\legal\jdk\libpng.md
| MD5 | 017404da92116dfcff825efcc361fd10 |
| SHA1 | 334dd723d38f2f2d5ca1521afff1deb6c4bee1cd |
| SHA256 | 60c059c5e4646acf72c6581e61f19c0aea11e55063d6a04460c665ea9fa57db7 |
| SHA512 | d92bc183b17dfa2520439618bff41b79a6fc54c94ad281ac3cd2dfe8ce961f543b57ed93b321a4060abf1c4f1a3984647facded96defc5a415cc4b8d630dbf93 |
C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md
| MD5 | ab3a188c4d3e07c807dd564fd6b31831 |
| SHA1 | 3b590fcd68d0ec3b62b960db20ce6043b0c0759e |
| SHA256 | 87db126b2467c45359b1880c8a2571c72f0a6ab7483e35c93573ea71436f9e88 |
| SHA512 | 7ec412ba252812a13bb41900063bdd7ee09c038ad425cb200ec6a640fccb43ba77b81b96d63d7ddb2b81e11fef3d75f35802be423e82d34f47b4d87b1c84d935 |
C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md
| MD5 | 33d015d652f181ed2f79055457e2f13e |
| SHA1 | 4597d62acebe5ed9cdc5b0fa287a7560a8724084 |
| SHA256 | 254aefa3977b222da7c5b7341729a28ee0099b96616c52ac6977283e98d5eb3d |
| SHA512 | 6bc7ab942b60bd48037006a7a9433953ecccc17aa9d0c9b9e43491ac926782c8fbbec4c4d4d0fb629dbe71baf22123c797388079f5334aa2575eec219d2db9fe |
C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md
| MD5 | d89bb6e944cb9773e0e0c9c94fc9d67f |
| SHA1 | 420c4d3b01dff0dba82fd20b3d90123c06df4743 |
| SHA256 | 938bfb82ea682edc3b189d50003af01632d5397964450a37031f6f9339e6071d |
| SHA512 | 8f6da1671820bb461e4114cf4fb8935b1af6fb93052d19a98a5cc3abaa92338b94c981559c3c13a45b153f2dc41b7afbbee093c95253d58244ee874a0de419eb |
C:\Program Files\Java\jre-1.8\legal\jdk\icu.md
| MD5 | 1a93ca4660e73fd103ea024771f76aa6 |
| SHA1 | 0339366570be95dceb047191416256d898442788 |
| SHA256 | 444e24a10680d9077ba60737d4a0c5241ee3baa9dc3e4cce2c3c21393e3d640b |
| SHA512 | 84e8c399a836b3c4d439139e75e1b14abd06daa1ee2678e7d1e967a4153e9b972eb15e7826723a704246b32c887919ecf5275efb8f188584c4a827205ccdeb41 |
memory/4308-790-0x0000000000400000-0x0000000000455000-memory.dmp
C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md
| MD5 | 0df6a0b708cfe9ee7ffdd1ee594baef2 |
| SHA1 | 41ee8df9ef293ece4b681531b17d54bad44d9c6e |
| SHA256 | 235ce7f4045f5461b1b222940c52bbf72a43b29accddb3cc2044c029b8d4ea78 |
| SHA512 | 3e0a4df6f08abcbf5669b148014b4e33e5525950dd87c93e7f090c2bf59e5c7a765a5b950c650065df690dfc85eec1257edfeec0669f12a9afb007abc234897f |
C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md
| MD5 | fee7c04b9357fbdb26689a3da3248e13 |
| SHA1 | 0327721c8048b922a0b5eb0a62a7ec2827b04cc9 |
| SHA256 | 1dc6aabf4ba0ff73e56134689d9926323dff7e4f604373e8f7caf6da7cbdb4d4 |
| SHA512 | 45a6dc35e4314d2412fa95176968157ec447a486e27c50c9d575c65d823e2e2156b4b88f8e7daee1569ac7e018cee8a6eab1a7998f0b79620b7bd2e1a197b131 |
C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md
| MD5 | 96fec3e4c8402967b7ba542a3a6df3dd |
| SHA1 | 181e6ab3d0c91743a7281c33aa305dc0ca662ad0 |
| SHA256 | fbb967182eb4095fe7134a1152db3e5acae92abd6c8a99b481fc0ef9750feee3 |
| SHA512 | f7cb6c98f650355217b07ad69f6b30fbe2d368655c0e1b9e10469f107092ccd2ad14e9c9ae109bc6726dd52af8fca0f112e6de778587c7f71694d5e931a27e11 |
C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md
| MD5 | 2088a4bf82d4a5f754ae4fae9f0ff0e5 |
| SHA1 | e986bf3b7e7a12cd40f6ad96dfa65b5d63059e2a |
| SHA256 | d9ac30a97be363d6fa1d2001a15a529e465f46005c770a49f47d9aaa5a505475 |
| SHA512 | d21176749c37945821080d29fc99ef6d6edd9fc715bfd55fc1e6c906ad3a3ed68e6f3db6a55fe80a2961efbb2c7ddb4c87e0e2e306b67cc4cc2f6f1c796ccda3 |
C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md
| MD5 | 2261ed77784b596e44b2820831688ab1 |
| SHA1 | 5385be6e0f3fb0ba14314cbc2123f145492d462f |
| SHA256 | 360e8598f6c3af6501acb930bf54da1ef6d03aa41f8ad0bf23473e1988d11558 |
| SHA512 | e8fd67ab94ee3d003eb46458546a61cadc01943713fdbacd05642744a9388548d05c3e16cf42c791d030fb85962ed2063560e58193d2bbd960b79c42a7170613 |
C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md
| MD5 | 54460eb366768c544f001dea0a978e5e |
| SHA1 | 5b5ae2b464d394cba40e773bcea03d0d8afc8e54 |
| SHA256 | 3c9b27ff5c91f3d8a8153ede3d7fde2db11d23203139a513a40c298a93920bcf |
| SHA512 | 137cbb44ec28e6ac9f7b8da3883eb5d7a0d4c82d4bd74329b063613b03a1a966ec05d9d97ca52e2e1d38d4173d93577628110effb4573fbd7a68231750a25f7d |
C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md
| MD5 | 996cb711eea0d71c1596aab12f80be08 |
| SHA1 | c580bfdf2f42cdc50272e938cf281d5ccd2fa0ad |
| SHA256 | c9ac78c6afff8df296161e17731324bf298d862a968f434b2518999fddf468d2 |
| SHA512 | aa89fd276641287ec1778fbd2df2d01b21345518d5390e3f58f4561d59996433a8f8d1b8c9d75f232a69e271960a9a0e7900ec4853786a9024ed4c6dee83bcdb |
C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md
| MD5 | 1285d6b13ba4432cf876917202d7e91f |
| SHA1 | cd7201463bdbf7af21d280a023a0daf6f2d4f7b7 |
| SHA256 | 34c367fffb5ba5ec09b60a5cc0cb634cc1e78e99de61e2d1f30778652f53b2e8 |
| SHA512 | 4cf2a74f98a4fbab23aa5fb9473f1d752fadc5a4e30c8a199482ae7631829477b6f10b56439822e59fded95a10e22be3981fcf60746c22ff50b8917b3f5d6d72 |
C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md
| MD5 | 702cf6827d86f4204358fa774e5fb466 |
| SHA1 | 0427cb768a81578b73175b30be4299372a8a1ace |
| SHA256 | c2fad9d83b0d799d3401169b815ef4a8de5925ef64df1791ad665915da6c01dc |
| SHA512 | abb6aad4a6ff5f09d9b52dd58c188b19e07aa67d6b6d0c88889a661980e62b539c7c9b5b18030facd3e0f74fdd71fe02b75bcf3b3522238d2795d9e5f62c7b3d |
C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md
| MD5 | a5a14be7d9cc544974b648e72ca9743d |
| SHA1 | 5b27484aa9a43a1e2ef217fee6251d6c2e284678 |
| SHA256 | 896d8e321d071e3d98efde13fa3912663dab2f3d609e97d891c58a0f339d9d24 |
| SHA512 | 6891967ce7aebee34538f64b65059ec3277ab6db6912cdbda46735a896b0d3cacf133564120b1c6bf054041215c4605899a86ffbf3d3aff5c411314b67b3de58 |
C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md
| MD5 | 066f25a10abaa1f0c62506db529438fd |
| SHA1 | c7cdcd50ce3929fcb78452dc0a7f4d80dd5ff712 |
| SHA256 | 55ec5e24b71cc9db5125e8ed39c12d693a625e948a2da5bf70814040fce6dbb2 |
| SHA512 | 503853645305404c1cfd0c310dbc0d251f9b56900798dbec4c57f0d2444f10722ec8f17c226b63d450d03e5ef4f2a1d7aa8984eac79057ef8dafe3da389269fc |
C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md
| MD5 | 4f33dbef85c2d703b24c4c7493663c37 |
| SHA1 | 659ea6b17d626e6f723aedc0ba630949d99838f6 |
| SHA256 | ff48bb8e14e578f96103a00cd63e973dbc5239c9884bec253473b098465e1b33 |
| SHA512 | de925a351acda1c4d31b9055ded37a1ef344c10176d068ab8ba88963e9fa6f6f1b8c1e4749980ad4d15bf83f4b9ce99504072ecb6b941a9a6880dcadb9ca8beb |
C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md
| MD5 | ec3f4273e7a144b3f19b0a4f21cb4dcb |
| SHA1 | a458796d7187be9363b0504d1b03f8535159cc88 |
| SHA256 | b0bbd435486880bc0bb838c986d33d6b4708da6eda4656d9f47b437ddef358ea |
| SHA512 | e553f9dac2ced1453ba3273a425f6860cac3af2d51a48d4fdebdf76d4a0ca0d7fa710205356acaa8b90c82da26e5ec741252e45eb66d50c8358d237a59fb9fd3 |
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md
| MD5 | f14aa1d7d7301953014414b99e838e60 |
| SHA1 | 1e937174f34056b6868fb497201e8ece997f75b7 |
| SHA256 | bc28dd72c3a5c32a9c7cdaa49b0b8a66d6c1dd11e2fab099fbc074e2eeafaaa4 |
| SHA512 | 61eea0794858abe66ce125d1087895ad6f3645f9409ddbc123cfdf5125bef8544d2930e7cf53b0843137fb7cb051435c7f12f37f5d6a8d1fee05208747a3fa5c |
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md
| MD5 | 68d4dbeacd6594a1bb0ac484a84179d9 |
| SHA1 | cdd205cb06913acb3ee249053b4c7df4a8bec9bb |
| SHA256 | 7dd2504f539d8dc5c032eb562a3ffdd44dd1bd8058e8e038d60a4775873b955f |
| SHA512 | 0ddd042f95dcb4b33fe741b8b8b4eea429ff6b2c0dc1b5b21912c165355ff19cae7ffcf7dbb77d971e1f18be2e0850b42efab907c219f719a1338b5d5082269e |
C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md
| MD5 | 24fae83d8aae878a4521de0917107d52 |
| SHA1 | e9e6d8ea3ae3cf518a7bb4454c52263c483edf2d |
| SHA256 | f3d9ec82a2e9d89002ef188f6c9da60f0235a82156629516a312bcf84dc0b90e |
| SHA512 | 53628dad284b36bda18d0e93f3c0c1be2d11048e87d49a5b59daf9b8bfd4257d6ac4aea27bffc78b39a13c6dd1b1ff1077de96357255d03ef06d1e81e51f247b |
C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md
| MD5 | c24d14aa50ddb5325bb9e9764fac2393 |
| SHA1 | 8c7c126f8f73161472e4ee201cbe157f81f11f42 |
| SHA256 | 4063bf01641e20da46b141677c43119412e9b27e3dca22a4d2e5dc8ba8e74af7 |
| SHA512 | de16f144ccddcd6f8d75d74244b88844e52cb32f58c85a1456a66770471c3997f2f726555e6ec374d39b664accf5023eaa6c12d15568cb0857af09fadabcbbc3 |
C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md
| MD5 | cc407af9764d28622639b9bdcc126ab8 |
| SHA1 | c5d97af0f99afa5f8b84bde3cea3eac8a57fedc8 |
| SHA256 | 05c15eb571d45157e860a7615ab5c5007c7a9c3dec0a4dd23dbf7c33701d123d |
| SHA512 | d2db15397dcc5ef388c33deb283bcebfc8245afa130243c3c44ff9c7bca886232fd892f261e09718bfa73283289a33f01c681ed0153ecff7f600c9bfbb1eb7b1 |
C:\Program Files\Java\jre-1.8\legal\javafx\glib.md
| MD5 | eb4118d52f740e055846c6fd13e1b1fd |
| SHA1 | 816c5cfb4bdb04f290e86b0643c0d69ca38de7f5 |
| SHA256 | 07b78192c44275fdaf4a911d072f21fb2393fae4920255a19de4adb25b3d19e9 |
| SHA512 | b182ceca50eeca376c65e3a17d173504216add73b628f42b028d652999bbde475c5fcf08724bc5f2ce7df8e82f1679d5f089f0dd42020fddb09b0166a2e82d2c |
C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md
| MD5 | d4e0fc1ef37d50f4a732807fb2000d8d |
| SHA1 | 0118ac9215c3a36a8f7676f785c1c997c0007dc7 |
| SHA256 | 7f7f2293ee49056b58fe6b11b6f8031712151fd52228dafea4db8db24e2e2113 |
| SHA512 | 07ebfa82a2abfbed5d8cdf0ceaddd25a3c330bd960f2b404f3ba42f4a986b0edf0e7be91eedb71d3c4fb785407a9e34a67e6f9b1566372d7d8e5621bacde7b24 |
C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md
| MD5 | 9e64a5111a69505f334a693d9c4c4e0b |
| SHA1 | 32f22f09a1d728fa22d2c0c5738031326000e8bc |
| SHA256 | eed0833497358e75c77385b00487be116d80c71748ae034c65f5932e4aa34d32 |
| SHA512 | ac03578c7bbf2926a9e630f8af2444c56c09613f4c7d9e478a1076f3703c9594d5a0787fdeab01469b673d93fdb3dbbff78c5e8563432f054af5aced0a1f6752 |
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt
| MD5 | 86ea35088c34370b03139c26fc5eea52 |
| SHA1 | 0fa417c76a246602fb9cc17a8de8b897bbe0062f |
| SHA256 | 7b29b57434c6b35a481a245fead074696b8d86e4af00683887399b44908496fc |
| SHA512 | 89151aabde91b24de7ffb979759d567c476e9fe1904d8c1297d9a6b004ff6036436ad5c97371f1e8bec0aa1dea7df25f86681a520e3e349da67a4d423b5ae86e |
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt
| MD5 | 4444a88bb20dd037ba718e4eb4a78f97 |
| SHA1 | b1829934b4ab99f91cfb50b47503889599fa281e |
| SHA256 | 2349f6bc34e7637d870d1ab8a3287b64d0eaa86ddb5284d29e1474f170b71905 |
| SHA512 | 0111c8073aa2f10cab0c27f7a7aebe7c7092d634e76ea1ccdbb19912218515d5fd0774f17b7f0ce495ab399df03145892e941909742725046387ffd9258d50c1 |
memory/2004-883-0x0000000000400000-0x0000000000455000-memory.dmp
memory/4584-890-0x0000000000400000-0x0000000000455000-memory.dmp
memory/4584-903-0x0000000000400000-0x0000000000455000-memory.dmp
memory/4444-904-0x0000000000400000-0x0000000000455000-memory.dmp
memory/4444-915-0x0000000000400000-0x0000000000455000-memory.dmp
C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt
| MD5 | 8e1ffabf83f973a87462562bf50518e1 |
| SHA1 | 0c85f4f9da2b9851e3a03d44d1ecbe04a07a1820 |
| SHA256 | 67856462df528c5f151a63a13d74f76cecdd050ebac01435b4413ba977853ded |
| SHA512 | b439cf3e3f22a98705db8f82040b34ce03d2b2eadf905e7ad914d7cfd629ff3747921a6eca85f5476f2fa12884b704585aa8e37cc2b95f1c16a22138578fa7e0 |
memory/4240-956-0x0000000000400000-0x0000000000455000-memory.dmp
memory/392-960-0x0000000000400000-0x0000000000455000-memory.dmp
memory/392-967-0x0000000000400000-0x0000000000455000-memory.dmp
memory/3508-1000-0x0000000000400000-0x0000000000455000-memory.dmp
memory/376-1012-0x0000000000400000-0x0000000000455000-memory.dmp
memory/428-1013-0x0000000000400000-0x0000000000455000-memory.dmp
memory/2180-1040-0x0000000000400000-0x0000000000455000-memory.dmp
memory/2076-1130-0x0000000000400000-0x0000000000455000-memory.dmp
memory/3772-1197-0x0000000000400000-0x0000000000455000-memory.dmp
memory/3548-1264-0x0000000000400000-0x0000000000455000-memory.dmp
memory/1612-1321-0x0000000000400000-0x0000000000455000-memory.dmp
memory/4552-1357-0x0000000000400000-0x0000000000455000-memory.dmp
memory/3160-1374-0x0000000000400000-0x0000000000455000-memory.dmp
memory/428-1413-0x0000000000400000-0x0000000000455000-memory.dmp
memory/396-1437-0x0000000000400000-0x0000000000455000-memory.dmp
memory/816-1519-0x0000000000400000-0x0000000000455000-memory.dmp
memory/396-1428-0x0000000000400000-0x0000000000455000-memory.dmp
memory/4416-1569-0x0000000000400000-0x0000000000455000-memory.dmp
memory/1844-1681-0x0000000000400000-0x0000000000455000-memory.dmp
memory/1560-1690-0x0000000000400000-0x0000000000455000-memory.dmp
memory/468-1709-0x0000000000400000-0x0000000000455000-memory.dmp
memory/2648-1722-0x0000000000400000-0x0000000000455000-memory.dmp
memory/944-1818-0x0000000000400000-0x0000000000455000-memory.dmp
memory/2436-1833-0x0000000000400000-0x0000000000455000-memory.dmp
memory/4636-1784-0x0000000000400000-0x0000000000455000-memory.dmp
memory/1928-1905-0x0000000000400000-0x0000000000455000-memory.dmp
memory/4636-1766-0x0000000000400000-0x0000000000455000-memory.dmp
memory/1116-1765-0x0000000000400000-0x0000000000455000-memory.dmp
memory/1116-1744-0x0000000000400000-0x0000000000455000-memory.dmp
memory/436-1738-0x0000000000400000-0x0000000000455000-memory.dmp
memory/4388-1935-0x0000000000400000-0x0000000000455000-memory.dmp
memory/4300-1938-0x0000000000400000-0x0000000000455000-memory.dmp
memory/4720-2005-0x0000000000400000-0x0000000000455000-memory.dmp
memory/2108-2013-0x0000000000400000-0x0000000000455000-memory.dmp
memory/4720-2007-0x0000000000400000-0x0000000000455000-memory.dmp
memory/3164-2041-0x0000000000400000-0x0000000000455000-memory.dmp
memory/1328-2068-0x0000000000400000-0x0000000000455000-memory.dmp
memory/2180-2077-0x0000000000400000-0x0000000000455000-memory.dmp
memory/4412-2078-0x0000000000400000-0x0000000000455000-memory.dmp
memory/4532-2105-0x0000000000400000-0x0000000000455000-memory.dmp
memory/2180-2069-0x0000000000400000-0x0000000000455000-memory.dmp
memory/1724-2163-0x0000000000400000-0x0000000000455000-memory.dmp
memory/3108-2178-0x0000000000400000-0x0000000000455000-memory.dmp
memory/4612-2162-0x0000000000400000-0x0000000000455000-memory.dmp
memory/4308-2327-0x0000000000400000-0x0000000000455000-memory.dmp
memory/712-2336-0x0000000000400000-0x0000000000455000-memory.dmp
memory/2800-2366-0x0000000000400000-0x0000000000455000-memory.dmp
memory/3192-2374-0x0000000000400000-0x0000000000455000-memory.dmp
memory/712-2350-0x0000000000400000-0x0000000000455000-memory.dmp
memory/2640-2339-0x0000000000400000-0x0000000000455000-memory.dmp
memory/2800-2388-0x0000000000400000-0x0000000000455000-memory.dmp
memory/2304-2400-0x0000000000400000-0x0000000000455000-memory.dmp
memory/232-2402-0x0000000000400000-0x0000000000455000-memory.dmp
memory/1036-2404-0x0000000000400000-0x0000000000455000-memory.dmp
memory/4532-2406-0x0000000000400000-0x0000000000455000-memory.dmp
memory/3860-2408-0x0000000000400000-0x0000000000455000-memory.dmp
memory/4908-2410-0x0000000000400000-0x0000000000455000-memory.dmp
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\aic_file_icons.png
| MD5 | 393e34f6868244fe7ea42c91ac13ccc5 |
| SHA1 | 78372c337c2f47f59373ae593fa5c3ef8e238d9b |
| SHA256 | 20932eab8c29e276c7f8760ac3bbe9024dc61cfb06e5a753abc2100f68356861 |
