Malware Analysis Report

2025-01-18 20:40

Sample ID 241211-z5p2naynbt
Target e342274b59e65578a37019215b798b45_JaffaCakes118
SHA256 c239a0e143d63c177f0647cb88febe8695feb31c7f9d2f67d7fdd0d3d3b4731c
Tags
xorist discovery persistence ransomware spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

c239a0e143d63c177f0647cb88febe8695feb31c7f9d2f67d7fdd0d3d3b4731c

Threat Level: Known bad

The file e342274b59e65578a37019215b798b45_JaffaCakes118 was found to be: Known bad.

Malicious Activity Summary

xorist discovery persistence ransomware spyware stealer

Detected Xorist Ransomware

Xorist family

Renames multiple (2364) files with added filename extension

Renames multiple (2346) files with added filename extension

Drops file in Drivers directory

Reads user/profile data of web browsers

Drops startup file

Adds Run key to start application

Sets desktop wallpaper using registry

Drops file in System32 directory

Drops file in Windows directory

Drops file in Program Files directory

System Location Discovery: System Language Discovery

Unsigned PE

Modifies registry class

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-12-11 21:18

Signatures

Detected Xorist Ransomware

Description Indicator Process Target
N/A N/A N/A N/A

Xorist family

xorist

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-12-11 21:18

Reported

2024-12-12 12:05

Platform

win7-20240729-en

Max time kernel

38s

Max time network

17s

Command Line

"C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe"

Signatures

Renames multiple (2364) files with added filename extension

ransomware

Drops file in Drivers directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\drivers\gmreadme.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\drivers\it-IT\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\drivers\ja-JP\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\drivers\de-DE\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\drivers\en-US\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\drivers\es-ES\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\drivers\fr-FR\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\drivers\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\8lX6v1peh72Mukh.exe" C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\System32\DriverStore\FileRepository\prnca00z.inf_amd64_neutral_27f402ce616c3ebc\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\fr-FR\Licenses\_Default\StarterN\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\ja-JP\Licenses\_Default\UltimateN\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmhaeu.inf_amd64_neutral_6611a858035bf482\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\de-DE\Licenses\OEM\HomePremiumN\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\Printing_Admin_Scripts\en-US\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_types.ps1xml.help.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_Comparison_Operators.help.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\acpipmi.inf_amd64_neutral_256ad642985694b3\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\prnne30a.inf_amd64_ja-jp_b2245ba886355a9f\Amd64\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\es-ES\Licenses\_Default\HomeBasicN\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_locations.help.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\en-US\Licenses\_Default\ProfessionalN\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\it-IT\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_methods.help.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\kscaptur.inf_amd64_neutral_6cb3fb6811a3f83d\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmiodat.inf_amd64_neutral_839e9ee1a8736613\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\prnlx00a.inf_amd64_neutral_a89d2c01c0f43dfd\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\prnsv003.inf_amd64_neutral_1e0c4fbb9b11b015\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_script_internationalization.help.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\com\de-DE\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\de-DE\Licenses\_Default\Professional\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\netloop.inf_amd64_neutral_856142fd87f1c21a\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\fr-FR\Licenses\eval\Ultimate\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\de-DE\Licenses\_Default\ProfessionalE\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmar1.inf_amd64_neutral_b8ebf59556c3dbf0\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\net1qx64.inf_amd64_neutral_85d10fa4c777b7be\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\wvmic.inf_amd64_neutral_b94eb92e8150fa35\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_remote_jobs.help.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_prompts.help.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_remote_jobs.help.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\averfx2hbh826d_noaverir_x64.inf_amd64_neutral_da2ba9e8a30dad14\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\prnod002.inf_amd64_neutral_a10c656b6c7c053c\Amd64\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_requires.help.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_scopes.help.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_Arithmetic_Operators.help.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_jobs.help.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\de-DE\Licenses\eval\Professional\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\wiaca00f.inf_amd64_neutral_f7f7e179d99acc58\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\InstallShield\setupdir\040c\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\ja-JP\Licenses\eval\UltimateN\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmbr005.inf_amd64_neutral_d140721f97061bba\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\prnlx004.inf_amd64_neutral_2cf95f307381e481\Amd64\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\hdaudio.inf_amd64_neutral_ce7bc199c85ae0a0\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmmct.inf_amd64_neutral_15bb3ed734fbbeb3\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\prnbr008.inf_amd64_neutral_0540370b0b1e348e\Amd64\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmkortx.inf_amd64_neutral_1975687236603184\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_PSSnapins.help.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_Parsing.help.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\es-ES\Licenses\eval\Enterprise\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\it-IT\Licenses\eval\EnterpriseE\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_functions.help.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\prnlx002.inf_amd64_neutral_12563574abbc36eb\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\prnlx00b.inf_amd64_neutral_89b555703683b583\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\wvmbushid.inf_amd64_neutral_6708ad28050a6765\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_data_sections.help.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\wpdmtphw.inf_amd64_neutral_a7a22bb0bb81abb0\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\migwiz\replacementmanifests\Microsoft-Windows-TerminalServices-AppServer-Licensing\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\InstallShield\setupdir\001a\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_Line_Editing.help.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmtexas.inf_amd64_neutral_7572473d88d69307\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\netevbda.inf_amd64_neutral_bab421df9c31cc81\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\wiabr007.inf_amd64_neutral_442d902f3f3dd5b7\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\en-US\Licenses\eval\Starter\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gjmoobdggjllobgi.bmp" C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\calendar_double_bkg.png C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\currency.html C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Internet Explorer\SIGNUP\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR19F.GIF C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_gray_foggy.png C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_INTRO_BG_PAL.wmv C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\requests\README.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\background.png C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LEVEL\THMBNAIL.PNG C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01747_.GIF C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Americana\TAB_ON.GIF C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\GrayCheck\TAB_ON.GIF C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\rtf_justify.gif C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-first-quarter.png C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectTaskIcon.jpg C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\images\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\images\info.png C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\27.png C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passport_mask_right.png C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Program Files\Microsoft Games\More Games\en-US\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0101857.BMP C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_High.jpg C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\144DPI\(144DPI)greenStateIcon.png C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\reveal_hov.png C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD14539_.GIF C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\css\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\4.png C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\COMBOBOX.JPG C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\css\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_blue_sun.png C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\en-US\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15022_.GIF C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\nb.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\Panel_Mask_PAL.wmv C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0341561.JPG C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21519_.GIF C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR42F.GIF C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\TAB_ON.GIF C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectStatusIcons.jpg C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectTool\Project Report Type\Fancy\SPACER.GIF C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\th.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Scene_loop.wmv C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\specialmainsubpicture.png C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationRight_ButtonGraphic.png C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\bNext.png C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_right_pressed.png C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR29F.GIF C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR3B.GIF C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\CalendarToolIconImagesMask.bmp C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\logo.png C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\46.png C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Scene_loop_PAL.wmv C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Program Files\Java\jre7\lib\amd64\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Program Files\Windows Defender\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\pause_hov.png C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Common Files\System\Ole DB\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\groove.net\ManagedObjects\SignedManagedObjects.cer C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\icon.png C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\ja-JP\settings.html C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\oc\LC_MESSAGES\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\js\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_e74ded66652fb660\502.htm C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-mobsync.resources_31bf3856ad364e35_6.1.7600.16385_de-de_2ea5a7ec449afb22\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-ftp.resources_31bf3856ad364e35_6.1.7600.16385_de-de_69044438125fef1f\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-s..cingstack.resources_31bf3856ad364e35_6.1.7600.16385_en-us_8c9010e4f616bbca\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-getmac.resources_31bf3856ad364e35_6.1.7600.16385_de-de_0ff099de0f3ac8f2\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\x86_netfx35linq-linqwebconfig_31bf3856ad364e35_6.1.7600.16385_none_56e30bcc495bf9ca\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.AddIn.Contract\v4.0_4.0.0.0__b03f5f7f11d50a3a\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-forfiles.resources_31bf3856ad364e35_6.1.7600.16385_en-us_34a3bba803e202dc\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-help-efs.resources_31bf3856ad364e35_6.1.7600.16385_en-us_7b42dfac415afe76\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-console.resources_31bf3856ad364e35_6.1.7600.16385_es-es_d9e1d0fb5c27b6d4\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-efsadu.resources_31bf3856ad364e35_6.1.7600.16385_en-us_c0f2532bf66b1c48\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-imagesp1.resources_31bf3856ad364e35_6.1.7600.16385_de-de_fa97652addc65bf0\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-s..trolpanel.resources_31bf3856ad364e35_6.1.7600.16385_en-us_1c2f17658368719d\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Windows\winsxs\x86_microsoft-windows-n..35cdfcomp.resources_31bf3856ad364e35_6.1.7600.16385_de-de_a64913c605a9a2c0\DropSqlPersistenceProviderLogic.sql C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.Resources\6.1.0.0_en_31bf3856ad364e35\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Windows\ehome\ja-JP\playready_eula.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_netathrx.inf.resources_31bf3856ad364e35_6.1.7600.16385_it-it_6197d21cd2c659ef\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\x86_fundisc.resources_31bf3856ad364e35_6.1.7600.16385_it-it_6ab892e3e837a0b0\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-format_31bf3856ad364e35_6.1.7600.16385_none_265f38d5eb4d284a\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Windows\winsxs\x86_microsoft-windows-gadgets-weather_31bf3856ad364e35_6.1.7600.16385_none_4db0b909695af8f9\divider-vertical.png C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Windows\winsxs\x86_microsoft-windows-wwfcorecomp.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_5dbc7e0875d581fd\Tracking_Schema.sql C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-ldap-client.resources_31bf3856ad364e35_6.1.7600.16385_en-us_db423f80885aae7d\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\Tasks\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-e..epassword.resources_31bf3856ad364e35_6.1.7600.16385_es-es_5ce30f3494a74e9b\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-gadgets-weather_31bf3856ad364e35_6.1.7600.16385_none_a9cf548d21b86a2f\redStateIcon.png C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-i..onal-codepage-10000_31bf3856ad364e35_6.1.7600.16385_none_240f5e8729f07c94\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-l..mepremium.resources_31bf3856ad364e35_6.1.7601.17514_fr-fr_9a7206c9fd273385\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\assembly\GAC_32\Microsoft.SharePoint.BusinessData.Administration.Client\14.0.0.0__71e9bce111e9429c\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-t..-mscandui.resources_31bf3856ad364e35_6.1.7600.16385_en-us_779a74a5042c46a4\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-tzutil.resources_31bf3856ad364e35_6.1.7600.16385_it-it_04361f65b5251181\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GraphicalHost.Resources\1.0.0.0_es_31bf3856ad364e35\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_image.inf.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_747741c93ad55b1c\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-bcrypt-dll_31bf3856ad364e35_6.1.7600.16385_none_4a8185140916af36\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-d..fontcache.resources_31bf3856ad364e35_6.1.7600.16385_en-us_2cd2a68aaaec5026\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_6.1.7601.17514_bg-bg_5ac99802e880497e\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-n..ce_iassdo.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_8aef539b8d387fbe\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-n..-security.resources_31bf3856ad364e35_6.1.7601.17514_de-de_a74c5dd3b3f79492\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\assembly\GAC_MSIL\System.Web.Extensions\3.5.0.0__31bf3856ad364e35\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-l..-startere.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_7cfc747fa923d94a\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-p..ystem-web.resources_31bf3856ad364e35_6.1.7600.16385_es-es_0c773247e275eda3\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-wlanui.resources_31bf3856ad364e35_6.1.7600.16385_es-es_82bb5ca8fc5e600b\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\msil_uiautomationtypes_31bf3856ad364e35_6.1.7600.16385_none_b8662df873a3a965\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-l..ultimaten.resources_31bf3856ad364e35_6.1.7601.17514_fr-fr_02ce9af6fe2baaa4\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\x86_desktop_shell-gettingstarted.resources_31bf3856ad364e35_6.1.7601.17514_de-de_957d2d76493d70b9\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-dpapi-keys.resources_31bf3856ad364e35_6.1.7600.16385_en-us_e8c314b68736a191\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Windows\Media\Cityscape\Windows Hardware Insert.wav C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-mfc42x.resources_31bf3856ad364e35_6.1.7600.16385_de-de_75a5d492b9d7cd2f\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-networktopology_31bf3856ad364e35_6.1.7600.16385_none_2d4ae8dc142e71f6\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-s..ty-identitylistener_31bf3856ad364e35_6.1.7600.16385_none_d57180f075948160\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-shimgvw.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_409b8e1ddfee35ef\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-powercfg.resources_31bf3856ad364e35_6.1.7600.16385_de-de_7fdfdf01dcc88490\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_6.1.7601.17514_ko-kr_1b56589636443993\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\x86_desktop_shell-gettingstarted.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_6b0d37ddf872f844\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-mfc42x.resources_31bf3856ad364e35_6.1.7600.16385_it-it_4f22d831ba835543\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_faxcn002.inf.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_046e7515912e39e5\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-m..-wmpshell.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_5eeca2c456245c7e\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-netprofui.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_df232de45e87f7d4\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-powercpl.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_2cb62be409345109\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-s..gement-ui.resources_31bf3856ad364e35_6.1.7601.17514_ja-jp_55fca664dc994c6c\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-d..anagement.resources_31bf3856ad364e35_6.1.7600.16385_it-it_c27658c0cc75cb0b\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-hotstart-adm.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_92dd14f5eb72ee5a\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_microsoft-windows-m..qlxml-rll.resources_31bf3856ad364e35_6.1.7600.16385_es-es_4f807b381bda3cc2\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\winsxs\amd64_transfercable.inf.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_a9e0f2faff6e7ec6\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.CryptoLocker2015\ = "JIXYNMTGOFNNODU" C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\JIXYNMTGOFNNODU C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\JIXYNMTGOFNNODU\DefaultIcon C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\JIXYNMTGOFNNODU\shell\open\command C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\JIXYNMTGOFNNODU\shell C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.CryptoLocker2015 C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\JIXYNMTGOFNNODU\ = "CRYPTED!" C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\JIXYNMTGOFNNODU\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\8lX6v1peh72Mukh.exe,0" C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\JIXYNMTGOFNNODU\shell\open C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\JIXYNMTGOFNNODU\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\8lX6v1peh72Mukh.exe" C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe"

Network

N/A

Files

C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\HOW TO DECRYPT FILES.txt

MD5 515f29d240c8defcfd6ee9395f2f7564
SHA1 e7ff1b461236fc7dacfa7776e43bde1188fe8a0f
SHA256 dabcf6b327c3ec0f177e21044c1aa01d215055b8b195aa1a7298ff8f8820ddc3
SHA512 5c42006bdfde4ba445325c3ad5dc28b5c5583d50c0cd853911c6224827b0dc1ba76d3bb16514b5815b3d82ebbf8e990a32ac64450df45de52a9f36fe74e0bf8c

C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif

MD5 61f51ef4c749977540451baa47632167
SHA1 bb9f0c5d17205316589cfaca227feba29de7f324
SHA256 536c04cf0c28c408eae391476b9e3e192dd595ab2d9dcc657eef9899454b2f33
SHA512 867fc234780ac7f432cc6f6b256117293fffb720b286397b8e7856830821ec5a81dc7753c3cf4b25d6aa3fc9a5b2255270a41705bb3e393da862f00a1b1abcaa

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html

MD5 e61174bef2b209144219702640ecf46e
SHA1 355f4fb81fed3c355cb55a3977c15d123daba65b
SHA256 15a3be4b59a2976e5f95ed6ca199a48f80c00cfcc71ae4169841568e3f8f4ce4
SHA512 2bea04543e69a4e959f54ac10e4144334d97e5abf8b4be413d88892472d9aac31d28840e2dbddbcfbf02e50a614568671f0691abdf4fba3160b1daffea77539d

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html

MD5 feac420aa14cefdffb22713ada779ad1
SHA1 1067776a34173d67f2dd7a49ea253c57dae3e2bc
SHA256 4098021c2e7f29f71657fe8234cc102a00c452a20940ae34e718ef50a71f09bc
SHA512 9c58400113ab8b08085b0c72cd48c386c85bc257548744c037e2ba64c688c72ef1877a709ab21b7c1c00c972bcc02b88579495c17e4fad11aba469b6f5bde935

