Malware Analysis Report

2025-01-18 20:59

Sample ID 241205-tbe2psxmaq
Target c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118
SHA256 1f210c60f90fd8403099482455f3220b56b2864bc4d2b6af0abda4a2c3854d40
Tags
xorist discovery persistence ransomware spyware stealer upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

1f210c60f90fd8403099482455f3220b56b2864bc4d2b6af0abda4a2c3854d40

Threat Level: Known bad

The file c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

xorist discovery persistence ransomware spyware stealer upx

Xorist Ransomware

Detected Xorist Ransomware

Xorist family

Renames multiple (2174) files with added filename extension

Renames multiple (2207) files with added filename extension

Drops file in Drivers directory

Drops startup file

Reads user/profile data of web browsers

Adds Run key to start application

Drops file in System32 directory

UPX packed file

Drops file in Program Files directory

Drops file in Windows directory

System Location Discovery: System Language Discovery

Unsigned PE

Modifies registry class

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-12-05 15:52

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-12-05 15:52

Reported

2024-12-05 15:56

Platform

win7-20240903-en

Max time kernel

122s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe"

Signatures

Detected Xorist Ransomware

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Xorist Ransomware

ransomware xorist

Xorist family

xorist

Renames multiple (2207) files with added filename extension

ransomware

Drops file in Drivers directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\drivers\gmreadme.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\drivers\it-IT\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\drivers\ja-JP\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\drivers\de-DE\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\drivers\en-US\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\drivers\es-ES\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\drivers\fr-FR\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\drivers\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\KR9SpeDJd0PU1OJ.exe" C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\System32\DriverStore\FileRepository\mdmmhzel.inf_amd64_neutral_1292ec506cfc26db\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\et-EE\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\ja-JP\Licenses\OEM\UltimateE\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\MUI\040C\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_Redirection.help.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\angel264.inf_amd64_neutral_04b54b6322607cce\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\wbem\en-US\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_If.help.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_execution_policies.help.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmaiwa4.inf_amd64_neutral_6e97842bb8d9e6a8\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmjf56e.inf_amd64_neutral_328dabbf0aeed9bc\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\spp\tokens\ppdlic\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\cxraptor_fm1216mk5_ibv64.inf_amd64_neutral_3eaae75b591bd148\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\prnep304.inf_amd64_ja-jp_27c560b15d9928c0\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\fr-FR\Licenses\eval\EnterpriseE\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-NetworkLoadBalancing-Core\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_functions_advanced_parameters.help.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\it-IT\Licenses\OEM\StarterN\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\nb-NO\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\slmgr\0C0A\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmar1.inf_amd64_neutral_b8ebf59556c3dbf0\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\es-ES\Licenses\OEM\HomePremiumN\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\fr-FR\Licenses\_Default\StarterE\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\InstallShield\setupdir\0404\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\it-IT\Licenses\eval\ProfessionalN\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-NetworkBridge\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\prnsh002.inf_amd64_neutral_42b7a64f45c7554c\Amd64\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_type_operators.help.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\brmfcumd.inf_amd64_neutral_db43b26810939b3e\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmlucnt.inf_amd64_neutral_642a5ab3f2a1ae20\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmtdkj3.inf_amd64_neutral_7e1053ab483310f6\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_locations.help.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_regular_expressions.help.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmnttd6.inf_amd64_neutral_ce587aa61510da51\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\prnbr005.inf_amd64_neutral_9e4cc05e0d4bcb33\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\prnep004.inf_amd64_neutral_63b22bfb6b93eaba\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\unknown.inf_amd64_neutral_5eb6ac70dd1a3ad0\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\en-US\Licenses\_Default\UltimateE\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\ja-JP\Licenses\eval\Enterprise\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\migration\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_profiles.help.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\it\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\zh-TW\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\de-DE\Licenses\eval\EnterpriseE\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\amdsata.inf_amd64_neutral_67db50590108ebd9\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\battery.inf_amd64_neutral_cb8fa151a7b7cb80\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_eventlogs.help.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\es-ES\Licenses\OEM\Professional\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\migration\WSMT\rras\dlmanifests\Microsoft-Windows-RasServer-MigPlugin\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\averfx2swtv_x64.inf_amd64_neutral_24a71cdaabc7f783\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\de-DE\Licenses\eval\Ultimate\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\netnvm64.inf_amd64_neutral_59c2a018fe2cf0b4\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\Temp\{522f6bf6-ae20-0f66-d982-a746d010852a}\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\ja-JP\Licenses\OEM\HomePremiumN\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmaiwa5.inf_amd64_neutral_ea8128ac5da37eb9\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmcxpv6.inf_amd64_neutral_f62ac4bd04e653d0\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\netk57a.inf_amd64_neutral_8b26ad5d0cc037a9\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_data_sections.help.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmdcm5.inf_amd64_neutral_0bb09f3e5a59f3a8\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmgl004.inf_amd64_neutral_1874f16002601f78\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\prnky006.inf_amd64_neutral_522043c34551b0c0\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\he-IL\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\Printing_Admin_Scripts\it-IT\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_remote.help.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\management\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_left_pressed.png C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CASCADE\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Windows NT\TableTextService\TableTextServiceSimplifiedZhengMa.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\novelty_dot.png C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD21325_.GIF C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\slideShow.html C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationUp_ButtonGraphic.png C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\WB00516L.GIF C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Program Files\Common Files\System\ado\fr-FR\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\en-US\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0175361.JPG C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01293_.GIF C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\StopIconMask.bmp C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Program Files\Windows NT\TableTextService\ja-JP\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD10290_.GIF C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\timer_down.png C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PIXEL\THMBNAIL.PNG C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsFormTemplate.html C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsViewAttachmentIcons.jpg C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\GrayCheck\TAB_OFF.GIF C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\ResourceInternal.zip C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\rssBackBlue_docked.png C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\15x15dot.png C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\bookicon.gif C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\kab\LC_MESSAGES\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SKY\THMBNAIL.PNG C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_corner_top_right.png C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\system_s.png C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00057_.GIF C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\SAVE.GIF C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Memories_buttonClear.png C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15058_.GIF C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21533_.GIF C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\fr\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_few-showers.png C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\novelty.png C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\144DPI\(144DPI)grayStateIcon.png C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR10F.GIF C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsBrowserUpgrade.html C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\square.png C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_gray_rainy.png C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\et\LC_MESSAGES\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\bPrev-disable.png C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_foggy.png C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\js\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\19.png C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_foggy.png C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\btn-previous-static.png C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\send-email-16.png C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\de-DE\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MEDIA\SUCTION.WAV C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\120DPI\(120DPI)redStateIcon.png C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-full.png C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\winsxs\x86_microsoft-windows-e..nt-client.resources_31bf3856ad364e35_6.1.7600.16385_en-us_e5c3d3ec6ff64de3\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-directshow-vfw-capture_31bf3856ad364e35_6.1.7601.17514_none_34a42c333d8f8d28\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_prnky005.inf.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_651d70902f0bbed1\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\msil_microsoft.windows.smc_31bf3856ad364e35_6.1.7601.17514_none_ab698c2bf8d20bb5\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-r..-detector.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_6e98baaa18d2381f\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-n..n-clients.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_0446380dc1b5f086\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-s..lpaper-architecture_31bf3856ad364e35_6.1.7600.16385_none_d99106b927aa7782\img16.jpg C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-w..verytools.resources_31bf3856ad364e35_6.1.7600.16385_it-it_9b447cd29db3e579\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-w..inter-mof.resources_31bf3856ad364e35_6.1.7600.16385_it-it_5227565e553ce0fa\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-r..-resolver.resources_31bf3856ad364e35_6.1.7600.16385_de-de_2ae6385a75aae595\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-s..edstorage.resources_31bf3856ad364e35_6.1.7600.16385_it-it_ff7eb5ba7edc3dbb\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-wmiperf.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_10bf6abad040a711\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\PLA\Rules\en-US\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-lanmanserver-adm_31bf3856ad364e35_6.1.7600.16385_none_596faacb0e799514\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-p..rolspanel.resources_31bf3856ad364e35_6.1.7600.16385_de-de_1e2ec9b1e4be8d48\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_netfx-csharp_compiler_csc_b03f5f7f11d50a3a_6.1.7600.16385_none_8b52bb03d4ea5d36\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_sisraid2.inf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_1b4e047257628dcb\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-directx-directplay8_31bf3856ad364e35_6.1.7601.17514_none_d6fc8d83d55eb77c\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-e..nmove-adm.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_a1d121939c849ce8\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_de-de_0f8ccf36b90bab3b\403-12.htm C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-w..enger-adm.resources_31bf3856ad364e35_6.1.7600.16385_it-it_794c4f1a057375c8\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-w..igurationdiagnostic_31bf3856ad364e35_6.1.7601.17514_none_425e0b40ea226db2\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-p..onhandler.resources_31bf3856ad364e35_6.1.7600.16385_es-es_e1cd4f762107d5bd\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-a..ltimateed.resources_31bf3856ad364e35_6.1.7600.16385_es-es_055f1920451f861d\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-deviceux.resources_31bf3856ad364e35_6.1.7600.16385_it-it_581bce649102203a\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-h..centercpl.resources_31bf3856ad364e35_6.1.7600.16385_es-es_02c6e18403821785\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-s..lient-scheduled-adm_31bf3856ad364e35_6.1.7600.16385_none_67efddec4340e49d\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\msil_microsoft.web.administration.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_cb2daa1e54dd7286\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\wow64_microsoft-windows-m..ification.resources_31bf3856ad364e35_6.1.7600.16385_it-it_9162d781042f78ed\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-i..onal-codepage-20290_31bf3856ad364e35_6.1.7600.16385_none_5577c689454fb8e4\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-u..evicehost.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_afbb22836677576b\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_eventviewersettings.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_21f72c556adb6572\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-ehome-font_31bf3856ad364e35_6.1.7600.16385_none_2ad6e90ee30ff985\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_en-us_1da743febb1ea38d\about_profiles.help.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\msil_system.management_b03f5f7f11d50a3a_6.1.7601.17514_none_f391cd7ec90fa718\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-d2d.resources_31bf3856ad364e35_7.1.7601.16492_fi-fi_297dd5f02986cd16\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-time-tool.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_7d0d9650dd11f925\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_server-help-chm.inetsrvmmc.resources_31bf3856ad364e35_6.1.7601.17514_es-es_ff202f1be9bd66c2\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_tdibth.inf.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_722164471aee61f0\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_narrator.resources_31bf3856ad364e35_6.1.7600.16385_en-us_a9a8d9cf3d005048\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\msil_microsoft.powershel..hicalhost.resources_31bf3856ad364e35_6.1.7600.16385_en-us_48117ca4ed85b946\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-t..ation-api.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ac5a0be727fc1f82\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-m..-wmpshell.resources_31bf3856ad364e35_6.1.7600.16385_es-es_d3c91bede0a7dd8d\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-nettrace-netsh-helper_31bf3856ad364e35_6.1.7600.16385_none_f72251fe8a04e1e5\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-opengl-msogl_31bf3856ad364e35_6.1.7600.16385_none_56601c3dd8d1f42d\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\wow64_microsoft-windows-ie-feeds-platform_31bf3856ad364e35_8.0.7601.17514_none_e31b8144fc78a957\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-e..orenderer.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_4c53258288780299\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-ipconfig.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_c654f3760a630162\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_en-us_1da743febb1ea38d\about_Ref.help.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-d..airingdll.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_ee843d138fc2c852\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-devicecenter.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_585d2a750d1f79b8\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-n..iagnosticsframework_31bf3856ad364e35_6.1.7601.17514_none_de622c363f0c5007\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_mdmcommu.inf_31bf3856ad364e35_6.1.7600.16385_none_4d3b1a3089ccc445\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-h..-medexptv.resources_31bf3856ad364e35_6.1.7600.16385_it-it_6e68945ee5b198b2\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\msil_system.data.services.resources_b77a5c561934e089_6.1.7601.17514_es-es_68935e257dda2cb6\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-n..meworkapi.resources_31bf3856ad364e35_6.1.7600.16385_es-es_50d2057f36677561\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-sysdmremote.resources_31bf3856ad364e35_6.1.7600.16385_de-de_0743e6fa5b05a465\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-helpandsupport-adm_31bf3856ad364e35_6.1.7600.16385_none_925cae255652704b\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-i..mc-snapin.resources_31bf3856ad364e35_6.1.7600.16385_it-it_5859b0039313ac6f\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_de-de_0f8ccf36b90bab3b\404-1.htm C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-uxinit_31bf3856ad364e35_6.1.7600.16385_none_5d2c46c14d8633f2\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Xaml\v4.0_4.0.0.0__b77a5c561934e089\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\wow64_microsoft-windows-i..l-keyboard-0001042e_31bf3856ad364e35_6.1.7600.16385_none_07b94c159607be13\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\wow64_microsoft-windows-p..rshell-wsman-plugin_31bf3856ad364e35_6.1.7600.16385_none_dd58da5136d6b542\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ZFHYSOJPQQFOIHX\shell\open\command C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ZFHYSOJPQQFOIHX\shell C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd\ = "ZFHYSOJPQQFOIHX" C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ZFHYSOJPQQFOIHX\DefaultIcon C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ZFHYSOJPQQFOIHX\ = "CRYPTED!" C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ZFHYSOJPQQFOIHX\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\KR9SpeDJd0PU1OJ.exe,0" C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ZFHYSOJPQQFOIHX\shell\open C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ZFHYSOJPQQFOIHX\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\KR9SpeDJd0PU1OJ.exe" C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ZFHYSOJPQQFOIHX C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe"

Network

N/A

Files

memory/2532-1-0x0000000000400000-0x0000000000415000-memory.dmp

memory/2532-0-0x0000000000403000-0x0000000000407000-memory.dmp

memory/2532-2-0x0000000000400000-0x0000000000415000-memory.dmp

C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\HOW TO DECRYPT FILES.txt

MD5 403bfaaa91c60738361399702b9945d6
SHA1 8193fd7d9062be23d726f36e7a6cc3a9f6128c4e
SHA256 02b79fe6ced690038ae030729b1865a36aa1bebd9bd4fe16ac1c2268417d6a47
SHA512 54ebba8b7304fc95a44762f34da41adc68a2630bc1a9ff2a6cef75edfbf459bc38ccb1ed479070311efdb3a0f8c1f9070d397783f5eb44287143105236f80354

C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif

MD5 e8f701444779a65edee6b7ce59ff8fe2
SHA1 341ff8f54f6a77e4819231391fafe62a004c6c28
SHA256 1c70e6c83e51c816da5fb4ca51d050ae6f5d7c6eb6c111fbb0c3d84389319f5c
SHA512 46de3084ec5a94652e3837eb17b17ede1d141c4c98529d0481cb8c817fb0581f7a7993b662f4b661812d948b52c8711f65b9b76ba54e2650ab5d08980ad6b60c

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html

MD5 aba54cd08fb54a13bf3c51941cf95fed
SHA1 ddefef0fff11e8b97a883a49e92d9d1391198c04
SHA256 0ee475327a1603cbb99f59a38999a4b0b90a2b408a9e8aa17334aa1939ddd8e6
SHA512 f17193d94e3fbdc6a9820705ceef7f87e909c4d96e0fc28da9c8ac2fb65c3ab4204ce4cc31e65b62ebc0bb0fb7ce1d9aaca7af4860a2ab3d593397c9c6aec89d

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html

MD5 fc9a25ac36c7ed2887b86483bdf557a6
SHA1 cf4df71d25ad4fe3a6aeb682a4a9104a8c30116e
SHA256 b2f253e7a41c13ba35469f0cfccc1eea311f184f97f00bdd3834a4537b4f0949
SHA512 24097366828223725a9d0d0fd45d9b6aa504ec9ac95b82733aa1f685fcb626c77d63bd7a62e74c5f73dd7761d764e14ef2a7849d21714b5cbdabccf8b5c6318d

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt

MD5 51e73718c2a4e35c3ca8bf55037b5a48
SHA1 45d34e824f0623cecf0e3a9bdef6c53f1b237397
SHA256 ccd017c55c3ae8fd111887d570a44ac710205c19f06e7db4e982a2daa0148b58
SHA512 91ea6fc3beeab08da6a3960cdbce7ad8f1a685786adc877288607d3b64f0f4522373da049396d675f8a23a40f91c022e006e3a33c84920812bb816dc9a66b693

C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME.txt

MD5 97c31e18c69e9e98253921a64f885cdb
SHA1 4d22ef8585af16310ecd9618e206376ba459ca52
SHA256 fd02366c347d18b15970cedbcd7a965361ae5cf56e52d420bb5c39aadb40c088
SHA512 43ba073ca1a0ee8c0ea50f6ff75cfed469465788b88cf80faa8ca32aa90e53d5dbb904805543f3d8248a294a27508ba824f50c118fb5440d153298e1d298f28e

C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt

MD5 73ef674e9c8d37415edb4081c9448ae0
SHA1 0d27b6ac4db575983e504ca8f115ae8de12f2f61
SHA256 c39f834a47c7907902e096224ae0b1e16c37b2d43c9c7783c73ff720135f22c8
SHA512 16d525509d66c5d5a7b2555c7a4fd88b59af7f86be3e7b8f62174bd1055114e80e8583ec9591c05a3542a6485c891276481bee5a3fe0dae0ca9bd44a95b43f56

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_OFF.GIF

MD5 9168b1ad79697308b82b6fea19d42b46
SHA1 ff8ae37facb5ae30fa77ac125edfbd53d706b3f1
SHA256 106efdbbae9d8e07e8673624cb47169af36f89834f670132a83a6b6ec4b9b619
SHA512 b5927847b0af4913e9431481c67aa6c2cd597677511fadbf898b38c0fda35ebc05ed6ac02d5b368daffd1bcd87e8159910bf3bee5bd8bee745a55ad02dfc3fa6

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_ON.GIF

MD5 e8cead5185c91c529596e35af0e46ecd
SHA1 64d4c4c3d42f9669a7bb4455bbf4d77d2468af4c
SHA256 5c2a8d7e936132c182af7f448fe4d1ccf82039e11d49642351a69a92fc2d8d8f
SHA512 72b565beae28f4ca1b1c61c7085e0ff300ab0bf30d57eeea318fea77dd2310c8e55fc027bd0a59b1e650a2bb7e995c94cea1b054069b1c023f86a0095e437760