| SHA512 | cf22b2a4a212f2979a5ce057461576356b36bb2381258ad92167fabb960eabc8f8b82ee2b9a0a55b81355e2d283702bf5a3487590c8096735d3df87b4d43f2a8 |
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions2x.png
| MD5 | fda3430983134618fe00d74f1b75ef27 |
| SHA1 | 9ec8235bb6a309bb0add627790594afdb268890f |
| SHA256 | f6968df622e1611733779b57a866066c0bb4317ee791261dadaf453fadc74330 |
| SHA512 | 4618cb5a22963136f048967bb8534390fafdeb1299d4a54b483de1d607924da82232db4a7b86472aa58d206704582d3e8a596d53d6fcce7067ff6bd7803e5a19 |
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions.png
| MD5 | f984021aacbe4d7e260e7abd6c716219 |
| SHA1 | bffee864d53a9dc25eea47d240f957a53a4e3e7b |
| SHA256 | 2ea4b30ca9cc4e405ae2d8a5aded1fe8e221b1151a5f04819a8d3f2b2db025f7 |
| SHA512 | 9bb8b68df9b84fc9a3efea859c774a4e63eb7c95efa0fe2d7da05c296b5687bacec10e57b236897eed7f295984dee0b5b2644ae3d31da881ad39801a51b5f0fb |
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon.png
| MD5 | a5c3671c701d987226b3bb239daede58 |
| SHA1 | 01fd0cadd22d31998f380f95a48cf0ce00a016b8 |
| SHA256 | 59110fd98269b840bbdcabadb2a3d1838f764e9831636be318825d15551d4310 |
| SHA512 | ef2f0b66de0f09598bb5df9f94d54cdea27a5f6f042e04441c621a69c4d36af94ee451523f453eeede0a0dbcecf73fbc794e14833e119b551b98d1dd19458dbd |
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover_2x.png
| MD5 | 3134adde7918dca9af2d0b0d9fa36b92 |
| SHA1 | 30303b59ab5345f6fcc4f9e7b5249ea7b6d8e51f |
| SHA256 | cb5c3409afe7fe53572783596169872e8a51582325e94ee5036b0a805361e81c |
| SHA512 | ab603e2d5c820e3c24da04c3533e0c2ccd88a0c91048e98a6957db253a663004cced867a528485843aa0efe8e7bc91d7e6eb15f44add4b9dd118f19f75203c46 |
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover_2x.png
| MD5 | 7de2d9488c32e84c88530453d9a31b4c |
| SHA1 | 099f3fc3466d8b17558bb2ee39a644be55c6f73f |
| SHA256 | 4d2d60ae7f0fd59dd7f08275630db1e3860a8a5e73dcaa78803b2b8d7305beb9 |
| SHA512 | e4f8f83c68aed500a96e0c7542482e6ae476038f1c0c6e5bab174c9dc121d9fde36bbe4a5cb38168d3300db15fd011bae7b5415f4e2382a3ff380c67fdc47166 |
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png
| MD5 | 24c621fdd6bfaf85b714bd98cd96703d |
| SHA1 | 9672e3488069475176a00b742b6582c91cc20e1e |
| SHA256 | 2b871a59003671b782ecbd982664d915d954728cec4b09cb8cb898db868c1dd9 |
| SHA512 | 0afc5f5121fef1537215c0a2790f2b0282b806ae204d36664dd543332e8c15e9a00db86f25ed63fa00898beb8fe0bc9984960528b81aca747da1a3acc3d0c005 |
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png
| MD5 | a0d138f10ad9c175446dd32279f49f90 |
| SHA1 | 696e606eef369b24aed3abb677d5558c23fdd668 |
| SHA256 | da2172117e0168e71f64e5931f21792939b95d4189246f20ff99a98f442e3a3f |
| SHA512 | 9e75db028347cc43dafd38788cb96acb1710e16835fa2eb31ffdb66460e4bd0361663603bfce1c0ea3d1f704fb3d53bae0d1e00e477fa32fb9cbe1a2e3b35c8c |
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon.png
| MD5 | e080ef1c652b1add529e90c79b50a939 |
| SHA1 | c23524b31aaa49c5877512ab59f700345895c772 |
| SHA256 | d19a689ec5b60b665427b4ce4f5cb3549761270c3bc753591f0bb7a5f47238a4 |
| SHA512 | 246ca7e601ababd9d36c1fd3d9d8a20b360bac16e8844240aadd2a1724fe173806228e6363068d3f181668a102c0a4c7904e5d5794fc9f7a6d1a375f456c3909 |
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover.png
| MD5 | e95758758982d485e4139e5fb58e8e36 |
| SHA1 | eed05c66bb7cbefd51a47bdc9c01f4fcfd9b0814 |
| SHA256 | 663059d98ae5b8d4ebb592c4e97f18dd2f097c8553c133d6402746dd074e9029 |
| SHA512 | 6ada939216a8270aeed262c7bf7d961a009aece151fb74c067a173b02608d4d8f0e5522f3e9c8c25efa30edf16353859f3d4c04684ba2ddd4d3fdd1a346d6525 |
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_2x.png
| MD5 | 796138b346f837341655aaa26af0d2b4 |
| SHA1 | e8426038bc7f8937427e5c37d5abe6d93590edd1 |
| SHA256 | ad9e144bdb88eaf1430bf8d327bba3575f03cd8d1f021e8261929fa701d34da5 |
| SHA512 | e0066c4b83ce48982ed7844747ced25397ebdfe32b925daff37cdb49bf55ae4c17bfba1241b1906281470beeec57296d235e97322271c632996d20bb015e79a1 |
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons2x.png
| MD5 | cfd2970840a0dd4cd1a72f8d96877052 |
| SHA1 | e4b3d480a0532ef5dc5aa8f61eee46fda7b891b1 |
| SHA256 | dca257a5b0b2de50870ece682c61ceeaff968ced6fb744d0f05babb8d94b6c1d |
| SHA512 | 4b0cceb1306eccca19443dfc84bbc242def31c5718a31f30bdb4b22d5d14f57270c513463dc16d6b1c8f339d0b8b0565646f52a7c2e941ac0a173be46b35f902 |
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons.png
| MD5 | 74371c120a4a334a45215b4aeb1a4251 |
| SHA1 | 5d13b12c7195febb3a50c2c4e852643709c00462 |
| SHA256 | 47879096c1fb99ac3dbe0d4ad826468ffb4007105b58d81b3c00f65f68542cae |
| SHA512 | 2e6af74ee065e8fb3ed7d748eccef7b3f6862c4dbbca5b12155a80ddd5bc17c0c3cd022d2540655940f286d077d00f54f7c20cfc877953bf1688e3416f024794 |
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons.png
| MD5 | f59672c72d3823afff0573443a1a4b5e |
| SHA1 | 767940e7a3a55df71753b7d76dee385731269793 |
| SHA256 | 4508df9c766a3115ca8143809112827493484ef47cdfa71db52116fe32b44f90 |
| SHA512 | cd687e9f69ec748134c82731c387b1f0c02d0d940299f318743d79f95c40372760d0dc40d7605b211c2b71ddd0cb71d3b93f8c27de139a7ca56a130a7278e67a |
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations_retina.png
| MD5 | 3feb97857185984114b913e69b24a80e |
| SHA1 | f505c281366304869de4d1df0e03b1e664838b39 |
| SHA256 | 990189ed603dc19743825ae5c864a9ec0d2ae0f19e28b26748750447a295ba48 |
| SHA512 | e6b967fab6f34318e4d8a2d81c81e096fa7908341e5a6e43bca71922f38700ef4b62ff4e9bba2a803b6cf0d95cf142ddcede76926f3bf09e3cf5c57e8f1d8dfd |
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_pattern_RHP.png
| MD5 | 6053714e097d18fcd96f7996b1dd3a91 |
| SHA1 | 87d5978fd862c5bad7e2581b1becb04ecad2006b |
| SHA256 | 6fc1997f70a81789a40721fc6cea27f53d084b38f95cb450c61732955b43d268 |
| SHA512 | 3fc6a74baf41f0724e7b21f76de22a032037abb597095e42b7cec52494db4f0bd655e9abc94313be43f810338ca2fdb8ece0cba78e3fd7eafa638ee6bf96c41b |
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_patterns_header.png
| MD5 | 79c93fce80ddc446a5578b5914b053c5 |
| SHA1 | 2e5170a0abb619cb3f48c7e8770e9b426642e49d |
| SHA256 | c4e4f4848e6ce86155f50c8cea063ab2a34020fed00fc79f2dca60e0d4fcf60e |
| SHA512 | 12a1afdf00b0ec5a7c6a258d2ac838884683f4c09b78d67d391737a69c0358693af7807de9cd5707943239b6eb41a03b6889ea93771b89bd5344d625fa0c5597 |
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations.png
| MD5 | 73f728644ed184a938846d271e0566a3 |
| SHA1 | 128e0dc4d5c2297ab48759172a4713500a275b7e |
| SHA256 | c5fc069fb42fbe28054b1743f1969424716a9fa5a2255453615ace671ff6ace9 |
| SHA512 | ae4e810b2211b8518c7560e1263bdb7f8a368aba1379953fb9e99dbd7eb7388ab03c590a23a946c8795a869b64a7b6566447df5449b3c952917c10cfa135d393 |
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons_retina.png
| MD5 | ac817bf53093edfcd6402106738d9375 |
| SHA1 | 1b0eba3e3beb1209a534620947f667818b51beb2 |
| SHA256 | 1326cc6ef108ac18443049af73bf5307623abf448252393a6164b9fec0e7a206 |
| SHA512 | bd9cb2f450ed916556f7c0201ea7357f70eba9ba791a26c526583925b74cbc4b012f177e858c4745912628f3f37e3aefe6ddb79971dd3971ac643861d2dbf831 |
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_retina.png
| MD5 | 9b500b3300ae6a3b0d9fdb6fdcc2a37c |
| SHA1 | 6d8d52209a6c33983d444a24c23948383ea204cb |
| SHA256 | 511961286d385a219401b15c714f7995e914c96e48fed10a5a2dc6ebee2f8194 |
| SHA512 | c6aec9695a3b267cc3fc2a75205df503829623e6317e20e5302ee7273dc46a441e56e38db6a9e89c55648e186d0fc2d4527bc7f6f23f1b3849a9a0a4d3b3c020 |
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_ie8.gif
| MD5 | 327126a184293a8d837ca7ae8d907105 |
| SHA1 | 8cfbff8b769bdcb69ad74d2c592d8a8dad5eceab |
| SHA256 | 88f8b5eab3943b95c109a080cf89b6ebf86e2fea56723a22fe827732aacbe41f |
| SHA512 | 00d11d0eb98d840e25a3ea5d345fa000078699951ca6727e68c0dc4ec133f1ce2963dbbd56990003ea2090f2fb87d42c1228907855c3ee7f45ae38988bb52af0 |
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons.png
| MD5 | 263c6141c49896658921a3f80d2e9d92 |
| SHA1 | ce35a0b18d4607281ecf68af0b17238ad0e8619c |
| SHA256 | a85ba6c8b979c1271d7cee3b0f669fe342e63fddbb2a6e403070c8c0452df7ee |
| SHA512 | a490c236c50c668a8fdb8a68d77c4728fadbbc2504f7728f19ce66681e5eb7ba61ef87e9c59747b12fff37f669b291826b895365aedfb2c8b0b5ee2ba24db735 |
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\faf_icons.png
| MD5 | 6d62d74eff75cc4b473e0b80fb0dd56e |
| SHA1 | b970db4685de6350d7e7e3d18a3803ee94f92787 |
| SHA256 | 2d1a7433e53e6810406753d2484c6ebe92a7b4c970d1140bf37d8949d457fa10 |
| SHA512 | 1b274b2bc9cec678b8a1a938cbaf8e804367603d61df487044789eedb694f2976cd9240eed38dbd7dd22df751c546e3a0f41421611919d6e17cf2b1fe66a23cf |
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\bun.png
| MD5 | 0e46d8f41b8adf31017e39c34dc00219 |
| SHA1 | 48ce4039e554622893439a5745e028170d5360a4 |
| SHA256 | a3c7e6cf0eb9d797d929524717393613c3924f2d36d02860ab9bfc731d01c980 |
| SHA512 | d69785e50f14bb232a71ec12c805736b70c14817ee296a5cfe0bb99874bf985040756f04be69b3388fd7e3851be273632fbef379371c3aa3ceadfcce6f8ed7d4 |
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small2x.png
| MD5 | 595fe75cacb5d3955bd53e06800e8c79 |
| SHA1 | 71ca996edfde3f105933fa16c5c3eb8add31a68c |
| SHA256 | a090faabdb38c8962485995c584a293fb44b9ee7c2ca93cbb537c1f6007b2e8f |
| SHA512 | 0f0ce4f671a233ab995a6ac397dd27422c4900d844643d6bd196693b7d0ee7f122d9908855acaa397be9a5ad23953e36e25c06743097040d7bd8b8fc53e6decc |
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small.png
| MD5 | dd77c587cfcea259682c3360647e2b47 |
| SHA1 | e8751e7acf235b235e710daa9d5e96230bcc6c79 |
| SHA256 | d04a82a3e24a3688fd00a0f4638a9eeaced5f1e406de39c32833ffff53889de1 |
| SHA512 | 099a5f35e3960b80a6f80cf813811b5d933540dc50f327e7c917e6216030f11120bb46056f520f948b595cb0a38eedb87e4d4833b3947442cb877eeb1e789677 |
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons2x.png
| MD5 | 20e29f1356ccd1f79569ab167fd889a9 |
| SHA1 | 50886648a954ebe93535bfb134b3358abb630618 |
| SHA256 | d19fe335a37a04aecfe6bf9504f02b0fed32b3e85d55f503a149caa13fefe379 |
| SHA512 | abaea18b4f410e69acbca5b4cad1b862aa191ad1360bdf54f602e209117c272fc7d884e8c828aeb07e1a4198636d16e2bb5b0d1c16f02e88ce8fa71df80c653d |
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons.png
| MD5 | 15cc9a08d4e8d300f469d38137245ac1 |
| SHA1 | 586fa86cb0cd16ae5f5c718ed3ce7f7c25dd5d86 |
| SHA256 | 271cd77388f8bdb061b76e262c60abf700a0caa8e737e9bb1e5ad87dc11fe21a |
| SHA512 | deafab68cb7b59e0d23225723bad1b07d9013115d7d3772107859eb33ec113b9ee4cc70f3b1d27f687284e258b897ec772f6eadea39c161c9238ddaf49b36a6d |
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\nub.png.EnCiPhErEd11143
| MD5 | 1aa9f76cebe3048e781ce48c5a00462e |
| SHA1 | 316b98a974e667fb033c2f7d8c82f2f82a2273f8 |
| SHA256 | 62e5edb3a306cad5ba71de50b672ebcfafb1bac71c6aed1a1324d5ec3cbf9216 |
| SHA512 | 8d70d0a953da6a9f37617ceb1fa09cd43d16f9d59d13020a2a5913c7f585b559f405652439b19a0a5702b2a09e2e395e7b0143c844a678e7968fcc0cddb03134 |
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\illustrations.png
| MD5 | 82ae07276cfb1dd6610efc20acabb828 |
| SHA1 | 06dbf43aa230bc6e61b5f685ff98a35bdf165065 |
| SHA256 | ea7c92c880d4ab842ab84412c7c7d77e62cb7b4533e1d727f8d2fe4272e4825b |
| SHA512 | 34d185735cfde7ec97d00ceeabe9a8e45ac9b5b61f9063d878e4fd94772176eb6b6ab675756508283bbe13b012e9532b5639e2c4b26b30b7396a7ce2b0e047ec |
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview2x.png
| MD5 | 74f61d8f008253893cd4688eb55eeeb5 |
| SHA1 | 650815af04fba7130b119c1408e332ce8e1a98b3 |
| SHA256 | f73296757db3300fb9464f1b5bae24a26b965b7376b37f816f72cccefc099bc8 |
| SHA512 | a1126fb9ed1e9151df3166d4ee34ab69f075c225534126b2fc31f5c625e69e3d8dda36cfde13807575d855e35ef4fd73575648c047ec0b4a5017addb4053f922 |
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adc_logo.png
| MD5 | 0f84e380f55c6950c0db7df7e152441a |
| SHA1 | 65be79d843a2698a17dc259b95acd561ebca7a9b |
| SHA256 | d89b067af5b4d407008343d60ddc5507632eb81dd3c08a666b7b4e181bf98da0 |
| SHA512 | 9dba069eb463f4b7f878f5693145ce2531b1854fff40126bf98829891fb76eeaeb2804a4a434031cf4b279585085dac81a3239aa72ec66942d406b435145119a |
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adobe_spinner.gif
| MD5 | 5cdf8f552e82772627182c67f3534691 |
| SHA1 | 00355ee8657cdc1eb89dd5e85e6506ffc9b71f3c |
| SHA256 | dea5cc9054d583c2872f0ba886c8c2ca6f44b7e45a9f5d8e794d88d6d81c8a97 |
| SHA512 | f04d8edf97973d4b44edc6c076214a665aa0e01a64f7a1ab9d45b94e20598474bac34babd077d74f632ae14fe553d81f9965add308ea33e246048aa5a86b7fe3 |
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview.png
| MD5 | 83069cb8d15e62d71e0554aea35d760a |
| SHA1 | ab19ca8644d27e417b35599d23b8749ddfdd8cd8 |
| SHA256 | 69fb2006af21f44548b62cce35909f9d1ded52b508fe7f1359b3daab40d84681 |
| SHA512 | 1f168f42a68a6ce0f5a06f1ed8bf7feedeaff237a27859c628a815702a41a4dba11ec5f3f860e8b8935150cca8af88e29bbd85c2a0dc48448d870198a812ce6e |
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\logo_retina.png
| MD5 | c147c0a678e8414a7bce5b809b4b6a4c |
| SHA1 | 860924ca952528b23d30304ec1d56b7347ced2b8 |
| SHA256 | 5dafce7ea7daae02931deca1df1388b894fcb86a7e5eb64cfbeaa5f068970a93 |
| SHA512 | f13af8b116734d0f188926760eb6b06c5e3351e498e3088b9374a75f489aa3cd7e7762fd8e25dbf608215bb7da7852c48c72e2cbabe3b117d5dab0f1a34784bb |
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo_2x.png
| MD5 | e0d8a94c5587c0ec86aa7127572f8577 |
| SHA1 | b8ebfc64741367309dae96c20b06e3cbc9780af6 |
| SHA256 | 2ef438a04191317a1a9847c0ce7105134a86d43d4da027fe82f1926077988b47 |
| SHA512 | 80da7462bca2a7c3eb4091de88f83e9eb54c92e6641faa5d1aec07fcabfbf066152aa628e02b9c24f46ce8cb668b603efd1639058fe4e09acd7ce05948814872 |
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo.png
| MD5 | bf20e0d96e101ebfbbf7ef0f2773e49b |
| SHA1 | c719aabcb17756c9c43f39cbe9456554c5284daa |
| SHA256 | b2f7d77077008a4546c7bcf938a88f5a4de09fc0bd877a259fceef5337947602 |
| SHA512 | 2af2136fb9159b8f9dd0e26907ed1a5005cc7f3228fef8b3d59bdc211f6cfb43cfb6f0eda058b8a996fe27c5036f515b4c3383910153c18437988040a31f1cfd |
C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB_EURO.txt
| MD5 | 59c8cfe69d4de8a294b47fe13019fae1 |
| SHA1 | 9fd88ff9b4ab083605643d99aada9c0d2f1dd207 |
| SHA256 | f284a9f787cddc073e6a5dfad097ac0d63befa154b0dd1d7e242cfed2cf78510 |
| SHA512 | 2e534e51a85f8e820830ef06ef54a01b5945341569d66efb68327e4daae08eceab739a0e468591423110ae297d5f0bb05cf1d0f20c69bbf0b9df3ae8f675c35b |
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727668912544901.txt
| MD5 | d4842bd98fb9c14a1679cb8fd1a7df55 |
| SHA1 | 19132e6f3b1f36fa63afffaba4b84434aea041aa |
| SHA256 | 99dfddb3617962a6b65e8ca268f4d835f82ce36b162ec4de053a201123a64973 |
| SHA512 | e222f5e91553e8c88ffd5dea84f00e7b9688b636dcaf009c1b225c6881a5c7c36c5c243fbf891672ce283b9a43bfc7f0fccbe74ab02107ee66ee02499f582877 |
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727663013511623.txt
| MD5 | 0c82790c9d858233d19194f484657455 |
| SHA1 | 0203ec595c846b6f220f8d1aef9af491b6ada190 |
| SHA256 | ef4819666e25386d1d1907a601bd939cf784115b474f924006e883a4aafd2313 |
| SHA512 | 6f75d562d18d1a84d535105bfcac46c8de1010f5d8b114047d26d8867f1713f555a11d6af59fb69519e4743ef0ec1b682aa8d0a2b1fd5c248768aaf4300d1ac5 |
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727671578469739.txt
| MD5 | 2ff5215e97029d21d018f05e1452df53 |
| SHA1 | 717278a80e9c8af9ae7adedd170bdeaf51eaac2e |
| SHA256 | 24930321c5d747e5d5bbc2f65d46b2cf56d154d8e7ee4bd737b211090d2e6bff |