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt

MD5 731a1d2cacc229b56f32038b0110a8fb
SHA1 5a7ff97cc58bca11294dd0cc9030086c483705d5
SHA256 ea944a82cfc4c4fd80cd8a2a1763dbadedd21f69ab2befe386d725e76f34761a
SHA512 a0919270e2b76f4140da79146bc23cbb396a033a472403af41f777457219976f2a6ba1d39e581b2186d40cff19285ce9b36d3ecd64f3471cb96d6ea968f0177c

C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt

MD5 3d9a66f2cbc1064f1ce0a9db34627564
SHA1 38765dc351f65b6ddaeb072511a1be4d984a6074
SHA256 bbab5eecd958ce7cf5b6131127336283a441cbc7511d564ac3e9239320993c37
SHA512 7b5acf6d4f55cb6cfd9faf562cb5f1592684ef0dd103a0a75232771122d4ed8065b35529e1010556994d064c64cc82960bb133725e7ec76357e70ee57779a03b

C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME.txt

MD5 a2d7d1c79e80ac72bc949738987fdf0e
SHA1 a53d2fcd9e5fe8d012ec32d22818006bb480c6b5
SHA256 701f71c305128209606c566667afede91563a1ed996567ef85aa1598b5eadb80
SHA512 64fe7af3cc37c1a729500ebe598d0c47de51081f78983abe604e443fc502f561d18a08d5dd26835a8455e6378a8431fbebe3612b2bda51ffdb683401f64fed53

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_OFF.GIF

MD5 687d079579c6829d98382e8b8dba4749
SHA1 c97e1b6a48b20c5dce5ae4f1bfd7ca8bf0659a83
SHA256 599114fb09ccb7deeb349149df9aaa35edad71e48a6d4604e2d6c5042a89ec31
SHA512 8bd241e5cd7ad64ed49e36f1c71d8da4567fdd5a25a8e845d8e00bddd4c21bba10bb88005ae1b2a4b2bc314663e7a9ab7b44e8326cfd2cf41de95c139727c056

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_ON.GIF

MD5 8302a37bf157409b8d053e068b1a48cd
SHA1 721aa419341aad4b78adbc1806388b4a3288c7b3
SHA256 9004435f39201f3622ac46016e047107365632057568259e271a61f869e0db7e
SHA512 649a9639373bc27bfb8b8821714a575c94a4d59106f201c1ce33dfc54895b68e9a93ecec16f444278110b79b08efbc3e3366a277a1568c9f88bc8fe0d9241599

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\BG_ADOBE.GIF

MD5 38ca7204b0df71c4ec2770c212547e19
SHA1 43971bcb67c772a58603edb85fd85db801c0bf5e
SHA256 141b5ff72ac494aeade7eaebd29fc74acb682cb99af8c09614fc1bf0022993ab
SHA512 9a8ffa6fb5a73dab2b623005f9a2dd312f624ffd6d0cc118cdf90d432e77f7a0b50c86e3221260dfab125b89df246924a33e287538532ad1da452188107707f9

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Casual.gif

MD5 1c39959115c1726e85f92d4741e37095
SHA1 00630b3155b6e1721970a175e028ab938078da91
SHA256 17fa52c522ddef4094abae5f89945cedc67be47910dec85d270b3afd138298d9
SHA512 b06db891e544cf2dce70ba652c507556540d4c72afff34f59428b18d81a18e050e4964358d9dfc684c9c5f249802037cff90a75f41847b5ef1c821c241c3e431

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Country.gif

MD5 544a816b3b0e56b8fd80bc01e4a80cc4
SHA1 06c708b79153b8f82bcade46a406806dc2a1e642
SHA256 8936ac60bcc9bbb3692595c53cf63d6c718fd058191feb03bb5be26a87864759
SHA512 f433b8e5cb4ccc1ef04370fcdb1158a0f116bf054d909db72642bcffca765926549d912400bfe5467303251d008b8ab15797e38fedf45e0ea5284d318a3b3985

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Earthy.gif

MD5 04631d440ba5aaeceff75e51705f31eb
SHA1 936b7d5330d8421ddb4d38acaf045934aae1c735
SHA256 e09deebdbbd503b02d1bc257edaf9832c3d9f3f504f215175d1ba97596936d0e
SHA512 dfe2cca59592eefde6a27faffa3c4dac33be64f1b06b28192ab2d7b6748c731beabe18c832e4ab5b3907e1dcb80bd67d1122e93b14b81d23896592ff3e3285ab

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_GreenTea.gif

MD5 fcb02106c96a095c57f5455e6223b186
SHA1 be253da8278c3358ed93689bfacc6ccf1ef23bee
SHA256 3b92b2b50fd686fd1530135ac5415d1da960514a170068a019c2ca6bb9d86356
SHA512 b63d7dec86b2c287bf8b0b226dfe40607745e33dc03dd69fd232552535a0414d99deccfe5f0d85dffe09752fb1b6b4459e8135c380caf581fb2f1c155d011a2d

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Groove.gif

MD5 f4ce39719179e7d2c1b87b7065bc7d5d
SHA1 4a994d690fafb71e8f51b9eafdcc408b45ae6f09
SHA256 3ca38b6d05026a68af9577a258f075fb960644ac30f67dacf7eef56e5a4ba05d
SHA512 976a4512402603146d5b4170f7e9c63890c0fe28807559790cefed00385805474e1bb1040b1150b3e5ff64f126ea0abad908c139de1bfe44447228f0f3024a40

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_LightSpirit.gif

MD5 13a834f07b4e4c7f06d7fb6fe21c7895
SHA1 5b681d44a5911558ab8c020f8b11189a87ae1d54
SHA256 239b43f4cdddc3df5863e9e59940584fcb0d099b1af5a06c39bb9eac12a77e32
SHA512 8bcb08bac5223fbf4f00ddc6151d9cac0a73d81396f9e126892c1f124ac30ce55fcd0c1f14f2b32448194e4e2a9535a7e8b6c2162283baa2fd86338c5089c868

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_OliveGreen.gif

MD5 54a40e9425c9d9eaedd407626e8528e6
SHA1 25f924e9fcda8e7b1747b2afd9e6512e586521a4
SHA256 5708c2dffe96f209b31a4a8dba50aa53a5ac74dcf8951beae6fac782d953198e
SHA512 47b33e5f3e0580f58f52ae635c4e0fda3a94022022a9b4999793e896783c8a4281ad9e3b33d079dc7a651ff968c37349483d4849e8dd89bed5e4becb9f0fbdc2

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Premium.gif.CryptoLocker2015

MD5 95788b73e936a9492edc013178968238
SHA1 c3c57f7c6a07333953940e56e00d42ff5cc6433a
SHA256 4f94377c3ebebf2b0cfbaf35a7d43c481c042a7d0e5d6f880cd8c906554b59aa
SHA512 3623f6acde7828e292a2f1513572e2841578aa5bf60989f057a13a84a2cd4153c9c2b0be0586c47ce4f39ad9d4d7133e5af0b59c165df3d24330dbb9b7baca34

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_SlateBlue.gif

MD5 1a05b95c1563b75aee382a0526fb5c10
SHA1 2c433e258ff66219949a4154c99cdac159670dbb
SHA256 ec8d8233aba8b640379e480c5c57e774633c0e74b7cae628f24ea8b3b2e866cc
SHA512 ba5217f1534a2e7d874fa0280f46c99a26563636df8d23e1a361489672e34e70609ba70ab0a804a257b8e7054d6c25fa4a0f409e4d6a45eaa77b15a84ca025d2

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_TexturedBlue.gif

MD5 9bb778dea1a89588e549f02add072118
SHA1 d5aaa4c1437063bfbe7f5cb4067f5d33ad31d091
SHA256 6b625dce5a50d12f40e7513df6fae16255ef04777a374cb2440c3d9b362b6d72
SHA512 67d7b3e431d62dc7dbe0ec7f98337f55b13cfc008330106b37b76a8f3c1a59c0f9414dd37f7c3a77dec812a8433c9095df9bfad68db71cae8262b701746a1f97

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_VelvetRose.gif

MD5 ac781bb1c49d0170c3d2f3333f2909ba
SHA1 192c5df2f7f8f80868988acfa0f35b8c6673bfcd
SHA256 ee95a86cce0d9deb8bc40e54b8bbd2334ca2cfd67445155515de28eeb8d399fb
SHA512 566e90f937587626f52b6d1543783a3f8e709a3213791a9ea0c2e26e2697d9a1b237818eef0933f80009909f6c2a967b82448b98172b6157d0ff73eebda21986

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BabyBlue\BUTTON.GIF

MD5 d4edf00c3f0d4ee5dbf3be801583cc2b
SHA1 67fc3c7f15a89b9a78585408fe1f28d8fb120aa0
SHA256 3fb564650b7b4ec83e10528719b97df2f2b04328e3407e55bd106c71d40411dc
SHA512 42b6086e0de3517541f195460dfdba2ea08b04378bdd8f34b9be1056531bfa7a1bbc42d3b8adf79d850d2db34115c1afa6fc1d0987a42438aaf379c541f56114

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\TAB_OFF.GIF

MD5 7d07c4d2690678740be870e2c7ad17ac
SHA1 08537dff6cacff0ebdc088f84a7caac08a24fee0
SHA256 1952b17b5679fbdd0b3376a960b169a1e98bd10dbc3bf03b4797bae72202b343
SHA512 1f4322486eddc66248563c8e33192d73d870ca9b0376b5d6f47b5bcf42860b36a01f6d6e551a87b22d96ed4d9eba4a80ce105a6a820dcf450a95af3d7c78b1f0

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\TAB_ON.GIF

MD5 e2b3f0c4502a3a7a18d18519702b8aa5
SHA1 2da83266ea95d4082f46232af32f930a9f2a15e0
SHA256 d1d2b429d21c1180d608e57af912910e6cb205582411ee95e0bcc8f966815d56
SHA512 0bbde4c0eac4a542ca808e5de382c5cad4c7e067ffa329a215be6ba043d6b693985322c18f85678d13c62d3f081bc982fc9d98f0da25e48574e759300889ae62

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrow.jpg

MD5 6674a0c64153f88f72a1fc58b8273bb2
SHA1 9623667c817ac105e690b9ac2997f3f3d48c69bc
SHA256 28e44801da98090f3326404115fcdfb6b05e3abbe198ac6c33bc0ec41ba22f47
SHA512 397c7f672574b544a77f290a35179a7042a9cf5765d57ee423ddee86134ea0087f50384de15054169ac838f8c61a732845de96a7db2df7771d37175bf91fa5b6

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrowMask.bmp

MD5 705e05e1111a6da9f96b222187719eaf
SHA1 9be8c71c76775bc1fd101691eb86212ee6fbd2ef
SHA256 a3e9a251968b599c04828b3a36e1d7122314e5a344fd164c119a0d73488d1015
SHA512 fb0cdaacab8d8910870652e5d1b9536d57f923f07c77e0e5e863f66caa30fbbaa890551e9fc083061dbd06d87f666ca1309bddb67f3e39cca91d30e9024869e6

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\attention.gif

MD5 a4d61c4ba04f21534e4ef17ee740c169
SHA1 a8aca685f8874b00a105eef314de3544daa477fd
SHA256 44f86b8a58ffa59f2b2043690de1db23a71a3443505d717d22cb2871bcb97758
SHA512 fe4f9eb78bd8572519de00f63e2226c8c014d3146e158e00d0dee693822723b9c60e13bea38b104b8deea1852940b732c6b6680779603085607131de1af437be

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_FormsHomePageBlank.gif

MD5 b06b1b5585d916dd02b73d2b587d9a7d
SHA1 39103de04fa9027e0019e0ba3c0ea0bcdbee9310
SHA256 13c9859f7273f9e3c032dee02aa2241d193b0fbd6c874e91e3a0679184666609
SHA512 eecba15f91e75e956b9238ca69ef5c93c99f4ac6c9ca1856bbc1b715af79dbd60d99dbb6d496ef0807e5dd3ef563f09cbb17cf56622c3f3f7e606cfbf60d6694

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BabyBlue\HEADER.GIF

MD5 7302dfad7e2c5d7ccc9c959770eca9a0
SHA1 3aaf2015b062d12d7354a1b37177cd0baf0963f1
SHA256 fabcd55e47e1da4703aaf749b2c3377cc9150bc2340e70b28e1cc30ca0d7c04b
SHA512 07c97e6db0f0258bb2ab5c6d3d94ec056174a665741ab0608af08eb105896959c8533521a597aa30cd3771ca2e48b3273242ec30e5b180b7ce336f8bd7590a0f

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightOrange\background.gif

MD5 0ef2bea69ab4690a2a2e98e4ce5bc062
SHA1 08c2251be78a633a6cb2a2dc508f9d7e6b796e76
SHA256 729c0c79c8fb9204281d62832cbb4e4232f73b980b508e23c2ef5577935083b8
SHA512 f96631c9b55c31c5d492184719607d69031e0b06c38fc1d15d4ff88dbf9e4fbb260216222d6910fcb9f0dfea48c4b0968521db4101e23f0a60bb41f6826c8a59

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightYellow\HEADER.GIF

MD5 4d363c341144853cf333edbbeaa64827
SHA1 0d9eb2530eab2423cf03dec01b1756ba8ce98e24
SHA256 d715344f42b8d50f71eed5cf37e244c7f75602f5ad4fe23565897389bb913f57
SHA512 1947e2dfcf81bdc4f36efbe2812a72b81bca4fab3d44ab3b966f63d24599b033c4b80644f6232045bb3e95f0a84ad7f119840428066210a828024f07af24139c

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Desert\HEADER.GIF

MD5 65a037c04e16741b2ca881db3d41c601
SHA1 e5f904431e0ce0151c96440ce7efb10167096cd0
SHA256 8d4b43c5a8da983be04b09e66a42a95bc539b39cecaddae85b141c4ff1c94e55
SHA512 ab2600211f09a7a9dda4d717953a2780756c1ea78ddbfe2a84f470e52778123de00a2d2f36ecf94e7ea29295a1f9979a7fee866923309edcdfa73851ba9f59a2

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\GrayCheck\HEADER.GIF

MD5 0139270ea981435b2b4f92520d5d57db
SHA1 b5558ad6df3ce22071886978c3aca42460adfb94
SHA256 95464f871c966638eee01b4f7b0fbc2bc437e7ceb9af5d946d50396d16fdac8c
SHA512 bf8c0d7fc3fc4b35bdd568995eb10e1814d2709098bc6336d1294fa553b07c7f8d5c385b03c34ef05901bd18b1315eb05dadedecfa6229e7cddd67fb6519f3b6

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\TAB_OFF.GIF

MD5 a834eaa934d03751168de3c59d179a6b
SHA1 5f26bed2d356fc4a2bfeb3a6afbf5e5efdb97030
SHA256 50f9d52a73a6e96d4c27b4ddc36ff1b63a3691dae16c477bc49ffd2b3e580ac8
SHA512 3d060fc445e4cf122a3baa40150df2156c0c2c8aafc4a02d2a1ecda7d5de2ba2177959e67cbe3399fe73804b33e85422da25f73f7aa2673bd99cae58b590ea2a

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\TAB_ON.GIF

MD5 d0e5f0f7cd422918ce6bf20a8b7d9c67
SHA1 91c96d69f08c690ab8bdaa25749c6e6c83dbfa59
SHA256 20fb111709115385e74a7ee742b5b9b3f7685843dcf5daff3a87ba73bf2a5cb0
SHA512 1a7e3e78a133c9fa8e2b5d86f2b41755345effb52a010e66af28f2f8247d720cef33408dc3eb75a19e972d95e8cb17f6943d150987ed6391c27fdc32c65e27db

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Oasis\HEADER.GIF

MD5 cce3c9207b755a5130620c584775a4a9
SHA1 b16dabd459f101089dd03ccfcf103004b7863839
SHA256 de30c8cbe438b71eacad6df1e90660a243a49e673cd99964efcfbb1f9fbe8f5e
SHA512 3d488050054267522395ce7005bee250179f21da6b39d41d4cd0e82378163536caa5765e38e1ef891c19583b804f897939712c41d81dfe066aeb1351d7e8513d

