Malware Analysis Report

2025-01-18 20:40

Sample ID 241209-nzbfjawng1
Target d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118
SHA256 c0fcf3ac6b125e985c6574ed7ef1a7929f3be8f6487b68e4d58a48a3b1517b5d
Tags
xorist discovery persistence ransomware spyware stealer upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

c0fcf3ac6b125e985c6574ed7ef1a7929f3be8f6487b68e4d58a48a3b1517b5d

Threat Level: Known bad

The file d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

xorist discovery persistence ransomware spyware stealer upx

Xorist family

Detected Xorist Ransomware

Xorist Ransomware

Renames multiple (2190) files with added filename extension

Renames multiple (2214) files with added filename extension

Drops file in Drivers directory

Reads user/profile data of web browsers

Drops startup file

Adds Run key to start application

Drops file in System32 directory

Suspicious use of SetThreadContext

UPX packed file

Drops file in Windows directory

Drops file in Program Files directory

Unsigned PE

System Location Discovery: System Language Discovery

Suspicious use of WriteProcessMemory

Modifies registry class

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-12-09 11:49

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-12-09 11:49

Reported

2024-12-09 11:52

Platform

win7-20240903-en

Max time kernel

121s

Max time network

124s

Command Line

"C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe"

Signatures

Detected Xorist Ransomware

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Xorist Ransomware

ransomware xorist

Xorist family

xorist

Renames multiple (2214) files with added filename extension

ransomware

Drops file in Drivers directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\drivers\it-IT\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\drivers\ja-JP\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\drivers\de-DE\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\drivers\en-US\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\drivers\es-ES\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\drivers\fr-FR\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\drivers\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\drivers\gmreadme.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vQVykYApjMM758B.exe" C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\System32\DriverStore\FileRepository\avc.inf_amd64_neutral_3ef33c750e6308ce\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_split.help.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\default.help.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\de-DE\Licenses\OEM\ProfessionalE\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\de-DE\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\ph3xibc9.inf_amd64_neutral_ff3a566e4b6ba035\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_Return.help.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_modules.help.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\lsi_scsi.inf_amd64_neutral_cfbbf0b0b66ba280\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmhaeu.inf_amd64_neutral_6611a858035bf482\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_If.help.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_WS-Management_Cmdlets.help.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\prnbr003.inf_amd64_neutral_dff45d1d0df04caf\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\en-US\Licenses\eval\Starter\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\nl-NL\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\prnsv002.inf_amd64_neutral_6ca80563d6148ee5\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_Core_Commands.help.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_properties.help.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_Quoting_Rules.help.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\XPSViewer\ja-JP\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\netvg62a.inf_amd64_neutral_5817ae5135655364\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\prnbr009.inf_amd64_neutral_fd2ac5b9c40bd465\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\prnin002.inf_amd64_neutral_977d40799168c216\Amd64\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\prnkm005.inf_amd64_neutral_c03c9e328608873e\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\usbport.inf_amd64_neutral_f935002f367d5bb0\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\it-IT\Licenses\_Default\EnterpriseE\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\prnsv004.inf_amd64_neutral_fc4526bbfbd5feb1\Amd64\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\usbprint.inf_amd64_neutral_54948be2bc4bcdd1\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\es-ES\Licenses\eval\Ultimate\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\it-IT\Licenses\eval\ProfessionalE\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\it-IT\Licenses\OEM\HomePremium\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\migwiz\replacementmanifests\Microsoft-Windows-GameUXMig\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\migwiz\PostMigRes\Web\base_images\WindowsPhotoGallery.bmp C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_join.help.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmnis1u.inf_amd64_neutral_15011483bd8465c4\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\ja-JP\Licenses\OEM\Ultimate\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\it-IT\Licenses\eval\EnterpriseE\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\ja-JP\Licenses\_Default\Enterprise\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmrock3.inf_amd64_neutral_9fdc5d710dd63e80\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\iirsp2.inf_amd64_neutral_9ed65fe0bab06b1b\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmdgitn.inf_amd64_neutral_09132735f1063a47\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\netl160a.inf_amd64_neutral_f8bdd2cbac28a8fd\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\prnep00l.inf_amd64_neutral_f1fa021d2221e2c7\Amd64\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\prnlx00d.inf_amd64_neutral_ce7a0b4e23e432ad\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\en-US\Licenses\OEM\HomePremiumE\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\de-DE\Licenses\OEM\HomePremium\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\prnrc002.inf_amd64_neutral_fdb6f2e252435905\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_Command_Syntax.help.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\prnsv004.inf_amd64_neutral_fc4526bbfbd5feb1\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\termkbd.inf_amd64_neutral_e561157e16aa2357\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\Speech\SpeechUX\fr-FR\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\hcw85b64.inf_amd64_neutral_22b436d5d06ab017\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\prnep004.inf_amd64_neutral_63b22bfb6b93eaba\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\wiaca00i.inf_amd64_neutral_de104aaa48ee4b00\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\en-US\Licenses\OEM\UltimateE\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\migwiz\de-DE\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_prompts.help.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_types.ps1xml.help.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_Parsing.help.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmbr002.inf_amd64_neutral_ce2134188ab21f59\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\prnca00c.inf_amd64_neutral_510c36849918ce92\Amd64\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\prnca00g.inf_amd64_neutral_6f76b14b2912fa55\Amd64\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\es-ES\Licenses\eval\HomePremiumN\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_scripts.help.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\rarrow.gif C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_right_hover.png C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\144DPI\(144DPI)alertIcon.png C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_center.gif C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Windows Defender\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Windows NT\TableTextService\en-US\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Adobe\Reader 9.0\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099188.JPG C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Earthy.gif C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Oasis\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\9.png C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightOrange\background.gif C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectStatusIcons.jpg C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\20.png C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\btn-previous-static.png C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationLeft_ButtonGraphic.png C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Program Files\Microsoft Games\Multiplayer\Backgammon\ja-JP\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01743_.GIF C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR14F.GIF C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02845G.GIF C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\Verisign\Components\VeriSign_Class_3_Public_Primary_CA.cer C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\nn.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\icon.png C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\next_rest.png C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00038_.GIF C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\preface.htm C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_thunderstorm.png C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\J0143749.GIF C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Solutions\Response.gif C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\pt-br.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Program Files\Windows Photo Viewer\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\Help\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Common Files\System\ado\it-IT\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14691_.GIF C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationRight_SelectionSubpicture.png C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\Welcome.html C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01770_.GIF C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\images\dialdot_lrg.png C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\sr-spc.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\ku_IQ\LC_MESSAGES\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\Tulip.jpg C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SoftBlue\TAB_ON.GIF C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\settings.html C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\rightnav.gif C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Program Files\Microsoft Games\FreeCell\it-IT\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EVRGREEN\PREVIEW.GIF C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02897J.JPG C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD21315_.GIF C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\css\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\144DPI\(144DPI)grayStateIcon.png C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SPRING\PREVIEW.GIF C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0145361.JPG C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Swirl\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\mng.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\WebToolImages16x16.jpg C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\images\prev_rest.png C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.htm C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\css\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\21.png C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Stars.jpg C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\assembly\GAC_MSIL\System.Web.Mobile.resources\2.0.0.0_it_b03f5f7f11d50a3a\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-l..omebasicn.resources_31bf3856ad364e35_6.1.7600.16385_es-es_77c3e2c030c9a730\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-cttunesvr.resources_31bf3856ad364e35_6.1.7600.16385_de-de_1a9b8c79c6d662f1\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\Help\Help\it-IT\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-m..ponents-mdac-msdart_31bf3856ad364e35_6.1.7600.16385_none_42074b3f2553d5bd\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft.backgroun..nt.module.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_836a83fa126c10f7\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-alttab.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_1130acee02899dd4\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-n..erclasses.resources_31bf3856ad364e35_6.1.7600.16385_en-us_74ff7604b8c68a3c\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-rasdlg_31bf3856ad364e35_6.1.7600.16385_none_6ce99231b0f48322\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_server-help-chm.cmak_ops.resources_31bf3856ad364e35_6.1.7600.16385_es-es_41c2a0c99232a8e3\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-font-fms.resources_31bf3856ad364e35_6.1.7600.16385_ru-ru_7b2a0898d09e3888\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-ie-internetexplorer_31bf3856ad364e35_11.2.9600.16428_none_11b913172f0cb26f\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-rmcast.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_725e5d16a880d498\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Windows\winsxs\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\deselectedTab_1x1.gif C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-dataclen.resources_31bf3856ad364e35_6.1.7600.16385_en-us_bd1e14477e5cb066\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\assembly\GAC_MSIL\Microsoft.SharePoint.BusinessData.Administration.Client.Intl\14.0.0.0__71e9bce111e9429c\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-d..fontcache.resources_31bf3856ad364e35_7.1.7601.16492_en-us_201bcb86330412a1\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-services-svchost_31bf3856ad364e35_6.1.7600.16385_none_11b04b481efec48c\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-d..lient-dll.resources_31bf3856ad364e35_6.1.7600.16385_de-de_accc80812c85f01f\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-ie-jsprofilercore_31bf3856ad364e35_8.0.7600.16385_none_253839ca09b4c8e4\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-m..fications.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_e7853b25060c6221\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-mscat32-dll_31bf3856ad364e35_6.1.7600.16385_none_dcd9059e393675cd\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-smi-engine.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_80319c33636a43d3\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-m..component.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_dd7184bbcf6cd663\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-s..-usermode.resources_31bf3856ad364e35_6.1.7600.16385_en-us_6e69236bf1ae1f80\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\wow64_microsoft-windows-gameexplorer_31bf3856ad364e35_6.1.7601.17514_none_aa7afed00c3d4db7\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-w..ure-other.resources_31bf3856ad364e35_6.1.7600.16385_es-es_ad7f1ebdfa3f77ac\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\assembly\GAC_MSIL\Microsoft.Jscript.resources\8.0.0.0_de_b03f5f7f11d50a3a\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-i..cyscripts.resources_31bf3856ad364e35_6.1.7600.16385_en-us_742267d524200863\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-healthcenter.resources_31bf3856ad364e35_6.1.7600.16385_es-es_eebfadad58553da2\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-ie-feedsbs.resources_31bf3856ad364e35_8.0.7600.16385_it-it_efb555207ab6d84b\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-d..fontcache.resources_31bf3856ad364e35_7.1.7601.16492_fr-fr_c29e9e6925fd1aa8\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-i..tbranding.resources_31bf3856ad364e35_8.0.7600.16385_es-es_6cb94f2a981a0059\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-m..oledb-rll.resources_31bf3856ad364e35_6.1.7600.16385_de-de_ce5e4d236c2cd77f\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-t..cesclient.resources_31bf3856ad364e35_6.1.7601.17514_en-us_76a51ea2cc60773a\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-v..skservice.resources_31bf3856ad364e35_6.1.7600.16385_de-de_f8f65c9d5ef440b6\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_circlass.inf.resources_31bf3856ad364e35_6.1.7600.16385_it-it_419729bb6c44ac33\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-main.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ac1bf6c4ee6b3ec8\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\wow64_microsoft-windows-bcrypt-dll_31bf3856ad364e35_6.1.7600.16385_none_54d62f663d777131\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\wow64_microsoft-windows-w..publicapi.resources_31bf3856ad364e35_6.1.7600.16385_de-de_332ee52c7283fee4\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-rasifmon.resources_31bf3856ad364e35_6.1.7600.16385_it-it_3b1c9b1d18c1a942\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-e..presenter.resources_31bf3856ad364e35_6.1.7600.16385_it-it_7017226bc5bb2925\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-s..-freecell.resources_31bf3856ad364e35_6.1.7600.16385_de-de_cbc7ace537b928fa\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ca7ec133e2786d8f\about_CommonParameters.help.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-t..minsnapin.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_36dc5da3b60ee79c\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Windows\Media\chord.wav C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-s..revention.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_dde37d0503aa8003\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\msil_system.windows.forms_b77a5c561934e089_6.1.7601.17514_none_054834d3002dd72d\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-s..cingstack.resources_31bf3856ad364e35_6.1.7600.16385_it-it_75597592789f1a85\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-i..tional-codepage-866_31bf3856ad364e35_6.1.7600.16385_none_2adda600b4e25a37\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-mail-adm.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_ff6f7ad3c2f5987e\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\wow64_microsoft-windows-p..ssettings.resources_31bf3856ad364e35_6.1.7600.16385_it-it_3c20a8ec4d33bf48\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-c..legacyole.resources_31bf3856ad364e35_6.1.7600.16385_es-es_ad22180475e0d9d6\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-d..how-other.resources_31bf3856ad364e35_6.1.7600.16385_en-us_7b9fd1df961b4d61\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-eudcedit.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_a23f4c127f87c066\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-w..umservice.resources_31bf3856ad364e35_6.1.7600.16385_it-it_54caca9fc5890277\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_prnlx00a.inf.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_4e455faee55246f3\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_de-de_7f0b185800a159c3\about_format.ps1xml.help.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_hidirkbd.inf.resources_31bf3856ad364e35_6.1.7600.16385_es-es_f0d1a908e7473790\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_es-es_1d72a0e2bb459532\about_scopes.help.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-takeown.resources_31bf3856ad364e35_6.1.7600.16385_de-de_0d1dcd4f636311e2\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_bthpan.inf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b9b457911a7a4781\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-rasrtutils_31bf3856ad364e35_6.1.7601.17514_none_6b3b9980011a19de\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_wiaca00d.inf.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_9cf3bf463e653b83\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ZIBXKKHVYMVCCPW\DefaultIcon C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ZIBXKKHVYMVCCPW\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vQVykYApjMM758B.exe,0" C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ZIBXKKHVYMVCCPW\shell C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ZIBXKKHVYMVCCPW C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ZIBXKKHVYMVCCPW\ = "CRYPTED!" C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ZIBXKKHVYMVCCPW\shell\open\command C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ZIBXKKHVYMVCCPW\shell\open C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ZIBXKKHVYMVCCPW\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vQVykYApjMM758B.exe" C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd\ = "ZIBXKKHVYMVCCPW" C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2616 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe
PID 2616 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe
PID 2616 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe
PID 2616 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe
PID 2616 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe
PID 2616 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe
PID 2616 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe
PID 2616 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe

Processes

C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe"

Network

N/A

Files

memory/2616-0-0x0000000000400000-0x000000000041D000-memory.dmp

memory/2616-26-0x0000000000412000-0x0000000000413000-memory.dmp

memory/2616-28-0x0000000000400000-0x000000000041D000-memory.dmp

memory/2616-21-0x0000000000240000-0x0000000000241000-memory.dmp

memory/2616-33-0x0000000000400000-0x000000000041D000-memory.dmp

memory/2684-40-0x0000000000400000-0x000000000040C000-memory.dmp

memory/2684-36-0x0000000000400000-0x000000000040C000-memory.dmp

memory/2684-50-0x0000000000400000-0x000000000040C000-memory.dmp

memory/2684-54-0x0000000000400000-0x000000000040C000-memory.dmp

memory/2684-49-0x0000000000400000-0x000000000040C000-memory.dmp

memory/2684-48-0x0000000000400000-0x000000000040C000-memory.dmp

memory/2616-47-0x0000000000400000-0x000000000041D000-memory.dmp

memory/2684-44-0x0000000000400000-0x000000000040C000-memory.dmp

memory/2684-42-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2684-38-0x0000000000400000-0x000000000040C000-memory.dmp

C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\HOW TO DECRYPT FILES.txt

MD5 84aa889a87f60a5efba19bf8d6464613
SHA1 4fe67d41d2ed917651e5820f131780bf078e3c7f
SHA256 43fc35d4b08e00236a28300d95f7426593db8f95f47e995477a77bfa5fb0ec99
SHA512 1d67c2552d16b8c9fa33417d45c8229d291077f45a12692d8a7e9ade813dbc629a4b13eb4107a773896386b9c4e6993fbefe54348568ef28f44f40c6153ff0a4

C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif

MD5 27c9d1245163f6a2ba76cc91b0c3bb3c
SHA1 5f126d6fca1dd15ee1a058e5e96a0b3c89dbbfab
SHA256 e25e7c97fca79b1146429e074fd830cea1283c464836c5b0e9676054e9469542
SHA512 c331ac3a69f9c599bf00cf6bc934ddb6195d8454af11603a7e954115376c8e0d1d7d9513357c2012c200a57e9ef6d43caa2d3bb3f2eae4eb0a063a825edf616d

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html

MD5 331ecf38fe5668c78edb8f2bb51f0aec
SHA1 21695e4b52735a172e86a732c72202802d89731d
SHA256 0386d83e43e17e64adbf24ffa5a52d5640accdf4c8072a19f4c7e6c13f8f5312
SHA512 a7a89ea5ee617ecf375218a96e3bfbf37574b400ad3e78a7c849cce29dee873f1b364547337147f83ca2fa2dfd7c28fcccdddb17dd902eb3442c1659d20d0c2f

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html

MD5 371b241caff76c21d055604f7675fb91
SHA1 28bee99eadb23f6aef2bf49d609694394d4ba115
SHA256 a4725bf11da5be3e0a849b8c242a9eb1859bde3f061c8491abed29bf48dea725
SHA512 8258a5c185fee6d540ec933bceff4b9f6ef86dd47ce7b6c654065448882a5cd2036b949263504b32e74925c9d4072eb518fb86d84fa3b126c4002e2362fa7f03

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt

MD5 966f4cc9ad4ff431c8f1d8d062939882
SHA1 ac03fe94102cbf1834c9a94545e3b5bfe6938b95
SHA256 a0828a0adea714702b6320c10ec46e1b92befacb621d9562db257d43e410e412
SHA512 4c9dbc87cf7ea0c757ccd5c965b9f63a5cce97bd360bf92356436fbc3eb8dfe3a9a0f4c91e7a48074a5c30543a12c944667fb0497ba13314d5d92903522673f6

