Malware Analysis Report

2025-01-18 20:41

Sample ID 241207-lsf2bsxjgx
Target d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118
SHA256 809ead42b86ac24d93896af74f2df781ff40e2157e33d47912202fe95510cc64
Tags
xorist discovery persistence ransomware spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

809ead42b86ac24d93896af74f2df781ff40e2157e33d47912202fe95510cc64

Threat Level: Known bad

The file d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

xorist discovery persistence ransomware spyware stealer

Detected Xorist Ransomware

Xorist family

Renames multiple (2198) files with added filename extension

Renames multiple (2184) files with added filename extension

Drops file in Drivers directory

Reads user/profile data of web browsers

Drops startup file

Adds Run key to start application

Drops file in System32 directory

Sets desktop wallpaper using registry

Drops file in Windows directory

Drops file in Program Files directory

Unsigned PE

System Location Discovery: System Language Discovery

Modifies registry class

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-12-07 09:47

Signatures

Detected Xorist Ransomware

Description Indicator Process Target
N/A N/A N/A N/A

Xorist family

xorist

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-12-07 09:47

Reported

2024-12-07 09:50

Platform

win7-20241023-en

Max time kernel

121s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe"

Signatures

Renames multiple (2198) files with added filename extension

ransomware

Drops file in Drivers directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\drivers\ja-JP\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\drivers\de-DE\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\drivers\en-US\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\drivers\es-ES\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\drivers\fr-FR\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\drivers\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\drivers\gmreadme.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\drivers\it-IT\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\20h0qrWAF1yJNAB.exe" C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\System32\DriverStore\FileRepository\prnep00l.inf_amd64_neutral_f1fa021d2221e2c7\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\prnlx006.inf_amd64_neutral_cc725426972d1293\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\en-US\Licenses\eval\HomeBasicN\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\sr-Latn-CS\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\Dism\it-IT\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmbr00a.inf_amd64_neutral_aa4f0850ff03674e\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\es-ES\Licenses\_Default\ProfessionalN\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmbw561.inf_amd64_neutral_fe42c0ff14d5562b\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\prnky308.inf_amd64_ja-jp_d90af802b607044a\Amd64\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_command_precedence.help.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\TroubleshootingPack\ja-JP\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmkortx.inf_amd64_neutral_1975687236603184\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmmct.inf_amd64_neutral_15bb3ed734fbbeb3\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_While.help.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_trap.help.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\it\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\prnlx00c.inf_amd64_neutral_79ebe29715d2fa47\Amd64\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\rndiscmp.inf_amd64_neutral_4ca64d28e1be8fa9\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\en-US\Licenses\OEM\EnterpriseN\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_remote_jobs.help.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_modules.help.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_Switch.help.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\prnbr002.inf_amd64_neutral_db1d8c9efda9b3c0\Amd64\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\prnca00z.inf_amd64_neutral_27f402ce616c3ebc\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\prnep00a.inf_amd64_neutral_92a4c727cdf4c2f7\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\fr-FR\Licenses\_Default\UltimateE\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\migration\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\MUI\0410\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_script_internationalization.help.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\acpi.inf_amd64_neutral_aed2e7a487803437\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\prnky305.inf_amd64_ja-jp_4d77cc4802b17ec3\Amd64\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\prnle003.inf_amd64_neutral_c61883abf66ddb39\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\prnrc002.inf_amd64_neutral_fdb6f2e252435905\Amd64\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\wstorvsc.inf_amd64_neutral_d7bf942e99bb1d41\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\migwiz\PostMigRes\Web\base_images\WindowsPhotoGallery.bmp C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_functions_advanced_parameters.help.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_Assignment_Operators.help.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\prnbr003.inf_amd64_neutral_dff45d1d0df04caf\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_job_details.help.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\brmfcmf.inf_amd64_neutral_67b5984f8e8ff717\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmbr004.inf_amd64_neutral_ccf1bc353e588fe1\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\prnca00h.inf_amd64_neutral_96a8e38189e54d71\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\prnrc302.inf_amd64_ja-jp_64ee91a0bf7b132c\Amd64\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\it-IT\Licenses\OEM\HomePremium\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\en-US\Licenses\_Default\StarterE\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_remote_requirements.help.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\IME\imekr8\dicts\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\migwiz\replacementmanifests\microsoft-international-core\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_split.help.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_methods.help.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\wiabr008.inf_amd64_neutral_27d1c9a28eac4eed\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_properties.help.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\prnlx00c.inf_amd64_neutral_79ebe29715d2fa47\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\prnsv003.inf_amd64_neutral_1e0c4fbb9b11b015\Amd64\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_transactions.help.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\winrm\0407\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\de-DE\Licenses\OEM\ProfessionalE\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmsmart.inf_amd64_neutral_829e8c7d1c8d5207\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\pl-PL\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_Parsing.help.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_escape_characters.help.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\qd3x64.inf_amd64_neutral_e8903726d63a3f07\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_debuggers.help.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ffilnnacffikkncf.bmp" C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\Common Files\microsoft shared\DAO\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\J0143752.GIF C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0214098.WAV C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.PPT C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR34F.GIF C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR46B.GIF C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\settings.html C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\AUMProduct.cer C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Discussion\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SATIN\THMBNAIL.PNG C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\LoginTool24x24Images.jpg C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\tab_off.gif C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BlackRectangle.bmp C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-back-over-select.png C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\35.png C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BrightYellow\HEADER.GIF C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD15072_.GIF C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\THIRDPARTYLICENSEREADME-JAVAFX.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Program Files\Windows Defender\ja-JP\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR7B.GIF C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormToolImages.jpg C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Notes_content-background.png C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Program Files\Microsoft Games\SpiderSolitaire\de-DE\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21308_.GIF C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382930.JPG C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14514_.GIF C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\bg_TexturedBlue.gif C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\SoftBlue\background.gif C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\images\Tulip.jpg C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_gray_few-showers.png C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EXPEDITN\THMBNAIL.PNG C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PAPYRUS\PREVIEW.GIF C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD10267_.GIF C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD21390_.GIF C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\QuestionIcon.jpg C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Windows Media Player\Media Renderer\DMR_120.png C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\navSubpicture.png C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationUp_SelectionSubpicture.png C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Program Files\Windows Sidebar\ja-JP\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\circleround_glass.png C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\css\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01750_.GIF C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.XLS C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\diner_s.png C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_few-showers.png C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Program Files\DVD Maker\de-DE\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\mainscroll.png C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_postage_Thumbnail.bmp C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\ViewHeaderPreview.jpg C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\ast.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToNotesBackground_PAL.wmv C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\Help\3082\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0101856.BMP C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\Sounds\Places\BUZZ.WAV C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\TAB_OFF.GIF C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\6.png C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Common Files\Services\verisign.bmp C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\winsxs\amd64_microsoft-windows-s..s-svchost.resources_31bf3856ad364e35_6.1.7600.16385_es-es_ad093f64c1519bbc\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_server-help-h1s.itpro.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_bc02b6df0a89f79d\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-minkernelapinamespace_31bf3856ad364e35_6.1.7601.17932_none_0ca1c10dda240617\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-x..lugin-mui.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_8475cbc0e2ebfdd7\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-a..figurator.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_bf45d11d71d42eef\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-ie-behaviors.resources_31bf3856ad364e35_8.0.7600.16385_it-it_2ad115cd06965272\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_prnep00d.inf_31bf3856ad364e35_6.1.7600.16385_none_ae3f8d47fad9c2a7\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_prnrc005.inf_31bf3856ad364e35_6.1.7600.16385_none_227092d2a7af4a58\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ObjectModel\v4.0_4.0.0.0__b03f5f7f11d50a3a\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\PLA\System\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-help-mobctr.resources_31bf3856ad364e35_6.1.7600.16385_es-es_69840a3195e14db0\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Windows\winsxs\x86_microsoft-windows-g..picturepuzzlegadget_31bf3856ad364e35_6.1.7600.16385_none_725857cf41f74c3f\settings_corner_top_left.png C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-fax-common_31bf3856ad364e35_6.1.7601.17514_none_6a2ab458674011dc\WelcomeScan.jpg C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-onlineidcpl.resources_31bf3856ad364e35_6.1.7600.16385_en-us_de0838fde8c16c11\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_xnacc.inf.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_19e5dd6205b3ab29\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Windows\winsxs\x86_microsoft-windows-g..picturepuzzlegadget_31bf3856ad364e35_6.1.7600.16385_none_725857cf41f74c3f\settings_left_pressed.png C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-g..ets-slideshowgadget_31bf3856ad364e35_6.1.7600.16385_none_815d27dbb889ba17\pause_rest.png C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Windows\winsxs\x86_microsoft-windows-g..s-weather.resources_31bf3856ad364e35_6.1.7600.16385_en-us_36bc61b12dcec80c\settings.html C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Windows\winsxs\x86_microsoft-windows-gadgets-cpu.resources_31bf3856ad364e35_6.1.7600.16385_en-us_4d6aa30008b38d10\cpu.html C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-s..ce-common.resources_31bf3856ad364e35_6.1.7600.16385_es-es_035fb2eb1fa7bd31\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\inf\.NET CLR Networking 4.0.0.0\000C\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security.Cryptography.Primitives\v4.0_4.0.0.0__b03f5f7f11d50a3a\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-a..core-base.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_68a3391d007cd856\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-halftone-ui.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_11659fed3eedfa29\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\x86_netfx-mscordbi_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_44829d2719114141\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-van.resources_31bf3856ad364e35_6.1.7600.16385_it-it_595ae8a0d0d6e218\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_ricoh.inf.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_c55debbc3f7a9ef0\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7601.17514_none_f35f9773adf74c06\Roses.htm C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-n..rkprofile.resources_31bf3856ad364e35_6.1.7600.16385_en-us_ad1c591dbc1da7cb\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-o..tend-apis.resources_31bf3856ad364e35_6.1.7601.17514_en-us_a1eb9485bb71c8ff\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-c..erecovery.resources_31bf3856ad364e35_6.1.7600.16385_de-de_7d1ea40c2518ee28\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-w..ellibrary.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_a84baf4dd2397886\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\wow64_microsoft-windows-p..eercollab.resources_31bf3856ad364e35_6.1.7600.16385_es-es_82946e72e9a0f858\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-d..re-client.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_5201d5325fa2b291\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-duser.resources_31bf3856ad364e35_6.1.7600.16385_en-us_d1256a4a3c8105f9\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\Boot\DVD\EFI\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_mdmgl007.inf_31bf3856ad364e35_6.1.7600.16385_none_cfee2604c67345ce\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-themecpl.resources_31bf3856ad364e35_6.1.7600.16385_de-de_e5ab4e59c02b40f7\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-wmi-ntevent-provider_31bf3856ad364e35_6.1.7601.17514_none_4e7fa5bfc379eecd\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-mystify.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_7c8fa5a9054c2f41\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\inf\.NET CLR Networking 4.0.0.0\0007\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\inf\UGatherer\040C\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-gadgets-currency_31bf3856ad364e35_6.1.7600.16385_none_c3b9072b536514f6\triangle.png C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-w..ty-client.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_14f92bf9e03a1646\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-font-truetype-euphemia_31bf3856ad364e35_6.1.7600.16385_none_14191eff72a98c54\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_wdma_usb.inf.resources_31bf3856ad364e35_6.1.7600.16385_de-de_5cd8b8e47c5ea11b\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-directshow-devenum_31bf3856ad364e35_6.1.7600.16385_none_5914022fa13f06ca\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-l..essionaln.resources_31bf3856ad364e35_6.1.7601.17514_de-de_84f7d8bcc36e68f6\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-performance.resources_31bf3856ad364e35_6.1.7600.16385_en-us_a2a861c03173588c\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_88df89932faf0bf6\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\msil_system.web.dynamicdata.design_31bf3856ad364e35_6.1.7601.17514_none_0f747869dd9333c9\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-r..iagnostic.resources_31bf3856ad364e35_6.1.7600.16385_it-it_16e1e8ac01f98419\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-tabletpc-inputpanel_31bf3856ad364e35_6.1.7601.17514_none_6fb51b358e21d75f\correct.avi C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-m..dac-rds-persist-rll_31bf3856ad364e35_6.1.7600.16385_none_949185e7889c96d3\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-shwebsvc.resources_31bf3856ad364e35_6.1.7600.16385_it-it_be1f5001d1e707e0\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-sctasks.resources_31bf3856ad364e35_6.1.7600.16385_es-es_7ed8755f62bb36e3\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\wow64_microsoft-windows-i..gbinaries.resources_31bf3856ad364e35_6.1.7600.16385_en-us_99d78f6b8e497537\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\wow64_microsoft-windows-i..l-keyboard-0000042c_31bf3856ad364e35_6.1.7600.16385_none_63b7f9b0a40897cc\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-imapiv2-base.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_07c24db6284f4de4\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-b..-bcdtemplate-client_31bf3856ad364e35_6.1.7600.16385_none_8419660d1cc97b24\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-m..ttheme-us-component_31bf3856ad364e35_6.1.7601.17514_none_b52573ad8e4c2d89\US-wp4.jpg C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-msconfig-exe_31bf3856ad364e35_6.1.7601.17514_none_38a043f2b45f9ad2\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-ie-pdm_31bf3856ad364e35_8.0.7601.17514_none_0a379bcfbdcffb74\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-b..xthandler.resources_31bf3856ad364e35_6.1.7600.16385_en-us_937f19a90a76d802\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VNTEIYXIWDWJPFL\shell\open\command C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VNTEIYXIWDWJPFL\shell\open C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VNTEIYXIWDWJPFL\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\20h0qrWAF1yJNAB.exe" C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VNTEIYXIWDWJPFL\ = "CRYPTED!" C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VNTEIYXIWDWJPFL\DefaultIcon C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VNTEIYXIWDWJPFL C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VNTEIYXIWDWJPFL\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\20h0qrWAF1yJNAB.exe,0" C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VNTEIYXIWDWJPFL\shell C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd\ = "VNTEIYXIWDWJPFL" C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe"

Network

N/A

Files

C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\HOW TO DECRYPT FILES.txt

MD5 b2890cf3bd97aac347746072c7028e97
SHA1 9a4c919126522232477ddf93e487dfc1b51ba5ee
SHA256 460c888926b71d1f00952860ccf79815d24a8d45597206bb31c4f5bdb8bcab63
SHA512 655857fbf4091f7a610edf1bed2733398cb100767f1fbd2ca163c8b145233217c939083389cc651c5706eb86beda310282ca05c3bb44a2b26fe2d6f90f39ad80

C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif

MD5 abf131c64a2d252f05d00b5aa36a9dcf
SHA1 e75ed214987bfb40242ee790c883c7bd878dc107
SHA256 f3062f4ef55bf421da943473aacc8ad237556e8af8a5c10646ad65215df0dcdc
SHA512 d9e307e3b5f111f8c3ddac85d0315470b62e5f847cfdaa026cd28af326280aa35c2013340963d97cdc0ebf1b7d3692768b85cdc66d869e371ae7c38c25268fab

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html

MD5 efb5de3e67c0a24b752bc24469a17adb
SHA1 128449ac112adac276a47f0b0917ec287f379249
SHA256 3948cc8e7884f8cd718a1e730844b32db54957a68c0604a288ced183e948d6eb
SHA512 d8a3ced7a6c2eea1e315f7c722deeb67f563325f70a11e2bb2b2ca2550d02762dc35725849ac9a5a25dc56e7842b549598f5578f9bdff216fd04db8d1da2d4fa

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html

MD5 799721e1061da7b932d031d82cb80d31
SHA1 7c7bfdda1cf9687e52049dfb52ea6c26ec39a689
SHA256 dbcb13bf40706616abfaa29d29cce3f294baa4794f8e87a56186ac26d2d02361
SHA512 ba55dde307222060bac2e583a2d1c3d8406c03b57e7441af61529077015c77140d6c107f8b66477c3f48870804e7bdaedc5eca3c5bcd1ed4feeec4478ac302a7

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt

MD5 0af1385253ac47b344d3feb23cad5b7b
SHA1 b3873fe834a875d5c6910cf6b844b65053817bd4
SHA256 5083a98384d060d8cfcc79499147438b49e1f87d98892fa7aa1113827b9f9eec
SHA512 51f4d97dd582af13e3751168d8e7bd436952ebe956d8eeb91877aabbf8c4f60fbe4f4f99cc201169cfbb42854ed6de9f56dc999490cc811678ab24336e533d64

C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt

MD5 ea6b0db636d56305a401abe465473fca
SHA1 71253c0a8ba5124a74bcf0a4f7a4efb4ed3dce35
SHA256 2b33944d83aa07795b77310caaff89bea24b8aa0d5c3ea19a9e7d171436712e4
SHA512 bfb510c130c2e9e4d6c95b7d707201d4be7cba460dc25f15489152e7ded5908c4ea5a61da150772ebb28e5964e2de27f5ad3bf9e0689e2dad60a706e6560cb50

C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME.txt

MD5 bcc4e36a1f2602146cb5dce49cfde71c
SHA1 23ec537974903f889996f253f480f4f2a80fb7e5
SHA256 4d4f39995c8978f4139b19878660247b6bfb9b92495aed5b5409e5b974dea9c3
SHA512 30e652783415fc5be10d7e399fccef6603b56aaa39680657518992a0386406132a0111518ce49b3d8bd8ed13625b50472734a24d19d3ce677c94e78b04fc51a3

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_OFF.GIF

MD5 72d0610dcc0c37c9bf929105a11bd796
SHA1 92ceed0411443b3049a0ea7c3a5f3dfac4b655e3
SHA256 d7e7201a400dcc573da43de81bbffece41f6a111570e11adfee5d8545f9e0f4c
SHA512 e2383f043fe24dd3c18e583da9231cf105734550a230c5eecffbc30f809a23e2982f7ab2d2b1caaae2876fa89065a108c67dad50bd97f2da66484bf0565a3e4a

