Malware Analysis Report

2025-01-18 20:32

Sample ID 241126-rp3c2s1mbn
Target a26906c09acbcd300aa4a7f237249282_JaffaCakes118
SHA256 20165d77c3851851b5df4fa23850bf02ebf990fbb80d387d0007b4ba52ac64a3
Tags
xorist defense_evasion discovery persistence ransomware spyware stealer upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

20165d77c3851851b5df4fa23850bf02ebf990fbb80d387d0007b4ba52ac64a3

Threat Level: Known bad

The file a26906c09acbcd300aa4a7f237249282_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

xorist defense_evasion discovery persistence ransomware spyware stealer upx

Xorist Ransomware

Detected Xorist Ransomware

Xorist family

Renames multiple (2190) files with added filename extension

Renames multiple (2170) files with added filename extension

Drops file in Drivers directory

Deletes itself

Checks computer location settings

Drops startup file

Reads user/profile data of web browsers

Loads dropped DLL

Executes dropped EXE

Indicator Removal: File Deletion

Adds Run key to start application

Sets desktop wallpaper using registry

UPX packed file

Drops file in System32 directory

Drops file in Windows directory

Drops file in Program Files directory

Unsigned PE

System Location Discovery: System Language Discovery

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Modifies registry class

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-26 14:22

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-26 14:22

Reported

2024-11-26 14:25

Platform

win10v2004-20241007-en

Max time kernel

150s

Max time network

140s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a26906c09acbcd300aa4a7f237249282_JaffaCakes118.exe"

Signatures

Detected Xorist Ransomware

Description Indicator Process Target
N/A N/A N/A N/A

Xorist Ransomware

ransomware xorist

Xorist family

xorist

Renames multiple (2190) files with added filename extension

ransomware

Drops file in Drivers directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\drivers\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\SysWOW64\drivers\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\SysWOW64\drivers\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\SysWOW64\drivers\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File opened for modification C:\Windows\SysWOW64\drivers\gmreadme.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\SysWOW64\drivers\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\SysWOW64\drivers\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\SysWOW64\drivers\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\SysWOW64\drivers\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\a26906c09acbcd300aa4a7f237249282_JaffaCakes118.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MD79PFRQ4de5n55.exe" C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A

Indicator Removal: File Deletion

defense_evasion

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\StupitHack.exe N/A N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmrock.inf_amd64_9b13bcc1f320d1ad\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\pnpxinternetgatewaydevices.inf_amd64_82b90e51473d48ea\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File opened for modification C:\Windows\SysWOW64\StupitHack.exe N/A N/A
File created C:\Windows\SysWOW64\StupitHack.exe N/A N/A
File opened for modification C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe N/A
File opened for modification C:\Windows\SysWOW64\StupitHack.exe N/A N/A
File created C:\Windows\SysWOW64\StupitHack.exe N/A N/A
File opened for modification C:\Windows\SysWOW64\StupitHack.exe N/A N/A
File created C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_amd64_9c09bd1df352f065\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\SysWOW64\StupitHack.exe N/A N/A
File created C:\Windows\SysWOW64\StupitHack.exe N/A N/A
File opened for modification C:\Windows\SysWOW64\StupitHack.exe N/A N/A
File created C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe N/A
File opened for modification C:\Windows\SysWOW64\StupitHack.exe N/A N/A
File opened for modification C:\Windows\SysWOW64\StupitHack.exe N/A N/A
File created C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe N/A
File opened for modification C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe N/A
File opened for modification C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe N/A
File created C:\Windows\SysWOW64\StupitHack.exe N/A N/A
File opened for modification C:\Windows\SysWOW64\StupitHack.exe N/A N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_PackageResource\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File opened for modification C:\Windows\SysWOW64\StupitHack.exe N/A N/A
File created C:\Windows\SysWOW64\StupitHack.exe N/A N/A
File created C:\Windows\SysWOW64\StupitHack.exe N/A N/A
File created C:\Windows\SysWOW64\StupitHack.exe N/A N/A
File opened for modification C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe N/A
File opened for modification C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\e2xw10x64.inf_amd64_04c2ae40613a06ff\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\SysWOW64\StupitHack.exe N/A N/A
File created C:\Windows\SysWOW64\StupitHack.exe N/A N/A
File created C:\Windows\SysWOW64\StupitHack.exe N/A N/A
File opened for modification C:\Windows\SysWOW64\StupitHack.exe N/A N/A
File created C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe N/A
File opened for modification C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe N/A
File opened for modification C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe N/A
File created C:\Windows\SysWOW64\StupitHack.exe N/A N/A
File opened for modification C:\Windows\SysWOW64\StupitHack.exe N/A N/A
File opened for modification C:\Windows\SysWOW64\StupitHack.exe N/A N/A
File created C:\Windows\SysWOW64\StupitHack.exe N/A N/A
File opened for modification C:\Windows\SysWOW64\StupitHack.exe N/A N/A
File opened for modification C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe N/A
File created C:\Windows\SysWOW64\MUI\0C0A\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WaitForSome\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File opened for modification C:\Windows\SysWOW64\StupitHack.exe N/A N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\MsDtc\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe N/A
File opened for modification C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe N/A
File created C:\Windows\SysWOW64\StupitHack.exe N/A N/A
File opened for modification C:\Windows\SysWOW64\StupitHack.exe N/A N/A
File opened for modification C:\Windows\SysWOW64\StupitHack.exe N/A N/A
File opened for modification C:\Windows\SysWOW64\StupitHack.exe N/A N/A
File opened for modification C:\Windows\SysWOW64\StupitHack.exe N/A N/A
File created C:\Windows\SysWOW64\StupitHack.exe N/A N/A
File created C:\Windows\SysWOW64\StupitHack.exe N/A N/A
File created C:\Windows\SysWOW64\StupitHack.exe N/A N/A
File opened for modification C:\Windows\SysWOW64\StupitHack.exe N/A N/A
File opened for modification C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe N/A
File opened for modification C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe N/A
File opened for modification C:\Windows\SysWOW64\StupitHack.exe N/A N/A
File opened for modification C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe N/A
File created C:\Windows\SysWOW64\Com\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe N/A
File opened for modification C:\Windows\SysWOW64\StupitHack.exe N/A N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pcfhhknppceehkpc.bmp" C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\Assets\GameBar_AppList.targetsize-48_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\Assets\ValueProp_Shadow.png C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\ja-jp\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-black_scale-180.png C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\MedTile.scale-400_contrast-black.png C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\ThirdPartyNotices\ThirdPartyNotices.html C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-white_scale-140.png C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\en-GB\View3d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\en-ae\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\StoreWideTile.scale-200.png C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-64.png C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RIPPLE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Dial\RotateVerticallyOverlay.png C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteSectionGroupMedTile.scale-100.png C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\GamesXboxHubSplashScreen.scale-100.png C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\BadgeLogo.scale-100_contrast-white.png C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\ImmersiveControl_Button_Click_Sound.wav C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\cs-cz\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-white_targetsize-96_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailAppList.targetsize-36_altform-lightunplated.png C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-72_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\sv-se\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSectionGroupLargeTile.scale-100.png C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\review_email.gif C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.ZuneVideo_2019.19071.19011.0_neutral_~_8wekyb3d8bbwe\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons.png C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Collections\contrast-white\MedTile.scale-125_contrast-white.png C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\GenericMailLargeTile.scale-150.png C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-72.png C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ro-ro\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\vi.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-white_scale-180.png C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ko-kr\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\themes\dark\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteAppList.scale-200.png C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailAppList.targetsize-40.png C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\de-de\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-black_targetsize-32.png C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\themes\dark\adobe_sign_tag_retina.png C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\text_2x.png C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\en-il\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_2019.19071.12548.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\PhotosSmallTile.contrast-black_scale-125.png C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedStoreLogo.scale-100.png C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-60_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\AppxMetadata\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-white_targetsize-256.png C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_GB\README_en_GB.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Program Files (x86)\Common Files\System\Ole DB\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\Weather_TileMediumSquare.scale-100.png C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Win10\Classic\Klondike.Large.png C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-64_contrast-black.png C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\node_modules\reactxp-experimental-navigation\NavigationExperimental\assets\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\LargeTile.scale-150_contrast-black.png C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\StoreAppList.scale-200.png C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\es\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\fi-fi\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\1033\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\Square71x71\PaintSmallTile.scale-150.png C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\ScreenSketchSquare310x310Logo.scale-100_contrast-white.png C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\WinSxS\amd64_microsoft-windows-i..hancementmanagement_31bf3856ad364e35_10.0.19041.264_none_262bc7b233c1d05e\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-directui.resources_31bf3856ad364e35_10.0.19041.1_da-dk_7e0110fe948bf9e4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-vmwp.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_d9215e46435b05ba\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_10.0.19041.1_none_15114cf4ffe3136a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-w..s-service.resources_31bf3856ad364e35_10.0.19041.1_de-de_186d4d64f2d75743\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-debug.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_8db8f5dd3a6a6b3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-c..rlauncher.resources_31bf3856ad364e35_10.0.19041.1_de-de_50d963028d3c601f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-defrag-adminui_31bf3856ad364e35_10.0.19041.746_none_770f598aef14382e\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-n..orkstatus.resources_31bf3856ad364e35_10.0.19041.1_en-us_371f6e25bf6cea98\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-shenzhouttsvoicecommon_31bf3856ad364e35_10.0.19041.1052_none_f102642afd21e47a\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-mediafoundation-mfsvr_31bf3856ad364e35_10.0.19041.153_none_a6fd395b4e3ef24e\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-n..ider-infrastructure_31bf3856ad364e35_10.0.19041.546_none_946b321b2260f332\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.Resources\v4.0_1.0.0.0_fr_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\WinSxS\wow64_windows-application..-appcontracts-winrt_31bf3856ad364e35_10.0.19041.1081_none_0a512a946737140b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\WinSxS\amd64_vdrvroot.inf.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_35ecf141accffabc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\WinSxS\amd64_windows-defender-service.resources_31bf3856ad364e35_10.0.19041.964_en-us_4d9efc8c65da4384\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\WinSxS\amd64_windows-media-speech-winrt.resources_31bf3856ad364e35_10.0.19041.789_da-dk_9bc6f58302dbd449\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_cd2d1cde69f392b4\acr_error.htm C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ndation-mftranscode_31bf3856ad364e35_10.0.19041.1_none_75295a6a3248871f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ates-english-update_31bf3856ad364e35_10.0.19041.1_none_7589dc4fe9ce57c8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-x..jectdialog.appxmain_31bf3856ad364e35_10.0.19041.423_none_d93ee361fbbc8f0a\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\WinSxS\msil_microsoft.iis.power...provider.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_e932e117878b426a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\assembly\GAC_MSIL\UIAutomationTypes.Resources\3.0.0.0_es_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_2d3b6ea159ff4dae\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-ui-shellcommon-core_31bf3856ad364e35_10.0.19041.1_none_91b1f58702057373\CellularToast.scale-400_contrast-white.png C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-notepad.resources_31bf3856ad364e35_10.0.19041.1_es-es_d3a242796e7e97b0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-s..diosettingshandlers_31bf3856ad364e35_10.0.19041.746_none_bacaf9eec0055626\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\WinSxS\msil_microsoft.virtualiz..nt.common.resources_31bf3856ad364e35_10.0.19041.1_es-es_4211d899b571f102\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-cleanmgr.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_b64a50542afd543e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-m..nt-browser.appxmain_31bf3856ad364e35_10.0.19041.844_none_d9eb415c5b9dbe4e\Square71x71Logo.contrast-white_scale-200.png C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-p..rtmonitor-tcpmondll_31bf3856ad364e35_10.0.19041.264_none_b08e3e3d06047dc4\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-p..tcpmondll.resources_31bf3856ad364e35_10.0.19041.1_en-us_d5031d9f297f85c2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..ast-black.searchapp_31bf3856ad364e35_10.0.19041.1_none_e479c512c8bfeb66\AppListIcon.targetsize-16_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\SystemApps\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\pris\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\WinSxS\x86_netfx-mscorrc_res_dll_b03f5f7f11d50a3a_10.0.19041.1_none_b10fc8572d498e50\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\WinSxS\x86_microsoft-windows-p..reensaver.resources_31bf3856ad364e35_10.0.19041.1_de-de_c1b8af4ac86844bc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-onecore-u..lter-mgmt.resources_31bf3856ad364e35_10.0.19041.1_en-us_cfde1148aafaf969\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-fodhelper-ux.resources_31bf3856ad364e35_10.0.19041.1_it-it_eca97e9509560b36\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-i..gbinaries.resources_31bf3856ad364e35_10.0.19041.1_es-es_e94a5dd9dfbc24b5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\WinSxS\amd64_net819xp.inf.resources_31bf3856ad364e35_10.0.19041.1_it-it_5cfe2c89ee08709a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\WinSxS\amd64_dual_wvmic_guestinterface.inf_31bf3856ad364e35_10.0.19041.1_none_a3750aa62b1952d1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-powershell-exe_31bf3856ad364e35_10.0.19041.1_none_1f070c37a19029ff\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft.hyperv.schema_31bf3856ad364e35_10.0.19041.488_none_a82f565621f4835e\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-onecore-c..dexperiencehost-api_31bf3856ad364e35_10.0.19041.264_none_9d11423d6f8d473e\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-browserservice-netapi_31bf3856ad364e35_10.0.19041.1_none_e37e715d37185736\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-iis-metabase.resources_31bf3856ad364e35_10.0.19041.1_it-it_cb4893e894e031fb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-s..omponents.resources_31bf3856ad364e35_10.0.19041.1151_en-us_0e8ac7c8d3abe00f\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-userdataaccess-cemapi_31bf3856ad364e35_10.0.19041.1_none_38bbcecd3c71af70\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\WinSxS\msil_system.web.entity.resources_b77a5c561934e089_10.0.19041.1_de-de_5035e9482686c669\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-i..rvice_mof.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_1447a2258289b923\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-s..ative-serverbox-isv_31bf3856ad364e35_10.0.19041.1_none_b55c875ed22d28bb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.S0f8e494c#\6d056f3fff70a663755a1120dd61d6e3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\WinSxS\msil_microsoft.windowsau...commands.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_770b14145c527c1e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-psmcoreserver_31bf3856ad364e35_10.0.19041.662_none_88b10bbde167d52a\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-wimgapi.resources_31bf3856ad364e35_10.0.19041.1_en-us_cf48a18a5fdfb544\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\WinSxS\amd64_system.componentmodel.typeconverter_b03f5f7f11d50a3a_4.0.15805.0_none_ca5cbef901aaac52\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-b..servicing.resources_31bf3856ad364e35_10.0.19041.1_it-it_aeca62b57fb4ea0b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-aarsvc_31bf3856ad364e35_10.0.19041.1266_none_e20a2c618eea3856\n\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-p..l-message.resources_31bf3856ad364e35_10.0.19041.1_en-us_f65d4067627622e9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-font-fms.resources_31bf3856ad364e35_10.0.19041.1_pt-pt_baf3b18f122c4a5b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-directui.resources_31bf3856ad364e35_10.0.19041.1023_pt-br_eef506143c1bff6a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-webservices_31bf3856ad364e35_10.0.19041.546_none_f6ca498bc1e24c44\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File opened for modification C:\Windows\SystemApps\Microsoft.Windows.FileExplorer_cw5n1h2txyewy\Assets\SquareTile44x44.targetsize-96_altform-unplated_contrast-black_devicefamily-colorfulunplated.png C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\StupitHack.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\StupitHack.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\StupitHack.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\StupitHack.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\StupitHack.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\StupitHack.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\StupitHack.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\StupitHack.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\StupitHack.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\StupitHack.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\StupitHack.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\StupitHack.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\StupitHack.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\GCUJCNQFTQMECRU\DefaultIcon C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\GCUJCNQFTQMECRU\shell\open C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\GCUJCNQFTQMECRU\ = "CRYPTED!" C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\GCUJCNQFTQMECRU\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MD79PFRQ4de5n55.exe,0" C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\GCUJCNQFTQMECRU\shell\open\command C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\GCUJCNQFTQMECRU\shell C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\GCUJCNQFTQMECRU\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MD79PFRQ4de5n55.exe" C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd11143 C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd11143\ = "GCUJCNQFTQMECRU" C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\GCUJCNQFTQMECRU C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1648 wrote to memory of 4160 N/A C:\Users\Admin\AppData\Local\Temp\a26906c09acbcd300aa4a7f237249282_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\Pizdec.exe
PID 1648 wrote to memory of 4160 N/A C:\Users\Admin\AppData\Local\Temp\a26906c09acbcd300aa4a7f237249282_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\Pizdec.exe
PID 1648 wrote to memory of 4160 N/A C:\Users\Admin\AppData\Local\Temp\a26906c09acbcd300aa4a7f237249282_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\Pizdec.exe
PID 1648 wrote to memory of 4940 N/A C:\Users\Admin\AppData\Local\Temp\a26906c09acbcd300aa4a7f237249282_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\StupitHack.exe
PID 1648 wrote to memory of 4940 N/A C:\Users\Admin\AppData\Local\Temp\a26906c09acbcd300aa4a7f237249282_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\StupitHack.exe
PID 1648 wrote to memory of 4940 N/A C:\Users\Admin\AppData\Local\Temp\a26906c09acbcd300aa4a7f237249282_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\StupitHack.exe
PID 1648 wrote to memory of 5092 N/A C:\Users\Admin\AppData\Local\Temp\a26906c09acbcd300aa4a7f237249282_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1648 wrote to memory of 5092 N/A C:\Users\Admin\AppData\Local\Temp\a26906c09acbcd300aa4a7f237249282_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 1648 wrote to memory of 5092 N/A C:\Users\Admin\AppData\Local\Temp\a26906c09acbcd300aa4a7f237249282_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 4940 wrote to memory of 5024 N/A C:\Users\Admin\AppData\Local\Temp\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe
PID 4940 wrote to memory of 5024 N/A C:\Users\Admin\AppData\Local\Temp\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe
PID 4940 wrote to memory of 5024 N/A C:\Users\Admin\AppData\Local\Temp\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe
PID 5024 wrote to memory of 2308 N/A C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe
PID 5024 wrote to memory of 2308 N/A C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe
PID 5024 wrote to memory of 2308 N/A C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe
PID 2308 wrote to memory of 2108 N/A C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe
PID 2308 wrote to memory of 2108 N/A C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe
PID 2308 wrote to memory of 2108 N/A C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe
PID 2108 wrote to memory of 1328 N/A C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe
PID 2108 wrote to memory of 1328 N/A C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe
PID 2108 wrote to memory of 1328 N/A C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe
PID 1328 wrote to memory of 2456 N/A C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe
PID 1328 wrote to memory of 2456 N/A C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe
PID 1328 wrote to memory of 2456 N/A C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe
PID 2456 wrote to memory of 4460 N/A C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe
PID 2456 wrote to memory of 4460 N/A C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe
PID 2456 wrote to memory of 4460 N/A C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe
PID 4460 wrote to memory of 4076 N/A C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe
PID 4460 wrote to memory of 4076 N/A C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe
PID 4460 wrote to memory of 4076 N/A C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe
PID 4076 wrote to memory of 5104 N/A C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe
PID 4076 wrote to memory of 5104 N/A C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe
PID 4076 wrote to memory of 5104 N/A C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe
PID 5104 wrote to memory of 2200 N/A C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe
PID 5104 wrote to memory of 2200 N/A C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe
PID 5104 wrote to memory of 2200 N/A C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe
PID 2200 wrote to memory of 3624 N/A C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe
PID 2200 wrote to memory of 3624 N/A C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe
PID 2200 wrote to memory of 3624 N/A C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe
PID 3624 wrote to memory of 740 N/A C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe
PID 3624 wrote to memory of 740 N/A C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe
PID 3624 wrote to memory of 740 N/A C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe
PID 740 wrote to memory of 1280 N/A C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe
PID 740 wrote to memory of 1280 N/A C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe
PID 740 wrote to memory of 1280 N/A C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe
PID 1280 wrote to memory of 3428 N/A C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe
PID 1280 wrote to memory of 3428 N/A C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe
PID 1280 wrote to memory of 3428 N/A C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe
PID 3428 wrote to memory of 4500 N/A C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe
PID 3428 wrote to memory of 4500 N/A C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe
PID 3428 wrote to memory of 4500 N/A C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe
PID 4500 wrote to memory of 2524 N/A C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe
PID 4500 wrote to memory of 2524 N/A C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe
PID 4500 wrote to memory of 2524 N/A C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe
PID 2524 wrote to memory of 2332 N/A C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe
PID 2524 wrote to memory of 2332 N/A C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe
PID 2524 wrote to memory of 2332 N/A C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe
PID 2332 wrote to memory of 2488 N/A C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe
PID 2332 wrote to memory of 2488 N/A C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe
PID 2332 wrote to memory of 2488 N/A C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe
PID 2488 wrote to memory of 968 N/A C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe
PID 2488 wrote to memory of 968 N/A C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe
PID 2488 wrote to memory of 968 N/A C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe
PID 968 wrote to memory of 2160 N/A C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe

Processes

C:\Users\Admin\AppData\Local\Temp\a26906c09acbcd300aa4a7f237249282_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\a26906c09acbcd300aa4a7f237249282_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\Pizdec.exe

"C:\Users\Admin\AppData\Local\Temp\Pizdec.exe"

C:\Users\Admin\AppData\Local\Temp\StupitHack.exe

"C:\Users\Admin\AppData\Local\Temp\StupitHack.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\a26906c09acbcd300aa4a7f237249282_JaffaCakes118.exe" >> NUL

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 75.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 107.12.20.2.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\Pizdec.exe

MD5 50c7c57e78e9d7b62abc477640ad52bc
SHA1 b6940cb51c59037c8882c8655faff8b4abd36de6
SHA256 8d416efbba749ad336169c94865b8f061f27ab14d3c7532ce65a1ee66a30da91
SHA512 db438be083930ce83d9af38db4aeaa328a6d8bde2d431485c47712b1f67cc0a6a414ee8c58ade03488c74e7968ee6b05d5f2fdaae86c745203c490e5d6452976

memory/4160-12-0x0000000000400000-0x0000000000414000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\StupitHack.exe