C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt

MD5 e3adb8dda9d633a95914de56f1dbe84f
SHA1 7d321579b36f5c337868142696a1a39dbd1d920a
SHA256 e0e86d5a7275cc2315198bebd385e385700ebfec3a1f6015437f644c2afc9e22
SHA512 fc0d5fbd22924df69bc851f4dcb06c8bc3c11a63ee2f62a29cc435c63cd47ed47d7fff4e7c18c4e064d43d6d11a87fe2bae131870aad92d3230021bc0d853edd

C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME.txt

MD5 5789f6e2fd217194f716477b7d2bb1cf
SHA1 677e3359be96317acc0989271ffa306f0218e547
SHA256 a68145965acc56b247030d8cbe79606490b893b05529940e652d054f803ac2ab
SHA512 7039e07572b2d143f80559bffce1a265a3c120fda3f0f801e7d14bc9ed9f409398f7dc753999c44de2940f1b032e88d306ad4adcfffd01d126112f6064db5b24

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_OFF.GIF

MD5 1af7d34ecf54e18b29b4521ade01f482
SHA1 76aeeb49f2db5b5ea19cfe94003757cf76dca92e
SHA256 761a41ab56c996490019bd9b7a2b14372d9cffa64c237284643bef9297f50937
SHA512 21989a19abbe03f023e19edb25ce57472eeb8b2a60ed0468b8753030c1b99f649e128af5eb8938162146bf64baf701b873fdc366c4094ce384c131275f6ceb21

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_ON.GIF

MD5 8321938fde27f77a50bf2340b0fa405c
SHA1 db54bb8b6c243abdc7e3fbeacd5be46afcb150ca
SHA256 30de98a31555a2712d2fb74c6ee0b27ef1d7db74805c4116eb9d94c04ac21bed
SHA512 d3b17b98654bb73185fdb1702d5ebb0e9163230049c5af0a9966d3c74058418b14382e3ab5634020a6091723ab1c419030d3f58fcc32785ae20b885ea7e49c84

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\BG_ADOBE.GIF

MD5 6cc7dc7807dcc77ede213cde5e316579
SHA1 6fa92b6c5222de926752f1870967f4256a5b062b
SHA256 dfb926a62310724d4d3bde6d018bc209d31b37a2e74e5470d1f27ee8356f672d
SHA512 1d97eacca8569ea3ff369a264718953e2d02adf7441cae137b73b306186e9131d109b67ef6560d09c2f76c201940771850680fe9ea096b29e1d049210f3d2edb

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Casual.gif

MD5 f3633373e8e0c7766b0f95579bc4ac3c
SHA1 c7bdffe2bf44bf4c2e4439594dc21f4044b5d455
SHA256 4a17527487be1048fd913b65a1e578a44d40de9a252f2c8ce354c736fcfbcaec
SHA512 e4b7facd7f12ede517614fece819cb88de49f69491158c7c94c3b0c02fc6f1979ea9b9c882288da2fe091adc05dfd3c4ba67933ccd122d8bc44bc5d4c4a8a98a

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Country.gif

MD5 0874d67fd3a220a291bab11c5d6ac794
SHA1 cc6f56089dbd3b8209870a82984208c43d01cd80
SHA256 536545828d40a151b4eeade33fef03b8824a7b7cba0292ee08fd4e1511fda755
SHA512 04827149c1dee564b50cc1c596301528d08c8c80787c00e69309cbfc245d04ead4b9db14446758e4e645b6c8ee32680242415edd5af01ff485414fcb64e416c0

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Earthy.gif

MD5 3b02fe5c5472e8562208798eca30a4be
SHA1 db04ddf930e3cbd63230bef71dd3872d882dcfd9
SHA256 52607fd4de7550b57fe177f9559b0a8206a84688944e85cd56a8aa3ad8a148ed
SHA512 eb64733a22988d5532e6d07d37670a789d4c7a5de5829624d32cac65e49c7e224a19e90223e7b26dfa2d547c79a3072d659277fb11b4f8d4c2aeb7b9cdc398a8

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_GreenTea.gif

MD5 2cc390c00a5fd530acc33d0047a41d07
SHA1 035a954db52459c1af0d1b92aba21e88820ce19d
SHA256 29e65d51175ac9cd88576b9776b55caf40f6deb643a7b134b657fc2817dca928
SHA512 df1b393bac3c7cfd1b5dd0c7ce1ae8e55d9356d72c05ef7d4c6dee8e390d65fcc3aebf681c2add565f78587aeea5814d56e728e8cdbdb5e58179dca7f69d6989

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Groove.gif

MD5 037a40463211dcef7895e83fbdaf51c4
SHA1 d4061d838f68179bfe857d47f7ccad8bfd1ab892
SHA256 704fb0f7bc0b9316fa7eb7d3b6a7aa433aae1a36f0e37423bebd7f9006e61eac
SHA512 0a926b8c562cda294c8828088409457a8e0800b06a560709c3015e7a312f5625821350bdc87bc241f1256bcbf51ba4585f13a724e8c2698dd8d85038100289a5

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_LightSpirit.gif

MD5 e4eb37d9927edd263c169bfa8380694c
SHA1 76c0dd6a9a3d175c619d73c17539b78d8a86574a
SHA256 9d1240e24a870dbdbe285e0261d62c093063b7a1d477f5a0c1d00980abee6e79
SHA512 bc93b9b4211b404cda7c9bff60bd547c7ffd1f3a2e6719ab39f4f268261239f450f6b556e643ae515943e81e95c4f483cb85740c3397a6d5963b0167c808ccd0

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_OliveGreen.gif

MD5 0b5333afec9f35206926e204f5a0dec1
SHA1 cde48354e72657c12e47ec4f24b054f47284a26c
SHA256 7cc0c9233f07d999a7ac7f1c601f74b98c8ba825c4c275a477a4b2e4151edd93
SHA512 4c16493a1632867ed6bc4adf648bd14e1cb517b11febf6c446f93272a0aad5696956fff53cc705ab08cb2579905f8780a2a0cf25703fe01a9a18d59827611043

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Premium.gif

MD5 9c362b8c6b3cdf188a276b002cc14312
SHA1 2beb8de0eea83839e2309fd040e08593dc398c6d
SHA256 5b5371344edf9af149ac0c651215e0ed3d34a833e04e017ecdd8f4a919ff8227
SHA512 fe16f3bdcf60a21b97e0f90558ba5a833240a93f1b5abc8a059a3c486477b50cb59ba9fcb3d91090d699afacd225d03bf11c6830bf27385c552a9e4523ca1a8b

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_TexturedBlue.gif

MD5 189313edf729895068a09a40d48bc6bb
SHA1 f59b014b8426dff96512ef7f217f54e317fad268
SHA256 6b6672a3ba6f8294bb84551f69227a58865656c03355045cb7cfee2feb5a25b7
SHA512 fd88918c92dd23c1312044b803f893f998355342496cb97dc9c18b96d0b73f5cd0ec3d91474d702e7058a57d911a01abb0467c8a129403e8fb6b3af90028a739

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_SlateBlue.gif

MD5 239a81afd06619c189ef5de4e9d2b31b
SHA1 2a715c8788cae6b76c428d0e0d043ec8d18d896d
SHA256 0c521a36c64fdb6c61dc8d4d7e1a8872816b3c1d61699671c07fbb74fc85f631
SHA512 9d99b4a4c77108858c3239bbb33ecc181cb8fcc856088fecf3a1436d1c17df90d930696ae4f064cca07ebb8c5ee246e3719823f6738f67f830ecf29944c112a6

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_VelvetRose.gif

MD5 571238b7377504c87fb90931bd3e8fde
SHA1 b1d54a5e2e1fb59bc673ad5910a8f6cdc7e4223b
SHA256 32749a6331c55f7c4b0028be698e119cc94dfe3f8e3b55616aae4a8a5aa156cc
SHA512 b0832b63561a52db5294c372218100b362f9def57710e23e47c5a7510a6b84237f9920c845f56818619ff9393ed3737883f357aeba56d7ac35cc3105f41fe8a8

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BabyBlue\BUTTON.GIF

MD5 129b10bc49bb5bc1f57f72ddb004ebde
SHA1 a61a554555135bfde998ef7303f1989b87070880
SHA256 c351655e7779e970fe8681634d92622ab14efe721c5895d52a7ada2d1c5172bc
SHA512 20a17c7e639e613bbdebf8f73c4de25846eadb5fc1bd90146456dcef1bdd0219fbe97874a8ba182fbb2727ce579c96d20fa06f207b88ebf01c87a9ffb0a32a73

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\TAB_OFF.GIF

MD5 90ddbfcde3b20377a35bff127cf73ff3
SHA1 7a7ede591bf8d9f21de616367b3093b285dcb21c
SHA256 9eb0010d944bcb52540c519eb0ce7fa7a789567e706701bab250d57c01af5d79
SHA512 62608a4310529c745cec0f62aac9a49fbdd00698a2c2ff65e774797639b18a38fb9aae5de660a54e5f13c14a59627bbd7814625d694d094e3a2fb50ba0076097

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\TAB_ON.GIF

MD5 fe670dae5a67ec4be196b6159f0fa4a9
SHA1 54b7d1ce5f11146fe70cc08ba26866fbaf7170fb
SHA256 f139cd555236f56d0eb47ba750b18f9fc63dcade07ab8ac04ce3339238f644fa
SHA512 f683cf92f425b7eb74c5a86c0fdc260649ae63af771bf99ebab9a77ca1930f0c53646e042b72a1a357b6ed04fc5c4b2a5e63235b1767c4bf82326a0652908c03

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\tab_off.gif

MD5 2191f9e12b06c48ce41f2a87c3da5665
SHA1 766db16171f27a44b3fd9c73db199f5ce5c42984
SHA256 716503674b82752ece37c7fc0e302329430d675b3fe1f8bbd6073a744d1fcf90
SHA512 dce47540f50a05a3e7ee6eca61d90998b553ee608daccf43e12fae400076e862fc5ee924e4f82639ec78bd54a82895322eb283aa2064e461136e9c52b93a8ac6

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\tab_on.gif

MD5 1ff6398949983dd41121f17bb6372ce7
SHA1 9ab8267a552836d26968472d24a89352a20a99b6
SHA256 dbabe0cb31f73881e8ee5772a5872722f9326bce0694f05bc0f4ed077a3de21a
SHA512 afefd4cdad836019995189ac901920a2f1f07d6725e67ad5c54beadf5f30d5fff9a5be2965ee24bf4e042514de3fbd6e55c1e3596da6fd328265fcb85fa9c266

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrow.jpg

MD5 77ba715a0b8f4a96417464c1dff7e880
SHA1 037881f283a0ae8a1cffc251cbdbcbe03a70f462
SHA256 3c85e83631e5c64c73e89486c3fe9de952a203dbcdf7870c0d91618539c121e2
SHA512 1e021b19fff299543e2494bf73358e88224c6704152167779297820603913b0a6279d47d7d757b052f4cfa6de2138dd4ab339da7acda1c83269150b24b671f6b

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrowMask.bmp

MD5 bbfc9fee85b3cce5e01feeadade57067
SHA1 8e41a07021da1d89dd05f25d23f74f1ef5d668fc
SHA256 aecf2f6aadd43fe06a095579ee03b2741d8996f3aef6ff5c73d947ac3c989e1c
SHA512 81c8436b4c4f259a287977e7ab01a5a5d05574ab023106c1cbd82d11e1f7445bf1c271f60f46a6f70f7381ff8e2e32e0d7e0d9bdf12256278630624849a7462d

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\attention.gif

MD5 4a96cd84440185cb6450ff80f9515963
SHA1 21c23ba3bd1e2996cd4b30a321651131e1d0282f
SHA256 c483fa507d3ba541202dea8053c0294ba49babcca5a0a94d21bd13c9390a4f9c
SHA512 ff9fb1a1d03188adfcb066cd0407ef8c7661cf6b62bcd593a92a122b822b673a68a7f9a80ff17a6f87835edc21054b20bb4cb3bc69ad7afa0f5ba5157717398d

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_FormsHomePageBlank.gif

MD5 52e09aaadc8c1bd1fb62c148740939b8
SHA1 1e93c9fad83ee2c11b5e74860e053ef9b22869e4
SHA256 adc8c15207c98cb57c12a70c5e50b0cf2edbee9811f8d106619d47bd869fdf22
SHA512 9a28269aeb2950e3b5fbfa76a026051edf10ac0d313c651d986183d79a5774d38db0246549d27c2e4549a0fa502a6c807a7001199cb5aa019a90972a9026dd31

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BabyBlue\HEADER.GIF

MD5 aa0df9608730ca7882be62542c5fcea8
SHA1 b938169f5b3e2dc38859584c95bca590728d992f
SHA256 810d8e04879cb2023cf1ae4673ebbfc2c4497444cbd0d065398bc90c7d196641
SHA512 b9b8e7de87577cd2a8fa0332110d76edbff5ba1fbf834157bc43e933f89d687335935a6f5282bc756fb93f85f03300a9ab50726db89c68954759095492981aad

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightOrange\background.gif

MD5 ea00bdfe137da25d60eeda1a8cac86a2
SHA1 5ad3c2de5e197cafe4a8919dd357a622ef62dbad
SHA256 56d65fee28afcf0b6d2bb8857bd203db283f6620d1f0c1ad1260acaedf74b1a2
SHA512 4388a220e47ea3fcaeca93d55d9761a9c022f06e6b3ed3f1da2d3baa9ecffe19a4539a428f04595f14ec0826d0f368ea2703c848c8dc2481d7010dca934f670f

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightYellow\HEADER.GIF

MD5 75e246b20447144541d8e0f090ff6a6b
SHA1 e996764bb7f7ff60044654e985d93bf7cabbfe0e
SHA256 47aa405570f20e7b19b35d463009d865afb9717b8ca7378fc81db75c0e327a2f
SHA512 8e782d4a72918c8f486c5a548dbcff47f9fc5107af456366b6f3a0bbb7f14ffbce1a5aeffa92cfe2ab3e23f7711b9e22854f19f8e408c0a259a9b3ff55eee4f1

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Desert\HEADER.GIF

MD5 dc15280b790fca5bdbfabab3bc5446f6
SHA1 7428449183562ef329bc3fcdab355a3e5800724b
SHA256 a151d05b42161fee381ed99130f60c6002b3ccd97a10bd156fce5e3eed8dcbaf
SHA512 aef9a2f423259b83c48f9cb305192ae77fa5f2a45df59f6308079fa2db17dd52b7bf157cea269b6cdcffcd31579c112225951422963183b7e4f04ff0c481d3ff

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\GrayCheck\HEADER.GIF

MD5 96cc94b8826144226e703172f6996627
SHA1 a6b6894ffbce36ef1bc026cae991367bad9da20c
SHA256 72aafa23161237c3ffe305f5b60bf84def198e741b56ceb79d5c76bc5b1d4c99
SHA512 3c8aae13146a89bac8eed311248f6cc992d62e4e2d961d6df83bd3aa49a9dc3b36b5b0d424b5f69485be73ea8d2facffd7c63fb47230a1e64dc8778fba9b2bb8

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\TAB_OFF.GIF

MD5 ff57a6f0d9b9bc45e08c2d785863507b
SHA1 cb5e1611b69fc97af9585413409d8efb1069630f
SHA256 47ed0c154653cda79e633095b05b860ee59f8becbe27e5726cc133a46c9d2678
SHA512 dd14ad9024704eec2acded45e116e0509f75b4ea3681cd3466eedf245430380f8165766cc5e788b262d0490fe699b7c702f791f72d7464309714290a72ef0558

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\TAB_ON.GIF

MD5 b5ed2a4e21c005dfd68a5ddc944027c8
SHA1 b012bfaf356436773a9eefb71533295224008958
SHA256 a520142c90a32538118bfd76fb11b549bb2a295a202c7b555631dc0df18a6f85
SHA512 5e833354d4dc8cd6ff1c222ba891680ca04823fe246e9819ede09edfe4b92da8509c8d11f39e384c87577df3d589a76cf7507cfa8a62252705d3accb0f9037af

memory/2684-4396-0x0000000000400000-0x000000000040C000-memory.dmp

memory/2684-4397-0x0000000000400000-0x000000000040C000-memory.dmp

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Oasis\HEADER.GIF

MD5 2cf1c26777eaa7724e67786a6ca48a81
SHA1 9c3132acba55cf0532b85d928e83aae04dbab033
SHA256 19bd07f62873b934a29d3eab74bb2e7f5ec5ecae751fa6499759bd9316a65ef7
SHA512 5d9d0de295687fedc342e2d05dc85b35221c9ea48ad660b70cc5ce6141e3173c1080be0a7142bf1897841348d8654710c63c55b45b3d6dc779a06528e9c36b12

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\TAB_OFF.GIF

MD5 59c102ff356b708076fc11c840ea92e6
SHA1 8fac6d7712a18d13e113b7ac07fd98fb9f362603
SHA256 33b128e9614c64504e0cea976975e96337578970285d1eff73fc1c471f40a70a
SHA512 7d327ca9f5f9cc730336193db0023ba498d6dce60bc64926aeefa6be446b04a6d86637612b13a51ed74c815927f57b8b7f183e00ee5ae341679ae5d29a37280d

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\TAB_ON.GIF

MD5 999ff477de483db6fca4043de9420d7b
SHA1 56290a59a63fc0750dd4b17a288898f86cb4b7b0
SHA256 d0bd2e06848ac27e92564c6134c4b6ae9a3d236a3a62537e9e7317665bbba503
SHA512 2d48d69406231b832de3130133d549dbdb93516dcbf0baaf01c014c6374ebd985740340320a4e03522515e1c5fb660df6902e099a959e403ff47af542ec256c2