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_ON.GIF

MD5 61f5e11ca53b06775c9e6c0b8432fb72
SHA1 5c8f1bf6e1ebbc8f8ac515add7f3fc60d79872aa
SHA256 d1b9e740831767d1616b519c8aa4803d15b72ae86a4fa81bcfb4b60d93f9eca4
SHA512 fd7d7e9527380b5d190ef0114786686a2e52ec1eadb5187902b3b98e9ba7cbf2042e9cd4ce98a8872f6493c688ee0b0b54f19cf92fdb732f0a4b287e11a5a227

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\BG_ADOBE.GIF

MD5 6f5741e52db754c6cdf87820ccb9a5d4
SHA1 610744b2adec319e347be408f6abb4f16a129f39
SHA256 1035e72b927d8015028595bbbbcdd2c02a4016af8b2394eb07b8075a943afa43
SHA512 a788a62862127fb4129b4d778262c47ed9ae8b2398e6407b4981071645dbc54d26cb8e3abf43c5e11a5d44c987c81be81d151935d319ca315019ed7b855a972f

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Casual.gif

MD5 060960ab8057f7221c04340ac060a00b
SHA1 436b7a5b7bfaa59c7fa6cd9ac7e89858f884200b
SHA256 22eb686f164a4d34d58a547c4ea048202d257530284ab27804ef7fab18fe61cb
SHA512 7b23f994210a10d0c7422e143ec7b14195407096bfd9aff5862f2aae2104cdc38f88bcb1561d09418cf175218f4bb2171f52f8d58828f3bcc9e22c8110e05455

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Country.gif

MD5 5a67fde1664056d4235d4fc1e0de90c7
SHA1 e217bef756d9df9bf04efdf93f314a7082fde99d
SHA256 97a2f3a71b9a76db1ed2dfd67e1fd1e44f127af931b39b01f39f58efbf865bc4
SHA512 214ba9b4fd8c9bd737f74b5d122b907094fca998cfacd3f8705c6fa8a1c8f3b547fdd8c1ce2b69f4c6c35dda724a4e9ce8d1c7fe2f67f7ea2405a3f2867972c6

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Earthy.gif

MD5 00b19ad9baf8a7e2296ed64b790aab26
SHA1 62ac832423ecad1445f61d313e8c651eebb72a7a
SHA256 b119f63eda0a9817663bf7a06d71994353c21b6888fae940ea763d5daf4a283f
SHA512 0b9dd2109cbec82cde42aca922cde88ef5ebc26cb18ea75e43146b8b35820bc63f18aa538a1dc6cb122db3a1444fcc722249eb4d3c1d4ba39c59b454c2ad4cc0

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Groove.gif

MD5 33aba222d2991962c52acbf5347d1425
SHA1 757eecfc26b5f566917d67a39cadb23b7a353f0d
SHA256 8944d88ffafdc7a440c142bacac0e5f5d6b7e8883f8bc6e461b9ae234d033004
SHA512 6919fcbb6066c574fed8043804ff96c7f9d577a461ddf21c8dc23030deb78149c0b687c6d8758421c8183e635372aabf4fca279224093793d6d9737ab00d416a

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_GreenTea.gif

MD5 d072dbdc4123506370d9170da0c92c3a
SHA1 2680d93fcb50e74b1ca2aa1d18ff978550ab4b8e
SHA256 9dfc92dbc51418f7611928622038532827a065cf2bcaabf46319e9bdb4056888
SHA512 53cd2be21cfc305148701692912ed99dfa4c22aece4804c685554972bbd1c3acdf37344d5701e9d4b48bbf509f37b4ab62c2e65a28044f829db79df3b52aed9c

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_LightSpirit.gif

MD5 1c1412c785b4ab06c6cbd2daa10945d9
SHA1 b2010e09df6a2a180066980a848592b3065816dd
SHA256 afe628b8750a19c7b0d22b320696bcd7862e7ba5ab4b9bbdbefcea1f7ff566a8
SHA512 ce346417c0a17abce013547c687ed409d065bd1bf33d6f24e755835d180df458da4e23314e46bf315a0991b85f240ba745e1c8d352a85ec0784bc8e83531ebcc

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Premium.gif

MD5 6b3198319643dbcd5a5a92e9305eeb1b
SHA1 1f506f6e054cb42653ecaa655951209b0ec50cee
SHA256 b37b91b06d71a5c2e8f6542868aeaa66c04e85fa4963bd4a0d9a6e63094aaa25
SHA512 ad112d761fc72a37f36885098f67c338bea9698c8360f6f9aeb3ca23792566129b07e1fbd8003120888ab329424e129887f984904de3a34f75dcdf540645f232

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_OliveGreen.gif

MD5 b809256234e7607ca4da34baa4a681f4
SHA1 cc4ef798acf969d08555186f68ed1aad71d6dec8
SHA256 e6fb79b5dda0685a54b7b43642065f55f5168dc867706d8b9b7a78b6c0035b4f
SHA512 728bcf3863270257fb6e5b1f1e2f5b67fce63ee885e13d609f90b5cac12adf28141d5f4264bcd8874d6b0f1780ec636f1b3beeb57927a49639413a7ee759aa81

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_SlateBlue.gif

MD5 b21ec8573fb27aa42cc14c8f6223b5ff
SHA1 c69bc910e58a0986867661b202debdbc1fb7cc3a
SHA256 85ac2d81920675141179b6ce813d38c7d1b544336c3244f201f1bfc097d5b15a
SHA512 3c3ebb4023cd706c4cacf09928f57935d2ed4437498ee0e3fffcf98f1913b1cf270301070fbd5a1d3bb512403e2fe46d59b960f5f879fdfd3d1eeb37a9acfa3b

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_TexturedBlue.gif.EnCiPhErEd

MD5 f8a6846032af25fb636503e6a383ac60
SHA1 b0a56a9d348bea000d6698d436f09e67d9df1924
SHA256 b283b786e2501012b4ac416c1ccc088ee19b860cac26bd55f8c43d1b8b4bbc30
SHA512 2b547dc360e4f1bae26b16efd6315f9763fa70ed1ea97bf317b64cc809d7f67c9ad322a0fd7d1941a55126b3723ded8b82812e4e41f4da4a4c0c7fe238a57e9a

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_VelvetRose.gif

MD5 cfbf6a10688a2a64461de215f4aad103
SHA1 f00a0dec9a40b12c10771dd360e18c6a0d0de3a4
SHA256 e2896142127a75b3e7ab74ab31a516b5b89edbce9087e8e512773f0a282cdd5c
SHA512 a84c1b75d450a5be8297b08ae5a6d20353d3e9f41c076782256091dfcd32eca86e8e6c0b830d0c1795c4f9c79ff3e07642db00986175c06c4cb8d9f983c613a8

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BabyBlue\BUTTON.GIF

MD5 e6b1e11e834f6013a8d8ab14ef6018b7
SHA1 29f3efe7d70697c4505702b249f414baebc80768
SHA256 8aad7acc30b18e9f1dc4c3d7fac3936338bf0d51df018dd2ef829f0920b20e20
SHA512 14c5a3e93f975691d655c6946cfa9d16aaa5b73045f84673a671294d06b100bebdb1433210ce266008e823d662d743c981c47f887c4611289c569a980432502c

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\TAB_OFF.GIF

MD5 4420525c46e9de14082ffc8837cbe997
SHA1 2a65fd859f0bf781325681526432f15bab793b5e
SHA256 e61e0451143c4c5e3c9ce88e1ddfcc5c1dc10da9c61f7b162b3912b4732739ef
SHA512 cef6c9805bd2c5d6db033885bb650032acc8dceffdaf49e3a1c56f189920b5aa6aa534891b2ad401e461da27c4532076fd435ac12bf1f53ddbae2c5dd086038c

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\TAB_ON.GIF

MD5 e534c8dea06ce2e4961d32f37848c225
SHA1 6e2ad53b6146b2ad10d6e0ed3703b8ff34657978
SHA256 8a20ac3edc5f947a22d7f1ded97feb213b5d89931502435a3e1721c84253267b
SHA512 53fd9c4ef41ebc23fdab36366029fb4fd18cbd5284f73ab3f13def407b201455cf189dbe673ffdf6cdb9bf29942ea7757596810f2fb27dcba395198c94e39bd2

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\tab_on.gif

MD5 4c0879a2b5bbf838f8777daff056aa4a
SHA1 c6af07dfeee7c69a5d55a28584502f27f5782597
SHA256 5b4bfb2df85e725cd91df739c9a28056c14b3d56947a70202662d8c6c18316c6
SHA512 7beb391947187232d3de91320ec7152ae93e66454ff92398cbc9364d5322c1728140e47e8fc24e42647ab823d7b1fc7925ac7ec64474ba152e4d2379594c7324

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\tab_off.gif

MD5 b8ad0a2db66a48bfa7b17c30df677575
SHA1 9f52ecd1d819cd7a00738ed80fbbe1c651788468
SHA256 2a4f74e2de93c817e94014e95df6cd908e3256d942f43b8b49de968fee9948b7
SHA512 34b1649bbc122266c8cf36d014decee6f74f7d1ebde76b57a0f1c9167e236095a4dea26908bf4bf37d0e0d27aebe72d72e47f20e488a770ee67f6e7a089db124

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrow.jpg

MD5 e64c742909a36269ed00cf80019134fe
SHA1 b21678297a540d30a345176a1d6e3cbe09705663
SHA256 8f177478e172e6449e4779e483372e5ae9b89ef9f5f0f4467409b927f687873d
SHA512 debc33bdfb174e12524a305905a2e0400cc6baacfa3bc72e9b2c1c9a2fd4012fa80ff5792f0a5019b326c1f40bd82b677ffd0ccdb39b54941e05cca15a6ef222

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrowMask.bmp

MD5 3decae9d8f3e91edf4d05bb1b7898231
SHA1 ca0e6c4cfc431d3e0d6e210d069943db812e9911
SHA256 450b02e36b15357c7d3571c289c9955618641e97881ae2cb7c5fcdddf8509392
SHA512 68b080eec7d98e0c0f2916421b4c87402e110d904f8238fc31172da10da94e39bf27219fef5247aad4c035e40048062d1bc65e1d733f0b1ae672c1fc560b2fd3

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\attention.gif

MD5 aad38bfae6c03f793cc5619593e0de82
SHA1 07de20d36a9cf92b20a6c40a3e60bb838a468cb7
SHA256 a7484ef493b2299bd55d43defca5bd1628ba5f8434d22a956af2edaec47c1dd0
SHA512 0614543da9d936034f333a54360aa09ef60a4345ec17bae9fea8c8c2512f9475ccb16a5a323ff06ed48f405b8fd89d5ee15c031cdc8973df197a478997f3ffc8

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_FormsHomePageBlank.gif

MD5 fb96d0b74a037a36de340e6f4e2c45c1
SHA1 847438475e9e12e74da82aed525ecacc2274d662
SHA256 150c535adba1bc04b018517516f74d8032c58a406006b9891c7189de83284273
SHA512 8bb70b8247b691b66296a6dfa4d84a381efd9dbe1652655afe07dc1dcf53c7f7af8e23fa68fa3823bd662dcf99cbab5d00baf554a3b9ee311526dab964b62b73

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BabyBlue\HEADER.GIF

MD5 4e19e524492d9181086fa82d820c60b9
SHA1 e4befc8d034281666b0dcf83cbe516dbca4c4980
SHA256 f7d3994216f35df576674f04ef9def7d159eabe4dbb77a5afe5c74d36ee9ec1e
SHA512 b06284c86240d188d1c690945836a00092af243cc5986184e2e1333323701e95f12fd5d93bf9cb5cfd5350ce27bd553c515730ef0d60072fb666193ee0ea7435

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightOrange\background.gif

MD5 356c3426c6c2ceb530a57b5c274690e6
SHA1 b03271e2d74adfc13116848b06a1b1a7f68b4b7a
SHA256 7dd3c5af0785aa8362d137044f7409e3828a2a009a241a8a22222cde2ea294e0
SHA512 a79df36f36391fdd6762970dff254342eb3e50423da23929609b7fb3aa7547f5740ee45ab0819393ca3feb444acb6abc8a7d4fa03f61a85d443c10f3351c89e5

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightYellow\HEADER.GIF

MD5 5a290d21d80297ebc63e79a450ecffff
SHA1 e4fa9b1b5be1604d076a357c1231407dcd597b89
SHA256 4ed5ed0061040540349776ebdcb34e75f8ef558e3c3b130b4524c3b83c00ec05
SHA512 a00002b5665b16c3cddf0927dc0d9994b76454ba689838cbc71d5d12db122b535fd9692c2129318d3f6edc63187ffa195845d5821df421e221d0be01060c7957

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Desert\HEADER.GIF

MD5 3319304f2722a5ddc67686fa76594735
SHA1 8c5bbc04e1129dc780498790e844c20f56649b3b
SHA256 b04c2f1956868cdcfc6918f56156b6c236bbf3229f4913b5073a3d77ae5c4e9f
SHA512 7eab3ab3a4504ee62e17a775e248885980c90facc5fc23d28fcef490e41062bddae5526e486d4cd0efe430fd2be0e2884b103fc0a124ce052388ef43c1654f79

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\GrayCheck\HEADER.GIF.EnCiPhErEd

MD5 6ec38bc33fee39f2efa72f93ddad3b4c
SHA1 7174b64af8865468f6e58a4c73bbd2105dafdb36
SHA256 eff56592600bbb819164b504a3ed346dac2a332a17f574cca066f562d8db7141
SHA512 ba48b3b2fad6430d39a7a95d2c286dfbd419967febeb2af0542fa8ff0c4577a187b1dcfa8dd3e03d09b07b10b5d6e0dcd627c1d34ea11927d0d7341e8e8c6123

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\TAB_OFF.GIF

MD5 b593ecdfb3070ad7d7e70932259d323f
SHA1 6d1909c8b84927b329b1d6f05345686f18bcc614
SHA256 bd9c8584062ee460a9d5b60f87c913924bcfdb2d61ca667b0468f4c60f4ca22a
SHA512 4183b08798852033172081e98f7f03dd22f8bfbc0fe4dbff66f898554e7efd01ab8d22aae60a5ec0eb4d316d2601d8eab5bad981e584c85c394fad76ac5627eb

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\TAB_ON.GIF

MD5 0736a7dbde68b1f161346a4fa365ae56
SHA1 d582dc542e1c3b81a36da21df5ea1680f3b2ed8e
SHA256 f7ce84b66eaf4d027cdf069ea0418bd5a8a7393a23222d66f936ccfe7b1a264a
SHA512 0a24930bc19ba0876425cd9923b8a67cc22b648d50ba83490f1d4640b9001a31b02f95a28b2140a7beca3d8969b93b89eb2539261fb3e0c5f84b9d1851da3dea

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Oasis\HEADER.GIF

MD5 fedd78d4536fb5583b436c0a74dd8154
SHA1 bfe33db87a8bad67cd5911407bb4fe7cdddba9a1
SHA256 5d1261c04a1b84bafd226435a3e083a1820d488fe4288d4e25594ecab00c0a85
SHA512 9baa5f2cc4cbcda0878b36e2cf3fbb33f693256aa5091a33c86e03d9c84e543ddb028ff5013a8292d86308422d0463b4f91a4a200481e2259bb209e26172f73c

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\TAB_OFF.GIF

MD5 7d85c762837cdcbc741e256895f92284
SHA1 0a165f12be961da7245b7d09c11f4b960f782f2f
SHA256 777100b3fdad02737d82d15fd3641c0df79549d2e71fa7d87a7e1f0c3b3ac107
SHA512 539f99443575e04449bfd938fd31e1228251ba8eedd26166ab1ca32896861b8c063b385acf7c858f2c36bd447ff9fe3ae954b66eb688114ce86482705fbb1fa2

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\TAB_ON.GIF

MD5 b38eb66f27f539097067a517281e7a3a
SHA1 868ea1b4cd3ecaaa04fe38ab063b4ad048b6bcc1
SHA256 66f1281bbad8fb6c60b12b8aa2b4c618618c49e3c69b8eaa0fa92fcd9ce9f2ea
SHA512 7e315abbba2955a7445fc8008ae7352465d65f262494ecc408df6d118c3fce04d3581fcdf864fc183c8e4e5defa765e1c9ea9fd5e94520681c1f8859c5313378

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SoftBlue\background.gif

MD5 d9699d3cf31cd0c9e193bef647922208
SHA1 a75d67c4741b7f8a5782d12ec34b92696d323472
SHA256 97220265324415fcc2d2d29f73e34e99a781964316e50e4d1dbd9bfd5bab6e6c
SHA512 0e6dd97e902da754a3e2425b7cea928075f2a0e56d1b7b1f14d6f8dce89a4d1860bf15b66f1c0caf7d8e1b45e066421ec2ac705eec7254380d9dcb1b195e73a8

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SpringGreen\BUTTON.GIF

MD5 d7e57b5ae1d9d8634dc95472e2efb112
SHA1 eb708e3cd53e9d69aa7fd352a6958c135ce746a6
SHA256 629d0c8fc3e0e99f53a426f3d382b50a0166995253d438edcc8578e7461aed8f
SHA512 f7cdef90893f572d1954200227ab483e9b86e2ad95a8fd736eb4f00df0ee1bf6ba4571aea33835e7eedea56ca9ec621935a55e2bf787782239aa4c499bd13254

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\background.gif

MD5 493e4428d2221e4c8db069d19605716f
SHA1 d84b76e042ee0f1dc482dd94a0ce4118080882b6
SHA256 dcce53dbbff6de0883b18acb525a0054155cedf0ae1854dccfbb3c1e96fd886e
SHA512 df6d320dc3e0cee7bbbcc66ff099628295dc32811da676530915dcbd0412d68a24f500cf2687f51f34cea75025f37a4427e5edcd5f4e42d4f3280f542e04abe4

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl\background.gif

MD5 b208dc907fe0feddc0189bb18fa7c490
SHA1 3e5102a2817c08bba74dace658a289f8f2211c0d
SHA256 b4b0cb85ae4a2912c48590ee00037b3a250260198181b6a4a33f2ec1a23e6e90
SHA512 ad5efcfdcc6f6741ce21ad94b8ef399e7ee6bebf2ed74d9cde1aa505f343cca3fab86b0080e833dff63495842be2352715e7aff3704727404b07a78c6f3aa2f4