MD5 4b46a0763cc3a4d5e8425c710ed89d4f
SHA1 3edd04e111cba5406ee286db3f7c970ef34d7c53
SHA256 8dbc58dc724a2c25d2b4d46ee528bc3007f1260afedb71c4cef6f9325d60b627
SHA512 1ebba09fa4eb8fbeaa976458c0eaa52f7f5622b522d9d17f815e6c27a5d458bd343fddf1807f7f17c7623ef87f6e439375b9477dd1050c25a2e9f1f33dabcbbb

memory/4940-18-0x0000000000400000-0x0000000000455000-memory.dmp

C:\Program Files\7-Zip\Lang\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt

MD5 e1729097a23480f095671534ca826c69
SHA1 2fa21ac0be0059c42344ea7ba1c2a82ca794e265
SHA256 fe7a9dce50a1cce7cbda97bb8a30e2065b54317ef3e753dc4901495d5a2b3124
SHA512 f17e4d46bfa962df72d3ae4dc96b8e02702ad30fa955fd3887bfbf4deefbcd45f0906a4ca30821efc3c95687765edd2565a509c52986912f5e5902e9b71dc146

memory/4940-150-0x0000000000400000-0x0000000000455000-memory.dmp

memory/5024-158-0x0000000000400000-0x0000000000455000-memory.dmp

memory/2308-233-0x0000000000400000-0x0000000000455000-memory.dmp

memory/2108-269-0x0000000000400000-0x0000000000455000-memory.dmp

memory/5024-145-0x0000000000400000-0x0000000000455000-memory.dmp

memory/2456-330-0x0000000000400000-0x0000000000455000-memory.dmp

memory/1328-329-0x0000000000400000-0x0000000000455000-memory.dmp

memory/4460-346-0x0000000000400000-0x0000000000455000-memory.dmp

memory/2456-343-0x0000000000400000-0x0000000000455000-memory.dmp

memory/4460-356-0x0000000000400000-0x0000000000455000-memory.dmp

memory/4076-361-0x0000000000400000-0x0000000000455000-memory.dmp

memory/2200-368-0x0000000000400000-0x0000000000455000-memory.dmp

memory/4160-367-0x0000000000400000-0x0000000000414000-memory.dmp

memory/5104-360-0x0000000000400000-0x0000000000455000-memory.dmp

memory/5104-364-0x0000000000400000-0x0000000000455000-memory.dmp

memory/2200-404-0x0000000000400000-0x0000000000455000-memory.dmp

memory/740-413-0x0000000000400000-0x0000000000455000-memory.dmp

memory/740-421-0x0000000000400000-0x0000000000455000-memory.dmp

memory/3624-415-0x0000000000400000-0x0000000000455000-memory.dmp

memory/4500-480-0x0000000000400000-0x0000000000455000-memory.dmp

memory/3428-475-0x0000000000400000-0x0000000000455000-memory.dmp

memory/2524-486-0x0000000000400000-0x0000000000455000-memory.dmp

memory/2488-541-0x0000000000400000-0x0000000000455000-memory.dmp

memory/2488-588-0x0000000000400000-0x0000000000455000-memory.dmp

memory/968-591-0x0000000000400000-0x0000000000455000-memory.dmp

memory/2332-493-0x0000000000400000-0x0000000000455000-memory.dmp

memory/2524-491-0x0000000000400000-0x0000000000455000-memory.dmp

memory/2332-488-0x0000000000400000-0x0000000000455000-memory.dmp

memory/4500-485-0x0000000000400000-0x0000000000455000-memory.dmp

memory/3428-468-0x0000000000400000-0x0000000000455000-memory.dmp

memory/1280-467-0x0000000000400000-0x0000000000455000-memory.dmp

C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif

MD5 a11be41db4b3b8d31d269d6cb82e7e62
SHA1 a3d48811affcad19ec140eace2ef7e5cc5ea83c3
SHA256 a4006db8376722c698457875f3d3788aa8c1086776b4b1f8fe70ff8bdf9dacb7
SHA512 dc385e6c6a717f4aea1ba3aa14209132c9f0fcbbac444dec112b60f896029c9192df2e25a9f5d78ddbd7dc5224708fc27debbcb5bc9dd28d35de477cfcb702b0

memory/2160-627-0x0000000000400000-0x0000000000455000-memory.dmp

memory/4412-691-0x0000000000400000-0x0000000000455000-memory.dmp

memory/4948-742-0x0000000000400000-0x0000000000455000-memory.dmp

C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md

MD5 2c9dc476bbb74266c6d11169fa322441
SHA1 3df18b3d3ad59d4aaa607e887ef84cb7f62aaf14
SHA256 f2621ccf8d02c825d34d2bb0879cfa6bd9ba2575558b8269e0cff49a4bf5f2c2
SHA512 998a98912c0fa639cf9eae0de64baee45df8ec072de49e83798e2ece5afec58c496a7c1157834d6351a48a1862642be61dd58ee8b79a085c801590fabcdc32dc

C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md

MD5 b8bf6c4db89071bf44483ccfe2d9ca94
SHA1 9bf3ded3e280b8c466d1708f71f6221109666e23
SHA256 b38b264c68d94386bb5d48b4f16609c595b5d1e29a61f4f0817d26166518cb16
SHA512 bafb66b1892a977b049722ef3d9407618f57137a6b570de83cee0df8fbc22007d3139d91aa81267e802cb345c5f8cdb35cb051645cf2795d530116f69e938260

C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md

MD5 424803d070e6f71e2ddaeec8f914be0e
SHA1 2ef8b37338123e5e3c4accc9f2ed3c8c7c642dfd
SHA256 40bbad07227e73ed9236d6289cfd156a851f3a0063f1cf8e278a84c3e2f64db0
SHA512 1a319d6eab9474717d3d0eb400b446013b39f241f0216d50b06792d913d1c83923635ba51982f768c1015d080ba61b7a57832839676ea49d03d431645ec68ab3

C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md

MD5 d1536bd8a6fef57e62e9b8d9589b0e89
SHA1 12cca1b49ee76dd3fbaf9eeb5f4d329d1d0e92b3
SHA256 50880fbf19ce02fa36b95577870ec5c32924a6887b4bb8ee4773a13ae441486c
SHA512 76f5dd1870dcfb3a3bee5bda8b4deac4c08ff55b31e3cd6a0d97fb5cd5dca81a0d98aa395d2192a5ab63fdf14d22d743b52a6504fc9cbcc87972cea0754010bb

C:\Program Files\Java\jre-1.8\legal\jdk\asm.md

MD5 951377dd0353552fea57fcfda1d4f795
SHA1 90f30ede22b76bdb74109af13284363350c8f689
SHA256 dbec97d815a4594dc6ed77976bb247d8ca7f4941ef695ce0501977ea3341fefc
SHA512 133c2246186b686ade5eb4c97cc79882f52e7531162265914f026d9db5289af477ecc5d6f0a973abad4a61bc20f3dd3ec0870493b2de8409e2acb95e510f5c28

C:\Program Files\Java\jre-1.8\legal\javafx\public_suffix.md

MD5 aa5adf4c6a3582956428903a5e451a40
SHA1 69eb265d79fc5db0e98ef72ac6422ecdf85924a0
SHA256 de4efa4d5878e190a144a077a1c1f9a6c67de5b6a27a9369bd00fcc0f208d005
SHA512 aa645b55ff8ce67958641f2857a36ce2379b5dfb0148804720203df1e1483132a4c3a68d8953ab41a49903f10f872cf459d3080cd38d8f029e97b416e357ccb0

C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md

MD5 c835590fcd521a515ce262637fa34ce3
SHA1 ea1f5f58b9dc8d1f9679ffaea75347f264b2df35
SHA256 bf5ed064dca9d031caa834f7ad553ca8a1d3b04b2c317f34455af8df9a557e15
SHA512 e26b389519e97af1f7fdc0961084de31d4823e1fb6051c21299fe7f8f4299c0b19bffb72410ba51669ed1b65d914be8b20117cc2227b557cd85969bfcb38ead6

C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md

MD5 4d04b2712837a26b6f5243e7d1ec245e
SHA1 2f0d90dc4ae6dee884612f67a305bc337acfb331
SHA256 57489d6b127c8f5fdfee687c447e830d7e73778169ec5b536ae2e817ef9cfdba
SHA512 d08bfe6eff77d541e08cfe3d1814a71254985c0a1aa2a6cab62308f2e10546f2cf456fd713ad16a5065ddf1f1ef04d78dbc4f5ae87363212b3c972c8bed8a8ef

C:\Program Files\Java\jre-1.8\legal\jdk\dom.md

MD5 c191c4ba3b92250b472ddae3a3ddbf74
SHA1 5b47b5d828161ffc668c1c93187d64fe232c5672
SHA256 b0847db957625f64a66fff7f5c85d0ab900fc774034f618500a71dcc3d2911e1
SHA512 ef43c2d2d6c0a2a49ad5e19a30df1036fa1e99fb64355e0a930a5b0c9d60961a408f22db5b5e71326ace3757e634ea4ebdbeb704f1c2a38e73a95d1525911503

C:\Program Files\Java\jre-1.8\legal\jdk\joni.md

MD5 d0f76c0e3b1141e78fc34f495a39cfce
SHA1 6f3b3ac9119a6403b646db867a66f11acf6373de
SHA256 c0f78712fcd8409fdf282c9d9a4f2c29231d1505e8b4392e4fb87fbecb87010b
SHA512 1d1f09cce0f48945549b353d64bdafba22a019dfb6a41594b8f59f9602d033b3dbe42ed7befdc2de1640a594debead174638506c06187f202d71f11a558c4682

C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md

MD5 92bac6a87e0c6b8dc0219ac15dadeaa1
SHA1 2fe46d94f877a2ae1649f320255ae10ea15c400a
SHA256 a3ff60d79288bd42c5f92171f8ba854ddb544170ad30af2b19ad3a4a902a4546
SHA512 255c53a1d6751a8f0b2bdde3304e2cb355cf4af944fac51fa139f9d3ff79586e9589494913d8cf781114c3d18ba18ad8031ed5a581a3d7405c28710affab1858

C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md

MD5 5adc35d88ff4a45c90d606772eaa22e2
SHA1 6e563ae6e79fcfc9c52b70078e86a5553de567f1
SHA256 1423ac65a6b00a9c9f73acaa5033913fe55cac7088d82279813b6c50bd7c3c63
SHA512 206ece3093da4de6a115ffff9daafba7376e653653c9b01139b4c29dfa73cb5bc62d196820e5a039fdb72eecd145c4b6046ebeb9e10c2be2c22d7b3bc7828eb5

C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md

MD5 5ee8ea767c9984cab1cc09987221971a
SHA1 aad99f30282a2fbe21009932751c3dfa0865249d
SHA256 240faea879cffaa3df60a3bd6477601baec72349c71596e55b64553866cf8911
SHA512 8f971f5be5f69a09ddefca153f6fc98d51bac804cbbf629e648eadec4a496c1312120721ebe7349827dc36da1fdf0d7776b9019a204ecd21edba7c5b6761ad90

memory/3536-810-0x0000000000400000-0x0000000000455000-memory.dmp

C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md

MD5 527bd6d49cc62ab4efa3f48cf7e53265
SHA1 57d21fb2ca92e62ae52e0f73049ab407ccda54ac
SHA256 85c1819897694349120a0689b63810de4f7b345c495bdef70056f6889d0fd5ac
SHA512 bd2c95680424a4b3d6a4e9976f246caf5c6e7a0638115997f7b459c54043e83d7236fdc3cd19b7d560370eec1775e0ee14b7064f9f200aec06d9d385a779c871

C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md

MD5 a141fe7920b04db3d030d365d1a7b3ee
SHA1 b965acbd93b27b68a232d0428b56aa85e4451ced
SHA256 40337b77f9bbba3187e1f74a6fea11375f3cc1c77c08849452628352ddaa52cd
SHA512 ffcd5eb78c7e0616d08318a9ab51f6148d457c5c0c90f1929bb169134476b0a3f6d1e7bea1eb13d17c05e9fea6c1de7c60aa0d5ee734e2ac7144baaeb12c40f8

C:\Program Files\Java\jre-1.8\legal\jdk\libpng.md

MD5 017404da92116dfcff825efcc361fd10
SHA1 334dd723d38f2f2d5ca1521afff1deb6c4bee1cd
SHA256 60c059c5e4646acf72c6581e61f19c0aea11e55063d6a04460c665ea9fa57db7
SHA512 d92bc183b17dfa2520439618bff41b79a6fc54c94ad281ac3cd2dfe8ce961f543b57ed93b321a4060abf1c4f1a3984647facded96defc5a415cc4b8d630dbf93

C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md

MD5 ab3a188c4d3e07c807dd564fd6b31831
SHA1 3b590fcd68d0ec3b62b960db20ce6043b0c0759e
SHA256 87db126b2467c45359b1880c8a2571c72f0a6ab7483e35c93573ea71436f9e88
SHA512 7ec412ba252812a13bb41900063bdd7ee09c038ad425cb200ec6a640fccb43ba77b81b96d63d7ddb2b81e11fef3d75f35802be423e82d34f47b4d87b1c84d935

C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md

MD5 33d015d652f181ed2f79055457e2f13e
SHA1 4597d62acebe5ed9cdc5b0fa287a7560a8724084
SHA256 254aefa3977b222da7c5b7341729a28ee0099b96616c52ac6977283e98d5eb3d
SHA512 6bc7ab942b60bd48037006a7a9433953ecccc17aa9d0c9b9e43491ac926782c8fbbec4c4d4d0fb629dbe71baf22123c797388079f5334aa2575eec219d2db9fe

C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md

MD5 d89bb6e944cb9773e0e0c9c94fc9d67f
SHA1 420c4d3b01dff0dba82fd20b3d90123c06df4743
SHA256 938bfb82ea682edc3b189d50003af01632d5397964450a37031f6f9339e6071d
SHA512 8f6da1671820bb461e4114cf4fb8935b1af6fb93052d19a98a5cc3abaa92338b94c981559c3c13a45b153f2dc41b7afbbee093c95253d58244ee874a0de419eb

C:\Program Files\Java\jre-1.8\legal\jdk\icu.md

MD5 1a93ca4660e73fd103ea024771f76aa6
SHA1 0339366570be95dceb047191416256d898442788
SHA256 444e24a10680d9077ba60737d4a0c5241ee3baa9dc3e4cce2c3c21393e3d640b
SHA512 84e8c399a836b3c4d439139e75e1b14abd06daa1ee2678e7d1e967a4153e9b972eb15e7826723a704246b32c887919ecf5275efb8f188584c4a827205ccdeb41

memory/4308-790-0x0000000000400000-0x0000000000455000-memory.dmp

C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md

MD5 0df6a0b708cfe9ee7ffdd1ee594baef2
SHA1 41ee8df9ef293ece4b681531b17d54bad44d9c6e
SHA256 235ce7f4045f5461b1b222940c52bbf72a43b29accddb3cc2044c029b8d4ea78
SHA512 3e0a4df6f08abcbf5669b148014b4e33e5525950dd87c93e7f090c2bf59e5c7a765a5b950c650065df690dfc85eec1257edfeec0669f12a9afb007abc234897f

C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md

MD5 fee7c04b9357fbdb26689a3da3248e13
SHA1 0327721c8048b922a0b5eb0a62a7ec2827b04cc9
SHA256 1dc6aabf4ba0ff73e56134689d9926323dff7e4f604373e8f7caf6da7cbdb4d4
SHA512 45a6dc35e4314d2412fa95176968157ec447a486e27c50c9d575c65d823e2e2156b4b88f8e7daee1569ac7e018cee8a6eab1a7998f0b79620b7bd2e1a197b131

C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md

MD5 96fec3e4c8402967b7ba542a3a6df3dd
SHA1 181e6ab3d0c91743a7281c33aa305dc0ca662ad0
SHA256 fbb967182eb4095fe7134a1152db3e5acae92abd6c8a99b481fc0ef9750feee3
SHA512 f7cb6c98f650355217b07ad69f6b30fbe2d368655c0e1b9e10469f107092ccd2ad14e9c9ae109bc6726dd52af8fca0f112e6de778587c7f71694d5e931a27e11

C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md

MD5 2088a4bf82d4a5f754ae4fae9f0ff0e5
SHA1 e986bf3b7e7a12cd40f6ad96dfa65b5d63059e2a
SHA256 d9ac30a97be363d6fa1d2001a15a529e465f46005c770a49f47d9aaa5a505475
SHA512 d21176749c37945821080d29fc99ef6d6edd9fc715bfd55fc1e6c906ad3a3ed68e6f3db6a55fe80a2961efbb2c7ddb4c87e0e2e306b67cc4cc2f6f1c796ccda3

C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md

MD5 2261ed77784b596e44b2820831688ab1
SHA1 5385be6e0f3fb0ba14314cbc2123f145492d462f
SHA256 360e8598f6c3af6501acb930bf54da1ef6d03aa41f8ad0bf23473e1988d11558
SHA512 e8fd67ab94ee3d003eb46458546a61cadc01943713fdbacd05642744a9388548d05c3e16cf42c791d030fb85962ed2063560e58193d2bbd960b79c42a7170613

C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md

MD5 54460eb366768c544f001dea0a978e5e
SHA1 5b5ae2b464d394cba40e773bcea03d0d8afc8e54
SHA256 3c9b27ff5c91f3d8a8153ede3d7fde2db11d23203139a513a40c298a93920bcf
SHA512 137cbb44ec28e6ac9f7b8da3883eb5d7a0d4c82d4bd74329b063613b03a1a966ec05d9d97ca52e2e1d38d4173d93577628110effb4573fbd7a68231750a25f7d

C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md

MD5 996cb711eea0d71c1596aab12f80be08
SHA1 c580bfdf2f42cdc50272e938cf281d5ccd2fa0ad
SHA256 c9ac78c6afff8df296161e17731324bf298d862a968f434b2518999fddf468d2
SHA512 aa89fd276641287ec1778fbd2df2d01b21345518d5390e3f58f4561d59996433a8f8d1b8c9d75f232a69e271960a9a0e7900ec4853786a9024ed4c6dee83bcdb

C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md

MD5 1285d6b13ba4432cf876917202d7e91f
SHA1 cd7201463bdbf7af21d280a023a0daf6f2d4f7b7
SHA256 34c367fffb5ba5ec09b60a5cc0cb634cc1e78e99de61e2d1f30778652f53b2e8
SHA512 4cf2a74f98a4fbab23aa5fb9473f1d752fadc5a4e30c8a199482ae7631829477b6f10b56439822e59fded95a10e22be3981fcf60746c22ff50b8917b3f5d6d72

C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md

MD5 702cf6827d86f4204358fa774e5fb466
SHA1 0427cb768a81578b73175b30be4299372a8a1ace
SHA256 c2fad9d83b0d799d3401169b815ef4a8de5925ef64df1791ad665915da6c01dc
SHA512 abb6aad4a6ff5f09d9b52dd58c188b19e07aa67d6b6d0c88889a661980e62b539c7c9b5b18030facd3e0f74fdd71fe02b75bcf3b3522238d2795d9e5f62c7b3d

C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md

MD5 a5a14be7d9cc544974b648e72ca9743d
SHA1 5b27484aa9a43a1e2ef217fee6251d6c2e284678
SHA256 896d8e321d071e3d98efde13fa3912663dab2f3d609e97d891c58a0f339d9d24
SHA512 6891967ce7aebee34538f64b65059ec3277ab6db6912cdbda46735a896b0d3cacf133564120b1c6bf054041215c4605899a86ffbf3d3aff5c411314b67b3de58

C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md

MD5 066f25a10abaa1f0c62506db529438fd
SHA1 c7cdcd50ce3929fcb78452dc0a7f4d80dd5ff712
SHA256 55ec5e24b71cc9db5125e8ed39c12d693a625e948a2da5bf70814040fce6dbb2
SHA512 503853645305404c1cfd0c310dbc0d251f9b56900798dbec4c57f0d2444f10722ec8f17c226b63d450d03e5ef4f2a1d7aa8984eac79057ef8dafe3da389269fc

C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md

MD5 4f33dbef85c2d703b24c4c7493663c37
SHA1 659ea6b17d626e6f723aedc0ba630949d99838f6
SHA256 ff48bb8e14e578f96103a00cd63e973dbc5239c9884bec253473b098465e1b33
SHA512 de925a351acda1c4d31b9055ded37a1ef344c10176d068ab8ba88963e9fa6f6f1b8c1e4749980ad4d15bf83f4b9ce99504072ecb6b941a9a6880dcadb9ca8beb

C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md

MD5 ec3f4273e7a144b3f19b0a4f21cb4dcb
SHA1 a458796d7187be9363b0504d1b03f8535159cc88
SHA256 b0bbd435486880bc0bb838c986d33d6b4708da6eda4656d9f47b437ddef358ea
SHA512 e553f9dac2ced1453ba3273a425f6860cac3af2d51a48d4fdebdf76d4a0ca0d7fa710205356acaa8b90c82da26e5ec741252e45eb66d50c8358d237a59fb9fd3

C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md

MD5 f14aa1d7d7301953014414b99e838e60
SHA1 1e937174f34056b6868fb497201e8ece997f75b7
SHA256 bc28dd72c3a5c32a9c7cdaa49b0b8a66d6c1dd11e2fab099fbc074e2eeafaaa4
SHA512 61eea0794858abe66ce125d1087895ad6f3645f9409ddbc123cfdf5125bef8544d2930e7cf53b0843137fb7cb051435c7f12f37f5d6a8d1fee05208747a3fa5c

C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md

MD5 68d4dbeacd6594a1bb0ac484a84179d9
SHA1 cdd205cb06913acb3ee249053b4c7df4a8bec9bb
SHA256 7dd2504f539d8dc5c032eb562a3ffdd44dd1bd8058e8e038d60a4775873b955f
SHA512 0ddd042f95dcb4b33fe741b8b8b4eea429ff6b2c0dc1b5b21912c165355ff19cae7ffcf7dbb77d971e1f18be2e0850b42efab907c219f719a1338b5d5082269e