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SoftBlue\background.gif

MD5 37bcb3378c6406012f98e09bb01543f4
SHA1 491a4e728c93e72753fb220d1ed4660e77c15631
SHA256 c262c865d610f582d647c2df016bc05a6a64c65e34700661af229d020cbe040a
SHA512 ace302257f76a2a502c30535c2bec50d04c67bc45a64ef5a9899c6073892c6601ea7bc6e6033b1dae817482034bbb6797b2f6b548b99632b4da3a246df64591e

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SpringGreen\BUTTON.GIF

MD5 88f055405cb3f1036373ec29458aa04e
SHA1 6ece1dbb791601a65d92cb630acae8cb8616d4e1
SHA256 547c5402337effc10fa5a67e5dd7de9df13497bad2cfb153d29ea85e848f3ad1
SHA512 f094be8bca8731294911a1769e83f6319668dc8aba27e53fac755270136f8bf6cc94169f5ae9fefd43b22bd0e88d20d94880e8908decf12583efa99a4bd9f912

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\background.gif

MD5 145842d6c8fe02679b5deb4096bad130
SHA1 699a4d263663f7bd753fc5ce2c1bffb006b4ffed
SHA256 c88b1bc2005800f2cc6ba64dc3dcb5b2c4e008a22b8bd83e053d427f3598c6ae
SHA512 d6950580bf8b615fa2deb1eaab8a9553bc0735c7d95e1189504bc2513c2228dfd9bdea2c530e0ad83958fad87acc19c7c834bbbb44fd673709f5be4bad21e9fe

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl\background.gif

MD5 ff964617307777c91053a822cb6d7c01
SHA1 300c86581d3c540058196f97145d31d6e4114b1b
SHA256 23d066eb19d60da76aa3c00607ef20ad069ee5a3303400d427928e8812c46819
SHA512 4e81825e522ea80eb48d961aa319f42bc34101f5763324c95a2de2d9341b4e8a6959ffdf954780a2204c51e16fc7637ff8b391bbe5930dc087b9689bd109185a

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormToolImages.jpg

MD5 fb7ef9bf5138a01442a111f9176b2706
SHA1 884f716bc9ddcad0a7df541cd6afcf1738faad3c
SHA256 63205119b10b720404aa0088f988c4040d8457a57a36ae5910bc20ff09c553ab
SHA512 da53b773ac2e949b533de2f820c80581e508d6bd53de6419932ec5e1ccae44cb96611d53c44755cf96c194625ce34f995ec6458369fa1244512a29f48e54f5b9

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\RTF_BOLD.GIF

MD5 f38758e1513385075b72b53a280ab302
SHA1 d31fa8aba3282fa49ba32f1a9f5246d939c288c6
SHA256 f25cc7b3162b8817152712bb9472244d42d0e01ab81ab6ce4800b112653087a7
SHA512 ce5438aea734081098246fe499914bae2be0fbfcb8a48f85abfa30ce38c96a712dd88fffbd3f65fd0ebad77ac6b3663a018cc8b64e6afe54b3e0d95b80b7596d

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_choosefont.gif

MD5 529610eadb200dec457b8ca9509793c5
SHA1 35822e8762aa6c342503b13cf6ca546ee5ae20c5
SHA256 5830b60ea874131243788e4e92b6f6e6d79477685d09a374f966d07984a85f5e
SHA512 22100675f81a9b70fab257fa1aea73222dcec9fff39797adaeef470c0ab1433b8bb12d350cc8ccdb2f6b99419db29aafe4f11e7af612499438150cfb49fff982

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_italic.gif

MD5 5a777f24df2f3a838c54a2eeece47c5f
SHA1 b3ed1cafbb1ec3a16b40aa155868474f108b1d6c
SHA256 d65f339175116d39d5e60559939fd8bccb303f3a0c1b8f4e70fe73c04478891b
SHA512 edd206aad270b2e30f59852e3f9623d6eb69d42c95c6def5c2cb4dfe32ca0d0ffad0ceb0af6c87b2330e27055bc04ce4ccec4afb6adc9256a9fe3e112e75a46b

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_underline.gif

MD5 a1860c16a2e6d7531411610550892fe8
SHA1 b656cc0a27c3677bf6fbee9dc050e4336b3be89c
SHA256 d2fcaa260240d9cb0c73fce0db625f9317b82674c8054d878a0bedfcfa71b80b
SHA512 0899319cb416e4bdf4c0b9df22ce0c1def403f8d9327dd6e88ae53b0971f8810ecc08938969f893b86b0d3676b33d83c5375102d65dd1f67aad9274003cd8fcb

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\ViewHeaderPreview.jpg

MD5 c9a07ce0901259930e2667bb8724b281
SHA1 4490a70fe323700b51e58331cb5938e0dbc4cc19
SHA256 25ad073765302530d4d99f9faff234a46f23fa621b08a6121ab5d1b3c83c113e
SHA512 d37e64fa87b065c77dc6656312b8a4c4efa6161272cd7eca8bef04646ec619dff544c41b554d160847669d8d1c5986b56c96d726b0f2149299bfcb925de50108

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\ADD.GIF

MD5 7fe23a7a8a2b1e39855bb443c3549007
SHA1 4cb92470641a6e0d5fec3ad21c4da30f400a7c08
SHA256 46d40020b0d1e82e0ee3c81fc6338b1bea27866ec5e1b7ebbf516a8b723c84f4
SHA512 848af5a09029347af5653878c67c58f68522dd937fc078ce7dc6c0a985fb7fb209b2c70e2949b66ac341dd53f49adf8517867f18024d53024d53ab30ce16af5c

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\CALENDAR.GIF

MD5 104a8fc104adaa6ec0b908110029f029
SHA1 db9246d360163a0002e1cba970a0d8e468a00d41
SHA256 2a975372744f4901d0e527773a5aece8ab49574d300d480817d2ab5e0ba30c8e
SHA512 07221ed73cfab40949411192c34b101251cf58bc7445933d9ec8b02cd86ea6273c0043797d2e1015600593e0671cd24269ee2d311650af1b88eed81d06893ae5

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\DELETE.GIF

MD5 199b5c0a10456d55a63e1d5d31ef931b
SHA1 d768145dfb504e3f1a3abe5c2549581036455ea7
SHA256 a299207d72efd127b79224d01025f5f27cc721e4959a4fa93bab10ce1cde6a75
SHA512 f01fc015f1bf05dbfea8a793503564fd367667a519b62546eaff234fed4cb4a3f7c76c5c86f418fb9f156d4cdeb5e72acd29497c4e4d29bb6f1c99d08924d262

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\ERROR.GIF

MD5 eb6f6b867242d0d794fa5d7494a3fc5e
SHA1 999ceccd9fcdf73691d04493cc33e0e41d9c1b49
SHA256 af79cebd96f06612eac986adc6ce098d66408e751dbea2a96dc65a0a34ae9ebf
SHA512 b8d3019b33cb18cbe0160bfb88abe9d9625b545e7b54f88f29b23b80542cda356d9a099cd71d7fb67e7d2407486f2901248b214770dd7d811e7d6b24d2f71ecd

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIcons.jpg

MD5 d40f18421223be9fbafa73f4d2d3549b
SHA1 2a6192a75767259e4983e715a733fcc31f32d130
SHA256 ded969a81919b844096029bd067ce71f9b1d8a7fc84494ccad55d663bd3d76fe
SHA512 51158af49a9d4bf23bd1d844d4065b4074d15c4c080062bb9556f1592d26d6aede2fb513deafb6753acacbc3371fa6a5638b398bcf1dd1b4a22b630ba289048c

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIconsMask.bmp

MD5 5bd49cf1243394561e3fbaa0242bc501
SHA1 5c402d4629e8973676bc0233cf712cd36ab325d4
SHA256 eb0116877343e27cdd9dfefec196d1230aaff96fd38f8ec0cef4d831cb647bb9
SHA512 458621c66b057a9837c677f76f9e76122067c57df58a8c42e62e99fc3f5217eb51f4d2394713980726ceffa547ef37441105b3741036374298e6e8383d94575f

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\LAUNCH.GIF

MD5 97ac4bdc1da5ef7d7cc21a02de934423
SHA1 830ce88d496230d529bc507bd51b07123b2ab5f3
SHA256 4a8e5c94f264aeda3bda0abafc9d7236f7775a2b7d1f233fd18712fe9360be7c
SHA512 3dcee6c41ca476c8b35fc384a638abdb6de2461bf435a31b4f3fbc5e1db98a6fd69521112b42f3d8203375b728b5fb4707095b85d6486c96ec49f7db123ab416

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignleft.gif

MD5 a2b435a9ee8eba8b3a732af749cc6e99
SHA1 0909fa22df696dc1afcc5206e56c405320fb9f80
SHA256 3374217860b15d352e6eb55a44501550f672ae986b42db66829dbf79959c61a7
SHA512 b9381a90d6fb4e4219dd2d999166cd2a789021539c33f922f1e674673852f9c7eb043cf48b4f1d4e85afcca3a548e3025ac039722879b4669554fd8906fa401b

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignright.gif

MD5 fb101ff707df20cfb23be6df94c1e01d
SHA1 7d2f9252c7e8b7d929ab741d4d888007fc5d1dac
SHA256 c8df420f7ee9a895c5a7cab749e6914ff5af06adc3f74e2f74cb6a0dfd25fffe
SHA512 153b41a2da57dd541076ac7e8ffe440b1252c2a6d7bcb1c895229e65c67f02d440d24e8daeb01a9b77740ae1040b72e2b1c281ffaf8e44644c2e04a77a0ca91f

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_bullets.gif

MD5 af9eae512bb1fe024a90df083bb9628c
SHA1 349ba6a80e54ca46f3808df8bdeb4a32c9c7a44a
SHA256 f46e2e37aba8dbcc957f979861de961eb9d0e42cad9a53c994f197825f6c7bb3
SHA512 d1c24d52ba800ee9d57ba9a93b2ffd49047c8ee1c9e019ed9039be33f9ffcdad688f8233270fa2b2bf13d287f856a3bee93882d87a8abd6443aa085ddbf6e9b9

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_center.gif

MD5 f1d7c3479982db1eee8069c3d398c7fa
SHA1 924629b426685ea84ec83bee1d057041c9821529
SHA256 cac8425aa84352cf861e1334954feab1ccdd71a2b3e8a92f0a9086620077b4fd
SHA512 8e30700061a1fe0198137750e5778b9bce8cd3abf1c9a83fb77efaf1a92e21eb2cc6c80eadca920337712dec3c3358cb35f4e334afb16f8f709dd3abc3bae429

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_decreaseindent.gif

MD5 6fbe7345ffb868d21ee2dfeddbc9fca0
SHA1 7bffbec9772f2137f76843dcef120732b36d2f68
SHA256 72d6cf5bea78745a8db2207c9e3835ae4ce36c5cee1f70253886835e60990d85
SHA512 879f9d171eafcd4b9a8225d679a33ceb409d295e1dc7b18049102691ff0673623c1c082b6252d3976237d7a413408408407e63a05eba48834fd7d0c340aa4f01

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_increaseindent.gif

MD5 2cde10b142e0e2a2ef03efeca791a46c
SHA1 c323134f4c29d40e92fc61fa46468c8d3cd5d0b7
SHA256 a1a7536150a3fafa238d3862363eb66b5abd05a5b6d533a10a47c15f9944c0f8
SHA512 2f7fe733d57b00a7927bbbf1efcb73bc9ea9758d2101cbf83fe6609bcc53de0cbd0fb0625ece2ea439771c1cb2b20a9e9c6ecda9bc035b345dd88a4b45280134

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_justify.gif

MD5 b7412761d9fb158d2665c7bebefb6a11
SHA1 00d9429c8b1e28395bb5ea5d16eb33cd501c4f6d
SHA256 b90189b5db13e7a61f0ca6dc1a7e7238c524f78f9039e67b13d7e80e3bfc4cff
SHA512 7896f47a94efee6fbbe44448c07fc80af40d81fbc29da8140478419d4fa2e5e07b047366226492326596e4a4db50ff00a80d39b3c98cd6730f63e9c3040c2db2

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_pressed.gif

MD5 76495b6cf106051aa1ba8037a1ca934d
SHA1 949447acc4b553113a8261b8777ff202936e771d
SHA256 12f098b9712c6bc602a8a58a1aae93fb2e31fd70dddbd41c42be7f8d6014fa69
SHA512 ba726e2246a6253f77ace8f714d9657ff458543ff75e8411ae585cc09614d3fa3b791a766621ab9a38793258393327fff7eb118cb0b51d3f13d7c8960c38a273

memory/2684-4896-0x0000000000400000-0x000000000040C000-memory.dmp

C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Windows Explorer.lnk

MD5 5d92af01977406945c2816e61e8dfd54
SHA1 e30a5794ebfd008bf6c243bd2b85848506f9a433
SHA256 88971b384a86c5fe7286b3cb84b0975e901835cea27ccf8b5e8cfc76f8d2560a
SHA512 1a1d545689cf2712f0fee43678b5a848a98b859ad1e7f279ee506cf62456859b138b05d65cf12ecc131892147fcb5d5df9cec43e68daa8ed5535b06102ecaa2f

memory/2684-7295-0x0000000000400000-0x000000000040C000-memory.dmp

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\alert_lrg.gif

MD5 66c643fe3add0b511f0667f7190daa3d
SHA1 bede5464a77e2b9241103883351d67591f3c829c
SHA256 53841b17be03947251789fd8843814b2d686a330e353d0934ba59e8a42d440c5
SHA512 ed3f84325e86115948b8b59a534f5cd7153b9b9e1fa6e532ba092ec77eb60fd43f57bc3056bcca6f171ca59dcabe5964a864c2b9299846e0a9163a1ce9e28578

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg

MD5 95e26a99f1735b921594c263341ce2c1
SHA1 01b3a9a236573f120f0c786124ee9ff2ba96f700
SHA256 59105a9f1c1c11ca4e7abb87a266e7b2bc594d6a9d4b49d51bd4afc958b4713b
SHA512 30ee1538d076d742a8e684d157c16d71daa37f7054711bb9368e3d2f69a2795a0f972fcb298becb527eaf1dae4632aae86db09e210af75f1ad554eb07e8a484c

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\aspx_file.gif

MD5 c4c893bd72e7f20347c96166150212be
SHA1 b521785d1972475fc0451b4e185b69d70a0f002d
SHA256 b3065b47d6999dd2dff7f1cbd2a490a1a0cc14925264e77ffe4a78c40f2fa014
SHA512 d9a994ad6d864e2b890047e14a55cb354d03a782387276f45dce56019ce32daf4e25d01d59ffe337e54645f7f94ff790ae81218ba04a37b941295066e11e5da5

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\branding_Full2.gif

MD5 92ca8e0fcf7c5f1c4094b66090b90391
SHA1 73f9dada15010e660e996c270b7e66dd4fdd4cff
SHA256 e3bcfd660c68d3dcb98f84447d260f4adccacbea46f6deec8dfc315a0ae8366a
SHA512 1df478d4a29b9b853d4f4270a48d1233afe397537ef6685e2a9145b00e89fba82780c4638afe6fc8dd14ebfb17b5429a8492c40e531fe674df41bc674ac6057d

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg

MD5 48d0e43e1ff4c61cbb4819b6cc87b8e9
SHA1 78b5ed201b438366946419de394450d6dd63adcd
SHA256 f8642f052cfe5bc6543252bc9ac14dd3d5323d7e9cafe0e2e0d4d8ce08224f6d
SHA512 d7ace69436d70f1b19b0069ef55773d8e9a2a9b8ce5795649141deb9ec2ba83b42b836830e3bf53f2be66ff3f6b14a7ac208b908864f100ed492048158240750

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\gradient_onBlue.gif

MD5 74a92b45e5cded1b5af9fcb568ef242d
SHA1 c5d110452493c1b92cf3db67b39779e5a3e7ec6f
SHA256 93afba154fd15e29879528cd877791b73dd2acbd8549020b912450ca3e26dd59
SHA512 72eff94a1b385c602720d437e8d1ca273c0c7556b2dfeefe571e455ab884574ab80e2e19770572cdbda0330fe5d19388aa8da7d82d703c4a5dfc53163e8b8c8b

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\folder.gif

MD5 91f00ff2312c7974c0d2902391da8399
SHA1 4f8ad04d575cc8914fc6cf58695429836eaf711e
SHA256 542013c56fb0fa58084282b35891362bf8d2a516cfcc418ea3efc7e8a37db86b
SHA512 42ec7fd1e2646ce908e60480d51c021ab4fc78aae43e8004b33400d38d620c3fbbb4454d61cd7ee8db84d7742085ad2eecac0e2ac090af52c642d942614bf2a0

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\gradient_onWhite.gif

MD5 c184ee4c96058287f30cac484bd9ee8d
SHA1 7a8ee8b9769d276b1aeea044fc74c1cd441a3d6d
SHA256 45ee7e26cb782243f7ae1f50c99dd6bfc77fe844dccf875d349781ef044ba4c4
SHA512 a40597141e860e48bf58f8a6f9d41edb8ea01a6cf3baa82d86242898c4b44821471722b5bd12c3b42ac15f8c989ad9697c724026555d8585c9ac25792418e495

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\headerGRADIENT_Tall.gif

MD5 e464aeb5dfe85b1a1ccb00ef09935905
SHA1 f89e3586da1385be7826f4a3163bbe75ae84594a
SHA256 ab393467312bd56b428392b869cef5ad1778ff3af8cdc4c58d636600cc597078
SHA512 3efa2c00c0b96e566a3aa9d5b0ab04a75116655a7d8af0e45795e26992e31ac8f8f5f696b76573c2b208232ea53b8b8b33514d957fb9a25ba719733c641f77e8

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\requiredBang.gif

MD5 0cba4e5e16ab58e7b932c885915de1d2
SHA1 07cdfdd0dd483b5200e3e8a838cce317365534a9
SHA256 6ae30d8599094052b05af2e94519d3f0f8905a425ed9e6538ee3b65980f9bce3
SHA512 366d986db2aec0158a48d079f1f12dc30d7cf1db717cf1608d95d971d0d9850752a87e938533f3062a8c15126c5fc3a13249a0d2b44b58fbbbfcfc997cd08e73