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormToolImages.jpg

MD5 76e83ea2a28e5f32ade810deb01c9d94
SHA1 c6f7f25b177f245a2e1defa9954d76aa593247d0
SHA256 0758bc7ce685df20603d16461e34e22ae99777b0767ac119a27c2d9f3f03c99a
SHA512 ab5e62340bfaf0260b4c9b465743a73241eeb2b7b7e24b60a91d438c56c0b4f5ee4b9f7a4a070fdcea1ab7f91e0e6cd3d11f93d9cb8af69affae6fd84193e972

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\RTF_BOLD.GIF

MD5 3a5dbf7ce3572f5c15a90be7a02f58ac
SHA1 2c9c375bb7ec542753062a5e0cdf8977cd06c2bf
SHA256 3624ca524cfe5a04a8a1878a667778bd07b017f700f00779f8d67191ed5752ba
SHA512 ce81f44674d98f0ec52035947dfef8a4e11f7b84568cb76c24528bb6fcf5465ddc95f2ff6ac717c438ae802e8c9cf4009c96eb1388690e33914cf49c59105904

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_choosefont.gif

MD5 5f6f93cfcf359e3d3b12acb55c6ac5c5
SHA1 af41415b74210b156c2a14f616eec99b94d7386e
SHA256 9d5b5a794c08319be6812d5ce60e8e6c2015713cab9cd9c567027a4ce72f0477
SHA512 64bddf746bcb4d09ff2426dd0062f8acc6881e7193b76543b4a78270fba9af2ec447b3c10ead65ed6755e5cfa5436ad2b9b99d07ed85000a28e70baab4d89ec2

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_italic.gif

MD5 2c8aedc82d3d74ff931af840e1ebbb49
SHA1 0986744fa89be236e06d9b9915b9f5e8ac666924
SHA256 b923ca17b8bef67b39c2368b6d9adc3c9ec9bae9311a1b4d8575f5c7c4eab645
SHA512 d6327478ee3231cda89007b1f2cfca7f38e88fc6723028685577843e913f993fdc3a4dbe44f6d5eeebba8d36e903282a7a98ea96c55492120701562dabd886ea

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_underline.gif

MD5 e1bcf8f6c09a36c44ca24720bb00878d
SHA1 c22ab3c3ec44f4ec62c7aad53e3a79976bd6d9d5
SHA256 f93219837106fb181e062e81ccbbad1f7c95e41c58d121033bad600c311f619e
SHA512 f67e4fc5a5444efe27506e81948bca8e8856fce8fada4b80ef2bdf0c421df2b65fbcfa3759c086c32f62cf3202566d13aa2634c0833f328d14d0831f6f5079c6

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\ViewHeaderPreview.jpg

MD5 5d80453b21835e41e00310ed69840974
SHA1 38157a52755db3de04099168a7de585186d3d7b7
SHA256 34522800d0809aba03cf956e87ae88b4d8e45e3ad85a3bbcf57086017bd1ac1c
SHA512 2152235db8867d884a5b6dd865fb743f345444af48527ac74f07e76282dd7711540bbdefc632d76e34a7d752e3f29ee4cb9cea7e445cb443a74f3bc74c6516c8

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\ADD.GIF

MD5 2e8097c68e138bd87cd2e7b4d0879704
SHA1 8669f66b1aa4beadbd9ffef10928701fe5d3d622
SHA256 afae67cd7a5004f7bfa0a6b0f58177db1203673e9a0a1cce87feb5b6f4e289a2
SHA512 37dec804633b32efd4a4deb9f420969409ad2d6f910021dee2c76f22778fbcd621271d76d498c97ba98d691c719fc4bdaa899054e9a3415fd266267528cd65a8

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\CALENDAR.GIF

MD5 1b41ef7e3dd84e6c1d864a970bd0ffa8
SHA1 359e8484b5c6a819de1b114f53ab9491ade54405
SHA256 a90baa17cb894a7f908e4a50691a0b44a473f5968a825726e836669581ebd4d7
SHA512 18214f0f8cf908044a58eabd294204d55a8802981be10f3063d082416ee9f89bc5f223f79187e0385fea255747392b61b917609008e3d4d5305892a165559f34

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\DELETE.GIF

MD5 bb27bd066d95e9405de05dae1117b45a
SHA1 48f78e92f938bb72f19e8b3535a9eb5eb60005ac
SHA256 36bb1323246a87cc285e18596075f45f1da0c1d4f26470cd839995bc650ddbb5
SHA512 3b91cc17c3e6e742f7470cc3fcf1da5f108dc966cad4f66623bd66ba0ddd9ffeed1be735a9f2b727f11223175cd07bc0638daa4f4a68b9356143594c406cd860

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\ERROR.GIF

MD5 e95f4fd143ee46fd5a1d257c91d4208c
SHA1 3027e6ec467b8dfeaf9a82ab37d8dd5c72388643
SHA256 0d18cacee12ac49e345f8392e9b718841effed5cba3469a6558803fc8cf6527d
SHA512 9e00d96184f7cd8530127fd03493be052e41515075a3b90302cfa6695f0b419d1f1167eccd60b38ab666af339e6644e619d6b6aa49a6c9fdaeedfa3e26457cbb

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIconsMask.bmp

MD5 e4850c05956b9a6cd1e393945593b6d4
SHA1 3dbafafb4ef88edfba273ed36e91fa5e0e8d18c5
SHA256 a587c5e4453c7c587d8371a4d992f31c6d38add01cea7c2929509ce511ac717f
SHA512 c7def6d299c3771cf07bd8f81f6d617fd3086805565bf21425de20b85da998bfac62c1573676e0d463bcbaa9daebbce6c04b7d42a96f8583bba1a22c13db83c4

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIcons.jpg

MD5 1fe55de5d96f077b1cdabd43eecdcded
SHA1 b027ff79375e2892432c8cb0cef61791e02b9b14
SHA256 7bc91e49cd894053ad4013767957250d3ee2e440f416e632aa3c4994a542317e
SHA512 26904bd5462f0f12a2275c2ca05221b0e4060eed9aca74150735d08fa8113549320006c428eeb93b49518be1f2ab3a47bcdd4fa6ff793f73082253074b6ffc0c

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\LAUNCH.GIF

MD5 661702b8bd2ebbf8bca970410e67418b
SHA1 9b75615cd8061a0ea54f6fdf0e2a645944609c9b
SHA256 143b2de9ffe32d96e94b49366ea84201aba99ed7044e83aa926aac5f85bea1e8
SHA512 318a24627f0d569858d1dd896b64d7af301af5fd04d1a1f05104d7b5fa4816f084c24308196d1b65f1f7fcfeba3875dd181a9bab9fd3f1f3904912c10f21e82c

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignleft.gif

MD5 a996e5bdfb96f31b37e655618410ea9d
SHA1 ad096b8e47588dcaa906e004aafcda3b498a2e5f
SHA256 53bdcf1c04e65c23ac82a60273508f501a7fa5a7e8f6c1575506b24da2bdd679
SHA512 e3af23aaf17c143c8970aad34f33c778f9b89c0ec6354e16e3fc89a01da85c85c0f74a94a735b82b91da5d7d6d7090d18ff7ea69fc50c4a205d293177a136ddb

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignright.gif

MD5 4f5cd5ea162ba4a59103250b3b52c041
SHA1 45659d967e2b38ad1c8378f2c0fa049211d1d35d
SHA256 2873abac56cd4404a0a604133a0855b3c97f0c5195d276d6b8db9fcbbbe2be30
SHA512 820a9eba908ae12ad97c0b139494e6bec4d86978845a5ce7190d894610b8b77610b96fdbb0d691754315fff61e86fcc44d2b11d4393ae9aaf11e53d90efcb77d

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_bullets.gif

MD5 755c39553041d08da2dc3974a5268119
SHA1 28b6145cef9d51d38b50f16ec3334b02e7e5644d
SHA256 faff74be6922f403ff88d8b3c9a536bc14c3cb9be2c477588ef2b24adb25adbc
SHA512 1b1fff2d9a15fef9c20b075472915d9ae86afa9328040e8a23e840a571eb09d8885ffe02a129cc47e64a0222b2ae769e56d8fef3a86788fc7f9db7b57c4b55bd

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_center.gif

MD5 6c1dc396d6d4317ca66309f28d8636df
SHA1 81b4cda515a44c95136b0e78d71696f22b7ade44
SHA256 0775c3ae5af84564b293cfb0534779f77b81eaf544335ad07d8a817ea13857d7
SHA512 2889b2bd64bc8fa003afdd5a488a084174c9f4166b70b5ef77ebdbb3a85ea29d034186a991dc97c8cab222bd70fcd045a9f417a5daeb98fe57b13f8156772376

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_decreaseindent.gif

MD5 31207d5404bb3efa607dc2b51e25eba6
SHA1 30e1493e85c5e5fd660c68c01621033492913d59
SHA256 334e66fda13057a60bad729a91c4f0d39b8f22b6a738edd9849440669b869437
SHA512 a05740d823598fed252a8b6e8ce16ed25511451eb3dd4085758f8a9c8c006906bc62d424933aa4e54415885686d45f690a17a3b7133dca72ea5200a02bed54a2

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_increaseindent.gif

MD5 8aa9bbfab0aef733f5f6497043770d43
SHA1 e36dfd5766e7fdefa5b34689c61f4931d00dbb8b
SHA256 cccd7160b552227a84707172b750b74a21ecc844abf0291ba67279399978eb7d
SHA512 466bf7a7c9b33cca2b8a30a284d71a44f6b3aa243a118594bb7bf3d3fb47980034e949e14ca5df832329763e5a80eeab10eb2693ee7bf3999b08f399277be60c

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_justify.gif

MD5 762b99f040f30af0b5af64b7e3550319
SHA1 bd7d2c5ad58ec0d637ddf4a88b2f2ebd9345b007
SHA256 5858504cda8cfcd1292baf9a28009851511634d98b76de88110feea111ebac63
SHA512 54a6be46c474ad5ea13668563071ac7ec50ef4f98a30e5a4a05d459b400596a29191d3deb84cf7ba084f0c3ea3180554a35f1dc61901d4fc83d4130f7d85333d

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_pressed.gif

MD5 0dcf90c4f44a1edf223a63188d17174e
SHA1 50c2dd77409f57c546d01543e8bcb8a9110bac22
SHA256 36143d73fa79268c82f36aa53a3134563df3ff8140342ac5aa33bf133b9031d3
SHA512 c7080f4a8dadcee0c7507113ff1babf5ea657a1adf71951a4dbd79459d2ab473096f40284f9bb6fb0cf52d53a9fdde0b13e5463c16696d266b6d535b7de9b657

C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Windows Explorer.lnk

MD5 5cc56c81d67fe543aff8a438d53d118f
SHA1 408eed2fb494d876f091855e920559ad6a8ff6a5
SHA256 a1c21a4b4a46d6f532b408c3ae87678386675321a8c9031cdaebcd4b3860f88f
SHA512 e6776c251fa852bdc14389e7a7acda24b28d5490722fc030b2bf819eddb1f44ccdc9e8cae080d7320781488b25dd4a1db4fe8da46f070bd398d6960db1d75300

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\alert_lrg.gif

MD5 728a877bc0e0dab33ad7a53dd390f3ae
SHA1 a52634b80fb864a8c2b9976339b48b14cc6e496f
SHA256 96b486df3e3a20f03413bf19127ee30f9318c667fc0e37744e6dfaff9eed8fc0
SHA512 c928d114bd3b552197413a211a29c9c5b4fe559e395e19921dacb73802a812c4776c98751bbe015635a92882841053397abdf45106abaa32a4467c10e2ab0dd8

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\branding_Full2.gif

MD5 80c8a00e9a20e65d667f438ff3e2265b
SHA1 c2673cc25a79a31748b11d0c23cfc5102ee5bd80
SHA256 47e38060940b64686464091d68a69e89273f0c02b8a3aba9b6c16286704ad8b6
SHA512 602ab1e665209e05cca352403745b1e77b6eb1351daebb98db62a9b56c81f9a387c1886c7d99335d2f733b64663171678cef80909701fd9c5cbe77cfddadf451

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg

MD5 64a17e4677a11daf682876bab435f60c
SHA1 eb4319b6ff9dc50a02f1f18eadbc42cbfcbfb030
SHA256 626458ccab34b338a130152e1bfb49a4dcb775c44eb2993228ae7b5cc25d7879
SHA512 bf0dad5c9754b2299d831741e8458a04189f7437cd97e007df311246c065b93f7594058a9d2844a9ead4b9f0b5f036a39aae8c02f6aeecde8ba913735f4de668

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\aspx_file.gif

MD5 06628a9043b71f0c8223e79441199dbc
SHA1 c3c325a2dcdc1f347f1cbc851f225ae0565eafc7
SHA256 3d6d3c6701e638291aadc809ae0818395a679d9b1ecf69ed8139cea170973504
SHA512 bdb39bb9ec7e6993af00757bc0297e8a24376fd610f207c4765e4fd7a7a6cc6dfca73067587c9260d9915783d68f5e2145a5fda265bca30012bf8c0a3fd1b29a

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg

MD5 10a6a5e7200f30919d71a050b67562bb
SHA1 09126bf0836f86afdaefcf66483587a59e8197a8
SHA256 6bedbcb06f00ba762cf6bad561230f861ede6c5cb3a9a06d926911f581c35a1f
SHA512 af54227d119395fcd3c766e266f37b292c7a985500e11fc90a60ea5746762d99bbb749aedb0aebe4eac01a4c1575b0e3b0ebdc394c0caec9ef0bc9ea334b0fb6

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\help.jpg

MD5 6518e1d11419ae837dc954f10c0edd95
SHA1 e127d480a466a27d8a049663c126205c2de21be2
SHA256 dfd90058d7b750d7e009785bbbf4f8e89339b3140ebac1c87557609f45e11dc3
SHA512 490c629c5533a9aac192ade552787e2df9c4bd354d7cdbf6df999d1b667aeb7f0a35393ef344ac501146e293a51cd366d291d81418ef3b7bdec4c7df106a05ff

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\headerGRADIENT_Tall.gif

MD5 c12d2e4f40b88096c4758be33ac64e1c
SHA1 a26d37b2483286cce7dbb9de53ee62fd26c9b60b
SHA256 980d2d49f1ac8fdab75280d7544a2e1abd35dbdfeb0f36f2b81fc47a846a4951
SHA512 a46e2052e7db86bad8c5851018c501ef28a673385d02d3a561fa5b6e2da7cb122501d07e3c94e1ea95021f2734b24ab630bfac77854457008d6812198fe058e6

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\gradient_onWhite.gif

MD5 d608c80ceafcd95ee0ad5bdc9e642ee5
SHA1 ef5f9fc42fcff6926116860f2f1ba5b93d0cc49c
SHA256 fe445fc9fab544110468fb0e7e559cf7f2433ef272b55a1c6fed13a46040e1bd
SHA512 4c363f83be59249c096a79fe95ed18bf5763619f0e915a80194684b7a8a1f57bf10d4d1708f39707e66cc63204d94c279bb24b703a7a06a6e0ac8ad6bbe45cf0

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\gradient_onBlue.gif

MD5 e0898a5539776a45c76b0b57e2e0a0b9
SHA1 f14f44ed15f43cc34593aa1dfe7295a7ce827cec
SHA256 f9c3b343e309b313297b17040d06f6ebc13d41b756d26f3f3eca8510994a95d9
SHA512 8c08a58e6f96e1be515a414002a16f48b51cddd62b8d37568812c9bb2d37b5032c0c6b25b19cfa67f5c5b6438aa5dbd601ff9ee4e4997575446be27b8e43a436

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\folder.gif

MD5 03092a426842ee9e3d196d1b74596966
SHA1 e879f6639a1bce1e2290e28900d7d8af8bd9305b
SHA256 8bf67ca7df0a534f3d0b789987c15982d8d145f9ac84490e06498cd67f95e67b
SHA512 8a898052838b78beceee239cd368e00bc9cdfb3efe7e316618ee3990b3a84f319af69c0ef8b3d147a446b964aa7565681a8124a8398243c44918fb7493837e80

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\deselectedTab_1x1.gif

MD5 f27d7642e7baa968d3eeb206cdd0db76
SHA1 e68d462b2d4ed1c4f2481ad02a8470c9e449c56c
SHA256 8b757b53eaccbf645d159b056fccfd440f2380f7795436e0129d546bc3c4ff2b
SHA512 9d26a1c19ebe50bda2a2f51b78f6670570a6186f2d58d0f7ddafa1bed851c82647c6d34e2866e25b4d08691ce12abdcfe8dc0f60bdedfa8f370a524d8fa25291

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\unSelectedTab_rightCorner.gif

MD5 ff6e5a956f62387c3d0880cb5ab779e0
SHA1 1489841af8f734caffd092387c14cc75b7b36558
SHA256 81edad4e48febca40de66e451bb3506a524c09e2b6fedbb03704a2ded1b7188b
SHA512 c53fdc85ec540cf9f4e3e20ea1c5c19a2a5801f33fffd5e66e9910d4d250f28680bcd77dac684d822b4fe5a03bf000797745aeab23aab9313a77b70ee0eafd38

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\yellowCORNER.gif

MD5 b101dbc14d0476d9191ae64dfaad86e3
SHA1 8002768ad413083aceab39070c49c20f4fb7079f
SHA256 4bfe7a54c943837970bcb499d1d3f798253cb528b89b43483a0058157cf37215
SHA512 35f40e63457388bd144961c83bfc59b40c66530136c05260a4c822d05fe79cb06dd8932ef582dabdff93f998810bd06e99f1a9b58746a8c117a068238f4fa259

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\unSelectedTab_leftCorner.gif

MD5 09ed5362331faa56504a91f31257810e
SHA1 ceb5d57752995307ba490fc6d29ae539c93ed603
SHA256 74303390f4f247f14f7ae4f45ecf0d80ab30be3bbbac07ee01b515f22f01fce3
SHA512 3a8e0b22ae9ef43578e87b873f306fa83d7f5c6a92222e6b41fc9e75ddf195b952b6e26ee65e5b097344fda2dfbbe6a51d8d36aa1bcb582cda38b307a9352b89