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\BG_ADOBE.GIF

MD5 1d48a281b2f1c6f10952480ec6594ea1
SHA1 0b1586f17291734bffe0a1c987ff41b7fcb89d07
SHA256 322813c3a0bfc78670238588f55170bb48edbf7954df934545cb5d28ed9d1d2c
SHA512 c9f81037cbfc8678c9fc9d089959139396635edd6891000a584a2e780924d820801ad5b037cd476ebd9c100521541604f60455c8ae37d8c00d2623280f276954

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Casual.gif

MD5 a66ca423edf28ffc2d77bd0317916c77
SHA1 e3a794112a77dbb8560fb8b54bfa586c4fcd4c40
SHA256 6fc590ed21fa0796124443ce1ceae0958cf8c3a02122b21aed7a8d6eaea09a56
SHA512 310156493ea4a923261559c6ab10efab282acf213c171ecd3c704247e2d12d2d5a28a7b8381adfb7e67893a93ff115efe4b62809eb7dffe9c43daff6006b84e0

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Earthy.gif

MD5 0d824fac75fff6616570b11ac068b495
SHA1 2b673cbad386097a5ed309bb1e81f72b98d4c028
SHA256 73a316f991b5e1cd59b3f9fccdca7228390342a38fcff02855996fc6a7bb163d
SHA512 00a53455208cafeb82580f9512e2b017c9a79433c0922c3d140266e704a60445972667f6382c3ca368a888fe250f6a05df878a92508ed56758364e113ccae98f

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Country.gif

MD5 d53a41145b67543c95cd2c6ab244d684
SHA1 60f37d83dab1fb4e695c5be0c0e1594023ac4087
SHA256 fd4bfda4ffc51bdb09af84d10a6ba576d32a057071dcc221ef444eec8a481c58
SHA512 0a45698f8d6b204a695dc5ede461ec2f655e670491b52ffbac551611238b6fae7b433dca978f9e142c7f040d2ac0a1ca93f946e2ec3bc896a63befaf5a0e820a

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Groove.gif

MD5 a2d65ed0f087c5cf5d85faa4c9029306
SHA1 3d744e87a58a47edb2e0d8b6967cb04ba65f1576
SHA256 2eb372fb56e18c42f0a988087aeb7019c8da91ee94b43857737577a287e71f84
SHA512 6590e8b19cf38bae91412390bfe1f507e08bee65fb4b567a4138f17f62b36fb91f40ba7efd422b8957a098891261a901c7fb3d30b2775b2161d9986aa0fdc15d

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_GreenTea.gif

MD5 63d58b975b0ce0edc5cd1026752f76c8
SHA1 ddcf5248a8e76a7b40aeff06bffceea54bc0fcdc
SHA256 22f333809b0558ce2a308856a4313948a0bf4f507a41e021a86d93e4f0d43c40
SHA512 cb6eb6f81b7dcae1187ab3457af31048a90f4e4d950fc41353341bf0b16c5d20eb1bc647390e4617c3cdc04db75957789c0b52bd3dc092ae17411cb4dd8bc979

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_LightSpirit.gif

MD5 ee3d1b252a89b80200828b50e0bb36d3
SHA1 3e32f32666645f32e7fc14aaad8fbd9fe003e91d
SHA256 dcd2120dcbd12a9fedce1ebac8a428ac2178ac766f62b69d633d6860d5fcf741
SHA512 55d7f2647f0bac8b9089dde9b2abbddca5aec8d5533ce8125fe78488b54e766574add2e20352cd6c4fb276c867dc3c83ef7178907b3dd5c29d10b60b93d3fee8

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Premium.gif

MD5 83ca0161e9c9d9c1bbea5193950145d7
SHA1 8f75e8ea1626e2dc32cbebe91011999754a1ace0
SHA256 9c706355e6656078f1685b4c7a5bda03af365e7c8709d9e13dc864e87645b908
SHA512 bfad014a5dcd993b93d29f7405d208567c274a4ecb9ebf6db4ab8cc1b3d01351a33beced6200c5d55d2f5c7e6d16eb8d64571c13c1e9fa16e28a7bdfd0430f26

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_OliveGreen.gif

MD5 9683fcd45da94a942eec018ddd8337ad
SHA1 147922e7b11a2f6d560e552e64858e8be1026e78
SHA256 a7f73efefb17a0a3c30d4afb8742d6f5460ba3de0cc3ab218cfac9fd7ca00dfc
SHA512 efbcff59f812a56eb139dcc4359059028de0d3564a023f3cf59c45e718b021d3c85186656578c889ea85cc91898eb1b7eec274136fa7590d084c833e828dc8c1

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_SlateBlue.gif

MD5 ca6d9c9a5b5603ce759eb5292359607d
SHA1 c6bfa6a09bd8128f13c208c2592b91e142282a21
SHA256 33d2f4cc2d6e391cb0bd77150976727e8a3c98b28d99ef329530ccfaaf0a8be8
SHA512 430f723d19086d51c04c5953ea2f48950874d234ead90ab41df30c156fed94c3ec14d07823f82c11d676e071d27ee36b843fbd9c8c77c82728544d568990148f

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_TexturedBlue.gif

MD5 a008a93e2a5ae27ac3ca51ca5c697f90
SHA1 6a1e0e0880647d2a3d69bd578a068f082bf0f7f3
SHA256 df5c1814e095e8973d585db19b69e77f448817a863fd19173f9593a9ea086ade
SHA512 3ee92b58c7740dd497b3c33e8ef545d76a210cc83e017cde45c360ddf3df318ef9891d53ed7cc3a029a643c62b28063865616331746acc2cee84e4e237e1b993

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_VelvetRose.gif

MD5 a42ab0d5004519822ffc5eac508a0e2f
SHA1 6de76732ec8df30018f83d30097d74f09b324a45
SHA256 0f0f89a3169b1678ff0c7ffb33f32d1312a486561b2b8f1b3d43cc9167f0f34b
SHA512 214520c8fdc6b0ec7f5571e72b8039f278eed898b19b7ad830d10b9bf76fe0679d6227dbab83abd535a708f6a6defd6ba0d6048553357df5d0afcc2497651028

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BabyBlue\BUTTON.GIF

MD5 66d6820de640073229cf3cd935b094da
SHA1 5405cc33485e016ec5606f56a5de234b76778ead
SHA256 07d057c66440de22342b51be811385e7f468b6602f87f908ea3e19547b84f73f
SHA512 ce11645e7361474bea20aa0582eaa5abc263612173d7e841f984b0e4a39346f13a4448a4068ef3d063ea50803a6364fecae043d693d61b636dd2e64a84e6bca0

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\TAB_OFF.GIF

MD5 f3b2a27104bd84de907b1d63f14d03b1
SHA1 daf617df5d5e6ba0ff52408dd93bb506c5d74689
SHA256 fdf2caa6e813624d93667e575065c72636e023fcc1cc66f7834f163c56f4ef84
SHA512 e68f626454a6b862d894b0eb64b8104818f6a887b85e742677fc816a7c8d7f76165450f89ee7c823f73b97ba84e7a74309cb0166cd7cb892f7d9fee44ed09b5f

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\TAB_ON.GIF

MD5 0dfd3888cadc8d35821ea3dbd8e2f0db
SHA1 dd9fee88a74d9b970901574bdd907cb3cc25e0ce
SHA256 3bfa3586b56ed484982359b1a69f916ad0edd2f3e8c81acbc74bd8f9e99c772f
SHA512 0774124683fb0f79ae908fecb7b3258ab8860dd6de9ce5598866adf31fd996b474e60bf2bfe630dc30a8fa268012d0b832e76b8cb86836d5ccac40f40ef46f31

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\tab_on.gif

MD5 cfc3928c91406791ada1bf0b41749c27
SHA1 311583f4180011d44816b75715fd822a915f168a
SHA256 b3d262c344e39e1c0e73afd8f6a079baade9b5adfe43c02c8b7a393ab27ba3a5
SHA512 b56a1b8d131655e8d6b31f98ea1d6a115ad9af146a1f5d4d0671c731049e1b1d2caaed9f875159a4475eb838ab109cffff175e31854ed621cf70ffee16a1bce4

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\tab_off.gif

MD5 d020ef033decc9b992aa4bd445dbff7b
SHA1 727e2b45ad3e5c0bbeae43913a1ea97813a9c01d
SHA256 82c221e5d22bc78b2eade8de2a6154db44e1565504e2c4dd88bfc845e6f8a6d5
SHA512 8422d270f3392e87e841f96a8939fb9afd6c1bbfaa70ead6a0accd93cd063bc656f3386093865cfb71f783753754c5c8e8984368b19c8d9c6206152fd125357b

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrow.jpg

MD5 1baf52d6bc176fc0611f30b8fe8678d7
SHA1 39059c87fc898142913bc42aafdbc2ed725bd3d1
SHA256 84d6cb4c3797e7cb3f187987bdafc96b4976dcbd20031cbd7678cdd631a07922
SHA512 08e42dbbd96b2d727745a133b675052f1fcc781cb5817dc726b87f9ed787056e87631651978f116244faa1faef936ec382f9121bce698e4054adde7093185b5f

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrowMask.bmp

MD5 09917808c5059a7535387c276313e046
SHA1 5ec24dd1b761c3fbaabf12a17fe9ba54afe47ae7
SHA256 57d1d498d07a80f3f76bf4166cdcfd28b7ceb33e3049ed3e41afaaed50caf985
SHA512 118fd9ca01e82106fe531a47bffb862cc6ed3fecefdd315c8c9dfe46ef536062784caf3acf5b2e68175c366113f546f926633f461a1e2c67e3e7f87edef7cbe5

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\attention.gif

MD5 a83deffbcdef2879888a42147a3a5773
SHA1 9f1084903e0846bbed729d3c158f81a83b10be7a
SHA256 bf2d727472d57934e3a3e10c928cdce59dfedab6f4aeb629b6c31a94b08417e5
SHA512 cb782e4f192ccab589dc47885bbe79024885015caedb7879d306766553598c0e804847cfd7aa8684b57a4a49af07f2951ef2e44a5eb737b8ab3146235927140a

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_FormsHomePageBlank.gif

MD5 af80b873c6bd8c35282c034e264a7036
SHA1 483c1491d97756611ce400a2504d8b46089d8654
SHA256 7a7ae554335c717cf371fa16673cdb8edd96032b404d907fe777d7de59bcdf38
SHA512 73e5657c088b9066e278181f6acb18e2409215dcb606c2b517f8cb6e206ef9521b97335f5d0b83c027bd8795146bb156b37f633a697c36e51e57564b4ffa10cf

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BabyBlue\HEADER.GIF

MD5 4ac5901f6b947bc71ee374888d855c88
SHA1 bbd6f8c653b1d60c9fd1dbfd0c858f183dca42bb
SHA256 38ee9f227f6208e6a9aff10ffce2b1d36ef64f8ac969c9a35235ac3f663c5d65
SHA512 9abdad301583022ad0c63551af67136b910b7cb7a2fd4d468ed46dac780129ba01f133dc6e757fcecc77f57e03e75797953b681dee020914a13086a84d02412a

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightOrange\background.gif

MD5 5ddc6dd8436c9b149a09fcd63f3a86f7
SHA1 6f2e119d45caf10729b0bfd631deca33c30ee10c
SHA256 7910e397c0d68871a1577f1bb70e101a0ee9abddf06c8a3e7748305e81107beb
SHA512 ad92301ef6cde9cd0f6ec5dcf082737c9c34a5a27be57351f0174399c1925661df630706b13605a09778d28478d5facf9e6913abd53f8492e56f3140438d59b2

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightYellow\HEADER.GIF

MD5 e611ec46e50676cf3588bbac2d73d9be
SHA1 f2a4d1bdb9af707d5f626a11b7abea91a981b213
SHA256 bdcd58e073da2d486481535f240c66abe4694eacc1be6a1a8fb1289d65925b71
SHA512 646390f3043e11ba1adb2b1247d54a09669c1f585fa6255b115c8885e798e4812aa9168fd7c854eb55f6aba8954e7edd375ba2fc9a9669aa9fa246f253e14a6e

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Desert\HEADER.GIF

MD5 5c75daa6a7c31faed8b228d6cdbbb919
SHA1 78a551bd52dabcb7fd93d15b3ba125eba68233ff
SHA256 7324584eca1d6b9e2e2bd609ad0edc2e48fc736425d8bafceb13a8d8a4a03405
SHA512 027bd3de369c5ac9a95834a4e968cf4b74f806d675828181bd141d9750175e553bfde514236578aaa2dd194257295ae42695fba726fe4bb6982990487bd9878d

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\GrayCheck\HEADER.GIF

MD5 216c7883a5feb2a9a300293bffcf8e32
SHA1 58c22aa9bdadb6e7b796984ed5bbc04bf613c84b
SHA256 efc94dd4a724567ab5f402461f1248032b381ebadb7d84d003ac5413d24e35d4
SHA512 258f66069798c8252809116c1eec04e3fab30ceeb6705c1d37556fa11f1c1c75454c8e8952f8b7a1fcec3d7f0924b106119ec238c60ca31179845b46b1b14e5c

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\TAB_ON.GIF

MD5 fec391b37c7aca23b4acf4911385e0d5
SHA1 e45a8f738f38db3e01be0bac3f7f950078b59691
SHA256 a41a5388924c8e95798aeef18d5a8a015d938b66cf021242d7f42e3beaf5da5e
SHA512 c9737d61da7a99e19f6dd0439b057b13cf92138b4b3374a87a0bb8e54e8bc174e7f4d57974780c8d857a9dcc5088514c3bc2964c351df2dfeeb9614b0030b87c

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\TAB_OFF.GIF

MD5 057f79b04d9e869d6438c9b73c790e4e
SHA1 274dc6880c07e8175cf037737385d0f6b8a96e89
SHA256 22f3ca6ba53c4f37e1ffc7e0b32e2aa913d8b7f9ecaf8bb7b09571c463712688
SHA512 8091ecb7c393195b8e27dfb8a432d6735eca90ba11e572dd40959370ecc48e30693231339b8c131cda4cc4801a031fa99a8cda80ab6c350de8361b8d55b1a8ab

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Oasis\HEADER.GIF

MD5 a9347f44353c4a999e5a93c2c7f1f5d8
SHA1 15e6432207d7171c41ec9010068074ab190da55d
SHA256 768d505e0082fb456cbac3f2ac50b83c35081f3ce475e55b20c2a1b3b9994387
SHA512 5996317805f38fcea7ce06b9092937b9dce327b1fdc10946d7d9dc5c3166147ac5ede61d03afcdc2d134fe3c4a4932d7705e1afdc59d4f839953578fef0529dd

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\TAB_OFF.GIF

MD5 fbb3e63abb2121f9c8fbfb982cd143ea
SHA1 5db93196745792536ec046e8a19fd6b546f74f24
SHA256 2c3a333c27a2b8eb3ee0135276f2abfb5056ed4bbdff3319d17f7ba51bbc882c
SHA512 60cf30416205633d8a98b3a85e233b4b5285bd39afe154e418b1a32833a44b1f286b12224b89fb14c0b264cc6e283291f1035956555d4f80608243668e827af8

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\TAB_ON.GIF

MD5 ded317e06aa75c89cd29f79cff34ac80
SHA1 71510755de72fb8940bd4340a836a63ae840c3c8
SHA256 7d2eefb1d8c06546b91d79bacaf326c19c6f5393ae6ff15e78a408857e4d2959
SHA512 2ee186f2ac5c978d5bb229e72dd41417bc7d55865494f931c81b0a98b030e25fa1fe430316665d1932ea5042bb05b8f7c06702dfce158e0a6d8a69a9367bbb0c

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SoftBlue\background.gif

MD5 1faa537e0904cc514c5054c550115d30
SHA1 aaba0bb5cbfda626cca78e80a74188ac78a299bf
SHA256 9f4ffceb475e96ad6a10a6961c76c3a0d31c091968a1c1020e3995e617980a5c
SHA512 bfbaf6e5477adbed7c7d13da547e5bbc09ff40502e8921ea9d9e9dbffc09c64af9d7897271f18186e52604df3ef029083601edd047da6644995d06517d41e72c

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SpringGreen\BUTTON.GIF

MD5 5268530ed1b749b9e33c480c8c7320a9
SHA1 650d6422b7a2c96a85e4c63ce69ec4e5942e160a
SHA256 e1dbe8c20661dd996d399bfa0a2403b304e85ca6994b0e22e596afbfe842eb92
SHA512 d722d2e07476508fb4d094beb5c3bd06d908f87da880a591a57e80d66e901584ec66ea5b135116618736d384b633a8d3feb2442263b60f1afd68b048c5bf222e

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\background.gif

MD5 af7fa5ca8bea5a7197dae99b8201d9f9
SHA1 1d8da78ccd17a348e30cfdafa6e36b88a7ac8776
SHA256 1f92dacc4a57ca216a854ee1dd611b776d6fb315a4fd0cbf16054cf769adcef6
SHA512 fa2a9d49eb7a9bc85eea19fdd10c1bad08dc49af32bdce46f731462adef5aa2b5954c7079109fc0f3b75532180df591d226b7cc63e7acab46e52aeded9796254

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl\background.gif

MD5 43d8b5e7a4414c400d0f8fd10527f416
SHA1 5eb1d993e22d964578f1c488d5688132fe040df1
SHA256 437454610947954694ac58139f0bb2a7224b5e7954293b2e6c8abb811a2f7efe
SHA512 9011177b2c71b0d4595fcd8fdcef28c2e9b5170a4265796391baa5f8dc0a3ee3cc7979a5d16171f439c99e9e46e2bf374b88d64df191a4531e33795124b927cb

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormToolImages.jpg

MD5 e32e2e62d03139a5287157a4eb91e249
SHA1 4058645da9cc196f6c19f99325528fecd5eaf54f
SHA256 e58cfd344aa0ed12a0e3903d383c7a6d36904bb96d74ee845fbaefdb0b39061f
SHA512 44d83aa8828e2c5f002c28a0488a7e209e179f28f56a3a0faf798057079d7a210962206b2f45df77f7a5bd7187855988da81d6d3ccb36624bc1d7f9b8ca189b7

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\RTF_BOLD.GIF

MD5 74034db9823229c664332cfac2bf535e
SHA1 b4363fc21e65d59354db97ce1171229e008a8c74
SHA256 6ca024ee8e56ec80160f738d0057b78b2f19ca84b0d010c4653e9a7b4c895660
SHA512 0095b1b8f6f179c3920c207b50593e28038831f565a172c0a01802e76771a3ee0f03de99ab9f8287b53ce2ba4b9aa74c00455a122b5105eec42933bf9c61669c