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\TAB_OFF.GIF

MD5 ccd6d1354d940a8ae3d69aa95f416510
SHA1 c3f102ea16726dc18ad2a5eb7fbe92ef5dfccab1
SHA256 cf0a78c35a6514d2f23a84b3b21ea94f99a81227123ac65cf71f615d4f2a34ec
SHA512 8524b937b05d0d17eeb473c0e8ffdcc06c62d38f3a8c656a23923f324e23da6dd072ee3db1365e25e83f8e851308559f3080f7849cbbebb3d4e2c74ab73a4631

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\TAB_ON.GIF

MD5 5d036102a06a094dfa1625f2175fa2ba
SHA1 66ceb98a8b9ea9b3d9fbae5da0f5588c17a31362
SHA256 6b9158520033491bbbfcf2a06fabca25eb906756bbe47864901ee1ef5415d42e
SHA512 7c54192a1dd22128f1c033829113716ac05a50e32414424c01bf02ca937b94f5e2972e154457dc647eb28174f94f82acf14a68f7b96c597c756633dd9c1555a4

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SoftBlue\background.gif

MD5 566b869e2cdfeffe997439778c0143d5
SHA1 d9bd6dc93b8315328230ee66c2d11a1ee3c3ea54
SHA256 dc9e9f3f985f07b47ad55401e08bd51f63e43b65be7e54fcb43ce54c59492a4e
SHA512 037cfb1e9efa0ca7b4f45bf745f179329d6b3192dca697cb7168114c093005eabb5975587b6dc87424e0316a1b31e1bbfdc4871c5ccd4ffa8e203c923fa21329

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SpringGreen\BUTTON.GIF

MD5 f80fe812e4bf1e418e355f84319105ad
SHA1 3249106bc3beb9ec287a1f16e5d231d60e2e6088
SHA256 ab02f35a255ef45d35305035a39a4fe4f038cae3c29dc42d55144648c4b023af
SHA512 c27f8559b0ff394dd727a3fc159eab23654b049bad293205bea5a42de70b709ff65e133d76daac550855126feb9a13167fa5a8a5bef10dc1bd8d5ff340cf0ad6

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\background.gif

MD5 f7fd84b990cc5d96f2a4f12e0baf4a27
SHA1 8c685e216c3c38c7c1dafc10dadbdcf83c3d5c1a
SHA256 bd0413edea72474ec26fb745f793447109b3f8d41d958932669acc8f13cf8f40
SHA512 b8eafd7dc171eb9341ca8e4ae53e3b2865a29f139e5aad90e204b2a098cb6c9b42032d544ba91959587f00e70087c0baeb6b03a9f56958d0f2b419f3ae994048

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\HEADER.GIF

MD5 137389d820d95164fd3ac0f3caf0edfb
SHA1 3267bf32a5caa31a1dbea8fab39314396e21e93e
SHA256 5faf49587b3ceefdfa645e57b99f640ca779f369e7a0944515a5867d225c315c
SHA512 f4d6c671ea73b25ab4db585d8daf6e74d83b60cc772af50c1eef9c090f14a5368366b5e8dc11325ef7b8550dfced062eb772e115b5833bcdac5612daa149d71c

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\TAB_ON.GIF

MD5 9e46412efc8d08a5242f5a1a100a9f70
SHA1 9977466ecc395d3b820ba4903eb409c94cfcec99
SHA256 0131bb4323374b1c9b4fd03f63c8ae979b20dc25bdb65a0cfab3c18cfb1f98ae
SHA512 ce2f1b4572b5a0ba66ae282761678034c0c78140e7d932a37a6d1d25833b21593cefe90d33e80c1c01fc5c6439a1231f1c7895bd5428bb28ede1513825e6ddb9

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\TAB_OFF.GIF

MD5 85f10a9eabc4b1fb820b0ed49985821a
SHA1 7a38f5a40c2a6e720c6dd7cb37f6dcf2e3493d86
SHA256 769eb067258aea790ed87dc37fa8b97654accb524b3f4bcffddc3ec3e2cab51d
SHA512 faba3a93e8fe5df8463282ba16335140004b027e9c352cc769196f3e1e8ef0143d71e02611576ff804c699123da9ca95f821762cd80379e759b2670e7b568eda

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl\background.gif

MD5 1a4a8630db17631cc601af320ca68c3b
SHA1 7d13c5cb78c0b821db58d8d734cba092805ecb47
SHA256 7f34a9aa5ec48ad1aaeb95a3d8e2f653fd7d37dbe8f2eaf8d359af220ef30956
SHA512 3c4f12cb63af34945295a7eb061506b0a855bf08b77bfcedf62a7404d22c743ba9d785ce4056ff6f2a61dba4788e5ae1481ea64c9762896270c9af36e6af968d

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl\HEADER.GIF

MD5 959ef11442ede410e1c5c16482e3acf3
SHA1 00e9696348f58445075077e3d442a93f2119fc4c
SHA256 2010a8fa564ed1dd6edc2ca4ebd37793723774ad2081f50d8c11f49e71b58528
SHA512 137be7af6cdc41a55129bd087288b2ee97b96e02389452c1f4ddf1c3c4ecd94f9a1a11a366589cb91e4dea5e2babbc377ca735cd6406ed90c1f38333ce0a3db8

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormToolImages.jpg

MD5 dd9779f9daba99953accb7c32c23011a
SHA1 a4fc5ca456d538473e4d476c3cdd7ecc5d51eb1f
SHA256 0d7f2004f0aeaf46a6f997ee98c2c28d990d5c9429b79888fad7a0c70e4bfeab
SHA512 9f1c402f151e9a5f90f7862399ab07fe25bcf183f4c7364c29e8fb4d3aa672ff71649ebf4dae02548f6ce4b3646608b71b34d64f00070796047d9768f50b1851

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\RTF_BOLD.GIF

MD5 9aff2a89ec2eb963c3b9829bc8659733
SHA1 7ec7e1a8dcec7fd787344a8c6cb6d908d5b6a1a6
SHA256 55266ad02f2bb4d658fd50839fdcf4eb8d99856550886fb6f5b84233e9300d1a
SHA512 c63223b378ba02555745044af626e7af1ece04532178595cfdfaf2cbbadea29c29ee6604c169cc40f4b60a6eab41b2cbeb3b67ee9432aa2248915487567053b3

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_choosefont.gif

MD5 68e4cf9abced8f413f68474e9ad38831
SHA1 0dd86612c4732258a619aa1f7966f473cec4b5c1
SHA256 0d6229026234a3033b50746143c34e2bd02609e83c25ecf975e1ec90884cfab8
SHA512 3fb3b52b834f58d156c7d39f3fdb21c40aff4d42d4b7ccde739738783e5e7f7d621d07762cbda0779b2d4e5468b925aeac03912680395f5affd44febecabd260

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_italic.gif

MD5 78e457f568694036ffd147a2c8bc63e2
SHA1 d9d5b84d182a81c75f3dbbc8ecd52dade1bd52a4
SHA256 59b352fe561d617fc51537964c399c287d52a50e9249bb0b91ccd1f21df47613
SHA512 a999e4028fd2140e93c4f58926f210bfbcbc0aa57a0bddddbd82f2cd4686f30450b5d0faa35b7b91665aa21ad26d330ce4c2040ebca7cb4e4f979cd5b8b6006f

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_underline.gif

MD5 9a81238862e23ee88f2ceb60c3120676
SHA1 8d6b3d647e4d8095b564419d300b328b9fc29b23
SHA256 4e10873f643bf3afaa6df6bdc86f20f5cd8fc1210651c41aa888838c3ca4b132
SHA512 78b4c43455ade1c8703408162423eab2d2b4f72e8b1e33f68b8f3813461f21ae0059d6a5be9b78534b1b2b88df7eb52ca40566ceeb7ffa3e3ff955925709c1b3

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\ViewHeaderPreview.jpg

MD5 b512712e83e05e2e283fb9390664a641
SHA1 fea371ceaa75b552e497f063c1b06baf6499751a
SHA256 16cfa85cd1907b7c5435bd22b8b5257c85cfcf07daaa2a32fa8ac68ef176093e
SHA512 62e3b258b7f5f71097d91e9aaa7e5b95395d9697fc77c246458c672d7f79d9a750d60f2df8fea42e6aca2bd2161f527bdf1badd0c02f9f5b651dd1b600fe2c42

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\ADD.GIF

MD5 b1ade11a4ae0c5f3c73aceaa58e0ffb1
SHA1 313a9b896ebe1a1ce4b3bfac4d23b8c655775459
SHA256 ca391889223fdadc18d0d130b75f9a9e3590301d4acab6f0bbec84d12366e1e5
SHA512 2e79d86521e3d0104a51c5bdf0de51888ec69028ad6f2be0ed40ae59b07ee220879b7aadae64607e81aafa81a3361e15a85eb3d590d6a090f4bad69df03723d3

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\CALENDAR.GIF

MD5 c13df8a8062b386c248cd12da5612f31
SHA1 3ae1ba9db6cb8d0ac17cd43d3333c70d9f4cf2f0
SHA256 39eaeb3eae23b89a66758798ade7e901caf14b548bef270d77c1484c0d803792
SHA512 725da1ac79ee2300e21fb8de32cfd52300e127b94e98069ef66ae5f47f28378c69f503616dda55b78f2d57e3cb1ebd94fc1376b504d2c290b5e0e47381d60746

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\DELETE.GIF

MD5 d7a4cd498b7a7c7eb11688e894573d96
SHA1 4cef3495f900c67e0e628bbb2ec70cc91e9921e3
SHA256 c4f7fd02f1aea70ae9f021b4f8bf797876b487b395a81a049f6c6d9613ccd7ab
SHA512 edeb4e2b37733e50a8b1d8e68e94e09fceae3300e9eeb744d55b7907dc80e7039b1837b56dc7526ea4d77da9d5097ba32707fb85bb975dc4b975a0d4df4d1470

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\ERROR.GIF

MD5 ded443d7270dfa1b5e15bf207c909d3c
SHA1 552a3905209680ed2926c245d248fdb22a41bfd1
SHA256 7f29751155169485c1bfb568d9a0acae7e5fae465ad7e2f184fbd9db201d64b6
SHA512 54a8013a62b583900e60840f8193422fe0c3dfa4cd7b0e7cda53d9c7ae7eced86c95f4c6371622c0fcec3ee63de387921b82636638f057856a9ee6781962beca

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIcons.jpg

MD5 06ff1880c3760141b7533bf3f6243d4f
SHA1 f81e4d9bb4c4c7cc3ad7d719756e3ebb8f5f5bcc
SHA256 8a0af659592e7f872806166bd62a13f4acc7f678acce89e6848b3cde2faa64dc
SHA512 01eb4080e56e69aa5f6230bd169af7d826c271f669e610eb274b8c1124f32c96af10f39ed0c07f6d69b0e55d4dbd5fa765c20a0913c2768c893fe8c6e5dccd7c

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIconsMask.bmp

MD5 79cd73a6155ea10c767b768ff266d0de
SHA1 9ded4f4fce381aaba732c77f40f030189b2e2a41
SHA256 85bfc56e257225991d6c04c41fb32601b6ac856f0a2fa5b486aef9d84b1b304c
SHA512 df24d6d2d1ef0299e284474fd46f7698e85204709c33c296b99fd7e09e0d9bbddebdc0430dd4aed4311e3b1411f9f038a37739e0f7ca9b59053595d344124d42

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\LAUNCH.GIF

MD5 5c1a7f3b61ae1640725b472975d08827
SHA1 038981cecc23642c133f3c006d124948d28018ce
SHA256 a3ce563b6c58beeadf3d6ef5e604b766c1e7b48c30e6d50c537c05ea56bdd0e3
SHA512 163059d526e29f600dab4fc7976cd470821fc55db3e05f05e2569cd1bc0560d0de4bc6a76335e297cf8b19871fdfb10256c1406136ca54b96e0542df9d591d89

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignleft.gif

MD5 cf90da95124aba53f7c28de51de16465
SHA1 e6c065bddffe0e73eb74db14b2e5fc62f94a0943
SHA256 7f3f31c581b64032269684f8555e486621a0eeef25ec3cbdb382741aef43f195
SHA512 29f7eaae9ba9f4cebe9cb3c19ba147ccbf8492b464534bedd44d803470321542c9985d2cd5813f5cb8e88c21998e60739d37b8672b994935254ebbff28252c4b

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignright.gif

MD5 51cb904aeb8ae47b378f7ce807986c99
SHA1 726991f9b01ba83dd0f56dfb3db542cc3d288846
SHA256 156b52b3a678dae33862fb3f635fdd564aacba4e6f42853aef3a00a0694c5b19
SHA512 0c0fa1805d77c969cf18c549040f7e87b5fa21fe173af3d4a31f2ae4abda99dc619fbf9dc730a3ce8f42d8cd6fc582fe36ca33b6ff3432d019d79330caa110f1

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_bullets.gif

MD5 8cebecd896037ba19ea48b527c1fe362
SHA1 3dae2506dbecae3c520ef06bf111bd197429d451
SHA256 c476047f79d869441ee5b5a9d82d91d443adb9c7874237f333a09d77bc93b2a9
SHA512 6af78cec79926948078a99b0df99a5aa7ac8cc3840e0c2de67ac9c36882c332cc2561f68d66c4c2af6108072156d96a4174f3315215c71564181f936629e1690

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_center.gif

MD5 5fa4c4422268231e097adfd63a2cfa1f
SHA1 34865084cfe6b7e073f7467089289b4453404bf2
SHA256 6734092a89b5ad8eacba05907221fd88432eff86c104e83595ff4c3d09377d94
SHA512 ede16b3d660bb324dbceb4503870ae4791ebe1b582fe9b530e5742f5a3ab2a2450635ddd6c9c0181eee2fe283e5157fdce91ddac358baf2891634bd0590dcb10

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_decreaseindent.gif

MD5 ad9ee5ba112da4e6ec4592b9492960e4
SHA1 596f422d60f09b96b75c7573668fb32cf1af3202
SHA256 21bae3c94a668484f5aac02f8cdb1a905225f1a8b7b040f0c616185847ff1ada
SHA512 9a12538b122ca545a9e0202bb398d09affe5ece9e745ef9afe97ca4814c5e2d05536b71a2be75e2c23b32c942fff8f539d8e238d6ab9f44ff306ff9e808639c4

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_increaseindent.gif

MD5 e90686eb2c93edb2f10490bfb5ecf91e
SHA1 204fe844f7d181708a6974b91e7fec5cfa00091b
SHA256 536e2f9150d1e51e132ad813918ab6faacc3e6c01f06b11130b5f96a68322360
SHA512 db6d702a1775b631c1d454bf3aff7e66067360098f6f26f66a1ca27b6c026ba51e4557bc4964c3a37db905ed52926f971f93d00b7118d5b6b565ea9d85ca3d37

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_justify.gif

MD5 85f8e1d82b75bc1e0a367bd803c3c2e4
SHA1 ab643b1f14474836b3a2faa802d03e227b23d2d4
SHA256 6e7916832c92a9eb66947f9e697bc87c9a2551d2270d9463143a17344b8cfc4a
SHA512 7860dedf7a1434a5d39adb71203f3f53199f46361a6c5d55aba3551e84f545ffadf47aad3d4865c950ddaa778046b182bd9b0312d05c9282cdf76b3b58d4e49e

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_pressed.gif

MD5 735d50ad2fab560c1786139b26aec486
SHA1 7ccaf55bc46bbd1f38d3b39c4205b77f7fc9efcc
SHA256 b347a44b872af4d800c94b2a4c1d9f629a3ed7cd8107a72b41332eaf11fbcfb1
SHA512 e371264c8fdce61f2a113aab8fee8b743daca0c1f688251ff2bb96b3758545d2b8301676d9061c2991f3aea72aa78a7776d19ed3fa903264faeefe9e3fe0b418