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg

MD5 4f9d63e49b5f4a1f0ef366d942df50cb
SHA1 b17887011dec1aefdb08fafb57831523e5e79384
SHA256 ee18edb2bbc106838e4a3b1e26240a7cc0ac14e0ea6b901c4fe7da4a1ad444d0
SHA512 2e16e3bfc67eb99b1435c5503de10561c87ac15f51d8b9b3eeff7368c8b2431c3c0086da49d00500dfa638bca843a06cf9e22960be1e8e2e16d7da70714f1e93

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\selectedTab_rightCorner.gif

MD5 25eb9e798f42da709c61b7c05c221059
SHA1 8188fd960cbe5bdc25814d2dd8bafc1eb453f3b3
SHA256 474b695a3b249f47d27e9476adcfb2441bbc1fb8e589c4752fa3f2c2a0151792
SHA512 9318bebd0ee55fee5992a42445596c3e04d19a7a97d4aff92eecbdcc8a51a40d57bd7b6deae7778dfbe6db6c08b709d32b4b9f3a14d492c905229fa92461d4cf

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\selectedTab_leftCorner.gif

MD5 f6620f62722b20fca3cb6a922f5fbab5
SHA1 3c0aa2a32268d80880f68a89efc88eacbe65dfcc
SHA256 656c5a7cf9c06f80135e04422dde55b731be6a7914dfa0a1e63e9d07da2cabb3
SHA512 ad1d4fedee12ed92361c3a4cdb891cdc51c0026018bd9bd6eddd083f318307522846c6bac9e73769c390b9c50bb8513fee59fc2421e9ca4420c2f53172f0fee0

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\requiredBang.gif

MD5 2ae2ca819d90bfe1d4fdfb4dca7c8278
SHA1 80c7d721c784605e2b0f25f6bfa0c8e3b1873fa7
SHA256 e2dfbe2587e7cf3db39a5605e8995413e1a9bf32cd86d367bbaaed9b4cd2487d
SHA512 6aee7695875a4e4880965b3ce5e5ddf17ac81070be58b91364344a4bbdc56ee4ee5fb13af56b0c95444be58138c7f5aa8f4cdb97f2d277b2ac13ae0071a0323c

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\image2.gif

MD5 ef382c75f8375be0b022c39c7a3e6833
SHA1 96782f71324a65c05d0104b15a0253437f1a514b
SHA256 47b1dbdcb542dda5d441a7bda72bbba53f2a8c92916d6aa1373ddfc01be6928e
SHA512 f0302c46f736fd294737faabfd9f0cfc5a94cb36370824a73c63b08146892dcaabd9bb6b6231f7fd8f9ae6edadebae507fd34148bab94998c4e9971532789e07

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\image1.gif

MD5 201267ab2fc0eb112e47835b0c00c2b1
SHA1 b1594fba5859fcd5ce9c2db95053531258f6dff3
SHA256 9b706fa69bd03fbffe76005d514d7fe8f6135bb4b9f1fabc382b54a49b947acb
SHA512 d7059606acec0c1aaad4e3dae5496fd3ffb79469cc71c2f0d9a409098dcfb6aed04926a0f74df9f6aa422858ccc3b097f1ef5e75c854b4f3cf5eef49e3b7714a

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\HelpIcon_solid.gif

MD5 2456e8cc81424ad20c7583abd7ebcf3d
SHA1 66984f2c3b3d6b83b3321964562a5503039af80c
SHA256 aba18b205c1ee14d9fc1516b1f7c37899b0b22636f472b76c8b133a5d883e5cc
SHA512 5b87f2166a188437f9609bf5cc02a5e7935f97b0488726f944401b7c3565b7765551f66a207e233a182ebf64418bf765229a16314e0b72481cd93e29f79f6161

Analysis: behavioral2

Detonation Overview

Submitted

2024-12-07 09:47

Reported

2024-12-07 09:50

Platform

win10v2004-20241007-en

Max time kernel

95s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe"

Signatures

Renames multiple (2184) files with added filename extension

ransomware

Drops file in Drivers directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\drivers\ja-JP\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\drivers\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\drivers\de-DE\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\drivers\es-ES\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\drivers\fr-FR\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\drivers\it-IT\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\drivers\en-US\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\drivers\gmreadme.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\drivers\uk-UA\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\20h0qrWAF1yJNAB.exe" C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\System32\DriverStore\FileRepository\mdmdp2.inf_amd64_6550f790ed88c7ba\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmtdkj5.inf_amd64_6f327fe9ac4fdb28\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\rndiscmp.inf_amd64_81bff1eb756435c6\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_LogResource\fr-FR\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\ja-JP\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\cpu.inf_amd64_0abeab1ee6572232\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\c_computer.inf_amd64_aa72c8894a821b32\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\c_extension.inf_amd64_7891c7d003f5e96b\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\prnms012.inf_amd64_707d3849370b9d23\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\prnms013.inf_amd64_2b1aa5c0f193f278\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\usbport.inf_amd64_254cd5ae09de6b08\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\migration\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\MUI\0409\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\Configuration\Schema\MSFT_FileDirectoryConfiguration\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AssignedAccess\de-DE\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\Dism\fr-FR\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\amdi2c.inf_amd64_d7ae71f8eb52c084\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmatm2k.inf_amd64_de71647ec29a6bc2\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmgl004.inf_amd64_189d0189716edeb1\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\rawsilo.inf_amd64_1cbfddc97a663ba6\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\ServiceSet\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\WebDownloadManager\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\Configuration\Schema\MSFT_FileDirectoryConfiguration\ja-JP\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmzyxlg.inf_amd64_c5ee07feb8dae038\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\nettcpip.inf_amd64_96215b82eaa40fd5\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\prnms006.inf_amd64_c3bdcb6fc975b614\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\c_fsinfrastructure.inf_amd64_1ef682cfd6fc7d1c\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\wsdprint.inf_amd64_b616bed30e8928ca\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\fr\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\DriverStore\de-DE\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmar1.inf_amd64_b2ebe9229789b181\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetQos\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ProcessResource\es-ES\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\hdaudio.inf_amd64_fe5b23ea7991a359\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\c_fsvirtualization.inf_amd64_078671a0cdfe2870\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmtdkj7.inf_amd64_161e1375bcff85d9\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\netbvbda.inf_amd64_06bc8afcd2617abf\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\ntprint.inf_amd64_c62e9f8067f98247\Amd64\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_amd64_144351277838b429\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\MUI\0C0A\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\spp\tokens\pkeyconfig\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\c_fshsm.inf_amd64_48c6ccb73844d3bb\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\InputMethod\JPN\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\pci.inf_amd64_66614bed5c0a20d8\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\hal.inf_amd64_fd0ae947345ac7bf\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmtdk.inf_amd64_9e49da794995b361\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\netpacer.inf_amd64_7d294c7fa012d315\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\netxex64.inf_amd64_ede00b448bfe8099\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\prnms014.inf_amd64_faec3fc366f8e1fa\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\MsDtc\es\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\ehstortcgdrv.inf_amd64_5cb0c23f45dac01c\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\Com\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\bthlcpen.inf_amd64_a2917ed464cbbc93\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\hpsamd.inf_amd64_0784fd3ef0d7ec93\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Examples\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\@AudioToastIcon.png C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\megasas.inf_amd64_289e18fb610dd883\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\perceptionsimulationsixdof.inf_amd64_3ff016f4df6d2b8a\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\it-IT\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_RoleResource\es-ES\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmpsion.inf_amd64_28542b9aafacda15\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_UserResource\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Schemas\PSMaml\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\prnms005.inf_amd64_add71423ba73e797\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\oadggilooaddfiad.bmp" C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\ScreenSketchWide310x150Logo.scale-100_contrast-black.png C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\LargeTile.scale-125_contrast-black.png C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Thumbnails\Sticker_Icon_PigEar.png C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\LinkedInboxWideTile.scale-400.png C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\cs-cz\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\GRPHFLT\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-96_contrast-white.png C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ru-ru\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\server_ok.gif C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\sv-se\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\dtplugin\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\SmallTile.scale-100_contrast-white.png C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-60.png C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\CardUIBkg.scale-150.png C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarAppList.targetsize-60_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\zh-tw\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\AXIS\THMBNAIL.PNG C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-30_contrast-black.png C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\WideTile.scale-150.png C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\vi\LC_MESSAGES\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\contrast-black\MicrosoftLogo.png C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\tr-tr\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-60.png C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-16_altform-lightunplated.png C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailWideTile.scale-150.png C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ro-ro\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_US\Added.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\ro-RO\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\CalculatorMedTile.contrast-black_scale-100.png C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-256_contrast-white.png C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME-JAVAFX.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Thumbnails\Sticker_Icon_Sunglasses.png C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\osf\moe_status_icons.png C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-48_contrast-black.png C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\tr-tr\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\deploy\[email protected] C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\AugLoop\third-party-notices.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\TimerLargeTile.contrast-black_scale-100.png C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarSplashLogo.scale-100.png C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\EmptyView-Dark.scale-150.png C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-white_targetsize-16.png C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\nb.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Work\contrast-white\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\es-MX\View3d\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailAppList.targetsize-30_altform-lightunplated.png C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\RTL\contrast-black\MedTile.scale-100.png C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\ru-ru\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-24_contrast-white.png C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\AppPackageSmallTile.scale-150.png C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Dial\Opacity.png C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailSplashLogo.scale-125.png C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\en-ae\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\fr-fr\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Program Files\Windows NT\Accessories\fr-FR\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageAppList.scale-100_contrast-white.png C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Square44x44Logo.targetsize-16.png C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchStoreLogo.scale-200_contrast-white.png C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.contrast-white_targetsize-24.png C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Program Files\Windows Photo Viewer\de-DE\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\LiveTile\W0.png C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\pris\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_kdnic.inf.resources_31bf3856ad364e35_10.0.19041.1_it-it_f6e47ebd97310e42\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-n..quickstart.appxmain_31bf3856ad364e35_10.0.19041.1_none_4a388618f6365227\NarratorUWPSquare44x44Logo.scale-400.png C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_multipoint-wms.eventlogmsg.resources_31bf3856ad364e35_10.0.19041.1_es-es_c93c280113f48e62\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-c..lter-mime.resources_31bf3856ad364e35_7.0.19041.1_en-us_6987bb3917153259\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_d1f435fdf91e63d5\http_500.htm C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-refs_31bf3856ad364e35_10.0.19041.1266_none_1b3c5422d217d4a9\f\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_smrvolume.inf.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_20c03dba2fdc67ac\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-s..ngerprintcredential_31bf3856ad364e35_10.0.19041.1081_none_1acc3ea302a542af\r\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-enhancedstorage-api_31bf3856ad364e35_10.0.19041.746_none_b32819b66e95bdf3\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.19041.964_lt-lt_ce47d201c53c798b\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-ahcache_31bf3856ad364e35_10.0.19041.928_none_11616d60b8a0cb9a\r\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_88e266cb2fac7c0d\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft.windows.h..pedrive-driverclass_31bf3856ad364e35_10.0.19041.1_none_481addfb5cac00db\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_security-octagon-enclave_31bf3856ad364e35_10.0.19041.153_none_2f115aecc2351c2b\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_windows-application..ardserver.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_52167fbdea8017f2\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_wpf-reachframework_31bf3856ad364e35_10.0.19200.101_none_2be23204f0dbc355\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-w..ows-web-diagnostics_31bf3856ad364e35_10.0.19041.746_none_db2530a245901d66\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-errorreportingui_31bf3856ad364e35_10.0.19041.264_none_ac46cb7f60f8a602\r\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-oobe-policies_31bf3856ad364e35_10.0.19041.1_none_6747b7a3667513bf\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ns-platform-library_31bf3856ad364e35_10.0.19041.844_none_648bdd4ee187c820\r\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\IME\IMEJP\help\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-i..-optional.resources_31bf3856ad364e35_11.0.19041.1_uk-ua_a64ea9441dc59b4c\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-o..re-security-webauth_31bf3856ad364e35_10.0.19041.264_none_35bf65fd1268e64b\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-web-app-host_31bf3856ad364e35_10.0.19041.789_none_1ab57d24625888e6\f\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-s..erclasses.resources_31bf3856ad364e35_10.0.19041.1_en-us_aca9a2feddb3667f\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-t..vices-configbackend_31bf3856ad364e35_10.0.19041.746_none_bee2ecb684c7fdfd\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SystemApps\microsoft.windows.narratorquickstart_8wekyb3d8bbwe\assets\NarratorUWPSquare44x44Logo.targetsize-48_altform-unplated_contrast-black.png C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-appresolverux.appxmain_31bf3856ad364e35_10.0.19041.1_none_b719750f25d4cc37\SquareTile150x150.scale-100.png C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_10.0.19041.1_none_27faaee495997877\branding_Full2.gif C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_product-onecore__dual_c_sensor.inf_31bf3856ad364e35_10.0.19041.1_none_c6c2a6d63bfd1fd2\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\x86_microsoft-windows-ie-controls.resources_31bf3856ad364e35_11.0.19041.1_fr-fr_de2fd7a0fcb62ecf\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.Entity.resources\v4.0_4.0.0.0_fr_b77a5c561934e089\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SystemApps\Microsoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy\Assets\Square44x44Logo.contrast-white_scale-200.png C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_netrtwlane01.inf.resources_31bf3856ad364e35_10.0.19041.1_es-es_5dcfa29abb99d37e\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility.Resources\1.0.0.0_ja_31bf3856ad364e35\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\TaskScheduler.Resources\v4.0_10.0.0.0_de_31bf3856ad364e35\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-n..quickstart.appxmain_31bf3856ad364e35_10.0.19041.1_none_4a388618f6365227\NarratorUWPSquare44x44Logo.scale-100_contrast-white.png C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-network-setup_31bf3856ad364e35_10.0.19041.546_none_85daa5cc47312f83\f\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-onecore-inputhost_31bf3856ad364e35_10.0.19041.906_none_85591a36bd9d4cc6\f\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_hyperv-vmemulateddevices.resources_31bf3856ad364e35_10.0.19041.1_it-it_fec29a5a647fcdac\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-mapcontrol_31bf3856ad364e35_10.0.19041.1202_none_881548dfbfc9556a\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-powershell-sip_31bf3856ad364e35_10.0.19041.1_none_1e5fae61a2104eff\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_wsdapi_31bf3856ad364e35_10.0.19041.746_none_9cacd79fac25e4e2\r\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\msil_system.serviceprocess.resources_b03f5f7f11d50a3a_10.0.19041.1_ja-jp_dbebe761a1ca0ae8\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.resources\v4.0_4.0.0.0_es_b03f5f7f11d50a3a\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-a..managerui.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_2928b4fb71c9c50c\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft.windows.winhttpcom_31bf3856ad364e35_5.1.19041.1151_none_90fbce7e9cbb300b\f\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-htmlhelp_31bf3856ad364e35_10.0.19041.746_none_b0a3ebd117ec81d4\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\diagnostics\system\WindowsMediaPlayerConfiguration\en-US\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-mssign32-dll.resources_31bf3856ad364e35_10.0.19041.1_en-us_73e85422933e8c6d\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-security-ngc-recovery_31bf3856ad364e35_10.0.19041.1202_none_08671dec41b43968\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.19041.264_none_8bd2f5fc0c992e06\r\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\Microsoft.NET\Framework\v3.5\3082\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-msconfig-exe.resources_31bf3856ad364e35_10.0.19041.1_es-es_2ddce787f20ccde6\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-s..r-service.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_a26b530d64eec39c\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-ehome-tvratings_31bf3856ad364e35_10.0.19041.746_none_018bd87238d2bd7e\r\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_sisraid4.inf.resources_31bf3856ad364e35_10.0.19041.1_de-de_53c7a4ea411a31ac\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_dual_iastorav.inf_31bf3856ad364e35_10.0.19041.1_none_58e8bdd69f5f0192\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-c..ement-wmi.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_97abc80a0d55485a\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-rasdlg_31bf3856ad364e35_10.0.19041.264_none_4af4dcf0ae8245e7\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-t..cesframework-msctfp_31bf3856ad364e35_10.0.19041.610_none_a8f1165b4dada058\f\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_dual_net819xp.inf_31bf3856ad364e35_10.0.19041.1_none_1aa025fd91929f24\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-i...appxmain.resources_31bf3856ad364e35_10.0.19041.1266_en-us_532c1727b299ece8\r\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VNTEIYXIWDWJPFL C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VNTEIYXIWDWJPFL\shell\open\command C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VNTEIYXIWDWJPFL\shell C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VNTEIYXIWDWJPFL\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\20h0qrWAF1yJNAB.exe" C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VNTEIYXIWDWJPFL\ = "CRYPTED!" C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VNTEIYXIWDWJPFL\DefaultIcon C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VNTEIYXIWDWJPFL\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\20h0qrWAF1yJNAB.exe,0" C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\VNTEIYXIWDWJPFL\shell\open C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd\ = "VNTEIYXIWDWJPFL" C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\d1cfc7d645f1480a458deab931d69c9b_JaffaCakes118.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 85.49.80.91.in-addr.arpa udp
US 8.8.8.8:53 20.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 134.130.81.91.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp

Files

C:\Program Files\7-Zip\Lang\HOW TO DECRYPT FILES.txt

MD5 b2890cf3bd97aac347746072c7028e97
SHA1 9a4c919126522232477ddf93e487dfc1b51ba5ee
SHA256 460c888926b71d1f00952860ccf79815d24a8d45597206bb31c4f5bdb8bcab63
SHA512 655857fbf4091f7a610edf1bed2733398cb100767f1fbd2ca163c8b145233217c939083389cc651c5706eb86beda310282ca05c3bb44a2b26fe2d6f90f39ad80