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_choosefont.gif

MD5 9ef59bf3d042f9ee9e9e4cad3c962d89
SHA1 42e2103980ec307a507c7bd7bb3bc89bc5241805
SHA256 81f2e54727fbf67d60b89b215d1d46e37f6df991054f9046d300624342c492f2
SHA512 b7007bfe476f528ddea68740410b82b5b2c58edb035ac7367933fd629dcc902866ff5f1e5c3623a6b92e5849b6c5d79fda32d5bbd28446de78971f8a6fa95d3f

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_italic.gif

MD5 8c70182fcf48070723d8b4d7eb9d15a0
SHA1 955a74eb0bde03555b7496941e521806da971224
SHA256 f648b045bc70df6d30b6d3373fb7c21f13b34f74978b24891bc37b591cbb226e
SHA512 e0c8aac2c438e54b245d963e2ef186854e578eddc49357656b444cbe5146061c5307a0c73275f9c7cd0a4669caa269d43bf9a3e1b24716b1d906f62a43de42a8

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_underline.gif

MD5 c6009bb6598013e85bc9e3a4fcd88bc7
SHA1 b95b235488cb9061762dc96f9fcef517f4f2aff6
SHA256 60e32ab69bd212b366e17a1797bceafbe4f1a549228e4ae7d31115291472cd6e
SHA512 33f6cdc3439c96bc7764f508f2f9a2e13e997cbd81d1b08e4d11273c51e0ad2f2678ee81869d64f8a34dff730ec292aa872724fe5f9ede1e7d78dd7df6822c10

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\ViewHeaderPreview.jpg

MD5 5e3e445dd8015f9bdb0c634e19f5fdb5
SHA1 7e170217d8b21079fa587a72649870977038695b
SHA256 c8d14e06a383dffac60e37a03523b18b4ea6c8d9782574a094161e28e14f7444
SHA512 4720e9979e3963416bc2d1c9f114c00815a715b43a5609b529fbaac842f168b769778b5d04068797385b8517c2d26d061aea4af3e15ae341b3c1049b53b49c04

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\ADD.GIF

MD5 fd26341eb8b4a46f3061a7e8ba49f90b
SHA1 a1979243a338d72a979774e3d2f7931bbb117a3f
SHA256 5739aa7b3279ec0c429e973fd46d216dd834811fcfc9143a90ea2a18436f6547
SHA512 2e9dbdc37f80b19e8391e34c45eb396904bc05956044e0c574f63c1437c17d4d547fbdf298415ea3d52cbb07dc57487ed7daf41911c1097203ffd906a5f3ba57

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\CALENDAR.GIF

MD5 3bd886c52b4362b5aaa2e18e4b051393
SHA1 13228e75b6f5b516ab8da3d058973af3ecf70b17
SHA256 d24761099a6b28fcc4ca14200bfe20863fc0813ff11745175a449f052942fa33
SHA512 0b20fe407a97de50b9457c1bae8df199ccf11e77669c3e190f554299a894bb4ef8c189845d4ac3fb348acaebf44e77b1bede24302dfc59a54ba72d39c4a82bc1

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\DELETE.GIF

MD5 5457b82832da386491e7123cde4f7913
SHA1 c3632d4e485f0d6938a182948022304c11e02999
SHA256 155444780f0d8cc29ae508920f1ebcc6494874966023d9fd86db31442cab51aa
SHA512 e821cdcdd9bcdd301dc9c0c4f7bf31b797fbd3e39aa5d292c40b5ed94a2f3719629308b4d7d6b1c39cfed3ee21983226adb785f088d3c261850c485ac173f3a7

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\ERROR.GIF

MD5 c32cdcc5163c402b67bf1f7f25b7181b
SHA1 6dcfc33a7431a59d36724d1fdc6879e5a7c1d60e
SHA256 550c52ba7ae503e336699ebbcccae7882a915490f9823bbdcddc2b483b078935
SHA512 7e5206b29bc1f61ee4c0e3d04feebb6b8dbdd406a1a94f59971f44a2ff936eccc7f3604bd8bdb19a37b0535750c525e0dbb4f6b6d29769a098c3c334e7ebe8c6

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIconsMask.bmp

MD5 15e456e1f5d41e7a2c1b73875703b093
SHA1 e3a04ce6b217343f5b0e6cbdd2d8255b9dba57b7
SHA256 3596fbb846eaac5030c3516224657f0b8fe6377575b2e1a0b61468303d58ced8
SHA512 1791fa247ee8965efda62a651ab55fcdcb1cdf0973ceee8020cbce06bdc27150a9be444821f4c755868f1d95d955b0ea963eeaa1e2ff593976c93fc284d92721

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIcons.jpg

MD5 dfdd6ff5718b4a33370ec609f22a2c45
SHA1 adc31ac6a5237f8ce72b8cbabacab14f210b6e9b
SHA256 3157922305a8bf1fbad29f4bf6f872c7cbab34a5afbc9902580befdc74f07fc6
SHA512 09ad3e057e452c7c042d46024b3649cc692889fdc1de57a76a91f5151f99eb500652ea8a158a071d8d5b1b3945468afb73a8437f1836718739e5e59607e0b7ab

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\LAUNCH.GIF

MD5 61e2ddb2fbcf57bb8a49470c99f1dac2
SHA1 6b05a6fca636bfda4363a3b2ad92c1890b5740bf
SHA256 33a752f94368c57221396d437d1741993f2cb4e5d5dd5b5ede8da6752bbee558
SHA512 4db360ba27a70070d96e2fd15d62f96d5dc7943464508d51ffb49aeb2badf45033170b7adfcc251ce5b6b10220d1e40aa1b296366a1903524cd3eab36ffb9d43

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignleft.gif

MD5 dc8db2342e90990ca0702b0b5f7a8062
SHA1 4e86c73afc3ff186742fb8af564fe43e5b21e554
SHA256 dcec95bf26fd92829d7730524a54e7782a4c9fed8d722485717997f7d4bb702f
SHA512 3aa6119c6fafdf0da5914c6338835de2ac1861c5cff570e7f3d84f6faa4654073a175fbd116e2a75f2bfaa345083210f25d877ba8b9bace8690fa1757921becb

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignright.gif

MD5 abd6b47689fd45a80dd5df86b4e6ef38
SHA1 130df5b8436d45059148ade6c76c4a06c46ba425
SHA256 50cbde5d8ba34070205ce15284775679e6e0549e7fb91debd6900e63c507af5c
SHA512 b86ebc7f9c688011a93ef06c2f436e1d1d0bc772a5b84646c7a310472adab6a067b73eeeaa129d24fa17c0b987aa2c4d82ee6f3b36f786a643832cf051c80e21

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_bullets.gif

MD5 30e6465a8782add249e869063a54e9b0
SHA1 b40794def8ff0aa6ec50dc03014270a5c213fab7
SHA256 c84cf2bac8299e280573205099aad77a08a0843167e55a5b40eeb2f23969533c
SHA512 11801b97879c57d755d968d0b7c5bbb95f5934a4be5f5f7971cb2cfe904a7ff7b31d09095828431bed70445cd5ee0202309a8d28b4768fbfb5472bc5b577d0c6

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_decreaseindent.gif

MD5 cac76c45723cb414f8e6f758e2681aa2
SHA1 8bf796484c517f806dea55c13bdcca9fe3f9dbfc
SHA256 7359ccd28074bbcdbc3ab72638024a81033e57f9c0a012a2c1c49d2dc995345c
SHA512 8e5a62ac53d8532e12615e0535479e4c763e5603642c2b6e19e1407608367a676ba756d2e5433a22a39c506bd7bda7b5f332fd7702383230aa44b298d202dae2

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_center.gif

MD5 7a8a0a1938f0c9b72a596acd9fdbaffc
SHA1 8f0094d919771e87b4a0cf6d0bedc54d5fff38ab
SHA256 94409b6e7aa402bd92ff86d5530dcaac04f7bd93cea530b2a2a15745990e7c03
SHA512 499cbdd84e123818b91332fc4332a479f8187ac27c4105087df11df59c87c94ee5aeb2d42d6c51491dbc2c55aa341a4b9107a657a4956a591c0861bd5f00dd19

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_increaseindent.gif

MD5 0d45cac1f53a3b79a16fc8117684dd90
SHA1 06463e5c80a99adf04f66eeba0b0a9c14a8ebafe
SHA256 0a19a263da9143d80a401598c276ec476cd55c5bb962e5a4de6b188ae60cbf6f
SHA512 e10d55ced3faac692c14234519a01bc115c3f1ede5e7629c87b9181b1c30b040f721352ec57e632711330b4542f8acc1a6054aa81a39c0ee57aabafd31b2758a

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_pressed.gif

MD5 e510589c74f44b3715965e036d77adb7
SHA1 1059f40ef9ea243a78de5d912aae3c1f517a4ba5
SHA256 89ad560739f817f3cdf6ceb6ea7f81c24207caf60ea95836249edf8dc50b7902
SHA512 df3250b296fba4475380b5bcfa59eb0374d2c656ac4d7b49ae42fb1e01ffa17fea913d8b7aebae0afe2198114441df802c6db40a9b21d5d557e06ec73f527910

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_justify.gif

MD5 d39b71226c8fbc73930f091f41ac416b
SHA1 b1d8765de4e04b605418c5b9f421d2cee8890915
SHA256 f52345f9c35a6f144ee96fa441a8c97080a4f17fec0376768604195ab29c85b4
SHA512 8a4bcdd2adc53e7dc52f66095a78a7855386558a451738b02f7db3942d98a2f8862b1cce975c3798080a2d859d86fa7bc39b299c6fe91926ac7114d83bad1553

C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Windows Explorer.lnk

MD5 81de3ec94e247223ef9d4da83afb51ab
SHA1 fcef9adac1a400efef72d5a5232a467b96423835
SHA256 482bdad3561ac547bd90f52986749d55e94050a88e563094ef639ddd92c0ecfe
SHA512 cd0dfdbe7bdfbb2e35379e630d110c8d5f203781afa1c18f257e686c4d3a36751597a894760acec96af184da903256db05a1ae7f3a53a853d5e415fbad34245c

memory/2532-5943-0x0000000000403000-0x0000000000407000-memory.dmp

memory/2532-5944-0x0000000000400000-0x0000000000415000-memory.dmp

memory/2532-7248-0x0000000000400000-0x0000000000415000-memory.dmp

memory/2532-7252-0x0000000000400000-0x0000000000415000-memory.dmp

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\security_watermark.jpg

MD5 20f2044701d0923e013515d7b32b4928
SHA1 30d30544445da6513071b08b1b962cf81993006e
SHA256 8d68b8781d83f14ac66efb2f8e9875eb8c06bb03129772908eb1d76bb6745b64
SHA512 560ad7494939bb91fc2df2bdb8a0f7b025ec2a9c47bb8dcee76e534066489f2a2fb73cbb8cc0e1b41b14a89948faabde72f65c7374d8d03faed21d76bbba37ec

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\branding_Full2.gif

MD5 f2bff720a852de2db4d9d966b83ec09c
SHA1 964037d7c4b64137fb751fcd918cd52d752acc58
SHA256 201ae8ed2b563bcda7d689aac7ab205d88adba9dda3e6fe22e33f10397a9ab04
SHA512 4e5463dd2251fa73a5caa303ae031ade95b77b6e73168c5fc65d89f1ce90e4c67d45383c042158e96589fc03cc919d650e1a9e592748731d41833c73678872fe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\aspx_file.gif

MD5 c42eb19e9bfec339ecc9a2f684527016
SHA1 3c381644a2bbb526e2ea6e11e6c7d0396800738c
SHA256 9fead7373d52b3a037356621f6d47a9cc530f25576c64912341d66e58ad50543
SHA512 02607f8686a5a382bdf1ede1737b0db07f7f2c4fe48f12ad266facc84c0924143e001a64bd5c10a6b5360ffae7b81b33d442c35603cdc3d556b1133c82227666

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg

MD5 22f5a98fbc9a514a6af4b534d9f858d9
SHA1 61a13f66428b2cdcb12663de5a7cdcde242f7623
SHA256 484c3a3de2737011645a444353f1bac4a8b91a6d93d2674701670eec5fde15c4
SHA512 294fba00000734db4bd30e70f7a140b4e61522db398cb2a0e9dc0ff858fb1f90fdbb9b8de4f19db4e73be33c508ea8b68cde8f3e81e20b4ad62fb75f326e1356

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\alert_lrg.gif

MD5 58589a00e2a4e1f192eec7f63e881bea
SHA1 dc9cbe9a4c87f424ac6ff15863e85c82bad5a192
SHA256 4723a146f2b903ba09a324f4c5cb4fed524780669caa28181c49d17e9ec8b006
SHA512 69fcc5489d3dec0ca7b03cc41104a1a909b36f969a76d8bc21f30483ff307138e902f4f07223617490a5cb03c620055acce79bcb9e555e6e0ffa227f83872eef

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\headerGRADIENT_Tall.gif

MD5 92decd1691e704ea19c543566b711d80
SHA1 21d4832ae76c917a4ef22f9fca665d93990d369a
SHA256 b5e5e1d3184ce7fe656363dc47e3767977d7054031b379968ca3394eaadd6a06
SHA512 9c70ca28df33bc497bdddbdf5d02fbfba760108d476d70a943ec92c04d2832784498ed4ddc2abe9e4b71e61e6ccc136081216f57a8d5a8edd696d1ad26edba5d

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\gradient_onWhite.gif

MD5 ec12a35e08fd0d01249d0cc6812c2dc7
SHA1 0500f53476d9fdddd6d6a6f2007e438076ebf2df
SHA256 a749ebbb124f2ef8746066872e6a9c7f04f5f58227942fe4e9692875d58e6885
SHA512 fdfc5b96a69a1d772ab67ec65f1a442cc1ccdee8070e39acaaf48063fdde05b84f56a3bdf9c21575a83a93e902a46a7132c0bcc4ed35f99ffea34c31cf4f5735

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\gradient_onBlue.gif

MD5 7d4dd188901227cc373fcb2d46b092e5
SHA1 0c14fe61e10eefa82f9b0bf3ea2cd273e2d4b268
SHA256 f092a6b2c56ec9bc538ecbb73cc4a46b507836e9b313ba0bc30e8ec59d2570ab
SHA512 ce2621ecc35e4e24e9e121eb2d6dddc7a329548fd17af09fc862356ace3af406cadb816191f9d6379052a9ba74b72e7ba1fb4b5d628935d49f288cab6ca32244

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\help.jpg

MD5 98bf9d09fbc7a3e20d4222684f1755c2
SHA1 40b68681ee2f2f01c7b5b39583ed2687969718bc
SHA256 a96ba78ddf0547c62a46480c77e4de3352dd7abf114ff493c80b9e11c2e35006
SHA512 0014308fd3b52f59c661dcddb7e40c4a6f96cd0fb61b0a8efd441a41c6269fd4cd93991ae42a1cacd23212441b49a0791e0847bb55f2257bee164ae9df91cfbf

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\folder.gif

MD5 e513abe9f14f466896e76af3e5114673
SHA1 bc9f0827c7660b66f3fad82aac2dffcbdfe81b59
SHA256 0c771e01ad21685545b7626b3b49a4809da76700a366f3507604fba7a9287f98
SHA512 be3f83a388b0d6513a82d6e86a480620830c1223292a5ae3523185f810f6db45e6a5e16ad746946b406999f3c8804407ce6434ccd3ed2c5c6cf8dc1416500428

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\deselectedTab_1x1.gif

MD5 6c27c510cf634ee915ad98efd33fa9ca
SHA1 a391e0979dfe65984fd8990f6cda0b3b06fcd846
SHA256 ff4f15a96944093e4546deb6c1c11c61f9c580f6a128d0aa24f573105c456332
SHA512 0adb07d3b20e8a9beeb53ef222c0d51ccfb28a1bc1385946082bddfcce7231f07dff4b563c0abb88ca4ae998410be77f34e0177fd88678afd7e2d769ae9f3399

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg

MD5 78fb30cb23c7d887f0834301a56d844d
SHA1 b8b66be59d4c4b49f79c6359518388f9e15662ef
SHA256 d97fe1636de39aa5130d057e56e855a58c7a33994f27bc411b7ebfef480f4645
SHA512 b8c5590ab998f43867c7f030e6a2b78f232b0ebfba9534eab10c798b9ec9f4e19b7e7fddcc2a4be544c75e3775282033ee32cf17247dfabcc5c643d1ee09df12

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\image1.gif

MD5 bff5530f721097a58df0a1da0a33848c
SHA1 575839c4b2e0cb5114e17c636cf5caf0c0f4773f
SHA256 df436280ca5fba18da991f17aa398c8e4668fe54e94a791409a85db520c47be0
SHA512 f2c48b2c72ec90fd52c32eeed63f665dcfe4ac846edb63a234d49dd95acabe5078eb001fad24eece7e2b6f0e01c005a6c6644c460a5774600997c2ca46996e4f

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\HelpIcon_solid.gif

MD5 7bf832e1e4a15c7541c1ad1b497c9033
SHA1 f86c704f119d232182ccdc2beb21c60ff28296cd
SHA256 1b3fc6cf0caa18c7dc73d19c0b36586a9fddbf8c1e206399b5d782bb51b5c6e6
SHA512 0f983931bd91e3f5e8f2b0d456577a41023a985fcdd7fb93e36300b3f7c570bde038fd9f2e632d07b538f01947e0d6ac2ce54b71aaea1ddb95063c375165646f

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\yellowCORNER.gif

MD5 1a27d7cd6bdd8bd487c1da1b1be0160e
SHA1 cdc21e2ab05f39cd002618886457ed6ee8c16e5b
SHA256 17c6bcb5ca3ca05840c2b68d5d2d94924e270e9f0ff6f93a7334a3db01461b67
SHA512 d008331e145696a15edbe3cb6a13bb6fe38d0063e2ad66a6ab81d87e3b27b1184b006f1611ffb6028588cc74d93e516c72803a6c21a195f070f6990e2fd1fee6

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\unSelectedTab_rightCorner.gif

MD5 60f93f3f3cf6a34606e295981a7e5b85
SHA1 b941ac3eb49c93d08ee2c043e2d643fd943ed91c
SHA256 b75a10a248a26d182a0310a7cd4db02d066bca4127e9fece732e1e965b5ac202
SHA512 12b68512db831fc7ce4f1e63fac7aed1447c902806274954d2271a546b296a3d66a49df9b9691d8205b24ab9beefe2813a02d76f7d7dd18a77f352fb93430710