| SHA512 | acb25d12fb7236bb82b64baec5f39806c1ef76180263fed176d100dabb4feaa50879ecbba10e35f4f49472addf553bc45e6a0518e4e22468a634ed9f4b8cc742 |
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727662498327333.txt
| MD5 | e814d6b3fea57c302caf05f1320a2e05 |
| SHA1 | 1ec5ae94c0be3ca9ee1b78d59172ce2b32a9bbf5 |
| SHA256 | a06728c701ed2ce48eb30d2f90260f7d3e3adae4bc3e3ff960a03584bb2bd430 |
| SHA512 | e80cf7870b81747ce6d4cbdd8aa997a24a7dac2ec42cece49326b0764e558612c38a9158af81c7d7fcb98c7eba4671916c2653b5dcdc42d41d7c54a1f20b4f33 |
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\File Explorer.lnk
| MD5 | 45a6a9f1229bcbaf217233c75a4a70c0 |
| SHA1 | dfe6e97e40dd44e862c5fc5d1719e073b987bc54 |
| SHA256 | ddc44c97b43e69c73feb8827d03441be3789117920488b8d4430a6ecd2b92f67 |
| SHA512 | 5fe18b3e3f42c0dac7352e3415e5fde89823e7c51fbf103f793f8ca2539eef6a63018275bf909ad8908d961ffc4597a04301381e1e4e03a7a458b53c1fda1b18 |
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\security_watermark.jpg
| MD5 | de340a3af6129a5da8f93e82bc1e5ad1 |
| SHA1 | 501e52987515a5bf14fb2020ab1a2c16c8a3acbd |
| SHA256 | a70d6f72e7a2f997f6cb72015f483a711a3ad5298c7b73bc479833201b4bb49e |
| SHA512 | 8c85667186963b0cf3ac53a1ed3018498124b24ed4a495099b0ddc8c7b6e0537b001d897085cfd21992e7b97dfb3820599088d03c3bec57a5d10e79fe215afcd |
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\gradient_onBlue.gif
| MD5 | a1b6eb2d14b70b137257b88f02a57417 |
| SHA1 | 84bdacf035836fb2999057af2ed1fc8a6faad5ec |
| SHA256 | 2c723bc8457768d7e2cd8035a4d8ee57c85b495ff30d799682e86ab41a4c1d56 |
| SHA512 | 58734f8b14f4fa1401a479ff0b738dbe4115b80a657f819e21ff4ddad5a26d7f48f547a86349b9915ab5de98f7596eacdd5da81d9da4253e8178ae915969602d |
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\deselectedTab_1x1.gif
| MD5 | 44647f7c081a86281959b1c4c91bb856 |
| SHA1 | ffca7d79ec78f43fca587b57dba711083c6ad161 |
| SHA256 | cbd20d8ca2365ca9ea0138144c68eda3f7e89d9c9351dfd79e2283da6ce69941 |
| SHA512 | 60607fb93b53b782a1198020d05dd419037ef15de2bca1604f855ebfd4cd7dfa4550fba99f8e4c755cd79deaee395eef1999c5cf4ab2a9ac76935566af84d03a |
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg
| MD5 | 13ff81d5bdf2b384f875d27a11e2a8e9 |
| SHA1 | f5d2c43853221c5266d25e1d64fb1fe94678bc9e |
| SHA256 | 0aecdffafc8fa132c6214717f590129a06d0ba03710aa9f493975a9ed23bcece |
| SHA512 | 9e849f80fafe7e880eb3fa061b16468f248afaea41fd16cecbf600f5090e9b85382afabd5918d49dbb7e615863a7ac7fb3362e813e2ab346059049c4c46e309b |
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\branding_Full2.gif
| MD5 | 0ef71da7951b4a0c13c799fb934bc428 |
| SHA1 | a961a87c3cde6dac32b1b2fbee5eaa4243b7d902 |
| SHA256 | c54931b274870c7ab1c2ceda029723334cc74dda31356d9aff8fe242f58bf296 |
| SHA512 | 525d45e7fe6b7a3ba1062edfa41fa6a13e7250d9086fd6a8accf351853e63632ed71c8fddbe18181880fdeebe684b9df77582ce54ec4cad373822ffec0448cb2 |
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\aspx_file.gif
| MD5 | 3e8789107b6e614c4a1baab089405197 |
| SHA1 | 42bab6d328cf628f7a3f07abd3fb4971bdff36fc |
| SHA256 | bee099242bc4b3e799888d3671013b15404ee64761c11b3579c6c743a05c7a2f |
| SHA512 | 30c482cccba5e63a3881eb1804a5557fe9ae0c3ee2d8afdadd3d09dd0361cfb36fa017084b2dd3180135d6f5e9046ec75211881b5564ea622c75c476f29a76a7 |
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\yellowCORNER.gif
| MD5 | 46ab9ca5a11646c5b589970212af2477 |
| SHA1 | 5d5a1d557d4b65303b61aee709533054e12c9ab3 |
| SHA256 | e9d7807a679bb51ba8d681a106c2aad6f7d0be035c5fc44b4b272aded5a3fe46 |
| SHA512 | 2bca78c286d8be8543fe70cecd3b87fc35c23bf294f5313f052e7412e9c91c398b82f34f16fd4b4df39ddb54fa73ee651646786e6d7149cbf425bf0e08d33b4a |
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\unSelectedTab_rightCorner.gif
| MD5 | 7e54074aaa15b5f63d9b88c5153348da |
| SHA1 | ca3c0941f033a2c35a3b3fdd82b6b907d23789c0 |
| SHA256 | e8748137a9fb21ac7633860740f4d4c9c46d752c7b5732c3e13e5d869baf8b87 |
| SHA512 | 31bc22cbeb5b09b02365fd42d46981d0fd0593d00c2516151ce554c109c507c88c91785364a17851ec79cfd0fd3d13890f9e2d79e7cd8bdbdd78af4f5ac2ae00 |
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\unSelectedTab_leftCorner.gif
| MD5 | cb23dc69ffce4f012a71083c4fbb6e9a |
| SHA1 | 5eac6b7f5facf0a085501aa642e550865abe74b6 |
| SHA256 | fa7066f7c2843d80180ec71a9a2ce782078f60614306802c43058d33ea83505d |
| SHA512 | df6b2bb57c3c6d74951b9a7fce8eb147af24cb721feed0d28eec7423991b458ac26d4ee9cb344eda3d753c4132b6f417a8dfe09dff2adc8c6ae14b0b92dbc848 |
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg
| MD5 | 0e3a040b42240f678288d066d8a97800 |
| SHA1 | 10bc1c2ad0e1407c4736934c7da8358def8a8481 |
| SHA256 | bb39e17575a83a07e2a00f067cef1c43ddc689f803575270cd635e80b554955f |
| SHA512 | f01d225ef120a1e0aac4d78484a73afaf480ea6b7f5c9f9b635a835cc300a3136d73954cb1f9373637d4f72ea26e79ea70bdc671807c8103651c1c419369d13b |
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\selectedTab_rightCorner.gif
| MD5 | d5e045fb5dd0729b4483a2cc68e119cc |
| SHA1 | 573c38e4f8d5460b8f4aafbdf13a395fe6dd0cfd |
| SHA256 | 488e1956771a51fcb2278cf02919d590e5f7112e6e3380a64a410735ccdf615c |
| SHA512 | a30491382dc4e64204c3b04d11aef3fc3ae3f62efbec452fe607f88ea86991ac94180a4e107cc670bf205b860cba3d0399a77efd090f3f1827256c2eccc768fe |
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\selectedTab_leftCorner.gif
| MD5 | 291c51d898fdddd815a5ca2ee60a4aab |
| SHA1 | 48031b58a79467f338c63b1f126772168d72977e |
| SHA256 | 1cd77037e7f327dd8de99e699969b4536ff9a3060f921ab6230a15c61067738c |
| SHA512 | e21248fbe0835ceaffb3398d0a1adf42164f76a36fc115113f3b30c7b21c880dc297f74f83fe3cc693205e347160b2c7e4cc45b6970197bd24dd9b49d7a2389b |
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\requiredBang.gif
| MD5 | b3733f1d4b5fad7410f33a4f0e274c76 |
| SHA1 | a6b745056c5fe101a532ae78220abc92438f681a |
| SHA256 | ae496cf92e9dac7d69207ea9ff71243b09ed4b511a3f4c42aae67f0726dd292b |
| SHA512 | ed0a156a592c1659cdc41ec1c436d80382c90510e3c4aa845719682c9d68ff1d368f8f2b9349d5808966b243f2dc10e7514f671b5baecca507b3776c3d8abcf0 |
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\image2.gif
| MD5 | 01884af8c2074eb4664e93c42be0c93d |
| SHA1 | 5ee8415799454557a6334e07f1c5a76469ca5a99 |
| SHA256 | 3a92bf9369feec1173c414db31f16983d4279edad50b529026694d37ebbe2ee9 |
| SHA512 | 3d060a6bdc534eca9abdff616a4086a51f9a0dafadb6cd570ac8b4812595e248b692cda6a7126439f20d215e82a00b84e435e11d65aaa3163183adf41a850197 |
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\image1.gif
| MD5 | 87b2074af5b620f165853015075b5ef7 |
| SHA1 | af97d9add98600ad2c6f608a7004c903fa9edd2e |
| SHA256 | 81a8504ed8398ead9bd8bcf1e90958077c128c83a228158dbed9bbdc52ebde27 |
| SHA512 | e7a820210f4e6fa3bf59e0b99019c283e84436d2eec426e7fda334b62032c2aab8dcca2ad278c52a8022b1ab922139635dbe976591a06f9738ba8fbc2f1e8c2c |
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\HelpIcon_solid.gif
| MD5 | 264b6101e6f7f1c4be9de6ee8fa60c29 |
| SHA1 | 6b61291c0b7ed4692d89501f3868b3a09502f142 |
| SHA256 | f361bb54f9756c1c1c5d4b1627d43ea0dbaf3c42948b3339fe702def8bfd5c18 |
| SHA512 | f99ab35df95ed62c0314ade5ff13135693ad029df7b4562eeb4397d85e4709374a1578d5cf40b5991d0edaaa258ae1ff53c18f8339d1a20eefaca94b24990aa7 |
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\help.jpg.EnCiPhErEd11143
| MD5 | 545a065171f9be5253d58d51b587bdbe |
| SHA1 | 33a8fe2f35ac143a63b9282aea872bc9d6c85748 |
| SHA256 | 5b1b6ea40a5281423373436acc53e3b8df175edf1c81b93e55abd934fc7eff3b |
| SHA512 | 07309cf317d5f77bc4d788ce5921b4665691819f51e827a28ed013ceaf6bc82027f3206f27cee9e1773982a807768d9a836a632be5f905e4481aa260b82dcdf3 |
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\headerGRADIENT_Tall.gif
| MD5 | b850130ae4630c5bf156219bc1ee6148 |
| SHA1 | ec6dac370e778b1e4f5383f4663e6e9b3d91e5c2 |
| SHA256 | 4ad35c5a730861d715b5dd886a714c0ce33656a59ee04ea15fe13c39804fec30 |
| SHA512 | 97b7ac139f481dfbd082561939183c60ef69ecd22442227fda253465f27943336c4a3d2c6daed270d469a313f108f141d56d5a9f8223dea79ae7ce92c0e77a27 |
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\gradient_onWhite.gif
| MD5 | dc274a295d0762bd50961c0dab7d3aa2 |
| SHA1 | 83a558c45a68a3cd7f8cc6b8f98a9cbce1523bdb |
| SHA256 | 9e27f2361b978796d31b507a9f76742cc1235657c580f449c3f333ce9ba644de |
| SHA512 | a8784cc65e660da3ed68f9bd4422aebea5683bbe22e811aa315f202920cbbf9759a313cee7cdeaf70b19c7d80f2570cd85f85045bc49b7df692d66df3287a71a |
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\folder.gif
| MD5 | e0d8dfb419d49653d70ceaf50c50751c |
| SHA1 | f033a255e36814434c34443d3aa69821205580b2 |
| SHA256 | 953644536739be09f529b5fb7a0b31fbf0a95f22b4eeeb2ac3f2dc9a76ef06a5 |
| SHA512 | 0cb316e7250de0ccc97c17777b7d6db237d128284eb438db98176ab50b480796f30fcae5e5693b3b6a816d3d5413a722c6b10b4531d19983d06093f1058b6f27 |
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg
| MD5 | 29d62be6286124ae2e1bac1865ee9210 |
| SHA1 | 098daaa26f328327d9dff8fd1f96de1d797868f6 |
| SHA256 | 6f05eb80e2d07c57d31f7f8672b85a02111f6a4bdfe8357c8d571504bde47715 |
| SHA512 | ad2f5182f42262204b58e8232bacbb9cd910cb1dfcfe3a8fa4949a8f9e1b12c9e387f2837a1761f85d4db27e5abdf0a253a522edcea4d9ad62769076bbe5ce5c |
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\alert_lrg.gif
| MD5 | 753a35716b58a88f72cce92246765f74 |
| SHA1 | b8e4e087c5995b8ca9ceab9c3dd7f7dac6ccfcee |
| SHA256 | 91dc47ce82cfa9e0301026d0eed6650df5c9f75074d02cd4f9103ee23f24ea26 |
| SHA512 | 9a806d453b14f044d2108f08ef029416bf9f613d46a1caa89c6d2ad49eaf5f3fd7ceb8b27afc97e483adaa875ee1bf25a66912862275b2cf0a6db142678c11cc |
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\04-1 - NetworkStatus.lnk
| MD5 | 00d3b4a878c127607159ef506e3e72fd |
| SHA1 | f6a1920942df85597870d2ea5319597479192814 |
| SHA256 | 5c974d984584a929e625d4ccad597eaeec5a54ee3d4b59dd1dae356415a10656 |
| SHA512 | 215e54e3fd1b3bbacd631e0ac56aebe02ea985e02243054401d63048e51592b67268f0f5f5be09f91a6e37993a987a4e98309ff3766f9382757b6eb281770a1f |
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\09 - Mobility Center.lnk
| MD5 | e988a841f17cbaf9d51297c1cc253464 |
| SHA1 | 6573dcf4c6ebb88c85442224c554200754b1c4e5 |
| SHA256 | cc27e4435a80f43b7cfc7b74c502d62f244bf3c804edb7a7cbc9585847dfe63a |
| SHA512 | 4905d2da658e692ada2e10677059cf8012eac29bd12b83a5424c9b17d3cea875c78901243d5ef6838aabfc77049b96b9d8806b7551d56597e2df35d52f684ae1 |
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Magnify.lnk
| MD5 | a95060b62aa7c0f91ddc80b249aa5947 |
| SHA1 | ff5f8c08e5cdfe6f20dacc666a395dde9ec2592c |
| SHA256 | 9b8c54ea4a16c4b150d46f5cfb8837a4d4c0809410310d2ff3fb29e1829bc33a |
| SHA512 | 34f2c566422df27bc1097c680ceefc9880b32381ca5d93ae40bc3237002fab4534accb70da948ecfcff9a1d52c7493dc5911ccd7dafa8c57d0e46d197c402f64 |
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk
| MD5 | 54040d5552af71b9985867781ac61c80 |
| SHA1 | e120e8a285c8b430a808343979984717d4190d41 |
| SHA256 | ad710d635122ebf052783252dc7ab1c512e6a85ba7ecebc3297a099fc7fc811a |
| SHA512 | 998b97265246cfec08e76ff2154e506844917788d762930ce28ff3563097b6ebd6b310237f2e33a88632e729ec76b94773bbe5a230399c419e70e8898cb3ed0a |
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Run.lnk
| MD5 | 0f3988085e51c8bd5855c4b06fbea7ef |
| SHA1 | a970e39aeb9ca53a4fe56398de9552639342e90d |
| SHA256 | f169cc48ea4dadb7ef9c6176eb7037281ccdbd9a384a8e5c78134abda799e87b |
| SHA512 | c9979d3bad021e553eef78337a6395ac5e99076292c6ab163e3215c98617d6c7193f9ba4d48d377ad33db8f560f097c4acb8be688eb38aee6c334fc622cd995c |
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Control Panel.lnk
| MD5 | 5388857397f02588bb440ca0736c05be |
| SHA1 | 29f92977a91edabd591b76bf72d7d42c4101d9d6 |
| SHA256 | de59b840a89398e9c5fa1456dea4ae38bc0a500e43d871fe46a99394dead564f |
| SHA512 | 9e12cd8d06e976c8b3b14e275890daad49acb3fdd46cafd092209f3eaaeadb6a98fab8fdfe82ea5e98707081a85a5605c2cbaba2c521503338a740768bf3623b |
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\computer.lnk
| MD5 | 01ba046042aa3e9fce096fbfd761f608 |
| SHA1 | 844d665f72e74fabe774ffea09b8daa5101fabb1 |
| SHA256 | f6cc03497830e1336df72fff7b39aa17db29e684a8a44603daceb8a780e9200a |
| SHA512 | e566a77ea371e872401e46d6b470cbe753dee8953b92a367d10833420c20a04fcb72d0f8daec52ad8bff023a636300d5d95c56a7cea9d1226f65d8d1924d408a |
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Command Prompt.lnk
| MD5 | 1afee79cf941981fd5b1d2c0d9bb25eb |
| SHA1 | 880d71a96c4abf019232d12e389d48959b048762 |
| SHA256 | b0459ef2525d1f6eb32dc748d2bdb9f704b72bfb00ef5c4e88d265b087bafcee |
| SHA512 | baf756c0c2b7f3713ba74695c2ccec5acaade27ecc04f2dc4adb465fcd941bda1b218753aa9374a3285298efc4b51dc7d14d69be231a1fbd8eb235851f3312ea |
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Administrative Tools.lnk
| MD5 | 2d216170bd615e9163ce904f79ebbcfa |
| SHA1 | 8c095a2b30aa0283d1cde63a7e32f1e1cdaddd56 |
| SHA256 | 8b9526721ef4cf31c711f721e37999a205fa4dc56d4dc79bfa1d7b311e106dc6 |
| SHA512 | a42f0c29572bc31c3d0a14958f183ddba4111c4274a473680c9d2f6fe239fbc99eb381dcd11c159d8d2fe087940943bc33cc129268a81c783cb362503636409f |
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\On-Screen Keyboard.lnk
| MD5 | 8c5553e7a3bd36bacb1eed5aa7988286 |
| SHA1 | e8e4b4f7bcd7ab9e6ee6a5538236b7f484f40b69 |
| SHA256 | 6ef9f2bc273207eaeada599a79c0d83819437e938b2044244f003058d11e5f91 |
| SHA512 | 195c98a15a773e9a05b5ae26e75a7f61ee6a7d7e70bfbf5b1475596ca0fa78519bebf557f381217f7645e94d552fb48ef64d6bd727c2a46642f80ee422fc4d02 |
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Narrator.lnk
| MD5 | 725eda0eaf751eb15f3d779552865b5b |
| SHA1 | b969825ad80f923c1ead4a38e7bcc3b0a4fa16ea |
| SHA256 | 3736a73b4b15c62c350f4361014bd3311c785ce118372abd21e6eed8ab66faf8 |
| SHA512 | d8d9dc6d3243c1ee26bb3e975693cefb7bfb46d3b3065c60a31f3117cb2ec703bc4669d349412cc7be4b80d762f03545a95c3fa14a0b1dc336ab0a13fa4117fc |
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk
| MD5 | 619be08e2060d4923849b4089172428c |
| SHA1 | 69c5e21f30d58f58b85d308606404f0124d2dd97 |
| SHA256 | 3bc6b058ad8d03c8a477cb8647bb0d2936059e500ac6c707e656c8f0fbd55829 |
| SHA512 | 2c6cf62804344296b64492200d0f286720ba70e1e67f232c4250996229e5934c1c2dd4e68054e0c806a6019532dfd66cb8d54b060e48a387c76965c8af6d109d |
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk
| MD5 | ab167799050fb20a14a92f498aa115d4 |
| SHA1 | 782a1be526a8ca69e304dc24838f26ea8fb5e874 |
| SHA256 | f6a80e132f72462bc2f3881754104996ac225b5b7823a34028731f3648620c55 |
| SHA512 | ee1e29f80b79f1b079bf512fefe1fbcedb238fad5df3723858cb0fa7388b34ba73a43b17e3bd3af84bf1c5ca267cc2686bf1a18a7d213764e69ba469c60c6031 |
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\10 - AppsAndFeatures.lnk
| MD5 | 93845dbcd7f047f2df603b1d782f2968 |
| SHA1 | 6ca981cce3103ddb01b87a0860b2fb3046205707 |
| SHA256 | 3a7feca999e0e446961dbaa5ef764362bbe8ed79db55ff32b1e733248db0e2a1 |
| SHA512 | dc5b259f4b1115023123a1d2fd6e8273e142795b59c29031a2d811fac89e8ad4d8d891c358574efedf8e70d8ade0d668858f3d3b37ebea0eb02a36e521e36fad |
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\08 - PowerAndSleep.lnk
| MD5 | 9534152d0194ccb8c5b7b6b5594ad464 |
| SHA1 | 0570834ff4b1403e190ce69ad4429f560623499d |
| SHA256 | 37ea41544f1a20c19d869f3afd7c5a690d575e2524960476d6a9d41cae55a294 |
| SHA512 | 7b597b9a32043fd26c463ca839cfd0b6dee3366174d059d7d87962c6fbc2130d730f365cf4b2945e2113c5aaca4323cf00c10440bbadadd30243f4a568301ecf |