C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif

MD5 abf131c64a2d252f05d00b5aa36a9dcf
SHA1 e75ed214987bfb40242ee790c883c7bd878dc107
SHA256 f3062f4ef55bf421da943473aacc8ad237556e8af8a5c10646ad65215df0dcdc
SHA512 d9e307e3b5f111f8c3ddac85d0315470b62e5f847cfdaa026cd28af326280aa35c2013340963d97cdc0ebf1b7d3692768b85cdc66d869e371ae7c38c25268fab

C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md

MD5 94633d4a7f5c54ca8c4c80a7cf72d9f5
SHA1 caf48b2a2f956eef54cb665a9b75ac76f74955d1
SHA256 fcc05025bd1f714454d437148ade7b91cd1201ac3632206235d2d638b40cba4c
SHA512 9f774db63fcd26134e7691f4ac0b7bb130990a611bf5e6f5e79379acb85a0bf49f32dd0be42cda8fbb0de8272d2cea68f503637e64fccc0eb40b41f984e0370b

C:\Program Files\Java\jre-1.8\legal\javafx\glib.md

MD5 16717eb5a65478f0b472f0a52282b55b
SHA1 fbeae55d5808cad6dfaad782e57c0b843f1e8f17
SHA256 d7e7ecb6b481d17c592c30eccb2e44f72016b3ae2b1e4fd5439da6294ec03890
SHA512 34bf2d0c2180d4323c01556bd80f81341ca9cd2c83bc34b375f44d245594eab99a30d364d993bfcd607a9a980aad37ad6bbeb411185b87719e1daf99530d1cfa

C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md

MD5 ce18ee24c35898cc6827e359f6d66f57
SHA1 35ca34a2cb2e8940e767ee8164c70f4d9e4d88d8
SHA256 1f6308af428f878595539da9aae936789a9b6fcdc0d2b712edba88692fc3e0e2
SHA512 fce9607b0f5837c0be0955573363c778ec83cfa18ebd862de4e615ae31a21ef55f34baf8966b042b41a732d185fbde5171987c2166598a35f24cbf612c1a509c

C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md

MD5 16f4de1376eef897fd81f41ceeae4262
SHA1 efef17bb07ccfb5feda2ff2d6db061ff6ee62a26
SHA256 cb920ab9f326d06ba8052e68586e52b0fae33dee1eebe7e6b5460b6ae70340d0
SHA512 8c56c49a5743f6617910e8e019d7090384ab95210fd24ff186b6566da372653bd87add153f9a0c9462d203266160db9e2ed01b9e43653ab38655f4f7c37042cf

C:\Program Files\Java\jre-1.8\legal\javafx\public_suffix.md

MD5 a76458de2e6f13975c508db116e310f3
SHA1 10dcd232f283e9975633a665eac5e85aa4b206fe
SHA256 88710bb4791d0476c2f4328c060c63a60437cc41ea5873f943065b407154d37a
SHA512 4165e3a36d70a94ecc621cac13f2be517c273078608980b5611e58627c65e170b92a5fae054bd6dfe9d0ed5c966b21b5be113f3747c6a1dac787aa317ae8afd7

C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md

MD5 2c24a40b1b46b625d8ef276cb953af95
SHA1 fa89f677b7f96bb144b861a050c4f3f2ecefae5e
SHA256 f97da01627d90020ce36129aca0369e90f567c87661df42988de029835780ab9
SHA512 1c98eae885a0d893dbb2ce3f9f497334f9362122965ececdd9f9e6dce7b1b54ec79e1ef1b0f4ee032ce4dd27d3cf760b74d7d4434fd76dacc60f6b40f3e0677c

C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md

MD5 7c375e8a2a24f4fb98f5308e020da15d
SHA1 33b5f52433c8757942e0f25c75918c7542be2f6f
SHA256 1e81bded22e4829fbb04c200519ea1ac0a4e8aa80e8d1c72bda58864c1f26c2f
SHA512 499a49bfd276d6c96c541779ef8a60281348f36c98e81c627874023781ec842b109f84ababfd8eb244788648f308898e054f98238fbfee2c231915f3f3abfd67

C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md

MD5 872e1c2b65d97ed78e12c21a8719344f
SHA1 7b7286bb8c7504f88ba4c266dc08351ff50abb23
SHA256 46c4b7cc9c938838a6aab77256189d60dccd9e9e6012d814e60ef97c32cabd9c
SHA512 344b8aecb4024a62de3d2c4c972ce66e762c2b1a034f16a163786e02b02d73aeb1112cf46e5f67264e306b2f2a886827ba2cfe1d817d3b8eb2a60c89afd11861

C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md

MD5 5f7ee0e9026a1653360344fc688c2a2f
SHA1 1657beec21c6398b52def972aeeb690077487eaf
SHA256 0de71fcbfa45baa3b89eb88c00b190c4fef23cb0cd9236192c4d60c03fc56319
SHA512 db9450fcf3bf0315ae496e2d08226d2b63988f4299c89777704381bbec9acb633ff9f1aff71a19d402ed8319775d9793db189788813c86095fcf86a78416ae80

C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md

MD5 db5ed01279b296fab0b16328ba35f1f5
SHA1 c391c3cfe5c9fce75d8d5678774d8aa56519ae6d
SHA256 37bc3657222a8791e6b70c3d84faeb379921373bca7ed50c94e39b872da8ed38
SHA512 9a0ef97ec458cc978357457b399edd35cc580cea0efe009008e255f016494c7321904b3651697cb689d21a28510b2189918da3897a697c3535647356eeaa25b9

C:\Program Files\Java\jre-1.8\legal\jdk\asm.md

MD5 0b40135b4b1f833fdbe49e08fde053bd
SHA1 df0b1b5430b2109b3f4af8bc16bd670ae796b474
SHA256 448aad79f1a7e174dcecb7aa3be0c7d42a7bdb36a7c79497dca8890b7ee1bd18
SHA512 9fb3067ed33f877588e4036fe13d5bac5ad4fb2bbf8ab8ea22a1dd04c465803baf7fe02b941daafd9575c79063d70a15cbb83c5bcfe0fff7ac2f8fe2a72680d3

C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md

MD5 9744aba4b53f0814d04b7237d8734373
SHA1 8c3a1ef5f3f8ccda154477970960b24d5f8bb2ae
SHA256 ad731ae80fb3e26ae7fcffa4d9aa4b7dab4164724a958ea0fc869076dd336d6c
SHA512 7a6c035f9607a36c9a7742cfe3c80acfecf41b1d97b6eda04395b3386ebbd82884003e8b51b684d1dff49c48bcd198ba3032c7ad402f51e73717a1c7d7b27185

C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md

MD5 075d3b30098ab9777e109f8408c09d06
SHA1 853c8a0d0b8a568a53ce9d946c0bb01e97f174e6
SHA256 7e6aef839c709db1e6f462782dacac0a1a7affd01790cb7f48195fff16f4d6de
SHA512 014897584b359a5f1ea7f75d71b96d496ffda045418fc85a654e280689d838f3aac99b0d3f6e01d246f44d81cfeec14ee39f1895daa37c1fa5abace09a291b88

C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md

MD5 ecba2e1a395f56ec76a0a0a4cd0e3827
SHA1 298e10ec77508e899e694055ccb6da28f7df8988
SHA256 5554fa4b83f972c1fc932ef98cc5db6787c37f735498f2a0a7c72cf5b498d010
SHA512 bf9423aa5b6be41cb830b1af3e924adcbb6a9cd9bf78cff04b3df9ef6a15746cc6aedef3bbd5a33c66e757dff8a2ec5184d941ca14c1b7d2142ff12959e9a6fc

C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md

MD5 e25e104262cbe69f34a2a85535179e02
SHA1 2a49cdf1c299cb81a3f3a2a1919a08580ba90293
SHA256 444930969f87144e8e9cf5c9d8b63a390b43e7bc659a6d29ad978d59070caea5
SHA512 9cf2aa3f3aa6b83e0da2e71c9f898f6ceffbd1dadd1e88b02bfa7a54786e52a555bbba7d245bdcbadf20c53262f0f230013bade45a718f098217d700287478b3

C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md

MD5 6a39deb9305cf5e7cb5cc6b998692375
SHA1 42e1f12611b6fe44cf0f52edf65a8370b6c8f84e
SHA256 55faf5d6067d121f5a30acbbbbee756072d3689a63ae85442b87940d27905d3e
SHA512 9ae073eacbd3de4dbfc8b243018e96535c7a1d0ce5e7f998a23f5921452b5f385cede19d80571b7c079c4cd69648756a79cbd40b042e88019c98483e83d009ab

C:\Program Files\Java\jre-1.8\legal\jdk\dom.md

MD5 054e622f012d803bee79ff4bb45ddbca
SHA1 55e04d64ebf0bfe7433d091b1fba00de0df35a67
SHA256 e11296c0fddfc5241ce225f279687784b9c380a2b7d1f00aa2b5e57063f11374
SHA512 4827d7c2c59d1be266672a20dfc40ffd19070a791f1b0fe5c584d9ae5dd36f88beefa0b22dac79316acc125f1a020146994cd13da08bf6acfcafb7ce10d09b86

C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md

MD5 163c8fbaf76b8c0b007242d183bb5935
SHA1 084ea8e734d19cc100dd0d3171ae355c7838695c
SHA256 31a0c5cc3d04c04431f340f43cbeedf4e4bbbe0fcf8aa4c9b6c23162c8d316bf
SHA512 60be1cccea7fc5f42173974f33cde445e759fbf7e8a93dba7854419afcc4a2184fe653ae87da4cf1273b1a1d047a3bab3efeedb0f2457974570dbf16e0586bb1

C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md

MD5 713273fd7473b83e38d8fdb84320bd9f
SHA1 04816cfb84112e8b0f520a7711773c48c2078b83
SHA256 e48d171ab74d24bc0cbbdf146f44515abc7d5f059788f5b5c19862cc673f289c
SHA512 9ec37eb9a93b7331a64a2c57021241793e033a4c909691c897bc0a516ec7dd6b5aef3402e4ec7b15b0aaee29f850bd519d84cc5622669479e9f86d4f1b94710b

C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md

MD5 645bab50a2c20a8eb95e27ea1a5a5a19
SHA1 2b2a630b37524edacbee156c308af6d1c5b7977d
SHA256 8c65115808f6f6a41d7ad03971ca6a6b360c718d8d76e57f2801b0e2927c611c
SHA512 595814d09556667ee0df32fcdc08115a05c512224bcaacf4b2d2a9c67da4204de739da48715437d074abf503fc15b64a02d6f219ad27a731b297ca4675d8f218

C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md

MD5 a4dcff03073348d305a910f4822c0021
SHA1 4ea981e49c22cef5b845eef74b7509b7a5664894
SHA256 62c224881ccd00b622d72edfb8c34669c3a9e0e2ddde57aaf5127e720db3eb44
SHA512 9297dfcd2e087a0370770765e79dd67a71ec8e23a0169e909ee8ffd78298a38c93c0a11db7b71edfe21455e61d968b3b601e43068eb0bd0d82af381ab2e9421a

C:\Program Files\Java\jre-1.8\legal\jdk\icu.md

MD5 f8b196577aff0d87eedb0d58477f7e5e
SHA1 319735000c26bc208b3024c9b66dee58080063d7
SHA256 0bd7db0178691be8e43d6da299e6a0641127887d93f2dbbd6e17ea13dd6e6595
SHA512 25513b1107e7a5830808977508581631ca5fb0fcf813303e3390f21caf37d8318aee8cfb1d521e1d6ce2437fb1016d85c73201b107e85afa4b7102bf86363e8c

C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md

MD5 bf966e3b991cc1de92603906fc2c09f5
SHA1 6c6f9e4fdc17a7e13dcfdd914f32708c3e89aa6b
SHA256 da24531e470d86ae187ea762626008c41b04ddaebef5d70990b66a2238c6eecd
SHA512 32e4af25c50220a70b1d6fc19ea7c39f97d9e5463d0ac09646784f29b30a77442e53e2fc973a6687b1c5efeda493f78f05024859515a3f82f062f2ab52337ab9

C:\Program Files\Java\jre-1.8\legal\jdk\joni.md

MD5 706e41711fea6b7ed805439384781130
SHA1 75891e06e51602a83d83edab22e1dfaff9edacf3
SHA256 bb6624279c9dc7f7a0ed2e4897dfef652e33108aa1cabc86ac291955008ee1ff
SHA512 7f1e64361355e608b07d3de747f346e536e5eba63ae87ca312765a3b720ecdbf51c3ac090a262d549f5d732b735dd720ef2ea1e40ed98351b5146c6a57396d69

C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md

MD5 1dc6113f3d58f1f2834da10a30256d0b
SHA1 00ef072adcefac1d9663d829e34c6ae1c35867d6
SHA256 d869d014d6813d57ab3e9929e929b4b4fb78a9c05c95481a23b04dcacaab1d09
SHA512 a902fc2566031019ef22c12936659efae8ce3656669b1602b50a3bc6263e8ed072d13cafc71bf81a1467a02a411fb3186b6a24353d4c775d0f5f72c94eee6b13

C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md

MD5 df8f920f5b44ddf1617bc32c043520ae
SHA1 11a3dbf29fb8cb41c7dec4f8b04227ffd3c3e5aa
SHA256 38953af4facab7a9dc21283299cc348aa1c088901718233ed3ba96e6e09e334b
SHA512 b936bc58729e9473bcc465bfb4e449619d1639f647e06722ec7e2876d4557e84f608f57119147e31f1a5ff242b66196034a85cbf4b19110b5d86dfcb2f3edb33

C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md

MD5 17b5d079c7b27d3bf5f6940d3261ae3d
SHA1 e6600eb5302a108b32d146efcd00b5872a7214bb
SHA256 1752b5cdc66ac311449ebd88e49d1c4615082df23e3089de43666f0482ee5ac8
SHA512 1086eeb3b1555df9637ded0096509ce2444cd928f154d5182151c16502a94fa6f4285b86871dfb85781402dfcefecc3902bc03aa1e09378a26afcab9d93da21b

C:\Program Files\Java\jre-1.8\legal\jdk\libpng.md

MD5 5896928bba4086daec598d133e1c822d
SHA1 006a0908f6af556559342d898d90a2cdc02e508c
SHA256 fa8e03a54650dfeaf5d0fe6fc76554c83f1287fb8e6564f01e3a54232735f9f4
SHA512 382ba70f1b9ad34b4b8e546169d0ef913feb70b8ccaa30be93e376a9588823b4bb1f31b37d1d2709d32ea1e46c2e01540aa1e762411f51a55218a5f1958fe1e8

C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md

MD5 cc2df707031d942cd0706cd2056a1988
SHA1 9a6d1ba277a6c8090f0fb222b74ab553beb6fd87
SHA256 6d1104801007eae8d4d2e3d17da9c46322d4e30bf57b70f9c7cdb6dc1e0365c4
SHA512 db853bb5edac54e34e7357d78789e60c7a44c5f4f747fcabd26291b3346d009082098f2abbc8d8333412262b0d18e6551d067a5a784ad843c7d2a8dcb0ff289f

C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md

MD5 2f18788c5ed30f51d66f35375004cef7
SHA1 a062117b8c61330a526a81afde6c5c8e5c1aa84e
SHA256 63c4cd188ffa3c02e76dcc03fa0725042ece6d8598a975f3b41293fca440e8af
SHA512 01b0ec427fea83eac916b6de18b2216c1c6f3b44581215539bcaa2bc58cb61aca11061d03b3a045db939c06efbc2efdc92e15891ce7c392d6f8aee2a5a23ad74

C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md

MD5 057a59f524e81b597e7645f597ecb0a1
SHA1 4b8e4dec0bcb6450a84d36d316cfc1de70924b1c
SHA256 49fdca22bc1f266367ef135a99c842a6c3440e5f0c8b5aabdea08209bd362126
SHA512 a24be0de4ad17485008419b2ee0d9e9894c3aba68165d351d300ce45013ed25b56e4f5586faaa614e1dcb24999a62679207c1a2bdd259e4ba352f75fdcfe72b4

C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md

MD5 518c0525e61a2063ac96248b40dd9be0
SHA1 3bbeced904d767ec2780d3d9f279721e4dd30cb1
SHA256 20294f00c3aeeee2c51db1fad2613299453e1ad8a5e12673f3bb0dbef8c98426
SHA512 d9a78ff27942d96ae14ca406d70071fafd676f68e58856ede62ce600df9c2b9c681082b55fbeaac51e9f10f896e9ff9590df3e21085ce34fb2f9924632eaf78d

C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md

MD5 816030fe9d6cf52a5cc35bb230ffb02d
SHA1 8f778d7a68cbd4ef9bad8e078c89ee66755c194f
SHA256 292fc8d558126e59cf8e600612dabd442d32b601dee5c43ee2919a00c02ea09a
SHA512 0b6756cab0f70905ae9847a6385c8ff48d4360a1583466d1553a4b32eb7e506d87162d8af1d99078b104b2bb259e1369c63ce88f1f433411b8146465e6a71c93

C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md

MD5 1cc743b8857ab7edd1f3215018504475
SHA1 6230afb3639a5a792fcb2d097f7c70150a097165
SHA256 54316ad41a60900b3d076b2d74589d65ef96f45813a8e5962708b06d1e4ff06d
SHA512 bb51f69be3271a74c12f9fb84896835dcb2679ce81372e1543a946fd16458687d84f7cd0e111fed9d9fce745ff823e7c07ff8698e400a7ffd8c2933885ee6846

C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md

MD5 a6255bf09ae11e18ac613255101b6f49
SHA1 0b8fd2be3b78259421902581bd805a6bf6dc3306
SHA256 a0337bd8a97fc296fdca11f7f52dc3763b46fe82cc61835f04f8f4dad4738c27
SHA512 4eddbe10e3219ecdb272eba28919536419af433da8b4dc10ca142cd785994f3ef17a50f8d3fa95a3d31e274160ef9e3d3e5edf4328c33651a158202bac136611

C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md

MD5 295600963d8a9f3d86bce9dd9a83b929
SHA1 ace0f2adaa63ca7131353565230118900ae46a62
SHA256 746097ccba3a32696538226e804b16c3dd17a736c11c1211e0314b1127047801
SHA512 49a361ad7c4a8c6cedb8d20520870e177136d8bb7827b9b1f177bc13c230f8af583e344d2b304d0f37ac741c8089c2e2abcfd38c8a4292bb9d766a05b3489843