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\unSelectedTab_leftCorner.gif

MD5 b423830b9e6c372be85a0e2f6f304e03
SHA1 c8825dcf392c8b6a076a4832a92a88d06a4dd700
SHA256 8e513700926b74daae8482ba9ef17b66860ed6070f2be53d6f8e2ec499189304
SHA512 346d0fec56fae8a4e2eeaa4b09d974ac9a7745d470c24fd5b1476f7aeb600db60928b1876fd19838ee5945ecf80440d50cb47066ff52eb4f79f53283cfbb60e8

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg

MD5 cc825fdb421e84c5138a3e87765aa762
SHA1 36bfe68cf55c30cbdf3ad342d90cff4e9bb7af1e
SHA256 71eeb4beb23c7e39af9ee58b214b827888656bfeabef74712e3092f71fd06635
SHA512 c99bfeccf8d651f278497933f042a0910fd415efe9b427a06ca84a6e17aa54b28856387f628b507382558d31754a86ae92fde3ad03269375f244964d00ba098e

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\selectedTab_rightCorner.gif

MD5 bfba1bb7f641e484400a18b43c4c3055
SHA1 675f94ae0b9fff7c4466d3095a378d6b02fd2ce1
SHA256 6aa7f5fbd44eee209350cc1ccbff391290407010c949971c9a17cedcdf3446b8
SHA512 cfb1ab92146e41c1402e19a02bfa33f44b55aad51346b44eb416b6d3bb0b90c528a1e8aae1390cffd03306c959d81e1de6fce87fae16156506963eed52951c60

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\selectedTab_leftCorner.gif

MD5 e81b5e68e84b6409b741515f32902582
SHA1 c0f1d1a432f1f677f68d5eb197e5c72261f3d107
SHA256 ff8a00a2c1674ff1c2a5f54f6ca95a2ee8e14c8c450db38657ab52706e832244
SHA512 99c5e05498e70ce6bd5d693756a773289b59c556a54019b3b8cff1817918b0bfdd8e2f61a4c458afd6447df8e6d7e67bca438fbb091eda826828694fcc4d80c9

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\requiredBang.gif

MD5 e5519bbc60d8f7f24f26659d3e107059
SHA1 67b4bd8f0fa4951a1e44bd1328a965a1e3138bc9
SHA256 ca903e47300e739bc8ed20de07a5fc3b4416091dfb148f4f55c4ecbd807ecc0c
SHA512 ffe14dedb94795f0f8383aec4559bbb6dbfdcaf9f5c39b304e42354312fa84bad0513459e257693072583e459625ee9d8fa343ef93eb16de1971f4c384e3b068

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\image2.gif

MD5 97dc13899e4f46bb38f5c20482d67420
SHA1 c5d7aef68a3486a9531a085c0de827c01afdca6a
SHA256 a6c1254fbd11376d4bd5ba2700d80b0934c059d08f273100a2062b7124777e04
SHA512 02e4c25943eaf88625dab92a930d7b0675358781d0f52feba0c9c56af09b735537e9d5ac1574b58490d6370b88bda8788945f960e86b3368ad9bb61566c81b8d

memory/2532-9187-0x0000000000400000-0x0000000000415000-memory.dmp

memory/2532-9188-0x0000000000400000-0x0000000000415000-memory.dmp

memory/2532-9189-0x0000000000400000-0x0000000000415000-memory.dmp

memory/2532-9190-0x0000000000400000-0x0000000000415000-memory.dmp

memory/2532-9191-0x0000000000403000-0x0000000000407000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-12-05 15:52

Reported

2024-12-05 15:56

Platform

win10v2004-20241007-en

Max time kernel

94s

Max time network

144s

Command Line

"C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe"

Signatures

Detected Xorist Ransomware

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Xorist Ransomware

ransomware xorist

Xorist family

xorist

Renames multiple (2174) files with added filename extension

ransomware

Drops file in Drivers directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\drivers\fr-FR\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\drivers\gmreadme.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\drivers\ja-JP\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\drivers\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\drivers\de-DE\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\drivers\en-US\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\drivers\es-ES\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\drivers\it-IT\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\drivers\uk-UA\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\KR9SpeDJd0PU1OJ.exe" C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\System32\DriverStore\FileRepository\mdmtdk.inf_amd64_9e49da794995b361\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmusrgl.inf_amd64_19bd1d6c2b642b6f\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\InstallShield\setupdir\0003\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\uk-UA\Licenses\_Default\Professional\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\wbem\it-IT\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\wbem\ja-JP\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\it-IT\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_RegistryResource\fr-FR\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WaitForAny\fr-FR\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\acpipagr.inf_amd64_a3248d35e6aba0f3\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\c_securitydevices.inf_amd64_f10a5650b96630b9\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmmod.inf_amd64_51d6c57c66e3de87\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\Speech_OneCore\Common\en-US\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\netnvma.inf_amd64_7080f6b8ea1744fb\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_amd64_144351277838b429\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\InstallShield\setupdir\0804\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\wbem\es-ES\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WaitForAny\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\zh-CN\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmtexas.inf_amd64_ed0ab85128ed7a01\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\netbrdg.inf_amd64_8a737d38f201aeb1\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\pt-BR\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\sppui\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\hdaudio.inf_amd64_fe5b23ea7991a359\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\ndiscap.inf_amd64_a009d240f9b4a192\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\prnms007.inf_amd64_8bbf44975c626ac5\Amd64\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\oobe\de-DE\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Archive\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\MsDtc\fr-FR\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WaitForSome\uk-UA\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\usbcciddriver.inf_amd64_400a61104320a399\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\it-IT\Licenses\Volume\Professional\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\digitalmediadevice.inf_amd64_5b64b65052c3a32a\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmags64.inf_amd64_767b2d723d0fe83b\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmsupra.inf_amd64_ed209c9a3da66777\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\netvg63a.inf_amd64_9f5493180b1252cf\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\wceisvista.inf_amd64_07ad61d07466a58a\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\Msdtc\Trace\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\nb-NO\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\XPSViewer\ja-JP\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\hidscanner.inf_amd64_b4d877fbd7faf471\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\slmgr\0C0A\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ProcessResource\en-US\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\de-DE\Licenses\OEM\Professional\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\Dism\en-US\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmrock.inf_amd64_9b13bcc1f320d1ad\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmtdkj3.inf_amd64_9658f2eb83f061c9\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\default.help.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_RegistryResource\es-ES\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\vsmraid.inf_amd64_3d2bbc45931b8232\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\wfpcapture.inf_amd64_54cf91ab0e4c9ac2\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AssignedAccess\en-US\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ScriptResource\ja-JP\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\UEV\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\Dism\de-DE\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\c_dot4print.inf_amd64_33c48c563d7541f7\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\pci.inf_amd64_66614bed5c0a20d8\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\Speech\Engines\SR\ja-JP\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\@WirelessDisplayToast.png C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\vdrvroot.inf_amd64_5dbe5e81fafe4636\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.ODataUtils\en-US\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\GroupSet\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmaiwa.inf_amd64_7cfab61cbab23e11\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\netathrx.inf_amd64_220db23f5419ea8d\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PeopleAppList.targetsize-20.png C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\EmptyCalendarSearch.scale-400.png C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\1851_24x24x32.png C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\dd_arrow_small.png C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Exchange.scale-200.png C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\AppList.scale-100_contrast-white.png C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\it-it\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\nl-nl\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-black_scale-80.png C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-white_scale-140.png C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-36_altform-unplated_contrast-black.png C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-96_contrast-white.png C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubSmallTile.scale-200.png C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\sk-SK\View3d\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\Wide310x150\PaintWideTile.scale-100.png C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\Bundle\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\fi-fi\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_GB\license.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\javafx\mesa3d.md C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\mobile_browse.html C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsSoundRecorder_10.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\VoiceRecorderMedTile.contrast-black_scale-125.png C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Collections\contrast-black\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\fr-ma\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\AppPackageMedTile.scale-125_contrast-white.png C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-256_contrast-black.png C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\aic_file_icons_retina_thumb.png C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Windows NT\TableTextService\TableTextServiceDaYi.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Program Files\Mozilla Firefox\browser\VisualElements\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-16.png C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\GenericMailBadge.scale-200.png C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\LinkedInboxWideTile.scale-125.png C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\themes\dark\[email protected] C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-linkedentity-dark.png C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Exchange.scale-125.png C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Transit\contrast-white\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\WideLogo.scale-200_contrast-black.png C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\en-ae\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Yahoo-Light.scale-250.png C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\LinkedInboxWideTile.scale-200.png C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\GenericMailWideTile.scale-150.png C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\ko-kr\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\CP1254.TXT C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\Assets\tinytile.targetsize-24_altform-unplated_contrast-white.png C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-64_altform-lightunplated.png C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-80_altform-unplated_contrast-black.png C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\RTL\contrast-white\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-black_targetsize-16.png C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ARCTIC\THMBNAIL.PNG C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.contrast-black_scale-100.png C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-24_contrast-black.png C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\nl-nl\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Common Files\System\msadc\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-64_contrast-white.png C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-256_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_2019.716.2313.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\AppIcon.targetsize-32_altform-unplated_contrast-white.png C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\arrow-up-pressed.gif C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailAppList.targetsize-36_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\de-DE\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\end_review.gif C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Shell\Themes\Glyphs\Font\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-32_altform-unplated_contrast-white.png C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-m..nt-browser.appxmain_31bf3856ad364e35_10.0.19041.1_none_b1e502c19c2a358b\Square71x71Logo.contrast-white_scale-150.png C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_buttonconverter.inf.resources_31bf3856ad364e35_10.0.19041.1_it-it_867fd4c490f3784f\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_dual_urssynopsys.inf_31bf3856ad364e35_10.0.19041.1_none_c25c085f7763a4cf\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ureengine.resources_31bf3856ad364e35_10.0.19041.1_it-it_44e2d3f797c55ac0\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_swenum.inf.resources_31bf3856ad364e35_10.0.19041.1_de-de_800f9bd43fe53628\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-c..n-comrepl.resources_31bf3856ad364e35_10.0.19041.1_en-us_305e90ab79aa3c78\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-c..panel-adm.resources_31bf3856ad364e35_10.0.19041.1_it-it_9fe3357d8beb3b9d\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\assembly\GAC\stdole\7.0.3300.0__b03f5f7f11d50a3a\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-i..urepicker.resources_31bf3856ad364e35_10.0.19041.1_de-de_187dcc1239ab96f3\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-netbios-netapi_31bf3856ad364e35_10.0.19041.1_none_8e501828f05c3499\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\msil_microsoft.powershel..orkflow.servicecore_31bf3856ad364e35_10.0.19041.1_none_e687754c4c9c3d83\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..ets.icons.searchapp_31bf3856ad364e35_10.0.19041.1_none_ceba36fd1b479c4c\AppListIcon.targetsize-80_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.19041.1023_fr-ca_71dda8005d38b726\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-runonce.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_fa4521d275253fb6\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-sxs_31bf3856ad364e35_10.0.19041.746_none_8c45e6e8b672ffff\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-onecore-d..onmanager.resources_31bf3856ad364e35_10.0.19041.1_en-us_56221b517ac0f8b0\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_netpacer.inf.resources_31bf3856ad364e35_10.0.19041.1_es-es_6563b68864d1a48d\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-f..yphanimator-library_31bf3856ad364e35_10.0.19041.746_none_04fb96c793ec61da\r\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-h..trolpanel.resources_31bf3856ad364e35_10.0.19041.1_de-de_c559abb4507d22b8\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\XsdBuildTask.resources\v4.0_4.0.0.0_de_31bf3856ad364e35\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SystemResources\Windows.UI.Shell\Images\LocationIcon.contrast-black_scale-150.png C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-securestartup-cpl_31bf3856ad364e35_10.0.19041.1202_none_cc46843e404eb749\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.19041.173_none_6486f23c2831aaf3\InputApp\InputApp\Assets\Fonts\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft.transacti..ridge.dtc.resources_b03f5f7f11d50a3a_4.0.15805.0_fr-fr_b957513fbc56751a\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-i..switch-toasthandler_31bf3856ad364e35_10.0.19041.746_none_a89196e695076787\@AdvancedKeySettingsNotification.png C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ttingsextensibility_31bf3856ad364e35_10.0.19041.746_none_06e2dddebda5c3ad\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-com-base-qfe-rpcss_31bf3856ad364e35_10.0.19041.1202_none_de8b08e5f31655d7\r\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.423_none_9de80b9d881a1ebd\NetworkStatus-Error.png C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-offlineregistry_31bf3856ad364e35_10.0.19041.1202_none_f6cf6090531738d1\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-smbserver-netapi_31bf3856ad364e35_10.0.19041.546_none_1e9fba3daf5ad632\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-i..-wow64-setupdll0007_31bf3856ad364e35_10.0.19041.1_none_a3e90f4f4fc05fd7\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\webapps\scoobe\js\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-aero_ss_31bf3856ad364e35_10.0.19041.1_none_c20963e9df445dcf\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-m..xe-common.resources_31bf3856ad364e35_10.0.19041.1_es-es_117eedfc8292c125\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-com-base_31bf3856ad364e35_10.0.19041.264_none_f62481abb9c79874\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-network-security_31bf3856ad364e35_10.0.19041.1_none_83157d6cc9e85e84\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-terminalservices-theme_31bf3856ad364e35_10.0.19041.746_none_b3df5aa8d99e9b89\r\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-t..ventextservice-core_31bf3856ad364e35_10.0.19041.1023_none_a381359b51d29b19\f\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-onecore-console-host-core_31bf3856ad364e35_10.0.19041.153_none_4b81b20e830f375b\f\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-imageres_31bf3856ad364e35_10.0.19041.1_none_92aeb0b697438cb2\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File opened for modification C:\Windows\Media\Windows Navigation Start.wav C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_system.servicemodel.activation.resources_31bf3856ad364e35_4.0.15805.0_ja-jp_c584bf3c54771be1\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-security-pku2u_31bf3856ad364e35_10.0.19041.1266_none_fd8a521e8809d8ec\r\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-sendmail.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_523b4df349069c27\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_dual_hidbth.inf_31bf3856ad364e35_10.0.19041.423_none_226d067426a3a65c\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-m..aphostres.resources_31bf3856ad364e35_10.0.19041.1_el-gr_33ef81ae7043d81e\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-i..l-keyboard-00080c00_31bf3856ad364e35_10.0.19041.1_none_b5e2d87e983ccc3f\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-t..lishing-wmiprovider_31bf3856ad364e35_10.0.19041.1151_none_aa086da848b2c07b\r\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_iastorv.inf.resources_31bf3856ad364e35_10.0.19041.1_it-it_2b8fd220eb863bc7\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nt-client.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_b2cc5d8f1b6b020d\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\SystemApps\Microsoft.Windows.AppResolverUX_cw5n1h2txyewy\pris\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_smdiagnostics.resources_b77a5c561934e089_4.0.15805.0_es-es_d0121f246da0cedb\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.19041.906_he-il_0be8f8db96d74140\r\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-i..ore-shareexperience_31bf3856ad364e35_10.0.19041.964_none_1c1a193f5bfcf136\r\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-windowscodecext_31bf3856ad364e35_10.0.19041.1_none_53d784428c63c2d8\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\apppatch\de-DE\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\assembly\GAC\MSDATASRC\7.0.3300.0__b03f5f7f11d50a3a\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-u..istration.resources_31bf3856ad364e35_10.0.19041.1202_en-us_d882497830128342\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-beepsys_31bf3856ad364e35_10.0.19041.1_none_7a11aed6a6faced6\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-s..trolpanel.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_48cfae7285d424e6\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-xbox-authmanager-component_31bf3856ad364e35_10.0.19041.84_none_4149bab988d0c5f7\f\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_fdwsd_31bf3856ad364e35_10.0.19041.746_none_5ba1ce4020f51d5a\r\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-n..tprov-dll.resources_31bf3856ad364e35_10.0.19041.1_it-it_cc2ac6acf8233add\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.19041.173_none_6486f23c2831aaf3\InputApp\InputApp\Assets\KbdSwipeGesture.wav C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ZFHYSOJPQQFOIHX\DefaultIcon C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ZFHYSOJPQQFOIHX\shell C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ZFHYSOJPQQFOIHX\shell\open C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd\ = "ZFHYSOJPQQFOIHX" C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ZFHYSOJPQQFOIHX C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ZFHYSOJPQQFOIHX\ = "CRYPTED!" C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ZFHYSOJPQQFOIHX\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\KR9SpeDJd0PU1OJ.exe" C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ZFHYSOJPQQFOIHX\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\KR9SpeDJd0PU1OJ.exe,0" C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ZFHYSOJPQQFOIHX\shell\open\command C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\c86e6c9a14e2c11428dea7f72805d999_JaffaCakes118.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 72.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 212.20.149.52.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 92.12.20.2.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp

Files

memory/3188-0-0x0000000000403000-0x0000000000407000-memory.dmp

memory/3188-1-0x0000000000400000-0x0000000000415000-memory.dmp

memory/3188-2-0x0000000000400000-0x0000000000415000-memory.dmp

C:\Program Files\7-Zip\Lang\HOW TO DECRYPT FILES.txt

MD5 403bfaaa91c60738361399702b9945d6
SHA1 8193fd7d9062be23d726f36e7a6cc3a9f6128c4e
SHA256 02b79fe6ced690038ae030729b1865a36aa1bebd9bd4fe16ac1c2268417d6a47
SHA512 54ebba8b7304fc95a44762f34da41adc68a2630bc1a9ff2a6cef75edfbf459bc38ccb1ed479070311efdb3a0f8c1f9070d397783f5eb44287143105236f80354

C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif

MD5 e8f701444779a65edee6b7ce59ff8fe2
SHA1 341ff8f54f6a77e4819231391fafe62a004c6c28
SHA256 1c70e6c83e51c816da5fb4ca51d050ae6f5d7c6eb6c111fbb0c3d84389319f5c
SHA512 46de3084ec5a94652e3837eb17b17ede1d141c4c98529d0481cb8c817fb0581f7a7993b662f4b661812d948b52c8711f65b9b76ba54e2650ab5d08980ad6b60c