C:\Users\Admin\Documents\RenameSearch.xlsx

MD5 d84dc21663ac86fb84b4dc1e962210c6
SHA1 8f9d32a71d864a0d6ba1c9835795308e3dd82d59
SHA256 6161d74b3787440d2da11ba8ebffec3c7f62dac41bc24f6ec5bb151b37148600
SHA512 8fcf4949074f58e76355db5ab6d2be0203b61c646086da6edb9342d1e7c93b796ff93ea8cef83d7c2be055e8e9240628bf790f02d4ef0305ede5757e342e5fd1

C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Windows Explorer.lnk

MD5 b16b7add5a7cea6615b691cc33272ecd
SHA1 7cfb4fdd8c84f3518d542395c7e014e8c49727e6
SHA256 4175ff072fa26b53baf4c42750dc998eeea8c13f29ef3c0a0fccde0362e8a697
SHA512 a26ed4f6bc483572bde8ee1ee750d575e8e1e6f2756505fa2a7c23e9cd75a81352936e40ac581c717791ea884beb0db85bfa895027d48e6f4eafc8a913fe56e9

C:\vcredist2010_x86.log.html

MD5 9d2f60aa9596646be4811f64c46b934e
SHA1 8465fa76078f03a72c7601a50635cb3e5af0ff48
SHA256 e2fadc0fe552276112e45dc0cb882fd6ba584f8400ab045b98b81d9d54ce33a1
SHA512 b8525331e43d57ff558592291eac4d496e273806af30b42d0e71e8bbad22c9011785393c5a8b45bc2059d9ae117ac98ba7b7eccc741453bb3025ef2446466410

C:\Windows\Microsoft.NET\Framework\v3.5\SQL\fr\DropSqlPersistenceProviderLogic.sql

MD5 8c19f0110527835fa7cb4636ca89cb3f
SHA1 917e441248181b19772a73b055bc8e9cb8064e33
SHA256 54de6ff987682096f635cc240cab77f16574ee773e590c2fa2b5fe8a5f5b032c
SHA512 b8eefe3f582d9cc9b216ee39a5f82359bf93d77a6a6e95826a26fa587bcb6e855d5586a1edf8ac7f8dc9876a53bede3db21d06d9c39d756a2d2c4cea1166352d

C:\Windows\Microsoft.NET\Framework\v3.5\SQL\fr\SqlPersistenceProviderLogic.sql

MD5 ea78097e2d5a1747de7655a13062035a
SHA1 e7c0e4dfc2acd655a675eb7c9bac033166495ca6
SHA256 eed0454beb5294a2b333786755e86db26340368ef5aa4b3a7ab530b175dc2cfc
SHA512 80ce816db5094496005c1c86f49ea1ee35f63813d9abfc8efa33fea8a0565ba47f9561b05ed42b0e24ce2a990687b450bb9261783e467fa7b348c9cb4febc53f

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallCommon.sql

MD5 7497c087a3da874668d19c22c50a87f8
SHA1 c479cd4d93678b90112f45fa649a85ab442aa8dc
SHA256 43375589c0d8f88db5a56e2cace01db528901fba53112ccac9c7599a695d3ed6
SHA512 40ccfe68ec49502f1acf96e10381fa2c2fc7bec1ef6fb67975251a7edda56f5639163345933fe21a63cd9b5298655cdd05cfc1892346940c9118e3a5eff69790

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallMembership.sql

MD5 c1512547915914e7c189d211a82241e8
SHA1 e084887cd497dada81f1687a12988d0d18e54a6a
SHA256 760a54b3641fb7cca0dcd91cb40b01c63ba861db9f90f8406cbb2d362b95c042
SHA512 119e4b7685aec7059aacaa7be253da8db02f95af59e573f890833135d5fa020800651fae2d5744864794916114c4fb37cf4ab8f6f228e22cf7b1d30ccb41ff53

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallPersistSqlState.sql

MD5 d81911b2e6954cd40ad650ea71988abf
SHA1 7a6e901f33f975a7e87cdf5b3bf83a33d181eaff
SHA256 886e94a9d9ab98e9c8cbd9d5078277cb831a046eebbaf334ecaf775d5ea41395
SHA512 4fcf4b55de4987656153b8605830fa9e5c2b3532c3080ae698bb671411ebfc17e88c3df8a0927459c1ef3a99eabe1f21b80d08bdc0016ef4e5f492a3132e81fd

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallPersonalization.sql

MD5 e70f90ed9ad03b1fbda7b574938a59d8
SHA1 921b41285e6f6a5650dc740fd10b8124d0360fcb
SHA256 587f8e85ff0c5a29c3fcad6ae9a925d7d648db2f2430cc1ffd77bf101f139ad2
SHA512 cd76538a6b0745d0e8a1a5808d101414f83b58c656c1068e59637ec90006863a500352f217f2412c055632466dd3cd47439c23f7458f67b71d3368fd4841b2ef

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallProfile.SQL

MD5 83cc3ff8578f31abee66540cbff4f422
SHA1 845be9ac25babae73dc5cfa1b598fc50cccf303d
SHA256 2622b503767c00ce292bd572b9378580b43269d1424adfa2e9ff8eac808a87d0
SHA512 8d8e7b44b62571b7a574d38efe25e6c21a9f816498c27117676068e623b5ce3a245f5a4c59523adf0be923d8cc67f1ee7be8eb89c869105fdde5fcdcef311fe2

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallSqlStateTemplate.sql

MD5 bbcd27db1745966a1bc22091fe51e83a
SHA1 d87384f6215848210981a705a2f62b887ac27dd4
SHA256 80c5f84fadc2dba93e5aff966d66ab8d9814c8a4748faf3e8bb1214e1a150d75
SHA512 015bdae81ced18aa4e6e6e698baf38a4fb0ea5976fda7d732ad232524718d7d867ce222fc9f46427801f7dbf64476e36834e48d9ed3983ec4120cfce71190a12

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallSqlState.sql

MD5 dbc0f9949992cae6be61e2f2ca30327d
SHA1 d5dcd522af48c4dd905f242176bd4e80aa0fb262
SHA256 e6f2b8a0b68d8c9306b45c79f6853bcbc3f85b11aeb51a57bd0858f3880b6839
SHA512 c3c6708f167b45fe3044f1b58e3bc211e5cf1bcf37cabf3f09b51e0222148cc859137310c3d1c3200387f69035ee474a0129413672ad3c48059d1287a69a0d35

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallRoles.sql

MD5 75e9c640523c8400c941bbcc74da3e7c
SHA1 1c1275322131b7166e57e950e20007b3cb52e5b7
SHA256 f7d0d9d8c39117f990450206642b52fec04401b45a79e42b70583dc7ea2e7cc8
SHA512 9342d3cca5544eafc5d4304b495b411e351939ad09431dd8cd7efc5851df0d74da90434bed7fbc7cd1119a399b2ca589ded665f9963478aa9140b382434404be

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallWebEventSqlProvider.sql

MD5 d93feebefa356bde982eb2117a17b2a5
SHA1 a2de5e8b29a4bbdd34af00deb17847588c1587b5
SHA256 4f7ae1ecbe06996cc8cd5fbbc38d7bee154e30575ccd6d51970d98d400f69fea
SHA512 45d2c091001c2daf628b33ff0bf2d506c2577dcece802fd520fde616fb5eb1aea4c9dcb45f28c32c6e77fa955fa6966535957741460528ad9764f6d18d9873cc

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallCommon.sql

MD5 61aad74f9a3edf709f11469e8b52a433
SHA1 f6519ec452667bea209b73a0e30a30f04b3210d8
SHA256 e66f0e761598e5f84ae4087ebc502d79c2a117064b2c45f725ebab5e40ce59e6
SHA512 bee2ede482f5ddeed967d3ff854b95adb74cc8a2d452072d9c2f7f8d2ccc2b60347fca4466612cc24b178d0061e6249dd41f53404a7ef072d000f154b18b9a30

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallMembership.sql

MD5 d010626df71b6aaf6b2aa85c3e504ecf
SHA1 741a41b7dc1653424c3c989c70f35653e2336f83
SHA256 3f2e5c8a38ad871d32a9ef8183d75a45bb6cdd373966959274610f6d6f49fc4f
SHA512 33f1f70eaced1dbd633ae8769cce165e5501d59fa6971733657cd7f4f6b6f7b99157e41064e66d6c8f8ec0b374e8b10afb119ab9c885cd16c8acd11f055ee91a

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallPersistSqlState.sql

MD5 6bcc8b0d26edc27e31b7c2b6b38e9626
SHA1 b9b22d13867d7edfc4b3ef003bd0b179f1d44f0f
SHA256 87054856cb58e6b2e4dd19db00e98813a41174eabaac9d826d7cc375657b4751
SHA512 55d636facb4da1f7e7200b7dd068b792bc46e0503632c5055de4323593fb48c67c774fc5c8996d4cbadb158a461f97150ac4d15d12039d88d4b8f2785f229907

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallPersonalization.sql

MD5 1d139a7ea6da8cb268080e52e7088f83
SHA1 bfab81c1bbe194acb5d415a5e8231f9eabbc46f9
SHA256 67622b4b021cde3089c7ce3abb3f394a2e06583588becf702eec14f472530bb3
SHA512 82e7c8fe7d9d0525e9c22bb35d1711b1352275dcc1e6ccfd24994bc7b553261f6d8e8fdb54c9c83df21a766a7a82b2a5bc75926a6f3983158ed455a0d7cea27b

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UnInstallProfile.SQL

MD5 1d7bcce60394e087b148c9abeca3daa4
SHA1 7f95158c8295568e5c77aefe8096961f66a7aa7b
SHA256 df88feb5c8136d07dcf24fdff037e416be9506a96e97a223945bb020f118b9ab
SHA512 3c83a5975d61b5be51f64c094a1dac8315bf779fe7aa4915e24a69b70e3046f545e1b0e9539d9b972abade97751f90651335b2b0c0b5ae0fb6a5032387a2431c

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallRoles.sql

MD5 74c168a8b2661f7f30ae356a2a264d17
SHA1 46e4c617cba2d0d3cdbd320bfcbbbb88a59a7730
SHA256 e1fa7e2ebae224b63effc4545c35fb5a88336f564df3b4ae3431f055c9e20280
SHA512 59a35fa37c019bbfc09524011579f5f232793b6cd83ee7cdaa32513a4b6fbb1680a9e44269fbf90c596a8d63bd66d58ad7f0c1c9bf089ec25ea319954b3b759d

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallSqlState.sql

MD5 2c4d15542a775787e416a24a5ea42528
SHA1 c3d6f7a5ec380b67b4176c4dff194cfd7d06ce0e
SHA256 f1a22545c502ce18e466e67da81613209646f945da7f7cdb702e3c82a1a07483
SHA512 b353e90ec3bb39fe1ba07688726103a23e3cda1aa2483ecdf5559004ea88b0dcaf9bc52a4ac61d5635ed57b409eea559fe1859c7d01322564ab008c6c6222b9f

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallSqlStateTemplate.sql

MD5 b36d4b95b72644a22b9872655cc9c107
SHA1 8eac430372cd355cbca2532029f372fadd3847d4
SHA256 ef075542a31885215b85b1374024720efa3120a7d4ac7ed9e842c24a9de4ab64
SHA512 969d490eb5f8193cf753ffb38a4da33dee9dd8f5adb7e8a37af45c92335ed1555cf45b003fa1aa7b98243c1022c3d80edce2c4bb2c56e8bb5dfa4d10268f68b7

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallWebEventSqlProvider.sql

MD5 6c8e7a78992c7ea9c00bdab0a5a29bd4
SHA1 71769593437cefe003b9e3e0a50e77da3cf3881c
SHA256 81b8381d13bc74ae9c86d4a91a8c311f383e54cb689a638306fce4711da0f23b
SHA512 6674b0f1c807669d893c378dc83bf2b95db2201299c8d4afb06bcd5e8addae7c11ee77fb93b2a132ec05bfc6443972e9a1410d8500fbc5e8e49ce9c23f7a6ff0

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\alert_lrg.gif

MD5 42c0f6f58e6be7b9a2ab1fd075bbc55e
SHA1 b924bcc78ca3515a3d9b71d6610df25b9b3ea4d8
SHA256 82ded1476660bfd9c7157002a3030e3b4742f2cceff60f44c0214b2b060ce0e4
SHA512 da20fac333e63522730efa004ffa338b25970775a3693da8aee45af8f4977059ebb59ab6c4b548cbe40a0675966addea7bf4f6c70661246976b5e884b39af8d0

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg

MD5 8a131e686f2b7559aa448ad87c8a0132
SHA1 f88ed9c516826735a432107ac2dba6c13725b199
SHA256 a83bc2250f4f51be3fddf5baaa9bd12e727984467b3f4dc23db66167366c487b
SHA512 53bfec80311d91e1a08ccb9b466605f3b6d1d7959aae8105fcacf12abdb8e5e43561737de13210187f180f637962f15aefa97c9bdad753bee2cdda40f476334d

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\aspx_file.gif

MD5 65dfca25c9f496d84a2c1b231442c5b0
SHA1 c1a44986ae16b985f4d666ad36523444b6d23933
SHA256 ceb8c1d2b3c079833d7b19e93c9a8c0f7b6ca21151f564ddea481d963b402de8
SHA512 d2b8ee94a477357a2b7d5cdb70cab216f5cc85bc26788896bd896100757f8eee3087fb957f5c01f2b26d975cf0f9e8bd007faa4706b6e50412ee3e230047199d

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\branding_Full2.gif

MD5 96cddaa44774e82d7aedc762665122a5
SHA1 58337de5dc14d9d1b650cb8ad048d7b021e07472
SHA256 eddc8bacddd596337b4981eef8468a6aa817786701eade0742b799ff616421b4
SHA512 defd1153a33c4470b96d401639eede169c22ac57a3e1c92c258d3e76966f1b7b01a8aa055dd2828bcb33b20e276a70e7775de74c4aac39e4c0136d93eae58a98

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg

MD5 f25f79fab2656119ca12fd4832de08f5
SHA1 a5eb7a3538f4437b738335a14ba55ef862294a4f
SHA256 a2b83ec797c25f2f69d9d55618fa6462cb3f5de692c6183c0cfa7e877a6f3966
SHA512 3ad26bcf24f111a7b8c3b266b41337809a08ac24c0b1db9007759f53fcc704e6fd6ae6752bdf67eb05a3e23df0efe6b7f3ca94ead6bd8688d23034ceea6ba25c

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\folder.gif

MD5 00bf6bdae4682f81c2575d04bd4978d1
SHA1 c33b8cf1852c1806ae6af92fdb1bece081e1acf5
SHA256 94b4ca1eaa2008cce5cd2a723fca7921b74058e5f314d3f8102aacf72f2617c0
SHA512 e47119be4ad9f29693beced9542f3be7c542299cd6ec93f5a19fc97ce27cb51699b855a06415f8fd8c390d32b2fe40c4af9cabc875ea722eeae6fa3a221f8076

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\headerGRADIENT_Tall.gif

MD5 f0d736c834fdadbcb62fcd6985125005
SHA1 dfe2836694900f5f2adfcd49cc8ae7e793482ab8
SHA256 1e7c219bb4604d435709a121e1afe4022549479f5c0eaf1bc0d5fb5af385a707
SHA512 111cff8bb0c51c30fed2b2557fc1a71b0a4293e7b7fb7a100051255deae90f5809e838fd37be82dfad288efa2e6369050487fbbb04860fecaa085fe625e370e5

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\help.jpg

MD5 51cd650a2589c3bcb1a747f3a5f2de0b
SHA1 2cef3e6720773715570093806010b42c7d3dec29
SHA256 27ec5aba2b778260f91ee4b8996baddf73c92dcb02c73dc6360a1337bedbc594
SHA512 1609826d62336399fc8e6e20f796ccf71eeb8deddb3e760a31a48ef956ad9755ec248bc50b723190e0f763a0f8804896986edf9261e4fec4b89a02da55585bf9