C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md

MD5 34c0130b19b8e12abd0c571f1f9ab4d3
SHA1 176c884bd44ecc33168bcce600f6dc052c091f6c
SHA256 c116e06b93e041bcf5b3953a80b58a9edd62e87e4d484a40d99cccc6ab5485a5
SHA512 24329a153cd96b445a879b02d37f558db4e7105806c22a65ed2322c0dbb360b38f5ece42484d1620316e0728d96517386ff8723d4e0c33c7f062d2183cea2ca1

C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md

MD5 c54467c780ae5c3880c88a2dd2656cf8
SHA1 7046fd2c8bf7552c08231b2a770f9c076cdcbb94
SHA256 03813358f50e7b42312b62ef651c81e78b16f4f5746dabefed2ef12f594ca72f
SHA512 bd3d779a1436c9b866753b7b2e57292dc16edbaf8c882d444423b236edbd3b73b84ce61553dc5d3b39f551fbdd59fbee5e05f9b630dea414fab8eecd99242e58

C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md

MD5 93b1625aa15449e060d42086995967c3
SHA1 6a7fc6ec0558d7ee0dff7deff50cc46d267f1e72
SHA256 fb292f61ffb4ce7939cfb79b56aca7290356e6eac114367437a76c32d222d3ac
SHA512 ffef10384a50a40909229625f0ff8fd2271c28fe1cd0fbfab850f34b6ff96aec25e63bd648a5709399ef573e9f5668ebe0046e9bebd789affbef605613ae10b1

C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md

MD5 bc96997ed3a23e06943178c07844e8f4
SHA1 206f15231754348587d4b397276dfae3fa869bd8
SHA256 646584335bdba3fbb6ac8784ee0a4dee874a8cd20ccec9c68acae99e7bd777f9
SHA512 4b67bb0f4a607ce410ac914a6480b0a94de129540ceb255972b5e4b7f938ae23817b84e0ce70851dcc3d130f259b147860222b47d0c7e7b2a7698f1885c6bf96

C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md

MD5 a80715b5623a9b0ea6576dcc51b30bf0
SHA1 a7c49ddb244072b3d2c7d3399772b891636b129f
SHA256 57d3e50d2337a8473c17351cb9612e196f940b68e6d7b0162b0d6682217a0229
SHA512 cb713c065ab5056ed334d8c4d4b2b621d53f6ad1c849e7d4a7f39f4b2afb3abd192f02eff6c9b8e6f3f8244cdcf51fc14a00412d2baa9ecb1d1e055c52d1a6b7

C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt

MD5 27d05a62a36bac8ae02bb602cbc113af
SHA1 3d5d3869e9b7a790b917c857f2d053b758188017
SHA256 f151ded4a929600c9f155f098c9a95252fec3349225c2da6336fcd4487c47a49
SHA512 acdaa219a6fb840c31a968f21f2fd12bcaf963ee0a913b1b4a303e729918d355d705e4f9792e64836ccb951a644c4b9549901fb7be251fc843a9ce1e9f441a4e

C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt

MD5 4cc175fd678dab2e0792f644fcd57fb3
SHA1 6d7a901faf33ece9b0840cef892bb1bfb4757544
SHA256 532cc36434cf77de679068d9a5e66d12f29a59084c66f7431bde9c4eff1b5b9b
SHA512 e7df9a111323f1d5e608163ccc6145779ee2bbc8ab026d5ee612d91f3e7c3b14353f38f4acfab5c93b056363b6568a135396c5fb233207801632f4e51a4ff1ae

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\aic_file_icons.png

MD5 832d445ee294438bf842780496e5eb39
SHA1 05bc28dad0ad8bf7e075db859f0fa57e81e9b784
SHA256 2c161e0ba1b46f7c28f03d0b6ee281201c2e8334538a27cc9de6a347e30200a3
SHA512 b40db4b5479050e665961d2f72f1634c59653d131ecf667740adc9d76ca809105629ce843651318ed8a61f496f8696c6131310b39b4e43647060723c6b3acb24

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions.png

MD5 b6cdc51503f7b149dfa89600ee709054
SHA1 3868b648811e06a32b07e3ddfae21ff1ddca6e50
SHA256 72c1b54c43f7388dbaa7aef2755efecb03ba5ccf2776d824281019f60125b589
SHA512 c10e7cb7300659956aaea13a69b697ca8513e9dac36bd13f9a5d40c8cbb55ee4f09d3f00250a4c7f325f51ed3891577f5b0bb7d804eedf785ee90384a9cd33b0

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions2x.png

MD5 7cc13bc2a94f73b6c457345589956384
SHA1 6f1ab39396018bc8d0fd8c6511ef579026eacc1d
SHA256 f2b7e6baccc66d8c2584785e248d789a5df356e6e5b48eac8368d64b9c7343ec
SHA512 f3b5e4badfa4f7ca57b696b1fcd88347d6b1fed6d045c6a5530e0998bb6ba75a1850fba9d094151a5ce0a7dc6bcb0a4d9f83f3fcd15cc89c8af74d0b4c725ac1

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover_2x.png

MD5 3ea7a2c979f025288767317d61485356
SHA1 f5efb6441f38f23bd586ed188a72ef97efdd18c3
SHA256 f5ae6f210ca677a859014e435bf4443667f660cea29e81c00db749b6cfe089a5
SHA512 9882fa804682c664eb0704dcd57f29fbcbb83b00a38bc29584900bc06a03f0b5491938352bd07e3e81713d5ede5b9a7bf46871a57ef23f4e2d087488007510c8

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png

MD5 8f42985dda56f797c36244364906787a
SHA1 a8829f7847ca7710198c271393ec11eb69005fed
SHA256 b94fe4a7c8fc09e16594736034b66b6eac5cce475c473f5f45ddafa250f457fc
SHA512 53b983df3b15c0ad29edc9989b2a84c302930c209046a48a8c26f0d67df9dfb0ec64b5e8215931c5e4fcc543ef5b912f7ebbcb42d37a989818555dba79a403e3

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png

MD5 3eb84e776af7c263646ef933147a82d7
SHA1 eed99ecbddedfe5b8e9d5c6526eff286f163d311
SHA256 adbb1ca98db548251d386f9b9bc5108554385f9ca29a6589905dbc6d58e19075
SHA512 60b76238530c489236ae79b84d2c36d14a908e94295ad7cae10d084a7ec8773240c54de8ff12112b77adfeaab22b2ae7ed126a2be4debdc57c089cf21cfa8c80

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon.png

MD5 0eeaf1ba0b1539b37a25bfbabfc8c6ea
SHA1 9f5f0c18001bc100b54f2a5cc10f38342364452c
SHA256 0c66a8d9e2082fad599da9404f376a7e5d266078d578937c15037b401aadf6ac
SHA512 ec95ae921bf1845d758b1b0f5a7586ed00638fde572a6caff0523b55e95e26e620a27837d86a6e67083215719d2c83a8e905894652a23872937f317e3bc274e5

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover_2x.png

MD5 c747412e1295122215e0c513a923abfa
SHA1 2893c5cabc8356e4f20ebe026b7f32f55f786d41
SHA256 9c4fcb3bb6a25bb29be34bb68f040bb58a1b2bb17c4fd5fb4da8592c64c1aebd
SHA512 d4f47403ebd6b973d2fe3099da9de350621509d34b0af77d46b44c020a1f8e4725201986fe4f034a6cb8ba1dd86bf9773af0cfe36fd609ce74b95aef59c7d4db

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover.png

MD5 f9a9929a29c99c9f01d1391f46402083
SHA1 63ded065af3703d0f85445bedd6d1b73c3c2abbe
SHA256 0cbcc2634a83eb4855d82e52d81fb42eae1751c3d54a09014422105d74124bd7
SHA512 556a53783b07b5ef2d0254103feb59ddf2c60084413b23eefb3070236b94296174de84884e8b144ee212b2f1741ac5a1c37aa90a2ab69de81991233a17c32518

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_2x.png

MD5 fcce450e563236e5b1d84bc264dbcd57
SHA1 34ebecfde50e513795d2d9c9030dc0ce986ede32
SHA256 bbd98aadd39abf54674b97796ed998f01e607e2d19954d8ec43523e96df0c973
SHA512 f7f7169e7975b669f4048231742628e7582f006ba1b9f067e404c2cccdf2fa6cf8cb6ea4fd00099de10c06b6da6395be1913e8a6358da5f04b9a3050a0c2ac6b

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon.png

MD5 52f923dbfb75405fa66ccde79f3a771d
SHA1 d3e9549721bf183ac3e8ff9a7f899aee0a8bbb07
SHA256 ec31ed6a8733cd5ba7aeed87b02b2a74829b9b32f293c69edae912c641cb95d7
SHA512 aa5c7e4e99c92dedea7c280168690d482c13b1ae1bb263dbfab24f873b26869bc879ca8a488ff033e93d1a590d46be9daba5e196df73bfd9e6fc6b9ddf638def

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons2x.png

MD5 fb835deba00f23766079d795023f9e9f
SHA1 f6aa671d2208eab845f706b36487d4da2d7f20d1
SHA256 d629cc2de85a481f5f1cdc1ba6f0cab364489cd77d7fd1e3f7a5c87c89b9eec6
SHA512 1f722a2679b9cc4f283e3fa4b7145dc63fbb566699ea7cdb6e69f10db4a458a989e86d10c7092ca735caf6c1643f682ccfdefb543327101ec520dd39eb639338

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons.png

MD5 bf1bd1176bfbfc0b3fb0514e432838d3
SHA1 8ce7b41353674b2ed4fd3674388c8ec9634afb24
SHA256 55aab609b7dcd236f20256f956b9b8a376a327540798063af096a79cc8731bfa
SHA512 fcd2a33f2c1049f0f819d4e1265cd7d4c661dbba14a6cfb805e970010349c59b200e8c18c95c56a71522c8ca5ef695604911c3886ef7462171a0c6eb49f9332a

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons.png

MD5 be4f2b5d760869af11a8cf8220349f87
SHA1 0ada7e8e7eaf3de5006685c2f13eb490d608ece7
SHA256 c4976c08568e08854e367eb243c678e57171fd42d42b3e70ecd6d0643dcf53d7
SHA512 0ab29b5a6da124a526e17a336ad6bc1443032daafa095bb4605984f2c8f12b1dc1fcca22a793db7a69a267aae41ef69c13929e97d6148140bced26d963ae4ec6

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_ie8.gif

MD5 169ba4293c4aa97ea4f68cf2ce1e6fe0
SHA1 8c9abd917aa6e309eb026df0ea307b8d9e808a34
SHA256 68830a5fd28608171206e25bff81fbb9c55d1af664fda542eaddbe110b69d941
SHA512 8f025b74700a8f92941492791a4e73e830fb30073ee7e70b44a7375a9f385be0cab96be748b12faa5e33c9bd05044cbae1a5102f761aedd045e164f64f616c23

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons_retina.png

MD5 1023774b43edc165e7630224a5092350
SHA1 83c85e58bfb918af6c5ea649edf640e9ef068275
SHA256 937f4d4de37f1fa145ca5c43b985adc6912b659e70b16d9e7c16e5f978f82147
SHA512 c8e575ac1cb8750460f32e43fe9856b5b0674f0429eb1c7b1585ac72514469866a0232cf59db9d50e798dbe82ca9904e0102a4e10b7f8dd0da6cd9ebe9fa20c8

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons.png

MD5 d8d0e3f34c6a2e3b06e40759eeafb744
SHA1 a469405853adbdbeae63f2eb68679590bfd7ff52
SHA256 84a28c0ff19b2a6d2be402308dba9e27908b9a5eabcf0d7331f4b593a264f63c
SHA512 7bfea3ffd497070db3f2229a2c3e037ca290261c791b951c35423699196f51bed045b07b9451e0bf40d733319ccae4115155344f4fba3ea3f8aec8c9bf1944c9

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_retina.png

MD5 3d946a70dd9dabd8fb91be399ac1664a
SHA1 7b57420cf4d37e876ded6b40b735853383ef8bb9
SHA256 9ef85eb0996648a6ec7a84dc9e64a9008d678c8bf1c0b87befa373dd4ce5c701
SHA512 18f3f5ab3ec3d01f8936d121b53bb6727de4d2353e19e03f64a12970ceaf454c6993e3714dca6b302826b1ca48f1f6f2428c9b3919aee802ca7f1a15137b8244

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_patterns_header.png

MD5 17b1cebff32148a90b3860fd685817f2
SHA1 b240acea360fbdece9374b1d286da571420a5caa
SHA256 042660129ca5ac5fe8b05b67dd8fe06241e1277d68c0ed0ffdedc0df8a3098ec
SHA512 7f6e79ab21023978824f9ef8a3e9eda85d452f974ad7db309770294a69074021a6ded74579ba983cd6b81f2bbee91cc9103bf7093f76605e3a4b20b2d6025b5a

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_pattern_RHP.png

MD5 713e09d06d5ce8c37ff1807e5188ab3a
SHA1 b6ac7415874dc4fff488128ae2461b531d8db59b
SHA256 cd10a6df2eb2d93ad38f1f98c63bdf83a275eeefecb76482501001045c12eead
SHA512 5a565a9a895676e46d9d3d6a8b14647ae87889fba2c5bcf5efa30227752d49eed3fd8643a44a503af5aa3993229212a02b843b3c1b5f9f59531022fd5c19466c

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations.png

MD5 ad52d9dd146592198edeb1cb52954806
SHA1 7cff6dc53ed33a154f09fd1d34c7c545e4c41093
SHA256 51006e5ddfa50597daa72ae36c8175bbb8335126f93b621727c50a252bedac42
SHA512 924532e8590cdce2ca89c283137d3384a3339637ba9d8e3ea52654736d76cbd9342410337e8d3569e7e339d876a4016f2ffcf9dc0ec90490ce8b6b0fabfa6fd0

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations_retina.png

MD5 9a73d91015adfc4973e12209bead9802
SHA1 d93ccfe7aee563a7e78c5b7971d8bb6693cb43f6
SHA256 02529f5b460b7be9375fbf2797358f7c9e105089f2d1924d67c16d8e40921d1c
SHA512 79e5bd85e7a3fb9ad68fb8cac4b86d1d3a1f33da6d4dbbca1debd5434ee547a157710b28f43eb7320402ac08e4b5e61c9744f54453e89bcd4007c81bb7f44e00

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\faf_icons.png

MD5 b8bb053fd4941b3fc3580304a9008b7c
SHA1 20fb828d4d6f4c90aad2eee255d16525fe18e30a
SHA256 4ad10a9e8a3f4c3f324c94be99c0e4c1c17e263ef409360a9ba49a0c5fa2d4b1
SHA512 af1f4347342c48b39d90f36f3b4c7eee0fedfff1f1d133948d52a23ff1f4e84ecbc7b5051b4b59d0a782dbb041dd1e08942c27faf64f58554580aa6870b9ba98

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\bun.png

MD5 d1c5af5c148058f9aa30aac45b1b0f9e
SHA1 947bc7181b3cfea69ae15c865cc4d13a9c54688e
SHA256 310c66d1dba147193dcbda03f0d5f4ae6fbd96e5827a20b91d23a91530395d03
SHA512 cb02d7226c6e63ad0dde88dd3eed4c65bd6ca20d1f61895399b97dbc714ed3b95882a9f7fd09a491b06eaa7a5b258d1c0ca685a6ac725ac0c8029785656fa93c

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview.png

MD5 13d7835019fdc9163b34843adc88bf10
SHA1 1b48cd29750aeded6a37ebb39ae28b0c11bbe430
SHA256 afff5f1a649f81955240ca775e07d04c06adc39889c9b8c3665c2fd3e879554d
SHA512 6afaa19d46d4bd1b1146da0087310ea122e79836440416857e462d141edcbb6408522bac106b9e47dabc47f97021dc5ed2fd7a3edde572f20a815178605e0984

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview2x.png

MD5 dcb94323f99a39c369ff97e3daf1615d
SHA1 35cd90602c179a14acc7816b8af0bf35e252c994
SHA256 0421ab55739f5ce0eeb365833c21ecbb107ea1f67d11d002c8482e3f3f1942c6
SHA512 037f377f4a4703f76083ad7e27dce6ebb38929109700a6ecaa20e021021ad9ce608a3057116aa92d076ef367c3ee14a8f128194430a4360ea30b309795c5f8b7

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small2x.png

MD5 113a6c9cfc717592736e4061a6f81741
SHA1 ba6197771a9ab32ddd99bff844240c62b7ba54ac
SHA256 9a235d67ed230a7bcfdd5473f58de5933a28e4a0ec1fcd2f2824749678e05a4b
SHA512 eee1d1d7b3f6fa70ff76e1c3afd9a8ac1925f61a31ef44b3e451afee2037c0a60fc99acdc6d307e12d9a893501e7805d02f012dfbf1ad1df67f049e37fa367d5

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small.png

MD5 329c20c3622c7ca74dcf27ae0e977d35
SHA1 7f94dba75b989ead672fbcbf8537c3d67c5de6fc
SHA256 da62fc2c06768f1d2496d50e130e8d648fd975012ed278e7215603d2eb3a412e
SHA512 5c5b41e5f4f359140a7674cce5f2bf90318806ecfa5b5bfdefc4adf7297dbdd15f0ec5efea4af866df4213c99e5914080c3792bd5fab91be12936c84bb07111d

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\illustrations.png

MD5 89f9df5b9c27ce1c39defa199a18c7d8
SHA1 838db6ef6744bedf041bc812b52fb294b219e972
SHA256 e693f05cc63fe8a41dfe4c2a4999c5e6bb364cd8ed28ad52a007c007395a2c71
SHA512 d2137aa8ad9f26865d2e46206ad1012ffe05444816261d44981ad3f3298a77577c39bd0eca30cb322ca43156874efbe063758ce4596b031a50f5f31d0e039c4a