C:\Program Files\Java\jre-1.8\legal\javafx\glib.md

MD5 7bd76c72aae3ef3c1ec60baf11ca4313
SHA1 84fb31251c3869a19308016c547397d8b44266d4
SHA256 bf5d86be6098290769c6594897df55dee8a1e3483596649c6d5cc9dc5e2718ea
SHA512 7a18567dc7f406b63d3c65f84f6ab88ad3bac68a1ac7953e324bedd41ff63337f2ec31bad9708af25baac98fcad894c2268ac263673153d674db283209adc49e

C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md

MD5 75799047f2b240ea139f0d2a8b96dee0
SHA1 ce6f6f6b4c9fb234250d5e25f331d6794d4d181c
SHA256 47793e9540bc7f191e82ca55d3b073f3302dc6d2e503bdb2eacf7a73a6ac404f
SHA512 fcec62dae7dac5a0a364603ace1a61db528475dcb98c232850825c579e14ff64adc20dc59f429933d18bd5693e45c27f10c7c1677400125cea16dbd66cb8a279

C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md

MD5 305e1b21c3f6462a5d3f85bc7fbdfaf5
SHA1 35de8cf5273503e14cdb8a199f69c2b97cd1f1a1
SHA256 445d91fd67790214c71b4cfdb2a3d16f8a80335b1ad4e53402f654d5c687c7a1
SHA512 043b2564b628652e7a21ebc7bea46e14d2f471d093094ba069098b48342c64e10027a22c3ac54f3e619bfdfc2a53ddfe9eb8e07b1ff83b5f704428bda3a27f1d

C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md

MD5 732e6af0cb437eec75554dc145b5296d
SHA1 66f8b88acb87f55b6d3c0c440b1e3d91d3624824
SHA256 a21942bc40308a63b9d3cc3746f494ff9f7127994135db54be811fba6610bdc8
SHA512 c2def596d67ea49407bc18171eaee707fd9118ac8e1dea05a7fb9b1bfd372faffb708f464ca409b773ffbb5dbcf7f98b9e74d39df14666b99d1ddf503736c032

C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md

MD5 a15a8187b756fb96259e26d91ad007b7
SHA1 84f816d766eb42efdf3272d1e0e38a4b2740891d
SHA256 2a1e34ad7cecaca326f9a32d95e45952cf4c2fb61c42444bb4069e5a4ac3a18b
SHA512 56c6f85a9aa7654d75cc6ec28ccfb28955815cdffc9f46fe11b098dbb832f41df42f407e93d13c09afe4d5d6c5716da7374467740e054be9e36165d339652de5

C:\Program Files\Java\jre-1.8\legal\javafx\public_suffix.md

MD5 ad5c6c9545485caf7c5703b142ef324c
SHA1 d68f94d814e507b6dcdb77f5743fef36f671fd76
SHA256 2a5b7a46725a8f8ab159ff2a527dd31cde8c6bebb411e65d9d9ebb8f5798c3ca
SHA512 088d3c022ee9fd94e3103542cc4fc6372092a0de660091a247729e42d62420fd44795bbd67dfca0c1f9b3334c0a76274ca8d44c044584cc7f5121d0694ace3f4

C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md

MD5 a8fe455c94ec8c1742b2da4d63f35032
SHA1 b959933c1a42c1fc241b4afd370baf655b9a9381
SHA256 55abda0cdfbe85cd3c554b3079569f06e4725f24dadd28fdb95eabbf8c8c49d1
SHA512 14234e0254e4a48c94ce58afbaaf3c2cb89240056147fb0859b531f466255711b1e4d5b8648634da9301e0060b16ab3ba38c777c83d78b60307a31b641595a54

C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md

MD5 2730df6796f99adfcbb45f40d4116530
SHA1 19d58dd25ad1fb4d5175eaa168d9b189564579fa
SHA256 eafd37a76a04bb2182c729c949709357319585e3fab685fadb90d4ce4f73a51a
SHA512 c4c437ca943b3167aebf2918fd0a67eb1e86cc90dffd8191b89c81a4ed0ded8b03cd8f0e8686c6e1f75c1dd9dcab64a39071b8653bc5b6546660cb73711e38ea

C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md

MD5 8cd1c98f30e41b232ef4dd8b791c91a4
SHA1 2c5fd44bc02946c7612e3332574b0f6c5424b15a
SHA256 0b645ce19ce9feb235b629c6f37aecccb9a4fadba2dfe2dedca2be9fcd4e1a05
SHA512 fa1bd80093e14cacfa581c0e43d9b8d0958351aadafabfd105338a0b90d7fd9fc3c607f29896455212804127bfe4f88320fffa84b649855443fc7e5c8215b1bc

C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md

MD5 028b97f399417beec6d1bde73c823dd2
SHA1 17785d68e7e6c31a1298cc2d1665afa6f208f319
SHA256 eec2ff8410b7e00be6aba55571651e0d087877ca8d754861ba591c434078e1f4
SHA512 54b1508ee123474426fb720df45b5fe18ded77439f822b8c4bad8a621ee54483ff86ff985c19ae91cc244cec4832ccffd2ea5bc68de1ffd76cf6082d5cbc3ce5

C:\Program Files\Java\jre-1.8\legal\jdk\asm.md

MD5 485b1ef35ada8f49040446df03015351
SHA1 41737a7aa8b1739ad3405b5d4d3eb465dee01f81
SHA256 23b389ce0a80d0f75ad8d3f4550c52bba17aa2680a2566e7535e21c8dcadf32c
SHA512 48fd4695ebc37b89bce92674af3f07f44123331410ae1f0076dfdc9035eba8c3836e5d150e44bcf0188ae13443e387a4ac4864fb24cad44804a1a3dec3629414

C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md

MD5 8ff9193dcd7f5868068b724b42ddabc1
SHA1 3c7a6e42d8a6d4d92b05280444db11f04f5e37de
SHA256 36e19547f4258a161932eef4f129731d993c635f47803c5fe563dfff91fb7f23
SHA512 5076c3e8451babf750182d753a61122fe52f136d5e180fda30bf8ddc65c0873ed92da0f3ac549ab0091990b04656b0edea88aaea1b25ba12c5e10d7e2c2b7db8

C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md

MD5 3d792484019fa8394bb09a0730782cad
SHA1 00bd3a03dfcd189528c8d7c68c2cb632224247f1
SHA256 a2dda025fe9ee9cbdc16115fff0a583954ef95f875b7f37323aa63b5490dcc02
SHA512 014dabd6d31c888714f1acad80b4815876866ea3ac04bbfe01317c1b682cc54eac69fe97eb7c32278e79b66e5d5b98349dc7e044e01711ebe907502cdbf63a26

C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md

MD5 5f93befb7f63307a493d3469ab77c8be
SHA1 c3d9b09a4223184285412b1a5dac444b48edf610
SHA256 b11cd36221090cb5ae5c96df45a1ba793be570476f0905bd6061c1efd0da0e64
SHA512 62d361875e4d41197726f3092fe9f7853426397316874044d88e49827c163c167d1ab148addaf3336f810a8988ded0d670b5f801e5a6d99aa8042f21101b37e6

C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md

MD5 bf03f00e1e06bd4ccdc49808bd4ab57b
SHA1 0c8f6eb371cd547e9ea62e0d24cf33565f99b9bd
SHA256 636bd93e5de3bdf38499d283b8e2fff6d282a5003de15b39927ed7939683f538
SHA512 46e3cb9c5d58ab3e2cdbed080c3fa108f51f34960f26683fd6cd664835b60a52f3639fc7cd91d672610d462d5368e643c7d21618e323988fa066857202ec098b

C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md

MD5 8a0c69340061afaf567b5a81c105bbac
SHA1 2873c72c5144ccbea3a9b5185a04f3159deb75cc
SHA256 5e78fa4061934cebadaa2dc402eda24d9d3c5b7ce3fe8650491b9b952f81113a
SHA512 9a622a6afca4d8c4c2d6664c609b012ae449ca60336f5fd18f04137e7d7198767cc2ef79349796f63b1eea7415494d1db84f31b72f4f2559459aeefebcd9ce29

C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md

MD5 c17abd5c11fa079da58ba1c15f0dfb75
SHA1 bcdd6ac04e770d81765067caa56a2d8ab86197b0
SHA256 62fce0e45fc3de60ae19ee5f7b8bc8fcae88efd8881cee74d44c30eda54f357f
SHA512 e8a77e6b5da058e1779ac2832b0a0f9c2e868b37454d28395d1c8a2ca2e2286abce67d9b76d82954c0b10bc11de28ce725018380840c6a01ebd498acbeb6694a

C:\Program Files\Java\jre-1.8\legal\jdk\dom.md

MD5 3b30d938f595eeebef707e9439f87c93
SHA1 c3e16e36af75c859b8ecd3ed54278214b7192385
SHA256 582312a4eb908eaf1d86a080153144e52f1e592fd47a48bf9e3da62840695127
SHA512 ca1b97c085a679fe7959a26c54249514b42c96650495b67c33fadca95cd49d4793b47269286c3b42ab52eadff984329f99ffcf7192cc782c669afb4be4e9197a

C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md

MD5 cecff0ed52c7817a4c88df85f09d6e76
SHA1 a928b2208532e2bf1d5dd6e21cd5f6fc75099fb0
SHA256 ba6b50651bbe6e9f07034fd9f77a520fded7265deacba8f484f0e5203cdbcc8e
SHA512 6bef6a93588325ba1d50cae53cb7c04f2fd9b248b2eb91066300aac85232b3398cb7d4e85566f77216dabd6c515717ea1278b71c6a07f1435fba1af9a5278db0

C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md

MD5 be12b9cf1026b0dcbfc7990924c3c0c1
SHA1 aeab4b75c83f93e32422ac9334214aa15a6f1b59
SHA256 63afab114a1820a90bca0abeb1476f1a9d4769830cbe376d1fd0f1e74db50be7
SHA512 f1d41f7482e70c4035f405cf2b0cd77cf41a777590da5355a2c96e77d49d21b17c1aa10958945b3cd65444607b6b5b662b49d0927f94610d234d1920d3af4438

C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md

MD5 be9be5866e08889a4fc167310217f01d
SHA1 a4b5d89f209e6505e8fedca898cffbe448679c8f
SHA256 b9f377b6e495f32b58c38517e54a79995642143a69ab02987daee4eb833135d1
SHA512 481581b0044f22247516ce6227c363e7eea93fd12b48c47169b37bdaee8f9df2f6872c9928a0bb232c7951db24dd5aedc6cc54aa6b1802cd1e1ce85a585719f7

C:\Program Files\Java\jre-1.8\legal\jdk\icu.md

MD5 793971833f1ba6266f4b54dfc6c990d3
SHA1 2518dab0b8e6cdc849b08833280edad825faab3a
SHA256 c39296abb1688692434983a77a753ab51a9e79e0a9f80018752bc594edf492df
SHA512 28367e022da99f401ae728d5f36a62b5c83188c375cd11913858444e49430d8d838f9fb12d4cf2acae9c4eb1b00c7d5999da1a79b7fb67345a9e5fb46af6b897

C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md

MD5 7188876b08b980e4dda19b13c413e409
SHA1 713dda1c97ecb2317fd52b8751e9781ff60a8eee
SHA256 9ffe9c4a74ab4b3f0655279d02814c9140176e65f75065f6d06f1cbee0b631dc
SHA512 fadfba92f552c7c8108703880fb6bdffd741ad5c350bd1f7494226e748e4fa962bbd9059ea687d42aecb2f7ca227f8d8a3f19b77a084b6a9eeef2cb6a66857da

C:\Program Files\Java\jre-1.8\legal\jdk\joni.md

MD5 89e64aeb0055040494bafd54bf3e14c7
SHA1 f67cadb3c06fac0b50c40c8640710ccd6d92bead
SHA256 32c505a3d3be2021a6e8d913653059070a39da1f2bfa4e8c14d2cf4996ea45e8
SHA512 7c911d40790bf7c140516a4fe2a1d65b4af514b1108a583b47bcbaf28ab5e860700b4ebf369c4f5ac12ef3d2c474aa3425389709329c208a8958f8906bd5cc7b

C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md

MD5 1e0deb0aa8c2505ae3ed8842a0cfe699
SHA1 deb8dfc44217d2f5a0fa39425c64a7dc3537fc38
SHA256 c6b384cf125bea4da141ee5c988be3e33d2184aef2075ec069dfaddb8c5305d9
SHA512 34cec5e8dc808a479e5cfd3a98bd6a3d80cf7b542002eaba5cc9050188cd218d8ed67b5f3fdaa9ccf4bc8e859a225ba7d68dd419a228034991366ec78e73a882

C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md

MD5 e688ad1408277b15bc3d2c8da89ec72f
SHA1 f2e7d3b1b2a3a532c78f3897a28b873d657a4d5e
SHA256 d59a9fe5e18996f047897c743f31ad2f4bf8532c9f01866a1dd94950fe2dc86f
SHA512 357810dbc1507727cff7f121b5f5eaad920b7d83aae2c4e9e18e5316b08c78ee4c9141c09218de888682c71fec1dfa73c98ff13731faf78d64244865d20c6089

C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md

MD5 eeebc8cad013cde129a07fa8b298fd28
SHA1 956937430e998db4d695e7d4b4d1d38227a91034
SHA256 fd2e543054eb77805892bd5791fcf5cc3769a3269eb43b001bf71d2e462174c9
SHA512 67079781404424c7cda96d437d970c6759c066d7bd28046cb5a65c7da0abbfeb711620f465488565666f4c98c8479d118a869d2d99e5025225eb0e47f081eb0f

C:\Program Files\Java\jre-1.8\legal\jdk\libpng.md

MD5 4e1c06274c9adaf082e873b0a90d9c31
SHA1 18253356b9e852fc168f146397fd0964ae5c1946
SHA256 ee03c527d3503e1c86f24caef897c52663d79960be1c539da2391c8216a3b034
SHA512 bbaebee37cd172754e5efa7f3202b93424b276ef97e8790e99caa0da8167b76f5c4df3172b294ef25619a5ce936e6aabd90c294e274ba2247580a39ba454cdc0

C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md

MD5 673c472e31e13c04eb3cd167aceeeb17
SHA1 58d1124ee823ece6ad2ecc6541deff8e0302174e
SHA256 3389216190adaea500585633ab542843fe9107e8fc1765a1d6aa140fa12066e3
SHA512 383f8d9e2a1787bb1ae04648eecdac099e5cee93bd828958c0283c31ed16e99cd09050cfbb9d90d5ecb89f7436d6c63989b7cc2f2e3e12a8cb2100bda30d7bf2

C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md

MD5 363ec065a53cc90b530ed602cc636bb0
SHA1 d5204bfc1f687c7ad553f27e739c862f14d08314
SHA256 2c18c4de28756b14e738feb63ee5ba329fb76355e0b84a507c18ffeb0ec46e4c
SHA512 2d800b10b2e97f80464ab8c14621c14ee7fd408fab02cfcfbc9669e14acc3ecb61714998450eeebb9fb28781ecd4531782b8711133060ea600ec658234f80646

C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md

MD5 0ce1991e9aadc3e8b14a14253dac4599
SHA1 29f85a6491aff16728b2667031ef0912fe06e8dd
SHA256 8de3a2ad2f9ce8133286301213f9e56c29b6060e2aeb5ffab117beee8f8115e5
SHA512 7a2fa807013ca37829d59f89481fdfc3ed635f8ec84ff114957ae857084c2e0db4e8a5a55e4688fe90d97c6b9c4d24b9780eccc51d7b5a2d23f85b1d7658ac92

C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md

MD5 3f0c0cfca1cae3561124a86c88d2a07a
SHA1 9664418ad07d226051b530e7e8249ebcb2a1ca29
SHA256 55cc3fca19da150abd1c272b5457371e1383333c8c980020ff6b1a12cf35caf1
SHA512 4af24cc2fe2ee101d0ebfd29ce05f9eb427752fa6a21a63cab03d4774b5df353092501806b86c9166fa1bbd698c768fb9432c057312b111df21919e8f5feb668

C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md

MD5 8825b6e85c01f8bedefc625ed87c8ff4
SHA1 b3d036cb96343b1ac7f04a136b1ccee08859219c
SHA256 bf76c5eb7cb3e7baff099c7d802e072d1ebf45bcec954ef46efebb1827fe075d
SHA512 5bb7f7ad2b28301030e59f3a911e6efea2f7161ed6e7eb268e42a7c412efe407a4c98f0b2c6710e76c6a81372930af03a4b371ffc9712b94fe4197248d31d141

C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md

MD5 86b5ff67658900cbaa98b89396a4ae87
SHA1 ca68cc92c33869f0b6179247ee2f67128c63ee7a
SHA256 e0404a7e3f38cab25df618c430d25d5b3c775865c46233b466e492f25c6c0b75
SHA512 8e30814e90dcac225ca00b2d26b0e9484d6c33d72b51869e4c5776bd457083f0614c9109533f7017848f12a8765022c223a107bf3b004c89a15d4da9823116a3

C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md

MD5 add4cebd1f9265554be953aad741d889
SHA1 aa9950c7f25f732b3a0e1234c79bd427306ea55e
SHA256 85fcaa60bbe1f99477aea75b27633f95b01daa91ea5359a0787ec97a522533f1
SHA512 2e51450278ff21ddd2a5264b83694edb8d450832cd33d96751fedae9d3e33c237371281556baaab62f9a150ddf92be1c6b4efc486744b02d1b0c7482935e192c

C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md

MD5 28a70bc12e1b3058ab55c191547ea925
SHA1 b969512af6785506ca857b13f7590ebd046f8207
SHA256 595859703b869d5793a264c73bc9fea486cba2235d5d852b8bf4284c0944a01f
SHA512 8650609ba876ca7f39bebcc33eabc771f56926290d31ff9c2d18407f97085a06260a4e8f09b51253697fcc7cd2dffe20b6e313440477dabff02ea34d76578edb

C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md

MD5 4c2aab7974ee0650e6c40ca2207ca649
SHA1 0131ee71e32c8d804241e4b9b54b900bc249bead
SHA256 df3493898d6b53c5a411effff1e0343a4bc3b3bdb96c7c46b81e17f602ce93ca
SHA512 e56fd820e3a0f2b06f278b3624d34deb994c158cb010b67f46b76419bd3f0b486d3fab3110dbf07404e8d25ea79ff30fd7043ab6cbcc1fd030ec2a14f8d7bf68