C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md

MD5 24fae83d8aae878a4521de0917107d52
SHA1 e9e6d8ea3ae3cf518a7bb4454c52263c483edf2d
SHA256 f3d9ec82a2e9d89002ef188f6c9da60f0235a82156629516a312bcf84dc0b90e
SHA512 53628dad284b36bda18d0e93f3c0c1be2d11048e87d49a5b59daf9b8bfd4257d6ac4aea27bffc78b39a13c6dd1b1ff1077de96357255d03ef06d1e81e51f247b

C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md

MD5 c24d14aa50ddb5325bb9e9764fac2393
SHA1 8c7c126f8f73161472e4ee201cbe157f81f11f42
SHA256 4063bf01641e20da46b141677c43119412e9b27e3dca22a4d2e5dc8ba8e74af7
SHA512 de16f144ccddcd6f8d75d74244b88844e52cb32f58c85a1456a66770471c3997f2f726555e6ec374d39b664accf5023eaa6c12d15568cb0857af09fadabcbbc3

C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md

MD5 cc407af9764d28622639b9bdcc126ab8
SHA1 c5d97af0f99afa5f8b84bde3cea3eac8a57fedc8
SHA256 05c15eb571d45157e860a7615ab5c5007c7a9c3dec0a4dd23dbf7c33701d123d
SHA512 d2db15397dcc5ef388c33deb283bcebfc8245afa130243c3c44ff9c7bca886232fd892f261e09718bfa73283289a33f01c681ed0153ecff7f600c9bfbb1eb7b1

C:\Program Files\Java\jre-1.8\legal\javafx\glib.md

MD5 eb4118d52f740e055846c6fd13e1b1fd
SHA1 816c5cfb4bdb04f290e86b0643c0d69ca38de7f5
SHA256 07b78192c44275fdaf4a911d072f21fb2393fae4920255a19de4adb25b3d19e9
SHA512 b182ceca50eeca376c65e3a17d173504216add73b628f42b028d652999bbde475c5fcf08724bc5f2ce7df8e82f1679d5f089f0dd42020fddb09b0166a2e82d2c

C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md

MD5 d4e0fc1ef37d50f4a732807fb2000d8d
SHA1 0118ac9215c3a36a8f7676f785c1c997c0007dc7
SHA256 7f7f2293ee49056b58fe6b11b6f8031712151fd52228dafea4db8db24e2e2113
SHA512 07ebfa82a2abfbed5d8cdf0ceaddd25a3c330bd960f2b404f3ba42f4a986b0edf0e7be91eedb71d3c4fb785407a9e34a67e6f9b1566372d7d8e5621bacde7b24

C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md

MD5 9e64a5111a69505f334a693d9c4c4e0b
SHA1 32f22f09a1d728fa22d2c0c5738031326000e8bc
SHA256 eed0833497358e75c77385b00487be116d80c71748ae034c65f5932e4aa34d32
SHA512 ac03578c7bbf2926a9e630f8af2444c56c09613f4c7d9e478a1076f3703c9594d5a0787fdeab01469b673d93fdb3dbbff78c5e8563432f054af5aced0a1f6752

C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt

MD5 86ea35088c34370b03139c26fc5eea52
SHA1 0fa417c76a246602fb9cc17a8de8b897bbe0062f
SHA256 7b29b57434c6b35a481a245fead074696b8d86e4af00683887399b44908496fc
SHA512 89151aabde91b24de7ffb979759d567c476e9fe1904d8c1297d9a6b004ff6036436ad5c97371f1e8bec0aa1dea7df25f86681a520e3e349da67a4d423b5ae86e

C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt

MD5 4444a88bb20dd037ba718e4eb4a78f97
SHA1 b1829934b4ab99f91cfb50b47503889599fa281e
SHA256 2349f6bc34e7637d870d1ab8a3287b64d0eaa86ddb5284d29e1474f170b71905
SHA512 0111c8073aa2f10cab0c27f7a7aebe7c7092d634e76ea1ccdbb19912218515d5fd0774f17b7f0ce495ab399df03145892e941909742725046387ffd9258d50c1

memory/2004-883-0x0000000000400000-0x0000000000455000-memory.dmp

memory/4584-890-0x0000000000400000-0x0000000000455000-memory.dmp

memory/4584-903-0x0000000000400000-0x0000000000455000-memory.dmp

memory/4444-904-0x0000000000400000-0x0000000000455000-memory.dmp

memory/4444-915-0x0000000000400000-0x0000000000455000-memory.dmp

C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt

MD5 8e1ffabf83f973a87462562bf50518e1
SHA1 0c85f4f9da2b9851e3a03d44d1ecbe04a07a1820
SHA256 67856462df528c5f151a63a13d74f76cecdd050ebac01435b4413ba977853ded
SHA512 b439cf3e3f22a98705db8f82040b34ce03d2b2eadf905e7ad914d7cfd629ff3747921a6eca85f5476f2fa12884b704585aa8e37cc2b95f1c16a22138578fa7e0

memory/4240-956-0x0000000000400000-0x0000000000455000-memory.dmp

memory/392-960-0x0000000000400000-0x0000000000455000-memory.dmp

memory/392-967-0x0000000000400000-0x0000000000455000-memory.dmp

memory/3508-1000-0x0000000000400000-0x0000000000455000-memory.dmp

memory/376-1012-0x0000000000400000-0x0000000000455000-memory.dmp

memory/428-1013-0x0000000000400000-0x0000000000455000-memory.dmp

memory/2180-1040-0x0000000000400000-0x0000000000455000-memory.dmp

memory/2076-1130-0x0000000000400000-0x0000000000455000-memory.dmp

memory/3772-1197-0x0000000000400000-0x0000000000455000-memory.dmp

memory/3548-1264-0x0000000000400000-0x0000000000455000-memory.dmp

memory/1612-1321-0x0000000000400000-0x0000000000455000-memory.dmp

memory/4552-1357-0x0000000000400000-0x0000000000455000-memory.dmp

memory/3160-1374-0x0000000000400000-0x0000000000455000-memory.dmp

memory/428-1413-0x0000000000400000-0x0000000000455000-memory.dmp

memory/396-1437-0x0000000000400000-0x0000000000455000-memory.dmp

memory/816-1519-0x0000000000400000-0x0000000000455000-memory.dmp

memory/396-1428-0x0000000000400000-0x0000000000455000-memory.dmp

memory/4416-1569-0x0000000000400000-0x0000000000455000-memory.dmp

memory/1844-1681-0x0000000000400000-0x0000000000455000-memory.dmp

memory/1560-1690-0x0000000000400000-0x0000000000455000-memory.dmp

memory/468-1709-0x0000000000400000-0x0000000000455000-memory.dmp

memory/2648-1722-0x0000000000400000-0x0000000000455000-memory.dmp

memory/944-1818-0x0000000000400000-0x0000000000455000-memory.dmp

memory/2436-1833-0x0000000000400000-0x0000000000455000-memory.dmp

memory/4636-1784-0x0000000000400000-0x0000000000455000-memory.dmp

memory/1928-1905-0x0000000000400000-0x0000000000455000-memory.dmp

memory/4636-1766-0x0000000000400000-0x0000000000455000-memory.dmp

memory/1116-1765-0x0000000000400000-0x0000000000455000-memory.dmp

memory/1116-1744-0x0000000000400000-0x0000000000455000-memory.dmp

memory/436-1738-0x0000000000400000-0x0000000000455000-memory.dmp

memory/4388-1935-0x0000000000400000-0x0000000000455000-memory.dmp

memory/4300-1938-0x0000000000400000-0x0000000000455000-memory.dmp

memory/4720-2005-0x0000000000400000-0x0000000000455000-memory.dmp

memory/2108-2013-0x0000000000400000-0x0000000000455000-memory.dmp

memory/4720-2007-0x0000000000400000-0x0000000000455000-memory.dmp

memory/3164-2041-0x0000000000400000-0x0000000000455000-memory.dmp

memory/1328-2068-0x0000000000400000-0x0000000000455000-memory.dmp

memory/2180-2077-0x0000000000400000-0x0000000000455000-memory.dmp

memory/4412-2078-0x0000000000400000-0x0000000000455000-memory.dmp

memory/4532-2105-0x0000000000400000-0x0000000000455000-memory.dmp

memory/2180-2069-0x0000000000400000-0x0000000000455000-memory.dmp

memory/1724-2163-0x0000000000400000-0x0000000000455000-memory.dmp

memory/3108-2178-0x0000000000400000-0x0000000000455000-memory.dmp

memory/4612-2162-0x0000000000400000-0x0000000000455000-memory.dmp

memory/4308-2327-0x0000000000400000-0x0000000000455000-memory.dmp

memory/712-2336-0x0000000000400000-0x0000000000455000-memory.dmp

memory/2800-2366-0x0000000000400000-0x0000000000455000-memory.dmp

memory/3192-2374-0x0000000000400000-0x0000000000455000-memory.dmp

memory/712-2350-0x0000000000400000-0x0000000000455000-memory.dmp

memory/2640-2339-0x0000000000400000-0x0000000000455000-memory.dmp

memory/2800-2388-0x0000000000400000-0x0000000000455000-memory.dmp

memory/2304-2400-0x0000000000400000-0x0000000000455000-memory.dmp

memory/232-2402-0x0000000000400000-0x0000000000455000-memory.dmp

memory/1036-2404-0x0000000000400000-0x0000000000455000-memory.dmp

memory/4532-2406-0x0000000000400000-0x0000000000455000-memory.dmp

memory/3860-2408-0x0000000000400000-0x0000000000455000-memory.dmp

memory/4908-2410-0x0000000000400000-0x0000000000455000-memory.dmp

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\aic_file_icons.png

MD5 393e34f6868244fe7ea42c91ac13ccc5
SHA1 78372c337c2f47f59373ae593fa5c3ef8e238d9b
SHA256 20932eab8c29e276c7f8760ac3bbe9024dc61cfb06e5a753abc2100f68356861
SHA512 cf22b2a4a212f2979a5ce057461576356b36bb2381258ad92167fabb960eabc8f8b82ee2b9a0a55b81355e2d283702bf5a3487590c8096735d3df87b4d43f2a8

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions2x.png

MD5 fda3430983134618fe00d74f1b75ef27
SHA1 9ec8235bb6a309bb0add627790594afdb268890f
SHA256 f6968df622e1611733779b57a866066c0bb4317ee791261dadaf453fadc74330
SHA512 4618cb5a22963136f048967bb8534390fafdeb1299d4a54b483de1d607924da82232db4a7b86472aa58d206704582d3e8a596d53d6fcce7067ff6bd7803e5a19

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions.png

MD5 f984021aacbe4d7e260e7abd6c716219
SHA1 bffee864d53a9dc25eea47d240f957a53a4e3e7b
SHA256 2ea4b30ca9cc4e405ae2d8a5aded1fe8e221b1151a5f04819a8d3f2b2db025f7
SHA512 9bb8b68df9b84fc9a3efea859c774a4e63eb7c95efa0fe2d7da05c296b5687bacec10e57b236897eed7f295984dee0b5b2644ae3d31da881ad39801a51b5f0fb

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon.png

MD5 a5c3671c701d987226b3bb239daede58
SHA1 01fd0cadd22d31998f380f95a48cf0ce00a016b8
SHA256 59110fd98269b840bbdcabadb2a3d1838f764e9831636be318825d15551d4310
SHA512 ef2f0b66de0f09598bb5df9f94d54cdea27a5f6f042e04441c621a69c4d36af94ee451523f453eeede0a0dbcecf73fbc794e14833e119b551b98d1dd19458dbd

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover_2x.png

MD5 3134adde7918dca9af2d0b0d9fa36b92
SHA1 30303b59ab5345f6fcc4f9e7b5249ea7b6d8e51f
SHA256 cb5c3409afe7fe53572783596169872e8a51582325e94ee5036b0a805361e81c
SHA512 ab603e2d5c820e3c24da04c3533e0c2ccd88a0c91048e98a6957db253a663004cced867a528485843aa0efe8e7bc91d7e6eb15f44add4b9dd118f19f75203c46

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover_2x.png

MD5 7de2d9488c32e84c88530453d9a31b4c
SHA1 099f3fc3466d8b17558bb2ee39a644be55c6f73f
SHA256 4d2d60ae7f0fd59dd7f08275630db1e3860a8a5e73dcaa78803b2b8d7305beb9
SHA512 e4f8f83c68aed500a96e0c7542482e6ae476038f1c0c6e5bab174c9dc121d9fde36bbe4a5cb38168d3300db15fd011bae7b5415f4e2382a3ff380c67fdc47166

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png

MD5 24c621fdd6bfaf85b714bd98cd96703d
SHA1 9672e3488069475176a00b742b6582c91cc20e1e
SHA256 2b871a59003671b782ecbd982664d915d954728cec4b09cb8cb898db868c1dd9
SHA512 0afc5f5121fef1537215c0a2790f2b0282b806ae204d36664dd543332e8c15e9a00db86f25ed63fa00898beb8fe0bc9984960528b81aca747da1a3acc3d0c005

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png

MD5 a0d138f10ad9c175446dd32279f49f90
SHA1 696e606eef369b24aed3abb677d5558c23fdd668
SHA256 da2172117e0168e71f64e5931f21792939b95d4189246f20ff99a98f442e3a3f
SHA512 9e75db028347cc43dafd38788cb96acb1710e16835fa2eb31ffdb66460e4bd0361663603bfce1c0ea3d1f704fb3d53bae0d1e00e477fa32fb9cbe1a2e3b35c8c

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon.png

MD5 e080ef1c652b1add529e90c79b50a939
SHA1 c23524b31aaa49c5877512ab59f700345895c772
SHA256 d19a689ec5b60b665427b4ce4f5cb3549761270c3bc753591f0bb7a5f47238a4
SHA512 246ca7e601ababd9d36c1fd3d9d8a20b360bac16e8844240aadd2a1724fe173806228e6363068d3f181668a102c0a4c7904e5d5794fc9f7a6d1a375f456c3909

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover.png

MD5 e95758758982d485e4139e5fb58e8e36
SHA1 eed05c66bb7cbefd51a47bdc9c01f4fcfd9b0814
SHA256 663059d98ae5b8d4ebb592c4e97f18dd2f097c8553c133d6402746dd074e9029
SHA512 6ada939216a8270aeed262c7bf7d961a009aece151fb74c067a173b02608d4d8f0e5522f3e9c8c25efa30edf16353859f3d4c04684ba2ddd4d3fdd1a346d6525

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_2x.png

MD5 796138b346f837341655aaa26af0d2b4
SHA1 e8426038bc7f8937427e5c37d5abe6d93590edd1
SHA256 ad9e144bdb88eaf1430bf8d327bba3575f03cd8d1f021e8261929fa701d34da5
SHA512 e0066c4b83ce48982ed7844747ced25397ebdfe32b925daff37cdb49bf55ae4c17bfba1241b1906281470beeec57296d235e97322271c632996d20bb015e79a1

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons2x.png

MD5 cfd2970840a0dd4cd1a72f8d96877052
SHA1 e4b3d480a0532ef5dc5aa8f61eee46fda7b891b1
SHA256 dca257a5b0b2de50870ece682c61ceeaff968ced6fb744d0f05babb8d94b6c1d
SHA512 4b0cceb1306eccca19443dfc84bbc242def31c5718a31f30bdb4b22d5d14f57270c513463dc16d6b1c8f339d0b8b0565646f52a7c2e941ac0a173be46b35f902

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons.png

MD5 74371c120a4a334a45215b4aeb1a4251
SHA1 5d13b12c7195febb3a50c2c4e852643709c00462
SHA256 47879096c1fb99ac3dbe0d4ad826468ffb4007105b58d81b3c00f65f68542cae
SHA512 2e6af74ee065e8fb3ed7d748eccef7b3f6862c4dbbca5b12155a80ddd5bc17c0c3cd022d2540655940f286d077d00f54f7c20cfc877953bf1688e3416f024794

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons.png

MD5 f59672c72d3823afff0573443a1a4b5e
SHA1 767940e7a3a55df71753b7d76dee385731269793
SHA256 4508df9c766a3115ca8143809112827493484ef47cdfa71db52116fe32b44f90
SHA512 cd687e9f69ec748134c82731c387b1f0c02d0d940299f318743d79f95c40372760d0dc40d7605b211c2b71ddd0cb71d3b93f8c27de139a7ca56a130a7278e67a

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations_retina.png

MD5 3feb97857185984114b913e69b24a80e
SHA1 f505c281366304869de4d1df0e03b1e664838b39
SHA256 990189ed603dc19743825ae5c864a9ec0d2ae0f19e28b26748750447a295ba48
SHA512 e6b967fab6f34318e4d8a2d81c81e096fa7908341e5a6e43bca71922f38700ef4b62ff4e9bba2a803b6cf0d95cf142ddcede76926f3bf09e3cf5c57e8f1d8dfd

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_pattern_RHP.png

MD5 6053714e097d18fcd96f7996b1dd3a91
SHA1 87d5978fd862c5bad7e2581b1becb04ecad2006b
SHA256 6fc1997f70a81789a40721fc6cea27f53d084b38f95cb450c61732955b43d268
SHA512 3fc6a74baf41f0724e7b21f76de22a032037abb597095e42b7cec52494db4f0bd655e9abc94313be43f810338ca2fdb8ece0cba78e3fd7eafa638ee6bf96c41b

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_patterns_header.png

MD5 79c93fce80ddc446a5578b5914b053c5
SHA1 2e5170a0abb619cb3f48c7e8770e9b426642e49d
SHA256 c4e4f4848e6ce86155f50c8cea063ab2a34020fed00fc79f2dca60e0d4fcf60e
SHA512 12a1afdf00b0ec5a7c6a258d2ac838884683f4c09b78d67d391737a69c0358693af7807de9cd5707943239b6eb41a03b6889ea93771b89bd5344d625fa0c5597

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations.png

MD5 73f728644ed184a938846d271e0566a3
SHA1 128e0dc4d5c2297ab48759172a4713500a275b7e
SHA256 c5fc069fb42fbe28054b1743f1969424716a9fa5a2255453615ace671ff6ace9
SHA512 ae4e810b2211b8518c7560e1263bdb7f8a368aba1379953fb9e99dbd7eb7388ab03c590a23a946c8795a869b64a7b6566447df5449b3c952917c10cfa135d393

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons_retina.png

MD5 ac817bf53093edfcd6402106738d9375
SHA1 1b0eba3e3beb1209a534620947f667818b51beb2
SHA256 1326cc6ef108ac18443049af73bf5307623abf448252393a6164b9fec0e7a206
SHA512 bd9cb2f450ed916556f7c0201ea7357f70eba9ba791a26c526583925b74cbc4b012f177e858c4745912628f3f37e3aefe6ddb79971dd3971ac643861d2dbf831

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_retina.png

MD5 9b500b3300ae6a3b0d9fdb6fdcc2a37c
SHA1 6d8d52209a6c33983d444a24c23948383ea204cb
SHA256 511961286d385a219401b15c714f7995e914c96e48fed10a5a2dc6ebee2f8194
SHA512 c6aec9695a3b267cc3fc2a75205df503829623e6317e20e5302ee7273dc46a441e56e38db6a9e89c55648e186d0fc2d4527bc7f6f23f1b3849a9a0a4d3b3c020

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_ie8.gif

MD5 327126a184293a8d837ca7ae8d907105
SHA1 8cfbff8b769bdcb69ad74d2c592d8a8dad5eceab
SHA256 88f8b5eab3943b95c109a080cf89b6ebf86e2fea56723a22fe827732aacbe41f
SHA512 00d11d0eb98d840e25a3ea5d345fa000078699951ca6727e68c0dc4ec133f1ce2963dbbd56990003ea2090f2fb87d42c1228907855c3ee7f45ae38988bb52af0

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons.png

MD5 263c6141c49896658921a3f80d2e9d92
SHA1 ce35a0b18d4607281ecf68af0b17238ad0e8619c
SHA256 a85ba6c8b979c1271d7cee3b0f669fe342e63fddbb2a6e403070c8c0452df7ee
SHA512 a490c236c50c668a8fdb8a68d77c4728fadbbc2504f7728f19ce66681e5eb7ba61ef87e9c59747b12fff37f669b291826b895365aedfb2c8b0b5ee2ba24db735

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\faf_icons.png

MD5 6d62d74eff75cc4b473e0b80fb0dd56e
SHA1 b970db4685de6350d7e7e3d18a3803ee94f92787
SHA256 2d1a7433e53e6810406753d2484c6ebe92a7b4c970d1140bf37d8949d457fa10
SHA512 1b274b2bc9cec678b8a1a938cbaf8e804367603d61df487044789eedb694f2976cd9240eed38dbd7dd22df751c546e3a0f41421611919d6e17cf2b1fe66a23cf

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\bun.png

MD5 0e46d8f41b8adf31017e39c34dc00219
SHA1 48ce4039e554622893439a5745e028170d5360a4
SHA256 a3c7e6cf0eb9d797d929524717393613c3924f2d36d02860ab9bfc731d01c980
SHA512 d69785e50f14bb232a71ec12c805736b70c14817ee296a5cfe0bb99874bf985040756f04be69b3388fd7e3851be273632fbef379371c3aa3ceadfcce6f8ed7d4

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small2x.png

MD5 595fe75cacb5d3955bd53e06800e8c79
SHA1 71ca996edfde3f105933fa16c5c3eb8add31a68c
SHA256 a090faabdb38c8962485995c584a293fb44b9ee7c2ca93cbb537c1f6007b2e8f
SHA512 0f0ce4f671a233ab995a6ac397dd27422c4900d844643d6bd196693b7d0ee7f122d9908855acaa397be9a5ad23953e36e25c06743097040d7bd8b8fc53e6decc

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small.png

MD5 dd77c587cfcea259682c3360647e2b47
SHA1 e8751e7acf235b235e710daa9d5e96230bcc6c79
SHA256 d04a82a3e24a3688fd00a0f4638a9eeaced5f1e406de39c32833ffff53889de1
SHA512 099a5f35e3960b80a6f80cf813811b5d933540dc50f327e7c917e6216030f11120bb46056f520f948b595cb0a38eedb87e4d4833b3947442cb877eeb1e789677