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\nub.png

MD5 08233b6e1e8bea69b5c440959392e3bd
SHA1 98fd1dce05d2d4c509fddbd5ce813b83d25dcbe2
SHA256 78a93b2c087205c823ec300e7a8bb069981cd4038fc64517fdabbe35f3b3271a
SHA512 a59a3a88f7b1f5d78f857f74231d91bbe09ee0175620fbdb977d802caa84b3b44825605abd35714bd01b71f5b94f822d16c08dc5dc4ec234aa97f98ec43160ec

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons.png

MD5 7c21ddf0a0e5c4a70cf3cc114a3befb5
SHA1 ed15d74ad536a006ed4339bdbd1ed80d4952fcb2
SHA256 67b7ba959c5161d5e01e3bac3018e9968628edb041785bb4aec1fdce4f1d3047
SHA512 a4fc859bb0db654d98fa3ccbe2fe33e7d0666ac0354e0876018f85c9eec1390a5e06c04d4e4e0ddbbef58ed68696441fbcd4db6013e8340817c83e42f9f55bb1

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons2x.png

MD5 38f35eee00114d29cdc40cd8022dee76
SHA1 e3a3d8b0ece0a68acec3185ceccdd822d953a718
SHA256 cb18404e3078d555656085984922535ab97ad9c2d71ec42074cdb66d7bdbbcd2
SHA512 4706e66470600698d7aaefe111c48dab64663553814eb3be4ec840ef0a76235663d456f7001844465717a3b7e860f2c3f733a23bdbd097d068726a06b74a51af

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adc_logo.png

MD5 422a0525c6d273c6fc92ca26deeb382c
SHA1 cb924ad062d264975a472d1c15774aec87ae1d9f
SHA256 52560c5b394add89bce18cb41f1cb286d854db5f697bc1e09b806308687d3bf0
SHA512 bf483dd49dbefe42c2278b2151dfa5731872b8d6b4ec761d68f8875d08dd0dbd79998f855e0b809fd15f31bfc0b4ef8f1d7efd18c4dfe2f2470a200bb4120fa7

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adobe_spinner.gif

MD5 ca19dad92feb2a96e29db1281b6ef2c0
SHA1 31ff7854e66cbce04ddb58ad7fb4fc5216368a0d
SHA256 7edd8ff1bf564a8b98759b82047561a9718557f5d541e58d8bba75735bd7d551
SHA512 955c0c91c379e9de31382a981e84c14f7a254fe96e8bc69d5ed733068102c434dd63303dcbb475a1d31400f74078ae155d4c81a4c1f9544f77da90e38d6490b0

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\logo_retina.png

MD5 82c3f0dd1e451ac13b531f967f977732
SHA1 4f7fc2ffe69f68ea16be1720b48f460ea8bfa371
SHA256 60fcb7df2c5f9e0aecef2f37f437f4bbdbbc65cb3fa5e409bf820d8f5005e310
SHA512 3da1badfc4a02a1ed484bbfb5d7cb3ac8cffdd3225b8152ed7ad8e54668872411ee2b7079311a0e0e9f2686154fed3aad278e580fbf21e4c78ff57e0bf6cf4d7

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo.png

MD5 26d492bf345b11baa79272a3625bf4ba
SHA1 9d9d47aef106a38acf3b739d54d616722eeea661
SHA256 33305ec0576d874322f2b27a2a7040fb2862774752cc02cf56ae876397c150ca
SHA512 f4a4ca6ddeedb9d01ff6dbf781a9f1072cbdf0cc7cbbbdeca03fc3e1725554fa8905e7ef56ce7a02f849d06951960ff69f4895a1bfbedd3cbc73911884f1084e

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo_2x.png

MD5 a361acfbef1fba2287c54ff52f84765c
SHA1 609281da117d4e90fab036be4a9c80cbe5983148
SHA256 6caebc152f0114cd53c6f5a12e6795d9098ced6274d74ea4d5d70704ccffee2d
SHA512 daf7a2f22e9788e1227ec4e93aea801d5575dbbd2d39eb0d4a83c85bcc1256b99a93a65451bdc4b46f12de0d969be6cdb3b9c368d58011b633eb408a6b1d1d73

C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB_EURO.txt

MD5 9a5468f2ccc799d5a0620837f4317e92
SHA1 c2e23e60c8b18d205da6273d67d48b5377ca634e
SHA256 bc216c51aeb58b50661f4677808d7e94f6aaf884b76975d930c97dc0c87215e7
SHA512 8ebad6edeed809434598e939a4ccd1de63d74c8ccc3458cb65a2649e3a887600996d08da2b668a991a228654a8f2ce23ac95ebe903eff5b54667687087e66f35

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727656525478361.txt

MD5 29b8aeb04b2522bae278b72e3041f5e0
SHA1 77063b991395fc66835a4548868f3a502add1453
SHA256 94709ad139e1db7734c27b778809a3bd873664a506d3833143d2c6d531ac802a
SHA512 c64162d6e58db396233eeac9265a8e343eb0c6c4a7b7a0b26af89d3dceaf2e90e3bc736d71d93e99b8c2f30d9b40e7aedec1b0979a53f4ecdf8100237b99cddc

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727656060295712.txt

MD5 f924652ceee90ba4024b292f50606d51
SHA1 ee70bcb8d0eb3f848ca066e59db569d99d73ac3f
SHA256 fd32b52d6fed808fd472401c60d30ad0d658a15a9f1246de1ca57a3d0519ca43
SHA512 f55249f6d837a09d13e3879176cc52cfb7792ed938ba1891c33f2382e5f6a15d20321118fa39a27529f1d7e742d89134c10f6f514a9c23d948a2098b69338b07

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727663169040966.txt

MD5 033fd518886dc804edd45a60480f9aa4
SHA1 ed42813e7f68d8f1059d5054ac54720e55c9e62a
SHA256 129420b445bd23b1596cfe058458481a218bd622110d2e455d42ed0f098a06d2
SHA512 07d12c326a22f73a8042710d039be315d9553967942aff4e5b598f56484b44b62ba01323d16414e1556b3eb2d222eeb7515ef4e07be76b4aa37677969011b21a

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727665885684530.txt

MD5 f0cb2b89fa33d6208c7f1254bdf90c20
SHA1 9ec14e8cb0f8f35aeb64f49f06addf65f107544e
SHA256 1a42cfd06c624ea5306b552f7d29e8c32b36404d0adb7b7fae7d300265d0c14b
SHA512 90678afd8878ccae494094deaa9fec350e440ee15dabf839d1d39120534b6c2f2f297e4d52153380871d558325fb29237688735906684514c0c52cd3edefea14

C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\File Explorer.lnk

MD5 7bdebef23629a746d74076f95b67493d
SHA1 d7643d8895c22e3cd60f9621ad1476f4d3517d16
SHA256 bf5d0e547e1c0a3f31db052b6b8aaa9b5c7881c81528f75ca40d2f2e68303c9d
SHA512 598a30dbe021da30dbac2f1e607d4f566f9ef1c85b4bcd5c6cd6e2745d7dc0edf602d13b4a0d3bd0181681f3821d9bf8b3bd4cbcd6cafc47a6caa4737b35e908

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\aspx_file.gif

MD5 06628a9043b71f0c8223e79441199dbc
SHA1 c3c325a2dcdc1f347f1cbc851f225ae0565eafc7
SHA256 3d6d3c6701e638291aadc809ae0818395a679d9b1ecf69ed8139cea170973504
SHA512 bdb39bb9ec7e6993af00757bc0297e8a24376fd610f207c4765e4fd7a7a6cc6dfca73067587c9260d9915783d68f5e2145a5fda265bca30012bf8c0a3fd1b29a

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\branding_Full2.gif

MD5 80c8a00e9a20e65d667f438ff3e2265b
SHA1 c2673cc25a79a31748b11d0c23cfc5102ee5bd80
SHA256 47e38060940b64686464091d68a69e89273f0c02b8a3aba9b6c16286704ad8b6
SHA512 602ab1e665209e05cca352403745b1e77b6eb1351daebb98db62a9b56c81f9a387c1886c7d99335d2f733b64663171678cef80909701fd9c5cbe77cfddadf451

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\requiredBang.gif

MD5 2ae2ca819d90bfe1d4fdfb4dca7c8278
SHA1 80c7d721c784605e2b0f25f6bfa0c8e3b1873fa7
SHA256 e2dfbe2587e7cf3db39a5605e8995413e1a9bf32cd86d367bbaaed9b4cd2487d
SHA512 6aee7695875a4e4880965b3ce5e5ddf17ac81070be58b91364344a4bbdc56ee4ee5fb13af56b0c95444be58138c7f5aa8f4cdb97f2d277b2ac13ae0071a0323c

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg

MD5 4f9d63e49b5f4a1f0ef366d942df50cb
SHA1 b17887011dec1aefdb08fafb57831523e5e79384
SHA256 ee18edb2bbc106838e4a3b1e26240a7cc0ac14e0ea6b901c4fe7da4a1ad444d0
SHA512 2e16e3bfc67eb99b1435c5503de10561c87ac15f51d8b9b3eeff7368c8b2431c3c0086da49d00500dfa638bca843a06cf9e22960be1e8e2e16d7da70714f1e93

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\folder.gif

MD5 03092a426842ee9e3d196d1b74596966
SHA1 e879f6639a1bce1e2290e28900d7d8af8bd9305b
SHA256 8bf67ca7df0a534f3d0b789987c15982d8d145f9ac84490e06498cd67f95e67b
SHA512 8a898052838b78beceee239cd368e00bc9cdfb3efe7e316618ee3990b3a84f319af69c0ef8b3d147a446b964aa7565681a8124a8398243c44918fb7493837e80

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\unSelectedTab_rightCorner.gif

MD5 ff6e5a956f62387c3d0880cb5ab779e0
SHA1 1489841af8f734caffd092387c14cc75b7b36558
SHA256 81edad4e48febca40de66e451bb3506a524c09e2b6fedbb03704a2ded1b7188b
SHA512 c53fdc85ec540cf9f4e3e20ea1c5c19a2a5801f33fffd5e66e9910d4d250f28680bcd77dac684d822b4fe5a03bf000797745aeab23aab9313a77b70ee0eafd38

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\yellowCORNER.gif

MD5 b101dbc14d0476d9191ae64dfaad86e3
SHA1 8002768ad413083aceab39070c49c20f4fb7079f
SHA256 4bfe7a54c943837970bcb499d1d3f798253cb528b89b43483a0058157cf37215
SHA512 35f40e63457388bd144961c83bfc59b40c66530136c05260a4c822d05fe79cb06dd8932ef582dabdff93f998810bd06e99f1a9b58746a8c117a068238f4fa259

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\unSelectedTab_leftCorner.gif

MD5 09ed5362331faa56504a91f31257810e
SHA1 ceb5d57752995307ba490fc6d29ae539c93ed603
SHA256 74303390f4f247f14f7ae4f45ecf0d80ab30be3bbbac07ee01b515f22f01fce3
SHA512 3a8e0b22ae9ef43578e87b873f306fa83d7f5c6a92222e6b41fc9e75ddf195b952b6e26ee65e5b097344fda2dfbbe6a51d8d36aa1bcb582cda38b307a9352b89

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\selectedTab_rightCorner.gif

MD5 25eb9e798f42da709c61b7c05c221059
SHA1 8188fd960cbe5bdc25814d2dd8bafc1eb453f3b3
SHA256 474b695a3b249f47d27e9476adcfb2441bbc1fb8e589c4752fa3f2c2a0151792
SHA512 9318bebd0ee55fee5992a42445596c3e04d19a7a97d4aff92eecbdcc8a51a40d57bd7b6deae7778dfbe6db6c08b709d32b4b9f3a14d492c905229fa92461d4cf

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\selectedTab_leftCorner.gif

MD5 f6620f62722b20fca3cb6a922f5fbab5
SHA1 3c0aa2a32268d80880f68a89efc88eacbe65dfcc
SHA256 656c5a7cf9c06f80135e04422dde55b731be6a7914dfa0a1e63e9d07da2cabb3
SHA512 ad1d4fedee12ed92361c3a4cdb891cdc51c0026018bd9bd6eddd083f318307522846c6bac9e73769c390b9c50bb8513fee59fc2421e9ca4420c2f53172f0fee0

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\image2.gif

MD5 ef382c75f8375be0b022c39c7a3e6833
SHA1 96782f71324a65c05d0104b15a0253437f1a514b
SHA256 47b1dbdcb542dda5d441a7bda72bbba53f2a8c92916d6aa1373ddfc01be6928e
SHA512 f0302c46f736fd294737faabfd9f0cfc5a94cb36370824a73c63b08146892dcaabd9bb6b6231f7fd8f9ae6edadebae507fd34148bab94998c4e9971532789e07

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\image1.gif

MD5 201267ab2fc0eb112e47835b0c00c2b1
SHA1 b1594fba5859fcd5ce9c2db95053531258f6dff3
SHA256 9b706fa69bd03fbffe76005d514d7fe8f6135bb4b9f1fabc382b54a49b947acb
SHA512 d7059606acec0c1aaad4e3dae5496fd3ffb79469cc71c2f0d9a409098dcfb6aed04926a0f74df9f6aa422858ccc3b097f1ef5e75c854b4f3cf5eef49e3b7714a

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\HelpIcon_solid.gif

MD5 2456e8cc81424ad20c7583abd7ebcf3d
SHA1 66984f2c3b3d6b83b3321964562a5503039af80c
SHA256 aba18b205c1ee14d9fc1516b1f7c37899b0b22636f472b76c8b133a5d883e5cc
SHA512 5b87f2166a188437f9609bf5cc02a5e7935f97b0488726f944401b7c3565b7765551f66a207e233a182ebf64418bf765229a16314e0b72481cd93e29f79f6161

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\help.jpg

MD5 6518e1d11419ae837dc954f10c0edd95
SHA1 e127d480a466a27d8a049663c126205c2de21be2
SHA256 dfd90058d7b750d7e009785bbbf4f8e89339b3140ebac1c87557609f45e11dc3
SHA512 490c629c5533a9aac192ade552787e2df9c4bd354d7cdbf6df999d1b667aeb7f0a35393ef344ac501146e293a51cd366d291d81418ef3b7bdec4c7df106a05ff

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\headerGRADIENT_Tall.gif

MD5 c12d2e4f40b88096c4758be33ac64e1c
SHA1 a26d37b2483286cce7dbb9de53ee62fd26c9b60b
SHA256 980d2d49f1ac8fdab75280d7544a2e1abd35dbdfeb0f36f2b81fc47a846a4951
SHA512 a46e2052e7db86bad8c5851018c501ef28a673385d02d3a561fa5b6e2da7cb122501d07e3c94e1ea95021f2734b24ab630bfac77854457008d6812198fe058e6

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\gradient_onWhite.gif

MD5 d608c80ceafcd95ee0ad5bdc9e642ee5
SHA1 ef5f9fc42fcff6926116860f2f1ba5b93d0cc49c
SHA256 fe445fc9fab544110468fb0e7e559cf7f2433ef272b55a1c6fed13a46040e1bd
SHA512 4c363f83be59249c096a79fe95ed18bf5763619f0e915a80194684b7a8a1f57bf10d4d1708f39707e66cc63204d94c279bb24b703a7a06a6e0ac8ad6bbe45cf0

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\gradient_onBlue.gif

MD5 e0898a5539776a45c76b0b57e2e0a0b9
SHA1 f14f44ed15f43cc34593aa1dfe7295a7ce827cec
SHA256 f9c3b343e309b313297b17040d06f6ebc13d41b756d26f3f3eca8510994a95d9
SHA512 8c08a58e6f96e1be515a414002a16f48b51cddd62b8d37568812c9bb2d37b5032c0c6b25b19cfa67f5c5b6438aa5dbd601ff9ee4e4997575446be27b8e43a436

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\deselectedTab_1x1.gif

MD5 f27d7642e7baa968d3eeb206cdd0db76
SHA1 e68d462b2d4ed1c4f2481ad02a8470c9e449c56c
SHA256 8b757b53eaccbf645d159b056fccfd440f2380f7795436e0129d546bc3c4ff2b
SHA512 9d26a1c19ebe50bda2a2f51b78f6670570a6186f2d58d0f7ddafa1bed851c82647c6d34e2866e25b4d08691ce12abdcfe8dc0f60bdedfa8f370a524d8fa25291

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg

MD5 10a6a5e7200f30919d71a050b67562bb
SHA1 09126bf0836f86afdaefcf66483587a59e8197a8
SHA256 6bedbcb06f00ba762cf6bad561230f861ede6c5cb3a9a06d926911f581c35a1f
SHA512 af54227d119395fcd3c766e266f37b292c7a985500e11fc90a60ea5746762d99bbb749aedb0aebe4eac01a4c1575b0e3b0ebdc394c0caec9ef0bc9ea334b0fb6

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg

MD5 64a17e4677a11daf682876bab435f60c
SHA1 eb4319b6ff9dc50a02f1f18eadbc42cbfcbfb030
SHA256 626458ccab34b338a130152e1bfb49a4dcb775c44eb2993228ae7b5cc25d7879
SHA512 bf0dad5c9754b2299d831741e8458a04189f7437cd97e007df311246c065b93f7594058a9d2844a9ead4b9f0b5f036a39aae8c02f6aeecde8ba913735f4de668

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\alert_lrg.gif

MD5 728a877bc0e0dab33ad7a53dd390f3ae
SHA1 a52634b80fb864a8c2b9976339b48b14cc6e496f
SHA256 96b486df3e3a20f03413bf19127ee30f9318c667fc0e37744e6dfaff9eed8fc0
SHA512 c928d114bd3b552197413a211a29c9c5b4fe559e395e19921dacb73802a812c4776c98751bbe015635a92882841053397abdf45106abaa32a4467c10e2ab0dd8

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\5 - Task Manager.lnk

MD5 2ad5ececd264bc401c84a7eed2419cd8
SHA1 c7f8cad127b8ca880645510925f93d6179293810
SHA256 b3cf0f41ab64d20842d4cb5bbadde9a63d1000cdd641a180895147757e36ebee
SHA512 1c6fcf24ded6339d4f0899bf8645f6c73337a8bc9eedeb04af2e0f7425d46b18ff522e2403a37b2d3478866a3bacd4d031f2a62988cc781321ad2a71a23ab1ab