C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md

MD5 8af577257e73f943b3307cd3f54d758f
SHA1 1c0c4780eea2e2cb5e5c2a7553b9264363f16a50
SHA256 e143158e82cdd027218abff702407d32f6d0fecd23ee46e73b088ee9a50eac1d
SHA512 85663293c4c226f7668b02affae82c7eec3810f217deb587ae05e921a858ad2ffb11aff61b3417cfbec3453bfb3d2c11713802bfe39c126dd8df94b8abd6ae1d

C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md

MD5 b23cc2d60a0b836ddb47dc4de3e265a0
SHA1 f5abbefdc7724ae70f0ba00c387fe75c5d7fe546
SHA256 54a4707ae09f2d15fd2a27b70632c59a7b6911181fffc9ce3fe45f4788f58431
SHA512 4a17239111080b69012f9cd8cca3d270dea489c351208ce82cf1a3f7b6c79cd4e847de1071d334ab5ae2fe9673803fce1ba44abc69b4036d377a88032ccb3a0c

C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md

MD5 d87e0a90c4bb0b661308b13c3bd20748
SHA1 9d657848bfff595decbe1f7eb3ee484bcaa8e3cd
SHA256 aa65b6f96066018a3de97e7b01a1b18a370433dc8ea3a77021a0702249372d04
SHA512 e6e72aca7f8f6f4f7c9e08738259946db894a76338e370e1dfd5a6101c811df9972b09a47bb9b59d163e11461ad3493ea18dcc3d1c7b8ed9e6f41b9e4104046b

C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md

MD5 347280e1af216fefd16502689fd66fc4
SHA1 9c8533125a5a6d1e947f7699079126b5b787be61
SHA256 7685c83c612f4ad7d0134faf85d004db130419079e10c7289af18f9b75ff1e8f
SHA512 d4a7d4927d12b8b4ee5954d30961103a3e98ccfc82a699f5c46d594f1ae3cd7052f8fa04a30e9f9c8b5090c2c22974d31b442d4b2599b475b30657d28a17ac1e

C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt

MD5 5f065944f28e5d7cad68f13670c8debe
SHA1 99b225c579612211a108e0fba34e88aa3c97165d
SHA256 2df170be8e163ba2c5a6021b63a3c6074337b7209306e8014373c5d3702e2679
SHA512 7eafd04978744cbb16175b20bd0838403e77ffea5821c1392ef9e845f5735dc1d9779307968db595ce5a79df4e6bd91b8783ef2557b0dce8bd81bfae1ab7b842

C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt

MD5 a19f085fade9a84b76784221f6ad65d4
SHA1 015f5edc392f9303f2c0890210551a5a553ff0f8
SHA256 e404a6d97497f7c5d822b0f2ad0b7c2a330364feec6aaedfe7db5b65ddbf64fd
SHA512 0e598b1129473f98e18efdf447e8aade9bae9abf4f99fab5d3373e2fb7441036fb8b0d56a62fe383a2b2321589a8f29b8e7266e5367b354f6021b29ef9583c26

C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt

MD5 5629cbf547b3b307ceb49e569d48cecd
SHA1 cdcfe57199292ef51e92ddbb528310a1b01efe7c
SHA256 9162aba568044150895c922c64ae4e2cd31ab70cc254a841adbf4fd1877dcd0a
SHA512 f2828614189c9f203debbb89609e166a9d14e3d803cde4ca9b9463d463be0f1fbaddf8603ee0c8cb7bae39f8047e848b5091198c0f0b42db697950db94b89fcf

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\aic_file_icons.png

MD5 3a718360aa124d817167789a3c2d9017
SHA1 f201309b114f77da2fd1440741927920c65c5390
SHA256 f83ca6b0ab223df6b8ebcf04cbd84301233d2dfa86350aa86596f7a836c96722
SHA512 72d097a4183f47d455dba2d2b063e59b0e3408a03e13e042ff0cbc605fd6e838cc85a529481833f13e870faa0462657c6a9374a29ef1a1d529022ac3a6b61c57

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions.png

MD5 a51758bd3fbe2f443413d215ae4205f2
SHA1 572363eeb0706510fc314c16401e96267db08043
SHA256 14a303d9ea20fbd270ed0ac077dda3211087304e71b8b504cd987319004a95bf
SHA512 21185ca345fb2066187138e95fcaff0eb0dd9f038e9d4b73647f31e63f375d456cad471d6423066151e57afd55ecfdfe833324cbda71cd409ebae1b4a139ab34

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions2x.png

MD5 7f75a7af544575aca5fed66b3f21d28e
SHA1 1627f0e6b40753bf99cf5933c957786a05fefa14
SHA256 0bb7cde64b3c5b471bc37dcf83a110c17c8f3be9f9979eca5a57b99940409bf5
SHA512 ff5e4561eb5e17b50d60ac7efa007a615c1bc623c7b00c1b6cbb3b570d6997ead167e51039c7bdfe27bf1a178fc8f178482d5dd324d7da73faec2bb11da5c2ee

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons.png

MD5 9bba92a294419b56ccbac2650f66cce0
SHA1 18286c2d5bfc5c70bcb9ba9c068ed4a880afdb39
SHA256 963b45378e7d0df09ef40cfe14e852cf549b6c4a01d97a729bcc30f120c1e127
SHA512 8b0d9317b2ab97f12726a332a76305f1dce5d0ece2ad673287dc4c39847eb12094336cefdb68b56f03dbaa2f7a0e9e534fb80961c68d880f602a61cad73f12cc

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons2x.png

MD5 edc32ea95643ed79ad647c62ccae5e3e
SHA1 1c599e36a17d0ce314a1c7eea9bb4d0a42226b25
SHA256 fd65da1a346a6dcfd21094ba1019ebcaf5204fd182d4a0484ac49611dac46a3b
SHA512 f64d06d3b0990c045f49c228966fc46c973c8262a8375599a9a4abb7a54729b39492210e3fbbcd4d9cbdffed6958cb697268bb9d1d5d6bad7073a17eb784b449

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon.png

MD5 b3e34f68e4c9d7166c2bf58629d560cf
SHA1 6ee68b8cd167e03e49daad0f93262106ca0252fe
SHA256 25f1629fc9ba8c4346250a6abe086e637a1cbd4bdab5ff5529c2c2df48088939
SHA512 7fe0f0f133baad3ebfd402430e8a82c2161fd7075029f15787d3aa3ee6bc85292458837726cb4bfdd14a06a03118869b532b14a8549db2034a5209fa7e8e73d3

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_2x.png

MD5 e4dbbf5674a5b4c51fc1538276d8d8cc
SHA1 d53d5fdac1559a92d32f28d1b396668a648a046d
SHA256 1dfecacc69cf54068c5252b2fb30f7a2091937adc33e9b6b6c0d61fe45c53246
SHA512 e488fef8338616b3d4d0cc59e185f01e16b7d96accf291377ba6e6636433de23ca4323305d081b14cce628ec01f2c7748e1c0d1980ff4a0e2a1bb03977fc1ee9

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover.png

MD5 5c531fc3329496b089463204f3d87c3b
SHA1 d49c2b4b7ce0c8aee0b435bb1334dd426974f2af
SHA256 584a0c7398b670fed9397665b1f97fb7ba32d619ede861265a925858c2e9b95d
SHA512 b9fcb9c8cb20f25d53f713d3f53a5e547ce1fd60a78e2fa054dcd47f75d46fd06422bcdfe0481e80b00440da5d43a47143375472920ae74626bfa782f1ee03ad

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover_2x.png

MD5 f4aceece5a9d4d71844871041963d164
SHA1 6bb83ecaa84aefaf45b712221aed6489b487a291
SHA256 3e3b9ca10ee702997d0542608b85203b4083fa422a9a4efa78cf2ffba727d4c6
SHA512 0ce191788dd9056bb82fd95a03b5e460f05fb5fa4101f0740664d5ad49f803b33526abda9c63c69ebecea0f17ad28617922eec71947d7aa8d1abd3dd3c2c05ea

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon.png

MD5 a3b39e5cddc4954c36f3b5363ce48b70
SHA1 02c87739748b8b57801747f9859b5cd9191f9310
SHA256 c02c5e674ce123dd8bd6007086d639306ad3974beda69fcd664c4839062e3211
SHA512 24cad9e02a37451c0bfe0b4e9fe63096e3cd9178a3692491905f805211778a061cb79a692971c1f440b8901690a2ac4e55dc63e08109530439a0219a9b61bd1d

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png

MD5 ad146274037d8776742d90b9c1951c10
SHA1 c85e8098e908f13c4b4640e889672cadbb08d7b2
SHA256 c77af11c29e9e406ce167e5722c3b3d95c322cdfb08ce6e6a0479effbca22102
SHA512 ba60d40e436205796dc893d9b66d71f4b864fbbe77a9ea99d748076a30152d3da66e22a8ca48c585d76f26a1868a8cbd47d7bb34361d9a9c140161416d1a1b37

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover_2x.png

MD5 d584eb63a41643786661d89760116fab
SHA1 dfbb96f41d31ae96d70c2dbec07758e7bb87e804
SHA256 e3c65e6aa2bcbc50201b2f74648d705cb4f5843f4304c57a15bc3ed1fb8f79d7
SHA512 94aa8c4d348570a93e2650810ca0fff8e7e92a80ca80ae9b3c1993404e4d383759b32b297b150121aa480828b4ef838cb95ac34e47d2e890a5742ac8bd269682

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png

MD5 5c42189389e7baa2cd0f6009fdf78452
SHA1 2d179f0b7f92bf335d19d3a3a6485a5d05063cce
SHA256 86ec951917cac23dcf8fa5d73cfb5719d40924fa03fc9244547d440cac74c02c
SHA512 1581c822a1464fd7575316385c495d1202b6e9090b0b134f1c9386416dd07ad32b177a501afa4f875c1c661c4cccaefb0883df28491ba002bd76bc895bdc8683

memory/3188-3049-0x0000000000403000-0x0000000000407000-memory.dmp

memory/3188-3270-0x0000000000400000-0x0000000000415000-memory.dmp

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons.png

MD5 905a7a2c91930242b6e16a42d705a5a6
SHA1 96c965ab2bd80b61a22f050ff4a01038cc2ec381
SHA256 745525cb77ae0fa8eb892ec193da3d8848b2659a17336c100041bc3b62e8e8b0
SHA512 5568de170fd9399b85284afd4fda5b1fc7f56543c8b8ed3e97a9454f2dca91fdb40f5247c9f337cf0d2050ea7ab75cf1639574b1ca8b234d41c850178f181d0f

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_ie8.gif

MD5 836f2a7833f28d148f5d357c2d68797e
SHA1 03e4ebeebefcd566e13b618879c2948855996f60
SHA256 ad0b7ab839586ca4e7031f4ac560a4ccf1c31c18a913db7932aa9ad9a6646f82
SHA512 4260f5871baf9e96dfd880ef021234acf5bbe99a99ab8e4554b23cdbd4130ff2e90362db624270a9bd2953a5ef8657b1f76ec077ee12e3ba960f650b41777cf1

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_retina.png

MD5 e67f382bd788938b4b01c49a70889bad
SHA1 c1cd1c14c8e9e79eb13ac81a5a784f096417ccac
SHA256 a55f095e0a69777a7b936ccb14a4989499cd307b61e53d59cc6072012d39902c
SHA512 1158efea64bc64bc152322145be2fa1b287e6d7af44a234f4caee0a1b450caaf28542cb47f53c8f9161a34f068fb0d2ff41020df76d548444c65bc73a3a614cc

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons_retina.png

MD5 2cad697d7fca5c4e86c41c430c514001
SHA1 5c1c793fc405ba5b4d9322a363a5c2241f09709c
SHA256 9f3a8c3dcfeb55c9c269d0b9647e170b14b792982eed95dabc7876e97b49d2a9
SHA512 741847894da804dc0d83e8d3f91432a7c5dd2a591f59621b7894da7e6a0fa9dabab5377a6712448bb44f72646998c287f33cf6a23011d3a19eb0319378a5de86

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons.png

MD5 a567d6f07e8083f7faf32198b45b01a9
SHA1 464941de0880009386ca1b5a40ad3bd2b8267191
SHA256 30af0914a1d240ec206e1df81e90b76aeed19ba5d240d0295b056533d5ccf332
SHA512 bb0c424fb629f63c169b5af94a80de0f39cf04ecf1679e9c153201351a04212e440348ad9aac8c4b135770f066225c76c013d61de89c817b8f36b622d282c490

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_patterns_header.png

MD5 bf843af8b141f5bdfdaaa3ffe83117c3
SHA1 6962dbefbc9cb471502eb9ed421bf2ea24c02496
SHA256 e0292ff8f48809b12466e088f73b96657738e41d4d8f2fd5df47929bc52f76f9
SHA512 c61b2e622f8781693957833ff93683b4ab77e4c6f0961997b5754af57bc63e7ca129fb24bce1f6e7d00c1837c2f2e2b96a365351f0a108aa4a6608315b55e6d7

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_pattern_RHP.png

MD5 ecbedaf0da163bc6a70c742182d22911
SHA1 0e8fcc57b09685e9e6d00ede06faac912dab98d1
SHA256 eecae9f9dccef550a3a94935f3c9207d4cc3b8dd9a335fc7654d5e6fc45d4622
SHA512 9f8f4ce7847501333f96b2022dfebad30e1f805b8782743ff2fb4346c5bcf50ff77d931efa4d01777bccbe5f010e56f29e5002ff0e14d5ab012251767ed2a829

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations.png

MD5 215e1ec2a576cdb5d870713799da8121
SHA1 5a35040e580dee3c9e4495312682b765bebd26a2
SHA256 c0b8764113f6d0efb9913553c40605d25eecb12ea875724159252c43ab021c5a
SHA512 95d793c98f5a9b4fbea278846a9831cd0bf9a3268df09a632ff3e38a51222ea7fa1f49ae9b1bd51f791e52fcd686ece34e5e2e2a177268034f5b7744585be4a1

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations_retina.png

MD5 8a4614686d9cab62897e81c54e6c58c9
SHA1 b0689af253705cccb2bac283053db2d92049594c
SHA256 922786b2df2ba2130bea26889a6b412d1f97e64b909c4549a529330c293884f3
SHA512 9fa6cf493aad26593a95cf7d33bd75984f8655f05afc4e78de5bc606e67682a7f2d5177faa823b21ec7af7434a89951717a7e025f99781d7f83295a3ef59d19d

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\faf_icons.png

MD5 1b3669615627a742b551c991b9c18078
SHA1 30eb6ba2598ce68684917c59f60026ffa290e03b
SHA256 57416f883755891a94db2cc2cd4f5257414c1981f65430fcdd49456568ef8976
SHA512 a18dc2afa98bbc6dda953581adebccca6f3dbb79d0246ec083cfa3a5beec787ddae3340a806025b3a4e754a3c729cb86eb3bae72d421995adc915b76ccd3f498

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\bun.png

MD5 2959f20bc2689a2820e2b30f83f85b9f
SHA1 24b089358c4f8c95b5ec59405e16a26d9f6ec615
SHA256 d0002360675177b518c8dfa92a290570028775d557ef3733fb0a1316c5ed5668
SHA512 59ae06ecec15c01bb7972abd6957156be9c12fab3324f7205b11395b4d2a088bd055cfafc4b66cdd391b19a7a7bbb575150e2ffb9c69e8652306ab14da637746

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview.png

MD5 be5fd83c43aedd12e5a5bf839d461f8d
SHA1 c0f89ae0658f8060b6e8b6958050cbd51c8f6ca8
SHA256 ad0e0888002e591e66187f5c2009f0150d88383d8e04c01a66cb71aecfb6858c
SHA512 cc6f3b4c424404bfc11ba1c8eb555559e78b0d425994d5878e1e91c8075fa2aee07a62cd08d04baf01e0bd44e51c6432bf1ec8e3a6e22b45a09d84fb6428cb45

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview2x.png

MD5 52167f042146d6b50ea6f04aa2643ad6
SHA1 5f58abc50c0d75c3c7641783ff330ea3724367bf
SHA256 f626e52083b241b87a89ff5cea929b91cf5dd5bbb4921f73b00bca087e1389d5
SHA512 b6116d564ad2dcffdb934d81eca3ce3de2900e6e83e2c62d702b1938e32845a41106d17a78783fa175dba642d746b46c0ac9d6af69d441ef61fa2065be690119

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small.png

MD5 4694ac8cc4ddb054fcd53a6ce3381693
SHA1 57e8f77ed6e43110027d84208300b0c4c15ab13b
SHA256 35dfa4cdc2caa44016f4c29a4806978cc2f2429b4b9d51eb4e991121448ebbef
SHA512 e93fe26c8be79fedebadd392f333d86d24b5ec084b142d7b01bb155158ced12f6272bf373f9b9aeee5e0b7ac2661d8baee1838d63fa9ab077331f4dba41a6e69

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small2x.png

MD5 7be8656a5c43d8a640bac80078dc72b7
SHA1 728258afb44a50dad653f3021f69c36db42698a4
SHA256 19b9b7bf1406cb6c2e48bbb4627cff5e5a234ddcf710694f3dcfd78d54c67f83
SHA512 86f0b5c60b95d823f64f4e3885acb5e26d81ab677a7c3485d48daeae9dc4b284f91a13ed882bff9c4c4a14be5ed42f30db2c4730ba24e2e0035b2efbcd661414

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\illustrations.png

MD5 2afb2c0225ddb2e8a3695d78b9e28004
SHA1 2a918b74d77670202f0c6247d2f901c99b43f6d7
SHA256 791efc131899e3bcf22c38294bc8f09c19d0476dc0ffc27625b11beff8445097
SHA512 444c0f98291ad473fd6535c71120e2ab1ddc754bf1d250087bcaed9362c186c595b793a4df40eccbba1902b5c8ba00ed32fd5b45bccb534ce1f6aaca3e9c80e0

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\nub.png

MD5 a60dd97a527e3a8c4be5ec0690aebd3d
SHA1 37b6a31bbc7f7f07888171ac2922022027702291
SHA256 9ad6ae1ccfe8c285491eabf1209123da76d80ef82a29c08cec75ae04ae566811
SHA512 d775b90cfeb86b1adf3b225001b2605e3ee37e0257aa21f398415277a743d7eb1afde72d0e6beb4d5dde872a7b2fa9c65d18065118975fc8b8c20853e2c64b03