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons2x.png

MD5 20e29f1356ccd1f79569ab167fd889a9
SHA1 50886648a954ebe93535bfb134b3358abb630618
SHA256 d19fe335a37a04aecfe6bf9504f02b0fed32b3e85d55f503a149caa13fefe379
SHA512 abaea18b4f410e69acbca5b4cad1b862aa191ad1360bdf54f602e209117c272fc7d884e8c828aeb07e1a4198636d16e2bb5b0d1c16f02e88ce8fa71df80c653d

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons.png

MD5 15cc9a08d4e8d300f469d38137245ac1
SHA1 586fa86cb0cd16ae5f5c718ed3ce7f7c25dd5d86
SHA256 271cd77388f8bdb061b76e262c60abf700a0caa8e737e9bb1e5ad87dc11fe21a
SHA512 deafab68cb7b59e0d23225723bad1b07d9013115d7d3772107859eb33ec113b9ee4cc70f3b1d27f687284e258b897ec772f6eadea39c161c9238ddaf49b36a6d

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\nub.png.EnCiPhErEd11143

MD5 1aa9f76cebe3048e781ce48c5a00462e
SHA1 316b98a974e667fb033c2f7d8c82f2f82a2273f8
SHA256 62e5edb3a306cad5ba71de50b672ebcfafb1bac71c6aed1a1324d5ec3cbf9216
SHA512 8d70d0a953da6a9f37617ceb1fa09cd43d16f9d59d13020a2a5913c7f585b559f405652439b19a0a5702b2a09e2e395e7b0143c844a678e7968fcc0cddb03134

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\illustrations.png

MD5 82ae07276cfb1dd6610efc20acabb828
SHA1 06dbf43aa230bc6e61b5f685ff98a35bdf165065
SHA256 ea7c92c880d4ab842ab84412c7c7d77e62cb7b4533e1d727f8d2fe4272e4825b
SHA512 34d185735cfde7ec97d00ceeabe9a8e45ac9b5b61f9063d878e4fd94772176eb6b6ab675756508283bbe13b012e9532b5639e2c4b26b30b7396a7ce2b0e047ec

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview2x.png

MD5 74f61d8f008253893cd4688eb55eeeb5
SHA1 650815af04fba7130b119c1408e332ce8e1a98b3
SHA256 f73296757db3300fb9464f1b5bae24a26b965b7376b37f816f72cccefc099bc8
SHA512 a1126fb9ed1e9151df3166d4ee34ab69f075c225534126b2fc31f5c625e69e3d8dda36cfde13807575d855e35ef4fd73575648c047ec0b4a5017addb4053f922

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adc_logo.png

MD5 0f84e380f55c6950c0db7df7e152441a
SHA1 65be79d843a2698a17dc259b95acd561ebca7a9b
SHA256 d89b067af5b4d407008343d60ddc5507632eb81dd3c08a666b7b4e181bf98da0
SHA512 9dba069eb463f4b7f878f5693145ce2531b1854fff40126bf98829891fb76eeaeb2804a4a434031cf4b279585085dac81a3239aa72ec66942d406b435145119a

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adobe_spinner.gif

MD5 5cdf8f552e82772627182c67f3534691
SHA1 00355ee8657cdc1eb89dd5e85e6506ffc9b71f3c
SHA256 dea5cc9054d583c2872f0ba886c8c2ca6f44b7e45a9f5d8e794d88d6d81c8a97
SHA512 f04d8edf97973d4b44edc6c076214a665aa0e01a64f7a1ab9d45b94e20598474bac34babd077d74f632ae14fe553d81f9965add308ea33e246048aa5a86b7fe3

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview.png

MD5 83069cb8d15e62d71e0554aea35d760a
SHA1 ab19ca8644d27e417b35599d23b8749ddfdd8cd8
SHA256 69fb2006af21f44548b62cce35909f9d1ded52b508fe7f1359b3daab40d84681
SHA512 1f168f42a68a6ce0f5a06f1ed8bf7feedeaff237a27859c628a815702a41a4dba11ec5f3f860e8b8935150cca8af88e29bbd85c2a0dc48448d870198a812ce6e

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\logo_retina.png

MD5 c147c0a678e8414a7bce5b809b4b6a4c
SHA1 860924ca952528b23d30304ec1d56b7347ced2b8
SHA256 5dafce7ea7daae02931deca1df1388b894fcb86a7e5eb64cfbeaa5f068970a93
SHA512 f13af8b116734d0f188926760eb6b06c5e3351e498e3088b9374a75f489aa3cd7e7762fd8e25dbf608215bb7da7852c48c72e2cbabe3b117d5dab0f1a34784bb

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo_2x.png

MD5 e0d8a94c5587c0ec86aa7127572f8577
SHA1 b8ebfc64741367309dae96c20b06e3cbc9780af6
SHA256 2ef438a04191317a1a9847c0ce7105134a86d43d4da027fe82f1926077988b47
SHA512 80da7462bca2a7c3eb4091de88f83e9eb54c92e6641faa5d1aec07fcabfbf066152aa628e02b9c24f46ce8cb668b603efd1639058fe4e09acd7ce05948814872

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo.png

MD5 bf20e0d96e101ebfbbf7ef0f2773e49b
SHA1 c719aabcb17756c9c43f39cbe9456554c5284daa
SHA256 b2f7d77077008a4546c7bcf938a88f5a4de09fc0bd877a259fceef5337947602
SHA512 2af2136fb9159b8f9dd0e26907ed1a5005cc7f3228fef8b3d59bdc211f6cfb43cfb6f0eda058b8a996fe27c5036f515b4c3383910153c18437988040a31f1cfd

C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB_EURO.txt

MD5 59c8cfe69d4de8a294b47fe13019fae1
SHA1 9fd88ff9b4ab083605643d99aada9c0d2f1dd207
SHA256 f284a9f787cddc073e6a5dfad097ac0d63befa154b0dd1d7e242cfed2cf78510
SHA512 2e534e51a85f8e820830ef06ef54a01b5945341569d66efb68327e4daae08eceab739a0e468591423110ae297d5f0bb05cf1d0f20c69bbf0b9df3ae8f675c35b

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727668912544901.txt

MD5 d4842bd98fb9c14a1679cb8fd1a7df55
SHA1 19132e6f3b1f36fa63afffaba4b84434aea041aa
SHA256 99dfddb3617962a6b65e8ca268f4d835f82ce36b162ec4de053a201123a64973
SHA512 e222f5e91553e8c88ffd5dea84f00e7b9688b636dcaf009c1b225c6881a5c7c36c5c243fbf891672ce283b9a43bfc7f0fccbe74ab02107ee66ee02499f582877

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727663013511623.txt

MD5 0c82790c9d858233d19194f484657455
SHA1 0203ec595c846b6f220f8d1aef9af491b6ada190
SHA256 ef4819666e25386d1d1907a601bd939cf784115b474f924006e883a4aafd2313
SHA512 6f75d562d18d1a84d535105bfcac46c8de1010f5d8b114047d26d8867f1713f555a11d6af59fb69519e4743ef0ec1b682aa8d0a2b1fd5c248768aaf4300d1ac5

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727671578469739.txt

MD5 2ff5215e97029d21d018f05e1452df53
SHA1 717278a80e9c8af9ae7adedd170bdeaf51eaac2e
SHA256 24930321c5d747e5d5bbc2f65d46b2cf56d154d8e7ee4bd737b211090d2e6bff
SHA512 acb25d12fb7236bb82b64baec5f39806c1ef76180263fed176d100dabb4feaa50879ecbba10e35f4f49472addf553bc45e6a0518e4e22468a634ed9f4b8cc742

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727662498327333.txt

MD5 e814d6b3fea57c302caf05f1320a2e05
SHA1 1ec5ae94c0be3ca9ee1b78d59172ce2b32a9bbf5
SHA256 a06728c701ed2ce48eb30d2f90260f7d3e3adae4bc3e3ff960a03584bb2bd430
SHA512 e80cf7870b81747ce6d4cbdd8aa997a24a7dac2ec42cece49326b0764e558612c38a9158af81c7d7fcb98c7eba4671916c2653b5dcdc42d41d7c54a1f20b4f33

C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\File Explorer.lnk

MD5 45a6a9f1229bcbaf217233c75a4a70c0
SHA1 dfe6e97e40dd44e862c5fc5d1719e073b987bc54
SHA256 ddc44c97b43e69c73feb8827d03441be3789117920488b8d4430a6ecd2b92f67
SHA512 5fe18b3e3f42c0dac7352e3415e5fde89823e7c51fbf103f793f8ca2539eef6a63018275bf909ad8908d961ffc4597a04301381e1e4e03a7a458b53c1fda1b18

C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\security_watermark.jpg

MD5 de340a3af6129a5da8f93e82bc1e5ad1
SHA1 501e52987515a5bf14fb2020ab1a2c16c8a3acbd
SHA256 a70d6f72e7a2f997f6cb72015f483a711a3ad5298c7b73bc479833201b4bb49e
SHA512 8c85667186963b0cf3ac53a1ed3018498124b24ed4a495099b0ddc8c7b6e0537b001d897085cfd21992e7b97dfb3820599088d03c3bec57a5d10e79fe215afcd

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\gradient_onBlue.gif

MD5 a1b6eb2d14b70b137257b88f02a57417
SHA1 84bdacf035836fb2999057af2ed1fc8a6faad5ec
SHA256 2c723bc8457768d7e2cd8035a4d8ee57c85b495ff30d799682e86ab41a4c1d56
SHA512 58734f8b14f4fa1401a479ff0b738dbe4115b80a657f819e21ff4ddad5a26d7f48f547a86349b9915ab5de98f7596eacdd5da81d9da4253e8178ae915969602d

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\deselectedTab_1x1.gif

MD5 44647f7c081a86281959b1c4c91bb856
SHA1 ffca7d79ec78f43fca587b57dba711083c6ad161
SHA256 cbd20d8ca2365ca9ea0138144c68eda3f7e89d9c9351dfd79e2283da6ce69941
SHA512 60607fb93b53b782a1198020d05dd419037ef15de2bca1604f855ebfd4cd7dfa4550fba99f8e4c755cd79deaee395eef1999c5cf4ab2a9ac76935566af84d03a

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg

MD5 13ff81d5bdf2b384f875d27a11e2a8e9
SHA1 f5d2c43853221c5266d25e1d64fb1fe94678bc9e
SHA256 0aecdffafc8fa132c6214717f590129a06d0ba03710aa9f493975a9ed23bcece
SHA512 9e849f80fafe7e880eb3fa061b16468f248afaea41fd16cecbf600f5090e9b85382afabd5918d49dbb7e615863a7ac7fb3362e813e2ab346059049c4c46e309b

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\branding_Full2.gif

MD5 0ef71da7951b4a0c13c799fb934bc428
SHA1 a961a87c3cde6dac32b1b2fbee5eaa4243b7d902
SHA256 c54931b274870c7ab1c2ceda029723334cc74dda31356d9aff8fe242f58bf296
SHA512 525d45e7fe6b7a3ba1062edfa41fa6a13e7250d9086fd6a8accf351853e63632ed71c8fddbe18181880fdeebe684b9df77582ce54ec4cad373822ffec0448cb2

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\aspx_file.gif

MD5 3e8789107b6e614c4a1baab089405197
SHA1 42bab6d328cf628f7a3f07abd3fb4971bdff36fc
SHA256 bee099242bc4b3e799888d3671013b15404ee64761c11b3579c6c743a05c7a2f
SHA512 30c482cccba5e63a3881eb1804a5557fe9ae0c3ee2d8afdadd3d09dd0361cfb36fa017084b2dd3180135d6f5e9046ec75211881b5564ea622c75c476f29a76a7

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\yellowCORNER.gif

MD5 46ab9ca5a11646c5b589970212af2477
SHA1 5d5a1d557d4b65303b61aee709533054e12c9ab3
SHA256 e9d7807a679bb51ba8d681a106c2aad6f7d0be035c5fc44b4b272aded5a3fe46
SHA512 2bca78c286d8be8543fe70cecd3b87fc35c23bf294f5313f052e7412e9c91c398b82f34f16fd4b4df39ddb54fa73ee651646786e6d7149cbf425bf0e08d33b4a

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\unSelectedTab_rightCorner.gif

MD5 7e54074aaa15b5f63d9b88c5153348da
SHA1 ca3c0941f033a2c35a3b3fdd82b6b907d23789c0
SHA256 e8748137a9fb21ac7633860740f4d4c9c46d752c7b5732c3e13e5d869baf8b87
SHA512 31bc22cbeb5b09b02365fd42d46981d0fd0593d00c2516151ce554c109c507c88c91785364a17851ec79cfd0fd3d13890f9e2d79e7cd8bdbdd78af4f5ac2ae00

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\unSelectedTab_leftCorner.gif

MD5 cb23dc69ffce4f012a71083c4fbb6e9a
SHA1 5eac6b7f5facf0a085501aa642e550865abe74b6
SHA256 fa7066f7c2843d80180ec71a9a2ce782078f60614306802c43058d33ea83505d
SHA512 df6b2bb57c3c6d74951b9a7fce8eb147af24cb721feed0d28eec7423991b458ac26d4ee9cb344eda3d753c4132b6f417a8dfe09dff2adc8c6ae14b0b92dbc848

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg

MD5 0e3a040b42240f678288d066d8a97800
SHA1 10bc1c2ad0e1407c4736934c7da8358def8a8481
SHA256 bb39e17575a83a07e2a00f067cef1c43ddc689f803575270cd635e80b554955f
SHA512 f01d225ef120a1e0aac4d78484a73afaf480ea6b7f5c9f9b635a835cc300a3136d73954cb1f9373637d4f72ea26e79ea70bdc671807c8103651c1c419369d13b

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\selectedTab_rightCorner.gif

MD5 d5e045fb5dd0729b4483a2cc68e119cc
SHA1 573c38e4f8d5460b8f4aafbdf13a395fe6dd0cfd
SHA256 488e1956771a51fcb2278cf02919d590e5f7112e6e3380a64a410735ccdf615c
SHA512 a30491382dc4e64204c3b04d11aef3fc3ae3f62efbec452fe607f88ea86991ac94180a4e107cc670bf205b860cba3d0399a77efd090f3f1827256c2eccc768fe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\selectedTab_leftCorner.gif

MD5 291c51d898fdddd815a5ca2ee60a4aab
SHA1 48031b58a79467f338c63b1f126772168d72977e
SHA256 1cd77037e7f327dd8de99e699969b4536ff9a3060f921ab6230a15c61067738c
SHA512 e21248fbe0835ceaffb3398d0a1adf42164f76a36fc115113f3b30c7b21c880dc297f74f83fe3cc693205e347160b2c7e4cc45b6970197bd24dd9b49d7a2389b

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\requiredBang.gif

MD5 b3733f1d4b5fad7410f33a4f0e274c76
SHA1 a6b745056c5fe101a532ae78220abc92438f681a
SHA256 ae496cf92e9dac7d69207ea9ff71243b09ed4b511a3f4c42aae67f0726dd292b
SHA512 ed0a156a592c1659cdc41ec1c436d80382c90510e3c4aa845719682c9d68ff1d368f8f2b9349d5808966b243f2dc10e7514f671b5baecca507b3776c3d8abcf0

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\image2.gif

MD5 01884af8c2074eb4664e93c42be0c93d
SHA1 5ee8415799454557a6334e07f1c5a76469ca5a99
SHA256 3a92bf9369feec1173c414db31f16983d4279edad50b529026694d37ebbe2ee9
SHA512 3d060a6bdc534eca9abdff616a4086a51f9a0dafadb6cd570ac8b4812595e248b692cda6a7126439f20d215e82a00b84e435e11d65aaa3163183adf41a850197

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\image1.gif

MD5 87b2074af5b620f165853015075b5ef7
SHA1 af97d9add98600ad2c6f608a7004c903fa9edd2e
SHA256 81a8504ed8398ead9bd8bcf1e90958077c128c83a228158dbed9bbdc52ebde27
SHA512 e7a820210f4e6fa3bf59e0b99019c283e84436d2eec426e7fda334b62032c2aab8dcca2ad278c52a8022b1ab922139635dbe976591a06f9738ba8fbc2f1e8c2c

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\HelpIcon_solid.gif

MD5 264b6101e6f7f1c4be9de6ee8fa60c29
SHA1 6b61291c0b7ed4692d89501f3868b3a09502f142
SHA256 f361bb54f9756c1c1c5d4b1627d43ea0dbaf3c42948b3339fe702def8bfd5c18
SHA512 f99ab35df95ed62c0314ade5ff13135693ad029df7b4562eeb4397d85e4709374a1578d5cf40b5991d0edaaa258ae1ff53c18f8339d1a20eefaca94b24990aa7

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\help.jpg.EnCiPhErEd11143

MD5 545a065171f9be5253d58d51b587bdbe
SHA1 33a8fe2f35ac143a63b9282aea872bc9d6c85748
SHA256 5b1b6ea40a5281423373436acc53e3b8df175edf1c81b93e55abd934fc7eff3b
SHA512 07309cf317d5f77bc4d788ce5921b4665691819f51e827a28ed013ceaf6bc82027f3206f27cee9e1773982a807768d9a836a632be5f905e4481aa260b82dcdf3

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\headerGRADIENT_Tall.gif

MD5 b850130ae4630c5bf156219bc1ee6148
SHA1 ec6dac370e778b1e4f5383f4663e6e9b3d91e5c2
SHA256 4ad35c5a730861d715b5dd886a714c0ce33656a59ee04ea15fe13c39804fec30
SHA512 97b7ac139f481dfbd082561939183c60ef69ecd22442227fda253465f27943336c4a3d2c6daed270d469a313f108f141d56d5a9f8223dea79ae7ce92c0e77a27

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\gradient_onWhite.gif

MD5 dc274a295d0762bd50961c0dab7d3aa2
SHA1 83a558c45a68a3cd7f8cc6b8f98a9cbce1523bdb
SHA256 9e27f2361b978796d31b507a9f76742cc1235657c580f449c3f333ce9ba644de
SHA512 a8784cc65e660da3ed68f9bd4422aebea5683bbe22e811aa315f202920cbbf9759a313cee7cdeaf70b19c7d80f2570cd85f85045bc49b7df692d66df3287a71a

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\folder.gif

MD5 e0d8dfb419d49653d70ceaf50c50751c
SHA1 f033a255e36814434c34443d3aa69821205580b2
SHA256 953644536739be09f529b5fb7a0b31fbf0a95f22b4eeeb2ac3f2dc9a76ef06a5
SHA512 0cb316e7250de0ccc97c17777b7d6db237d128284eb438db98176ab50b480796f30fcae5e5693b3b6a816d3d5413a722c6b10b4531d19983d06093f1058b6f27

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg

MD5 29d62be6286124ae2e1bac1865ee9210
SHA1 098daaa26f328327d9dff8fd1f96de1d797868f6
SHA256 6f05eb80e2d07c57d31f7f8672b85a02111f6a4bdfe8357c8d571504bde47715
SHA512 ad2f5182f42262204b58e8232bacbb9cd910cb1dfcfe3a8fa4949a8f9e1b12c9e387f2837a1761f85d4db27e5abdf0a253a522edcea4d9ad62769076bbe5ce5c

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\alert_lrg.gif

MD5 753a35716b58a88f72cce92246765f74
SHA1 b8e4e087c5995b8ca9ceab9c3dd7f7dac6ccfcee
SHA256 91dc47ce82cfa9e0301026d0eed6650df5c9f75074d02cd4f9103ee23f24ea26
SHA512 9a806d453b14f044d2108f08ef029416bf9f613d46a1caa89c6d2ad49eaf5f3fd7ceb8b27afc97e483adaa875ee1bf25a66912862275b2cf0a6db142678c11cc

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\04-1 - NetworkStatus.lnk

MD5 00d3b4a878c127607159ef506e3e72fd
SHA1 f6a1920942df85597870d2ea5319597479192814
SHA256 5c974d984584a929e625d4ccad597eaeec5a54ee3d4b59dd1dae356415a10656
SHA512 215e54e3fd1b3bbacd631e0ac56aebe02ea985e02243054401d63048e51592b67268f0f5f5be09f91a6e37993a987a4e98309ff3766f9382757b6eb281770a1f

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\09 - Mobility Center.lnk

MD5 e988a841f17cbaf9d51297c1cc253464
SHA1 6573dcf4c6ebb88c85442224c554200754b1c4e5
SHA256 cc27e4435a80f43b7cfc7b74c502d62f244bf3c804edb7a7cbc9585847dfe63a
SHA512 4905d2da658e692ada2e10677059cf8012eac29bd12b83a5424c9b17d3cea875c78901243d5ef6838aabfc77049b96b9d8806b7551d56597e2df35d52f684ae1

C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Magnify.lnk

MD5 a95060b62aa7c0f91ddc80b249aa5947
SHA1 ff5f8c08e5cdfe6f20dacc666a395dde9ec2592c
SHA256 9b8c54ea4a16c4b150d46f5cfb8837a4d4c0809410310d2ff3fb29e1829bc33a
SHA512 34f2c566422df27bc1097c680ceefc9880b32381ca5d93ae40bc3237002fab4534accb70da948ecfcff9a1d52c7493dc5911ccd7dafa8c57d0e46d197c402f64

C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk

MD5 54040d5552af71b9985867781ac61c80
SHA1 e120e8a285c8b430a808343979984717d4190d41
SHA256 ad710d635122ebf052783252dc7ab1c512e6a85ba7ecebc3297a099fc7fc811a
SHA512 998b97265246cfec08e76ff2154e506844917788d762930ce28ff3563097b6ebd6b310237f2e33a88632e729ec76b94773bbe5a230399c419e70e8898cb3ed0a