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\image2.gif

MD5 f1d235b8ead9bae3004d2828c13c95f6
SHA1 d88007a4623301884d63365b7f5f5576adea7e92
SHA256 feca6b69af4912dd3b1f04dfc091bd73070f2f29abcdc38ef69f185526f5c769
SHA512 07af1cd5cc2e753b056d2ef70f1775f40b814721672229f243f6cfe0f2a3a0ad7952ec1b903e870c355f135a65d0a1334403e3370c72d71b0fa6e36cbca97577

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\image1.gif

MD5 744e7b23d328c836034fd5ca01423ddf
SHA1 b1e81e0d03a722341145e2e4e17dd69dd2285010
SHA256 727ea69cbf7f5d1e7bfb12d05ca3adb4ed647b548a41eadcf7ea66508aecdd4a
SHA512 f7c9facf0e90e8a091465fe124389b89793c55b7eed21bab610da5a606d57e9009ce9c394b60ee6cdcbf118b628cdf9f37d58d49c0a8370c3f1a95edf81f1ad5

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\HelpIcon_solid.gif

MD5 41526eaef057cc772abb093fcf3a2f09
SHA1 7ac26633f72ef4e634f665242977ceb9405bc983
SHA256 70964a3775e2d2e9dbc68ac218fb0a30b45460f8327d0dce70eefa439f9de82d
SHA512 89d44d65d738891559d0ee3e78fe3dfa46476d7418b5be8d989f3788d19a09914b41b2c8cdcdb126b2e1fc106832382038a2a201d2df6e531bd375fcca38162a

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\help.jpg

MD5 6e7f2dd48c147b13d485f6c839d41846
SHA1 ab257d2d00400f165c3848af78e984f9cb6bf767
SHA256 f7e05c4121962c4c052c81b0b8c0151afa4ae01eb2b52c37f4c626c2f9a22b05
SHA512 7f36fbfad0aeeb038ecbdd3bdd182cdecbfd624db8f7c69e58f569e35e29c592db66dbed0aab025ecaa9c1f7cf6c6df9957195207288c42feec72f6de0814789

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg

MD5 26ba333e7a7d012f740b211ac508d149
SHA1 ec4b64c6de7c16249ef9aa7ad2c28cce782f7140
SHA256 315291cc7a3b5aa1fc7eed56347bdd68fdff3cd77240ee58ad07b73388408de3
SHA512 0acaa61a8b6f6984137d20389a7c6085afbde06df45cff2fb112bf9884280b7dba6a38ceb9cd92124f53c1d1a9ffea0691a371525da4048c2ba8358f57f621bc

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\yellowCORNER.gif

MD5 7344a100eae6134cca920134ba6f3d1d
SHA1 02659c0b1d95addb9498beac7faf7d0acac7e34f
SHA256 8f6ab273a64fb63622e6c307b270f5d5c9c6ce9012b385ed5e5426801899eba0
SHA512 d61814141277177fe26dd04f86bf736d705cd655db9342031945d1a89f5a39913f3d2d1ac2a7826ce1561a544dfd6a8bd0f24cc6459ddafe54f8f49da1274607

memory/2684-9175-0x0000000000400000-0x000000000040C000-memory.dmp

memory/2684-9176-0x0000000000400000-0x000000000040C000-memory.dmp

memory/2684-9177-0x0000000000400000-0x000000000040C000-memory.dmp

memory/2684-9179-0x0000000000400000-0x000000000040C000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-12-09 11:49

Reported

2024-12-09 11:52

Platform

win10v2004-20241007-en

Max time kernel

94s

Max time network

138s

Command Line

"C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe"

Signatures

Detected Xorist Ransomware

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Xorist Ransomware

ransomware xorist

Xorist family

xorist

Renames multiple (2190) files with added filename extension

ransomware

Drops file in Drivers directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\drivers\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\drivers\es-ES\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\drivers\fr-FR\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\drivers\ja-JP\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\drivers\uk-UA\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\drivers\de-DE\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\drivers\en-US\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\drivers\gmreadme.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\drivers\it-IT\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vQVykYApjMM758B.exe" C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\System32\DriverStore\FileRepository\prnms003.inf_amd64_0e2452f597790e95\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\prnms010.inf_amd64_9e410195c3b236c9\Amd64\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WaitForAny\es-ES\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\c_fssecurityenhancer.inf_amd64_e84a289dd0df20ff\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\fusionv2.inf_amd64_a47d9636ce0d7dab\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\percsas2i.inf_amd64_a7f5d94e6751c911\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\bthmtpenum.inf_amd64_3abc48e730d08fde\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\windowstrustedrtproxy.inf_amd64_db5be14d5e02560f\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppLocker\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\urssynopsys.inf_amd64_057fa37902020500\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\MsDtc\es\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_LogResource\es-ES\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\circlass.inf_amd64_9f3f831d13d3df1f\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmtron.inf_amd64_0b075e1cb11005f4\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\swenum.inf_amd64_16a14542b63c02af\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\ucmucsiacpiclient.inf_amd64_a233292790c69f03\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmdf56f.inf_amd64_1e78e192efc26192\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\netbxnda.inf_amd64_1fff3bc87a99b0f1\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\netwtw04.inf_amd64_c8f5ae6576289a2d\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WaitForSome\de-DE\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\@AppHelpToast.png C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\bg-BG\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmsmart.inf_amd64_3ca4b12cda56232e\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\c_fsinfrastructure.inf_amd64_1ef682cfd6fc7d1c\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mrvlpcie8897.inf_amd64_07fc330c5a5730ca\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\InstallShield\setupdir\000e\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppBackgroundTask\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\AdvancedInstallers\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\image.inf_amd64_d2006c0517ddc60c\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdminfot.inf_amd64_564561a23e05c7ee\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmneuhs.inf_amd64_eb59a40d88060ada\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\wvmic_guestinterface.inf_amd64_192114845ec44b66\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WaitForAll\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\c_display.inf_amd64_c7457a37d16eaadf\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\c_fdc.inf_amd64_fe3599e7eac09e7f\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\ialpss2i_gpio2_glk.inf_amd64_dad1e0a2b185e32b\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCClassResources\WindowsPackageCab\es-ES\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WaitForAny\ja-JP\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\Configuration\BaseRegistration\it-IT\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\audioendpoint.inf_amd64_4fc4a632c1490033\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\netrass.inf_amd64_7f701cb29b5389d3\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\WindowsDeveloperLicense\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\c_system.inf_amd64_184528953a6fb673\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\eaphost.inf_amd64_d37080dfb66d830b\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\tsusbhub.inf_amd64_bd91a147ab4ebf1c\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetEventPacketCapture\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\NetworkConnectivityStatus\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\IME\IMETC\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmdsi.inf_amd64_0b96cc4cfeb2cbf8\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmusrsp.inf_amd64_4c83ce3a06d0048e\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\prnms012.inf_amd64_707d3849370b9d23\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\qd3x64.inf_amd64_fd7b06296b7ac679\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\oobe\de-DE\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\Configuration\Schema\MSFT_FileDirectoryConfiguration\de-DE\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmnis3t.inf_amd64_9f214efed426c12a\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\netbc63a.inf_amd64_7ba6c9cea77dd549\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmdgitn.inf_amd64_6360d736a6f64e35\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\F12\it-IT\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\sr-Latn-RS\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmcpq.inf_amd64_3acec385f5d67bdf\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\F12\es-ES\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\CimCmdlets\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\Bthprops\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-96_altform-unplated_contrast-black.png C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\de-de\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\illustrations_retina.png C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\LinkedInboxWideTile.scale-200.png C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\StoreAppList.scale-200.png C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\root\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\RTL\contrast-black\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\WideTile.scale-150.png C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-GoogleCloudCacheMini.scale-125.png C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\skype-to-phone-tiny.png C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\images\PayStoreLogo.png C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\LargeLogo.scale-200_contrast-white.png C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Assets\Store\AppIcon.targetsize-48_altform-lightunplated.png C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\423x173\30.jpg C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\PeopleSplashScreen.scale-100.png C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\AttachmentPlaceholder-Light.png C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Yahoo-Light.scale-300.png C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\AppIcon.targetsize-30_altform-lightunplated.png C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ja-jp\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Program Files\Microsoft Office\root\loc\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-40_contrast-black.png C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Images\SkypeMedTile.scale-200.png C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\MixedRealityPortalAppList.targetsize-20_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteWideTile.scale-125.png C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteSmallTile.scale-400.png C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Collections\contrast-white\LargeTile.scale-200_contrast-white.png C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\tg.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\default_apps\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\ky\LC_MESSAGES\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\EmptyCalendarSearch.scale-200.png C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\GenericMailMediumTile.scale-100.png C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_US\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Diagnostics\Simple\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.scale-100.png C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\Background_RoomTracing_Success.jpg C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\skype-to-phone-small.png C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosLargeTile.scale-200.png C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarAppList.targetsize-72.png C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Home\contrast-white\LargeTile.scale-200.png C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\StoreAppList.targetsize-32_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\redact_poster.jpg C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Program Files\Common Files\System\ado\fr-FR\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Program Files\Common Files\System\ja-JP\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Transit\contrast-black\LargeTile.scale-125.png C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\Assets\tinytile.targetsize-48_contrast-white.png C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\AppCS\Assets\FaceReco_Illustration_LRG.png C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\AppxMetadata\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\capture\shutter_button.png C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailAppList.targetsize-256.png C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\WideTile.scale-100_contrast-black.png C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\Assets\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteAppList.targetsize-32.png C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\GenericMailWideTile.scale-100.png C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\hu-hu\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\ja-jp\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-32_altform-unplated_contrast-white.png C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-24_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\Images\Ratings\Yelp6.scale-100.png C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-96_contrast-white.png C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\TimerSmallTile.contrast-black_scale-125.png C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\256x256.png C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_neutral_~_8wekyb3d8bbwe\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-20_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\WinSxS\wow64_microsoft-windows-n..setup-compatibility_31bf3856ad364e35_10.0.19041.746_none_58702f801199ce06\f\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_windows-media-speech-winrt.resources_31bf3856ad364e35_10.0.19041.264_fr-ca_dced12cceb55fa7d\f\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\msil_microsoft.web.manag..davclient.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_35bac403e777d25d\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-d..ingfolder.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_95263f064befbafa\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-n..n_service_migplugin_31bf3856ad364e35_10.0.19041.746_none_469c8467dd7d2578\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-i..mentation.resources_31bf3856ad364e35_11.0.19041.1_it-it_8eddfc8b2e0b842c\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-m..nt-browser.appxmain_31bf3856ad364e35_10.0.19041.1_none_b1e502c19c2a358b\Square44x44Logo.targetsize-256_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\x86_microsoft-windows-wpfcorecomp.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_ae693cf36a495170\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\aspnet_regsql.resources\v4.0_4.0.0.0_it_b03f5f7f11d50a3a\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-s..aryauthfactor-winrt_31bf3856ad364e35_10.0.19041.264_none_b97ba484f49769a9\f\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\msil_multipoint-wmsdashboard.resources_31bf3856ad364e35_10.0.19041.1_es-es_f7b351c279a6b3f4\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SystemApps\Microsoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe\23\common\images\tree_icons.png C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-g..-admfiles.resources_31bf3856ad364e35_10.0.19041.1_de-de_6bd480430b68168e\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-ui-search_31bf3856ad364e35_10.0.19041.746_none_d30a83ff81d13ba6\f\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-webio.resources_31bf3856ad364e35_10.0.19041.1_it-it_42156f93a232a479\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-d..providers.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_c976a292fae256ac\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-icm-base.resources_31bf3856ad364e35_10.0.19041.1_it-it_2e8e8b232963b7c8\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-r..izard-mui.resources_31bf3856ad364e35_10.0.19041.1_en-us_4466ad3340812e70\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-p..inscripts.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_7175eaaf1307a2f9\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-eventcreate.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_fd37ab7523def73e\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-msmpeg2enc.resources_31bf3856ad364e35_10.0.19041.1_es-es_27eb4a82003d4fc6\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-fax-service.resources_31bf3856ad364e35_10.0.19041.1_de-de_e7ec241ca624202c\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ets.fonts.searchapp_31bf3856ad364e35_10.0.19041.1_none_c3f9da47d3bad2b2\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-softpub-dll_31bf3856ad364e35_10.0.19041.1_none_998514c21e4acb23\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-t..etoolsmqq.resources_31bf3856ad364e35_10.0.19041.1_en-us_d5eb94b67a532880\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0\9.0.0.0__b03f5f7f11d50a3a\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-d..outercore.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_2632014a5d0cacb3\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-u..usnotificationuxexe_31bf3856ad364e35_10.0.19041.153_none_51feabe070ab84f6\X_80.contrast-white.png C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-hyper-v-vstack-debug_31bf3856ad364e35_10.0.19041.928_none_e22c6ae2239eceef\r\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ngservice.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_0a74a0583789ad29\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-microsoftedge_31bf3856ad364e35_10.0.19041.264_none_ef195f564f00d259\MicrosoftEdgeSquare50x50.scale-100_contrast-black.png C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-w..utils-dll.resources_31bf3856ad364e35_10.0.19041.1_it-it_69f198896adc8877\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ment-diagnosticcsps_31bf3856ad364e35_10.0.19041.746_none_a4135e9f727bcecf\r\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-fileexplorer-common_31bf3856ad364e35_10.0.19041.1151_none_ec76581f556a7020\f\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-getuname_31bf3856ad364e35_10.0.19041.1_none_eda2e09b6d4d9dd8\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-d..onfidence.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_3fa28029d783125a\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-fax-common_31bf3856ad364e35_10.0.19041.1_none_cc4a66bf245ed011\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-a..on-logger.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_88ae48e8b93d3073\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Resources\8.0.0.0_es_b03f5f7f11d50a3a\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\WindowsBase.resources\v4.0_4.0.0.0_es_31bf3856ad364e35\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-m..vider-rll.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_18d73ba20bc6ff0d\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-s..tenterprise-license_31bf3856ad364e35_10.0.19041.1_none_1a10dfb5f7f25149\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-i..trolpanel.resources_31bf3856ad364e35_11.0.19041.1_fr-fr_aef00096e55c8f67\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-t..honyinteractiveuser_31bf3856ad364e35_10.0.19041.264_none_a61d15efb6291d40\SendPhone.scale-150.png C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-i..ultdocumentbinaries_31bf3856ad364e35_10.0.19041.1_none_3a33b048982b337b\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-s..dminflows.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_5a7ba8144123e555\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_product-onecore__mi..p_src.inf.resources_31bf3856ad364e35_10.0.19041.1_en-us_02d4458d4c92e8f7\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\msil_eventviewer.resources_31bf3856ad364e35_10.0.19041.1_es-es_23ca30549cf7cdad\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\assembly\GAC_MSIL\System.Web.Mobile\2.0.0.0__b03f5f7f11d50a3a\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-w..erclasses.resources_31bf3856ad364e35_10.0.19041.1_de-de_b98f606bf6b21618\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-wininit_31bf3856ad364e35_10.0.19041.1_none_f13870a4d80eef18\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-winver_31bf3856ad364e35_10.0.19041.1_none_7697361270372205\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_c_biometric.inf.resources_31bf3856ad364e35_10.0.19041.1_en-us_058d0d809f4f9960\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-update-orchestratorapi_31bf3856ad364e35_10.0.19041.1266_none_ae717274fd678579\f\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-certutil_31bf3856ad364e35_10.0.19041.746_none_937e52b9922bd791\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-m..osoftedge.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_45a6c0aa2ed16c7c\LearnMore.html C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-ui-shellcommon-core_31bf3856ad364e35_10.0.19041.1_none_91b1f58702057373\CellularToast.scale-125.png C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-enrollengine_31bf3856ad364e35_10.0.19041.1266_none_17fe6387a82e5ee2\f\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-hgattest-catrustlet.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_3d31d3dfa3dfa535\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-g..ation-wincomponents_31bf3856ad364e35_10.0.19041.1_none_51b7888297a3c04e\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-m..simple-provider-dll_31bf3856ad364e35_10.0.19041.1_none_75822d5664503324\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-management-oobe_31bf3856ad364e35_10.0.19041.1266_none_e6ebbe2a02425392\r\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_es-es_12451df02dbd2879\403-9.htm C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_uaspstor.inf.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_e371e7a1e1e933b2\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd\ = "ZIBXKKHVYMVCCPW" C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ZIBXKKHVYMVCCPW C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ZIBXKKHVYMVCCPW\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vQVykYApjMM758B.exe,0" C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ZIBXKKHVYMVCCPW\shell C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ZIBXKKHVYMVCCPW\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vQVykYApjMM758B.exe" C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ZIBXKKHVYMVCCPW\ = "CRYPTED!" C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ZIBXKKHVYMVCCPW\DefaultIcon C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ZIBXKKHVYMVCCPW\shell\open\command C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ZIBXKKHVYMVCCPW\shell\open C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3000 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe
PID 3000 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe
PID 3000 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe
PID 3000 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe
PID 3000 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe
PID 3000 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe
PID 3000 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe
PID 3000 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe

Processes

C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\d9789bfbc54d5cb6d52c385fd8f5d288_JaffaCakes118.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 133.130.81.91.in-addr.arpa udp
US 8.8.8.8:53 68.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 212.20.149.52.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 20.49.80.91.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp

Files

memory/3000-0-0x0000000000400000-0x000000000041D000-memory.dmp

memory/3000-3-0x00000000021E0000-0x00000000021E1000-memory.dmp

memory/3000-4-0x0000000002230000-0x0000000002231000-memory.dmp

memory/2816-5-0x0000000000400000-0x000000000040C000-memory.dmp

memory/2816-7-0x0000000000400000-0x000000000040C000-memory.dmp

memory/3000-9-0x0000000000400000-0x000000000041D000-memory.dmp

memory/2816-11-0x0000000000400000-0x000000000040C000-memory.dmp

memory/2816-10-0x0000000000400000-0x000000000040C000-memory.dmp

C:\Program Files\7-Zip\Lang\HOW TO DECRYPT FILES.txt

MD5 84aa889a87f60a5efba19bf8d6464613
SHA1 4fe67d41d2ed917651e5820f131780bf078e3c7f
SHA256 43fc35d4b08e00236a28300d95f7426593db8f95f47e995477a77bfa5fb0ec99
SHA512 1d67c2552d16b8c9fa33417d45c8229d291077f45a12692d8a7e9ade813dbc629a4b13eb4107a773896386b9c4e6993fbefe54348568ef28f44f40c6153ff0a4

C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif

MD5 27c9d1245163f6a2ba76cc91b0c3bb3c
SHA1 5f126d6fca1dd15ee1a058e5e96a0b3c89dbbfab
SHA256 e25e7c97fca79b1146429e074fd830cea1283c464836c5b0e9676054e9469542
SHA512 c331ac3a69f9c599bf00cf6bc934ddb6195d8454af11603a7e954115376c8e0d1d7d9513357c2012c200a57e9ef6d43caa2d3bb3f2eae4eb0a063a825edf616d

C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md

MD5 447ba3078ae39c96bad23284c0ce1c37
SHA1 407e455937c8a09cc916aab769f35c0a328622da
SHA256 fb72cbca2416887d19dd6c75032a265d4d5f6c45304ae2eb33ba7b92583f412a
SHA512 f5e99b5ec64b071cd6c33c44559a07e79c5a383bb7ca8e22dfa7e7cb52411e3ca9a55b24519664c7827f019f6986aa6a2eb07dbc89eaa25fac1c10d1fafa7300

C:\Program Files\Java\jre-1.8\legal\javafx\glib.md

MD5 0a61124ff4d5f5a4a8877a01c03e7e85
SHA1 0f5d643f988157f06fcd64e78ad53722c63379bc
SHA256 b01dd5be355ca9febb829e219f9a1d7ba82bba03128895b95df4a0c85ff0405a
SHA512 a9baa426a3ce56d6401a9a46afcc12c355eefa1a974535d640ea52ad697d307bba6fa5978ba86b13221c73909f98a54bfcb7685477850dc9e77fc2d021c7a7ca

C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md

MD5 62fc029f21f901df1a8b3f7068fbc679
SHA1 13f2627718807512efbd105c157e06ef33ad57fa
SHA256 3a082e02197b77cc70741d4339c2ccf2d89413f696ea1a4fda5c63790acd165d
SHA512 c4980e6658e4724d5868cf3c58422f3962d715debe02e2bdf0f31d918f013d169521dc6edea92feb35e5f7f52f4887a07b12aef49a0c933686288ebf0e0ec21e

C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md

MD5 24e46dd90848f164ed8ed0af5211f0fb
SHA1 3126b4a0e282a46a71c416e78c0313134ca6161a
SHA256 7d5cf5a621b00c8aa82f189226a23c96aa935ba6e01b33e41e34434da006c8ae
SHA512 54ee08298c9778f3f13086c65cf71a43fd84d355ff59b194f19abe1d5592998573cd5fb120e7196e6acc9747fde12a97a840bc964cfe624fe9ce46242ff85ef2

C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md

MD5 cd7df679fa4e95668164470324d1eabf
SHA1 c68d6eb1b8bddfea694f04849c2e630d20a441f0
SHA256 481640b504204be5790aa88b1ee1ba09f455151a182751f51b99840b44360fa3
SHA512 3e7895b2d0edd990dd999f73ff2f6f6b7995e20833481087e3fcdbef1802296bc6e4cc2be967fd322c48171ea066a963cebc047f72a09c236f6c0181d8b7311b

C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md

MD5 6cc01d5205d4eec2db36048c409889ca
SHA1 6fa02d3ea4d0dd2f2c002fa149e495759d9a084a
SHA256 0c5a6bb3e2d0c5f28ff3d51735e20626533befd8f73d2dd2d32d7095797a09c4
SHA512 28988ff14047d4890db5f7f477cfc038a372eda7318fc6dd7dfb7859f2ed969d6ed1acf256ad3468808ac8f96c3d9df0ae6353d9d48cc6e62cfb3b67a34e1c1b

C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md

MD5 bc95c74cd948546d8d4951c2e6525fe7
SHA1 ff6e0e18cd8feca8fa360cc8d1f4c5640e91016f
SHA256 8ade00f1a561cb6ef988b2ea80491ebeb90d2e6c0053c16d3599313ef4465078
SHA512 ad5ae0f72d29528b52b95b0b05e61d59d5542d3e2be7fed368b4aedd586ee58d522b9da76de5d7c19e2182396d54a82cef8ef992b49b9b6607c1b8e9f6ac54ec

C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md

MD5 2138d8e6dc4c2842e859fafc4b374f48
SHA1 22f6855bdd11690dc136b320a177bd22224ed51a
SHA256 edb4544c79834f9d09af2ff71761387f187aae4843516604cd0a6e72dfc87c59
SHA512 f729b860c2dd48dcd17cdb68f28653e6d3a21f76d82105a2f75982e59b744435fc5f4ed82836629d96b7ec72aeab505efe435b5f03ca58d8d22cd0ba86dfde1b

C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md

MD5 d3171f6edc094f61cd44236e1088d1b7
SHA1 0dd2aaefc21c3f177f14ab2d1cce51bca560e604
SHA256 89d42d61a9fbfc6fa5187df61bc6b23108d0ca20efa9d48d19c86b069bce77c4
SHA512 2e0a6dc4a5e757a8c53ee742ed7eacb721700e8671460384fa6e60d0448255da1e247f6da47a7a59998a4b3ab2cf2b035a7f5913b3d0ca7a973f9d27aa080cb5

C:\Program Files\Java\jre-1.8\legal\javafx\public_suffix.md

MD5 ea7ba5a415f120f7cb54d79985e04fe4
SHA1 c1b88c54fbc3539cd1e25decb277a23d0030ffcb
SHA256 62f0ff6ee63cc7e5c11a004109828a5c79e05906dd8e650b095ba99b6ac5c790
SHA512 df0e3de5bdca4d445f084794e837d8098b95270dfac65112cfcbea4c041ea023c91ae034c0a437eed420008adc6304b56d7232839c4fc34a3ee3aaee7069c0a7

C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md

MD5 f98dccff5d73ca90421557f690008b6f
SHA1 46d23a7d333888a1a332674784fad6c206e8ea52
SHA256 fab0df9c789cc984987c78dcdc254d371b2e6316e8484d428ede96f5cd44dc26
SHA512 18e9380c3763b7c7dca6a36ed83d89671480c69e99d9e5b984f59521cb85ae82060b2faf458135953bdf6ad00bf24853ed23f905ee896775620ccabbf29a0777

C:\Program Files\Java\jre-1.8\legal\jdk\asm.md

MD5 5b9bf7c00a193c1b622d3a3c64ec31a1
SHA1 17f5c63ca77bb07df2def21694561b2ac9ab9a8c
SHA256 6c90339cd7dfabff5ebd48745e89012db00c0ecd0b4fc9a6e178e1c31804eff0
SHA512 daaf102852ed8c2668c2cb3353efff1f712620f2a3db72b565bc0faf2e8cf5e96749104e18d3b57aff06be21d4e5e331dcdb895851513391ad2897c267af177a

C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md

MD5 3a0b928f57979541130f1e8b56dbe3a0
SHA1 e35beb4d0cae820e9887c457c4f240ed2d3e6700
SHA256 b6bd0a404ecda0fe3de79292938e4c55b2a625038470eb575482b4ffddd16979
SHA512 dc731b0338b6953752ba7a0247828ad214b8da7bd31df46372f4359fab025f2f9743ad94555b3c4cce8be0ff76eaa766fb1db850fd5b62a6e59092f368ba16b2

C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md

MD5 1e40ab651b8fa79fd8660a7cf5220886
SHA1 c33c170e510fad9dd2d0073df05d80ba38c7584b
SHA256 eb96a1ec2b646f70a4531b150f308550d53182c9d574b72c343a471ae748b1a8
SHA512 a254a3023a4cf55a066a61c44bd818eb40994ee471ce2bc16dcab4d589f5d8b51f1f99dd49603b0f21c102e633837d9e5a01bb1a895362eda2aa590bca812bd1

C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md

MD5 d89ee322babbc83289180cc7cc83c05f
SHA1 2276ccd03b7cf06f935a66720252061941a9593f
SHA256 6e50614b4cca3dbb28c2ff6c0c908507b60ed710dd7ce115e974d06872eeb498
SHA512 39fa84c9ddf27331597090960af8a96c3e2bfef1bb328e457a31ca29fbc093a4866b191c2e1baa79b35ded544fbeaff4c9a43817fc2d37958ed69b19835d3d0b

C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md

MD5 5d556908daf9cd748181dc320c63a44d
SHA1 1a1e1715cce0cccb7795163b753587f5586b2fdf
SHA256 886abb82a69889db6fb21d7be3183483aa46b8963c817423ca8dbbdf841ffc67
SHA512 2812b2a7d4e14e3178b82dc68bce092ee9a87c03af0c55413cd225103ce8808134900a1ec36222dfbb4fef8f1902402bb7e99abd2bac1e1fb591fc48f8be8e68

C:\Program Files\Java\jre-1.8\legal\jdk\dom.md

MD5 07c656010b4241f8038e9054226b97d7
SHA1 1352bcf05d373feda4df2925d5c58d969faa0b36
SHA256 d93c6864eafdc7b7cae2df8c0c7ebaa0e5f2f69939d0b1b6a5935c63478fd95c
SHA512 a83d0a41186e2afef2ea76b7a31443043f5e391876019ba269ef3974edd7e4b70f0cd10266998701f7fcecd6712d94f5ec3eff96aa58b7c3450e50006f6da1e9

C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md

MD5 b12fc4195c69d41d03a4535d825a01f0
SHA1 1f4ef8d178888182387d61c5451a731b5f369e11
SHA256 987cd759c0f19bbcc56aa50ad588599c7a549d3f2535d7e51c1503cd91753988
SHA512 d92701a8f3bc5e0e16840056e274c52921113567386648b16396b6616445119d998bfcb31da51010b25437cd54d460f4659b2d756f8bed4b1a32af31cf49e687

C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md

MD5 b42114995b66874e65c3fcec2e89c375
SHA1 f1b2f091e6b42c2d9cc74a3ed8aae7fc4dd58666
SHA256 4a82fe9743373256d199907fca7dd6e3b156764dce58576b272c67857499f4cb
SHA512 7c8a856ba15ee63bd5555518c69a130bbc0ae8f6fe607709b28605cbff80b46df7174466228c8626c2fb16de25888fb7eb8f38c7812bea68f0866b7f55351bcc

C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md

MD5 771242022f8e2a744f95950de824592b
SHA1 be11ef5269f8377f77fea0d44e8d255dcaa6367c
SHA256 c93aa5f59901c20a40a2f0632d1d08d899ed2ff1e9834cdb790a362df8a0dfe5
SHA512 7188047144704851aaf58fe0a3aab20d987368a02eb20c8536f8452f4866ee23b2e2f1b93ea0396ca428614a240a9e0433fd4e3d7c9bb53a3bc38829902c6bd7

C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md

MD5 2300cddbe7b5d2f9840ca30dda229f20
SHA1 91854de0d057a1b244f290f661412f2fd22fba49
SHA256 274d6bc145fa91c54e7ceac1c2076f2019741249711aafc429b31283981b7403
SHA512 80c8ccd0cef2e64a54315e0f662977edd537478c109f06a27943a1e5546ca3e5968d492cfcfd6f364cdcc24ceab4957c29538bf2de61771f1ad8d2bb87fde3da

C:\Program Files\Java\jre-1.8\legal\jdk\icu.md

MD5 dfc0fde76a3ef23b5cc19fcf4f942d9e
SHA1 0e534e2e58d4c5dc9fd1179219e2c53c845bbd00
SHA256 85b51240ba6b44e961b61984d82752b2040ea89a58a1fc75e3926995737b1804
SHA512 2405710e6cb54f980ff06a95a04266d750a516198b443a7b3296440c80afe27c3757e1e18beb49834481f90c8f57c1ee36fd4d4db39946607a18e4751ac75576

C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md

MD5 b37de7090c0461728c0f4440b9d659b1
SHA1 debdfe834fe042938ec17dfa7a0536f89f274ffb
SHA256 70241000a40bf3e3ed1f80162acfd3bdfb551eab0fbb35a5858460d9e159b667
SHA512 57788cadd0438879eb1cafc9e32b616f9e2d85732b830ce852d97a48535b42a407e4e0bfea8770652c5cbe1a912dbb0173a0421d13fa876d6c0bdb39688089b4

C:\Program Files\Java\jre-1.8\legal\jdk\joni.md

MD5 edd1cae4cc4bc7a88e2fb96464e885d0
SHA1 60f44f61d2cb1666e6619c48f9b6eb191439524f
SHA256 e86bab5ccc767da63b6799d2a7b7ab7be8e298b203382477204ef74c158d44cf
SHA512 dc6e6874150259e957a1928e6a7008079c6939c4f69ae5c49e82ebf1e71ae7fd60a2b230c5d2e2ad308ce0381c902199e2422908aecadce18f6ce4acb791c173

C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md

MD5 80e7bad3dc9dbee24849dad9cd734a9c
SHA1 70cc34f74246f6c3f9c666022c8259b20612ed5f
SHA256 1cefb01933c29f688116208f8df5e0c72a23431eca82ac82e56e2485793a3834
SHA512 33b2ed9f9c68d7944a1ed7581f133e4d6b4bc1ead9d05416169b8b66a40d01068548e4c0ffff9a31e8d0b9703d86831a64f492477ad94cba09f512cbb1336941

C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md

MD5 ac9eb4713a288421f9d8766cb622d9d9
SHA1 fcebd66c899c077f63704d2f699b12f9260273cc
SHA256 566cae4fe94744824db4e1b1fd0c04efdd42e61e47126e7c8c0b4ceb89df9b46
SHA512 c17740a745a0197ae73d14ea6530f55d2982710b989763ac184a0971a195663fd22b4de76aa885a97d1c72ddba25bdb4b2b458143d679e34256d7b788c8a21f5

C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md

MD5 897ea2f793badf25a193bf6c8b5eb50a
SHA1 b7a8b181a6e4b8df2a903c6d7e385e5e39a54277
SHA256 ad68f7cc4f3ce9325d63e3195c3e861d7d50c7b1a89dbc02b7c858df570a372f
SHA512 0a79365e7f1aaa356a70fb995c9ce51a9e3014b56b967e59b12d20dffc8614ac114bb98b1ed56dc018905c6d769071b32ada2e92c3d5d5ce11749c2703948962

C:\Program Files\Java\jre-1.8\legal\jdk\libpng.md

MD5 8bd5eb39a0c5cfde449b8f2a8dbca4ef
SHA1 3d1be6338ce65a2a2ac0b4165db24ae1d65cca93
SHA256 3b9180e2cf0fb6cc80cffb6808fe87b731db12af5cf9b2ce0f43d585599b841f
SHA512 6f7f1ddf36b7f2c48ef0dd01bf1621ede5829e217a0f286bbef2486cbb89e7246370b3acee25dc2674c6765f916809da4cf7f9507bda9529c6ee4d88122b1a08

C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md

MD5 30aca111cd7ae7f5c5686622e48453f2
SHA1 091b1b4d35fcae059b6aab9ac874ff0d9cdb8971
SHA256 0efa0ac778d3dfe1e3dddbdb3b8e89b01c407a5ac8a938b188fcae80aad73d5f
SHA512 499b249b4a4e3b74712ef45eb1ce08c630a44522ee7fba3b85f39cce24365c50387a046b5d852f9a6931f00b13620c7df48283ccb01fbec24585b5b764df53b3

C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md

MD5 96b826b13f9afc0534131c336647ec39
SHA1 27ea3855a05c61d0247d030062c9e73d3461e7e0
SHA256 e2a1bf1d800879b45acf29a2b1b4fec474d16e1ce3453487dc8949a9f12f2f66
SHA512 d1c41d7f79cfc6d0c0f63c112fdf93615ee5610e9cb37ddbdd01acc580366507f78cc07fafa1d7127f7d839cb22b8f38982ab87c412924b4ff09b599623f1efd

C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md

MD5 30f320fe9b1a0500b86af632749812d3
SHA1 16c94c1ff3014b329d4a1d6ff2b271fff13093da
SHA256 256940f1373c20076f8b928d83224950bbc9a6e53ae8201952a34ecb59bd65d1
SHA512 50cdcc8a25c3223609554bd13fe2fc0e5923c850d9a1507c2af160d791859bcebcc9da9120e9c0ad050e6131119fdd46d48f5547349a8b698a6f4cdd4aecffe7

C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md

MD5 804effa43aae5f83333c8d5d4f523e0e
SHA1 367714459f011afbec55e06e55ad6cd8c34eaf95
SHA256 e70de21f35ce75990c07c968170bb9ac7ca3a016748e1b4975ab8f62a18acdde
SHA512 6904be78ad2e558a5dd1cb1c2264ffe6c3ac6d92a06a3e2e619e004fa6cb39f19e8ad1919eb750852d49c7cd56dd6bfc5112ce89529af7d05237b91edd58d211

C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md

MD5 1ac36a46a9621df7206315184b5e7bec
SHA1 b79cefc470751759372872075cd9189be3e9ac3d
SHA256 2e4b0f3a7aaaebbfc11697a66894493bbe50327292d55ac04ecd8adb7524c09b
SHA512 99531e54ef994ce6e2869abb894f1d88cf8dd195860610f924d8ffeaf04c9343109aabf534253b29ba0874578da20365659dc0395c507ba2e9db353d3ef6ca7d