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\07 - Event Viewer.lnk
| MD5 | 6814f99c313650cc32a0bd2cef7ab578 |
| SHA1 | 6075248ca9d99126b90c215468bb1324a764a208 |
| SHA256 | d35418ffc565866c7747de3bb059626bd03454a02bd9f0d647c9c745976b489f |
| SHA512 | 17be7585e841aef01dfee6e630a124663015b1617da5061ebda03fdf57cb6d42f6ae6a551240ed05bd26b5c59aa6fbc35a86043c1932a175f534d21b54d92447 |
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\06 - SystemAbout.lnk
| MD5 | fd7669b7569b957e6a9c08680a651939 |
| SHA1 | ecd56c43ae6f4005610dfdbf418f87ebf683d090 |
| SHA256 | 386117319e5299e609961f11da8f8ff68fbf2e656dbfedace30df70d00a588d5 |
| SHA512 | fca302e3bbffb025564b2f46a851d5137225b2c9078cd19bd08dd048578a0cf754dc3c7b4c9173105aeafa7fe9045c5ca95510e11a647887e13c498792fc0fde |
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\05 - Device Manager.lnk
| MD5 | 199d28d60bff377d39881cd2946c5c25 |
| SHA1 | 0bd86d613d442976c335ec7a29c6e5189f9b5003 |
| SHA256 | 7a8b5757b6c06819ee5632cc2dca78aa4fcd479b216ed6c9b4944f290c4a09bf |
| SHA512 | c7bc2ba88d1b51d68dcaafae850a3ca8f98d6ddf7d482d4d0bb70cb72cc1f059f58d5396224d3c85e4ea84a888868746f46d2fe1ed9d1ac488beb8c42025aef2 |
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\04 - Disk Management.lnk
| MD5 | bd7e6553c4cb4723968bd10b3ec883c2 |
| SHA1 | e132e85a158773f5de05d81ddec7b7c9a30df0e5 |
| SHA256 | f862d6216e158f6729fa667e351c0bae6f9250358baf8c117f093e16612ab5a4 |
| SHA512 | ea6109b94d058fa627cea325b39771061ea18fde1e85483cfd64c023502f63b7ff2f78106f595ac6d2039ad7d5b34adf7da59a2273ae8acb71af023afb09c9b2 |
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\03 - Computer Management.lnk
| MD5 | 44e6c9e5cb29cbb2a828648f72a28a8c |
| SHA1 | 906435054ff5e9b08a4fc6a5dc7d2509ff9ae241 |
| SHA256 | 27a4fd7e08b1e454984ed7a920c65bf015317e364cbceed641b4bd9160545039 |
| SHA512 | eed52e9350bd1cdfc500ea825239db2c748446d1fa0bb386edf5860123e472a817156f3c18d4a782a7d847d6848dd7f70e08f7939dcc82d29db8d69703806652 |
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\02a - Windows PowerShell.lnk
| MD5 | 86de1763494af9be46256560709e2324 |
| SHA1 | aff672b9c1e1ca6f1d8524c233c0e57625f2b4b1 |
| SHA256 | f09a2a15f74fa756a88b15c7772ef4c19e199afa192e7903f55132f9879cb8c4 |
| SHA512 | 4045f84a414e177b89ab94ac5ac4750c9627928baaa08c06febdc5924968dea0dd2949fb51633bc7a520cc8d29d18b0cf60fcabf639ac348f42c8af4924a38bf |
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\02 - Command Prompt.lnk
| MD5 | efdc121896c39949cdc67d3ca8b80393 |
| SHA1 | 3633a738374927e81c7e6040f1bfb7a73de3372b |
| SHA256 | f98a04712ed4b181cc5015e0630fe829ecd1d15d07f69962eeb3607e6accb3ef |
| SHA512 | d2191d762f6e297ba381f0974228749dd611e9c34bc01d0e086d8b49e58068cdc7044462c1a3700dade9a06160205855852855757e6c526c70bfea3b5e08d869 |
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\01a - Windows PowerShell.lnk
| MD5 | 217bee7e7158b2ea8e510cdd60ed4262 |
| SHA1 | 39c78f693a2cb052266234ecd500ec72b6f72948 |
| SHA256 | db860698e168b4d8026287c02813e46e54ca509a3b4d0193b49f241efc71aba9 |
| SHA512 | c7563008f5e401f35d039ec289bd389e7f1d1feba26721bf797d21fca482c1c1f4691c0f1856fca2a237af6652f909ed786641def99888497df5688e265bd54f |
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\01 - Command Prompt.lnk
| MD5 | fca1ec9ac2483dbf37828b4c9f1209c8 |
| SHA1 | feaa5586ffa813998f26704fc3a0b561accef911 |
| SHA256 | deeef980cb657ccbddb05f464a49d2aa8ef1be1259879c36ac31265b2b8a6c56 |
| SHA512 | 189ff029c202528221cfd99061da8c9b270a8ed4246a8c34b7c844e13511adb9b7f2e3ddaf60af752a0ced684b1edd491a0d02dc1c1b338f2a385aa50f9abbba |
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\5 - Task Manager.lnk
| MD5 | cf6b604be1114dc22facce0ac83de336 |
| SHA1 | 2c45ed7f97d97b288545733dd7d291489ecf4eec |
| SHA256 | e99f0b1d8bbea3b3fa521e24f582297f99ae81d7cd5399a5226582545a119196 |
| SHA512 | 9901ab3fbf6eace40820bab1a8e8854d5ba82b98a668bf831f238005b774837a7c7ec72be4c0dca162a552701538a2df2a89e9edceb5bb5f9cdd24850539a625 |
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\4 - Control Panel.lnk
| MD5 | 4fe1bca1af96af3df213fa4792fe8fc8 |
| SHA1 | cf9da90cdc82452c67c1028c0b3316a72c400f9b |
| SHA256 | 0c7ee59618188fcd01fd10b6b9baa0089f54a15b9123cc476bfcec7ede94fc35 |
| SHA512 | 667e78c0c6317894be6082330529ead1012b6e4a31928f186add6e84113f81dbf2939f7e39414c7b63584220f31341a764ec8a79e7f80c628916661e9a296092 |
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\3 - Windows Explorer.lnk
| MD5 | 3cb8c7130545739348a909fd71671d7c |
| SHA1 | 4f0c4a30b45b587c0a8c72213a994b85cb2485f7 |
| SHA256 | 57dd706226f570e8714856a4e7be2403452404842932728f8be362579e833aa9 |
| SHA512 | 94161cd9be8ad61a06b547d6f75a1eabb99b30c90abda8aa7ddf785282c29aca4b4bb5df220d3c30f00d2b7f1124ddde4eab5f7dbbb09e6cfac407ee54a5ca4c |
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\2 - Search.lnk
| MD5 | b36bde6a10978d8362eef8782b6bd9d5 |
| SHA1 | e093c15de36454f14576808ef66a3023ee62fbd7 |
| SHA256 | 2d51e2001aacbff283690073582b997cf18a97551354c66d9c7961a6d97dc2ea |
| SHA512 | 7fe90f2c7897d2c31fe0ea3e25ad6ba4b3225a8caf94ff256f4dce2b6ea3836ecd3c40e02f0aa5dbc93f3e1d802b3092d097b004de88f5389d70033a697367e9 |
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\1 - Run.lnk
| MD5 | 89ff6d8d522f58d12ff9dabbad1998a6 |
| SHA1 | 3abfb872a5128dd3e1a9ea2979ad4eabcd44db0f |
| SHA256 | 5d6c5143e2b3a36d71b871d1aed1c5203cfea5240c2fa5d6908cd1c09a6f3714 |
| SHA512 | 087e17822c2696ebd1065a398fe4c7f3f361752a86590df3ed24742f4f2c8bb258608ed603a2a96fc0b6a4e5e69dd01c31dc924b9edec4290f25ed36dc52269c |
C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group1\1 - Desktop.lnk
| MD5 | 4f838761189418d7a8bf9084fe5df818 |
| SHA1 | c0c38e29994c3c7a5138431aa0a2b50221db89ca |
| SHA256 | 215f35b1c77372bb6d23b91cce320e58e269650c3894da0955e1fcf3be5ec0a6 |
| SHA512 | 60ac8ed93a11c1cdcfcdadf41128c6f3b0da6e7de792abfc089965d943f524709a1e526a21de76a93b81093029d6e6bb19599b403d0cb0eacc37c06138920a26 |
C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell (x86).lnk
| MD5 | 67dbcfc90b4e87e0d659edbf4e156bd5 |
| SHA1 | adc29f90ce7083a362c82d065090b7d1677226c4 |
| SHA256 | 478571bf16bcb02821fda2e5ea9633982df8a5055e5796b3953ee7cbd0ed3659 |
| SHA512 | 7fc584fc8000aedea510d296667daf58226de794e191654ccae8ccb7489093fd6bbd3386de0098582e47dc7f6ea4e144dbb55a852ea5daf6c168e733487bd5f3 |
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png
| MD5 | 41457526b654eab641eb608226d16382 |
| SHA1 | f3005459cff98e226e92ef36330962cf0eefe9ca |
| SHA256 | 441420993e159fcc01e12cc85ac1656d4ba25480c56abb04561fdd6ed1698324 |
| SHA512 | 19ed713e6ba851bd379b14abb3c20993c439e3fb5b700df02609ea131891598d0edcb5aa6c79651e5c5eb43a4b07f36b908aaf4ecab52a45108ddce35883de79 |
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_contrast-white.png
| MD5 | 0843290b46e5a518a613825a8648b4b7 |
| SHA1 | adaad9eee7f0b2f916492569b51f85fafb934705 |
| SHA256 | 69340f7aceb09607de336223b453d873739d5abcc20605423b8f2fffacb619ec |
| SHA512 | 0eb6e4094830523416583b5c367e56450993dcbbdfbd502caa44ee248eee5ba20ac6d952bc2118e8e3d85d0b00421a66eb30fdecb1b0b6bb31e8636e38838ede |
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square44x44Logo.targetsize-44_contrast-white.png
| MD5 | 8c2348d1ed47dfb352d233a45fb85ec1 |
| SHA1 | 2b098ed44dd9d7190877e2b4116322d678a36a60 |
| SHA256 | 5b81a0c8479c0db6071dd684f138714081b261e3f2b610c3105756739fd046e6 |
| SHA512 | 21d2f1e6ca91b1cfa3081e8c8b3031c4f05fd151137c9d79ccdb0625ab54cac2ffad3dba04a57ae92d806200ebb0c6b59962ab5e2b9912d69534f208cc1dab79 |
C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png
| MD5 | 9a3a822c5f432e087836b0345d7de4ca |
| SHA1 | 94de3ae7aed97d1c8b4b97bcaf63135d2cb79f69 |
| SHA256 | 6b554d0a6dd35dc9d51c062c98e8acc70b2a6496e236f4ee87ddca1485b0ab71 |
| SHA512 | 3ee71ab2d42832b4417b88658d684d4155695fef6709044ad9b8aa14666e719ead833bbe08d5f17a6bdf8df691436600cc652e546019a630746c874639519a80 |
C:\Windows\WinSxS\wow64_microsoft-windows-onedrive-setup_31bf3856ad364e35_10.0.19041.1_none_e585f901f9ce93e6\OneDrive.lnk
| MD5 | 9349be02c01666356695774e53d7a093 |
| SHA1 | a2114a1bf7b9ccbc0a6c25916922d4b544415560 |
| SHA256 | 5dc96255a75c0801501fe9460745a96a0d5f8cc4874d1f84367f42e438b3fddd |
| SHA512 | b0f1b67f72b94bdd85afff66a839fe4e864de390e7db973a6aea0b5e4344670be0baf678310b415569600c134ddbe6954498dd2cdb388c55d94fff1143a315c5 |
Analysis: behavioral1
Detonation Overview
Submitted
2024-11-26 14:22
Reported
2024-11-26 14:25
Platform
win7-20241010-en
Max time kernel
71s
Max time network
125s
Command Line
Signatures
Detected Xorist Ransomware
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Xorist Ransomware
Xorist family
Renames multiple (2170) files with added filename extension
Drops file in Drivers directory
| Description | Indicator | Process | Target |
| File created | C:\Windows\SysWOW64\drivers\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\SysWOW64\drivers\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\SysWOW64\drivers\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\SysWOW64\drivers\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\drivers\gmreadme.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\SysWOW64\drivers\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\SysWOW64\drivers\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\SysWOW64\drivers\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
Deletes itself
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\cmd.exe | N/A |
Drops startup file
| Description | Indicator | Process | Target |
| File created | C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MD79PFRQ4de5n55.exe" | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
Indicator Removal: File Deletion
Drops file in System32 directory
| Description | Indicator | Process | Target |
| File opened for modification | C:\Windows\SysWOW64\StupitHack.exe | C:\Windows\SysWOW64\StupitHack.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\StupitHack.exe | C:\Windows\SysWOW64\StupitHack.exe | N/A |
| File created | C:\Windows\SysWOW64\de-DE\Licenses\eval\EnterpriseN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\SysWOW64\StupitHack.exe | C:\Windows\SysWOW64\StupitHack.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\StupitHack.exe | C:\Windows\SysWOW64\StupitHack.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\StupitHack.exe | N/A | N/A |
| File opened for modification | C:\Windows\SysWOW64\StupitHack.exe | C:\Windows\SysWOW64\StupitHack.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\StupitHack.exe | C:\Windows\SysWOW64\StupitHack.exe | N/A |
| File created | C:\Windows\System32\DriverStore\FileRepository\ph3xibc9.inf_amd64_neutral_ff3a566e4b6ba035\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\System32\DriverStore\FileRepository\prnbr006.inf_amd64_neutral_f156853def526447\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\StupitHack.exe | C:\Windows\SysWOW64\StupitHack.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\StupitHack.exe | C:\Windows\SysWOW64\StupitHack.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_History.help.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\StupitHack.exe | C:\Windows\SysWOW64\StupitHack.exe | N/A |
| File created | C:\Windows\SysWOW64\StupitHack.exe | C:\Windows\SysWOW64\StupitHack.exe | N/A |
| File created | C:\Windows\SysWOW64\StupitHack.exe | N/A | N/A |
| File created | C:\Windows\SysWOW64\StupitHack.exe | C:\Windows\SysWOW64\StupitHack.exe | N/A |
| File created | C:\Windows\SysWOW64\StupitHack.exe | C:\Windows\SysWOW64\StupitHack.exe | N/A |
| File created | C:\Windows\SysWOW64\InstallShield\setupdir\0c0c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_script_blocks.help.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitsTransfer\fr-FR\about_BITS_Cmdlets.help.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\SysWOW64\StupitHack.exe | C:\Windows\SysWOW64\StupitHack.exe | N/A |
| File created | C:\Windows\SysWOW64\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\StupitHack.exe | C:\Windows\SysWOW64\StupitHack.exe | N/A |
| File created | C:\Windows\SysWOW64\StupitHack.exe | N/A | N/A |
| File created | C:\Windows\SysWOW64\StupitHack.exe | C:\Windows\SysWOW64\StupitHack.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\StupitHack.exe | C:\Windows\SysWOW64\StupitHack.exe | N/A |
| File created | C:\Windows\SysWOW64\StupitHack.exe | C:\Windows\SysWOW64\StupitHack.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\StupitHack.exe | C:\Windows\SysWOW64\StupitHack.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_remote_troubleshooting.help.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_Automatic_Variables.help.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_Core_Commands.help.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\SysWOW64\StupitHack.exe | N/A | N/A |
| File opened for modification | C:\Windows\SysWOW64\StupitHack.exe | C:\Windows\SysWOW64\StupitHack.exe | N/A |
| File created | C:\Windows\SysWOW64\StupitHack.exe | C:\Windows\SysWOW64\StupitHack.exe | N/A |
| File created | C:\Windows\SysWOW64\StupitHack.exe | C:\Windows\SysWOW64\StupitHack.exe | N/A |
| File created | C:\Windows\SysWOW64\de-DE\Licenses\eval\ProfessionalE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-shmig-DL\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\System32\DriverStore\FileRepository\prnca00f.inf_amd64_neutral_777b6911d18869b7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\System32\DriverStore\FileRepository\prnlx009.inf_amd64_neutral_d4b76afd08f308fb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_PSSnapins.help.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_Ref.help.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\SysWOW64\StupitHack.exe | C:\Windows\SysWOW64\StupitHack.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\StupitHack.exe | C:\Windows\SysWOW64\StupitHack.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\StupitHack.exe | C:\Windows\SysWOW64\StupitHack.exe | N/A |
| File created | C:\Windows\SysWOW64\lt-LT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-Sxs\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_Session_Configurations.help.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\SysWOW64\StupitHack.exe | C:\Windows\SysWOW64\StupitHack.exe | N/A |
| File created | C:\Windows\System32\DriverStore\FileRepository\hpoa1so.inf_amd64_neutral_4f1a3f1015001339\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_remote_output.help.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\SysWOW64\StupitHack.exe | N/A | N/A |
| File created | C:\Windows\SysWOW64\StupitHack.exe | C:\Windows\SysWOW64\StupitHack.exe | N/A |
| File created | C:\Windows\SysWOW64\en-US\Licenses\_Default\HomePremiumN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_Continue.help.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_WS-Management_Cmdlets.help.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\SysWOW64\StupitHack.exe | C:\Windows\SysWOW64\StupitHack.exe | N/A |
| File created | C:\Windows\System32\DriverStore\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\SysWOW64\StupitHack.exe | C:\Windows\SysWOW64\StupitHack.exe | N/A |