C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Run.lnk

MD5 0f3988085e51c8bd5855c4b06fbea7ef
SHA1 a970e39aeb9ca53a4fe56398de9552639342e90d
SHA256 f169cc48ea4dadb7ef9c6176eb7037281ccdbd9a384a8e5c78134abda799e87b
SHA512 c9979d3bad021e553eef78337a6395ac5e99076292c6ab163e3215c98617d6c7193f9ba4d48d377ad33db8f560f097c4acb8be688eb38aee6c334fc622cd995c

C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Control Panel.lnk

MD5 5388857397f02588bb440ca0736c05be
SHA1 29f92977a91edabd591b76bf72d7d42c4101d9d6
SHA256 de59b840a89398e9c5fa1456dea4ae38bc0a500e43d871fe46a99394dead564f
SHA512 9e12cd8d06e976c8b3b14e275890daad49acb3fdd46cafd092209f3eaaeadb6a98fab8fdfe82ea5e98707081a85a5605c2cbaba2c521503338a740768bf3623b

C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\computer.lnk

MD5 01ba046042aa3e9fce096fbfd761f608
SHA1 844d665f72e74fabe774ffea09b8daa5101fabb1
SHA256 f6cc03497830e1336df72fff7b39aa17db29e684a8a44603daceb8a780e9200a
SHA512 e566a77ea371e872401e46d6b470cbe753dee8953b92a367d10833420c20a04fcb72d0f8daec52ad8bff023a636300d5d95c56a7cea9d1226f65d8d1924d408a

C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Command Prompt.lnk

MD5 1afee79cf941981fd5b1d2c0d9bb25eb
SHA1 880d71a96c4abf019232d12e389d48959b048762
SHA256 b0459ef2525d1f6eb32dc748d2bdb9f704b72bfb00ef5c4e88d265b087bafcee
SHA512 baf756c0c2b7f3713ba74695c2ccec5acaade27ecc04f2dc4adb465fcd941bda1b218753aa9374a3285298efc4b51dc7d14d69be231a1fbd8eb235851f3312ea

C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Administrative Tools.lnk

MD5 2d216170bd615e9163ce904f79ebbcfa
SHA1 8c095a2b30aa0283d1cde63a7e32f1e1cdaddd56
SHA256 8b9526721ef4cf31c711f721e37999a205fa4dc56d4dc79bfa1d7b311e106dc6
SHA512 a42f0c29572bc31c3d0a14958f183ddba4111c4274a473680c9d2f6fe239fbc99eb381dcd11c159d8d2fe087940943bc33cc129268a81c783cb362503636409f

C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\On-Screen Keyboard.lnk

MD5 8c5553e7a3bd36bacb1eed5aa7988286
SHA1 e8e4b4f7bcd7ab9e6ee6a5538236b7f484f40b69
SHA256 6ef9f2bc273207eaeada599a79c0d83819437e938b2044244f003058d11e5f91
SHA512 195c98a15a773e9a05b5ae26e75a7f61ee6a7d7e70bfbf5b1475596ca0fa78519bebf557f381217f7645e94d552fb48ef64d6bd727c2a46642f80ee422fc4d02

C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Narrator.lnk

MD5 725eda0eaf751eb15f3d779552865b5b
SHA1 b969825ad80f923c1ead4a38e7bcc3b0a4fa16ea
SHA256 3736a73b4b15c62c350f4361014bd3311c785ce118372abd21e6eed8ab66faf8
SHA512 d8d9dc6d3243c1ee26bb3e975693cefb7bfb46d3b3065c60a31f3117cb2ec703bc4669d349412cc7be4b80d762f03545a95c3fa14a0b1dc336ab0a13fa4117fc

C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk

MD5 619be08e2060d4923849b4089172428c
SHA1 69c5e21f30d58f58b85d308606404f0124d2dd97
SHA256 3bc6b058ad8d03c8a477cb8647bb0d2936059e500ac6c707e656c8f0fbd55829
SHA512 2c6cf62804344296b64492200d0f286720ba70e1e67f232c4250996229e5934c1c2dd4e68054e0c806a6019532dfd66cb8d54b060e48a387c76965c8af6d109d

C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk

MD5 ab167799050fb20a14a92f498aa115d4
SHA1 782a1be526a8ca69e304dc24838f26ea8fb5e874
SHA256 f6a80e132f72462bc2f3881754104996ac225b5b7823a34028731f3648620c55
SHA512 ee1e29f80b79f1b079bf512fefe1fbcedb238fad5df3723858cb0fa7388b34ba73a43b17e3bd3af84bf1c5ca267cc2686bf1a18a7d213764e69ba469c60c6031

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\10 - AppsAndFeatures.lnk

MD5 93845dbcd7f047f2df603b1d782f2968
SHA1 6ca981cce3103ddb01b87a0860b2fb3046205707
SHA256 3a7feca999e0e446961dbaa5ef764362bbe8ed79db55ff32b1e733248db0e2a1
SHA512 dc5b259f4b1115023123a1d2fd6e8273e142795b59c29031a2d811fac89e8ad4d8d891c358574efedf8e70d8ade0d668858f3d3b37ebea0eb02a36e521e36fad

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\08 - PowerAndSleep.lnk

MD5 9534152d0194ccb8c5b7b6b5594ad464
SHA1 0570834ff4b1403e190ce69ad4429f560623499d
SHA256 37ea41544f1a20c19d869f3afd7c5a690d575e2524960476d6a9d41cae55a294
SHA512 7b597b9a32043fd26c463ca839cfd0b6dee3366174d059d7d87962c6fbc2130d730f365cf4b2945e2113c5aaca4323cf00c10440bbadadd30243f4a568301ecf

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\07 - Event Viewer.lnk

MD5 6814f99c313650cc32a0bd2cef7ab578
SHA1 6075248ca9d99126b90c215468bb1324a764a208
SHA256 d35418ffc565866c7747de3bb059626bd03454a02bd9f0d647c9c745976b489f
SHA512 17be7585e841aef01dfee6e630a124663015b1617da5061ebda03fdf57cb6d42f6ae6a551240ed05bd26b5c59aa6fbc35a86043c1932a175f534d21b54d92447

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\06 - SystemAbout.lnk

MD5 fd7669b7569b957e6a9c08680a651939
SHA1 ecd56c43ae6f4005610dfdbf418f87ebf683d090
SHA256 386117319e5299e609961f11da8f8ff68fbf2e656dbfedace30df70d00a588d5
SHA512 fca302e3bbffb025564b2f46a851d5137225b2c9078cd19bd08dd048578a0cf754dc3c7b4c9173105aeafa7fe9045c5ca95510e11a647887e13c498792fc0fde

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\05 - Device Manager.lnk

MD5 199d28d60bff377d39881cd2946c5c25
SHA1 0bd86d613d442976c335ec7a29c6e5189f9b5003
SHA256 7a8b5757b6c06819ee5632cc2dca78aa4fcd479b216ed6c9b4944f290c4a09bf
SHA512 c7bc2ba88d1b51d68dcaafae850a3ca8f98d6ddf7d482d4d0bb70cb72cc1f059f58d5396224d3c85e4ea84a888868746f46d2fe1ed9d1ac488beb8c42025aef2

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\04 - Disk Management.lnk

MD5 bd7e6553c4cb4723968bd10b3ec883c2
SHA1 e132e85a158773f5de05d81ddec7b7c9a30df0e5
SHA256 f862d6216e158f6729fa667e351c0bae6f9250358baf8c117f093e16612ab5a4
SHA512 ea6109b94d058fa627cea325b39771061ea18fde1e85483cfd64c023502f63b7ff2f78106f595ac6d2039ad7d5b34adf7da59a2273ae8acb71af023afb09c9b2

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\03 - Computer Management.lnk

MD5 44e6c9e5cb29cbb2a828648f72a28a8c
SHA1 906435054ff5e9b08a4fc6a5dc7d2509ff9ae241
SHA256 27a4fd7e08b1e454984ed7a920c65bf015317e364cbceed641b4bd9160545039
SHA512 eed52e9350bd1cdfc500ea825239db2c748446d1fa0bb386edf5860123e472a817156f3c18d4a782a7d847d6848dd7f70e08f7939dcc82d29db8d69703806652

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\02a - Windows PowerShell.lnk

MD5 86de1763494af9be46256560709e2324
SHA1 aff672b9c1e1ca6f1d8524c233c0e57625f2b4b1
SHA256 f09a2a15f74fa756a88b15c7772ef4c19e199afa192e7903f55132f9879cb8c4
SHA512 4045f84a414e177b89ab94ac5ac4750c9627928baaa08c06febdc5924968dea0dd2949fb51633bc7a520cc8d29d18b0cf60fcabf639ac348f42c8af4924a38bf

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\02 - Command Prompt.lnk

MD5 efdc121896c39949cdc67d3ca8b80393
SHA1 3633a738374927e81c7e6040f1bfb7a73de3372b
SHA256 f98a04712ed4b181cc5015e0630fe829ecd1d15d07f69962eeb3607e6accb3ef
SHA512 d2191d762f6e297ba381f0974228749dd611e9c34bc01d0e086d8b49e58068cdc7044462c1a3700dade9a06160205855852855757e6c526c70bfea3b5e08d869

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\01a - Windows PowerShell.lnk

MD5 217bee7e7158b2ea8e510cdd60ed4262
SHA1 39c78f693a2cb052266234ecd500ec72b6f72948
SHA256 db860698e168b4d8026287c02813e46e54ca509a3b4d0193b49f241efc71aba9
SHA512 c7563008f5e401f35d039ec289bd389e7f1d1feba26721bf797d21fca482c1c1f4691c0f1856fca2a237af6652f909ed786641def99888497df5688e265bd54f

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\01 - Command Prompt.lnk

MD5 fca1ec9ac2483dbf37828b4c9f1209c8
SHA1 feaa5586ffa813998f26704fc3a0b561accef911
SHA256 deeef980cb657ccbddb05f464a49d2aa8ef1be1259879c36ac31265b2b8a6c56
SHA512 189ff029c202528221cfd99061da8c9b270a8ed4246a8c34b7c844e13511adb9b7f2e3ddaf60af752a0ced684b1edd491a0d02dc1c1b338f2a385aa50f9abbba

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\5 - Task Manager.lnk

MD5 cf6b604be1114dc22facce0ac83de336
SHA1 2c45ed7f97d97b288545733dd7d291489ecf4eec
SHA256 e99f0b1d8bbea3b3fa521e24f582297f99ae81d7cd5399a5226582545a119196
SHA512 9901ab3fbf6eace40820bab1a8e8854d5ba82b98a668bf831f238005b774837a7c7ec72be4c0dca162a552701538a2df2a89e9edceb5bb5f9cdd24850539a625

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\4 - Control Panel.lnk

MD5 4fe1bca1af96af3df213fa4792fe8fc8
SHA1 cf9da90cdc82452c67c1028c0b3316a72c400f9b
SHA256 0c7ee59618188fcd01fd10b6b9baa0089f54a15b9123cc476bfcec7ede94fc35
SHA512 667e78c0c6317894be6082330529ead1012b6e4a31928f186add6e84113f81dbf2939f7e39414c7b63584220f31341a764ec8a79e7f80c628916661e9a296092

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\3 - Windows Explorer.lnk

MD5 3cb8c7130545739348a909fd71671d7c
SHA1 4f0c4a30b45b587c0a8c72213a994b85cb2485f7
SHA256 57dd706226f570e8714856a4e7be2403452404842932728f8be362579e833aa9
SHA512 94161cd9be8ad61a06b547d6f75a1eabb99b30c90abda8aa7ddf785282c29aca4b4bb5df220d3c30f00d2b7f1124ddde4eab5f7dbbb09e6cfac407ee54a5ca4c

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\2 - Search.lnk

MD5 b36bde6a10978d8362eef8782b6bd9d5
SHA1 e093c15de36454f14576808ef66a3023ee62fbd7
SHA256 2d51e2001aacbff283690073582b997cf18a97551354c66d9c7961a6d97dc2ea
SHA512 7fe90f2c7897d2c31fe0ea3e25ad6ba4b3225a8caf94ff256f4dce2b6ea3836ecd3c40e02f0aa5dbc93f3e1d802b3092d097b004de88f5389d70033a697367e9

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\1 - Run.lnk

MD5 89ff6d8d522f58d12ff9dabbad1998a6
SHA1 3abfb872a5128dd3e1a9ea2979ad4eabcd44db0f
SHA256 5d6c5143e2b3a36d71b871d1aed1c5203cfea5240c2fa5d6908cd1c09a6f3714
SHA512 087e17822c2696ebd1065a398fe4c7f3f361752a86590df3ed24742f4f2c8bb258608ed603a2a96fc0b6a4e5e69dd01c31dc924b9edec4290f25ed36dc52269c

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group1\1 - Desktop.lnk

MD5 4f838761189418d7a8bf9084fe5df818
SHA1 c0c38e29994c3c7a5138431aa0a2b50221db89ca
SHA256 215f35b1c77372bb6d23b91cce320e58e269650c3894da0955e1fcf3be5ec0a6
SHA512 60ac8ed93a11c1cdcfcdadf41128c6f3b0da6e7de792abfc089965d943f524709a1e526a21de76a93b81093029d6e6bb19599b403d0cb0eacc37c06138920a26

C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell (x86).lnk

MD5 67dbcfc90b4e87e0d659edbf4e156bd5
SHA1 adc29f90ce7083a362c82d065090b7d1677226c4
SHA256 478571bf16bcb02821fda2e5ea9633982df8a5055e5796b3953ee7cbd0ed3659
SHA512 7fc584fc8000aedea510d296667daf58226de794e191654ccae8ccb7489093fd6bbd3386de0098582e47dc7f6ea4e144dbb55a852ea5daf6c168e733487bd5f3

C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png

MD5 41457526b654eab641eb608226d16382
SHA1 f3005459cff98e226e92ef36330962cf0eefe9ca
SHA256 441420993e159fcc01e12cc85ac1656d4ba25480c56abb04561fdd6ed1698324
SHA512 19ed713e6ba851bd379b14abb3c20993c439e3fb5b700df02609ea131891598d0edcb5aa6c79651e5c5eb43a4b07f36b908aaf4ecab52a45108ddce35883de79

C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_contrast-white.png

MD5 0843290b46e5a518a613825a8648b4b7
SHA1 adaad9eee7f0b2f916492569b51f85fafb934705
SHA256 69340f7aceb09607de336223b453d873739d5abcc20605423b8f2fffacb619ec
SHA512 0eb6e4094830523416583b5c367e56450993dcbbdfbd502caa44ee248eee5ba20ac6d952bc2118e8e3d85d0b00421a66eb30fdecb1b0b6bb31e8636e38838ede

C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square44x44Logo.targetsize-44_contrast-white.png

MD5 8c2348d1ed47dfb352d233a45fb85ec1
SHA1 2b098ed44dd9d7190877e2b4116322d678a36a60
SHA256 5b81a0c8479c0db6071dd684f138714081b261e3f2b610c3105756739fd046e6
SHA512 21d2f1e6ca91b1cfa3081e8c8b3031c4f05fd151137c9d79ccdb0625ab54cac2ffad3dba04a57ae92d806200ebb0c6b59962ab5e2b9912d69534f208cc1dab79

C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png

MD5 9a3a822c5f432e087836b0345d7de4ca
SHA1 94de3ae7aed97d1c8b4b97bcaf63135d2cb79f69
SHA256 6b554d0a6dd35dc9d51c062c98e8acc70b2a6496e236f4ee87ddca1485b0ab71
SHA512 3ee71ab2d42832b4417b88658d684d4155695fef6709044ad9b8aa14666e719ead833bbe08d5f17a6bdf8df691436600cc652e546019a630746c874639519a80

C:\Windows\WinSxS\wow64_microsoft-windows-onedrive-setup_31bf3856ad364e35_10.0.19041.1_none_e585f901f9ce93e6\OneDrive.lnk

MD5 9349be02c01666356695774e53d7a093
SHA1 a2114a1bf7b9ccbc0a6c25916922d4b544415560
SHA256 5dc96255a75c0801501fe9460745a96a0d5f8cc4874d1f84367f42e438b3fddd
SHA512 b0f1b67f72b94bdd85afff66a839fe4e864de390e7db973a6aea0b5e4344670be0baf678310b415569600c134ddbe6954498dd2cdb388c55d94fff1143a315c5

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-26 14:22

Reported

2024-11-26 14:25

Platform

win7-20241010-en

Max time kernel

71s

Max time network

125s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a26906c09acbcd300aa4a7f237249282_JaffaCakes118.exe"

Signatures

Detected Xorist Ransomware

Description Indicator Process Target
N/A N/A N/A N/A

Xorist Ransomware

ransomware xorist

Xorist family

xorist

Renames multiple (2170) files with added filename extension

ransomware

Drops file in Drivers directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\drivers\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\SysWOW64\drivers\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\SysWOW64\drivers\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\SysWOW64\drivers\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File opened for modification C:\Windows\SysWOW64\drivers\gmreadme.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\SysWOW64\drivers\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\SysWOW64\drivers\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\SysWOW64\drivers\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a26906c09acbcd300aa4a7f237249282_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a26906c09acbcd300aa4a7f237249282_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a26906c09acbcd300aa4a7f237249282_JaffaCakes118.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A
N/A N/A C:\Windows\SysWOW64\StupitHack.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MD79PFRQ4de5n55.exe" C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A