C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md

MD5 1d6d0587b145abb11de19c40b570646a
SHA1 dca9ce36c5a18b2ced30fca5311602dedd65daf4
SHA256 abea6a4ea56f99f5e990d753d51813834bca437dc29baf7b9925d1f21f6ef3c8
SHA512 a0f7c0ab679fb3061f9e1246ac4f22904894e4a6b7c624323178f202524793da560915e05d0d6c423fc716c1d722a62230cab093d0adcadf8fb91d5991776b9c

C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md

MD5 e078b6263bdd685926dc4a12cde47a03
SHA1 6eba6606569bc3f0617c982ab18215bdf7c07585
SHA256 c16c8301777988bcedb3bceb4101cfbec5990bf5551fdb299407b53be256226e
SHA512 b1f9ec99d32f4746737247e106ccb694a29a6a26ea1148faf99e21299d7bdc2d4a1d2119de0752ae2086540fceee00f625d59695fc9cb1c8f8358b6e6b396371

C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md

MD5 72925f67742f3e57831c5bad34949210
SHA1 d8acc705adddda42bc7dad76b6caa4f24b2ba387
SHA256 39c0145eb75906cd091f6ea86e8a1288737b57c9b6acb7e3a4807a5f76b2881c
SHA512 de27105efb8873d5a4d996f0abde297a8d1d264932e41c6f39b8cfb04f91dd42562e600f99a03b4221f320b403871cd36a001d4fae32aeea1bfce0208dc764e0

C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md

MD5 1d8323e4194a5f683fa24a3f37b7fe81
SHA1 655d6c8ff01c9250878f66b17f371d8b375131af
SHA256 b2dc94f4c6b972324f6602d5454d5200395b39c761cee6687bcfef52422189d7
SHA512 fbc9ebb24d84db95acd4d1ea283703d2b508010ab5d11221bca54b477c44af3e784ae2957baab84f8df52bef7defa7d0400559fbf5ab86e3e2125313fe9e8217

C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md

MD5 95733793649ab4147c5fcd54a20e8c4c
SHA1 047fe5e9ca63ceea9085562e65bb43617fcce56c
SHA256 cea05c4266acd306b174a85beed817aff137ef80d041d1806f602644c59b54fe
SHA512 873928daf2abcb351ea6e6bb604b61be6e8d78733ab342e4c625b45eb5debb3c4631c625651c250d3518356a17b39c72925071cece335da311096d1d5f237d08

C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md

MD5 504f8f8c03aec9c47dc484f92c7219cb
SHA1 e432e02ec26c1367fdfa0bebca6f5c9a9a991356
SHA256 d7921e8760f22cc69ca1c77a08cf4d008b9378230a6be6ad76f03e1da1541481
SHA512 f162a3ad2ac6909936451087256820618177d0dc539f39acaa26c36f7130d5d916ec1bd4384ec34cf1419002ca8b4256200c610146fcbed9d0353008e5a32640

C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md

MD5 1b0007b5ee36c1428670691402a5c1e9
SHA1 7b941926c6ca84361e04d9b4063a69cd954b2833
SHA256 3f0332813c3efd7a1b8953755c4c782313ac7c49da429be06e8465ec8b92de8b
SHA512 d736d73d75534baf294bb5759f13247c14d15171807c6f575cd1694253407c1571b2a6cd6c89cc21d318750d5b819cddaf922c03b8c1d6915a84c8286fb84b35

C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md

MD5 478d1b7d51abe37a14aa9144b1cd3d92
SHA1 7f8d547de5534f8d2bcca68cc8d0f985f8774434
SHA256 04e3ddbb8cfd270c3b780c2def2d184b3cd46e25a9c30f1ea7fcbc52279e4fab
SHA512 917bb9c2c978c807f31df898fc803868811bbf8be2872e2b6a206536b58714be8c58226b7cbbb784b78fc2928ff5b5ead0c48385322c41cac5e3d4e2feecf39f

C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt

MD5 b5ba00f5ec2dbf6b1fcec0ac6063233b
SHA1 b2b6225f1f8aedcece2ddc54944ef8fa4c3f9b93
SHA256 314e683877ba1290c8f661be0692a3128a92a0073997b38ed9afa5c6f8f01958
SHA512 6371fdd94e905e30d02e39db82b4ee5274e40ee12d6c49c94a59a45ce4bcaa33a20c4ee03d3211bfc4e5ad9d7c563984bb533a59dd2ce84b49fa82fb54cc70d5

C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt

MD5 089a26fb8eb056cea370e280137a3ec1
SHA1 59a2d5fdf8c655164080792f95a37b99305c8fa3
SHA256 fcf418bc162502420a70ac77aa46f31be4bb88b73469bdde386e24ac1bf0da58
SHA512 6a51d032fc21c2722dec3b55c175666637dc4ba62cbd4cc4eb3c6a6df0388adb6c214bb162f2c20f4b0ab855695e398bf54256ef3c944b9c56347ac4d6511809

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\aic_file_icons.png

MD5 742cfd1b2c91f0bc866443ebf8b58740
SHA1 091eff805dd145f609f19070620db2a1c5c69399
SHA256 688417adb50242ee6144e6f8888fea3a1a556aa06f21fe90208714bf177e0208
SHA512 6048d201144edee673d9c574db969c694b96a953dd9b66fb86a46ca23555645c483a352b5dac0091719e30dc9833d76c5f7b25ff82466e1b9fc2b8c3f88e93c8

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions.png

MD5 4fd34bef279e7f94904ffd09eff264e3
SHA1 dfc962967577d69534c830aa2a9dbc9d742c2413
SHA256 e16bd2ec9893d9e7fad9fc10ea015e99b50a52d79c5340bb9b5e9404a5e5229f
SHA512 39c44987de4c912cd7292b503a844fcb299347aaf81903a269ec8ff8792e59e5e021fd82e046f2ee974ad7754836912fac5fc8cdcb4a3e27b7cd27d7504d9897

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions2x.png

MD5 d398bf414601efc3f232b2cadafb266a
SHA1 2ba655c502004f441095a589386db3a4e142da2e
SHA256 082eab0cc4395597babec03c0907f291637e6513039f332b48f8a647912eda8f
SHA512 b1b1cd4251fb21edf68b242a8ba3652a5ac225670f23698e00a2caafe312770eacd4d5d13b007313f9557abf6cc3a4ec007332ba00d70c456a7d74a6b0307739

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons.png

MD5 bbb418f1cafff805415a4fd09401b0ad
SHA1 147ecdf6c26b5f1e50740ed3d9a26bf090e42e82
SHA256 87d17a8055ff1618863016aed0a9000be967cb0a23de1d2c395d5982bd809e24
SHA512 dab813790f9925bca6359016a1751375c83305921b54733cf52c8a178e330a3f39a1af6f7b4d30392dac24d11f9594a9630559e52e345bfb9b763028d775254c

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons2x.png

MD5 0250891f51f1a19982361f7d72309dbc
SHA1 beb69feeb4333088fec978aeb7fd8ce3250392af
SHA256 13211b854cea9f9307bc741c4bb9803a8b3b4b3259c0702426a41cd2d84dd3ba
SHA512 6d1e00e492c9434b31fc4dbb0291a4bc9ba293ef3b09053217549261ada0f670e3915ff64d186b3f3dea981b2e94b221b018f71d2d050d68baa2d78d9ba708f2

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon.png

MD5 bd19b88bd84cd377c30100e86d909d23
SHA1 178137a6a52c426c030f5a1c1ebb8d3dc20eb16d
SHA256 bb64e7ffa5b89a93471694cc248d76c87021863f93bbeb61f904d96dcf585f1b
SHA512 51bcefb3149c657dd697366df613954b7cf758ebe1f942b572601d249ba9e7364e9f32a15890d65dd6368829713eb32054c009273a4e03e722d56938cd8573a5

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_2x.png

MD5 5f00bfa28141430d2a7c32a1f9a79d9f
SHA1 5f9be308d6eb54fc23ecb0f49319e45a5f5a4561
SHA256 da042c976b4468e9d5752e86f58bcff665e3bffe9bc56f7924fab5683ec14a1a
SHA512 99ff557c3bded9451062a3c3f4f15897bb785fe056d617563658b9333c2d7d8e9380ca42b16a7d3be19ad98f1d74adbbfa341d05bb15c6ffa2a752720d9b1599

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover.png

MD5 2840306cda70f778c0cda646dd69940e
SHA1 b9bcc01283df7bf1dd0bcfe1ad1220004927e250
SHA256 68ddbdf4d7bb9bf723015de77d65e304d2cb96e6771e55c25166d07d8af977ea
SHA512 cd36efbb35686ef6f55f5dd5d409a2cb8f88a69d068012b160306e4816c4f3097f12327b88be086afdfddad544aac52ab78dbc500e5115f5be40399a8b18f298

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover_2x.png

MD5 571a288b1b2c856fbb2af9df718f8468
SHA1 0bdfe49922b3b0a6bb5ef093cabecabb8098d4ce
SHA256 453e79b99434f037dfaa0543ba56d06a8111a3d5747e9d9d794fcd77c3ba2342
SHA512 ab956852e45fa2240f6529e8373b0241d7ef0745883c52c4434cebc1893d0a75fd64afdf5907cfbf9d8ff263ea0d2889c6c60e8b2a338c213be727da5a038cbb

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover_2x.png

MD5 cba735be654054a5ad9368a2526a2a72
SHA1 9b7ca90a9d028efd98ef9dbb6a3bd050ccc30e30
SHA256 becca10f94dd0569c09c2b8bc323fb0fe4722fd873ebe827fa876dfeb600a82b
SHA512 982f9c5b2c5e9fd206fb941ecc13c363459404b1b9b399458725ee8156722a43922de1c32fb9ca4f74519ff2d170fc583cb75acb48dad9f031d70bdf08f352bd

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png

MD5 5ba5fdedf2ddb1cb9810e52fa76cd462
SHA1 bafb01d7f71e7d12f0847f6230fc6adc2d1481cc
SHA256 4c812cce04e4a120d8bc170be6773d7f6fcf9812260c2aa297df204959c0e8d8
SHA512 328e88e1416b6d6cf3e42b82fb0419e5702a092e79794e8b88e30309b8f3669abaf840472da8e5acb036936d594e4bce0cc6388f085316fd11acdc2af7fa7923

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png

MD5 8fb3b5bff2873d01417fe38ad15c6416
SHA1 a8f9fc32ccfb103511014f3c6064704bcfe5f08d
SHA256 efc54132e962100b780d93da7ae388d68cac77677d6f80e5a9843033b36c8aa1
SHA512 33781a2a89d27d833bc2bf77b91d1391503959d76cc84e6e8f56773a50f4d440cb9413899e7f93ab19fda6e9785e78a40ff7b7a462b36fa6c0d0fe4d9bf044ab

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon.png

MD5 6c09e177ca946b0b987ae192fcb2d058
SHA1 6e831e91312ede1df72df54994a13afbc98127a1
SHA256 c8eb2566c67ecc64578d57d8a5ca399407e9496f27ce4d4b65d03d80d1358dd6
SHA512 d0affb17bda7452ee056a5010d1682175eea7829596b510039a10d89361be7495408c41b4d68994258c9cc25f66d9278149c4ba4f78b851c9f7adcf12ed5a25a

memory/2816-3335-0x0000000000400000-0x000000000040C000-memory.dmp

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons.png

MD5 5717558bc21fc7dc0f00ff23b0c19b2e
SHA1 936704aa0d2822a1e7fc9c4c7d5aa19aed4f9524
SHA256 6a3dfe71abf3f8cedaa4054978621fe720f3c53db6d79a7995cd8cfd703a3d0b
SHA512 38b59649c07c9989363b6e086cffe331c31a4913d4e1732c8c8931688eed41c319f01fbb01789210fcc7c7b0527690d51734943f6f78f3d5eee06b5b901c2f15

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_ie8.gif

MD5 b1d87b479c0956c65570bf2b656b5e5a
SHA1 8722cb1762c073e0a118b0f013300f7afcc82df9
SHA256 f64121d9ed18ea96800cd55ef4fc7ffb6e60c050cb4b7a738f37268a1600fe1e
SHA512 cabc634644b112d5dbb50f4f18a3a83b8d3e1a4f4c3354acb88dc909dae880a8774fc69d51f945b9509c3d04fdbf34f5e2cac10f30ee7bb04f76731bfac9a5a4

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_retina.png

MD5 61d2ee4a76aab8678cc8193b67e37346
SHA1 cd5e05eabd65e3989d5147e52d2052ad41b58b9a
SHA256 0283a8da988a750768959fdbaba5f4623b78a6ad00b022bc85bce84b8934d009
SHA512 b7f5bbb93073705b2516457eb89471e481dd9badc17d71facda3cf7be4d0cf6ac1b0c60ea63fe0071b394cb09ab8d0b1a210548f38e2f2c9292757f85277b0b5

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons.png

MD5 bd8d57332060ca14f9fc453dab7eedf3
SHA1 c87e358b84570d11f95dcea372615eb722a991a7
SHA256 6a3e95b10b298e317418f81dfa2badaaab6abd157c066fcdb9ec14878a8f1622
SHA512 97b762a6a9b7d329945f2b654761274bb25171a69551a2ad0447de3a4667d42e569c34ce758f95fb18e5e997f88e608a01dc6adf36c6ce920f8da9095089966c

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons_retina.png

MD5 454f14554289db3acc0a5adf6378bc7a
SHA1 649841330e47afefb1e09037061b6bb7d334a70d
SHA256 a3bfc24f626d242c24ed0cf8bc7556700259fe671e6556fcf4bdfd5cf14605f1
SHA512 7bd4ec16fc837d19b81f40b1d416132d8bd69a43e994774219241faca507d6b0d27e345640432a455786d6c4e49056214235c14fba2b19238c3df60cea8c031e

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_patterns_header.png

MD5 1993287394ed12b823855d40fd41341c
SHA1 949cc5a1895a82f8abb1188fd5569adc5011595a
SHA256 94c81ad025ecef750cdc5408e8a7719ab2d1d5e53f93f552a27a1180fa9fdcd1
SHA512 577b93beecfcab3851f39231fe7865e5ca90d17ca6a9da3cb2ea488c3ecc3ac77bbab255aabc865c34b465133cbfe83e274875024d469265c4e8a8f2ed0422a5

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations_retina.png

MD5 12d5e12cc5f03b148b2aa782e0906610
SHA1 d3a0e5253e250a3ebc21613ab5a5bd9330ef918c
SHA256 4a8ad411cad4e221d256408c663e003940315cc9763e642da79ac2d11ad8e532
SHA512 70a5377b73b2211f88ee0587324717d4c36b86d2f2a97723d2f703158d2bb5c58c3ea952abfede5916f33b5ba4ece79694ba04eb3ee5746adf678b78e01ac7e9

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations.png

MD5 e6e48ac34995c24f356137e1c8460d5c
SHA1 43dd65e226192ccd624616a03334e663b1f0b134
SHA256 d4ae7cec8c9138dbb10f2ccfd60fda7572c0ca781e220aa1c134ecc22249f944
SHA512 0134ed538ccbe2d2236de892a502abf913d6c8e66b21e56202d4a9b0f714adddad04a9f32c13b88abc657ba37f1249c07f412cf6e5750318136c5c2ccd0c1c9b

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_pattern_RHP.png

MD5 cc4253515e8c6b6f19274cb337badb52
SHA1 1393cba3fb26171612ca052a776e8eb74bfa76f4
SHA256 532730a6e0c1374c8070ccbbc094d7c11d5489cc027f3fe537137a0f621b2249
SHA512 f74dafa4fca581408e4d1c1ca81ffb3f12bc9c0cf6f3a031269d10894ad4e5633e0296c5b39dd6f330221ea128bd7d212717bef65870838463016338500a313b

memory/2816-3852-0x0000000000400000-0x000000000040C000-memory.dmp

memory/2816-3854-0x0000000000400000-0x000000000040C000-memory.dmp

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\faf_icons.png

MD5 897c883a30e927a0bca5e4a441db8cf2
SHA1 20414e69d2a453b553533848be1e21af6dacb45f
SHA256 bae94c2d8bec01f639fa8f4b9db25914c4c3887a60d53fe3841a0caf7c769c22
SHA512 6d25d6727f1c5855366e3b3c9f8ba1c3088138107fe08471f3fb0a44354e4a87b96efc9e2e4a59caf4ecc0c2e0894aabc332956fe9f7cb9033980054375c4f8f

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\bun.png

MD5 12929e4040bcf36477cc2cbc733c2176
SHA1 04867208170beab54be8dd06a5ab09feee98e828
SHA256 28b02a2cb73edb39643caca30275859d7b81df5e28191c95aabb23c15bb40cba
SHA512 05647eb1b16b361a940c549f405ec033e4d3d74884ed4096b2f9a6d9b264d53dcbc30495c07375c03f5c790347ea12cbc7aa726b40dd60880de3b90aede4e1c5

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview.png

MD5 22a6543bb16946c08079d6e39500887a
SHA1 eb8a8d191c8705f0a179ee1542965c8fddc0d89c
SHA256 fcc4bbf7c489df258e952e29975c6ad3a4553578e8d0d9523c203aab9d0722d9
SHA512 6983473826be1ae793f85e53e552d379002310d36c70c7068e3a0cfc6c5157b28bc0041e2a04a1a82073c17277e6f6175842dc8e107afde32d4012d979ae7548

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview2x.png

MD5 922e201c23d671691f4b70a369e986fe
SHA1 146c0e3c6fb160081d89aa4b88a3be36740556bb
SHA256 f37e57d289722b91aaf87e6afbf85ca3aec80030b1e747c4bbf84e6e7d55a385
SHA512 aee7fb0106f93d251cf71230b5a25bc07507a9feedb87eb10057073e39784c9b146e788ac8bbd8be4c0f19c8b5a68304518a1de2122ed8d4a8228bb38cc2bec1