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\HelpIcon_solid.gif

MD5 9e6538e1ee09f96bd696ffdf941b0c31
SHA1 8bf05ee8eabcb10b77a8dbe9ad523ccf6f593110
SHA256 f8e89edd113c82ea85647c4f4b7561567e51c0ad2b8b5c4edc4d668813b63e5d
SHA512 95f72b43725e93194be0e1c14e87774147cdfdba8046cc7283a22e90ae7f2e4e2c82b5d4b0da3302e80ceb9f2b51e73a7bbae3522ac9cd3911f9d53d39a93539

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\image1.gif

MD5 77bd4f8807abea386d744ba96c33b8d5
SHA1 d9e81e6f355a8d60c4afdd31fa40de753f3ca8b0
SHA256 485b8cdc78c3db3be230e9049fd3146fed497adc92060ecc056cc8fd5e4bd24e
SHA512 ee093a3c886359bbaa993c555b11a0ec26b14a29fd731f2a8b7e99b301b3f65144c4e7cb63479a2a4c7a49a316d69960d234125a2a6eae4b35f671fd4ffbeb98

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\image2.gif

MD5 417c58aad74b0cd90e76f77c8d2c2ac1
SHA1 b4d89ea1738f85e1a73a03f8a38b6454f9dd45ea
SHA256 41f2b910cc16dce9f4ecc40a191ad5de91485398ebb9668504c03e17a4e16e5e
SHA512 212e3b9e957bdeb5bd5e382e2381ebf3cf7cee00cacef60dce44e7cb697059287e8622efa54be63a10100d24609c568b2f2a17c43d9b852a32bb966cf26cfbb0

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\requiredBang.gif

MD5 f45e0aec75bddf174dc418ea3669cc76
SHA1 7b17407b945d748715714fcadcf5c54392971870
SHA256 3a1ee21a59e73f7f4e8b7535501ef6b0b528019472d9e5c5778331758e35200a
SHA512 7c8460d7665034838ab8862c286394390750501ab9d681c52bf44da7824d620d85d7ff57dcbe761f4a9a091c6de7be89efaaaa1ff4ab4002ee5902bfac914b15

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg

MD5 a3b3139f75205d176f310bc8d087cb5d
SHA1 92825048c870c302d7e4d88df8cc4e98233a5837
SHA256 f4d10fe6cd6ff7ff82d8002606c29d551fd788ba4b8a623003e1c5c6bcedc843
SHA512 028bccdf0968818ea38777290e822d128a68a9446214668d417b6afc04cd191adc1a215dc529e3e58cba982aad4bed786c8fbb98e0ff3683dd56b10fdebcdeb9

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\yellowCORNER.gif

MD5 3d615f1cfe48e6b70d468e544ac2b576
SHA1 3205d086f7dad7f589beb2a240d7207f901de8ab
SHA256 464163505bea41ef2cbde3924b909c072a42f7421772aaa11388caf9c971432d
SHA512 d5f708106872b157a370522b9ea537d71fc57478175a532cee21a1aeee114146f5c9e1615c25d7c8f2c54c74134706bfc577b671bf3084a0aa8ab1b97197a542

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SQL\en\SqlPersistenceService_Logic.sql

MD5 b1f265a99bc7decbd7149056029de05a
SHA1 1abdb6381b8f5546ae2b3f7d5491c858707780c3
SHA256 4fe6af3082b244a57e3d3d13bd2152ff3a724c69ddcb7c052f2b65a7f69ed622
SHA512 eb372f01e3530e5c7f9a6c8fda4b8317ef1f966c73dc64fa7f5377959bd32ffef5b7f2bc0c141ca5cda240f7e8999bc42c419dc03a553035325b9de6bec198d0

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SQL\en\SqlPersistenceService_Schema.sql

MD5 eba0f1236a32b0908c2d59b4ad7802eb
SHA1 8545a10beb2aca9393c7a86963a32e942427f0f5
SHA256 6b75af745c95d23dc641f95dc257e00d83b5ee8e7c4950b029c06879c87cd897
SHA512 bc3ad1c8ae735357d60294085a780f443efe6753f418b1fd221c7ff014b1829c76967d759d11df75bb1ffd918e18abe2fce7484ce238167a96a2aec7b40a379e

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SQL\en\Tracking_Logic.sql

MD5 cbc7fe675cd619ff9e085bdee48f34a1
SHA1 b7beb0e5ce5ea8ff6f87c30c524fd2f0ccd7c5c1
SHA256 c973fb484621e398c3ee4f4ee7779e8012c1bb8992add5ba633a4aafef8a52d3
SHA512 f1e6960ad7b49972b7c6bc17ba72636dc49097a53858b7443932a9eac9470c8e28258c53809ae8e131e924ea5d366e2ea1cdd848fdeac8528cd972eed4d9493a

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SQL\en\Tracking_Schema.sql

MD5 2f8137035243f883794af0c7487d29bf
SHA1 e84900a6e75b347c46414ea3d2aa4138d59886ff
SHA256 2836550dd82ef09a45225b1ff42fb5162cbaf68310e53351092098141df51450
SHA512 00a1cc48976b24a309b4beae9c996eaac00925c630779e9a29be1362d25b9d413577dca76db42a7e35a2e08050d60dbd9bb69fd9f657351c07be3b8a66b33a93

Analysis: behavioral2

Detonation Overview

Submitted

2024-12-11 21:18

Reported

2024-12-12 12:04

Platform

win10v2004-20241007-en

Max time kernel

100s

Max time network

141s

Command Line

"C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe"

Signatures

Renames multiple (2346) files with added filename extension

ransomware

Drops file in Drivers directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\drivers\en-US\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\drivers\ja-JP\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\drivers\uk-UA\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\drivers\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\drivers\de-DE\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\drivers\es-ES\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\drivers\fr-FR\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\drivers\gmreadme.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\drivers\it-IT\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\8lX6v1peh72Mukh.exe" C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\System32\DriverStore\FileRepository\uefi.inf_amd64_c1628ffa62c8e54c\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\oobe\fr-FR\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\wbem\en\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\de\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\netathrx.inf_amd64_220db23f5419ea8d\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\netrtwlane_13.inf_amd64_992f4f46e65f30d4\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\wsdprint.inf_amd64_b616bed30e8928ca\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\fr-FR\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\icsxml\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\acpi.inf_amd64_605a5cafbbd86f6a\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmnis1u.inf_amd64_64035dd8a7571ba7\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmvv.inf_amd64_26dc960cc4c84207\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\InputMethod\CHS\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AssignedAccess\ja-JP\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.ODataUtils\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\es-ES\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\Bthprops\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\cht4vx64.inf_amd64_b03448ba0b72ec47\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\hidspi_km.inf_amd64_7e53b3972dc4df20\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\rndiscmp.inf_amd64_81bff1eb756435c6\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\usbaudio2.inf_amd64_8d164ac6f7088f97\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\wfcvsc.inf_amd64_dfe08f401a2eedbc\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmcdp.inf_amd64_919b7beec2c70482\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmgl008.inf_amd64_c0d977e565fdc839\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmlucnt.inf_amd64_f4769cb994ece833\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\netmyk64.inf_amd64_1f949c30555f4111\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Dism\es\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\iSCSI\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\c_fsphysicalquotamgmt.inf_amd64_796516c18b264f1e\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\tdibth.inf_amd64_e1022e6b4f7ab56d\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\usb.inf_amd64_683fd853c8b8a4db\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\F12\es-ES\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\spp\tokens\skus\csvlk-pack\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\default.help.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PrintManagement\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_RegistryResource\uk-UA\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ScriptResource\fr-FR\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\wvmbushid.inf_amd64_fd2fe159a9daf508\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WaitForSome\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WindowsOptionalFeature\de-DE\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WaitForAll\ja-JP\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\c_fsreplication.inf_amd64_cadbd20a667cf903\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\c_wpd.inf_amd64_0245a364d71cf6b5\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\netvwififlt.inf_amd64_c5e19aab2305f37f\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\vsmraid.inf_amd64_3d2bbc45931b8232\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\wvid.inf_amd64_7c50642b144b870d\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\InstallShield\setupdir\0816\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_EnvironmentResource\de-DE\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mlx4_bus.inf_amd64_4c426f3bebc68844\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmracal.inf_amd64_dd534e815632509c\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\megasas35i.inf_amd64_4df7f6223ebcd28d\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\megasr.inf_amd64_72258921635be994\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\netelx.inf_amd64_7812e4e45c4a5eb1\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\lt-LT\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\Speech\SpeechUX\ja-JP\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DirectAccessClientComponents\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_RoleResource\fr-FR\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\SysWOW64\de-DE\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\c_magneticstripereader.inf_amd64_86e291110e37418b\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\mdmtdkj2.inf_amd64_46dd0342577f43cd\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\netwtw06.inf_amd64_2edd50e7a54d503b\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\prnms012.inf_amd64_707d3849370b9d23\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\System32\DriverStore\FileRepository\termkbd.inf_amd64_a0634dcf2da1127e\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A

Sets desktop wallpaper using registry

ransomware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jmobeeglobbdggdg.bmp" C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarAppList.targetsize-40.png C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-Google.scale-250.png C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\Assets\AppTiles\StoreAppList.scale-200.png C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2018.826.98.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraMedTile.scale-125.png C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-125_8wekyb3d8bbwe\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-60_altform-unplated_contrast-black.png C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\Scientific.targetsize-16_contrast-white.png C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\TXP_Flight.png C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_glass_100_fdf5ce_1x400.png C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSectionMedTile.scale-400.png C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarAppList.targetsize-80_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\StoreAppList.targetsize-256_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_US\Excluded.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\legal\jdk\cldr.md C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-60_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-48_altform-colorize.png C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-60_altform-unplated_contrast-black.png C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\eu-es\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\256x256.png C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\ExchangeBadge.scale-150.png C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\LTR\contrast-white\SmallTile.scale-100.png C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\iheart-radio.scale-200_contrast-black.png C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_Pester.help.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\loc_archives\en\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Thumbnails\Sticker_Icon_Concrete.jpg C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\SplashScreen.scale-125_contrast-black.png C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\hr-hr\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\sq-AL\View3d\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\Logo.scale-125_contrast-white.png C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-96_contrast-black.png C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\tr-TR\View3d\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSectionMedTile.scale-100.png C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\AppxMetadata\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\WorldClockWideTile.contrast-black_scale-200.png C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\AppList.scale-100_contrast-black.png C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\BadgeLogo.scale-125_contrast-white.png C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-80_contrast-white.png C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Square44x44Logo.targetsize-36_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-32_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-white\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-72_altform-unplated_contrast-black.png C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\AddressBook.png C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\new_icons_retina.png C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\195.png C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\es-es\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\TrafficHub\contrast-white\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\pl-pl\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\LargeTile.scale-100.png C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageAppList.targetsize-20_contrast-white.png C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\Background_Safety_NoObjects.jpg C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\plugins\rhp\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\da-dk\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\fre\StartMenu_Win7_RTL.wmv C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsSmallTile.scale-125.png C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\LTR\contrast-white\WideTile.scale-125.png C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\themes\dark\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-16_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ko-kr\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Program Files (x86)\Common Files\Microsoft Shared\VGX\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-white_scale-140.png C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-filepicker.appxmain_31bf3856ad364e35_10.0.19041.1_none_7862ca1f7379fdcf\SquareTile150x150.scale-400.png C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-t..interface.resources_31bf3856ad364e35_10.0.19041.1_it-it_3ebe1e0ff4a3730a\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-g..-base-mof.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_f91e0ac1363cfad9\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-nlasvc_31bf3856ad364e35_10.0.19041.1151_none_dc560ad6c013e621\f\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-smartcardksp_31bf3856ad364e35_10.0.19041.1_none_6be17c8122b64bfa\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-ui-shellcommon-core_31bf3856ad364e35_10.0.19041.1_none_91b1f58702057373\CellularToast.scale-125_contrast-white.png C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-hdcphandler_31bf3856ad364e35_10.0.19041.746_none_65c2c08a23dfa2ae\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..okerplugin.appxmain_31bf3856ad364e35_10.0.19041.1202_none_d081f9868ac0a804\PasswordExpiry.contrast-black_scale-100.png C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\wow64_windows.networking.vpn_31bf3856ad364e35_10.0.19041.264_none_14d5bd407f524c83\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-m..demanager.resources_31bf3856ad364e35_10.0.19041.1_en-us_bf493abe1176addc\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_wms-chm.resources_31bf3856ad364e35_10.0.19041.1_uk-ua_1c41d961cdffbe1c\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-xwizards.resources_31bf3856ad364e35_10.0.19041.1_de-de_fd8c8fd0071babca\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft.dtc.power..l.scripts.resources_31bf3856ad364e35_10.0.19041.1_it-it_2d76f50e984eb7fb\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-t..nkrecognition.de-ch_31bf3856ad364e35_10.0.19041.1_none_7919a9fbf0725602\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-usertiles-client_31bf3856ad364e35_10.0.19041.1_none_df86f0e7b84bf07b\user-40.png C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_ykinx64.inf.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_d2d59ebe793090f3\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.19041.1288_none_d9539a9fe102720c\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\CYRILLIC.TXT C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\it-IT\assets\ErrorPages\http_400.htm C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-microsoftedge_31bf3856ad364e35_10.0.19041.264_none_ef195f564f00d259\MicrosoftEdgeSquare44x44.targetsize-30_contrast-white.png C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-s..resources.resources_31bf3856ad364e35_10.0.19041.1_en-us_bc6bb427497320ba\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_unknown.inf.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_894f22846eee75ab\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-r..t-v2-core.resources_31bf3856ad364e35_10.0.19041.1_en-us_fa34c4083f8eac3d\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-onecore-pnp-drvinst_31bf3856ad364e35_10.0.19041.1202_none_ca1e0a7a1f21274c\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-consolehostv1_31bf3856ad364e35_10.0.19041.21_none_366e294ae81d8c31\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-v..ure-filter-tvanalog_31bf3856ad364e35_10.0.19041.746_none_4b8e94dacaa0adce\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\msil_microsoft.certifica..t.cmdlets.resources_31bf3856ad364e35_10.0.19041.1_en-us_ac3961ad28ad6512\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-d..t-onecore.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_dabf991f90a68c4f\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-i..ingconfig.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_c38665ec78480172\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft.hyperv.schema_31bf3856ad364e35_10.0.19041.488_none_a82f565621f4835e\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-bwcontexthandler_31bf3856ad364e35_10.0.19041.746_none_c7440cf0162b9bf2\f\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-dusm.resources_31bf3856ad364e35_10.0.19041.1_es-es_1d4d399c4d3f29aa\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-netplwiz.resources_31bf3856ad364e35_10.0.19041.1_es-es_e51b12575abf6254\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-coreuicomponents_31bf3856ad364e35_10.0.19041.1_none_03f084fd11897e73\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-printing3d-winrt-core_31bf3856ad364e35_10.0.19041.264_none_7e6520f6092da338\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-w..tnet-mua-hostserver_31bf3856ad364e35_10.0.19041.746_none_b93dce693a9c6db9\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-dfsui_31bf3856ad364e35_10.0.19041.746_none_37b94d735bd22150\f\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-store-licensing-client_31bf3856ad364e35_10.0.19041.1_none_bd00dc33a869a94f\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_netl160a.inf.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_78a4fd4caff2cb54\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_wsynth3dvsc.inf.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_afb501a324a6f582\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\msil_microsoft.web.manag..nt.webdav.resources_31bf3856ad364e35_10.0.19041.1_en-us_749e1a0bf831f608\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-azman_31bf3856ad364e35_10.0.19041.746_none_3ea50e5445e96359\r\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\SystemApps\Microsoft.Windows.FileExplorer_cw5n1h2txyewy\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-controls.resources_31bf3856ad364e35_11.0.19041.1_ja-jp_c69be8787f60975e\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\msil_microsoft.security...licymodel.resources_31bf3856ad364e35_10.0.19041.1_en-us_32298de2240861e7\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_en-us_1279c10c2d9636d4\500-17.htm C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-n..oundtransfer-common_31bf3856ad364e35_10.0.19041.746_none_81ab93cbe6fbb519\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-sensors-core_31bf3856ad364e35_10.0.19041.746_none_884674ebabfe0d4e\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.19041.1_nl-nl_61fdcb9606b8baa5\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Providers\App_LocalResources\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-lxss-wsl.resources_31bf3856ad364e35_10.0.19041.1_en-us_01d5196beea9fa25\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-t..languages.resources_31bf3856ad364e35_10.0.19041.1_es-mx_6ad0630b96d5eea6\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\wow64_microsoft-windows-winocr-tifffilter_31bf3856ad364e35_10.0.19041.746_none_1b70ed4b7ed28266\f\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Windows\Web\4K\Wallpaper\Windows\img0_3840x2160.jpg C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-m..oolsclient.appxmain_31bf3856ad364e35_10.0.19041.1_none_75cd350cc8b5dbcf\headerrestore.png C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-n..quickstart.appxmain_31bf3856ad364e35_10.0.19041.1_none_4a388618f6365227\NarratorUWPSquare44x44Logo.scale-150.png C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-w..win32-dll.resources_31bf3856ad364e35_10.0.19041.1_en-us_599754e5b9029653\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_hidscanner.inf.resources_31bf3856ad364e35_10.0.19041.1_de-de_1d66074e17d6cca4\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-n..quickstart.appxmain_31bf3856ad364e35_10.0.19041.423_none_72535ca9b59a9515\NarratorUWPSquare44x44Logo.targetsize-48_altform-unplated_contrast-white.png C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-s..-cryptngc.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_1131de8bb2fd5de7\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\WinSxS\amd64_microsoft-windows-u..lsettings.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_24affe06b00d9f2c\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.RunTime.Serialization.resources\v4.0_4.0.0.0_ja_b77a5c561934e089\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
File created C:\Windows\rescache\_merged\1973483750\HOW TO DECRYPT FILES.txt C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.CryptoLocker2015 C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\JIXYNMTGOFNNODU\DefaultIcon C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\JIXYNMTGOFNNODU\shell\open C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\JIXYNMTGOFNNODU\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\8lX6v1peh72Mukh.exe" C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\JIXYNMTGOFNNODU\shell\open\command C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\JIXYNMTGOFNNODU\shell C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.CryptoLocker2015\ = "JIXYNMTGOFNNODU" C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\JIXYNMTGOFNNODU C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\JIXYNMTGOFNNODU\ = "CRYPTED!" C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\JIXYNMTGOFNNODU\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\8lX6v1peh72Mukh.exe,0" C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\e342274b59e65578a37019215b798b45_JaffaCakes118.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 83.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 197.87.175.4.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp

Files

C:\Program Files\7-Zip\Lang\HOW TO DECRYPT FILES.txt

MD5 515f29d240c8defcfd6ee9395f2f7564
SHA1 e7ff1b461236fc7dacfa7776e43bde1188fe8a0f
SHA256 dabcf6b327c3ec0f177e21044c1aa01d215055b8b195aa1a7298ff8f8820ddc3
SHA512 5c42006bdfde4ba445325c3ad5dc28b5c5583d50c0cd853911c6224827b0dc1ba76d3bb16514b5815b3d82ebbf8e990a32ac64450df45de52a9f36fe74e0bf8c

C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif

MD5 61f51ef4c749977540451baa47632167
SHA1 bb9f0c5d17205316589cfaca227feba29de7f324
SHA256 536c04cf0c28c408eae391476b9e3e192dd595ab2d9dcc657eef9899454b2f33
SHA512 867fc234780ac7f432cc6f6b256117293fffb720b286397b8e7856830821ec5a81dc7753c3cf4b25d6aa3fc9a5b2255270a41705bb3e393da862f00a1b1abcaa

C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md

MD5 aecc71263bb97bbf6fef382b1524cc50
SHA1 5e8e273ed72774fc1a70a2c4372261be9901a319
SHA256 c1088c6b9019c69204f6754778a88fa7c62039bbb8aadc88ecef64ea8ddfa3d1
SHA512 ecfe1d2004eff72d2977d4d4d586d447498a5148de9d2270ded37bf29729735edf7d7646359864530cceecbb2d6ab60de69ff0d202f0c8c7bb891090c5c75c50

C:\Program Files\Java\jre-1.8\legal\javafx\glib.md

MD5 985ddcb637e37ecfec27b92c4e69210e
SHA1 c3c725a3b06755c6c5664ece432faeae2d56ebc9
SHA256 95849fc1c07c6bb2f298e84d11bdb651813ec5cb16e5bb64e404fc428d65431d
SHA512 2ba56a52d34385b9fc9205037cef89b9cb6c6af86a471865f219a12ca08bb1bc422cc0c9ff50dd34a4c68339ee84feb8527f394a1a51ada7c79f34763d862703

C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md

MD5 61e20256f286b9611ec31134fa90d027
SHA1 a53f747c812e9fdaedabda23bfd600057b52e988
SHA256 d67f320c2297667c987b57fa4d290b140b115a6a9669acfe1f06797bcefec3d4
SHA512 9a651177d1edadb5b969255fa19017d4753eba9f59864db37af0d313898f96b17d2e88c2accfae0161a9a8cfbe2501e91c1b5cc7262c3c15f7d60b90d4158351

C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md

MD5 f36fa926fbb317f1728acfb457327dbd
SHA1 31fb6601bf500b3fd4f04786b56a1d9fa55ad1d6
SHA256 5915285b49241dbd3887c2de9f8fa744f8d701d63a858f9f9804ab3fd3422a2b
SHA512 f9bc819e2759a787769c619f9992986004931bd9dbb601e040244c71e524f467524a73c17441fdd37a244fbdc7bf773f15e24837554e8e30d2d682ed0193f8ae

C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md

MD5 b5ae8d8fe89568739e44a14b6ae2f022
SHA1 4262e586a2d8a0734094242c178f7d6aaf834a9d
SHA256 a08d88ac954150a5c673aa7b90ae9725b57d2aff50ac60432685d764bb0fd497
SHA512 93ce909003735de777e9bb0f68cbbc9b4c22b633ad047a7ce7b6b7597d6e954cb78af90237654e8ac27b27573247314e16836146833f31069fdb10a53e2a3fe4

C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md

MD5 7019e074b8d10739ff474b8f86c8e825
SHA1 ead9b6a59946af35e411d9c10d85f8ebc77cbf61
SHA256 f194f29317d9198b086fdd090194e6bd47d296b93818225015567a0e27c6a4f7
SHA512 ce72f49af4731d9b48e6cb2cdce201c58c767020cb772f9854a94dd7d856b80ab3cbf55b340ef6d2fa2412755db4acade4e621ced5a9cc04c7508f1f8c8ff2ac

C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md

MD5 495b671793daf9f7f53da86a5b0022c7
SHA1 ea226b92a64fa19698cbeb11e6b372521917b745
SHA256 9be684995d8e5001f5bc83446601e20286ba1c082c75747486c7713fe5735c3c
SHA512 0c07c66e326fcd9ca6591843e67ef79519a0ca6a6a11b1a92c88b2549480029c32a7db1ab4230e7dcdc33b70d9bf419561af8cd571429c7186e0601914c83a87

C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md

MD5 92aabae7a473e54daf687146453f28e6
SHA1 15d6eba289e1c5ac96c6115ecc4c70278fc5dbf9
SHA256 2a93451c78d9b07dfaa82a62442d3fbebbdbba620d80122273c84502dcc07033
SHA512 b3f3a887d427393d0f184622d23291b23768f20d08df328a6ee491903684f4babd9b29aee2cfd33911762f541207eb11be2d37632a91b68b8b7ae4bfc434fc68

C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md

MD5 9b859ca244ab30d42e15fb361c83f1ba
SHA1 091c4d1854d8a2252c37ed15543763b9474321e0
SHA256 aefa3ad6aac4f9ef6d1a980fd7be61415c9427df4c34217f5c6c717605c6f7c7
SHA512 fe6c7ed7fe95423d921d4dbfd35beaf4dced474079877684dc29a1b6521af7856c52bdd53e5518650773c9b398d8f88df3027a0acf7728c89c100336211f7d42

C:\Program Files\Java\jre-1.8\legal\javafx\public_suffix.md

MD5 9375465f66b95f6f1d4cd195ad2665b0
SHA1 362d9c11f6707ea5cfa3c9596df252db9ee6cc2d
SHA256 fd7617c38cf499c91e20cd453944ccbca68a7cb0e5f3a1158a943729129cac72
SHA512 9dda636f15efbb5be4a9ffd40bb63a6ce1966e534a1160750987a96991cd0e0895664946e9aded5888536519e57d29a67a8510485e2c01ade745a3441e7fd215

C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md

MD5 77326d505e9a7fcf8dc312a381dd6a83
SHA1 3080cf2ff0c649730749edcb384aad45335ca66d
SHA256 f0212b4ce6d3c87ef3ea2cde02388083bd05b81a16a9d89c144eba9e7c9cc97d
SHA512 9a7ecbb43779f42c68584e791aff2cddb4113d640a4bbf6a7aab8e8bcc9d265525a3567f1f1f7193246edc3d2f03c732080ab9ab73a4258910742b915b3899d8

C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md

MD5 679300d1a275f6e22b957ab7d188a65b
SHA1 a246e38fc2f556b529ad4af7d4ea05caeb08a66f
SHA256 bb209f550ca274dd1ccbbb8c141561acb449989666367aecb84aff7e99a16c3d
SHA512 a1d60f1aa52755ec58a36ee7f127763a34d82a438901146f7176f314d694282cdb25acf8cd7bbe09a82d83938e36465655555cd2409a02e4e8ad0acd4fef33af

C:\Program Files\Java\jre-1.8\legal\jdk\asm.md

MD5 31a88f5b1e15e3997782a1fa344882a8
SHA1 7593753be107be92b9b108972f80e4109a2d93be
SHA256 5e59cec8a4fe732fb998ea3462ccf5f142f5e64f3b8443fa82d4f1fdc5156f43
SHA512 b95dca151c0b881a625c2847028e0a5f6dfeb119c374c2a247d8190941b6469b8a893687eb9a606e1a088490a7b6b0d972f6597dcc74e1066490ea9daa094de5

C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md

MD5 8365aa835bd88da082bc26000453bb6e
SHA1 9a549b0341b9e5a814f2ba5147fc4bc190752ec3
SHA256 cf5d6fe6f0ab84b55811b403890e89eb063919ed7c3ece1c7b6469db3269b311
SHA512 c74104e77618962df9dd80dd270cc9590a3d49cf84ae0d1ec7fffca1678a2dbbef6f44c37bddcfd06e51b0296f8693a4d9e544a42e23b6e47497b5d7963718f8

C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md

MD5 561b6e7baa3006d16c89e45ca8184091
SHA1 9621663c0d0a80050713e9f3a81c36cdbc4b42c6
SHA256 9f9de53d9052479e5f7e9138048f8a069bee1e6ff8822f3dc22fa91451c0d66c
SHA512 a05d5e52616ecfa8c8f5db692c24a923571fb08776a2e25354f402d24395c9afefbe170dbf7ccd1828f06f9aac1a5b66936a800724e508e4515157ac433d737f

C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md

MD5 aa4c3384e3ffc3b6fa32b32d61451fc0
SHA1 1616375e82de3fc5086ff9de7a085f8e5821da62
SHA256 69936abce775e68f8f55074d1b3bfdea95a75557615ca404905b968f7f653562
SHA512 81ec7d177ec3b02988b7a98721c1ea368f250a02fcbbbe05003e475ad2a1ab873e16a3eb773b66cf240d82b231d76be9bc3ed6b91504d92c84fbeaa989a4b2dc

C:\Program Files\Java\jre-1.8\legal\jdk\dom.md

MD5 8b66e2c3e3e1f246fa72331d44d77567
SHA1 5584c620017f1f6b061607bca6b8b13af3a125da
SHA256 b9d7798c2a77a639602b827944c51358b2959687d961d52de8c884c9789e8f0f
SHA512 31e5b580d4e328af4d1b5c326e04d83fbcb2d6f2269a68c1a7b2f36c5d161ac324c7ed246fce5a007258a83d8d64ab75e6d2e1cc09cdb877cfa62d0851e9704a

C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md

MD5 67f5b70cb5bfa08cb7cd50997252fbd7
SHA1 825ab442aa5167c9af7d284b3e29936e454f3f45
SHA256 be4d368846e19915c9e217717cbd66b2c96254b34d39f228face0391d894ff8a
SHA512 e1154ca4d87987ac6cef08df9270c6528f7ccb1b4c81f3b56c53a838843521dbb259e897f930090ed9ff59a257b4e1a8035d302a571d7d5bef8008ca78b77c89

C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md

MD5 5a1ecf98c0984a66d9c58f02a64d942a
SHA1 7a7a04c13a83853a5e8922e74110b708307d1eb4
SHA256 173360ad6972577d1f91eaa56468d95b1b220ec1845ac1ef89369bf28242cd16
SHA512 62f9459cbe12e8806f20c9f9680903ce3f7987ef12583d5c8e5160eb1e8f188324f59fdb0bcd770e7344ba71deeb0c335812265c459ce90a028a2322661e26f1

C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md

MD5 d8e526bac8d01d7b0008abcbc5f39184
SHA1 bc9c92925de0796990388f405e60ce5aba8d3b80
SHA256 615190676f59bb134a6f466b4d3cec62115f474d598d166d7454eab639d7232a
SHA512 0c0a93dc220df721fb70ae90a9f343e43aee041bcce4f931953ba7d3ceaf460f9879125a26824129a9f7f4fb2b0efd9a8e69c8e61bdc6ffd7eff8de8f59684b3

C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md

MD5 178766bf5c65b1581efd6e793fc2947e
SHA1 69f8a25c00e57d21e632e734ec3cb8293ec25742
SHA256 c0366bd5822bb8a808c77e9c815031502b59f6269fc7e117425b96d5e0749c3d
SHA512 bd797e70b7b985cf040f4194819cb27a958b0e372695ad931c73a4edc5579a9c7d76e3927112bfa8cb357eb66b4438519fc6055536f6e2d86b374718366c92c2

C:\Program Files\Java\jre-1.8\legal\jdk\icu.md

MD5 ed35df8121c275eb0025565894a41ea2
SHA1 ea5c68985db2dfce7a743cb1da816a0bb28eb473
SHA256 5e3d868ea4c3141204e114bf8255664446077509e321192ca7c99c17eeb648a3
SHA512 f5bfbadbc776939a29923b8d46bada28b03d69fc8f8ce27713cad7e109ec0b16233ecda97fe3800836fdfd2e79de256115fc8577be64d6b65388bdc9f111f7ac

C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md

MD5 47f3e0cbbea48ae5a3c0d2ca8ba9f6ea
SHA1 853124df1a62c11fde7e1cce0e777d43e306ff09
SHA256 f970b88e2f8af8a1c554f26adfa8af12be16f9e48fba7cbdb31e2bc774e387a0
SHA512 1ce44241f033e80b717193707ce22e0aac6745de4bd7dc816ff426bcbed734921052013ba8908508393a38e889e69baa5d01e4f176476a299d7ef94b717f6a9c

C:\Program Files\Java\jre-1.8\legal\jdk\joni.md

MD5 4b7e5ac0e325dca9edbb28b335284f22
SHA1 fc2947536cedb130d1bc6e3425e62bf7991dc2f7
SHA256 e17c6a5783b463ba1cb0345fb395d442a805cc13913d1efdcc1c41de16713818
SHA512 b39a7c0aa8e89456b646f2322bdad08f5e7a48bc12724f4a766376ccf6bee6e12937cf86370680aa1d5bb8344228388ad90a25d2619c3f7e2eee1a37f6951393

C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md

MD5 b8729821a39642694322020637bab0bc
SHA1 081e722b7956c38f2b1603dbb079e6de403c1765
SHA256 0faefa9af3bd2e3b530c8adc39442d21a07bdfc53039d051eff46eb99bd8734b
SHA512 6e31639cc3732fdaf07301a7b81913d23cbfcaec5ff73dc43fdb23d0a883e9c38199ecf4001c8d78f91312d7cb0d8641c991890c92932d2ad21d85e688aeea2d