Indicator Removal: File Deletion

defense_evasion

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe N/A
File opened for modification C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe N/A
File created C:\Windows\SysWOW64\de-DE\Licenses\eval\EnterpriseN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe N/A
File opened for modification C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe N/A
File opened for modification C:\Windows\SysWOW64\StupitHack.exe N/A N/A
File opened for modification C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe N/A
File opened for modification C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\ph3xibc9.inf_amd64_neutral_ff3a566e4b6ba035\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\prnbr006.inf_amd64_neutral_f156853def526447\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File opened for modification C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe N/A
File opened for modification C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_History.help.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File opened for modification C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe N/A
File created C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe N/A
File created C:\Windows\SysWOW64\StupitHack.exe N/A N/A
File created C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe N/A
File created C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe N/A
File created C:\Windows\SysWOW64\InstallShield\setupdir\0c0c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_script_blocks.help.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitsTransfer\fr-FR\about_BITS_Cmdlets.help.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe N/A
File created C:\Windows\SysWOW64\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File opened for modification C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe N/A
File created C:\Windows\SysWOW64\StupitHack.exe N/A N/A
File created C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe N/A
File opened for modification C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe N/A
File created C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe N/A
File opened for modification C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_remote_troubleshooting.help.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_Automatic_Variables.help.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_Core_Commands.help.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\SysWOW64\StupitHack.exe N/A N/A
File opened for modification C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe N/A
File created C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe N/A
File created C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe N/A
File created C:\Windows\SysWOW64\de-DE\Licenses\eval\ProfessionalE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-shmig-DL\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\prnca00f.inf_amd64_neutral_777b6911d18869b7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\prnlx009.inf_amd64_neutral_d4b76afd08f308fb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_PSSnapins.help.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_Ref.help.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe N/A
File opened for modification C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe N/A
File opened for modification C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe N/A
File created C:\Windows\SysWOW64\lt-LT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-Sxs\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_Session_Configurations.help.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\hpoa1so.inf_amd64_neutral_4f1a3f1015001339\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_remote_output.help.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\SysWOW64\StupitHack.exe N/A N/A
File created C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe N/A
File created C:\Windows\SysWOW64\en-US\Licenses\_Default\HomePremiumN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_Continue.help.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_WS-Management_Cmdlets.help.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe N/A
File created C:\Windows\System32\DriverStore\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe N/A
File created C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe N/A
File created C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe N/A
File opened for modification C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe N/A
File created C:\Windows\SysWOW64\it-IT\Licenses\eval\UltimateE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\SysWOW64\migwiz\dlmanifests\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\VideoLAN\VLC\plugins\audio_filter\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\button_right_mouseout.png C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0178460.JPG C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\WB02214_.GIF C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-last-quarter_partly-cloudy.png C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\CORPCHAR.TXT C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01237_.GIF C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Oasis\HEADER.GIF C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\hr.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Program Files\Microsoft Games\Multiplayer\Checkers\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.es\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LEVEL\PREVIEW.GIF C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BrightYellow\HEADER.GIF C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\Passport_PAL.wmv C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21335_.GIF C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR37F.GIF C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\NotifierDownArrow.jpg C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\it\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\an.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File opened for modification C:\Program Files\CompleteRepair.odt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATER\THMBNAIL.PNG C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\icon.png C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\6.png C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00130_.GIF C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\BG_ADOBE.GIF C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\bg_Premium.gif C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\GrayCheck\TAB_ON.GIF C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0315580.JPG C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01304G.GIF C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\J0115839.GIF C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\en-US\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\timer_over.png C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD14882_.GIF C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Program Files (x86)\Windows Mail\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Program Files\Windows Mail\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382926.JPG C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\SpringGreen\TAB_OFF.GIF C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_right_rest.png C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\settings.html C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Stars.jpg C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EVRGREEN\PREVIEW.GIF C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\rings-desk.png C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0386120.JPG C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\OutofSyncIconImages.jpg C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BrightOrange\button.gif C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\trad_s.png C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\images\delete_over.png C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\WB02055_.GIF C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\groove.net\Servers\Management.cer C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Stationery\1033\TECHTOOL.HTM C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\16-on-black.gif C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0309598.JPG C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\winsxs\amd64_microsoft-windows-l..epremiume.resources_31bf3856ad364e35_6.1.7600.16385_es-es_aa872ff79993c5bd\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Globalization\v4.0_4.0.0.0__b03f5f7f11d50a3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-cryptui-dll.resources_31bf3856ad364e35_6.1.7601.17514_es-es_61539089b51fc4e0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-s..ordinator.resources_31bf3856ad364e35_6.1.7601.17514_it-it_c8a2cc139113dac5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-s..vault-cpl.resources_31bf3856ad364e35_6.1.7600.16385_en-us_f4cd822e26c1b353\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\assembly\GAC_MSIL\TaskScheduler.Resources\6.1.0.0_es_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_c02a16e1ae17ab94\about_remote.help.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\inf\ESENT\0410\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Workflow Foundation\SQL\ja\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-i..tional-codepage-870_31bf3856ad364e35_6.1.7600.16385_none_2adf2efab4e0d9c8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\assembly\GAC_MSIL\System.Windows.Presentation.resources\3.5.0.0_it_b77a5c561934e089\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\diagnostics\system\DeviceCenter\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\winsxs\amd64_adp94xx.inf.resources_31bf3856ad364e35_6.1.7600.16385_es-es_7d1934d0258df2c9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\assembly\GAC_MSIL\Microsoft.Jscript.resources\8.0.0.0_fr_b03f5f7f11d50a3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Xml.XPath.XDocument\v4.0_4.0.0.0__b03f5f7f11d50a3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-e..gadgetxml.resources_31bf3856ad364e35_6.1.7600.16385_es-es_901b335e29d329ab\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-g..-currency.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_5c4791cafd126e03\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-i..l-keyboard-00000843_31bf3856ad364e35_6.1.7600.16385_none_441dca567d53951f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-l..omebasicn.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_1a7b58bf239bbd92\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-processmodel.resources_31bf3856ad364e35_6.1.7600.16385_es-es_a119d2e3a5767adf\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v3.5\1036\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-a..iles-help.resources_31bf3856ad364e35_6.1.7600.16385_es-es_ebd6917fd6440ec3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-extrac32.resources_31bf3856ad364e35_6.1.7600.16385_es-es_67144e9e0af59827\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-enhancedvideorenderer_31bf3856ad364e35_6.1.7601.17514_none_edc8831ae3260955\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-openfiles.resources_31bf3856ad364e35_6.1.7600.16385_es-es_d513f7ac93221150\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\assembly\GAC_MSIL\SrpUxSnapIn.resources\6.1.0.0_ja_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Pres#\fee2bbfe0b8f5988a3ab7a9db85c7a30\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-help-license.resources_31bf3856ad364e35_6.1.7600.16385_es-es_afb241b6af4af442\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-iscsi-adm.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_a98b594839a4e5db\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\winsxs\amd64_image.inf_31bf3856ad364e35_6.1.7600.16385_none_c079423a110e8ff9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-s..oundthemes-heritage_31bf3856ad364e35_6.1.7600.16385_none_5872c0830d0c4747\Windows Ding.wav C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-o..disc-style-huecycle_31bf3856ad364e35_6.1.7600.16385_none_810df6f57d9f2a73\NavigationRight_SelectionSubpicture.png C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-d..asks-sync.resources_31bf3856ad364e35_6.1.7600.16385_it-it_d4b0107c52e0a2c9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-e..atibility.resources_31bf3856ad364e35_6.1.7600.16385_es-es_e1de9eeb9e402a99\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Serv30e99c02#\aa093ade93079bf7ac8b4446ebd6d935\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-t..framework-migration_31bf3856ad364e35_6.1.7600.16385_none_4ce62d7fd1cb54eb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-ocsetup.resources_31bf3856ad364e35_6.1.7600.16385_de-de_59042a1524a4660c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-sort.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_e4219686d4202553\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-p..ystem-web.resources_31bf3856ad364e35_6.1.7600.16385_de-de_63baff6af370f039\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-magnify.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_80523aa3c39a0c55\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-p..-localspl.resources_31bf3856ad364e35_6.1.7600.16385_de-de_1a8ba067c513126e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-ime-korean-hwresource_31bf3856ad364e35_6.1.7600.16385_none_ac4a6957c5dbd4bb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-n..line-tool.resources_31bf3856ad364e35_6.1.7600.16385_it-it_a3a873c4a692126e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\assembly\GAC_MSIL\System.Configuration.Install.resources\2.0.0.0_it_b03f5f7f11d50a3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Workflow.Activities\v4.0_4.0.0.0__31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-cdosys.resources_31bf3856ad364e35_6.1.7601.17514_hu-hu_a8642385afe86a68\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-i..gbinaries.resources_31bf3856ad364e35_6.1.7600.16385_es-es_8f4e41fd5a0fa4e1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-n..35wpfcomp.resources_31bf3856ad364e35_6.1.7600.16385_de-de_1c792e5cadcd4c36\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-o..disc-style-babygirl_31bf3856ad364e35_6.1.7600.16385_none_b2bd01695c9021fd\content-background.png C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-p2p-pnrp-adm.resources_31bf3856ad364e35_6.1.7600.16385_es-es_8bc7919d3f36cee7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-s..es-common.resources_31bf3856ad364e35_6.1.7600.16385_en-us_341e0271bf05fe78\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\winsxs\amd64_devicepairingproxy.resources_31bf3856ad364e35_6.1.7600.16385_it-it_6976fa64f9742bce\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-atbroker.resources_31bf3856ad364e35_6.1.7600.16385_it-it_4fd8c47c12328205\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-sidebar-adm.resources_31bf3856ad364e35_6.1.7600.16385_de-de_a611a6570549db88\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_fr_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-a..vesqmmanifestplugin_31bf3856ad364e35_6.1.7601.17514_none_756ad8eef4d0f1d0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-autoplay.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_95114bf53924b486\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-l..epremiumn.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_6128609abd76ab18\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-m..ttheme-us-component_31bf3856ad364e35_6.1.7601.17514_none_b52573ad8e4c2d89\US-wp6.jpg C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\assembly\GAC_MSIL\policy.3.5.System.Data.SqlServerCe.Entity\3.5.0.0__89845dcd8080cc91\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-a..ionrecord.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_1193b4bfce8dcbdf\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-hlink.resources_31bf3856ad364e35_6.1.7600.16385_de-de_7e00139a18587871\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-n..qossnapin.resources_31bf3856ad364e35_6.1.7600.16385_es-es_5d5df012d8c7a97f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
File created C:\Windows\winsxs\amd64_adp94xx.inf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_7d4dd7ec25670124\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\StupitHack.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\StupitHack.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\StupitHack.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\StupitHack.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\StupitHack.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\StupitHack.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\StupitHack.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\StupitHack.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\StupitHack.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\StupitHack.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\StupitHack.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\StupitHack.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\StupitHack.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\StupitHack.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\StupitHack.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\StupitHack.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\StupitHack.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\StupitHack.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\StupitHack.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\StupitHack.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\StupitHack.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\StupitHack.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\StupitHack.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\StupitHack.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\StupitHack.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\StupitHack.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\StupitHack.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\StupitHack.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\StupitHack.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\StupitHack.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\StupitHack.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\StupitHack.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\StupitHack.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\StupitHack.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\StupitHack.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\StupitHack.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\StupitHack.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\StupitHack.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\StupitHack.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\StupitHack.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\StupitHack.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\StupitHack.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\StupitHack.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\StupitHack.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\StupitHack.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\StupitHack.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\StupitHack.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\StupitHack.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language N/A N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd11143 C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\GCUJCNQFTQMECRU\ = "CRYPTED!" C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\GCUJCNQFTQMECRU\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MD79PFRQ4de5n55.exe,0" C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\GCUJCNQFTQMECRU\shell\open C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\GCUJCNQFTQMECRU\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MD79PFRQ4de5n55.exe" C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd11143\ = "GCUJCNQFTQMECRU" C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\GCUJCNQFTQMECRU C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\GCUJCNQFTQMECRU\DefaultIcon C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\GCUJCNQFTQMECRU\shell\open\command C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\GCUJCNQFTQMECRU\shell C:\Users\Admin\AppData\Local\Temp\Pizdec.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2888 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\a26906c09acbcd300aa4a7f237249282_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\Pizdec.exe
PID 2888 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\a26906c09acbcd300aa4a7f237249282_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\Pizdec.exe
PID 2888 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\a26906c09acbcd300aa4a7f237249282_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\Pizdec.exe
PID 2888 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\a26906c09acbcd300aa4a7f237249282_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\Pizdec.exe
PID 2888 wrote to memory of 2104 N/A C:\Users\Admin\AppData\Local\Temp\a26906c09acbcd300aa4a7f237249282_JaffaCakes118.exe C:\Windows\SysWOW64\StupitHack.exe
PID 2888 wrote to memory of 2104 N/A C:\Users\Admin\AppData\Local\Temp\a26906c09acbcd300aa4a7f237249282_JaffaCakes118.exe C:\Windows\SysWOW64\StupitHack.exe
PID 2888 wrote to memory of 2104 N/A C:\Users\Admin\AppData\Local\Temp\a26906c09acbcd300aa4a7f237249282_JaffaCakes118.exe C:\Windows\SysWOW64\StupitHack.exe
PID 2888 wrote to memory of 2104 N/A C:\Users\Admin\AppData\Local\Temp\a26906c09acbcd300aa4a7f237249282_JaffaCakes118.exe C:\Windows\SysWOW64\StupitHack.exe
PID 2888 wrote to memory of 2864 N/A C:\Users\Admin\AppData\Local\Temp\a26906c09acbcd300aa4a7f237249282_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2888 wrote to memory of 2864 N/A C:\Users\Admin\AppData\Local\Temp\a26906c09acbcd300aa4a7f237249282_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2888 wrote to memory of 2864 N/A C:\Users\Admin\AppData\Local\Temp\a26906c09acbcd300aa4a7f237249282_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2888 wrote to memory of 2864 N/A C:\Users\Admin\AppData\Local\Temp\a26906c09acbcd300aa4a7f237249282_JaffaCakes118.exe C:\Windows\SysWOW64\cmd.exe
PID 2104 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Local\Temp\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe
PID 2104 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Local\Temp\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe
PID 2104 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Local\Temp\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe
PID 2104 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Local\Temp\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe
PID 2408 wrote to memory of 2480 N/A C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe
PID 2408 wrote to memory of 2480 N/A C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe
PID 2408 wrote to memory of 2480 N/A C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe
PID 2408 wrote to memory of 2480 N/A C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe
PID 2480 wrote to memory of 1256 N/A C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe
PID 2480 wrote to memory of 1256 N/A C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe
PID 2480 wrote to memory of 1256 N/A C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe
PID 2480 wrote to memory of 1256 N/A C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe
PID 1256 wrote to memory of 748 N/A C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe
PID 1256 wrote to memory of 748 N/A C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe
PID 1256 wrote to memory of 748 N/A C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe
PID 1256 wrote to memory of 748 N/A C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe
PID 748 wrote to memory of 2552 N/A C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe
PID 748 wrote to memory of 2552 N/A C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe
PID 748 wrote to memory of 2552 N/A C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe
PID 748 wrote to memory of 2552 N/A C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe
PID 2552 wrote to memory of 2932 N/A C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe
PID 2552 wrote to memory of 2932 N/A C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe
PID 2552 wrote to memory of 2932 N/A C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe
PID 2552 wrote to memory of 2932 N/A C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe
PID 2932 wrote to memory of 1704 N/A C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe
PID 2932 wrote to memory of 1704 N/A C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe
PID 2932 wrote to memory of 1704 N/A C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe
PID 2932 wrote to memory of 1704 N/A C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe
PID 1704 wrote to memory of 2100 N/A C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe
PID 1704 wrote to memory of 2100 N/A C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe
PID 1704 wrote to memory of 2100 N/A C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe
PID 1704 wrote to memory of 2100 N/A C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe
PID 2100 wrote to memory of 1988 N/A C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe
PID 2100 wrote to memory of 1988 N/A C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe
PID 2100 wrote to memory of 1988 N/A C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe
PID 2100 wrote to memory of 1988 N/A C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe
PID 1988 wrote to memory of 2784 N/A C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe
PID 1988 wrote to memory of 2784 N/A C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe
PID 1988 wrote to memory of 2784 N/A C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe
PID 1988 wrote to memory of 2784 N/A C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe
PID 2784 wrote to memory of 1484 N/A C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe
PID 2784 wrote to memory of 1484 N/A C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe
PID 2784 wrote to memory of 1484 N/A C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe
PID 2784 wrote to memory of 1484 N/A C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe
PID 1484 wrote to memory of 2956 N/A C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe
PID 1484 wrote to memory of 2956 N/A C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe
PID 1484 wrote to memory of 2956 N/A C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe
PID 1484 wrote to memory of 2956 N/A C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe
PID 2956 wrote to memory of 1700 N/A C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe
PID 2956 wrote to memory of 1700 N/A C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe
PID 2956 wrote to memory of 1700 N/A C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe
PID 2956 wrote to memory of 1700 N/A C:\Windows\SysWOW64\StupitHack.exe C:\Windows\SysWOW64\StupitHack.exe

Processes

C:\Users\Admin\AppData\Local\Temp\a26906c09acbcd300aa4a7f237249282_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\a26906c09acbcd300aa4a7f237249282_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\Pizdec.exe

"C:\Users\Admin\AppData\Local\Temp\Pizdec.exe"

C:\Users\Admin\AppData\Local\Temp\StupitHack.exe

"C:\Users\Admin\AppData\Local\Temp\StupitHack.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\a26906c09acbcd300aa4a7f237249282_JaffaCakes118.exe" >> NUL

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

C:\Windows\SysWOW64\StupitHack.exe

"C:\Windows\system32\StupitHack.exe"

Network

N/A

Files

memory/2888-5-0x0000000001ED0000-0x0000000001EE4000-memory.dmp

\Users\Admin\AppData\Local\Temp\Pizdec.exe

MD5 50c7c57e78e9d7b62abc477640ad52bc
SHA1 b6940cb51c59037c8882c8655faff8b4abd36de6
SHA256 8d416efbba749ad336169c94865b8f061f27ab14d3c7532ce65a1ee66a30da91
SHA512 db438be083930ce83d9af38db4aeaa328a6d8bde2d431485c47712b1f67cc0a6a414ee8c58ade03488c74e7968ee6b05d5f2fdaae86c745203c490e5d6452976

memory/2888-14-0x0000000001ED0000-0x0000000001EE4000-memory.dmp

memory/2776-15-0x0000000000400000-0x0000000000414000-memory.dmp

\Users\Admin\AppData\Local\Temp\StupitHack.exe

MD5 4b46a0763cc3a4d5e8425c710ed89d4f
SHA1 3edd04e111cba5406ee286db3f7c970ef34d7c53
SHA256 8dbc58dc724a2c25d2b4d46ee528bc3007f1260afedb71c4cef6f9325d60b627
SHA512 1ebba09fa4eb8fbeaa976458c0eaa52f7f5622b522d9d17f815e6c27a5d458bd343fddf1807f7f17c7623ef87f6e439375b9477dd1050c25a2e9f1f33dabcbbb

memory/2888-25-0x0000000002F30000-0x0000000002F85000-memory.dmp

memory/2104-31-0x0000000000400000-0x0000000000455000-memory.dmp

C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt

MD5 e1729097a23480f095671534ca826c69
SHA1 2fa21ac0be0059c42344ea7ba1c2a82ca794e265
SHA256 fe7a9dce50a1cce7cbda97bb8a30e2065b54317ef3e753dc4901495d5a2b3124
SHA512 f17e4d46bfa962df72d3ae4dc96b8e02702ad30fa955fd3887bfbf4deefbcd45f0906a4ca30821efc3c95687765edd2565a509c52986912f5e5902e9b71dc146

memory/2408-88-0x0000000000400000-0x0000000000455000-memory.dmp

memory/2408-107-0x0000000000400000-0x0000000000455000-memory.dmp

memory/2104-71-0x0000000000400000-0x0000000000455000-memory.dmp

memory/2480-167-0x0000000000400000-0x0000000000455000-memory.dmp

memory/748-208-0x0000000000400000-0x0000000000455000-memory.dmp

memory/2776-204-0x0000000000400000-0x0000000000414000-memory.dmp

memory/1256-198-0x0000000000400000-0x0000000000455000-memory.dmp

memory/748-246-0x0000000000330000-0x0000000000385000-memory.dmp

memory/2552-261-0x0000000000400000-0x0000000000455000-memory.dmp

memory/748-242-0x0000000000400000-0x0000000000455000-memory.dmp

memory/2552-283-0x0000000000400000-0x0000000000455000-memory.dmp

memory/2408-299-0x00000000001B0000-0x0000000000205000-memory.dmp

memory/2932-302-0x0000000000400000-0x0000000000455000-memory.dmp

memory/1704-303-0x0000000000400000-0x0000000000455000-memory.dmp

memory/1256-308-0x0000000000400000-0x0000000000455000-memory.dmp

memory/1704-306-0x0000000000400000-0x0000000000455000-memory.dmp

memory/2100-346-0x0000000000400000-0x0000000000455000-memory.dmp

memory/1988-354-0x0000000000400000-0x0000000000455000-memory.dmp

memory/2784-361-0x0000000000400000-0x0000000000455000-memory.dmp

memory/1484-364-0x0000000000400000-0x0000000000455000-memory.dmp

memory/2956-393-0x0000000000400000-0x0000000000455000-memory.dmp

memory/2104-403-0x0000000000400000-0x0000000000455000-memory.dmp

memory/1700-402-0x0000000000400000-0x0000000000455000-memory.dmp

memory/1700-400-0x00000000000C0000-0x0000000000115000-memory.dmp

memory/1700-399-0x0000000000400000-0x0000000000455000-memory.dmp

memory/2104-416-0x0000000000400000-0x0000000000455000-memory.dmp

memory/2424-420-0x0000000000400000-0x0000000000455000-memory.dmp

memory/2352-426-0x0000000000400000-0x0000000000455000-memory.dmp

memory/2608-430-0x0000000000400000-0x0000000000455000-memory.dmp

memory/2400-442-0x0000000000400000-0x0000000000455000-memory.dmp

memory/2304-441-0x0000000000400000-0x0000000000455000-memory.dmp

memory/2400-445-0x0000000000400000-0x0000000000455000-memory.dmp

memory/2536-459-0x0000000000400000-0x0000000000455000-memory.dmp

memory/2264-468-0x0000000000400000-0x0000000000455000-memory.dmp

memory/2584-472-0x0000000000400000-0x0000000000455000-memory.dmp

memory/716-480-0x0000000000400000-0x0000000000455000-memory.dmp

memory/944-492-0x0000000000400000-0x0000000000455000-memory.dmp

memory/520-484-0x0000000000400000-0x0000000000455000-memory.dmp

memory/2416-510-0x0000000000400000-0x0000000000455000-memory.dmp

memory/2416-521-0x0000000000400000-0x0000000000455000-memory.dmp

memory/980-522-0x0000000000400000-0x0000000000455000-memory.dmp

memory/980-525-0x0000000000400000-0x0000000000455000-memory.dmp

memory/2628-543-0x0000000000400000-0x0000000000455000-memory.dmp

memory/1540-545-0x0000000000400000-0x0000000000455000-memory.dmp

memory/1540-548-0x0000000000400000-0x0000000000455000-memory.dmp

memory/1492-553-0x0000000000400000-0x0000000000455000-memory.dmp

memory/1860-555-0x0000000000400000-0x0000000000455000-memory.dmp

memory/296-558-0x0000000000400000-0x0000000000455000-memory.dmp

memory/1348-557-0x0000000000400000-0x0000000000455000-memory.dmp

memory/296-560-0x0000000000400000-0x0000000000455000-memory.dmp

memory/1736-563-0x0000000000400000-0x0000000000455000-memory.dmp

memory/1736-562-0x00000000003A0000-0x00000000003F5000-memory.dmp

memory/2036-565-0x0000000000400000-0x0000000000455000-memory.dmp

C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif

MD5 a11be41db4b3b8d31d269d6cb82e7e62
SHA1 a3d48811affcad19ec140eace2ef7e5cc5ea83c3
SHA256 a4006db8376722c698457875f3d3788aa8c1086776b4b1f8fe70ff8bdf9dacb7
SHA512 dc385e6c6a717f4aea1ba3aa14209132c9f0fcbbac444dec112b60f896029c9192df2e25a9f5d78ddbd7dc5224708fc27debbcb5bc9dd28d35de477cfcb702b0

memory/1596-589-0x0000000000400000-0x0000000000455000-memory.dmp

memory/1684-594-0x0000000000400000-0x0000000000455000-memory.dmp

memory/1684-595-0x0000000000400000-0x0000000000455000-memory.dmp

memory/1288-600-0x0000000000400000-0x0000000000455000-memory.dmp

memory/1796-601-0x0000000000400000-0x0000000000455000-memory.dmp

memory/1796-605-0x0000000000400000-0x0000000000455000-memory.dmp

memory/680-616-0x0000000000400000-0x0000000000455000-memory.dmp

memory/2292-618-0x0000000000400000-0x0000000000455000-memory.dmp

memory/2904-624-0x0000000000400000-0x0000000000455000-memory.dmp

memory/1996-631-0x0000000000130000-0x0000000000185000-memory.dmp

memory/1996-633-0x0000000000400000-0x0000000000455000-memory.dmp

memory/1984-646-0x0000000000400000-0x0000000000455000-memory.dmp

memory/2688-649-0x0000000000400000-0x0000000000455000-memory.dmp

memory/2500-654-0x0000000000400000-0x0000000000455000-memory.dmp

memory/2884-656-0x0000000000400000-0x0000000000455000-memory.dmp

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html

MD5 cd534d8435cf83f38e65a6366beedaaf
SHA1 f9cc33e408fecc4749a79e91f708d2bed686e15a
SHA256 ef5b89cedd7d0948681258fafec50cadb19a4265c8f21c4dbc747565a3eb20c3
SHA512 154ac434b4135efa97dd9c9ed89502c3008fcff1af4a8dc296835be8241931cfc5625e5d9a30357c9cd5c3b7a394c6ba31ae667ef74d30969f7be68f62c9c07a