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small.png

MD5 cea97013e3eaebeaec69c11824f323ee
SHA1 d04666b0fe9984c85377f40100ea58c90d218ea0
SHA256 fca536933f5a7ddf0bd7ced131076892fbf165c3dc29ad486dc9a27cbf3a43c7
SHA512 037df1a97f61c822ceb7a648b561f7d6e7c92481de3b373bb64714a1b977837049b48a21f71d7957267e62235241312ff3379007ade7eb486b48748318b9fe73

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small2x.png

MD5 c366809c7c412ba8079df18e4857457d
SHA1 5a77e5f6aeea38fd559edd22870c6142f2e224c4
SHA256 24aefd4bb5b78b0ef4229ae255f09152f093f095cba81e5896a5b9426396482a
SHA512 2725f8f995fa17f6feaf08710997c09effa35c2ee6c3237e289466f5a6b129a25e052e02ad849ffe43900b2fcc279ed1f527898ffe5a33ee36a1cd1366a81d30

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\illustrations.png

MD5 a46c064a820cb4f4ad7fa7f28d3b9c98
SHA1 c27e76c2dcaef876abc568e55dce1fba19b6c6eb
SHA256 caa4c3cbc82f67b8c9ac2384baaa6197fe3a7503f805231c93c5f902d201dce4
SHA512 492562ace0a15ddeed7644265b5dc827d787d7e57eb0ddc834ecd8330d9123b31451aaedf0e1db5ad46080433e54ef29141092c2c5155c4bf41531d157256d70

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\nub.png

MD5 d4e8642b606afd7d2a5a89a94990b148
SHA1 0af3d7dbc3fc036b5e1f48e52ab216dae3293aac
SHA256 055bc8e41b22f9e181ff7ea87c87ffe21a9c15c46f44e2f0366f9268ee5608eb
SHA512 524fd5f9e32ff764d7ee0f018a27920ad03fb1e35d1466e8fa8bb691d6f167a26a49b4403dee3558fa2c506e0d6256c2bc6d03b53a78efd57177343c0889c20c

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons.png

MD5 ef011752436c5ef86147b99bb6abf644
SHA1 39479d7cc673795cb12cbf7f226dbfdcbbb1b1b1
SHA256 b005bb41de6bc8733ee9cc1c0b8da37ebd71d02d55b07527230c3a559e30c716
SHA512 459114c48cfa5a70459bbefc075e875c75e9864a5dd00417796737840c2c70ca0ac0ba2292b7bfb46ccb7ddce8841b57da43bb9a0195da8617f510890a873288

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons2x.png

MD5 239b8016067d55e8f2ffe89f1faf13fd
SHA1 5cbe2345182839eca2f3053c9cf8af4aed6e99d4
SHA256 7de25db9ea7b649b34e1e3d9a416b0c2264742fa4e6598ade94b5766b60952e6
SHA512 ed928b4b912e6fadbff56c717420abde6d74c4b4291941310a93f720c3712f7475b27db60e333917812755c5a4a6aa842553319c0cef3af18db422d5062e08d6

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adobe_spinner.gif

MD5 8fe3cec6d9dd45354f2443b8060d82ef
SHA1 b607cb4e2810048e9d57a8bc218ddf9e88227731
SHA256 5e944cb5c444bf39a04431d47b250c54391cd51a44629f37291fa6e1ef501e77
SHA512 d30529dfb4d42233977ae995f70239f3b27bb11dc418e22528f61f6681378938185bc2fbb1089695993a27d117663b72e0d1788f7bc2c807e8c2043ff93db7da

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adc_logo.png

MD5 e5566b65431d9506ed9e439942697671
SHA1 a6e95f3fbc0466ba29278d307453ca6e69f6e610
SHA256 b710ec83792dc0a02f8773c8e9d6851f74c44973299d2bffc3c101cefb8ced53
SHA512 f4d5a0adc30f4a2c6be4c78576a52a1bb48bea7c3bb85ff2d738b2f7c1e4d2882e21686b1373744b9044f8921355e191ae582aecc136d14d9cab4b4cbadce12e

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\logo_retina.png

MD5 372972c295563a9f4f30416586fbb3b0
SHA1 54bc6d9fbb3e7a6670992a3a9cb529eb9befa902
SHA256 ca29081ebb879418fa08a3bec305a02375ae9f2c72142bfba0b81544aa9912f0
SHA512 437cc9c169ddd2ff0feb49ba8498f4278bc60201d716ef13accaa79e842d642d3e6d71369930a205ce73764f126675a7b3331f211b76539c3b0c202b6250af89

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo.png

MD5 6adf4391a3523b218b0998631f5a506e
SHA1 fb3f8408fb3f7111f7a1ea6c051a1fbcbd7fba3f
SHA256 69971803353c9070b66bdb01a6fddf71a03b860c3f246a2ccaa0b410e44bcffa
SHA512 b10f61d9cab2920d612d5ae42296fd14db96f6aa10d55b471ea1f027a0bca0f7a700a2295baacb97354ef2b6a77da007607af33daa93258fd79cc72d36c0a538

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo_2x.png

MD5 aa342183320cea15a8630d235b2fa9fa
SHA1 be0646e0c58a96f6ae2cbe9a23a8f3a859543f51
SHA256 1ab299f972d95c56a72773724307ed4676fd7f7a5efefb08377333ee6143d074
SHA512 8bf4a3e0a8a9649837817d50466fbdc88a82b6498975e968881d8656003b03a7b48f89dc281407d4aabf1b99dc2283c106ae15c212982b65f320e89b8fbb7068

C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB_EURO.txt

MD5 60fb13617090fee4f9b0be2f7a5f4abd
SHA1 3cb97e88c3ec718ee591a104b81b8e4af87bdd66
SHA256 4c16a175d3b988c63c92081793b03dba1edbf835828d31a7f3260b3a8e69c132
SHA512 d4c6ef2fb1f4486484b587fac74344dde35bf0134edf0a79e4c552a8cfa06f435f1dceeda3909bf3009af2bd5b1de4be77f0d641331bed3a21c1ce615167aa54

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727655840085328.txt

MD5 46fe9788151d15296649e6b6efeab34c
SHA1 dda47b9d8ed63267d2418b285506debce4ead669
SHA256 b6a8d9c03deb1e2cc510bafd4214cfd855f9ac8a87ff0a6ee38b1f239cfae327
SHA512 d57a5eed00b64a05f48458fcc6bc38e1c7793dd0fa73815aaf635613673cc8f18df75509e35277613aef139c7c83bbdf11ff03ded214b451bd6a6f063cd4150d

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727656363999749.txt

MD5 6c41fbd62d3fcc7a2c112f5992b905eb
SHA1 39660c4b383e5f5c36dc32d022224b72dc20a87a
SHA256 333ac09763e46256fc3477733a496fbf4ac2349224d83b9f0b7131bd53c20118
SHA512 53b784bff98f3c0c60b23de3088f30b04bf1692078659a54418bdf98c6a4bf98b5713cbcef595079b4f405ce3f7f19211195e8c5651fd33722dd6ae1c6c75f3f

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727662640605367.txt

MD5 22912d0b9a5fc69bc11f4fc9292fe19b
SHA1 8e661b360ad72e2493140dadd1e53651fa7cdcb5
SHA256 8955c3e3e9cd1fa8d9df1a20397f5856810ee130b06096e13d29e4ffb0a30c49
SHA512 a066865fcbad56300f23d17c0eb002b5929db3ef683bcb1476af0ad23dffd6c11fdc0a9b0e1f999e99e18e2b4c4fc15787c0644e07f5aaa538c5cd9fcb658603

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727665714398674.txt

MD5 605550930abf352ef1e7cde603e6ae2c
SHA1 831f13b29be25c76a9b2066f50a871ba208e8ef4
SHA256 b44a096b7b7c3b95af4f2fd6190d19f8121a4b3739495553935c58754ec6e0ef
SHA512 d99ded8b5c7104567846e86587e353ef855827d9bf6a76471a543d7c118b9bc4a374b965dd94a2c85330ce5c2d958fda2782932e36a2528ac39c1c744f136bcf

C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\File Explorer.lnk

MD5 30f6cade378618c6e9dc777ad2e274b7
SHA1 ce94ac4b712d2b7aa9b36e50f7d9a9c96a200f20
SHA256 872be5aa3e7662c53478f6d92ecc1299ee69af57bbc365e0df19e5ed1bb9026f
SHA512 7f4bde656c7671249e6ed14569d88e63fe73cde01326bed41aca03d2cebcee43d887e694c4f1e9fb34d97ef2ed7cecceb9fdde57edfe89ca128e36ddc3fda990

memory/2816-8658-0x0000000000400000-0x000000000040C000-memory.dmp

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\alert_lrg.gif

MD5 66c643fe3add0b511f0667f7190daa3d
SHA1 bede5464a77e2b9241103883351d67591f3c829c
SHA256 53841b17be03947251789fd8843814b2d686a330e353d0934ba59e8a42d440c5
SHA512 ed3f84325e86115948b8b59a534f5cd7153b9b9e1fa6e532ba092ec77eb60fd43f57bc3056bcca6f171ca59dcabe5964a864c2b9299846e0a9163a1ce9e28578

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg

MD5 95e26a99f1735b921594c263341ce2c1
SHA1 01b3a9a236573f120f0c786124ee9ff2ba96f700
SHA256 59105a9f1c1c11ca4e7abb87a266e7b2bc594d6a9d4b49d51bd4afc958b4713b
SHA512 30ee1538d076d742a8e684d157c16d71daa37f7054711bb9368e3d2f69a2795a0f972fcb298becb527eaf1dae4632aae86db09e210af75f1ad554eb07e8a484c

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\aspx_file.gif

MD5 c4c893bd72e7f20347c96166150212be
SHA1 b521785d1972475fc0451b4e185b69d70a0f002d
SHA256 b3065b47d6999dd2dff7f1cbd2a490a1a0cc14925264e77ffe4a78c40f2fa014
SHA512 d9a994ad6d864e2b890047e14a55cb354d03a782387276f45dce56019ce32daf4e25d01d59ffe337e54645f7f94ff790ae81218ba04a37b941295066e11e5da5

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\branding_Full2.gif

MD5 92ca8e0fcf7c5f1c4094b66090b90391
SHA1 73f9dada15010e660e996c270b7e66dd4fdd4cff
SHA256 e3bcfd660c68d3dcb98f84447d260f4adccacbea46f6deec8dfc315a0ae8366a
SHA512 1df478d4a29b9b853d4f4270a48d1233afe397537ef6685e2a9145b00e89fba82780c4638afe6fc8dd14ebfb17b5429a8492c40e531fe674df41bc674ac6057d

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg

MD5 48d0e43e1ff4c61cbb4819b6cc87b8e9
SHA1 78b5ed201b438366946419de394450d6dd63adcd
SHA256 f8642f052cfe5bc6543252bc9ac14dd3d5323d7e9cafe0e2e0d4d8ce08224f6d
SHA512 d7ace69436d70f1b19b0069ef55773d8e9a2a9b8ce5795649141deb9ec2ba83b42b836830e3bf53f2be66ff3f6b14a7ac208b908864f100ed492048158240750

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\folder.gif

MD5 91f00ff2312c7974c0d2902391da8399
SHA1 4f8ad04d575cc8914fc6cf58695429836eaf711e
SHA256 542013c56fb0fa58084282b35891362bf8d2a516cfcc418ea3efc7e8a37db86b
SHA512 42ec7fd1e2646ce908e60480d51c021ab4fc78aae43e8004b33400d38d620c3fbbb4454d61cd7ee8db84d7742085ad2eecac0e2ac090af52c642d942614bf2a0

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\gradient_onBlue.gif

MD5 74a92b45e5cded1b5af9fcb568ef242d
SHA1 c5d110452493c1b92cf3db67b39779e5a3e7ec6f
SHA256 93afba154fd15e29879528cd877791b73dd2acbd8549020b912450ca3e26dd59
SHA512 72eff94a1b385c602720d437e8d1ca273c0c7556b2dfeefe571e455ab884574ab80e2e19770572cdbda0330fe5d19388aa8da7d82d703c4a5dfc53163e8b8c8b

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\gradient_onWhite.gif

MD5 c184ee4c96058287f30cac484bd9ee8d
SHA1 7a8ee8b9769d276b1aeea044fc74c1cd441a3d6d
SHA256 45ee7e26cb782243f7ae1f50c99dd6bfc77fe844dccf875d349781ef044ba4c4
SHA512 a40597141e860e48bf58f8a6f9d41edb8ea01a6cf3baa82d86242898c4b44821471722b5bd12c3b42ac15f8c989ad9697c724026555d8585c9ac25792418e495

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\headerGRADIENT_Tall.gif

MD5 e464aeb5dfe85b1a1ccb00ef09935905
SHA1 f89e3586da1385be7826f4a3163bbe75ae84594a
SHA256 ab393467312bd56b428392b869cef5ad1778ff3af8cdc4c58d636600cc597078
SHA512 3efa2c00c0b96e566a3aa9d5b0ab04a75116655a7d8af0e45795e26992e31ac8f8f5f696b76573c2b208232ea53b8b8b33514d957fb9a25ba719733c641f77e8

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\help.jpg

MD5 6e7f2dd48c147b13d485f6c839d41846
SHA1 ab257d2d00400f165c3848af78e984f9cb6bf767
SHA256 f7e05c4121962c4c052c81b0b8c0151afa4ae01eb2b52c37f4c626c2f9a22b05
SHA512 7f36fbfad0aeeb038ecbdd3bdd182cdecbfd624db8f7c69e58f569e35e29c592db66dbed0aab025ecaa9c1f7cf6c6df9957195207288c42feec72f6de0814789

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\HelpIcon_solid.gif

MD5 41526eaef057cc772abb093fcf3a2f09
SHA1 7ac26633f72ef4e634f665242977ceb9405bc983
SHA256 70964a3775e2d2e9dbc68ac218fb0a30b45460f8327d0dce70eefa439f9de82d
SHA512 89d44d65d738891559d0ee3e78fe3dfa46476d7418b5be8d989f3788d19a09914b41b2c8cdcdb126b2e1fc106832382038a2a201d2df6e531bd375fcca38162a

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\image1.gif

MD5 744e7b23d328c836034fd5ca01423ddf
SHA1 b1e81e0d03a722341145e2e4e17dd69dd2285010
SHA256 727ea69cbf7f5d1e7bfb12d05ca3adb4ed647b548a41eadcf7ea66508aecdd4a
SHA512 f7c9facf0e90e8a091465fe124389b89793c55b7eed21bab610da5a606d57e9009ce9c394b60ee6cdcbf118b628cdf9f37d58d49c0a8370c3f1a95edf81f1ad5

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\image2.gif

MD5 f1d235b8ead9bae3004d2828c13c95f6
SHA1 d88007a4623301884d63365b7f5f5576adea7e92
SHA256 feca6b69af4912dd3b1f04dfc091bd73070f2f29abcdc38ef69f185526f5c769
SHA512 07af1cd5cc2e753b056d2ef70f1775f40b814721672229f243f6cfe0f2a3a0ad7952ec1b903e870c355f135a65d0a1334403e3370c72d71b0fa6e36cbca97577

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\requiredBang.gif

MD5 0cba4e5e16ab58e7b932c885915de1d2
SHA1 07cdfdd0dd483b5200e3e8a838cce317365534a9
SHA256 6ae30d8599094052b05af2e94519d3f0f8905a425ed9e6538ee3b65980f9bce3
SHA512 366d986db2aec0158a48d079f1f12dc30d7cf1db717cf1608d95d971d0d9850752a87e938533f3062a8c15126c5fc3a13249a0d2b44b58fbbbfcfc997cd08e73

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg

MD5 26ba333e7a7d012f740b211ac508d149
SHA1 ec4b64c6de7c16249ef9aa7ad2c28cce782f7140
SHA256 315291cc7a3b5aa1fc7eed56347bdd68fdff3cd77240ee58ad07b73388408de3
SHA512 0acaa61a8b6f6984137d20389a7c6085afbde06df45cff2fb112bf9884280b7dba6a38ceb9cd92124f53c1d1a9ffea0691a371525da4048c2ba8358f57f621bc

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\yellowCORNER.gif

MD5 7344a100eae6134cca920134ba6f3d1d
SHA1 02659c0b1d95addb9498beac7faf7d0acac7e34f
SHA256 8f6ab273a64fb63622e6c307b270f5d5c9c6ce9012b385ed5e5426801899eba0
SHA512 d61814141277177fe26dd04f86bf736d705cd655db9342031945d1a89f5a39913f3d2d1ac2a7826ce1561a544dfd6a8bd0f24cc6459ddafe54f8f49da1274607

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group1\1 - Desktop.lnk

MD5 c91b066a1b530051bce4a7f151360a30
SHA1 53d692c382654a2e0367b3883615afec6d19a84e
SHA256 0665431f66eaa96cc58429173f6038595bc8a804a5b22f36f99706393135c6bd
SHA512 48a1da5e7b8f21bfcb404858e752225bcd658a2ab80be4686dbabbe2595783e260733401af567cefc46e8547b90e7fc114bfcacb93e32bccc1078631fe8c522b

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\1 - Run.lnk

MD5 d699ee58b59a5fd70a6a9ec0c9008d28
SHA1 60c79962f0e97acbf50b5aee77069bdb8d25e7e8
SHA256 d13dd805537bb9daf623c22e3ea786253548d4f6cd0d6a671169d07e8a11dab2
SHA512 ed94abf926a7c9ca2645b3e38a61b222d59438f112ae07bb3ed1bc517eaf3d5980ebac97e7c62cfab5af4deb0665fe279b22bf8edb6c486ea28ae5aa9e8119ab