| File created | C:\Windows\SysWOW64\StupitHack.exe | C:\Windows\SysWOW64\StupitHack.exe | N/A |
| File created | C:\Windows\SysWOW64\StupitHack.exe | C:\Windows\SysWOW64\StupitHack.exe | N/A |
| File opened for modification | C:\Windows\SysWOW64\StupitHack.exe | C:\Windows\SysWOW64\StupitHack.exe | N/A |
| File created | C:\Windows\SysWOW64\it-IT\Licenses\eval\UltimateE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\SysWOW64\migwiz\dlmanifests\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
UPX packed file
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Drops file in Program Files directory
| Description | Indicator | Process | Target |
| File created | C:\Program Files\VideoLAN\VLC\plugins\audio_filter\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File opened for modification | C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\button_right_mouseout.png | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0178460.JPG | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\WB02214_.GIF | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File opened for modification | C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-last-quarter_partly-cloudy.png | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\CORPCHAR.TXT | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01237_.GIF | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Oasis\HEADER.GIF | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File opened for modification | C:\Program Files\7-Zip\Lang\hr.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Program Files\Microsoft Games\Multiplayer\Checkers\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.es\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LEVEL\PREVIEW.GIF | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BrightYellow\HEADER.GIF | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File opened for modification | C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\Passport_PAL.wmv | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21335_.GIF | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR37F.GIF | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\NotifierDownArrow.jpg | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\it\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Program Files (x86)\Windows Sidebar\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File opened for modification | C:\Program Files\7-Zip\Lang\an.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File opened for modification | C:\Program Files\CompleteRepair.odt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATER\THMBNAIL.PNG | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\icon.png | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\6.png | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00130_.GIF | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\BG_ADOBE.GIF | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\bg_Premium.gif | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\GrayCheck\TAB_ON.GIF | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0315580.JPG | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01304G.GIF | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\J0115839.GIF | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\en-US\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File opened for modification | C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\timer_over.png | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD14882_.GIF | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Program Files (x86)\Windows Mail\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Program Files\Windows Mail\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382926.JPG | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\SpringGreen\TAB_OFF.GIF | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_right_rest.png | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\settings.html | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Stars.jpg | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EVRGREEN\PREVIEW.GIF | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Program Files (x86)\Windows Sidebar\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File opened for modification | C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\rings-desk.png | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0386120.JPG | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\OutofSyncIconImages.jpg | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BrightOrange\button.gif | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\trad_s.png | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\images\delete_over.png | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\WB02055_.GIF | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\groove.net\Servers\Management.cer | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Microsoft Office\Stationery\1033\TECHTOOL.HTM | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\16-on-black.gif | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File opened for modification | C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0309598.JPG | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
Drops file in Windows directory
| Description | Indicator | Process | Target |
| File created | C:\Windows\winsxs\amd64_microsoft-windows-l..epremiume.resources_31bf3856ad364e35_6.1.7600.16385_es-es_aa872ff79993c5bd\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Globalization\v4.0_4.0.0.0__b03f5f7f11d50a3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\winsxs\amd64_microsoft-windows-cryptui-dll.resources_31bf3856ad364e35_6.1.7601.17514_es-es_61539089b51fc4e0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\winsxs\amd64_microsoft-windows-s..ordinator.resources_31bf3856ad364e35_6.1.7601.17514_it-it_c8a2cc139113dac5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\winsxs\amd64_microsoft-windows-s..vault-cpl.resources_31bf3856ad364e35_6.1.7600.16385_en-us_f4cd822e26c1b353\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\assembly\GAC_MSIL\TaskScheduler.Resources\6.1.0.0_es_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File opened for modification | C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_c02a16e1ae17ab94\about_remote.help.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\inf\ESENT\0410\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\Microsoft.NET\Framework\v3.0\Windows Workflow Foundation\SQL\ja\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\winsxs\amd64_microsoft-windows-i..tional-codepage-870_31bf3856ad364e35_6.1.7600.16385_none_2adf2efab4e0d9c8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\assembly\GAC_MSIL\System.Windows.Presentation.resources\3.5.0.0_it_b77a5c561934e089\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\diagnostics\system\DeviceCenter\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\winsxs\amd64_adp94xx.inf.resources_31bf3856ad364e35_6.1.7600.16385_es-es_7d1934d0258df2c9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\assembly\GAC_MSIL\Microsoft.Jscript.resources\8.0.0.0_fr_b03f5f7f11d50a3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Xml.XPath.XDocument\v4.0_4.0.0.0__b03f5f7f11d50a3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\winsxs\amd64_microsoft-windows-e..gadgetxml.resources_31bf3856ad364e35_6.1.7600.16385_es-es_901b335e29d329ab\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\winsxs\amd64_microsoft-windows-g..-currency.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_5c4791cafd126e03\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\winsxs\amd64_microsoft-windows-i..l-keyboard-00000843_31bf3856ad364e35_6.1.7600.16385_none_441dca567d53951f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\winsxs\amd64_microsoft-windows-l..omebasicn.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_1a7b58bf239bbd92\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\winsxs\amd64_microsoft-windows-processmodel.resources_31bf3856ad364e35_6.1.7600.16385_es-es_a119d2e3a5767adf\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\Microsoft.NET\Framework\v3.5\1036\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\winsxs\amd64_microsoft-windows-a..iles-help.resources_31bf3856ad364e35_6.1.7600.16385_es-es_ebd6917fd6440ec3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\winsxs\amd64_microsoft-windows-extrac32.resources_31bf3856ad364e35_6.1.7600.16385_es-es_67144e9e0af59827\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\winsxs\amd64_microsoft-windows-enhancedvideorenderer_31bf3856ad364e35_6.1.7601.17514_none_edc8831ae3260955\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\winsxs\amd64_microsoft-windows-openfiles.resources_31bf3856ad364e35_6.1.7600.16385_es-es_d513f7ac93221150\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\assembly\GAC_MSIL\SrpUxSnapIn.resources\6.1.0.0_ja_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Pres#\fee2bbfe0b8f5988a3ab7a9db85c7a30\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\winsxs\amd64_microsoft-windows-help-license.resources_31bf3856ad364e35_6.1.7600.16385_es-es_afb241b6af4af442\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\winsxs\amd64_microsoft-windows-iscsi-adm.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_a98b594839a4e5db\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\winsxs\amd64_image.inf_31bf3856ad364e35_6.1.7600.16385_none_c079423a110e8ff9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File opened for modification | C:\Windows\winsxs\amd64_microsoft-windows-s..oundthemes-heritage_31bf3856ad364e35_6.1.7600.16385_none_5872c0830d0c4747\Windows Ding.wav | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File opened for modification | C:\Windows\winsxs\amd64_microsoft-windows-o..disc-style-huecycle_31bf3856ad364e35_6.1.7600.16385_none_810df6f57d9f2a73\NavigationRight_SelectionSubpicture.png | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\winsxs\amd64_microsoft-windows-d..asks-sync.resources_31bf3856ad364e35_6.1.7600.16385_it-it_d4b0107c52e0a2c9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\winsxs\amd64_microsoft-windows-e..atibility.resources_31bf3856ad364e35_6.1.7600.16385_es-es_e1de9eeb9e402a99\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Serv30e99c02#\aa093ade93079bf7ac8b4446ebd6d935\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\winsxs\amd64_microsoft-windows-t..framework-migration_31bf3856ad364e35_6.1.7600.16385_none_4ce62d7fd1cb54eb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\winsxs\amd64_microsoft-windows-ocsetup.resources_31bf3856ad364e35_6.1.7600.16385_de-de_59042a1524a4660c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\winsxs\amd64_microsoft-windows-sort.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_e4219686d4202553\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\winsxs\amd64_microsoft-windows-p..ystem-web.resources_31bf3856ad364e35_6.1.7600.16385_de-de_63baff6af370f039\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\winsxs\amd64_microsoft-windows-magnify.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_80523aa3c39a0c55\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\winsxs\amd64_microsoft-windows-p..-localspl.resources_31bf3856ad364e35_6.1.7600.16385_de-de_1a8ba067c513126e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\winsxs\amd64_microsoft-windows-ime-korean-hwresource_31bf3856ad364e35_6.1.7600.16385_none_ac4a6957c5dbd4bb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\winsxs\amd64_microsoft-windows-n..line-tool.resources_31bf3856ad364e35_6.1.7600.16385_it-it_a3a873c4a692126e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\assembly\GAC_MSIL\System.Configuration.Install.resources\2.0.0.0_it_b03f5f7f11d50a3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Workflow.Activities\v4.0_4.0.0.0__31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\winsxs\amd64_microsoft-windows-cdosys.resources_31bf3856ad364e35_6.1.7601.17514_hu-hu_a8642385afe86a68\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\winsxs\amd64_microsoft-windows-i..gbinaries.resources_31bf3856ad364e35_6.1.7600.16385_es-es_8f4e41fd5a0fa4e1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\winsxs\amd64_microsoft-windows-n..35wpfcomp.resources_31bf3856ad364e35_6.1.7600.16385_de-de_1c792e5cadcd4c36\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File opened for modification | C:\Windows\winsxs\amd64_microsoft-windows-o..disc-style-babygirl_31bf3856ad364e35_6.1.7600.16385_none_b2bd01695c9021fd\content-background.png | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_es-es_8bc7919d3f36cee7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\winsxs\amd64_microsoft-windows-s..es-common.resources_31bf3856ad364e35_6.1.7600.16385_en-us_341e0271bf05fe78\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\winsxs\amd64_devicepairingproxy.resources_31bf3856ad364e35_6.1.7600.16385_it-it_6976fa64f9742bce\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\winsxs\amd64_microsoft-windows-atbroker.resources_31bf3856ad364e35_6.1.7600.16385_it-it_4fd8c47c12328205\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\winsxs\amd64_microsoft-windows-sidebar-adm.resources_31bf3856ad364e35_6.1.7600.16385_de-de_a611a6570549db88\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_fr_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\winsxs\amd64_microsoft-windows-a..vesqmmanifestplugin_31bf3856ad364e35_6.1.7601.17514_none_756ad8eef4d0f1d0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\winsxs\amd64_microsoft-windows-autoplay.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_95114bf53924b486\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\winsxs\amd64_microsoft-windows-l..epremiumn.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_6128609abd76ab18\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File opened for modification | C:\Windows\winsxs\amd64_microsoft-windows-m..ttheme-us-component_31bf3856ad364e35_6.1.7601.17514_none_b52573ad8e4c2d89\US-wp6.jpg | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\assembly\GAC_MSIL\policy.3.5.System.Data.SqlServerCe.Entity\3.5.0.0__89845dcd8080cc91\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\winsxs\amd64_microsoft-windows-a..ionrecord.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_1193b4bfce8dcbdf\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\winsxs\amd64_microsoft-windows-hlink.resources_31bf3856ad364e35_6.1.7600.16385_de-de_7e00139a18587871\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\winsxs\amd64_microsoft-windows-n..qossnapin.resources_31bf3856ad364e35_6.1.7600.16385_es-es_5d5df012d8c7a97f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| File created | C:\Windows\winsxs\amd64_adp94xx.inf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_7d4dd7ec25670124\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
Enumerates physical storage devices