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html

MD5 2563138389fb9f9ef675ec058b17d8ae
SHA1 62cd9168b5a6597ae9764707300209229c9cf19f
SHA256 2c7e998e0a999c13d5ac075ce2ded421f02c618f4017745059a6de6d86836587
SHA512 d0bd552e574fa1d518d385d5628a979c0071a971e7f75c1ae8521c76da3fd9da73a0a01224ad8a6e20b0a957f8b9a670a5ca400694917e856510de43cdfb7967

memory/2680-703-0x0000000000400000-0x0000000000455000-memory.dmp

memory/1964-722-0x0000000000400000-0x0000000000455000-memory.dmp

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt

MD5 2a1e4c11792e293453796e8848b5dea7
SHA1 afc67defc6712c9a8cf95a9175f72761903747aa
SHA256 c520baa3dcec4ee1bd4d41fb4b5b2430078d4b1b4e06999d800009b422a61728
SHA512 fc41edefa3b8f31280afc05a8df462d245f0dab64b022e4668a3eba46a3d9bb860a1c645f5c3aa9f58bad22766adceb4534ae094d8ceb05af4bec197a85ee00c

memory/2356-764-0x0000000000400000-0x0000000000455000-memory.dmp

memory/2080-788-0x0000000000400000-0x0000000000455000-memory.dmp

memory/2080-786-0x0000000000400000-0x0000000000455000-memory.dmp

memory/2960-784-0x0000000000400000-0x0000000000455000-memory.dmp

memory/2380-790-0x0000000000400000-0x0000000000455000-memory.dmp

memory/1316-882-0x0000000000400000-0x0000000000455000-memory.dmp

memory/1772-884-0x0000000000400000-0x0000000000455000-memory.dmp

memory/2624-890-0x0000000000400000-0x0000000000455000-memory.dmp

memory/1632-892-0x0000000000400000-0x0000000000455000-memory.dmp

memory/2600-894-0x0000000000400000-0x0000000000455000-memory.dmp

memory/1704-896-0x0000000000400000-0x0000000000455000-memory.dmp

memory/2912-926-0x0000000000400000-0x0000000000455000-memory.dmp

memory/1996-947-0x0000000000400000-0x0000000000455000-memory.dmp

memory/108-946-0x0000000000400000-0x0000000000455000-memory.dmp

memory/1996-951-0x0000000000400000-0x0000000000455000-memory.dmp

memory/2784-955-0x0000000000400000-0x0000000000455000-memory.dmp

memory/1984-957-0x0000000000400000-0x0000000000455000-memory.dmp

memory/1984-960-0x0000000000400000-0x0000000000455000-memory.dmp

memory/2656-964-0x0000000000400000-0x0000000000455000-memory.dmp

memory/2656-962-0x00000000002D0000-0x0000000000325000-memory.dmp

memory/2500-967-0x0000000000400000-0x0000000000455000-memory.dmp

memory/2500-965-0x0000000000130000-0x0000000000185000-memory.dmp

memory/2888-970-0x0000000000400000-0x0000000000455000-memory.dmp

C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME.txt

MD5 7766c4e253a3bd0d1e3562c1ff1ac49f
SHA1 4db37cddac1427d54338a59da5d8481583d958cd
SHA256 5fab93c02a88a13909877bb2e69ca1da6f8b4c5a2aec6e00ba843226ba5ee611
SHA512 aadb7bc7cd70574d7d53f8b9857a2675145c20e256c3719ffa00b728423668a6a7de7eb811230dd740b0beae89f58e7e106d352d0bad08ddb5c26e072f3b63de

C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt

MD5 abcd3daae6319a11a4680adf07557378
SHA1 1ea6e0abea2e61f1a8bac0743d127aae7d55fc40
SHA256 2fd6efb44cb8cdf27b4cb90f981f43a82bf0c376ce67070f9eebe0d5ffe522aa
SHA512 8059e80e2e14bee713b2dcac5b4d393665350fc70eb1bde73f709c405f0e1164fe37145603c62c72a64a635ce979226d2f4762d78c46b8b2021ae48bd6ebfb60

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_ON.GIF

MD5 b2b88259dde790468160af3ba0e076ac
SHA1 8b0c1f3a02a462431d2842913b019f0e7b8f17b1
SHA256 bc83a6b5173cbc401d59c2630d897235ccb5a931159dbfa435a66968af02611a
SHA512 2e5f816b335c0feac9ad1523765ef96a4813286c19a7a7840fb9a6827d9ef1caaf892b5a24908391c85bd8c37e74fb9d2a917333db29681059dde96d704f163d

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_OFF.GIF

MD5 d23058f75a59756218fa3ffcdc79a642
SHA1 eeb183812aba1007198604bdda67522ef46c6086
SHA256 fcda199ec9ce2ac6bdbdaca053c2e6ae4a4d43ef1aa8c374542d358cc8cc2a0e
SHA512 2508bf977dfae73179b8669a10021b411d843b19cf021cf3d1363276609e328a204a019a605e816a5f283e8590221f973247355b8512ce3a2d63182b781b05c1

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\BG_ADOBE.GIF

MD5 7a8671d119253bd3729b4171937fb7bb
SHA1 d4575df417b71b5ea7321cc064fbe420ace24d5d
SHA256 4edaf3287a986e5fab0d87002c671f55534f27a00e5af993228f202bd6e80f7b
SHA512 6e86b184b76a544c09a62cbdc48b9ff358328da9688a1d4773ad1e07939c124a7808e0bb3e5021098be3fc42cbdec5d34406c33f30ad069c987a17255c62d6e4

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Casual.gif

MD5 0e49e760c8c80eb6e7b1c80c6a70c150
SHA1 455925af8e3f7802c60f80ff4e4ccf0f724d9501
SHA256 6731d14617e437401f1b814db88c2fcf99849850b8837ff6a7495dfee8d0eacc
SHA512 bd449ffbcb2be30c7be63b3e3808d7063b8f205e2209da640a2208373634be06e86a95c840382486c139ec2f510096f516937e7b3bf89731573e659a7e94d069

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Country.gif

MD5 17ef6dcd8afe671b147a9ae8a3d321d8
SHA1 c58b0d6c0d9980e7dc20985a491b1133c28725ba
SHA256 ac81e613a40ebfa09de718da36bade3d2cf49134a68d2678f0090a57f3891152
SHA512 70da4e153b711c3224fd493eedd3672446e17013a7770567061cc9fead600a3787b450fb4f2cd56a1b9ff420a5bdc9cb2737aeaacc950bd83c15f6a10332bd10

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Premium.gif

MD5 c0602ea56e2991ac8eab0b27788bc0c7
SHA1 0768d8047781a8a32213a16068b88702f7430ff1
SHA256 e4ad37ce4de454b5ac7d25fe764c22169cf9c7d2f07e162b6c16b41d7ba81083
SHA512 5cfeb9d794d7dd0d1cad7b245cb7e264aad056dd91649c8135f74b87b79b47bfcd42e21e0250c5792cdcadeef9f06649eca5a3561c13ba57c7470df15fbbdac9

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_TexturedBlue.gif

MD5 41029866852179a0915fda51a7bb2cc4
SHA1 f7c54518894f0554e9f3f6e3d32a4d5097d97153
SHA256 92acd60a9083a20ec80079b2bae84f302218e9a0873a706e446788d0b8fc43ec
SHA512 6abf2daf5dbb64438da445d70c94527c6abb64f01cb3bb525bd71acb127026fb4e9056951b3d0232e8258902315880321ce919445824534a17aeeda6d9792394

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_SlateBlue.gif

MD5 ce86bb8df12dc5d4efdedad66e1af526
SHA1 6f367cd059390a27e3addc13d7c5ebb004d363e0
SHA256 b9eb243191d3f200510e4a3bfa9276650d95f6c570457158f5a4a64ea6edb5d7
SHA512 fc04357b69188ecf6e8f2efc34210cfcdf1bb2598dbca671591ce2126f756012068686fbf3872f70973cb27d674c205e8ee8e349eed354645fc2176cceebf491

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_VelvetRose.gif

MD5 af0952ec66f5dfdc4987ebe6f5386cf3
SHA1 f2f0785908496f80e616fb9d01a36027e4c77731
SHA256 a560f028fe0b6230a697c1a447ed475c0f10f0f0636587d5b9cbbc94f70e107c
SHA512 f8b56b00c08e8736222847b23dbeba586124e254d61d76315cfcac508f6216f719d050fee55e2654a79b95f9e52d0a23d3f63c414056c5cb843a292734cc2a34

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_OliveGreen.gif

MD5 94ce7f4c4c1b4e1ec7517d1b69e5f149
SHA1 3dacbfeb272560a06fd926999a68478eccec19a8
SHA256 84c07f27d10283b78a11bb9c546a570ad0c35a385753fbd4ed35f8431d040ed5
SHA512 30b868082421dcc910627f1bfa3bb600b54ba216dcc2d4e0cde55c1009d6c42e1cc4d281a90cfa0f5305b3e94c36587054c0f494b0835bb01a27c6d8b9da2114

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_LightSpirit.gif

MD5 07a7e905ba677b491a0ec54b1edd405b
SHA1 0f52553191ff57cc7947fbf965d4eca414c5c346
SHA256 84673ef6d85d96caac5821f7064044cf27bc9448ab9e25c609ad96d19662de59
SHA512 a492c027a0a8d2793eedc0368b0ec6c79d3d1ca8c7e338a813b6f9e14aed05bd90e85baf4ec605fd740562ef57413d22fe437dced13ce966cd79995feb5f3ba6

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Groove.gif

MD5 b884d3acb745e9be84d1dceae5353b39
SHA1 0b9b6a0b77292927c26ebbc49921b5cc7794a5a9
SHA256 d11968ae8dbb5cb2c10e744c830cff282c86d7eef62fec04ba76ab0ab268fc78
SHA512 d7c0c67c8c021f0bba3df099caee9ec6d06747093ccb56d020c18f80bd55cd79bb1d1a1fd467bdcd6228b5868e02f8fe45b7b071c75effd7a9ce8e07dec48c1c

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_GreenTea.gif

MD5 26f1b5ff983fab1d1a335806cc951dce
SHA1 1fd2de7103a53a65ac52edb4edaf72a0eac7d6ce
SHA256 3cdd885bfb24793eba695e66843f76a85db5cfa9c181072d850aea1eec86c78a
SHA512 922d92d0ffc17781f62d482c07e919a3d23150740ab9abdfd2f779166aca2f467b2eab4db4e561903a6567ead1bc982a96d6a641789dfabcb9f85ae4897f9eb6

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Earthy.gif

MD5 c9c6c2ce0ea6dd4325c3aac0b524683f
SHA1 5fd60b6f8145045242d7e259029865dae7ac09fd
SHA256 2220c52ddd5ecf4e16a3f340cc5db6f9132efed96754598389961beeebe1da3b
SHA512 cb91d1a36fb15f903d5f68b0b40e1eeb65108829da5ad7c45c257c0060b79f3fabf7537454b3107d88e1a07e1ed64b715b67fd0c967a50fa1fa54c9532ffd460

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BabyBlue\BUTTON.GIF

MD5 4f4de302e1c46b7f6e27c36365541c29
SHA1 f060ac343e5c937ff81a31798bd24ce2ddd93e92
SHA256 1b34346dd78c32b172cb26ac6faa8455dbd77d2ec5ffd1ce1e74985ce20c119e
SHA512 77e50b937db7de229a1f9313c89bd72eb51bee978d0a80b5903e5b8a1e0456a3098d9237f0d59943ced473687838312e08c8d23aa75829b66ed88885bdc1e463

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\TAB_OFF.GIF

MD5 25519aa9d968d562a5ac488f47c12ebe
SHA1 6fc35ade3706b15a5fe4fd5e2c51455e53db27ab
SHA256 5fa62c99337f10ea93ef1fce00855933d6ea86e31e1041c3b1df4b168e9bd093
SHA512 70b3e228ac764e5e60d77e2de43c609e56599807c32d34a97b4f26fa603f51e7b0d6f8e88d61805bb347ae185da96e7401b2cf6a9f99b005e118dea62d9847a1

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\TAB_ON.GIF

MD5 3ea1ac58944a53a3ed411fb47f37919b
SHA1 d015bbacfe0ba63625b7a7a61c22c87bcb8c16cd
SHA256 0e12d31310726be805e964f22a35d28429bf4d8214edb384448fc0b2640dfe71
SHA512 f23555b69deac770a5cd4f3ef715baf590f08ecded7e5beda9e222341b802a869cb19793066b3cd38bf4e82f17a1a94b3e9581952fe2d29d04a616c6c60b6936

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\tab_on.gif

MD5 53cc8a9fece3c8e710e34ce951d86b39
SHA1 1a8c1661ead6c650fa09aa9b571a75267c9fd67d
SHA256 d88c5645ad31d2b195ba7349a52c91e9e4ffb385c7961f4375e98491ed65a312
SHA512 1b3d51efe06ea819c173bfb5c82e9b15e7624886710f1dd88092269479a9f6b80b2d547f0e971f2165b9c094bc9e265a7834e8d49899fd65a108c9a29a970aef

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\tab_off.gif

MD5 194d14a9b766220904e3dc39160fc7c5
SHA1 4740d693b8d264c2c3c79f004fda6506807a5e0d
SHA256 f34307ae148e9922318bf48f05dd210ab73d6b2ef37bb3b224cd5fde6011db83
SHA512 c67ac9dbfb2d16dcc570f187b2625f2039826554b8664c0d3ceb6e4ead9af1541c36831c40d7067fb8b2de3cf7fdecf39a5ff33f9fc6301e6a03cbcd557037a5

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrow.jpg

MD5 c28e2e06fadc21d084cf9e02ea6106ea
SHA1 d074f0131efb03e986dd9b6d808f95cbe4f282db
SHA256 9dda99f0ddc835a149e0f650fab920ed000ea1fe0ca74aabc316485d0c96dd48
SHA512 e62d45836896825f8ab397217c8f8cfe9a910656c0b745ddeb26a9d326f7ad0f061783991319b71bd65e9c610d544bb0836ada4587d9a6654ad6f5dbbdda6ab7

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\attention.gif

MD5 69b65f6a1b62a294c47b36368085c4e0
SHA1 a6a78ce33746418e9ff925648d95aacb51c95f2b
SHA256 751ba658943f0becc35edbd9ef9e3b73153fec1fbfe47e4bcc7309da45b92597
SHA512 977aca2d5e5b2cbf2da244496dd7489a422abff4d62da380092701261800768b2f2e9178f263b0183e5ac34e244f6990013ccfcc2f46fa51d5f46af377afe837

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrowMask.bmp

MD5 61869bf1d1283b6214b3286b2401b81c
SHA1 13ef52e8c21bd9b6b66e188ae9a2ebf7177129af
SHA256 9d6d8626cb3b73ee47af734319bfe1673bbcb6740ce613bb55215cc241b8efb3
SHA512 62fc6c42ccbbc1a8c0c8517d827cba4649bbf820732b968bac54161e6564a90ac32b17e6fc229ce8b7f117cd161d5e50c1cb8b57b649bc9210c33f0d4daf15d4

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_FormsHomePageBlank.gif

MD5 f80d5af96bacdafe682f1dd0ba8e8e70
SHA1 b7430ae03e5a3c913d253fdc498c43ec5994121a
SHA256 583e3f6d25c009598cb69ba43795020677407f120fed7cdbfd66a61a89df0579
SHA512 cda67196a30917d356d9c60804bd744647ea0deae9f1d569c482a856e159af93fae13154d45731653940f11cdfe1f503f69bfa8cc46ec47d74aade55b72fc237

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BabyBlue\HEADER.GIF

MD5 8d9c3e3b23707c4e2f34dfeef3ff422b
SHA1 863f9d6cc772dd933b54568a1746fdd8d1ab053b
SHA256 751e5130778a52842a38b069dc1392ebc51797f7c063654e946c85d34aafb2c8
SHA512 33733865262b2cc81af7a524335a292715bd3bd63d6fb16e8f4e3f1b2193f903fd68df82c959ee69d7c9bcda643b2f7ced0dc7a9785ddd4af67737f40808a810

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightOrange\background.gif

MD5 7a4f81622f376879e17d8d40f0477317
SHA1 ab7f27f9215a93c7e1383758ad8f880df61639ac
SHA256 756f5ce66d384973e57a81536ca7545ab8e55534d149cf50a7227386a7a26a22
SHA512 b83021d76cc82462a3b503e9986ae3b689dc8ba5a5823931c91b32d10c19fb011a938c252764ce5661990781a23b735db8acdb176d0f0f0ddd879528c3e74c13

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightYellow\HEADER.GIF

MD5 f36097f5ebdba66e2b45fe77399e16af
SHA1 8521e70f3c46a6f05ede3009e49e4309c7c1f9fb
SHA256 4058712db85e537175f964c3ecf380c6812a58fd15b3905cc44f3fac37530592
SHA512 304db05cc16a39d5008e7536ca8710a742e46c2656fcc2a5678dab1fc565fc3eaed8616b21d2fc2c18bd43cb1b8a74cb8a358550f25ec11202e78e1258b99031

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\GrayCheck\HEADER.GIF

MD5 9b4ee4d3fc2fbc21c6f12edaa09c4853
SHA1 a4e4a29675cdc0acfc815522b7ab522ffe429a08
SHA256 aeede3e338060c21b808e207b8fba4f82158f63dba3857dd2234ad9a9789343c
SHA512 7d6e227dd671eb54981883dc96138aff073a7aaa6f17109c431baf1698523bd6ba95653dc6d6de119eade328d9c255b1c38ac4b1bf24c07875e8cfc556655ac8

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Oasis\HEADER.GIF

MD5 71cafb8a49b6c63bc129b1e694e6cbd8
SHA1 ea0c02f5e61ff38bb8fc638fda7b39e622c71a5b
SHA256 89b937ae7713c3550c881674e5705168ff8d7e5e0657e225192ffa9fe7db676b
SHA512 b2396d84f410e46b86774faa5dcd9bbbf57109091c938a1e52da1743e6e636faff177d4a6c37c114b9bbb56b9e5af54c1901480491293dc371eb5a7b3fc7cdce

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\TAB_ON.GIF

MD5 bc303e4fecae95a9ab34c11e033a6722
SHA1 bcecda298ef0dc69bd54cd9611f13ed4ecbea2ca
SHA256 0867e0f7180e44124d90956d525a534350fe920b89ba547c88087c9c850aba73
SHA512 6e8ec35fd225ce939bcf39920d4b21cccae3b08bc02faba19fa5fbd4e2f1bf80a381ac1e44bee4202832583e398dc8cf79043564d268094fcfe56f0ceafdf7a7

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\TAB_OFF.GIF

MD5 795a80f13ece13587e262a42c12a39fd
SHA1 dd5d52bea7530280cac5ac79ef71618ceb96442f
SHA256 f36b682553338aecacd029f51bd3f4d6382e73ad3f59257de38f592964921f9b
SHA512 9e190c890340a9f18cec628902e197ec7d67a41a9199ed301ffb894098f86667351fec9f19848e38bac7e3f9f16f01fe4035571cc3669ee6ccfea49b5530f6ca

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Desert\HEADER.GIF

MD5 2f60f5edbbabfd16a3842fb28e3a64ce
SHA1 bfdb564e08698066396751aefd39737e79268ab7
SHA256 62aad9fa86a2f79c35e053225e649c583c0602daf6b0b7fa97f3b96a14930063
SHA512 84283024904db594e18041ab893967d6630d0dc932e490927194fbdd86b8613e3b65972658d9133c9964ee729f1569ab9bd5fd39158011808f218a7e7565481f

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\TAB_OFF.GIF

MD5 745990a80878ff1f138075cd64b10f3d
SHA1 7486fd74b8f567ce4868f0dc915ea899d4974e21
SHA256 7085b03d00e3da3feb05997ff6c525fe95f30997e90014d387e0e756f2e6c204
SHA512 cfe724b1ee2bd46d2b03941d0bf42f17a572c5714adb076fd2710e124700f8a4d8a690ba2791fc76fb064ec80864c38d0c5be418aef69ade940d860fb032c83c

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\TAB_ON.GIF

MD5 87c6db22324d0c4ce90b010a483175fb
SHA1 a06f0fde7a7495317a5077dba2cea76fc682155c
SHA256 cf00715d6252f8ae9eb687c4ac4ddecefecefedc5d2d34d2825fe3a9ec4e7512
SHA512 4de675224cb4d68d6d315563bcc1781230f6033e2e628ed752f559a2acba59dd2259e20647ad924ad59d6241294f39cbf7611b276f8cfedf05a8020fa2ebfc10

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SoftBlue\background.gif

MD5 312edd8b93fd0e0f6f2fa850b117cd22
SHA1 f22e2f33626171b444be8e37d147c3e2e8cc6b27
SHA256 b83a3b889c33b6b3a7b074787f4631d79dd66b6cb1602a91f22332ea9b94dea7
SHA512 08e9718925f958189c0da4f8e4276816be7c54eb5b37bf348fdbdbd6cb979f031de050ff732af29c3c1c303f97800e51ec1b2e3573dd6c52f94d2d2f292d4cd9

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SpringGreen\BUTTON.GIF

MD5 75ac43e25c716855ced4f43461642001
SHA1 60749025819b337655958e84942ac08d7c46cd24
SHA256 a51d06c2265888c209d3bd7b044fc13bf10b25276886181bd580d8c3245c257b
SHA512 6bb0783b9259d4a1c1cb2ff3ff2fd495a513203263b1908bb812bfa2db00c9dab83b6a454ad72b739434bf504d001e9a3e95cce209dc42f83016de44caf93b0b

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\background.gif

MD5 805bb84cd63d7b6b4aa750a785d33103
SHA1 6f18796cdd112af9e2941afa1c85a1d041c3a7f3
SHA256 439bff6ad747184a7c8fdb334adb354b9cf14d6af45be1cd90d2d1dd1046c88a
SHA512 010bb38d24de29d3310f4e8faf2e0f7c913176d120d50b7815a8dc4644f56b714a032eb4e51f2c4f10ef5dcf8ea526f365aac0317087ac52b09e7ae2f58f4f46

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl\background.gif

MD5 ef50c256f5d455800219832600d90c43
SHA1 16eb4b7505f0191a2ff485aa51fe686b9296261b
SHA256 478f401e0cf8ab901ea4eaefc9d3c8410f809941a291d75c166ae7535030cf64
SHA512 4f369826a065f6f6e1b44d594f6e843d9f3e80aa6c58e7347f05fb01969ac6c72c77e354a357c19d8098295cf1dc250963b413cbead136934815f285ce47e7cb