C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md

MD5 7072ea411bd78e88b6ee59a2945a21bb
SHA1 e18749abca992b0b09569e29fb09e8b3f06c007e
SHA256 a6ae0917bb393ad886b572a2cd3643fb3ab5955a832009a88d8b08e9547baa01
SHA512 71f1337b11b91c47e124b4d0efc91ef40b28f65e154456119966c040e073f6d6872b0db9626ff295010f6ab2603af9f6bf7cc5aac5f0ae84bb8c185077288175

C:\Program Files\Java\jre-1.8\legal\jdk\libpng.md

MD5 55b745c7b0843e3f89ac271c663498d3
SHA1 3caa858164ee49aa50203e3ee31108f6de496541
SHA256 422a89048e60de925e8b76afd3f5c10d13f5eaed1c104609ef67856324824533
SHA512 7694fbd665a0ea752f8889ea50c7b283154b09b9ce4c08395fdfc8d62253780bd353622f975c8dcd7daf80a373625368a97130043c4f3988eec60d77594530d5

C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md

MD5 3a765edf38c843a0ebe7ebf9f47d2e2a
SHA1 fb38c6d2f14c4f7b9abdba2e623406829a2e079d
SHA256 e75635347edd68b421be5058f8ee2d12dfc4135a7de14abbff2fcf4d547d8b97
SHA512 1dc3c24d68042f384f318295b41c612beff4bcad94d9d491635e14a2f6d20b599e4ab3ae7891860d5aa2033bfaba10fdcd0b787d8cd8b6abff22da1f922c8d9b

C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md

MD5 798a3d75185fc7683bc18c6a2844b5b6
SHA1 54558b7052878bb639c36d58e0401ac0fb7699a2
SHA256 edd9fe5223abf711cbb409217601195337f7bb8275d5335e50a66179617c1b44
SHA512 0a7da4be61c27bc37fdc92d8745e3b31d2de9100b221dda30973c968197e9e1698d44ce5d0f2922b980898e3bbe1bc3a12ddf4abb2e8d205f3103db7221874b7

C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md

MD5 9fe18cda7cac62d8072adf86ab24e116
SHA1 1a8ba131136e02bf9db9683e35d9b172b4457c52
SHA256 c0a788cb181edaf08392b2acd91643d50129b01b981695b29981a3bbf6e31f03
SHA512 b057b91b16f58b13ec77aa14c3424f35efde7ede1211ad8cdc12b87b6de63839622db41f5b660955e56dc416785dd439d998b892f34354796ffbeef59fce33fb

C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md

MD5 8141005033a1fdfc1d9edfa5925da78a
SHA1 5f3cbaefffd6f27a13ebdf3df8e27962f1dd5a20
SHA256 3252ef9b6a6feca91368191516a266ed7ccf10dd8d912a67d264a3f2861c783f
SHA512 b9a38ef6bfb22680c6a8c4820d3c66f656a9553697d3680f31aa5f0b25149b834ddea76b0e83b737533e9c2468f3ad74fee10fdfe115671dce60451962689de9

C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md

MD5 143a2d7bc249891b2cc4946b0efd2d2d
SHA1 16c971a9f43c0421d371820d1228082ada5f28f5
SHA256 e2c4a044262c44355469e48aff035d408344efe56757e030044422ae44a6cb73
SHA512 e95a3e25dea2337ee2a0d1f5e863d681d9930a0e5f24215d2c1da314c4bf4c5f0b78504466bd1dec5ea5a60f7b139b9e55efe8aaecc479f81e0b0a6f666f6637

C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md

MD5 37686cb3783ec1993c670ef27daeecee
SHA1 1285f2242d23f6e9024967ec7d77ad9317476f63
SHA256 0946633140b95588f6dee16c5895f7dc0a2669d6a9c3a073383c75828962a351
SHA512 0a01b77d8957e9542197f5bf3eb65ba41203c6b0b38570a6e9c0502a5c57202ad1cc494c557b6442ac38914fc0617a91c1ea63a401fbd3b3fbfb0ba40c0cacfd

C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md

MD5 b1fd7960e04559a89efa58d86cd99932
SHA1 24f0920ee502c042a0091729c7da45c865537c42
SHA256 5bb39bd16988f0c37dc3fc09106db4544a0eed7f40ff4948cfb9282d58282530
SHA512 0a95228272ffd092145866a4218fd8f1d6d2be9b6c36404bd92d49b643b6ad7a3beae6e17ed888e95e71b3975200e2964fdc3fe6e057e6630d9dbc207c6f8ab3

C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md

MD5 d5f9b74eefe85471e86823c7aeb578f5
SHA1 1aba36cad62934f9b0c21639eaf0f85c9d901ce3
SHA256 b7e64b16e484c66cc1ce15c05be8791079b70663373c9fa28f6dade5d3dc812d
SHA512 8f25723f3202b959cdd3c2f4a81e1a976bb3b0929dc7d15962ca381319464faffb83e930c3dadd83145f3458c0b7faf605ab60f580549a3bfa7ea2070d8e8cb3

C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md

MD5 99182f4e22a7611123496e2c19dab32d
SHA1 b297d802f6294c25967990a17eefa9ea4c968fa4
SHA256 4807d259f452113e4edbfdd129850f25f34d2477a071f699bc651d94ad22e5b6
SHA512 306970aeb5d222e017987569794216f208a5d90489e4dfea6f7dcec0eb3a94b75212e1943ca0e3584aca24a56bdd81a4bd0e85ad40d0cfecda4f02cc3afb7eb3

C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md

MD5 2ea6348c2d8e4e6e4d4307ede6eddb5c
SHA1 dda5aead9d2c162e14bc3430d86ea4f50ef40150
SHA256 7ecbc102f6f59926771b5bc7d14a70b255cf089e2cdb2367a5ed4871ad3c3451
SHA512 a3898c66a7a1a8819547a3e38563f7db12deceec6a1266650a258e7904b355e6a665f31d71b026ef6a7d485b88f89ac7586bf20803d4f0b1b769a1c17709a28a

C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md

MD5 8f2efda0749a3ebd88fa49058d3075af
SHA1 b113fa2d8190f4630613c6f272369104639e479e
SHA256 9f1f3f396f157856edc90a407a6b005878741e53448b8616aaa60ccb091efdb5
SHA512 3d7a319b7ce86f226bf33344e590e4c42ed507b4740ba2d0572057f9ee056877cb2a0b48c17fadee9d598a0f829eab1ba4c33140ed09f527f770a4b693b91a06

C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md

MD5 f88e04d81a77b578eae247de70babfc7
SHA1 5c66d7df679ac2d8cf84feaee114e745f0995f4b
SHA256 d3e8a75f42389ac3068c7a2871338af18d97dbf7bba18bf84c0a4df55a867b0b
SHA512 c2d5f22f359123498339d910d1b1987540c0bc9726587ca15decd4f420d817d8dd8ef2c34543a12f00dc7107e47d3640196234c3038a9611f943a78f06e707d4

C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md

MD5 d4798c13fcfdf5cbca71555ea7f7f808
SHA1 727dcbd315cc2ba485d2879f11d1fb232cade467
SHA256 4e95e20add59a85dd74e2f78e23585fabb8d1acbc83a12a15f81c539299d2e9c
SHA512 f4c320faeaaf1a3e7baed7a23b609f537fd6db86f459dc0e5cd961a5d1778398ffba285f0a8f0454debc116f02993d2e78ce23414cdebf44142bad3e9dd27c29

C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md

MD5 1a188ab5b27f392f046b44e89708b61a
SHA1 1c614686353b923986808d07c561cb3558b14fd3
SHA256 959a5b62adedda3f48347f03447cdef92a3e9b14360de1ffc2fb6e3a81fb9e3e
SHA512 44d4b90c61699394f4379099b9b0ed8a384e20684c4f5d971adaa060052bcc4ce036db715f8e51983f27d61b891c0caf317f82e53f6552aa2f79843ae7f22c7b

C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt

MD5 6a86043da7e970f3a936e60f1b021c0a
SHA1 0e7466afd643210e6fe0dc8de568d41f8d2d296f
SHA256 71926580c3e091566d9316a60999908df51bd4a3a75f7341bbb189051b2cd878
SHA512 033d68ef297ec0ebdab347c8f569d3b3868d1e75b4c93a348ffb676b14d35a393d0416f5329b80a19d737479292359d34e3e96553bd2172e85fd73fba40d669b

C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt

MD5 1cfa92245910eb9b98a39e725cd2d051
SHA1 890992c4d4b7c3ce16be011f602b487b6245ad6b
SHA256 76e5c13d602247db44593713e5485b97740b4472473859f223d75a7580d0e380
SHA512 0273e461bdd874807cdda95d5070401007ade22a63b89eb5fb3acfc7964b17a6efb04bf7221c768737037661e0fc6b1ddf7cff04ebdb6a48582be1547b949b2a

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\aic_file_icons.png

MD5 744f656de755ff574e8381608a88e857
SHA1 93fed564996a389fed243903e87a0939e3fb54d4
SHA256 7affce34c23ec8e809ead4e5e7899daa8b9b44b07e5fc9989d80a3b9aeed68ef
SHA512 501b17c3efd6f46657c61b43cefe36a97622eb785f2df34c3ec57e3fa1f6641dbc7bc6ed7a597285cf9e9f2f64bd886c534dd63002477bc05fc13b5eec259fc3

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions.png

MD5 1fb8eaddc75481fb0a75839b332c9303
SHA1 f0a3332a9087fe27ec74e8b767a47c0d2c4b89cd
SHA256 0994f059534fabd1adb9db300c72960dd6d4196c19cb29eee34b427a5d816ea2
SHA512 33962b1c96573386a34a9d8a3902077f4600721f30a65c078876ba2c3c4e4715815a9f9905387761eea7a8330a69963c330fc5bd6a32d2eb2fe2cd0dcd63d841

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions2x.png

MD5 c6c64ae5a26e727696d7de8c2fec87e1
SHA1 aa1011b735c1c6c9926d5883630cfc80ea38d00b
SHA256 7c2b9fe5e8b80b004af5489e6cd1c17fee6c638c8459413f4ffc9f9d66008e2c
SHA512 0f4f3dcd680bf665511c847c7d3da4ee567b0652b300794ca8066195c0b8e9dfcb6d3d8dc48126f61e854ad6d1c209c2f76f341144a07bc826bd7e6de5ff319a

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon.png

MD5 0eaf9e01d5e54f4e48e317c360779886
SHA1 0563b07161f9d47ae50d4634461f396d47c3c845
SHA256 254bfc3d4b368ef0b7573bec35c011ab2d40df3c79371d0842d0025999b1b402
SHA512 d6f695305bf7e2bba893a37e1ab67f6bed12464858ae2f3d153f4946c3f01e7251785014d1e5c06845d55b733512a00801da0ef56be554b262f29a072e74316e

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover_2x.png

MD5 176582b8d4c62b79dc7e5a4190231546
SHA1 25408e3d4943fdb05701cf4e466c77d6cf5c8db7
SHA256 c1558582a9db68876d4824154b494ed73d6350c8afe1bd37bdd6d1420ed6f072
SHA512 a1024613e78c8f08d64b78661a83aaa6a3b76a90fbad1f879ed5a76580d714df999207166e3d2c0571042df0d2ca35a33501e3fcd638b7e35b313d3c98514a4b

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png

MD5 51868d1708703313837043d5a80f3d27
SHA1 ba55793c5d4100c939f9456c13dbbd42b9dedc02
SHA256 ad44178289de78428c15922e3527d00cf10a890418b15ddf670f4a917ba7c4e3
SHA512 e39af2f3a7f2c28dc258d3833631ed1d296ca97804b9b5bb26454e66e2ade777bdec0b185fcd066e413c400f704f1e7d9940f1518a2ed36b0fe1664e59a9ab37

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png

MD5 82f58729c8361cd8d171b2824734fb2a
SHA1 851974301be099f6c17c2a6cb576d7f02b963816
SHA256 603ca10a0bb57c349fe004a6fb2a3717e8c8ad9ea4728b6198f274664b492b0d
SHA512 546639aabf97bb8352bf2f2365af5f3e804af5e2b425542b5e32a9210952d8b3474274b8b58a3840fadc0fcdcab5f3eaf30ca4b2c30d444e79291dbab927812c

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover_2x.png

MD5 00ebfb4e8dabecca8a14bf9a3d8ac10a
SHA1 83f134b6218aca9b1be695a0e078730047764ccf
SHA256 15f17d116c0133571938512ef6702f03f27c5f8b0cf508ca9f5dabd97e4216e1
SHA512 75061c3221715bfd3d107921b30b0b0a169ed95d5f41095ce098b4978248fba7ef98af0c946f5ad8d899ca6a2f32af13b6a64157e6e53e8e6e66a53a41707b49

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover.png

MD5 e4f0cf3046a14f813da0a5648206816a
SHA1 054bd1e393519a15fd9ed7a7086a23c7dad635e7
SHA256 d1d9572e784e04abd763f91a37105bc8f24809e83c95d7a9854ad49aca75be33
SHA512 bfb28b2c7c91870c003fea5343774108b009bb706ca27b55aea7324cc5350c7d0c924766faa0a4b88a4388d2da5bb777d042b015fe1b6664a2594b0390a50979

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_2x.png

MD5 0853029485b861703b68ee0d989045a0
SHA1 a2b39b10c4f1a7be6672543b4ca92aa6521bf168
SHA256 2c81a30f497867e438ada90b2d6d7ec772f8a5ac3a8217c0c8fbb9ae7ebfb507
SHA512 dc4d835cd09719a1779f8abb09fdd02a6c766a886c3cb255c7d8ce9f2b4428e65ff38bcf39717814725cf9907412203560948e4f07402c7955bbaff9140afb88

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon.png

MD5 59fef74b8cde5b828145d5499be647d6
SHA1 4eadf5286cc5fe8733df5f5eb722fd60ca547a98
SHA256 5cc69b2bfc4b0363ffbcc0735b2914f8ab50fbcfc0c2f94d8f47929509f0d55f
SHA512 dd831cb20285c16991813dc64cd0cf63a89f2869f17a3289938b33d1735359250edf4690736e00b0f1794a2db34b8e8107fdd38e69c951645fb1b88b5d2b1ee2

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons2x.png

MD5 4333aaf9c9c8d6d06e07e67d6aec6114
SHA1 d41238ef98e73c84cccadfe96f8004659e21d538
SHA256 7462b86a1a8fdf0b24b1ea3c8a7d01fecf4290057b8bec44597d18c5c51bebeb
SHA512 ac2ed5b0f4b7d89fe2fc6df3d4b1d7918bbc88cd1413f91abd7e60b450e1318f4ee057b2106aeb52af74426e09dd9c356209d7e4b7c5e9d31ea9ee424db82c4a

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons.png

MD5 11fcae38ec006cd6d7f75a620fdab5bf
SHA1 1b70987d937ea539031dacd3c0d6a29199183aa5
SHA256 a4548c447d56bda279ae851eaa8f4825d17fd417e1048ae7a202714f893c5d85
SHA512 821f9f6134621907368d2529d389e5883f2980c56ea0b05a4278506be4a4443544cfc2aa265a21a72f715d78e83ff94fcb9252d5ba824fd3d47753d90fd9ad3c

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons.png

MD5 14f87ee10d1ec05e626ddbaf204e365c
SHA1 6c19196526bab45d97bdcd556700e51d8e863b8b
SHA256 fe5abcf4c210658c9adba71b96feb2e178e3a7d8c57aabda448a3acdcfcea3f5
SHA512 7a9e1971c46ddd506a0ae6930fce8b95ac707c397e6367975ca859240b136342a7e139e231644702e8887e66ee3247caffefb186f92064d004cb64f77f79ffac

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_ie8.gif

MD5 90bbacbe9570d0f944d81204c02c9bcf
SHA1 f92b02a392e8eae8eaba34937aec23b762b4e859
SHA256 82d56e58087b4e230f92bb42b473d3db4276814386ceb69f6136a76f89f673f0
SHA512 2becd89d1baa1db7a90fdf541ad73335a66d9c2765283bc697422519ecf4a2f0f8bf644dc8870ded0fb629e341adf97a45a37d83744cec99c72dbc2c953b1a72