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\StupitHack.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\StupitHack.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\StupitHack.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\StupitHack.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\StupitHack.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\StupitHack.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\StupitHack.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\StupitHack.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\StupitHack.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\StupitHack.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\StupitHack.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\StupitHack.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\StupitHack.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\StupitHack.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\StupitHack.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\StupitHack.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\StupitHack.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\StupitHack.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\StupitHack.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\StupitHack.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\StupitHack.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\StupitHack.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\StupitHack.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\StupitHack.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\StupitHack.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\StupitHack.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\StupitHack.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\StupitHack.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\StupitHack.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\StupitHack.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\StupitHack.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\StupitHack.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\StupitHack.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\StupitHack.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\StupitHack.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\StupitHack.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\StupitHack.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\StupitHack.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\StupitHack.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\StupitHack.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\StupitHack.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\StupitHack.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\StupitHack.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\StupitHack.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\StupitHack.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\StupitHack.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\StupitHack.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\StupitHack.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | N/A | N/A |
Modifies registry class
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd11143 | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\GCUJCNQFTQMECRU\ = "CRYPTED!" | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\GCUJCNQFTQMECRU\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MD79PFRQ4de5n55.exe,0" | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\GCUJCNQFTQMECRU\shell\open | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\GCUJCNQFTQMECRU\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MD79PFRQ4de5n55.exe" | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| Set value (str) | \REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd11143\ = "GCUJCNQFTQMECRU" | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\GCUJCNQFTQMECRU | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\GCUJCNQFTQMECRU\DefaultIcon | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\GCUJCNQFTQMECRU\shell\open\command | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
| Key created | \REGISTRY\MACHINE\SOFTWARE\Classes\GCUJCNQFTQMECRU\shell | C:\Users\Admin\AppData\Local\Temp\Pizdec.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\a26906c09acbcd300aa4a7f237249282_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a26906c09acbcd300aa4a7f237249282_JaffaCakes118.exe"
C:\Users\Admin\AppData\Local\Temp\Pizdec.exe
"C:\Users\Admin\AppData\Local\Temp\Pizdec.exe"
C:\Users\Admin\AppData\Local\Temp\StupitHack.exe
"C:\Users\Admin\AppData\Local\Temp\StupitHack.exe"
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\a26906c09acbcd300aa4a7f237249282_JaffaCakes118.exe" >> NUL
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
C:\Windows\SysWOW64\StupitHack.exe
"C:\Windows\system32\StupitHack.exe"
Network
Files
memory/2888-5-0x0000000001ED0000-0x0000000001EE4000-memory.dmp
\Users\Admin\AppData\Local\Temp\Pizdec.exe
| MD5 | 50c7c57e78e9d7b62abc477640ad52bc |
| SHA1 | b6940cb51c59037c8882c8655faff8b4abd36de6 |
| SHA256 | 8d416efbba749ad336169c94865b8f061f27ab14d3c7532ce65a1ee66a30da91 |
| SHA512 | db438be083930ce83d9af38db4aeaa328a6d8bde2d431485c47712b1f67cc0a6a414ee8c58ade03488c74e7968ee6b05d5f2fdaae86c745203c490e5d6452976 |
memory/2888-14-0x0000000001ED0000-0x0000000001EE4000-memory.dmp
memory/2776-15-0x0000000000400000-0x0000000000414000-memory.dmp
\Users\Admin\AppData\Local\Temp\StupitHack.exe
| MD5 | 4b46a0763cc3a4d5e8425c710ed89d4f |
| SHA1 | 3edd04e111cba5406ee286db3f7c970ef34d7c53 |
| SHA256 | 8dbc58dc724a2c25d2b4d46ee528bc3007f1260afedb71c4cef6f9325d60b627 |
| SHA512 | 1ebba09fa4eb8fbeaa976458c0eaa52f7f5622b522d9d17f815e6c27a5d458bd343fddf1807f7f17c7623ef87f6e439375b9477dd1050c25a2e9f1f33dabcbbb |
memory/2888-25-0x0000000002F30000-0x0000000002F85000-memory.dmp
memory/2104-31-0x0000000000400000-0x0000000000455000-memory.dmp
C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt
| MD5 | e1729097a23480f095671534ca826c69 |
| SHA1 | 2fa21ac0be0059c42344ea7ba1c2a82ca794e265 |
| SHA256 | fe7a9dce50a1cce7cbda97bb8a30e2065b54317ef3e753dc4901495d5a2b3124 |
| SHA512 | f17e4d46bfa962df72d3ae4dc96b8e02702ad30fa955fd3887bfbf4deefbcd45f0906a4ca30821efc3c95687765edd2565a509c52986912f5e5902e9b71dc146 |
memory/2408-88-0x0000000000400000-0x0000000000455000-memory.dmp
memory/2408-107-0x0000000000400000-0x0000000000455000-memory.dmp
memory/2104-71-0x0000000000400000-0x0000000000455000-memory.dmp
memory/2480-167-0x0000000000400000-0x0000000000455000-memory.dmp
memory/748-208-0x0000000000400000-0x0000000000455000-memory.dmp
memory/2776-204-0x0000000000400000-0x0000000000414000-memory.dmp
memory/1256-198-0x0000000000400000-0x0000000000455000-memory.dmp
memory/748-246-0x0000000000330000-0x0000000000385000-memory.dmp
memory/2552-261-0x0000000000400000-0x0000000000455000-memory.dmp
memory/748-242-0x0000000000400000-0x0000000000455000-memory.dmp
memory/2552-283-0x0000000000400000-0x0000000000455000-memory.dmp
memory/2408-299-0x00000000001B0000-0x0000000000205000-memory.dmp
memory/2932-302-0x0000000000400000-0x0000000000455000-memory.dmp
memory/1704-303-0x0000000000400000-0x0000000000455000-memory.dmp
memory/1256-308-0x0000000000400000-0x0000000000455000-memory.dmp
memory/1704-306-0x0000000000400000-0x0000000000455000-memory.dmp
memory/2100-346-0x0000000000400000-0x0000000000455000-memory.dmp
memory/1988-354-0x0000000000400000-0x0000000000455000-memory.dmp
memory/2784-361-0x0000000000400000-0x0000000000455000-memory.dmp
memory/1484-364-0x0000000000400000-0x0000000000455000-memory.dmp
memory/2956-393-0x0000000000400000-0x0000000000455000-memory.dmp
memory/2104-403-0x0000000000400000-0x0000000000455000-memory.dmp
memory/1700-402-0x0000000000400000-0x0000000000455000-memory.dmp
memory/1700-400-0x00000000000C0000-0x0000000000115000-memory.dmp
memory/1700-399-0x0000000000400000-0x0000000000455000-memory.dmp
memory/2104-416-0x0000000000400000-0x0000000000455000-memory.dmp
memory/2424-420-0x0000000000400000-0x0000000000455000-memory.dmp
memory/2352-426-0x0000000000400000-0x0000000000455000-memory.dmp
memory/2608-430-0x0000000000400000-0x0000000000455000-memory.dmp
memory/2400-442-0x0000000000400000-0x0000000000455000-memory.dmp
memory/2304-441-0x0000000000400000-0x0000000000455000-memory.dmp
memory/2400-445-0x0000000000400000-0x0000000000455000-memory.dmp
memory/2536-459-0x0000000000400000-0x0000000000455000-memory.dmp
memory/2264-468-0x0000000000400000-0x0000000000455000-memory.dmp
memory/2584-472-0x0000000000400000-0x0000000000455000-memory.dmp
memory/716-480-0x0000000000400000-0x0000000000455000-memory.dmp
memory/944-492-0x0000000000400000-0x0000000000455000-memory.dmp
memory/520-484-0x0000000000400000-0x0000000000455000-memory.dmp
memory/2416-510-0x0000000000400000-0x0000000000455000-memory.dmp
memory/2416-521-0x0000000000400000-0x0000000000455000-memory.dmp
memory/980-522-0x0000000000400000-0x0000000000455000-memory.dmp
memory/980-525-0x0000000000400000-0x0000000000455000-memory.dmp
memory/2628-543-0x0000000000400000-0x0000000000455000-memory.dmp
memory/1540-545-0x0000000000400000-0x0000000000455000-memory.dmp
memory/1540-548-0x0000000000400000-0x0000000000455000-memory.dmp
memory/1492-553-0x0000000000400000-0x0000000000455000-memory.dmp
memory/1860-555-0x0000000000400000-0x0000000000455000-memory.dmp
memory/296-558-0x0000000000400000-0x0000000000455000-memory.dmp
memory/1348-557-0x0000000000400000-0x0000000000455000-memory.dmp
memory/296-560-0x0000000000400000-0x0000000000455000-memory.dmp
memory/1736-563-0x0000000000400000-0x0000000000455000-memory.dmp
memory/1736-562-0x00000000003A0000-0x00000000003F5000-memory.dmp
memory/2036-565-0x0000000000400000-0x0000000000455000-memory.dmp
C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif
| MD5 | a11be41db4b3b8d31d269d6cb82e7e62 |
| SHA1 | a3d48811affcad19ec140eace2ef7e5cc5ea83c3 |
| SHA256 | a4006db8376722c698457875f3d3788aa8c1086776b4b1f8fe70ff8bdf9dacb7 |
| SHA512 | dc385e6c6a717f4aea1ba3aa14209132c9f0fcbbac444dec112b60f896029c9192df2e25a9f5d78ddbd7dc5224708fc27debbcb5bc9dd28d35de477cfcb702b0 |
memory/1596-589-0x0000000000400000-0x0000000000455000-memory.dmp
memory/1684-594-0x0000000000400000-0x0000000000455000-memory.dmp
memory/1684-595-0x0000000000400000-0x0000000000455000-memory.dmp
memory/1288-600-0x0000000000400000-0x0000000000455000-memory.dmp
memory/1796-601-0x0000000000400000-0x0000000000455000-memory.dmp
memory/1796-605-0x0000000000400000-0x0000000000455000-memory.dmp
memory/680-616-0x0000000000400000-0x0000000000455000-memory.dmp
memory/2292-618-0x0000000000400000-0x0000000000455000-memory.dmp
memory/2904-624-0x0000000000400000-0x0000000000455000-memory.dmp
memory/1996-631-0x0000000000130000-0x0000000000185000-memory.dmp
memory/1996-633-0x0000000000400000-0x0000000000455000-memory.dmp
memory/1984-646-0x0000000000400000-0x0000000000455000-memory.dmp
memory/2688-649-0x0000000000400000-0x0000000000455000-memory.dmp
memory/2500-654-0x0000000000400000-0x0000000000455000-memory.dmp
memory/2884-656-0x0000000000400000-0x0000000000455000-memory.dmp
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html
| MD5 | cd534d8435cf83f38e65a6366beedaaf |
| SHA1 | f9cc33e408fecc4749a79e91f708d2bed686e15a |
| SHA256 | ef5b89cedd7d0948681258fafec50cadb19a4265c8f21c4dbc747565a3eb20c3 |
| SHA512 | 154ac434b4135efa97dd9c9ed89502c3008fcff1af4a8dc296835be8241931cfc5625e5d9a30357c9cd5c3b7a394c6ba31ae667ef74d30969f7be68f62c9c07a |
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html
| MD5 | 2563138389fb9f9ef675ec058b17d8ae |
| SHA1 | 62cd9168b5a6597ae9764707300209229c9cf19f |
| SHA256 | 2c7e998e0a999c13d5ac075ce2ded421f02c618f4017745059a6de6d86836587 |
| SHA512 | d0bd552e574fa1d518d385d5628a979c0071a971e7f75c1ae8521c76da3fd9da73a0a01224ad8a6e20b0a957f8b9a670a5ca400694917e856510de43cdfb7967 |
memory/2680-703-0x0000000000400000-0x0000000000455000-memory.dmp
memory/1964-722-0x0000000000400000-0x0000000000455000-memory.dmp
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt
| MD5 | 2a1e4c11792e293453796e8848b5dea7 |
| SHA1 | afc67defc6712c9a8cf95a9175f72761903747aa |
| SHA256 | c520baa3dcec4ee1bd4d41fb4b5b2430078d4b1b4e06999d800009b422a61728 |
| SHA512 | fc41edefa3b8f31280afc05a8df462d245f0dab64b022e4668a3eba46a3d9bb860a1c645f5c3aa9f58bad22766adceb4534ae094d8ceb05af4bec197a85ee00c |
memory/2356-764-0x0000000000400000-0x0000000000455000-memory.dmp
memory/2080-788-0x0000000000400000-0x0000000000455000-memory.dmp
memory/2080-786-0x0000000000400000-0x0000000000455000-memory.dmp
memory/2960-784-0x0000000000400000-0x0000000000455000-memory.dmp
memory/2380-790-0x0000000000400000-0x0000000000455000-memory.dmp
memory/1316-882-0x0000000000400000-0x0000000000455000-memory.dmp
memory/1772-884-0x0000000000400000-0x0000000000455000-memory.dmp
memory/2624-890-0x0000000000400000-0x0000000000455000-memory.dmp
memory/1632-892-0x0000000000400000-0x0000000000455000-memory.dmp
memory/2600-894-0x0000000000400000-0x0000000000455000-memory.dmp
memory/1704-896-0x0000000000400000-0x0000000000455000-memory.dmp
memory/2912-926-0x0000000000400000-0x0000000000455000-memory.dmp
memory/1996-947-0x0000000000400000-0x0000000000455000-memory.dmp
memory/108-946-0x0000000000400000-0x0000000000455000-memory.dmp
memory/1996-951-0x0000000000400000-0x0000000000455000-memory.dmp
memory/2784-955-0x0000000000400000-0x0000000000455000-memory.dmp
memory/1984-957-0x0000000000400000-0x0000000000455000-memory.dmp
memory/1984-960-0x0000000000400000-0x0000000000455000-memory.dmp
memory/2656-964-0x0000000000400000-0x0000000000455000-memory.dmp
memory/2656-962-0x00000000002D0000-0x0000000000325000-memory.dmp
memory/2500-967-0x0000000000400000-0x0000000000455000-memory.dmp
memory/2500-965-0x0000000000130000-0x0000000000185000-memory.dmp
memory/2888-970-0x0000000000400000-0x0000000000455000-memory.dmp
C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME.txt
| MD5 | 7766c4e253a3bd0d1e3562c1ff1ac49f |
| SHA1 | 4db37cddac1427d54338a59da5d8481583d958cd |
| SHA256 | 5fab93c02a88a13909877bb2e69ca1da6f8b4c5a2aec6e00ba843226ba5ee611 |
| SHA512 | aadb7bc7cd70574d7d53f8b9857a2675145c20e256c3719ffa00b728423668a6a7de7eb811230dd740b0beae89f58e7e106d352d0bad08ddb5c26e072f3b63de |
C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt
| MD5 | abcd3daae6319a11a4680adf07557378 |
| SHA1 | 1ea6e0abea2e61f1a8bac0743d127aae7d55fc40 |
| SHA256 | 2fd6efb44cb8cdf27b4cb90f981f43a82bf0c376ce67070f9eebe0d5ffe522aa |
| SHA512 | 8059e80e2e14bee713b2dcac5b4d393665350fc70eb1bde73f709c405f0e1164fe37145603c62c72a64a635ce979226d2f4762d78c46b8b2021ae48bd6ebfb60 |
C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_ON.GIF
| MD5 | b2b88259dde790468160af3ba0e076ac |
| SHA1 | 8b0c1f3a02a462431d2842913b019f0e7b8f17b1 |
| SHA256 | bc83a6b5173cbc401d59c2630d897235ccb5a931159dbfa435a66968af02611a |
| SHA512 | 2e5f816b335c0feac9ad1523765ef96a4813286c19a7a7840fb9a6827d9ef1caaf892b5a24908391c85bd8c37e74fb9d2a917333db29681059dde96d704f163d |
C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_OFF.GIF
| MD5 | d23058f75a59756218fa3ffcdc79a642 |
| SHA1 | eeb183812aba1007198604bdda67522ef46c6086 |
| SHA256 | fcda199ec9ce2ac6bdbdaca053c2e6ae4a4d43ef1aa8c374542d358cc8cc2a0e |
| SHA512 | 2508bf977dfae73179b8669a10021b411d843b19cf021cf3d1363276609e328a204a019a605e816a5f283e8590221f973247355b8512ce3a2d63182b781b05c1 |