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormToolImages.jpg

MD5 8161534387ee42a7c598f75ecc70d5d6
SHA1 eed53a1868b113df6f60d986aee727f2e4b5287e
SHA256 73e5d1f97e9b93319806d36933a45120b22d6c366f7003b15e0b644a79913b10
SHA512 19155f310ab7c0ac5323f545fff3bdd8d8ea20b141d7609451ac3bd2bb71ef7ba4dd1c509ce5d744555ed12708ee35fea3735d7c4911a88c2ac58f9403f4eeab

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_italic.gif

MD5 787bc8b30ac5901008255e4d15efd9e3
SHA1 22f3f14f106fa068ecafa5c1a917cd302a3ab6a5
SHA256 052852609a2499792bcc330b2d046af459efe900b897b27552d4a913998ab03a
SHA512 e6e0a93a439ede6029bd02e43d5abcaa7631c1cbd61a7ca79819e8d796d2fdf99665f33a93d05d2454c358ba964c5fd0e86a2ec61d3243ca70bc56ab16ea9f54

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\ViewHeaderPreview.jpg

MD5 732dad53ca458ed713ca5600cbedcfbc
SHA1 6dc5a40f4ad5922b98d4450794b255ed291e48aa
SHA256 9457232a4c882164a5c1f060427b9358c045696c0b97ca1652928f43f81a4baf
SHA512 8e68bf7ee236898e4cfa910d39da02f711dcba234d69068d2aabc4a0c40e2aec2c5bd51da605ec49a6b0decf9f77fc7e451b416349bd0c758ac8213b9a2b25ff

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_underline.gif

MD5 b96449fcb98ab08766802ec3aebb12dd
SHA1 552a31e76b8360d6ab256602316e810c305e02c6
SHA256 048ba2304c7e22246d572b4f314ebe9aa978c8423e0b1cd500b41906d530379d
SHA512 e6be87d2066121db42a2fd6edf820b7f2400e4b65e9a80a6de4fc15725eb82810c7d246587626cbe3b751b49590025aead5b496a66efdf2247a6f774b1c10e71

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\DELETE.GIF

MD5 69a197f80cff39353fd738ba65c4ab62
SHA1 9196a36a64c587775e15872837a2f584125d864e
SHA256 d66fb9d703a7bb18984eb71d97cb1cdece9c43ed8651f2f382afdff9aed49649
SHA512 ba390536ece92dce0bd4e5bbef2149af76a76a93356e1892772cb80c6ed913b7449d7349bec2540b130f7ac5192a0fc7b8665841466c113bf8fe0ac5070dedb6

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\CALENDAR.GIF

MD5 26d57d89b1be9e5df529bbb80f63c5e2
SHA1 7ed7bbb66a35fce4f32b7ab4f1bf4f2f73989692
SHA256 2aa655fb7a42797061722b7f6030e8e8fea420928d28c9fe52fc13e527f61b8f
SHA512 21c9aed0d570c6cf8e2093bf202d036004304ed52a4a842668b08ebcaceb55587ae6d3ec57f6ed4f1e1e8c4230fdcf4aaf1305258c057caa2bc398a1c06a8506

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\ADD.GIF

MD5 53c840bd83edbdce28c42b05c62f12cc
SHA1 a2bb38d762f2b599b49fb028d8a598f3ce1a7a12
SHA256 4a8a7f8305489a4f4b46507db6be88a8dd3bf20823a2f03055d265efd8a68137
SHA512 c00c6763e9c845819bed57f26a6dc0f06a09a8b8fa5cf8c1a1f63e678789af750d9511ee37266799bbebfa3382f75945ac56f520f3fb8ce50ce0653ec976da8c

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_choosefont.gif

MD5 520b82be21c5fe8c1f4be62696b1a18d
SHA1 eb32dc2b027df102199228c39ffada40044ad4a4
SHA256 fa26e4c72330b2810e92ad604ab4e814fed35fbc3e871557a5c2745ac0279a2c
SHA512 80127fa0bd085bdfb14278b7b77106b66142239c39ab1d4ed264eb002b008a0df768a3a5ce288385495f79e51b9493a416bb59a9e86fe2cd70c9b02c6b5611ec

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\RTF_BOLD.GIF

MD5 b88bf7344d519733c9833bf19085d60b
SHA1 b2dbe17611005a25f29fc60bf54459a7e791a921
SHA256 1144420c99686aaf2f8c6cbf46b1f92fc2463feb8b66681b2ddc38a0c9a81cdf
SHA512 2a62f570dd2093c9557869c0d13e195d28df692caaed682154998610bcbf78711176f8b29eb74e29816c299685b137190a0964890e0a55a809148d71ee5f4ffb

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\ERROR.GIF

MD5 dd522943741c50684921e5e827a11905
SHA1 af38c0839481089062d8d0a9cc11d71a56edb9f9
SHA256 0dff63b67d310f861c0e0ccadf28058da8c638aafa8d1676e79ef30899d2f245
SHA512 4c53c3c1e479449e418bf30789217a2a1b9915fe689ca4b130bcc4f86b1ac31de7536bfeac683e3f579ca1fb98981c6dfa542bbf820d90983fdc9a53e561ce3e

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIcons.jpg

MD5 1d78096fee9dd52322b7b0e0f10e1997
SHA1 b09ebcce2e57fafd34316ea0b43630a00d8f8549
SHA256 5bb343dee826865dfbbcef1308b7ade9dd2e4340f5906e0def783281551d5c4c
SHA512 b30beffb1dc67158247626cc5260dc66a2b4eb8c0a4157e92c994624716168d8f884c96cea80f94556a4598a86a3ae1711e43954a74876f30ae2038b7b757354

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIconsMask.bmp

MD5 5752704fcd383444c0f44a02d3dcaee3
SHA1 50a2f88e7897634ebb9ce97056f18fd4594451eb
SHA256 679248cba532d298d2944cf70ae05bea3f1205c7b9ffb22b42948876e3f63e8d
SHA512 19f0c0baeb08d0eb7ec7f60e8799f537f85da662ec6a27d28b05c8e8674e94522d0e7ec907f70a985dfe5a9d00f9994981a0fd541dff59337f7273f590afa498

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignleft.gif

MD5 272a75349584311318fff11804ddeafb
SHA1 762df405b359b9c8aead475ad3273d345fc9bbb1
SHA256 55e4d6c1137ed89a389b2ea8693675e8fd9c85d1d8d26659161d3263161f2d39
SHA512 723ae251baf563bc3d72ce5d6756d295d676f6a885029b6383223b9f11755abe1ba79990a0676a6d75088bea0cf8c63f261758782d44089ba4d67044a3b96323

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignright.gif

MD5 b4025670c612edca7992c12f81da0c11
SHA1 a16874e8ca4f3c55b3e1f918195f6b095574fcbe
SHA256 c97d67f06bc91743262813341f9b0b4c1b4a5e742ae4b41efeec2f16540bfe52
SHA512 661640eb52ed71e0a54e33c509958ea053cc20bf99e5de44181395e130b980a3158dcb7925ea0ffa6263140d7119ff83c80a7585c745a7cdd4125c9ce7df29fb

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_center.gif

MD5 f6fc5a9da91349f58bd8de74bd43e707
SHA1 10c77557d9d14a08f83fb5e026a643f095fc4f06
SHA256 7b4f05af3f4a487d806cb155f4747f0bcdbc32f3ec4d5cfaa72bd55cc6e411f3
SHA512 62c9a801f684f9da19f7d60b4df7bd66b7ec2d7ddae5fc258f2285c9ae79ac8e128399f578d4ae64080b122b9b6dd31c203fc6d7f2d5ed688d192b50607be5d9

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_decreaseindent.gif

MD5 df2e005ec5e334510cb8a119d520dee1
SHA1 5b0f11987388dfe9b973b4096e02e360df935919
SHA256 fa3ade4e796f37f2ab09fb576031d49afa4bed86937434034e579e175e9703da
SHA512 ac23f622174cb454c2df9fbf0f0c5ffc3cd8d9d28199610584519e841321591dc37669ed23986e9f848315e4cc9bf5d3d93491211961813c9d038f7fc41ea16a

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_bullets.gif

MD5 0074ff695946a878603b8dd210d92e76
SHA1 0a6ca893e604a47687fbaf874d54118ad13b9bb7
SHA256 9c3bcfcf23945b3ed3a1958b2f5e5481495b4405b6b2aedbb02b42308f45d3db
SHA512 b8c8269688e6ff98525dd65af69ba2542a8e0615214f65a97b04dd334295665f9a41c984de615de6040bc9dbe2ff7d969e10ac4d4f5443f28b9c8cd13aa80888

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_increaseindent.gif

MD5 b05d70234b2f5cd1c09c24673f05dc72
SHA1 ad3ca7a5153affcff048f7dcc32e63f55703e819
SHA256 8dbe14897aaac7d50fe364efab85cfc221704c6f4ec5e4a7bd0e15a62fa14455
SHA512 564014fb58395097366231cec33bd3f7b210aa973764f86064d21197a9136ce97969cb3c2ab0f9e0598dc2fb968d5477ea377aa6ac422371eb2b3e7022c6fcff

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_justify.gif

MD5 402e892493c6ed3da7890cde1066d936
SHA1 f7d08331c0bf72227d1b5e610a4962ea9675e85e
SHA256 6201661c0e71fd1441b447cf2073525201a526fdf49c8c3764b0fae02adf0bad
SHA512 14e7b00d5bf1eaa36f92d236f7df2cf4d6a309adaa52750e915f7f60bc92b756f61cf2fd98e1ea79188ef6d4838baf8615cf1c3bba4acab4c7141b43c6af7e68

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\LAUNCH.GIF

MD5 1ba37b6357520611b36bce48861c3768
SHA1 da9e1795ec161394a83913f4ca5ed299726f86c4
SHA256 a3b93e394b8f123b0354e862e8ea98462b7d5aba96d3c91a3b6e763ee18f4b0b
SHA512 b08735e0f66c3be1a3fcd4300f8aaf6507f654f82b22c1b496bab3591e55a2f5670d9a75232cac8491bc39505c2566f5cb9d0364a40c14eebaca77e06171d4fc

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_pressed.gif

MD5 013a90061707e36407a2825d4e03a38c
SHA1 c334ce3fab7b10934ed50d2deaa8809b5f91bb2b
SHA256 a355487b4e52bb472aea343d34a6dfcd50e955975e4b26cf96c06b0beccd9a58
SHA512 a318e7acb1a64a68e77004ad7cc849a8c3ba54d9ed431cf4f451cf1c358e5b4455cf3267e7d613b4129907edc2df99c626da1c32c1ab703267d4b39e66a3cd70

C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Windows Explorer.lnk

MD5 624fd9e04323e866fc5bae3fb9f0b026
SHA1 1e30f44a1a0c642e95306547280607a9245dc785
SHA256 74b199e9ae9fdbe2e3eb16dd2ef6eb41c44c239c4e5cb84d00b44569200b6951
SHA512 01801900b6a843d1d14b949cea9a4fef80e6c96dbb78cff9e613eba286f7dfc62b31c6fb4d9e6eb06d707ef94712899ac0a61d9bef0c5368c0ef8a4586d103a0

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\security_watermark.jpg

MD5 de340a3af6129a5da8f93e82bc1e5ad1
SHA1 501e52987515a5bf14fb2020ab1a2c16c8a3acbd
SHA256 a70d6f72e7a2f997f6cb72015f483a711a3ad5298c7b73bc479833201b4bb49e
SHA512 8c85667186963b0cf3ac53a1ed3018498124b24ed4a495099b0ddc8c7b6e0537b001d897085cfd21992e7b97dfb3820599088d03c3bec57a5d10e79fe215afcd

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\alert_lrg.gif

MD5 753a35716b58a88f72cce92246765f74
SHA1 b8e4e087c5995b8ca9ceab9c3dd7f7dac6ccfcee
SHA256 91dc47ce82cfa9e0301026d0eed6650df5c9f75074d02cd4f9103ee23f24ea26
SHA512 9a806d453b14f044d2108f08ef029416bf9f613d46a1caa89c6d2ad49eaf5f3fd7ceb8b27afc97e483adaa875ee1bf25a66912862275b2cf0a6db142678c11cc

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\aspx_file.gif

MD5 3e8789107b6e614c4a1baab089405197
SHA1 42bab6d328cf628f7a3f07abd3fb4971bdff36fc
SHA256 bee099242bc4b3e799888d3671013b15404ee64761c11b3579c6c743a05c7a2f
SHA512 30c482cccba5e63a3881eb1804a5557fe9ae0c3ee2d8afdadd3d09dd0361cfb36fa017084b2dd3180135d6f5e9046ec75211881b5564ea622c75c476f29a76a7

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg

MD5 29d62be6286124ae2e1bac1865ee9210
SHA1 098daaa26f328327d9dff8fd1f96de1d797868f6
SHA256 6f05eb80e2d07c57d31f7f8672b85a02111f6a4bdfe8357c8d571504bde47715
SHA512 ad2f5182f42262204b58e8232bacbb9cd910cb1dfcfe3a8fa4949a8f9e1b12c9e387f2837a1761f85d4db27e5abdf0a253a522edcea4d9ad62769076bbe5ce5c

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\branding_Full2.gif

MD5 0ef71da7951b4a0c13c799fb934bc428
SHA1 a961a87c3cde6dac32b1b2fbee5eaa4243b7d902
SHA256 c54931b274870c7ab1c2ceda029723334cc74dda31356d9aff8fe242f58bf296
SHA512 525d45e7fe6b7a3ba1062edfa41fa6a13e7250d9086fd6a8accf351853e63632ed71c8fddbe18181880fdeebe684b9df77582ce54ec4cad373822ffec0448cb2

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\deselectedTab_1x1.gif

MD5 44647f7c081a86281959b1c4c91bb856
SHA1 ffca7d79ec78f43fca587b57dba711083c6ad161
SHA256 cbd20d8ca2365ca9ea0138144c68eda3f7e89d9c9351dfd79e2283da6ce69941
SHA512 60607fb93b53b782a1198020d05dd419037ef15de2bca1604f855ebfd4cd7dfa4550fba99f8e4c755cd79deaee395eef1999c5cf4ab2a9ac76935566af84d03a

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg

MD5 13ff81d5bdf2b384f875d27a11e2a8e9
SHA1 f5d2c43853221c5266d25e1d64fb1fe94678bc9e
SHA256 0aecdffafc8fa132c6214717f590129a06d0ba03710aa9f493975a9ed23bcece
SHA512 9e849f80fafe7e880eb3fa061b16468f248afaea41fd16cecbf600f5090e9b85382afabd5918d49dbb7e615863a7ac7fb3362e813e2ab346059049c4c46e309b

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\help.jpg

MD5 545a065171f9be5253d58d51b587bdbe
SHA1 33a8fe2f35ac143a63b9282aea872bc9d6c85748
SHA256 5b1b6ea40a5281423373436acc53e3b8df175edf1c81b93e55abd934fc7eff3b
SHA512 07309cf317d5f77bc4d788ce5921b4665691819f51e827a28ed013ceaf6bc82027f3206f27cee9e1773982a807768d9a836a632be5f905e4481aa260b82dcdf3

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\headerGRADIENT_Tall.gif

MD5 b850130ae4630c5bf156219bc1ee6148
SHA1 ec6dac370e778b1e4f5383f4663e6e9b3d91e5c2
SHA256 4ad35c5a730861d715b5dd886a714c0ce33656a59ee04ea15fe13c39804fec30
SHA512 97b7ac139f481dfbd082561939183c60ef69ecd22442227fda253465f27943336c4a3d2c6daed270d469a313f108f141d56d5a9f8223dea79ae7ce92c0e77a27

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\gradient_onWhite.gif

MD5 dc274a295d0762bd50961c0dab7d3aa2
SHA1 83a558c45a68a3cd7f8cc6b8f98a9cbce1523bdb
SHA256 9e27f2361b978796d31b507a9f76742cc1235657c580f449c3f333ce9ba644de
SHA512 a8784cc65e660da3ed68f9bd4422aebea5683bbe22e811aa315f202920cbbf9759a313cee7cdeaf70b19c7d80f2570cd85f85045bc49b7df692d66df3287a71a

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\gradient_onBlue.gif

MD5 a1b6eb2d14b70b137257b88f02a57417
SHA1 84bdacf035836fb2999057af2ed1fc8a6faad5ec
SHA256 2c723bc8457768d7e2cd8035a4d8ee57c85b495ff30d799682e86ab41a4c1d56
SHA512 58734f8b14f4fa1401a479ff0b738dbe4115b80a657f819e21ff4ddad5a26d7f48f547a86349b9915ab5de98f7596eacdd5da81d9da4253e8178ae915969602d

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\image1.gif

MD5 87b2074af5b620f165853015075b5ef7
SHA1 af97d9add98600ad2c6f608a7004c903fa9edd2e
SHA256 81a8504ed8398ead9bd8bcf1e90958077c128c83a228158dbed9bbdc52ebde27
SHA512 e7a820210f4e6fa3bf59e0b99019c283e84436d2eec426e7fda334b62032c2aab8dcca2ad278c52a8022b1ab922139635dbe976591a06f9738ba8fbc2f1e8c2c

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\requiredBang.gif

MD5 b3733f1d4b5fad7410f33a4f0e274c76
SHA1 a6b745056c5fe101a532ae78220abc92438f681a
SHA256 ae496cf92e9dac7d69207ea9ff71243b09ed4b511a3f4c42aae67f0726dd292b
SHA512 ed0a156a592c1659cdc41ec1c436d80382c90510e3c4aa845719682c9d68ff1d368f8f2b9349d5808966b243f2dc10e7514f671b5baecca507b3776c3d8abcf0

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\selectedTab_rightCorner.gif

MD5 d5e045fb5dd0729b4483a2cc68e119cc
SHA1 573c38e4f8d5460b8f4aafbdf13a395fe6dd0cfd
SHA256 488e1956771a51fcb2278cf02919d590e5f7112e6e3380a64a410735ccdf615c
SHA512 a30491382dc4e64204c3b04d11aef3fc3ae3f62efbec452fe607f88ea86991ac94180a4e107cc670bf205b860cba3d0399a77efd090f3f1827256c2eccc768fe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\selectedTab_leftCorner.gif

MD5 291c51d898fdddd815a5ca2ee60a4aab
SHA1 48031b58a79467f338c63b1f126772168d72977e
SHA256 1cd77037e7f327dd8de99e699969b4536ff9a3060f921ab6230a15c61067738c
SHA512 e21248fbe0835ceaffb3398d0a1adf42164f76a36fc115113f3b30c7b21c880dc297f74f83fe3cc693205e347160b2c7e4cc45b6970197bd24dd9b49d7a2389b

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\image2.gif

MD5 01884af8c2074eb4664e93c42be0c93d
SHA1 5ee8415799454557a6334e07f1c5a76469ca5a99
SHA256 3a92bf9369feec1173c414db31f16983d4279edad50b529026694d37ebbe2ee9
SHA512 3d060a6bdc534eca9abdff616a4086a51f9a0dafadb6cd570ac8b4812595e248b692cda6a7126439f20d215e82a00b84e435e11d65aaa3163183adf41a850197

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\HelpIcon_solid.gif

MD5 264b6101e6f7f1c4be9de6ee8fa60c29
SHA1 6b61291c0b7ed4692d89501f3868b3a09502f142
SHA256 f361bb54f9756c1c1c5d4b1627d43ea0dbaf3c42948b3339fe702def8bfd5c18
SHA512 f99ab35df95ed62c0314ade5ff13135693ad029df7b4562eeb4397d85e4709374a1578d5cf40b5991d0edaaa258ae1ff53c18f8339d1a20eefaca94b24990aa7

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\folder.gif

MD5 e0d8dfb419d49653d70ceaf50c50751c
SHA1 f033a255e36814434c34443d3aa69821205580b2
SHA256 953644536739be09f529b5fb7a0b31fbf0a95f22b4eeeb2ac3f2dc9a76ef06a5
SHA512 0cb316e7250de0ccc97c17777b7d6db237d128284eb438db98176ab50b480796f30fcae5e5693b3b6a816d3d5413a722c6b10b4531d19983d06093f1058b6f27

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg

MD5 0e3a040b42240f678288d066d8a97800
SHA1 10bc1c2ad0e1407c4736934c7da8358def8a8481
SHA256 bb39e17575a83a07e2a00f067cef1c43ddc689f803575270cd635e80b554955f
SHA512 f01d225ef120a1e0aac4d78484a73afaf480ea6b7f5c9f9b635a835cc300a3136d73954cb1f9373637d4f72ea26e79ea70bdc671807c8103651c1c419369d13b

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\unSelectedTab_rightCorner.gif

MD5 7e54074aaa15b5f63d9b88c5153348da
SHA1 ca3c0941f033a2c35a3b3fdd82b6b907d23789c0
SHA256 e8748137a9fb21ac7633860740f4d4c9c46d752c7b5732c3e13e5d869baf8b87
SHA512 31bc22cbeb5b09b02365fd42d46981d0fd0593d00c2516151ce554c109c507c88c91785364a17851ec79cfd0fd3d13890f9e2d79e7cd8bdbdd78af4f5ac2ae00

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\unSelectedTab_leftCorner.gif

MD5 cb23dc69ffce4f012a71083c4fbb6e9a
SHA1 5eac6b7f5facf0a085501aa642e550865abe74b6
SHA256 fa7066f7c2843d80180ec71a9a2ce782078f60614306802c43058d33ea83505d
SHA512 df6b2bb57c3c6d74951b9a7fce8eb147af24cb721feed0d28eec7423991b458ac26d4ee9cb344eda3d753c4132b6f417a8dfe09dff2adc8c6ae14b0b92dbc848

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\yellowCORNER.gif

MD5 46ab9ca5a11646c5b589970212af2477
SHA1 5d5a1d557d4b65303b61aee709533054e12c9ab3
SHA256 e9d7807a679bb51ba8d681a106c2aad6f7d0be035c5fc44b4b272aded5a3fe46
SHA512 2bca78c286d8be8543fe70cecd3b87fc35c23bf294f5313f052e7412e9c91c398b82f34f16fd4b4df39ddb54fa73ee651646786e6d7149cbf425bf0e08d33b4a