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\5 - Task Manager.lnk

MD5 80409a71641f2992ca4afaf6f7c8bf35
SHA1 cb266f557225af36d425c423825dce435f341e89
SHA256 58d295b012e27baa0680ed3c306d0f0435ba582355b34afb89296124f209b250
SHA512 0cca876b77c4a20aea33d1d73e44de24341466b2892e807fafd473c7831f130852eb992a0af5e5086e8f61a029c97cb271f162b5058e906b4a6d8c9ff770bea0

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\4 - Control Panel.lnk

MD5 1fab9d1a05875bfc3ebd76e5de2f9ce9
SHA1 77dcbcfa6b335033787308e0ddcf62ebb3038426
SHA256 70e15f7cef50cca926cd68397d41afb1b0528a9afda5333c03a3323381bcf577
SHA512 73adc099b8f474caa9d75b60ed3ac4b222c06b35d79465f6e3d6b8c8cee7f0a676e3c2557b5e0bd2fd537de62e44df489f346fd43ab5888c698d5e37cd148b15

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\3 - Windows Explorer.lnk

MD5 197b8c4cd38e024f9fc67f494fd45163
SHA1 ec3ea42d155de56f09bc5e1774207685cfa18301
SHA256 077878b3392822aa4f63dca1b5dc48a98b442c5d5f1f022e62f7377188383446
SHA512 9036a3d553b18f0117c3fe0f023ce2016d99b60f862094a357d5dd7b0cbf6129c30923b67ceb2bc4f0bbf7d4d91659a28fb468e542aeddbf54260520e6dd07ec

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\01 - Command Prompt.lnk

MD5 f405e6a11a28db1289c606974a55f0bf
SHA1 b4ee285f424c43cb9a5881b90ffb83cee6f90ae4
SHA256 d9bc33caa9a1cb31644a8f42988354d1205d44c55f7c885e793a30210b735f29
SHA512 ef8f9bef0a78a0e1e4e1509595c8564f610f845abd42476cdaa948f2adfccce7008df4f7f391744cc6c0474f1e5ef71b70402fbaf10705d2170a80770610075f

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\2 - Search.lnk

MD5 54d9dec62c5e50e662d0dc25668a93df
SHA1 8b1913cb98d4e6d8a04106c57531dd68dc5c5886
SHA256 8fa9074d1df2ca313abceb75c82408bcc1e1bd740d916f51ab9f3fff67793b4b
SHA512 48cb6ed223d6fbb8803e3c81fb2d3c9a263e5b67967b3d9976856f03f523888180c22a220d280fe33d12abd30104b9c651287ad3c1d5e076a54edd20bc01867f

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\01a - Windows PowerShell.lnk

MD5 301165ab2726f760eb41862125665764
SHA1 fc6f0a1b18af33538df6d98c81e8002011bbcb08
SHA256 505a71607260838393afd0a848c3469f2c8a38a5c968879471aca20e09478982
SHA512 477338c92efde8ee023f615ed0c4d596fdb9bbbf48541b0ea733364ed140e517401be8b06071d9fe04b06d8876c4e02feb71dc2e3d712b52c7ecce2b3192b338

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\02a - Windows PowerShell.lnk

MD5 c8186f4dd5709e657d6b97d2c50c2e41
SHA1 17d0f35b21b3105e56cd02541937f291945b9437
SHA256 22c2758395a801273f9c3bf3af1859a9dad4e1ca0bd93996d9a9ecc5533b2280
SHA512 e6f27098db83f8b5ccf9265e1b16c7c5409b21200860437bb15ac3c61d67ce1e709d3511a19dc455ab2bd495966fae74012a913bb3b00894e7f8f5825e6783ee

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\02 - Command Prompt.lnk

MD5 107a6e0b037c7934a47ddc69b6b098b7
SHA1 ee83b1ad6f7c49610f5b0cdb53863101da359ba8
SHA256 cfb414002063d8e3f1f11bf1a4f4d769e67165c2fd8f6eaebcce08faecc76e4f
SHA512 9544356a073c14329bbbd8b5f602ca6cfae77770025a70c31531b05f480fdec38db070f227fbce56a8705a9432e1a9a09c689c13f2309d8a0968a9454b0ccd79

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\07 - Event Viewer.lnk

MD5 94f2854105a4500197bcb11d51f3fc7d
SHA1 8ebe5dd4a745a5a87caf17f123b52e1fe2dab47a
SHA256 34fb0761596919a95478020644d8b4e6e41830d4f6659728bc32b510ac831b0b
SHA512 c8db9ca36175cac6f0080de6d7655b85ed6f0f9f2174d20b0e32a9c2a59f6814db7b8e3822343df9576998bde842d4550da67ab954fe8f24e8a95ffbec0f2de4

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\06 - SystemAbout.lnk

MD5 6f5b1392972639ac020831b36b22d8e5
SHA1 61d57d3e8ef363708a61a1a27a9406553cab983f
SHA256 afc78069c618c480edd44fd49cf6e427d6d2f73925fb81601f031417fee8c47e
SHA512 921b7f834f5c23b792cae3e5e07950e4d6eb63c31a82ac516ee118e2d7af48597a0c40be0fbd0799033bcee5d302e152466a594e11a969c0897d5a81b4d99010

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\08 - PowerAndSleep.lnk

MD5 9cdfcbf2b0d1b285acc256f7ddc852cf
SHA1 763143705df7fbbf16467c1d5b30eef7e07a00e0
SHA256 6c678dd4db578c2a955105dac18370337aeb79a2e8489ec203ccab8df39b2595
SHA512 30866baf903ca7950fe5f44547a768cb00cd52203391e7b9c5a987acbbbab94f2535f00fc787930c54d0b37b0a1b23f679186dfe22ca8ecbb4343ceddd79246d

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\05 - Device Manager.lnk

MD5 3a9c4066595b9570089ea4dcef87490a
SHA1 b504092392cda25c986f02737b0eb291ffa13651
SHA256 83fd31b533bde176e75ace9c4bc68a17f295f3b7aa09867bd05d42d6a30b771a
SHA512 d96c37df5558470ade88ed0617a03a906e3353b6539aeaf5800491732eff4da89a72e19170310c87b896901ed85dd0b2fcfe38160975b8c7dad1e41c0d745143

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\04-1 - NetworkStatus.lnk

MD5 da1489b2b965a88b1c8e045e0989ec28
SHA1 bd02cfdbaf3bedad233858a86c97a6c0f54fc1a2
SHA256 e7073ed51a40c1c998158542cfef0a9b5d19f0a5fd01739d44ea29dfdd4ce5f3
SHA512 3f332e0db8ae579904731a754ef86a7a85f86444ac359f3b9468e442f4ad48433622a5a02d5a8ff919b2fe25a5b95efe76b42227c42de28b329827fa974d6653

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\04 - Disk Management.lnk

MD5 520ced1129ddfb0d8454ae117c72cf43
SHA1 b5f746b2ffd9e4590274a0c46681e428d2ca3ec8
SHA256 2504dd32ac30cc846c41ac8e15158fd240b956b996fa2b17b198a29d11a28ca3
SHA512 837a28006fc291f2eb13882e98b9ff37bab2fe0c936a79e2acc1e7a7ebf177c2f3224d344c35d6b010738ab9c79dd8d7b1b3567966dcc12722d66126a9fec2ad

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\03 - Computer Management.lnk

MD5 048c96bc4f18f0d14a0e1b733ec9cbe9
SHA1 fe84da663980058c9b92bbc073185cca5e9cf963
SHA256 bfcc837d38d966d0de421a07625fe883a646e1aa36e99a2cc24c45e802f5c348
SHA512 82a507db83b73c33b2ae7e2df4518b2f04536566121a49313b2ba04b2385520917803c0e8f741a173ab326d2517bfcafae347de7b55c93075987d6a9292d5928

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\09 - Mobility Center.lnk

MD5 112e2ddb55610636ffe807082b7c8239
SHA1 454b66cd1e654b93fab014a1270472c0febec6d4
SHA256 ef1427b4073ad7789b144d2ff507f7e377d983592eb219c12edb45c039c686bb
SHA512 73de138154ed5ed487d1eea658df44d17cc3fc4442d7948d10b9ca72ec979fe2821126716af54e48d9aad54f2abdc538cb2f402f1228063dd3129b796a241572

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\10 - AppsAndFeatures.lnk

MD5 73d95331ea801ab4c38782f8f5f191e3
SHA1 bfedb2e9962238cb903db4392f93dc7439c7e62f
SHA256 39ddc6d346de6b782e9b2c9dcee23dd1d409b68e8368791e3257473c5643a9af
SHA512 0562b2574504bcf1c2ee16f9fbfc9a020b12e04fbb56a66dee43c38b156dd3dfc2d69166cbd1c50d237e5972a573abd4ed0a7b818aba33ccdcf5e59e5ed92067

C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk

MD5 67d9bfe3ec21cd2c3155d2c0271f4663
SHA1 b3d7ef2414f2840ff726ca43b65729fc5a8d70fc
SHA256 4303e608dbd410e1c30fbf5b18ba6af5be54bdcc0652b8e6a0b0c77e9999e562
SHA512 31fb557627f393fc9704fc76dcb749d100527ab7fd8f6e9b71c004cc3da404e0f16d59f9e815844df291b654cf543eae3c8c55d4379e5fdee4ef44a8193af46e

C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk

MD5 f37ab8968a057eb9252c2b3554d86f60
SHA1 836d06606a165aef703b5ac8df1032d85056c2cb
SHA256 0d575122f783456d96730628683f8173d04c710ef42788f3dc6be27c5f85906c
SHA512 ac6eaea23de9a98acbf8f572d8fb9f101a7058c7e00133402421a67bc822464dd36f5a8354e9eef58a0e329a4fc03881a2a8a83de0c960ef399cf417b16abf57

C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Magnify.lnk

MD5 0a31dd22b97b31b434c66306c8770ee1
SHA1 904ab000e6a9f0bde89b2792b376e96e14f78e4e
SHA256 02df4a5e9442390cc39dcc23575f25a8464ae24a9e7076ca8e6fb457ec62137a
SHA512 db3a823e251fb2cb8924ce96bfb39bed4f2ba0b47b157c9b12b6aaccdcb80a8ba60a6281241dd135c104c6a349f76d3b34e551a773bc4116c54231b376867705

C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Narrator.lnk

MD5 66d95dab8c867c757e286847efaa0039
SHA1 88f017d787da5d0924c22d9daacfdcf9c2b5241c
SHA256 40a14b95a9ea5ceb499c5087312caff53757f5fc9a31da0248e6819cdce7e6db
SHA512 5014da183bf3842e85aa199f7db1b4958904ba289f6c696c462157d389daafd11d9a74d88b6928b7ef0655f9e2db70b7b734dfd82b363a60fee1c526f06e160b

C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\On-Screen Keyboard.lnk

MD5 1d6b2348d9ca540e2047dcf9296edc2a
SHA1 8d3f6f72851350c2189ad8c6f731e98cf57bc60b
SHA256 8c507b0b1fcb06c4a10a0a8c014e7a8459a9ce6ca7e630ee80e1c59ee3bf4977
SHA512 99027a4a0579d124cd81d6fa1636187ca13e192feb30c9f5a0035b1020ddcbc7eefbd80c42320e0783248524c140ff58b931ef4609d44bee9e5a64a8bad514dc

C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Administrative Tools.lnk

MD5 b04d613e7b3a74d757a89101c51cf873
SHA1 2782dbafbbe100f889e1846b1be736230c8c3e2a
SHA256 4b0fef85e8fb781bfe90d719ef473da1e844ee877d5f46dacb4ad10fbcbf0973
SHA512 011d0ead131abfc1934a50f14807977378ce4a7bc706249fdecd32726fce70966612d71f6794043c67853fa7157b1fe00a4de31b195f5f96ebb29b5aba62f8af

C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Command Prompt.lnk

MD5 ff3f6b3f1496386c6584046ab5dd7ad6
SHA1 316b2d38aa5951e40401657d71f70f07e5f88e49
SHA256 beb24ddb693005c3c27af72465ccfb2abf51612a13e5c788a4c65859f8e84297
SHA512 6bac0ac2ceb3260c718101f611c8223594f3938ee1bf3cfbc9e45f46c6a3ca4732c9e793f302f3f24066e032fb0f4203ad54daac6d402afcc8b32dfcf2857287

C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Control Panel.lnk

MD5 ad798bfb325c0e5ad6d33f2acb06b9a4
SHA1 b98ada32e1691b9271ccd872c68d78812efecc13
SHA256 19d31f773e164f7b9d70cb254c2c28d4dd3d4d7edf9891fdc4fa39a597317158
SHA512 4eb415ec370ecc8bdb53f7c6bf9c0bacb8cc8fa2c766aa92131a02c3536fec7d33d5340fd2ad44d7a9e01c3152ee76c4ec9e4ffe736488c9f2d980652301fc00

C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\computer.lnk

MD5 dd7f9a0c9ef154f860d6d9e41a7279b3
SHA1 39cabe865c6c3e7ec4686fbf19b4804d4946d21d
SHA256 d8c925fdba38da814403e24198ac45449f9b3f81647c7af7c6efb05bb2dc29c7
SHA512 e03190d47d3ec40db8b26fcfc06cbc262e9bb82c18af1dc75f0fd5c5d5b7865fc5139702046f8acdfd01320db8d3b7f576ad0908811183933fca5f2a8d374dfa

C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Run.lnk

MD5 2c18b295a5862b229ee119980fd74ebf
SHA1 463df16e00f05d2fda7c12f3e5351b762e319def
SHA256 4ea289652baa7648a0c1a5401637ef59d7d7521d49bb94f27f0e430549e3fbad
SHA512 69297d405ff48849ba3205da013329490abb4892c6ad1d96b6062730f2c39c70efa67ec5407b4856438465a7c90508e2a96797b87c84dd8389e3493664ae671f

C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell (x86).lnk

MD5 66c703a2c6489050e0d7871239fb0252
SHA1 8faddf0337fe1c1611e825e7668756bea288361c
SHA256 4936528b2b484bb1554e4ae33a9e8cba747d3896d420b4c98c42db469fcecdff
SHA512 d9bce55c5a92496aaa8eb0d6e18a48dcbf527dde55001ecc20af6d8fe2af4773c9678215da19ad2f2c0f83cab6647baabf88ecf77ad11a48a5e4a7a5fb415bb6

C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk

MD5 392c0cd7e1271603c7248f6c8dad76c3
SHA1 3e10c105e65fa7dbc617a90cd2f5f3de9dfca29d
SHA256 24cfa9182e928045b10c506f60c5088b18131c166653671403a116ba9c29888c
SHA512 3c170fb5a6028dceb4ec861e6a33a3b9f2e801647c3376cbb17f943afcee920c0b136c2da105a507a6de8ed0c151fc4000c024f9f2c30ba1817b59d1978d85d2

memory/2816-10820-0x0000000000400000-0x000000000040C000-memory.dmp

memory/2816-10909-0x0000000000400000-0x000000000040C000-memory.dmp

C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png

MD5 fc16b79527dcb115c908034366b3d29a
SHA1 28a1d7a6be1823ffaf6648f92b98162599fdb93b
SHA256 6a4c52f94144bd8eaf7bcf374c12a33e8f7aa79cee7d957c30f911a0f8b25bf0
SHA512 1e316d5adb5d6e1415743f6fdd6efa444714f0f15c6b7059a95ddd9e8fd470db6decb74b413346cea991f66437f29ba68c8d7aaf1d21e9c4ef94689893bd270e

C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_contrast-white.png

MD5 6934d310b64bc2fef416d3042549f229
SHA1 fc94928ecb380bc2307810fcd83d7216b8746704
SHA256 5d2583d080df3760814a9e2c2969f597b8197652d20860f75a3faa421922c655
SHA512 49f996bb3e25a98a71e4ccc6dd9bf3e02c67aa3c54793b0ad74a8ea0cef84ab1ed9d46aa806554429a49861d5ce4ac18251de2f1ca0c2faf2d9d001e3a251360

C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png

MD5 a730b91fdce8b20de037293d56302f48
SHA1 b0bb39c0f1a5070c35c653abdc539a48dac504e7
SHA256 fb9ad4369e729caacb545fcfc349a53162700f24240243fcab68d894c1189ca0
SHA512 ed7ab5e4c0c0925d281594e3f48fcbeca02d21e106d9e8b484124a41549bfd54e7a10a0b3dac218778127b24b846bb97094502210f09d11b6298bae32606eb1c

C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square44x44Logo.targetsize-44_contrast-white.png

MD5 3d822fcbd564864160a4bc96ce6ab132
SHA1 da0975708c2e518c21b6902425e287b7818de61c
SHA256 b0c97c789a8ed5072ed6d5c5bfdd1d3a55d7b70f5f3e26db731ab1b3136854d8
SHA512 dfd2bf7f8cd970ffce267a5f234418ee21e6cd10af4440e7d6ea62be70d9c1a6a6dff64aa6b1642133ba230beb4b32b754914ff3550e15e475bed32dfa889de3

memory/2816-11222-0x0000000000400000-0x000000000040C000-memory.dmp

memory/2816-11249-0x0000000000400000-0x000000000040C000-memory.dmp

memory/2816-11250-0x0000000000400000-0x000000000040C000-memory.dmp

C:\Windows\WinSxS\wow64_microsoft-windows-onedrive-setup_31bf3856ad364e35_10.0.19041.1_none_e585f901f9ce93e6\OneDrive.lnk

MD5 d34b23b53461c8cc212c3057cdd07901
SHA1 b632713b4aef2e96d33aa6069b7db47cbdbe2205
SHA256 469abd1bc402e1b845816dec8106fac6b43eaf3c030f25ea16e6cd195885868a
SHA512 2ee97b8d49eac8a9a774f9cdb705828b19db9948fc1f91f8ed28ec76aee4a77c3721cd17a6ccee5031f553f0f8d01ac0317416767f9de006ebd6dfe4a8e98d35

memory/2816-11256-0x0000000000400000-0x000000000040C000-memory.dmp