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons.png

MD5 292480cd0e56515f21e7e369ce1c1042
SHA1 2eefffdc0a1340771cc75c6a4bdc574f1c4f0f43
SHA256 23922e8066a51dbe440dbc3217c7d433b3c0d2a0af65ecfc2f7bb60ec659ed2b
SHA512 300e24bcc59ba28ce2d6e67a6d4161bfc9813cc6a1cb2f45cf218503bb66eaf4541e11fec17a04c6db09380b3c95f04d455ad2fcc24d9d0d83cda34b643150be

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons2x.png

MD5 5e4d4fc59b228c708ea9e6daaad02074
SHA1 3c08b15ad94a2abae99dbde99cfb1bbb46723447
SHA256 cb5e691d9e7e1ede1f5dd356d48733dad8c2ce271d5b519f1b943725fc6770ac
SHA512 b0f5813432e6e1e78848b44f19233a18c616d0803ab382332518098f663b7684d2d98ade906e3bccfdce70e1829a7b0e7a5a62659ec9bf41ec9ce7db989e15b0

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adc_logo.png

MD5 1309fd54dddc8d74892819561f4de1f4
SHA1 a0066454cd22f372dc54802900b9310ec5e4c5a0
SHA256 cf0f815579afdeb8b04b26a100cd0bcea9f829629eba3f6721b80dde332ecf5b
SHA512 d7fe16b7ce6cd399f6fc33be1aee11f349f81646e9c0841bf319a18533f4613ef098b2f36333d6e4cc7c432d359472c313b58472449c8ef7b8d4f218210f9816

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adobe_spinner.gif

MD5 33ea3a9c5cda5cca6935d5fd0c7fec47
SHA1 a1e0a7b81ebed9cb95f9db92699d0e0f8a305306
SHA256 ef20bac0f4e2a930fff258f63cfcc22bc9feab07d65f9c0d68028a648c448f3b
SHA512 1aecad7b52daefde39c167e156f0ea1098ca61042662b102fc11654a79aa344a675d7a40e1f8314d57b748a9950d74fb91eb4ecf3569f998a3f7b20233697a6b

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\logo_retina.png

MD5 79ce5ec89b3e7ad00f9b3d62f23dc2f2
SHA1 06cd3c73bc5b0ff9d49d2114b50a87718ed9e681
SHA256 58c6e703b721a716cafdc7c9bd30570b875d1e6aea7c87299c8096dc30d94559
SHA512 fedf543eba2bfb64607aad65adbecc8ed8df3c0f3b18ded112aae9e8156b3cce99ffc214152f82ac5ec8a76e7af8eb9dfb49c1d9baa5530f557868f44637147e

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo.png

MD5 45d02a461cedabe2aabe2175fea758f0
SHA1 e0c73ae2644cb9005febf5ddb4ee2aa6dbcef581
SHA256 74e659c6c57d829b8e4e16852849acfd2b2012de47a239af82c665ddf70a050f
SHA512 a71cc3f945d0b39d378ddaddb3a15ea43ebe097d799ba9394ee992a75d8f0aad9d0051ed962fd4d47c0946a9f2604d6008a42b31697d54add8f563a97e0c76f0

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo_2x.png

MD5 ba5c9dc5d99d3532695816af08efa19f
SHA1 070f63b337cf3889d6e6bbc9e13be8220c528e32
SHA256 869555d6acf195ac6522c6bd4cfa6a2308c851e455acb5bb7dff9b25508c14d0
SHA512 c6b2b783098e4e76dee44e3d150b38d7a9e8b5814a762f8576b03ce6f6331ca412236c1b1295ea9821c052e24f20278cb2f21b0d2e413fd1840f5a93669e42a1

C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB_EURO.txt

MD5 eb99879cea006c5cee17506d0cf8f28c
SHA1 5cc32a84ca823019326b30b2c81ae146a7304fd8
SHA256 346ec7dff4f84b0ae0cc44e43249ce85f9924d26c97de61e9eb06f8830d1af09
SHA512 92b3dee2af5f8318abaee288fe75c2780de06dbb9d553a80dc85dd2f8e103c189def735a51964da3665d4c9bc7ceae9ca021a1930e37c59c49cb7f8b38a25f9b

memory/3188-5033-0x0000000000400000-0x0000000000415000-memory.dmp

memory/3188-5030-0x0000000000400000-0x0000000000415000-memory.dmp

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727662498327333.txt

MD5 84fd871fd7d1681e6e5bf39e7c2714a9
SHA1 f4aab2aeba8dd5820f9d2805c411c5943e387a71
SHA256 d5a694f6ce9f27229819cafebe2ae9edd7374b04dd4fe6a47ef7d4d3d24c3c00
SHA512 46f887b5e5edd0c14119ee087c78758af18e6da4a9f6534d86bb706a33381e0c27e57d4c52a00a46b9d9f7313538aa49030eb45509f3c2840f1fa3b8e23d66fd

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727663013511623.txt.EnCiPhErEd

MD5 95ed65f1738dad42f1f11e859f104284
SHA1 5cdd6617388783e330962eb20c27cff2fc8c8b0a
SHA256 dc38400451c59e0371fc6527bfcb03155547069e0dd5bf91d1419284db5f0f26
SHA512 562c9dcdab56b3b0f76cb3a59060455d32614bbfecaaf6eacd32291017c6b9b0e398de6eb0ff47900562801dfabb10c6509150d7f27ec6a7b3cbb37cc083f6c2

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727668912544901.txt

MD5 50b7cf475fb2d0ad450bf50a2f005317
SHA1 a2ff43390930a93a659a2087721fb622451eaf24
SHA256 ecca729ad0a0220cbba68c382a41888ff8bf24e67cb481b78028b2d92cb93024
SHA512 f47a476d896b76a90eb5f6df7590c48106e889cd78fd282c4c2fcddcd4a14af0b5fc8fbd51c29dce40e4f19cde262879935a94a941f9e61497ecacee1da1cdf1

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727671578469739.txt

MD5 846ef99a07817367aef26f9816124e5b
SHA1 a4283be258f4a7145287992d702a325c5c36ee69
SHA256 8741558ba836d32e285d243d67efb897a2e9248d31a51ed7f8bb8570bf1bac31
SHA512 6abc70939d3c115f57380c4173de91556cf2888b2bd977fdf4bc4c585bdabbba11cc393a0baed674d7eff7a7626b6d6dfec5818ca6c87316e94930802eeb376e

C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\File Explorer.lnk

MD5 4f207950942959bd9b3f27557b2a5af0
SHA1 25e0a3667cd28f6ef655719589f700e5c9ba03b2
SHA256 23fda9ba118ed1d18230ce57fa3ac501feeef6a4ad358769d85182f4689cf402
SHA512 90d06580fa81be2f8f706447c9203f03e77f65b35e5ff0cba997bdcabbc8100b9ab229301186fa970f9819bc4640aa0a9e917ce38f6413871377d56562e4f576

C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\security_watermark.jpg

MD5 20f2044701d0923e013515d7b32b4928
SHA1 30d30544445da6513071b08b1b962cf81993006e
SHA256 8d68b8781d83f14ac66efb2f8e9875eb8c06bb03129772908eb1d76bb6745b64
SHA512 560ad7494939bb91fc2df2bdb8a0f7b025ec2a9c47bb8dcee76e534066489f2a2fb73cbb8cc0e1b41b14a89948faabde72f65c7374d8d03faed21d76bbba37ec

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\alert_lrg.gif

MD5 58589a00e2a4e1f192eec7f63e881bea
SHA1 dc9cbe9a4c87f424ac6ff15863e85c82bad5a192
SHA256 4723a146f2b903ba09a324f4c5cb4fed524780669caa28181c49d17e9ec8b006
SHA512 69fcc5489d3dec0ca7b03cc41104a1a909b36f969a76d8bc21f30483ff307138e902f4f07223617490a5cb03c620055acce79bcb9e555e6e0ffa227f83872eef

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg

MD5 22f5a98fbc9a514a6af4b534d9f858d9
SHA1 61a13f66428b2cdcb12663de5a7cdcde242f7623
SHA256 484c3a3de2737011645a444353f1bac4a8b91a6d93d2674701670eec5fde15c4
SHA512 294fba00000734db4bd30e70f7a140b4e61522db398cb2a0e9dc0ff858fb1f90fdbb9b8de4f19db4e73be33c508ea8b68cde8f3e81e20b4ad62fb75f326e1356

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\aspx_file.gif

MD5 c42eb19e9bfec339ecc9a2f684527016
SHA1 3c381644a2bbb526e2ea6e11e6c7d0396800738c
SHA256 9fead7373d52b3a037356621f6d47a9cc530f25576c64912341d66e58ad50543
SHA512 02607f8686a5a382bdf1ede1737b0db07f7f2c4fe48f12ad266facc84c0924143e001a64bd5c10a6b5360ffae7b81b33d442c35603cdc3d556b1133c82227666

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\branding_Full2.gif

MD5 f2bff720a852de2db4d9d966b83ec09c
SHA1 964037d7c4b64137fb751fcd918cd52d752acc58
SHA256 201ae8ed2b563bcda7d689aac7ab205d88adba9dda3e6fe22e33f10397a9ab04
SHA512 4e5463dd2251fa73a5caa303ae031ade95b77b6e73168c5fc65d89f1ce90e4c67d45383c042158e96589fc03cc919d650e1a9e592748731d41833c73678872fe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg

MD5 78fb30cb23c7d887f0834301a56d844d
SHA1 b8b66be59d4c4b49f79c6359518388f9e15662ef
SHA256 d97fe1636de39aa5130d057e56e855a58c7a33994f27bc411b7ebfef480f4645
SHA512 b8c5590ab998f43867c7f030e6a2b78f232b0ebfba9534eab10c798b9ec9f4e19b7e7fddcc2a4be544c75e3775282033ee32cf17247dfabcc5c643d1ee09df12

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\deselectedTab_1x1.gif

MD5 6c27c510cf634ee915ad98efd33fa9ca
SHA1 a391e0979dfe65984fd8990f6cda0b3b06fcd846
SHA256 ff4f15a96944093e4546deb6c1c11c61f9c580f6a128d0aa24f573105c456332
SHA512 0adb07d3b20e8a9beeb53ef222c0d51ccfb28a1bc1385946082bddfcce7231f07dff4b563c0abb88ca4ae998410be77f34e0177fd88678afd7e2d769ae9f3399

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\folder.gif

MD5 e513abe9f14f466896e76af3e5114673
SHA1 bc9f0827c7660b66f3fad82aac2dffcbdfe81b59
SHA256 0c771e01ad21685545b7626b3b49a4809da76700a366f3507604fba7a9287f98
SHA512 be3f83a388b0d6513a82d6e86a480620830c1223292a5ae3523185f810f6db45e6a5e16ad746946b406999f3c8804407ce6434ccd3ed2c5c6cf8dc1416500428

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\gradient_onBlue.gif

MD5 7d4dd188901227cc373fcb2d46b092e5
SHA1 0c14fe61e10eefa82f9b0bf3ea2cd273e2d4b268
SHA256 f092a6b2c56ec9bc538ecbb73cc4a46b507836e9b313ba0bc30e8ec59d2570ab
SHA512 ce2621ecc35e4e24e9e121eb2d6dddc7a329548fd17af09fc862356ace3af406cadb816191f9d6379052a9ba74b72e7ba1fb4b5d628935d49f288cab6ca32244

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\headerGRADIENT_Tall.gif

MD5 92decd1691e704ea19c543566b711d80
SHA1 21d4832ae76c917a4ef22f9fca665d93990d369a
SHA256 b5e5e1d3184ce7fe656363dc47e3767977d7054031b379968ca3394eaadd6a06
SHA512 9c70ca28df33bc497bdddbdf5d02fbfba760108d476d70a943ec92c04d2832784498ed4ddc2abe9e4b71e61e6ccc136081216f57a8d5a8edd696d1ad26edba5d

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\gradient_onWhite.gif

MD5 ec12a35e08fd0d01249d0cc6812c2dc7
SHA1 0500f53476d9fdddd6d6a6f2007e438076ebf2df
SHA256 a749ebbb124f2ef8746066872e6a9c7f04f5f58227942fe4e9692875d58e6885
SHA512 fdfc5b96a69a1d772ab67ec65f1a442cc1ccdee8070e39acaaf48063fdde05b84f56a3bdf9c21575a83a93e902a46a7132c0bcc4ed35f99ffea34c31cf4f5735

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\help.jpg

MD5 98bf9d09fbc7a3e20d4222684f1755c2
SHA1 40b68681ee2f2f01c7b5b39583ed2687969718bc
SHA256 a96ba78ddf0547c62a46480c77e4de3352dd7abf114ff493c80b9e11c2e35006
SHA512 0014308fd3b52f59c661dcddb7e40c4a6f96cd0fb61b0a8efd441a41c6269fd4cd93991ae42a1cacd23212441b49a0791e0847bb55f2257bee164ae9df91cfbf

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\HelpIcon_solid.gif

MD5 7bf832e1e4a15c7541c1ad1b497c9033
SHA1 f86c704f119d232182ccdc2beb21c60ff28296cd
SHA256 1b3fc6cf0caa18c7dc73d19c0b36586a9fddbf8c1e206399b5d782bb51b5c6e6
SHA512 0f983931bd91e3f5e8f2b0d456577a41023a985fcdd7fb93e36300b3f7c570bde038fd9f2e632d07b538f01947e0d6ac2ce54b71aaea1ddb95063c375165646f

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\image1.gif

MD5 bff5530f721097a58df0a1da0a33848c
SHA1 575839c4b2e0cb5114e17c636cf5caf0c0f4773f
SHA256 df436280ca5fba18da991f17aa398c8e4668fe54e94a791409a85db520c47be0
SHA512 f2c48b2c72ec90fd52c32eeed63f665dcfe4ac846edb63a234d49dd95acabe5078eb001fad24eece7e2b6f0e01c005a6c6644c460a5774600997c2ca46996e4f

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\image2.gif

MD5 97dc13899e4f46bb38f5c20482d67420
SHA1 c5d7aef68a3486a9531a085c0de827c01afdca6a
SHA256 a6c1254fbd11376d4bd5ba2700d80b0934c059d08f273100a2062b7124777e04
SHA512 02e4c25943eaf88625dab92a930d7b0675358781d0f52feba0c9c56af09b735537e9d5ac1574b58490d6370b88bda8788945f960e86b3368ad9bb61566c81b8d

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\requiredBang.gif

MD5 e5519bbc60d8f7f24f26659d3e107059
SHA1 67b4bd8f0fa4951a1e44bd1328a965a1e3138bc9
SHA256 ca903e47300e739bc8ed20de07a5fc3b4416091dfb148f4f55c4ecbd807ecc0c
SHA512 ffe14dedb94795f0f8383aec4559bbb6dbfdcaf9f5c39b304e42354312fa84bad0513459e257693072583e459625ee9d8fa343ef93eb16de1971f4c384e3b068

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\selectedTab_leftCorner.gif

MD5 e81b5e68e84b6409b741515f32902582
SHA1 c0f1d1a432f1f677f68d5eb197e5c72261f3d107
SHA256 ff8a00a2c1674ff1c2a5f54f6ca95a2ee8e14c8c450db38657ab52706e832244
SHA512 99c5e05498e70ce6bd5d693756a773289b59c556a54019b3b8cff1817918b0bfdd8e2f61a4c458afd6447df8e6d7e67bca438fbb091eda826828694fcc4d80c9

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\selectedTab_rightCorner.gif

MD5 bfba1bb7f641e484400a18b43c4c3055
SHA1 675f94ae0b9fff7c4466d3095a378d6b02fd2ce1
SHA256 6aa7f5fbd44eee209350cc1ccbff391290407010c949971c9a17cedcdf3446b8
SHA512 cfb1ab92146e41c1402e19a02bfa33f44b55aad51346b44eb416b6d3bb0b90c528a1e8aae1390cffd03306c959d81e1de6fce87fae16156506963eed52951c60

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\unSelectedTab_leftCorner.gif

MD5 b423830b9e6c372be85a0e2f6f304e03
SHA1 c8825dcf392c8b6a076a4832a92a88d06a4dd700
SHA256 8e513700926b74daae8482ba9ef17b66860ed6070f2be53d6f8e2ec499189304
SHA512 346d0fec56fae8a4e2eeaa4b09d974ac9a7745d470c24fd5b1476f7aeb600db60928b1876fd19838ee5945ecf80440d50cb47066ff52eb4f79f53283cfbb60e8

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg

MD5 cc825fdb421e84c5138a3e87765aa762
SHA1 36bfe68cf55c30cbdf3ad342d90cff4e9bb7af1e
SHA256 71eeb4beb23c7e39af9ee58b214b827888656bfeabef74712e3092f71fd06635
SHA512 c99bfeccf8d651f278497933f042a0910fd415efe9b427a06ca84a6e17aa54b28856387f628b507382558d31754a86ae92fde3ad03269375f244964d00ba098e

memory/3188-9481-0x0000000000400000-0x0000000000415000-memory.dmp

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\unSelectedTab_rightCorner.gif

MD5 60f93f3f3cf6a34606e295981a7e5b85
SHA1 b941ac3eb49c93d08ee2c043e2d643fd943ed91c
SHA256 b75a10a248a26d182a0310a7cd4db02d066bca4127e9fece732e1e965b5ac202
SHA512 12b68512db831fc7ce4f1e63fac7aed1447c902806274954d2271a546b296a3d66a49df9b9691d8205b24ab9beefe2813a02d76f7d7dd18a77f352fb93430710

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\yellowCORNER.gif

MD5 1a27d7cd6bdd8bd487c1da1b1be0160e
SHA1 cdc21e2ab05f39cd002618886457ed6ee8c16e5b
SHA256 17c6bcb5ca3ca05840c2b68d5d2d94924e270e9f0ff6f93a7334a3db01461b67
SHA512 d008331e145696a15edbe3cb6a13bb6fe38d0063e2ad66a6ab81d87e3b27b1184b006f1611ffb6028588cc74d93e516c72803a6c21a195f070f6990e2fd1fee6

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group1\1 - Desktop.lnk

MD5 4f1f465e71da2b33504cbba42555d6a5
SHA1 b589ad7de79bded4ae941a8e2c27b40443319264
SHA256 6946ee3e14b2500dcde6972a251896f87889e7f5bec4890cf36ea26e472aa956
SHA512 c922e41e6ec1ee755e9cce7d72c7ffb4878964b5586bfc17108149e35bcc2abc5219fe0a1cd43b013b5b2170fcd68cced202463ac5a8febb8f05787cd6ecb45c