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\BG_ADOBE.GIF
| MD5 | 7a8671d119253bd3729b4171937fb7bb |
| SHA1 | d4575df417b71b5ea7321cc064fbe420ace24d5d |
| SHA256 | 4edaf3287a986e5fab0d87002c671f55534f27a00e5af993228f202bd6e80f7b |
| SHA512 | 6e86b184b76a544c09a62cbdc48b9ff358328da9688a1d4773ad1e07939c124a7808e0bb3e5021098be3fc42cbdec5d34406c33f30ad069c987a17255c62d6e4 |
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Casual.gif
| MD5 | 0e49e760c8c80eb6e7b1c80c6a70c150 |
| SHA1 | 455925af8e3f7802c60f80ff4e4ccf0f724d9501 |
| SHA256 | 6731d14617e437401f1b814db88c2fcf99849850b8837ff6a7495dfee8d0eacc |
| SHA512 | bd449ffbcb2be30c7be63b3e3808d7063b8f205e2209da640a2208373634be06e86a95c840382486c139ec2f510096f516937e7b3bf89731573e659a7e94d069 |
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Country.gif
| MD5 | 17ef6dcd8afe671b147a9ae8a3d321d8 |
| SHA1 | c58b0d6c0d9980e7dc20985a491b1133c28725ba |
| SHA256 | ac81e613a40ebfa09de718da36bade3d2cf49134a68d2678f0090a57f3891152 |
| SHA512 | 70da4e153b711c3224fd493eedd3672446e17013a7770567061cc9fead600a3787b450fb4f2cd56a1b9ff420a5bdc9cb2737aeaacc950bd83c15f6a10332bd10 |
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Premium.gif
| MD5 | c0602ea56e2991ac8eab0b27788bc0c7 |
| SHA1 | 0768d8047781a8a32213a16068b88702f7430ff1 |
| SHA256 | e4ad37ce4de454b5ac7d25fe764c22169cf9c7d2f07e162b6c16b41d7ba81083 |
| SHA512 | 5cfeb9d794d7dd0d1cad7b245cb7e264aad056dd91649c8135f74b87b79b47bfcd42e21e0250c5792cdcadeef9f06649eca5a3561c13ba57c7470df15fbbdac9 |
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_TexturedBlue.gif
| MD5 | 41029866852179a0915fda51a7bb2cc4 |
| SHA1 | f7c54518894f0554e9f3f6e3d32a4d5097d97153 |
| SHA256 | 92acd60a9083a20ec80079b2bae84f302218e9a0873a706e446788d0b8fc43ec |
| SHA512 | 6abf2daf5dbb64438da445d70c94527c6abb64f01cb3bb525bd71acb127026fb4e9056951b3d0232e8258902315880321ce919445824534a17aeeda6d9792394 |
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_SlateBlue.gif
| MD5 | ce86bb8df12dc5d4efdedad66e1af526 |
| SHA1 | 6f367cd059390a27e3addc13d7c5ebb004d363e0 |
| SHA256 | b9eb243191d3f200510e4a3bfa9276650d95f6c570457158f5a4a64ea6edb5d7 |
| SHA512 | fc04357b69188ecf6e8f2efc34210cfcdf1bb2598dbca671591ce2126f756012068686fbf3872f70973cb27d674c205e8ee8e349eed354645fc2176cceebf491 |
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_VelvetRose.gif
| MD5 | af0952ec66f5dfdc4987ebe6f5386cf3 |
| SHA1 | f2f0785908496f80e616fb9d01a36027e4c77731 |
| SHA256 | a560f028fe0b6230a697c1a447ed475c0f10f0f0636587d5b9cbbc94f70e107c |
| SHA512 | f8b56b00c08e8736222847b23dbeba586124e254d61d76315cfcac508f6216f719d050fee55e2654a79b95f9e52d0a23d3f63c414056c5cb843a292734cc2a34 |
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_OliveGreen.gif
| MD5 | 94ce7f4c4c1b4e1ec7517d1b69e5f149 |
| SHA1 | 3dacbfeb272560a06fd926999a68478eccec19a8 |
| SHA256 | 84c07f27d10283b78a11bb9c546a570ad0c35a385753fbd4ed35f8431d040ed5 |
| SHA512 | 30b868082421dcc910627f1bfa3bb600b54ba216dcc2d4e0cde55c1009d6c42e1cc4d281a90cfa0f5305b3e94c36587054c0f494b0835bb01a27c6d8b9da2114 |
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_LightSpirit.gif
| MD5 | 07a7e905ba677b491a0ec54b1edd405b |
| SHA1 | 0f52553191ff57cc7947fbf965d4eca414c5c346 |
| SHA256 | 84673ef6d85d96caac5821f7064044cf27bc9448ab9e25c609ad96d19662de59 |
| SHA512 | a492c027a0a8d2793eedc0368b0ec6c79d3d1ca8c7e338a813b6f9e14aed05bd90e85baf4ec605fd740562ef57413d22fe437dced13ce966cd79995feb5f3ba6 |
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Groove.gif
| MD5 | b884d3acb745e9be84d1dceae5353b39 |
| SHA1 | 0b9b6a0b77292927c26ebbc49921b5cc7794a5a9 |
| SHA256 | d11968ae8dbb5cb2c10e744c830cff282c86d7eef62fec04ba76ab0ab268fc78 |
| SHA512 | d7c0c67c8c021f0bba3df099caee9ec6d06747093ccb56d020c18f80bd55cd79bb1d1a1fd467bdcd6228b5868e02f8fe45b7b071c75effd7a9ce8e07dec48c1c |
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_GreenTea.gif
| MD5 | 26f1b5ff983fab1d1a335806cc951dce |
| SHA1 | 1fd2de7103a53a65ac52edb4edaf72a0eac7d6ce |
| SHA256 | 3cdd885bfb24793eba695e66843f76a85db5cfa9c181072d850aea1eec86c78a |
| SHA512 | 922d92d0ffc17781f62d482c07e919a3d23150740ab9abdfd2f779166aca2f467b2eab4db4e561903a6567ead1bc982a96d6a641789dfabcb9f85ae4897f9eb6 |
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Earthy.gif
| MD5 | c9c6c2ce0ea6dd4325c3aac0b524683f |
| SHA1 | 5fd60b6f8145045242d7e259029865dae7ac09fd |
| SHA256 | 2220c52ddd5ecf4e16a3f340cc5db6f9132efed96754598389961beeebe1da3b |
| SHA512 | cb91d1a36fb15f903d5f68b0b40e1eeb65108829da5ad7c45c257c0060b79f3fabf7537454b3107d88e1a07e1ed64b715b67fd0c967a50fa1fa54c9532ffd460 |
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BabyBlue\BUTTON.GIF
| MD5 | 4f4de302e1c46b7f6e27c36365541c29 |
| SHA1 | f060ac343e5c937ff81a31798bd24ce2ddd93e92 |
| SHA256 | 1b34346dd78c32b172cb26ac6faa8455dbd77d2ec5ffd1ce1e74985ce20c119e |
| SHA512 | 77e50b937db7de229a1f9313c89bd72eb51bee978d0a80b5903e5b8a1e0456a3098d9237f0d59943ced473687838312e08c8d23aa75829b66ed88885bdc1e463 |
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\TAB_OFF.GIF
| MD5 | 25519aa9d968d562a5ac488f47c12ebe |
| SHA1 | 6fc35ade3706b15a5fe4fd5e2c51455e53db27ab |
| SHA256 | 5fa62c99337f10ea93ef1fce00855933d6ea86e31e1041c3b1df4b168e9bd093 |
| SHA512 | 70b3e228ac764e5e60d77e2de43c609e56599807c32d34a97b4f26fa603f51e7b0d6f8e88d61805bb347ae185da96e7401b2cf6a9f99b005e118dea62d9847a1 |
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\TAB_ON.GIF
| MD5 | 3ea1ac58944a53a3ed411fb47f37919b |
| SHA1 | d015bbacfe0ba63625b7a7a61c22c87bcb8c16cd |
| SHA256 | 0e12d31310726be805e964f22a35d28429bf4d8214edb384448fc0b2640dfe71 |
| SHA512 | f23555b69deac770a5cd4f3ef715baf590f08ecded7e5beda9e222341b802a869cb19793066b3cd38bf4e82f17a1a94b3e9581952fe2d29d04a616c6c60b6936 |
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\tab_on.gif
| MD5 | 53cc8a9fece3c8e710e34ce951d86b39 |
| SHA1 | 1a8c1661ead6c650fa09aa9b571a75267c9fd67d |
| SHA256 | d88c5645ad31d2b195ba7349a52c91e9e4ffb385c7961f4375e98491ed65a312 |
| SHA512 | 1b3d51efe06ea819c173bfb5c82e9b15e7624886710f1dd88092269479a9f6b80b2d547f0e971f2165b9c094bc9e265a7834e8d49899fd65a108c9a29a970aef |
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\tab_off.gif
| MD5 | 194d14a9b766220904e3dc39160fc7c5 |
| SHA1 | 4740d693b8d264c2c3c79f004fda6506807a5e0d |
| SHA256 | f34307ae148e9922318bf48f05dd210ab73d6b2ef37bb3b224cd5fde6011db83 |
| SHA512 | c67ac9dbfb2d16dcc570f187b2625f2039826554b8664c0d3ceb6e4ead9af1541c36831c40d7067fb8b2de3cf7fdecf39a5ff33f9fc6301e6a03cbcd557037a5 |
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrow.jpg
| MD5 | c28e2e06fadc21d084cf9e02ea6106ea |
| SHA1 | d074f0131efb03e986dd9b6d808f95cbe4f282db |
| SHA256 | 9dda99f0ddc835a149e0f650fab920ed000ea1fe0ca74aabc316485d0c96dd48 |
| SHA512 | e62d45836896825f8ab397217c8f8cfe9a910656c0b745ddeb26a9d326f7ad0f061783991319b71bd65e9c610d544bb0836ada4587d9a6654ad6f5dbbdda6ab7 |
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\attention.gif
| MD5 | 69b65f6a1b62a294c47b36368085c4e0 |
| SHA1 | a6a78ce33746418e9ff925648d95aacb51c95f2b |
| SHA256 | 751ba658943f0becc35edbd9ef9e3b73153fec1fbfe47e4bcc7309da45b92597 |
| SHA512 | 977aca2d5e5b2cbf2da244496dd7489a422abff4d62da380092701261800768b2f2e9178f263b0183e5ac34e244f6990013ccfcc2f46fa51d5f46af377afe837 |
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrowMask.bmp
| MD5 | 61869bf1d1283b6214b3286b2401b81c |
| SHA1 | 13ef52e8c21bd9b6b66e188ae9a2ebf7177129af |
| SHA256 | 9d6d8626cb3b73ee47af734319bfe1673bbcb6740ce613bb55215cc241b8efb3 |
| SHA512 | 62fc6c42ccbbc1a8c0c8517d827cba4649bbf820732b968bac54161e6564a90ac32b17e6fc229ce8b7f117cd161d5e50c1cb8b57b649bc9210c33f0d4daf15d4 |
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_FormsHomePageBlank.gif
| MD5 | f80d5af96bacdafe682f1dd0ba8e8e70 |
| SHA1 | b7430ae03e5a3c913d253fdc498c43ec5994121a |
| SHA256 | 583e3f6d25c009598cb69ba43795020677407f120fed7cdbfd66a61a89df0579 |
| SHA512 | cda67196a30917d356d9c60804bd744647ea0deae9f1d569c482a856e159af93fae13154d45731653940f11cdfe1f503f69bfa8cc46ec47d74aade55b72fc237 |
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BabyBlue\HEADER.GIF
| MD5 | 8d9c3e3b23707c4e2f34dfeef3ff422b |
| SHA1 | 863f9d6cc772dd933b54568a1746fdd8d1ab053b |
| SHA256 | 751e5130778a52842a38b069dc1392ebc51797f7c063654e946c85d34aafb2c8 |
| SHA512 | 33733865262b2cc81af7a524335a292715bd3bd63d6fb16e8f4e3f1b2193f903fd68df82c959ee69d7c9bcda643b2f7ced0dc7a9785ddd4af67737f40808a810 |
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightOrange\background.gif
| MD5 | 7a4f81622f376879e17d8d40f0477317 |
| SHA1 | ab7f27f9215a93c7e1383758ad8f880df61639ac |
| SHA256 | 756f5ce66d384973e57a81536ca7545ab8e55534d149cf50a7227386a7a26a22 |
| SHA512 | b83021d76cc82462a3b503e9986ae3b689dc8ba5a5823931c91b32d10c19fb011a938c252764ce5661990781a23b735db8acdb176d0f0f0ddd879528c3e74c13 |
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightYellow\HEADER.GIF
| MD5 | f36097f5ebdba66e2b45fe77399e16af |
| SHA1 | 8521e70f3c46a6f05ede3009e49e4309c7c1f9fb |
| SHA256 | 4058712db85e537175f964c3ecf380c6812a58fd15b3905cc44f3fac37530592 |
| SHA512 | 304db05cc16a39d5008e7536ca8710a742e46c2656fcc2a5678dab1fc565fc3eaed8616b21d2fc2c18bd43cb1b8a74cb8a358550f25ec11202e78e1258b99031 |
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\GrayCheck\HEADER.GIF
| MD5 | 9b4ee4d3fc2fbc21c6f12edaa09c4853 |
| SHA1 | a4e4a29675cdc0acfc815522b7ab522ffe429a08 |
| SHA256 | aeede3e338060c21b808e207b8fba4f82158f63dba3857dd2234ad9a9789343c |
| SHA512 | 7d6e227dd671eb54981883dc96138aff073a7aaa6f17109c431baf1698523bd6ba95653dc6d6de119eade328d9c255b1c38ac4b1bf24c07875e8cfc556655ac8 |
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Oasis\HEADER.GIF
| MD5 | 71cafb8a49b6c63bc129b1e694e6cbd8 |
| SHA1 | ea0c02f5e61ff38bb8fc638fda7b39e622c71a5b |
| SHA256 | 89b937ae7713c3550c881674e5705168ff8d7e5e0657e225192ffa9fe7db676b |
| SHA512 | b2396d84f410e46b86774faa5dcd9bbbf57109091c938a1e52da1743e6e636faff177d4a6c37c114b9bbb56b9e5af54c1901480491293dc371eb5a7b3fc7cdce |
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\TAB_ON.GIF
| MD5 | bc303e4fecae95a9ab34c11e033a6722 |
| SHA1 | bcecda298ef0dc69bd54cd9611f13ed4ecbea2ca |
| SHA256 | 0867e0f7180e44124d90956d525a534350fe920b89ba547c88087c9c850aba73 |
| SHA512 | 6e8ec35fd225ce939bcf39920d4b21cccae3b08bc02faba19fa5fbd4e2f1bf80a381ac1e44bee4202832583e398dc8cf79043564d268094fcfe56f0ceafdf7a7 |
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\TAB_OFF.GIF
| MD5 | 795a80f13ece13587e262a42c12a39fd |
| SHA1 | dd5d52bea7530280cac5ac79ef71618ceb96442f |
| SHA256 | f36b682553338aecacd029f51bd3f4d6382e73ad3f59257de38f592964921f9b |
| SHA512 | 9e190c890340a9f18cec628902e197ec7d67a41a9199ed301ffb894098f86667351fec9f19848e38bac7e3f9f16f01fe4035571cc3669ee6ccfea49b5530f6ca |
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Desert\HEADER.GIF
| MD5 | 2f60f5edbbabfd16a3842fb28e3a64ce |
| SHA1 | bfdb564e08698066396751aefd39737e79268ab7 |
| SHA256 | 62aad9fa86a2f79c35e053225e649c583c0602daf6b0b7fa97f3b96a14930063 |
| SHA512 | 84283024904db594e18041ab893967d6630d0dc932e490927194fbdd86b8613e3b65972658d9133c9964ee729f1569ab9bd5fd39158011808f218a7e7565481f |
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\TAB_OFF.GIF
| MD5 | 745990a80878ff1f138075cd64b10f3d |
| SHA1 | 7486fd74b8f567ce4868f0dc915ea899d4974e21 |
| SHA256 | 7085b03d00e3da3feb05997ff6c525fe95f30997e90014d387e0e756f2e6c204 |
| SHA512 | cfe724b1ee2bd46d2b03941d0bf42f17a572c5714adb076fd2710e124700f8a4d8a690ba2791fc76fb064ec80864c38d0c5be418aef69ade940d860fb032c83c |
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\TAB_ON.GIF
| MD5 | 87c6db22324d0c4ce90b010a483175fb |
| SHA1 | a06f0fde7a7495317a5077dba2cea76fc682155c |
| SHA256 | cf00715d6252f8ae9eb687c4ac4ddecefecefedc5d2d34d2825fe3a9ec4e7512 |
| SHA512 | 4de675224cb4d68d6d315563bcc1781230f6033e2e628ed752f559a2acba59dd2259e20647ad924ad59d6241294f39cbf7611b276f8cfedf05a8020fa2ebfc10 |
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SoftBlue\background.gif
| MD5 | 312edd8b93fd0e0f6f2fa850b117cd22 |
| SHA1 | f22e2f33626171b444be8e37d147c3e2e8cc6b27 |
| SHA256 | b83a3b889c33b6b3a7b074787f4631d79dd66b6cb1602a91f22332ea9b94dea7 |
| SHA512 | 08e9718925f958189c0da4f8e4276816be7c54eb5b37bf348fdbdbd6cb979f031de050ff732af29c3c1c303f97800e51ec1b2e3573dd6c52f94d2d2f292d4cd9 |
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SpringGreen\BUTTON.GIF
| MD5 | 75ac43e25c716855ced4f43461642001 |
| SHA1 | 60749025819b337655958e84942ac08d7c46cd24 |
| SHA256 | a51d06c2265888c209d3bd7b044fc13bf10b25276886181bd580d8c3245c257b |
| SHA512 | 6bb0783b9259d4a1c1cb2ff3ff2fd495a513203263b1908bb812bfa2db00c9dab83b6a454ad72b739434bf504d001e9a3e95cce209dc42f83016de44caf93b0b |
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\background.gif
| MD5 | 805bb84cd63d7b6b4aa750a785d33103 |
| SHA1 | 6f18796cdd112af9e2941afa1c85a1d041c3a7f3 |
| SHA256 | 439bff6ad747184a7c8fdb334adb354b9cf14d6af45be1cd90d2d1dd1046c88a |
| SHA512 | 010bb38d24de29d3310f4e8faf2e0f7c913176d120d50b7815a8dc4644f56b714a032eb4e51f2c4f10ef5dcf8ea526f365aac0317087ac52b09e7ae2f58f4f46 |
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl\background.gif
| MD5 | ef50c256f5d455800219832600d90c43 |
| SHA1 | 16eb4b7505f0191a2ff485aa51fe686b9296261b |
| SHA256 | 478f401e0cf8ab901ea4eaefc9d3c8410f809941a291d75c166ae7535030cf64 |
| SHA512 | 4f369826a065f6f6e1b44d594f6e843d9f3e80aa6c58e7347f05fb01969ac6c72c77e354a357c19d8098295cf1dc250963b413cbead136934815f285ce47e7cb |
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormToolImages.jpg
| MD5 | 8161534387ee42a7c598f75ecc70d5d6 |
| SHA1 | eed53a1868b113df6f60d986aee727f2e4b5287e |
| SHA256 | 73e5d1f97e9b93319806d36933a45120b22d6c366f7003b15e0b644a79913b10 |
| SHA512 | 19155f310ab7c0ac5323f545fff3bdd8d8ea20b141d7609451ac3bd2bb71ef7ba4dd1c509ce5d744555ed12708ee35fea3735d7c4911a88c2ac58f9403f4eeab |
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_italic.gif
| MD5 | 787bc8b30ac5901008255e4d15efd9e3 |
| SHA1 | 22f3f14f106fa068ecafa5c1a917cd302a3ab6a5 |
| SHA256 | 052852609a2499792bcc330b2d046af459efe900b897b27552d4a913998ab03a |
| SHA512 | e6e0a93a439ede6029bd02e43d5abcaa7631c1cbd61a7ca79819e8d796d2fdf99665f33a93d05d2454c358ba964c5fd0e86a2ec61d3243ca70bc56ab16ea9f54 |
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\ViewHeaderPreview.jpg
| MD5 | 732dad53ca458ed713ca5600cbedcfbc |
| SHA1 | 6dc5a40f4ad5922b98d4450794b255ed291e48aa |
| SHA256 | 9457232a4c882164a5c1f060427b9358c045696c0b97ca1652928f43f81a4baf |
| SHA512 | 8e68bf7ee236898e4cfa910d39da02f711dcba234d69068d2aabc4a0c40e2aec2c5bd51da605ec49a6b0decf9f77fc7e451b416349bd0c758ac8213b9a2b25ff |
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_underline.gif
| MD5 | b96449fcb98ab08766802ec3aebb12dd |
| SHA1 | 552a31e76b8360d6ab256602316e810c305e02c6 |
| SHA256 | 048ba2304c7e22246d572b4f314ebe9aa978c8423e0b1cd500b41906d530379d |
| SHA512 | e6be87d2066121db42a2fd6edf820b7f2400e4b65e9a80a6de4fc15725eb82810c7d246587626cbe3b751b49590025aead5b496a66efdf2247a6f774b1c10e71 |
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\DELETE.GIF
| MD5 | 69a197f80cff39353fd738ba65c4ab62 |
| SHA1 | 9196a36a64c587775e15872837a2f584125d864e |