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\01a - Windows PowerShell.lnk

MD5 bea9da0cd1ff2c1de17686dab1d4db97
SHA1 fb3dd0578dfc6f941a8cbd5fbabd515bff720e00
SHA256 1b7a1751b9da646d95d28ac80c1e4d92beb51d86f789be3d8d918f8297c3407b
SHA512 d1b8843b09497e38e5ca583aadb6080ec518c0097f14eacb7eb96f1bb00cc287b1dbff912112ccf1e341a8f96b47f9ad88d475e72b118e758333a04daf3b5dad

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\01 - Command Prompt.lnk

MD5 543fe06d03460a1c355790e0bbc3e3f1
SHA1 d8607c78c0f71eddd3044c747487e088b66682d8
SHA256 7fb56c7167e9b01cf27cfbac4998d7b21c44c08283bb0a9ff622f4027a2075d9
SHA512 3781871f2e6be75951c76d49b6831efbc362facac6efe14021e60314ccf56c32ca252585ca27d2a2cb10b5a5a5f2c0002845c1e2cc21d8378528796d1808f626

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\4 - Control Panel.lnk

MD5 1a3cea5d9014a182425bc83d1a3e56c4
SHA1 bbdb714c94375fc8dd757ac0dd98720c908e2958
SHA256 d798dd13531ff5804da4c9a416f5b610c08447b62ff893960bb31b1b55d0e5bc
SHA512 7fe961da2f1c161448cbac7a1dfec6dac4ceaec01431c42f296b24f5d63a443131aca91fd7277ac8b1ed407b9e629843923d4ee7647466426738d3b9456c0aa0

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\3 - Windows Explorer.lnk

MD5 57b62bce450f82a5bfad38328d8467d0
SHA1 848ba339a47d0ceee4f6ed4021dcdd5144e485ae
SHA256 e06b281f4680522356bdd3956acd5f51e42b3d50b5f9a7a751201de7ee358bab
SHA512 104680da6935642096f990497d9ee84540dde151e12f1bdf0ecb56f25b857ead3607845cfb8a05775dc4c76fe14c6c6cf0758d5f6f922db377c0e9c54c136060

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\2 - Search.lnk

MD5 f29b816b0c123004548784ecf53b8eaf
SHA1 0faf69a7194cb0365a055ec1c8768a8f70145d15
SHA256 b64f3007f5125e82e41572fea15b14857dd7bef772aa4363811bf78584b7d61a
SHA512 5c9771afa47c70ef701acf9df01126ce32b74ad467b25e9ffd2d1d77fc21a060d9661997bc9afd654169bc00246853b4df2f886f9d4cac95895623dcca547815

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\1 - Run.lnk

MD5 574cbd73bf83ff8ebc8628bea693637a
SHA1 50b127b189c1bf94582ee977491fc769f71c4448
SHA256 273b344622bc49746a6cc8385c0b462d8ef8b24e0a8fe30ea5b2cc9d069b57c5
SHA512 e2ae399aca9af76cfecd7359f05a7cc709c4dadf5ea523287e780a8bbe5677d27f2b2b99e3603936ada053ca81209f985210b59bf15b40c0ad0283a903f586ec

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group1\1 - Desktop.lnk

MD5 bd6dc7328a37002afd6b00d16d35fed1
SHA1 dec2aa92c2be3d98517117598dcc6ecb01209f85
SHA256 5ebdd92776e6bb0f11eb22443ff02449cc9d6f933ba196d20775876c2b3daed9
SHA512 3b881d3297fc7fab14c8347273dbd0b582133f811b323a60cb80ec305e51856fe6c10c0a79ec1a100714ecb0a14c38da452bf9e69d6022caa8f426ec25f0fccb

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\02 - Command Prompt.lnk

MD5 0c5ce1efc9b4bb43236a827017d646ac
SHA1 1ceace44ea29c28e9169677db960ddcc78812f28
SHA256 3049f1484d3b2c265c135372d3599d08633681cba28ce0451e88598e3666b505
SHA512 7291e1d0236506bd33d6a36f7a3e5676729217cc50e6a7192cb6b3a0ac8cba5496f1457ded14cfc256a39b0527ae01dcbf7be3be0e5d5d2a963150a84759254f

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\02a - Windows PowerShell.lnk

MD5 fb18353e0b6ce6bc9594d0778cdddcf4
SHA1 a49db3138a11595e8b1ae38c109e97523e0e51da
SHA256 76f73fb0777847117dcf6093bed75e30543f7147a7436586802e04415eb435f9
SHA512 d99da948ce36b1bffe93a1cbf15ba3b298569c3c1b431e6c8a39ef37e6eced285a6f48bd9139660b391c6b19a58e30e5f722bc094c27e615f637d07c2ab7290c

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\03 - Computer Management.lnk

MD5 e1641996e5ee8c90e65e26a20eba7650
SHA1 689272364ca28c33c0522a61fcdfd2193b0b7dcb
SHA256 b470c8dcc89c50c4edb46a528a5bb6647cdce0894d4faae8c2a2d06db02358ab
SHA512 8945920b5137d442d86f657d306b06facec3dd6a523b102743c10b30ac613eb4df133c63d9651a5c7bac6ce7f0443e301763e6ba2b643cc3241b910c9e037935

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\04 - Disk Management.lnk

MD5 0ff327fa3750cf2ed9250110b8f8b119
SHA1 53e27d5cc758493e5fa7ab67407d62ae7fabedf1
SHA256 c24956ad1817e89a7fedb36b26ca1f2b61482f43ca8e24ef450fb6e449bc31f0
SHA512 b8620971c9c35782bd89b20edd23d4dbb1039905854b8fc5eb011a80b53849dda3cba696ab6965e118b73093cb0bf63dd0c0be354248be3df7fe43d9401d0984

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\04-1 - NetworkStatus.lnk

MD5 f9de65e4d7bfcf3d8e7f5660993bd86c
SHA1 9155fd8e3a0a13ac0f7f9a5fd69bbd7d4015a645
SHA256 3e241711bcd395c695e93d91260ab2b46112f35f6ae388a46192f320f34109a1
SHA512 51ca81f2916d800b20527675b56bfbc3a8c32f49a7dc1d7edff21af6048bb0163e4af10a3e80721cab7338d0d9685f9ac4b94bae52a5be0169fabee4a8d97b51

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\05 - Device Manager.lnk

MD5 1c158b44ced1762202a3d5a1f2aa58ab
SHA1 0d8397a744d563755a84a579ea3858aa6b612b54
SHA256 8d63831a9f8b1bd50b871e3d0a11a867e4712c7a03332c8dc7fc7612203a5ed1
SHA512 4ec73420529403585cdd23165db99f932cee7d00a88b8804c5cd8912ecf85eac4c747136c5c5805b661f4475b1cd4cd2a50b8342fb484abd2513b795498ca1ca

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\06 - SystemAbout.lnk

MD5 75074fb79479009c35d85b7d6dbf9b82
SHA1 c4bb2b50980efacb6055e66bdb18aee39dd4a16a
SHA256 a527f92607ebc08a14838630c0f20a3674540771581fc660b6721d737f65d076
SHA512 d2df00a05627f511811bbd92257a9710e3941b5e19fefeae6632052df21fae354f09d9be0138a726de6fed2af5c117ec4de4b7969da3c13d73c5fdc096d1f373

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\07 - Event Viewer.lnk

MD5 49b84bb4c7b7bea8fb7a85df343945ae
SHA1 472238e072c30e1dad5de5a8557f2354eeddcd0b
SHA256 5fb4dcd268ebaea360588480cc7ad462742a09b822bcc7b81f8d9a7fe352d8b8
SHA512 dfcb962cd3bafeb330909c99ec297cea819a2ce911c751b769d10473488352a0d89d5eece722c131da74af7e8f63076060b8e48d81377312b1c6c4eb56a2e977

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\08 - PowerAndSleep.lnk

MD5 b7ba2519c7c8164d5792a3cf101aed7c
SHA1 da538d9d12d81cd74248d80e99c430222add9d90
SHA256 2d2bd8a10ffba791250c32639b2fee2378d724475b5690db70c09b9957a2842d
SHA512 28b81eceaf99abd60badccba3f1610518e8cb6072c48d458c3c5d0b8efe35d722618f5cae3ae4f0a63b451b5ea75b70c6a9172b427270ca7096384a157cce8f5

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\09 - Mobility Center.lnk

MD5 2d9d36cfe73533b6c1e6fe702cb10633
SHA1 bba2848bbc13914dcc06312de75b15dfb5293f34
SHA256 f62861a0e033e06db865376a8c394f7dcad063e96e99cb08ba7da72417c6fd87
SHA512 878663496365acea2f22107745c29cf6be6732d1d97dc28e53233b1dda997d115b2dad72b2d9453125f544a303ddf7900ac200cbe5f7432b9c7247e8e4fe12af

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\10 - AppsAndFeatures.lnk

MD5 149612303199c754d46f776bdf98e8e6
SHA1 cbb71dc486f044f26f25c2d95dd28a0d63ba512f
SHA256 36f12556678050723306f89f344a46f19edd94940f2acbdd28aec4bf2d026b59
SHA512 18d7003cf1909fe520d729492a77c7bbcf022d10c4daa27846fd13b4230af079b2f5ca258a66c1a7e5309a212b7b4609d274123a80e242ab71763072149c802e

C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk

MD5 0201c385089305aa78491dece91cdc27
SHA1 d844b643110ba8a570888c5a49b6d05b549521f3
SHA256 5528995f347dce21c43dab0e440773e030d505acbff3e70c11b9f0c737c03d9c
SHA512 547b9dfdf8b2df26ac53de54e4c7d79fd9ae0b86c9d35b4b6836efad3bc145f8b1fcf14067ad7b925d177368071b8995820ca89a76913a982d24ac41bd7772ff

C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk

MD5 2a438a5f98a10119d32207ccc87b6ccd
SHA1 f5c50fa9e7297c0b0ff4edf311b1b7c7911bbd21
SHA256 b984f9a2545c16a289f678a72a25fbb432cd20c613b7001dc340e24e2cd99868
SHA512 7d296f577da0dafdd39bb361e8638ae089f1350daeec28207ec96818bbbcc29ccbfd32b6e1553af3d3e50a27955c77beac2b3bfe356cb0ac2b8986249c62c2b4

C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Magnify.lnk

MD5 23c0cfa5b7a2d3322c59a1bfc55c8e2e
SHA1 83a76bb50cfd90978760bad79498b18aa455a7a8
SHA256 fbb44b95d4968eb9ce67d204a4ae3358d25c4b1deb0b4e7780615b7fcb9b9764
SHA512 12d4003b97dc36bcd1afccdc2fed949f4b8b126dac160f82abc25480dba9891f72fbf09eefe26b771252db61cbba56b789368f6c6aa67045a65facdd9fce30ea

C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Narrator.lnk

MD5 c164e42e3b24243e9217f5f94d56c6c6
SHA1 61d2bbbf918d611ffa0749372d1d92ecd478bc0e
SHA256 75a42af8770d94fb92d4dbe5327d7fffd0eef7a77e91a722627f01383d2cc3a2
SHA512 e1c27e8fa62f8c5f5e8fa46ebdcbdb68ec00e159749cc0eb781a02eea982295c1c8c06293481b61a4b702e0db6107955ae2712d55e7999b299118213d1d10236

C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\On-Screen Keyboard.lnk

MD5 21682f2b0ae7b76e48ade8036ee2f455
SHA1 02acd2145c91a52831d29eb174a555f60ee205f3
SHA256 4db561128f327cd04164e80ddb97e018927752c6fa5deeb4861d271bc7e53728
SHA512 07dd1a82b662cb625ec106b6013cd1ec7cfa256a10069f3606cf96e97497aec63669d47fac66421840f187c4164c3745a1ece9f199f916a46d30821d46ced487

C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Administrative Tools.lnk

MD5 116e3e4e17104338cf0ede593acc4300
SHA1 9ef66f7f3f55270e5eb66d0911504702a4f92b63
SHA256 06f4faf75c236f29f6950e05b193f3097060e2a057aac8707d9978d77eb4b40b
SHA512 eebeec8ec8737e0052ea21b9e3a68102c3d271f36c234392145436e9243e437a168947e41dd157097066d05fd96e0a6b9ce954419f4bedf4b32930ae76b164f5

C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Command Prompt.lnk

MD5 a278410cb79844292ad5265ae2f63d54
SHA1 42e19a7fa63ee048319572869964c5ca06c88e2e
SHA256 f9cfa7cbc7e852993e6e085470bed6a235de41f0cb27c16662137725650788ac
SHA512 1dc1d78033dc13fa612b39c114978cc44ed31e7a65716c240df93788a6f2847c4195699a2b0d21e614b3dfa69e3ca9a9f5c5a80ef951a35bbdeb90d17364c352

C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Control Panel.lnk

MD5 2eab5072ce48d73e2879ecbe0872ecbe
SHA1 9f02b2130e881599da947a58c5949d3d08103dfd
SHA256 6bf4060ce246951df8e8d10662bb2e817764f1b01fe3d38bf2c2b59b2b1fe838
SHA512 d1953ee1e0521bd55cbfaadb3e74a0e8b110bf161d4b506ef419bd9458b581dae1e7c4c4d9737075b65d7d3c393a983af5f4ebf2c77ee22cca8cc461c9384b45

C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\computer.lnk

MD5 860fc5613086de3fe464f2f5c7d91053
SHA1 4c39e2b8007c6ff74b90843df29f7816df5133f7
SHA256 f8b90b120983430fd81af98b339d0db23240d5f6f1696f6f1c63336c206f8aa8
SHA512 5dd9d5e87997885d800d507d9757727c34d190b6a4810d7260f626fa730337c48809360c17c68fb32dd37b5674af6208ab5fa42b536bd3f4f4a25764e8aa5f7b

C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Run.lnk

MD5 26192ace9321830331f550dfaa74a86d
SHA1 bb2fa19d4239cff914e7ae1cac03fdc52bb1a56a
SHA256 f0fefc1cd09c08e4da57a04fd02bf3002d54eec5ea23ef5b36bf75b1942c7860
SHA512 0fd5aa270d2de45c334b920db3f49d7bfce325b5db7239be384964cff1a3cc19839798db15ca42c311b9ad3eaf058aa7df165738fcf1139bfe6ff9299bc3f83a

C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell (x86).lnk

MD5 02029c81ac98ed3460244fe9605e43f1
SHA1 5a0cb359e4026354a81b6dac140e31db80cdc25b
SHA256 a983d6e61da4972d23d9731133785a0a4ba86eb66cf567616207ea342c70af2c
SHA512 370bb50638920bcd839abb98ddb3e814b89ee37d669f35ed01e539cf4a92e10230192ad6d847513be2a7fbc0ba01a6100009aa7852bc8d29bd1df9c266fe0103

C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk

MD5 6d2aa32014aa454d9644ca02575eb775
SHA1 ec56634752878b015e253abcae425be74de66434
SHA256 bbea9dbd451e1596c66495aa45d429950eeb1344e2d1bae83355cfa5d7156891
SHA512 530693b827da6908208af4e370a46f6675feb466c336cddb84d89f959d5463a8e859ddf75368b5a3fa1dc66a92a3714d9a9020c99f216d60ab5cecff5f8285ac

C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png

MD5 d511d2aa2c21b31d13580cc3d52cb43b
SHA1 379c28f14ba8fe8556f8301fb61a9da79491081f
SHA256 e1aba88ba529f3ff043a550af7c08007bc6c7b6420316d8dacdae98a9d2071fb
SHA512 29688c843db7d6a4a655f24b23b7c24623278471b96af77b900674b04dfb25672986feb82273b50642705f780467c1d4b3d52511893708ae66b2a66002034b0b

C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_contrast-white.png

MD5 180a37865c0ce79ff72bb3bdfb6e4b81
SHA1 a347aa4ebad7d8282e62b7fe6b13d67dc8786d71
SHA256 90297750659f4403c54d10504c2d1b0560e2b685fead1a3ae3f0c2058c06108d
SHA512 2002fe5360084cd839e70c3aa7630fc2e56b45f1a022fa798effd4f9deb86ba1946ebd6d45fdc32bd736098fc37656129987d704de6323a56b7ecbfba8b4d569

C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square44x44Logo.targetsize-44_contrast-white.png

MD5 dd8810e75e1aa8029dfb1d875c6eab43
SHA1 768064dbd2a0c76610aa655628582812307e51f0
SHA256 604e90c6d156cdfded92fd8440c8277f9430de6e0a2808d00c2e50192f395cb9
SHA512 641a121e5079853cc0061d6804169f21aff79405658c3f795fa01a243bc5086ce01ff7b66381fdc972d7719cedd07067ce7510d97c3cb4c458718a0b2a3489c6

C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png

MD5 9f567fffd94dfa6d50f1d1a2e55d4aa6
SHA1 627a866271bb8c05baa5bf60aa9194d7a5964293
SHA256 e5f56337311af9e408a11cff1ffac295a519bd1837f53f24ab058c45712abfe4
SHA512 75070bf1da2886ea015c2af7710bc94212ca9b503261032ca6eae9db6241c5dbd848cf38dce18df7c07e95dd16fb6f50623f3a1a9e741093c10b7789ce7aa1ae

C:\Windows\WinSxS\wow64_microsoft-windows-onedrive-setup_31bf3856ad364e35_10.0.19041.1_none_e585f901f9ce93e6\OneDrive.lnk

MD5 815fe160b34dca45b55e73fcd4e50e65
SHA1 2c7f318356774730dee3e30e7ca52167ea73b871
SHA256 aa1d953aa31e6b05ca914808241398fb75669df836b150dc6b0c142c0f672d07
SHA512 0f6838e580ccc7eb992b6e812c2f1f1af53837c6726b5c73ee35dc202afdb19605efa9caf332322e75784ac50336a44389a5ae0660970e7c6cd725a9b37e52e0