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\1 - Run.lnk

MD5 78189ca0d22aade111ea3db7eec538a1
SHA1 00d771fa9ec796a61a19ea71b431a31f7d6ff792
SHA256 2c1688ac753d83c4e03aabe1f381958bd475a7f254b811815a7dfa3f66be1ebd
SHA512 fd5f93bbce9fe57239256097a8017dd5ce6ddc7eaa80b19ef5bc723415d84165601f382ca84a437c05039dce1b7871d96dcf6108aab1de0612e3874acc5c04ba

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\2 - Search.lnk

MD5 879aca6b50d92f9c7e155a547318ad0f
SHA1 678c19fe5b90dc59e8b723583f51e949d75841f8
SHA256 df9ddd172bebf146365afaf796fa38cc82012abdb3fc6f9f86f408a5c2f41a5b
SHA512 bdeb3f5e5b96ce206bcd8cf3b27693a33f46af5953e23e3bec6ef77665ff8174971b7abb063ab6245da7d9a5da759465d7b9c3bce98005429682ad181b3c3039

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\3 - Windows Explorer.lnk

MD5 7d98d3671f02d816ad19bd032bbe1d69
SHA1 512cfe99e3c84e18b2a616033fc5e83f31eebaf7
SHA256 6717d397e4262a1d0fed54e82372c197ad3344cf790d3c06e5f81e1d5d045d23
SHA512 7b5074e99a7e0e8af5ae72737af9e97630b03dcbe88f961438a6b46618b9def9cb6da371e049970158ad48ac473b36918d9b478564345a7b1bf9ad21022718fa

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\4 - Control Panel.lnk

MD5 3b72a540829e497cc943caf47ff41033
SHA1 0b8d1daec2041bf8e86f57b1a08db0edc7a0e080
SHA256 e35deb8e13ea48c1597120aee3134b9c6878163d4a53f2e8a385826f350d4da6
SHA512 261f064d13b450e9768f39d3f6aeabd564d3d4dcf6975969cc0066a5f70b3487f8a9d2eb0889d8af7d59473a342467cc8061f165333baadcfc89228b38ece004

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\5 - Task Manager.lnk

MD5 fd921cb882601745cdf4033db4b42abb
SHA1 0e7f4bb05aa9ea73003466a59ef5c218f2fe221c
SHA256 ec0d569dd7285718056f14036bd6b7baf64cdd2d07c40fdb690e19c19afe16ab
SHA512 94d4b7a9ebba5fa328b332000e3429af4f18a66da2bf12b0a61cabf5f310902145c1969c81e056633014e2cb10099c9a771f18a8eab2f120fde904a75f81116b

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\01 - Command Prompt.lnk

MD5 6ee911b1e3c488298536d1babce0ef0c
SHA1 caee67de4acfc49b455895f214a5cd5b204b30fd
SHA256 81495d9543d501c7ee9910978aba4e233dca306efc0e3b3031bbb6ead6f87b2e
SHA512 32fb878d82b4428c0ec35611fe7d35b98251d1d76fde8d4d7a2c0bb8b1d34b4a08fa24ef04147d7b3e60b44d5548db59d0b40ca40413c21b07b37a1890f8ace6

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\01a - Windows PowerShell.lnk

MD5 f85b6d175a7a341e77180f6de867605b
SHA1 f8d6ce91bfaa03b6399c492e58f1d377f25c3fa5
SHA256 845f4ea4bab89fd164485e75aa9943f1d609c89c005b8c941add416c89c197c1
SHA512 e37870d4c90de9ce41c2d2d74826b0c701b5ead704c63a5637a018dab817cfb26de19cf5751f6c288786366f4c8ec7023b8a97ffd7614b261dfd9a9adb02f8e1

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\02 - Command Prompt.lnk

MD5 2d14e4da4653da77fd4fced30a277bb7
SHA1 54656db787c100824d7d13d8d152abdc66dd0106
SHA256 c674192311bab5a3dc4de840abd6e5dcdd3fccdea39ee3c44633aeec82562d70
SHA512 5b3f41b12ae8e945398f7d273e89d7e3f91340c88703a7564ca14c6402bbbefc477f01d587be83c936860a003affc6a02e199b6009e1d6e5ad2c4fa297017d9b

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\02a - Windows PowerShell.lnk

MD5 3c464ad758eb7d7a0faff733bf58f089
SHA1 457aad8ba8903feea6f5cb571ac2b8027ca9fe60
SHA256 4792947546fbcd2fe726a31a9f49fc2182d7206ca4b5dcc1de8beee9b100daf6
SHA512 d5a5f0bdf955c46158a888c0903a6c0983c747f19dd860bf2d907c1324bb9449b6b6cc9b680f473c76efed7e4247f9a61e523fa4c9a89bca61e9baf0b4967b9f

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\03 - Computer Management.lnk

MD5 fe215f48618af7829fbde107df412c1a
SHA1 5919686082bd43c1efa4d569b0b1eae7a7290f5a
SHA256 9e346a2df57dacc74aa6166d0cc2ba9d522046cfb52b8e0b337cb40eaa3324e0
SHA512 d5869ada749bf869f7701679396fa6664f94188b5ead29fabe5119e83b6ff606a386b4ce085fa7c00b387f9077e36f2e835ae7258ad4e5817e3983c59e0821c1

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\04 - Disk Management.lnk

MD5 86b8878ae2e6fb1f92c8677fb54f4042
SHA1 fd85f11b64e7d769bc9c4aff13bdc9cae30a32a2
SHA256 d7e87adcb4fc6ec0c8b64c2cf61f7cc1b70193527ba1cea9692b3475f08fe28d
SHA512 6eb8086a01230586cc41c160780534be36ab11a1e756efcddb54fcdec36d4571017dc7def83fe8a41aec060c8b38a9dffa8ffe64bbd4176bc687dd91bb9e5e8c

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\04-1 - NetworkStatus.lnk

MD5 8bd5cd6129fefc552a2f1d3372626d32
SHA1 e81aec6dab953cf780545989cfc5398ffb823356
SHA256 19cd09cd9f0648e59e9e4fb8dfd48c12289f94b8955943f87a68727fc5def682
SHA512 05e2eeb6b497873f244fc033a5830f4ef39326a5016709913b644ee8a4afa9e1314ef60e6aab27b6a365af6e67af1a4fb86a1b8a2cf1df324a74b874866fbfa9

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\05 - Device Manager.lnk

MD5 214230fd15b61f1b818518adb6e919a3
SHA1 159d9f65a52005f5b244be23068e7f1c1896ca88
SHA256 32d45c18d9d9d1deca38908347a7dca67ebeeea4e29b780d2860b862fcc0c320
SHA512 0ccd2a98a734cc53698282d13d832ee3c0784029974d681833c34932cd8587f778ea96d918067c164187eaa93cd84b3719e8990f1842dc03c5609d386ec1d67f

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\06 - SystemAbout.lnk

MD5 f25a998b1009516a665d9b1f03e239f9
SHA1 1d8b84dea239eeefab8d852610a11998cc1e70b3
SHA256 8292784acce78fc68beb9073e14b6b65024ad3dd2c470ea8319dc8cbea529233
SHA512 2d24bb33246face8b8197361990a13d8a159c39c376ee18014d562829a00136ebc155014a986a237837dddb77f8cb76710376583ed48dc5396bd457be2254109

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\07 - Event Viewer.lnk

MD5 74129860d7d910013aed0146fe81844c
SHA1 54d373c926aec868f6889a59328b70309346f321
SHA256 ede01ec16197829ea189f1c1241c241ec7eb2b501fc10e456a17dd811d7250ee
SHA512 18dc199c5186ef3dde2d6f2e5f820fe4ecc6cbbe2f79f3b57588a064e1124e311c6b0bd3eaae1ef20d912747fdeb10b451fcbc6858f11ffcf182a24db361af65

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\08 - PowerAndSleep.lnk

MD5 feb50d690d25cd7865e187a2d31dc87b
SHA1 207645fad6f4e3e5c50a6962e2acae5c72355dd4
SHA256 03ddadbe3e9e72f4b3824b12094e87a97cddce4ac97ab578c81003adfbbe943b
SHA512 56767f49387555555d4371e9a1cee91b6eae355b23ded99727657f74d348a4a95693365dafeb0b43c226f066e021adc1a7ea734813584eb9d7e998855dc51039

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\09 - Mobility Center.lnk

MD5 9bc44c64f4ee0acf544f1b2db439420c
SHA1 41426856d5a81003e9a36f1f33997bb814532034
SHA256 4941f3c0126ce90073f0a663403e6b16d9f1e73ca80b117c1c09be6018821113
SHA512 7b5638b4d217c0ddfc63b14dbb8961b9b702b8e982ae5ef33a6f859436cbd802213c7a16d09931e449798d858a31a4e5e172b3ed4da78d55affd6238d1564fc6

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\10 - AppsAndFeatures.lnk

MD5 415ee77566c2375e57a222c8cf5f1cc8
SHA1 5c58c7f2e844dbfe3ea96b827be5025af64799ab
SHA256 27fcefbaac6a0e35ab78d2d3a3c579250c28744675f17e2ed153abe7e6d6583e
SHA512 921027012315a4640f75114488496633c1b03474a4af27cb96addce3dc2e89dbfc117bb62f110c6f77a566c49fec16d6ab596dce374c9f826c2719a6e8c55398

C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk

MD5 27ac88650adb01f80e7c0dfd047a8770
SHA1 4e5fb36f747979173e53d35fef8bc5a98fce4a2a
SHA256 de139440fdcc0e6f6d5a43abff8a3da329efa4d3b2b3d465c984d7e52d71bb8f
SHA512 e0becd29f6d6dd94bc2d1fddf82e3b6aa59c0dc99b1d48de01a198360675596979687cb087b862caa45c25f0e59d940f129cc9737eddb0303ce42e4af7e25dc0

C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk

MD5 bbf58f742c678a77c2ce049812094015
SHA1 b7f1446c979e644bc601a868d8f6eabe4781ad77
SHA256 f088d50e9880e1b6841b09cd445d2f622d7b31b9b73434daffc94eadded8ecef
SHA512 2dfdcd7bc17cad21b27200267c5572cf671634e6d2bbd1ff278e64a05baa83a72f10d8e993bf1a2b2fb9e02af179b779e35fdb615b5be6e9a543fead4fea966a

C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Magnify.lnk

MD5 3b8d645f47ddcdc5256ab0bf718653f3
SHA1 aef184c61db9052e1fea80d4d3f8c17f9bc6dc73
SHA256 9d7727cbf6de0f73c45dba40cea36d1cc9db3c7ea477e98d35d99322264c79d2
SHA512 645fd195bb97b905187f1fb17877ada3cc4994fc59aa0b24fed60ca02b75cee68508e82612722af5b35fbffdb9a536ac9ff1790903061404b54492b2a17cd4f1

C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Narrator.lnk

MD5 05989bcb6b3bff2a06f1ef556d60f155
SHA1 6a489cafe89fa543e76700fb0a7ec0d9815e6557
SHA256 68ace7354fa1361ed7ff51d837167a41771602b9ae4f352afbf125d08a8f3927
SHA512 f17586c9ca15926f220c6e32709ab7bee6bba42f39d5a73689a57d4437c3baecc9531c70183c8d2e6951ae2a2d0a620f3be489b659dfa427e04a0f878ff5b693

C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\On-Screen Keyboard.lnk

MD5 e54fad0b9012ec25196545928b06d3c5
SHA1 89a7447273198e4ae7f5a60984a2162e2c8da583
SHA256 89ad599d0d33fd56c7ce08903a01674f66d2947a8636b0269bd091f4577bdc5a
SHA512 d1d21ee253601d607ef4d537ce181344ae5085c36b4d888d57b286adb737a85105023fd1bc7ef5441b2409a14e5f27ebc61e19683a18020d8a51ac5ad80499f3

C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Administrative Tools.lnk

MD5 6cb0d2df42d8a9e6854ce18ba407f2e3
SHA1 6e69e81d5bf607b9ceb3934ffcbf9aadfee12dc5
SHA256 1d22e1d5422ca24b564812de304ee3eabd7979112ee3236ac66b098659ab16cf
SHA512 ae5f8b460cfb92c9dbb7b6463ce64abfa43b7d1a3d5b144e7054162dd122dfd508bb091388ecdc699478c4bbbb0798668436beb7e3fb2c4d961442069439a975

C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Command Prompt.lnk

MD5 c6e942b628f962b9688ba7a82e75b6f1
SHA1 412a13dc3e32fbca6d896151e8bfe01aac066b5d
SHA256 8422b39c786ce95e5fb1dc91814e0bcde426d69e32bfb7b842196f8c4afba7b4
SHA512 6ad4adfd7bac3f2dce3cf9189105bac5bbc7868edb418d091866817460075a82fcb4a7cd70d869457bc4b9c6fe72185660e690085ba96a05e13474a812170622

C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\computer.lnk

MD5 a7e5b11ead6985e643f33c5bb59adecf
SHA1 b6ce5537cd2f41d001d29220ddca8c13e332e783
SHA256 88c2a85d8f54582798b571491c5ae8d7b457a8b892d49c6857b6f1e70d93f65e
SHA512 8f5934b88048df4fbccf2617ae1b747f31ca9d8a53e3d3b477a362693c6a045af42df907bdbad48609bc0a3af1bfe6dd6cb31ceb0ef83e886f600e993eb71705

C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Control Panel.lnk

MD5 2725c134b6d085ed616718ccf31cccd5
SHA1 81f905ed357b3672de570c5799c4952b5a703bf7
SHA256 2a320f252cb9a446646be08b4cd0fecdab46678b7ea57b9dfeffac5d4e12edf6
SHA512 6cd637ff399758fdbc68f13b0bb02add7d96fead280f4a35d0983e492f9dd96ab582f102bca43d11b8a00ef7d5b1e0581f49d8a45e4ce8d004f5a5164c3db642

C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Run.lnk

MD5 f64656e2b55ee7b5ccb7186153441bf3
SHA1 a5029a2a3f8d16a769588f6c3732022f83b823ee
SHA256 fa55be564701a76a7d7b207a16a463d000d68575a0cead187d4273e76203234a
SHA512 c23834cedb2c6ab2246f96087f7ce36f317b41578c921518e9f29efc46d66bbc6e6dfd43a856cf2ecd67f0945d38df1b67459ab229efe67c37371a0ddee0bfa1

C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell (x86).lnk

MD5 50a032195f807956b6ccc71edb653ae8
SHA1 4ce1f6dcb76a44c0fb9d0706f72855663c701787
SHA256 1bce72306af71ce6a840f384cbb1cffd99815c978a9b8a5001fc1431392f603b
SHA512 94c96237d98223d768c5180ce25496f2fd58723f8afd2a401dd047513b1b05990f4d1995322c9488c6032427779a695372e3f38d447eb7b293767c6957ab3b3a

C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk

MD5 8dd6cfad8391ee359365f577b723e1a1
SHA1 8545791d4ed0cb38b52ca19ad59c03150fb1f7f5
SHA256 aaacf067fdbcfb10288bc34161098f4c43add68e545aba825e57e6a81658a203
SHA512 cb5124e8aab0069136c73a75d03e3ff07febb4518208454a3b88eb32bdd5cea9bd0ce06c229c01eb1ab25b46e0f5f6eb7e451ec17bbddd9beaddb64f456184ae

memory/3188-10890-0x0000000000400000-0x0000000000415000-memory.dmp

memory/3188-11003-0x0000000000400000-0x0000000000415000-memory.dmp

C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png

MD5 da777ead9ed12618aca65493cdc5260a
SHA1 0d7290d23396ff10ad2d4c88dbe49b31e5393ff0
SHA256 f70531842da2978a4dd18cb43e8adbd00784470edc4592b8c5d9fb05bcec1cc5
SHA512 d25079805d77377551fb6046eba22fbe6e29709996bef7811b1e2507c9937006a81f6df093eff4d7cc3d2e51078afcf2f504d9a0a4ebfae7101123d10e857970

C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_contrast-white.png

MD5 16a205b0dd2a3f47a4335ba0a84ca88f
SHA1 b81adf764f3cd5b307dca35330a890ab59236b45
SHA256 6b7fe80a887aff7aa41c3882c9567a171fe4e5aa4a29dfde3e2eb9a24876e4e6
SHA512 c4ef25062d4295781b9ef4382cc33cbf3092d5448522a6e99b09f4175591cae6c1ffda88773cce85a44ef43acb150947ae738c7aab8a31700f50abf986b29bac

C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png

MD5 af00ff08b827f41788f2419b790f103b
SHA1 d2e4ef4709b0c0618fa698f40a1e56adefd233ca
SHA256 32b86dfa5a94002c4511df2b58287105e860fd0aea85474ea665386dd691e63d
SHA512 4180a9d20b001206819596ffd357e64fdc567718f95cca2d9864e9f98c3bfbf928db4d993347ed8766d9bd307ca69068ebfca1201f8f45422c870e396199fd5f

C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square44x44Logo.targetsize-44_contrast-white.png

MD5 32e93bddf646c37b48f189900f375ed5
SHA1 91a31ec240cd0abaae52242b58a0e67fc23bc5df
SHA256 02e667131f789e63a1cca99f811c8359b4c561a69327a066e7aff24a01b3dab6
SHA512 1521666a2b57ce9e42f250348d636256b1af997788b13919a4ae34eb3cb4f6e37b8b770f874e2a3f0ce24dc579793911786c711c886f9a681a01ce84f4de6585

memory/3188-11308-0x0000000000400000-0x0000000000415000-memory.dmp

memory/3188-11309-0x0000000000400000-0x0000000000415000-memory.dmp

C:\Windows\WinSxS\wow64_microsoft-windows-onedrive-setup_31bf3856ad364e35_10.0.19041.1_none_e585f901f9ce93e6\OneDrive.lnk

MD5 6cc52a595c8f7fd766eca220eb7934f8
SHA1 6a2d3b7e50a189e726dc5dc6dc8bd922a6aec0ae
SHA256 6aff259f6f035d5ca015f43c5dc9ffc872246587f9b25a5560bb7cd10f2fb6c0
SHA512 cbbb3c75c345f8e0e3fabf11f30c1db781bf43863dc9d595e141fc0e54207de9c1538dc3d1d866d3e8b9c17d2ef8fcfcefa0e8bf1569000dc2ebd86219786756

memory/3188-11315-0x0000000000403000-0x0000000000407000-memory.dmp

memory/3188-11314-0x0000000000400000-0x0000000000415000-memory.dmp