| SHA256 | d66fb9d703a7bb18984eb71d97cb1cdece9c43ed8651f2f382afdff9aed49649 |
| SHA512 | ba390536ece92dce0bd4e5bbef2149af76a76a93356e1892772cb80c6ed913b7449d7349bec2540b130f7ac5192a0fc7b8665841466c113bf8fe0ac5070dedb6 |
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\CALENDAR.GIF
| MD5 | 26d57d89b1be9e5df529bbb80f63c5e2 |
| SHA1 | 7ed7bbb66a35fce4f32b7ab4f1bf4f2f73989692 |
| SHA256 | 2aa655fb7a42797061722b7f6030e8e8fea420928d28c9fe52fc13e527f61b8f |
| SHA512 | 21c9aed0d570c6cf8e2093bf202d036004304ed52a4a842668b08ebcaceb55587ae6d3ec57f6ed4f1e1e8c4230fdcf4aaf1305258c057caa2bc398a1c06a8506 |
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\ADD.GIF
| MD5 | 53c840bd83edbdce28c42b05c62f12cc |
| SHA1 | a2bb38d762f2b599b49fb028d8a598f3ce1a7a12 |
| SHA256 | 4a8a7f8305489a4f4b46507db6be88a8dd3bf20823a2f03055d265efd8a68137 |
| SHA512 | c00c6763e9c845819bed57f26a6dc0f06a09a8b8fa5cf8c1a1f63e678789af750d9511ee37266799bbebfa3382f75945ac56f520f3fb8ce50ce0653ec976da8c |
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_choosefont.gif
| MD5 | 520b82be21c5fe8c1f4be62696b1a18d |
| SHA1 | eb32dc2b027df102199228c39ffada40044ad4a4 |
| SHA256 | fa26e4c72330b2810e92ad604ab4e814fed35fbc3e871557a5c2745ac0279a2c |
| SHA512 | 80127fa0bd085bdfb14278b7b77106b66142239c39ab1d4ed264eb002b008a0df768a3a5ce288385495f79e51b9493a416bb59a9e86fe2cd70c9b02c6b5611ec |
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\RTF_BOLD.GIF
| MD5 | b88bf7344d519733c9833bf19085d60b |
| SHA1 | b2dbe17611005a25f29fc60bf54459a7e791a921 |
| SHA256 | 1144420c99686aaf2f8c6cbf46b1f92fc2463feb8b66681b2ddc38a0c9a81cdf |
| SHA512 | 2a62f570dd2093c9557869c0d13e195d28df692caaed682154998610bcbf78711176f8b29eb74e29816c299685b137190a0964890e0a55a809148d71ee5f4ffb |
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\ERROR.GIF
| MD5 | dd522943741c50684921e5e827a11905 |
| SHA1 | af38c0839481089062d8d0a9cc11d71a56edb9f9 |
| SHA256 | 0dff63b67d310f861c0e0ccadf28058da8c638aafa8d1676e79ef30899d2f245 |
| SHA512 | 4c53c3c1e479449e418bf30789217a2a1b9915fe689ca4b130bcc4f86b1ac31de7536bfeac683e3f579ca1fb98981c6dfa542bbf820d90983fdc9a53e561ce3e |
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIcons.jpg
| MD5 | 1d78096fee9dd52322b7b0e0f10e1997 |
| SHA1 | b09ebcce2e57fafd34316ea0b43630a00d8f8549 |
| SHA256 | 5bb343dee826865dfbbcef1308b7ade9dd2e4340f5906e0def783281551d5c4c |
| SHA512 | b30beffb1dc67158247626cc5260dc66a2b4eb8c0a4157e92c994624716168d8f884c96cea80f94556a4598a86a3ae1711e43954a74876f30ae2038b7b757354 |
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIconsMask.bmp
| MD5 | 5752704fcd383444c0f44a02d3dcaee3 |
| SHA1 | 50a2f88e7897634ebb9ce97056f18fd4594451eb |
| SHA256 | 679248cba532d298d2944cf70ae05bea3f1205c7b9ffb22b42948876e3f63e8d |
| SHA512 | 19f0c0baeb08d0eb7ec7f60e8799f537f85da662ec6a27d28b05c8e8674e94522d0e7ec907f70a985dfe5a9d00f9994981a0fd541dff59337f7273f590afa498 |
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignleft.gif
| MD5 | 272a75349584311318fff11804ddeafb |
| SHA1 | 762df405b359b9c8aead475ad3273d345fc9bbb1 |
| SHA256 | 55e4d6c1137ed89a389b2ea8693675e8fd9c85d1d8d26659161d3263161f2d39 |
| SHA512 | 723ae251baf563bc3d72ce5d6756d295d676f6a885029b6383223b9f11755abe1ba79990a0676a6d75088bea0cf8c63f261758782d44089ba4d67044a3b96323 |
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignright.gif
| MD5 | b4025670c612edca7992c12f81da0c11 |
| SHA1 | a16874e8ca4f3c55b3e1f918195f6b095574fcbe |
| SHA256 | c97d67f06bc91743262813341f9b0b4c1b4a5e742ae4b41efeec2f16540bfe52 |
| SHA512 | 661640eb52ed71e0a54e33c509958ea053cc20bf99e5de44181395e130b980a3158dcb7925ea0ffa6263140d7119ff83c80a7585c745a7cdd4125c9ce7df29fb |
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_center.gif
| MD5 | f6fc5a9da91349f58bd8de74bd43e707 |
| SHA1 | 10c77557d9d14a08f83fb5e026a643f095fc4f06 |
| SHA256 | 7b4f05af3f4a487d806cb155f4747f0bcdbc32f3ec4d5cfaa72bd55cc6e411f3 |
| SHA512 | 62c9a801f684f9da19f7d60b4df7bd66b7ec2d7ddae5fc258f2285c9ae79ac8e128399f578d4ae64080b122b9b6dd31c203fc6d7f2d5ed688d192b50607be5d9 |
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_decreaseindent.gif
| MD5 | df2e005ec5e334510cb8a119d520dee1 |
| SHA1 | 5b0f11987388dfe9b973b4096e02e360df935919 |
| SHA256 | fa3ade4e796f37f2ab09fb576031d49afa4bed86937434034e579e175e9703da |
| SHA512 | ac23f622174cb454c2df9fbf0f0c5ffc3cd8d9d28199610584519e841321591dc37669ed23986e9f848315e4cc9bf5d3d93491211961813c9d038f7fc41ea16a |
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_bullets.gif
| MD5 | 0074ff695946a878603b8dd210d92e76 |
| SHA1 | 0a6ca893e604a47687fbaf874d54118ad13b9bb7 |
| SHA256 | 9c3bcfcf23945b3ed3a1958b2f5e5481495b4405b6b2aedbb02b42308f45d3db |
| SHA512 | b8c8269688e6ff98525dd65af69ba2542a8e0615214f65a97b04dd334295665f9a41c984de615de6040bc9dbe2ff7d969e10ac4d4f5443f28b9c8cd13aa80888 |
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_increaseindent.gif
| MD5 | b05d70234b2f5cd1c09c24673f05dc72 |
| SHA1 | ad3ca7a5153affcff048f7dcc32e63f55703e819 |
| SHA256 | 8dbe14897aaac7d50fe364efab85cfc221704c6f4ec5e4a7bd0e15a62fa14455 |
| SHA512 | 564014fb58395097366231cec33bd3f7b210aa973764f86064d21197a9136ce97969cb3c2ab0f9e0598dc2fb968d5477ea377aa6ac422371eb2b3e7022c6fcff |
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_justify.gif
| MD5 | 402e892493c6ed3da7890cde1066d936 |
| SHA1 | f7d08331c0bf72227d1b5e610a4962ea9675e85e |
| SHA256 | 6201661c0e71fd1441b447cf2073525201a526fdf49c8c3764b0fae02adf0bad |
| SHA512 | 14e7b00d5bf1eaa36f92d236f7df2cf4d6a309adaa52750e915f7f60bc92b756f61cf2fd98e1ea79188ef6d4838baf8615cf1c3bba4acab4c7141b43c6af7e68 |
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\LAUNCH.GIF
| MD5 | 1ba37b6357520611b36bce48861c3768 |
| SHA1 | da9e1795ec161394a83913f4ca5ed299726f86c4 |
| SHA256 | a3b93e394b8f123b0354e862e8ea98462b7d5aba96d3c91a3b6e763ee18f4b0b |
| SHA512 | b08735e0f66c3be1a3fcd4300f8aaf6507f654f82b22c1b496bab3591e55a2f5670d9a75232cac8491bc39505c2566f5cb9d0364a40c14eebaca77e06171d4fc |
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_pressed.gif
| MD5 | 013a90061707e36407a2825d4e03a38c |
| SHA1 | c334ce3fab7b10934ed50d2deaa8809b5f91bb2b |
| SHA256 | a355487b4e52bb472aea343d34a6dfcd50e955975e4b26cf96c06b0beccd9a58 |
| SHA512 | a318e7acb1a64a68e77004ad7cc849a8c3ba54d9ed431cf4f451cf1c358e5b4455cf3267e7d613b4129907edc2df99c626da1c32c1ab703267d4b39e66a3cd70 |
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Windows Explorer.lnk
| MD5 | 624fd9e04323e866fc5bae3fb9f0b026 |
| SHA1 | 1e30f44a1a0c642e95306547280607a9245dc785 |
| SHA256 | 74b199e9ae9fdbe2e3eb16dd2ef6eb41c44c239c4e5cb84d00b44569200b6951 |
| SHA512 | 01801900b6a843d1d14b949cea9a4fef80e6c96dbb78cff9e613eba286f7dfc62b31c6fb4d9e6eb06d707ef94712899ac0a61d9bef0c5368c0ef8a4586d103a0 |
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\security_watermark.jpg
| MD5 | de340a3af6129a5da8f93e82bc1e5ad1 |
| SHA1 | 501e52987515a5bf14fb2020ab1a2c16c8a3acbd |
| SHA256 | a70d6f72e7a2f997f6cb72015f483a711a3ad5298c7b73bc479833201b4bb49e |
| SHA512 | 8c85667186963b0cf3ac53a1ed3018498124b24ed4a495099b0ddc8c7b6e0537b001d897085cfd21992e7b97dfb3820599088d03c3bec57a5d10e79fe215afcd |
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\alert_lrg.gif
| MD5 | 753a35716b58a88f72cce92246765f74 |
| SHA1 | b8e4e087c5995b8ca9ceab9c3dd7f7dac6ccfcee |
| SHA256 | 91dc47ce82cfa9e0301026d0eed6650df5c9f75074d02cd4f9103ee23f24ea26 |
| SHA512 | 9a806d453b14f044d2108f08ef029416bf9f613d46a1caa89c6d2ad49eaf5f3fd7ceb8b27afc97e483adaa875ee1bf25a66912862275b2cf0a6db142678c11cc |
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\aspx_file.gif
| MD5 | 3e8789107b6e614c4a1baab089405197 |
| SHA1 | 42bab6d328cf628f7a3f07abd3fb4971bdff36fc |
| SHA256 | bee099242bc4b3e799888d3671013b15404ee64761c11b3579c6c743a05c7a2f |
| SHA512 | 30c482cccba5e63a3881eb1804a5557fe9ae0c3ee2d8afdadd3d09dd0361cfb36fa017084b2dd3180135d6f5e9046ec75211881b5564ea622c75c476f29a76a7 |
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg
| MD5 | 29d62be6286124ae2e1bac1865ee9210 |
| SHA1 | 098daaa26f328327d9dff8fd1f96de1d797868f6 |
| SHA256 | 6f05eb80e2d07c57d31f7f8672b85a02111f6a4bdfe8357c8d571504bde47715 |
| SHA512 | ad2f5182f42262204b58e8232bacbb9cd910cb1dfcfe3a8fa4949a8f9e1b12c9e387f2837a1761f85d4db27e5abdf0a253a522edcea4d9ad62769076bbe5ce5c |
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\branding_Full2.gif
| MD5 | 0ef71da7951b4a0c13c799fb934bc428 |
| SHA1 | a961a87c3cde6dac32b1b2fbee5eaa4243b7d902 |
| SHA256 | c54931b274870c7ab1c2ceda029723334cc74dda31356d9aff8fe242f58bf296 |
| SHA512 | 525d45e7fe6b7a3ba1062edfa41fa6a13e7250d9086fd6a8accf351853e63632ed71c8fddbe18181880fdeebe684b9df77582ce54ec4cad373822ffec0448cb2 |
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\deselectedTab_1x1.gif
| MD5 | 44647f7c081a86281959b1c4c91bb856 |
| SHA1 | ffca7d79ec78f43fca587b57dba711083c6ad161 |
| SHA256 | cbd20d8ca2365ca9ea0138144c68eda3f7e89d9c9351dfd79e2283da6ce69941 |
| SHA512 | 60607fb93b53b782a1198020d05dd419037ef15de2bca1604f855ebfd4cd7dfa4550fba99f8e4c755cd79deaee395eef1999c5cf4ab2a9ac76935566af84d03a |
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg
| MD5 | 13ff81d5bdf2b384f875d27a11e2a8e9 |
| SHA1 | f5d2c43853221c5266d25e1d64fb1fe94678bc9e |
| SHA256 | 0aecdffafc8fa132c6214717f590129a06d0ba03710aa9f493975a9ed23bcece |
| SHA512 | 9e849f80fafe7e880eb3fa061b16468f248afaea41fd16cecbf600f5090e9b85382afabd5918d49dbb7e615863a7ac7fb3362e813e2ab346059049c4c46e309b |
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\help.jpg
| MD5 | 545a065171f9be5253d58d51b587bdbe |
| SHA1 | 33a8fe2f35ac143a63b9282aea872bc9d6c85748 |
| SHA256 | 5b1b6ea40a5281423373436acc53e3b8df175edf1c81b93e55abd934fc7eff3b |
| SHA512 | 07309cf317d5f77bc4d788ce5921b4665691819f51e827a28ed013ceaf6bc82027f3206f27cee9e1773982a807768d9a836a632be5f905e4481aa260b82dcdf3 |
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\headerGRADIENT_Tall.gif
| MD5 | b850130ae4630c5bf156219bc1ee6148 |
| SHA1 | ec6dac370e778b1e4f5383f4663e6e9b3d91e5c2 |
| SHA256 | 4ad35c5a730861d715b5dd886a714c0ce33656a59ee04ea15fe13c39804fec30 |
| SHA512 | 97b7ac139f481dfbd082561939183c60ef69ecd22442227fda253465f27943336c4a3d2c6daed270d469a313f108f141d56d5a9f8223dea79ae7ce92c0e77a27 |
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\gradient_onWhite.gif
| MD5 | dc274a295d0762bd50961c0dab7d3aa2 |
| SHA1 | 83a558c45a68a3cd7f8cc6b8f98a9cbce1523bdb |
| SHA256 | 9e27f2361b978796d31b507a9f76742cc1235657c580f449c3f333ce9ba644de |
| SHA512 | a8784cc65e660da3ed68f9bd4422aebea5683bbe22e811aa315f202920cbbf9759a313cee7cdeaf70b19c7d80f2570cd85f85045bc49b7df692d66df3287a71a |
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\gradient_onBlue.gif
| MD5 | a1b6eb2d14b70b137257b88f02a57417 |
| SHA1 | 84bdacf035836fb2999057af2ed1fc8a6faad5ec |
| SHA256 | 2c723bc8457768d7e2cd8035a4d8ee57c85b495ff30d799682e86ab41a4c1d56 |
| SHA512 | 58734f8b14f4fa1401a479ff0b738dbe4115b80a657f819e21ff4ddad5a26d7f48f547a86349b9915ab5de98f7596eacdd5da81d9da4253e8178ae915969602d |
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\image1.gif
| MD5 | 87b2074af5b620f165853015075b5ef7 |
| SHA1 | af97d9add98600ad2c6f608a7004c903fa9edd2e |
| SHA256 | 81a8504ed8398ead9bd8bcf1e90958077c128c83a228158dbed9bbdc52ebde27 |
| SHA512 | e7a820210f4e6fa3bf59e0b99019c283e84436d2eec426e7fda334b62032c2aab8dcca2ad278c52a8022b1ab922139635dbe976591a06f9738ba8fbc2f1e8c2c |
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\requiredBang.gif
| MD5 | b3733f1d4b5fad7410f33a4f0e274c76 |
| SHA1 | a6b745056c5fe101a532ae78220abc92438f681a |
| SHA256 | ae496cf92e9dac7d69207ea9ff71243b09ed4b511a3f4c42aae67f0726dd292b |
| SHA512 | ed0a156a592c1659cdc41ec1c436d80382c90510e3c4aa845719682c9d68ff1d368f8f2b9349d5808966b243f2dc10e7514f671b5baecca507b3776c3d8abcf0 |
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\selectedTab_rightCorner.gif
| MD5 | d5e045fb5dd0729b4483a2cc68e119cc |
| SHA1 | 573c38e4f8d5460b8f4aafbdf13a395fe6dd0cfd |
| SHA256 | 488e1956771a51fcb2278cf02919d590e5f7112e6e3380a64a410735ccdf615c |
| SHA512 | a30491382dc4e64204c3b04d11aef3fc3ae3f62efbec452fe607f88ea86991ac94180a4e107cc670bf205b860cba3d0399a77efd090f3f1827256c2eccc768fe |
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\selectedTab_leftCorner.gif
| MD5 | 291c51d898fdddd815a5ca2ee60a4aab |
| SHA1 | 48031b58a79467f338c63b1f126772168d72977e |
| SHA256 | 1cd77037e7f327dd8de99e699969b4536ff9a3060f921ab6230a15c61067738c |
| SHA512 | e21248fbe0835ceaffb3398d0a1adf42164f76a36fc115113f3b30c7b21c880dc297f74f83fe3cc693205e347160b2c7e4cc45b6970197bd24dd9b49d7a2389b |
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\image2.gif
| MD5 | 01884af8c2074eb4664e93c42be0c93d |
| SHA1 | 5ee8415799454557a6334e07f1c5a76469ca5a99 |
| SHA256 | 3a92bf9369feec1173c414db31f16983d4279edad50b529026694d37ebbe2ee9 |
| SHA512 | 3d060a6bdc534eca9abdff616a4086a51f9a0dafadb6cd570ac8b4812595e248b692cda6a7126439f20d215e82a00b84e435e11d65aaa3163183adf41a850197 |
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\HelpIcon_solid.gif
| MD5 | 264b6101e6f7f1c4be9de6ee8fa60c29 |
| SHA1 | 6b61291c0b7ed4692d89501f3868b3a09502f142 |
| SHA256 | f361bb54f9756c1c1c5d4b1627d43ea0dbaf3c42948b3339fe702def8bfd5c18 |
| SHA512 | f99ab35df95ed62c0314ade5ff13135693ad029df7b4562eeb4397d85e4709374a1578d5cf40b5991d0edaaa258ae1ff53c18f8339d1a20eefaca94b24990aa7 |
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\folder.gif
| MD5 | e0d8dfb419d49653d70ceaf50c50751c |
| SHA1 | f033a255e36814434c34443d3aa69821205580b2 |
| SHA256 | 953644536739be09f529b5fb7a0b31fbf0a95f22b4eeeb2ac3f2dc9a76ef06a5 |
| SHA512 | 0cb316e7250de0ccc97c17777b7d6db237d128284eb438db98176ab50b480796f30fcae5e5693b3b6a816d3d5413a722c6b10b4531d19983d06093f1058b6f27 |
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg
| MD5 | 0e3a040b42240f678288d066d8a97800 |
| SHA1 | 10bc1c2ad0e1407c4736934c7da8358def8a8481 |
| SHA256 | bb39e17575a83a07e2a00f067cef1c43ddc689f803575270cd635e80b554955f |
| SHA512 | f01d225ef120a1e0aac4d78484a73afaf480ea6b7f5c9f9b635a835cc300a3136d73954cb1f9373637d4f72ea26e79ea70bdc671807c8103651c1c419369d13b |
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\unSelectedTab_rightCorner.gif
| MD5 | 7e54074aaa15b5f63d9b88c5153348da |
| SHA1 | ca3c0941f033a2c35a3b3fdd82b6b907d23789c0 |
| SHA256 | e8748137a9fb21ac7633860740f4d4c9c46d752c7b5732c3e13e5d869baf8b87 |
| SHA512 | 31bc22cbeb5b09b02365fd42d46981d0fd0593d00c2516151ce554c109c507c88c91785364a17851ec79cfd0fd3d13890f9e2d79e7cd8bdbdd78af4f5ac2ae00 |
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\unSelectedTab_leftCorner.gif
| MD5 | cb23dc69ffce4f012a71083c4fbb6e9a |
| SHA1 | 5eac6b7f5facf0a085501aa642e550865abe74b6 |
| SHA256 | fa7066f7c2843d80180ec71a9a2ce782078f60614306802c43058d33ea83505d |
| SHA512 | df6b2bb57c3c6d74951b9a7fce8eb147af24cb721feed0d28eec7423991b458ac26d4ee9cb344eda3d753c4132b6f417a8dfe09dff2adc8c6ae14b0b92dbc848 |
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\yellowCORNER.gif
| MD5 | 46ab9ca5a11646c5b589970212af2477 |
| SHA1 | 5d5a1d557d4b65303b61aee709533054e12c9ab3 |
| SHA256 | e9d7807a679bb51ba8d681a106c2aad6f7d0be035c5fc44b4b272aded5a3fe46 |
| SHA512 | 2bca78c286d8be8543fe70cecd3b87fc35c23bf294f5313f052e7412e9c91c398b82f34f16fd4b4df39ddb54fa73ee651646786e6d7149cbf425bf0e08d33b4a |