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_retina.png

MD5 86f1dc78b6dd23bea07261521cb52d3b
SHA1 970460c5c756d21b4f20703951925316c56d28da
SHA256 2391ede99b39c1f38d02e9e87026e2cb7388571aae912d97c7f4152a7a704aff
SHA512 d81b8690bd96d9d5b305f0817d6b6a2b7d18b201956db48f666f73c83140c96861b571be40f9d536aa9b73be146962eba90bc30adf8b3ae2feee49b86b6548e1

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons_retina.png

MD5 8fbea186ad51a80333066773f5414f25
SHA1 f8dd942420586bdd821e0be56496b9db74916c73
SHA256 bdab0037598093f917b41516c604ef77d96ab730e06266387f6624efb36c8d44
SHA512 da6724b1fb5fe13adc1bca427ee58fc3bfa5cbfaf9cfd09ca3aba87302c3debdc18f0d7f5e49f55d0fd93d71de5b27df5ed0037f2c089a1e72a5d0e9218eb478

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons.png

MD5 ed76ae2745bb5ae2226cc87b1751242b
SHA1 940c69fef525696bddb0bd94991248e70da69d61
SHA256 bd23c4d24af20d390868cc361a47c775c5a54cbb370ef0b3b4ba474f76460426
SHA512 26d52b6604b7fac0139bb336d2b4e52dfe90c90b2e710cfed1eebd2abd56ae20691096be68cfc005ca059efb49ce61f4598b5dc411a10b4224b48e01b0858c1c

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_pattern_RHP.png

MD5 fd5644bac84502ee9249ba1a0730a58c
SHA1 3bab8796410c403c6b4019860c04e8e04381ebca
SHA256 584c69ba72a6276d26cda274ed9fa0f4558e5d844c8512fee0e3570f8af8c161
SHA512 709660a4926f73ec1fe21c0e34761fe524b4c21433e22a75b5acf77a00150384a7c6fe94c73b8080af4c312e47ead2bfcfbc5ea4e6d0bfaf5ad569e0da438e9d

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_patterns_header.png

MD5 2cea0e49ab3759dcef5219a9bcee6c12
SHA1 36f1b61007799ea82ea89044ca5cf3d9721ce57d
SHA256 3e4bd2028a4d6398ece40977c3ea8886e85e692fb7a94952e55f939f93532d46
SHA512 cba7122abcc24d17eb3ceb0619bc92d3e1504adb1f035ce83fa8adeb8af9fd28f222002451f85b5d7ddffd77f51908585b70bd9c3ff2c6de6d8ce5c0b46cffc1

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations.png

MD5 0f27416ae0e8eb1dad5eb34a9961c0a6
SHA1 08e5cf5099aceb196f8c263e429a6cbcea7312b8
SHA256 69f377942e47f44116177e6671857fb0b4ea552e92d6b30e90b2003cb1bcba9f
SHA512 a807c8c6e2ed8ca0ad2bd67c62fbba4c1cb146ba0347417aa5b6081d009fe746f55c2640438a122b35391b5449accbce99697f2bd94042ebe232c7fbe8ae82b5

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations_retina.png

MD5 49e5d02298dbfed403a726fab2a74647
SHA1 a826215dda5c46fd243b69740a7ea49d20d7e881
SHA256 38d33750bc11959850b4ed3120e1ba6ae6140b5ca5addc709cd9730d251958fa
SHA512 faf3a310918c742a216fbb7dcb2ee49ca6b227bbd229a743fb45d861be8c2218257250d10861fb2877c6b577f6b307a9bb31fad50cc3ab37aec866bead15fb08

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\progress.gif

MD5 7198d93a70954b14a534bc8da550d5ac
SHA1 dd1a5eeffbe978099e39dc72847c40b345c37d90
SHA256 2c982271fd35612e9b5cc64034b6985f0611805968b860e02e338b5a4eebb70c
SHA512 93d6c5845d5627818fc59e57005508c4e59903bb155adbc6269dfa22a736dc954f4ccf3edc75d2d9e7065c12fdad985da967529a11a8f7b52ba254e88b80a571

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\faf_icons.png

MD5 d28232bdee5a1316096aee43448c4e20
SHA1 60f96247829f5d5cb0171269103ded50680abd33
SHA256 81228d714490dca597d1234426d19722c577997fa6fa3d9ab7f8aa3cbb32edeb
SHA512 363d0796fd25ea59d545c477113dc4d1a39d780721a5aa14190be27745ab0d8cb8fbae83b614efaa279fd3c6bfc84ad741116112a2a57a156800927cce53cc3d

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\bun.png

MD5 d4ab342db363136ca42c2936e98150da
SHA1 e26985eaadeb90ef5b00aa66dfc2ebd9f65be6c3
SHA256 023dc56f5e9c6666d7108eebe9d30a3f68da330bfd09bad45ddce4f995699538
SHA512 56451953ba48ba72c9879bcbe1266ca07ea10d091e085710e7ae704c5ffb1c4febe4841882dec3c7fa17635648bbd08f12df0e5bf7bbff6cdb19872a2d7384b2

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview.png

MD5 7b1c87d3d2633bf07dc1c273cafe6682
SHA1 df12c1461f25dec5ea113fba438e877fd1e4ffb3
SHA256 b02ac60a09f4cc7dea182b29836e11adb177de6f73f2f98bfe547a39863dcc54
SHA512 6435f7797812cd619f3ad908fcf2bc2fddeaa6e5ef1727cf7db64ae1ddf30c894315d361ae86f62a9c43a2b8d44a965d2f4a6bd1594aea2fdb4930d8ddbf1dc4

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview2x.png

MD5 1a4299a1fc77ff34eb77ec6901aefdbb
SHA1 ce7a27ca6e03ddc5c4f61a151210c20a1e0003b9
SHA256 f870a111eb39dffb4cf854fce3cb5824339583e99a3d74dbf4d94790c0d8c45e
SHA512 1e8eb0d19ecdc51cd9f7cf79baae6476a261533f3808c4635115a82f1f631b7e89a0fe2afc524fc7826c28fd205f05b911c3984e713b27900c88afc7ac441759

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small2x.png

MD5 df1685b5fb2cdd11700310498bcfefd7
SHA1 237e2484e29caeaf48c9e0ff8d5ec21380e1ff3b
SHA256 b472d3344fc6e8e92af5c0c58a6d3f274f48e387f2748c77542f44c0efda458d
SHA512 8bbc4ee68d038ea1b06a4468e1741382910c3a7764c6b811da1c1073ea0fea8af586969ebb5257e47a2bbd2b008b0c2217c5c7197d06c343938af1c4a4cb57c8

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small.png

MD5 5a9dc328e62414ee2cd0610493a39227
SHA1 b111fa82ef1a3d6e218c510c7abe872a92419e7b
SHA256 215fb78c8642455b35e04a5cf44e325396d69814afca706d7e272ae879938156
SHA512 3218f8e5a6e6fbcb74a1ee237d457e409f9dea309c8ea3d7562672dab43bc81feb965a7714270bcccf57ce576a663471ec1dbd3a5ea931f06e1d1f9bcc30ced0

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\illustrations.png

MD5 270d4053ae407caa50e984ba13c22fa9
SHA1 0ce2beadf04ab466cc84f1daa4a419409f19a514
SHA256 2c1e5294092d57bd8ce73837f8d31a4f1c572b1ffc85323acacbf754e27c14c7
SHA512 ac0f9169743a895555f39dd018921d6fdf5d36f0add14ca7d71c1c4329b9a19f1d33eeac7a338d0bfea5a53f0e38eba0e93c0dcc098882bc1de379285d3d7320

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\nub.png

MD5 8d1e936977427baffd6eb33f193699c4
SHA1 21320cd51a01015e2157989c72538d2c9ea9eb1d
SHA256 fb5306c0612dfbd58ae07a005e416ac6acf3db3c45486d109ce491b188fa48de
SHA512 acc37c5da8f6661fac41cc175f2a8e4de9230fa11b705b5b0f6141501bb7571e4dfae63494040d4d8b8bb298ccd196eee9604be5676f18d6331411c51068c4a8

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons2x.png

MD5 6cae2748a9c66ede406a5bc9f9cf5943
SHA1 8157c54a465570b9235584380b8634cba7e75a85
SHA256 df7e5f1bde0f89abf30699d34a529a2126ac8e132fb61617da4b18d32d0f8742
SHA512 2ba13ff38c53ff6b38bcc3e5e88aba208c0e9f656a3dd61f6a923db7176b743dee5094dc16bf99af6ca706978759d17f519ff8347e260134e67c55f09c24c0a7

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons.png

MD5 3ec828fceb6db288eb2516ba296af375
SHA1 9d8551c2448b0374fe39c77d9ff14ebc15a419b9
SHA256 049724ca1f8192ab7285bb2de2552d45086dacee846ea1bbbd3a451ec937c4dd
SHA512 b1876eb83001e8553d657a3c9f48100b8c642f9eb1af7ce85388f02fa2644e094eefee407d21d40701a610fb4a9f8ab4d44b43f566696b441737e731e881dbfa

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adobe_spinner.gif

MD5 4f04093c87e414d05a7864466dd7584f
SHA1 9f38bb6c07ce3ca0ed0c7f0120e7f7615c49105b
SHA256 065fae467d755c882fe10d7f660461167bacdf1c646b38201e00031bde5a8190
SHA512 4d47c7bc14bb424305e04d9987f5654b9fbd07fd6815f1d82d9deb13848cf7d8da196c3387d4fbf0d8a2ff734ace6a144e5773909ac11a230a6b110e5f7a722f

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adc_logo.png

MD5 cd0184bf1974721628007bd0341a702f
SHA1 e3d284562304f1c25be1d18de52ee4fda5f9f577
SHA256 1ff31034385c7e3b967c040d3ea1bc8bc94c55d4d17c03785ea763f2ca0cf750
SHA512 7f1d14d28b3c1efd2fc8772634cd3ee404c41ae9b975267a2d1d8db8e2c7ddbe630cd9b8a5a8466c6cc27c25616591679210398e7fc10bfcdf7d97b3234a1960

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\logo_retina.png

MD5 3d18366e9ca06912f88bdcac8c395ee2
SHA1 8c98d1a50fa6216ffa1c6a741e04ec58b5915464
SHA256 6b768b3c0fdc71ac309836a2f106446ebfd409f98b85afa07be2e55925f7687c
SHA512 80ebee009e3025b206e2381ceddb234dc225b2cba9c783973ac667789780b720352766c7fe41c3da1e37ebfbd82604d91aee4b96956256e10ab2ad07a6b617cf

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo.png

MD5 909797cbd8404a2ce18895f5b7d69423
SHA1 5302e9b6f2fd477570fd636ef3d28f6c472fca57
SHA256 5ee3b5002e4c14d197ba47a219c9730334a2e689091e3c720e9d09122b5c040f
SHA512 58d73937b9d75b03a43799f040d0fa72dec9a464e8e2c5fbe44f692d8c1221e85bb1cc2fae89b6c0639d08bd37b0fa3b3b8b57c1d34d97a5ce5dab661caef97d

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo_2x.png

MD5 ef22bb8a66fd77cfcf117a1919700b06
SHA1 b3a0dab9f61f9c48f0cf0051eba0fe19351e12c9
SHA256 177cef859f97e4c55f135999c8a2f11520666cf431e6ec09198bfa1018958dc6
SHA512 b92370aad53dcad123adb133ddfb516b650b45bc6ab3e8e855ae42c0e8593ba5d84b9abaf337b2cfa96279aaf69b03f6976b59ca2cd694174a7f02655fdb16fe

C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB_EURO.txt

MD5 27cdfcdb547b1db26eca097bce7503c4
SHA1 dded3529a27186d0570a906c0046c164f96c8fa3
SHA256 f48b3e8fc0679f7ecacdb5c136b409b7173e2c24806dabb026dada439676748b
SHA512 6eb3d2e140a2a8e10ba1e69e561717207e72d67ada10b2fd064cfb4f00ae3d430185ae6cf579415975456d92a86119e0695f6b6d5367115db0035471b160569d

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727656590293648.txt

MD5 4ba0781c90bf4b06750f8cf59b9ad872
SHA1 937a761d5647fe0225d908c8a2865df2582706b0
SHA256 897a1cdf2a9303b9bbdfae1b1d8164dc5961fa7e250d8084e61134e678137923
SHA512 511945e9f26adfff63a5c08e1cdaa5b37fc8f86213e6a0e0e1dc47f58792ff2e680076214bd9f5f7fe800a3a12f6743fcaced394d76145e39916ebaa5da9427d

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727663328721506.txt

MD5 2c3065d8eaf7b2798c3b7b14a38f4e93
SHA1 825ef9c6343fb960b2dc54fb1a739afff5ff0863
SHA256 621e21302ac17e8c1bb7686f7c2a124c849de7857ec7cd1df32f0f4c1cc60866
SHA512 b29d4e4257a9135b776f4e17bfe90f58f8b6b2ab84090c0b918e1c8e7e8652bcef7a362fe2698d34d26e8a0e64db9265d5e315df7c63d82d33bf781255d777c3

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727656120098725.txt

MD5 7435750f431d0e1cc3463abcb760110c
SHA1 a4806f888022e1981c3e551edee32c9ec765b993
SHA256 997324d04c965c598bdf3f986fa0ab2cf4fdd7316f2a4be8f0f47a45f9a442d6
SHA512 480ea8c177ce1426c0008555c9f5afb5447f755c576ff2d2305dcb2c5f56123a287b8654f33feff9a5a72a603227155c483307ef7ad64ea3d1f570a778f0db9c

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727666039184869.txt

MD5 59c896af0e9bf35e67e5531b6593b19b
SHA1 712941ac13822971ab72cda37d77874fe88562ee
SHA256 c5fdc6e27840471662f30f7bb72e2ac0d3a1723706ab1fd064f70eff6391a490
SHA512 e3268bbb1421fb0b02b619934ec1f1eada96226e71bf174d886a9d5a98496546d7a4320b1a963d2b17aba186e598e7e01c515f813d79173e320fdd0cdaa3202d

C:\vcredist2010_x86.log.html

MD5 ce0c544a7e3b6a4ae37cac8e97fb5f35
SHA1 fd7c8ea9bcf41e035a346bff84ac8154d433da23
SHA256 205a57090fb789fc44394479005756a3161db587ff9bcf489dceed011762b8ed
SHA512 719c41c8a06816db9d9662e24168005c8ccc4865db88e0016530fa344de570b286a46464060e1051c689ef80b1f797f87a517c106e44fe56f566b4e63dcb683c

C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\File Explorer.lnk

MD5 d8a5bb5064224cf77ac34ff3566cbe20
SHA1 785e78d63f94be2e7e100ac08810b0d8b3e14a09
SHA256 0503e6e596200c9523b74f1715267449770c8e6c2f377de8c3a5358230b443b4
SHA512 e1c8cc1517ef475a559e232e85936446b57d154f8f9feadebe64e6c2b2c23af7b7de4d252a98651570500d7556cefe1e61f18d22cbab5e14129073276de3a0ed

C:\Windows\Microsoft.NET\Framework\v3.5\SQL\fr\SqlPersistenceProviderLogic.sql

MD5 ea78097e2d5a1747de7655a13062035a
SHA1 e7c0e4dfc2acd655a675eb7c9bac033166495ca6
SHA256 eed0454beb5294a2b333786755e86db26340368ef5aa4b3a7ab530b175dc2cfc
SHA512 80ce816db5094496005c1c86f49ea1ee35f63813d9abfc8efa33fea8a0565ba47f9561b05ed42b0e24ce2a990687b450bb9261783e467fa7b348c9cb4febc53f

C:\Windows\Microsoft.NET\Framework\v3.5\SQL\fr\DropSqlPersistenceProviderLogic.sql

MD5 8c19f0110527835fa7cb4636ca89cb3f
SHA1 917e441248181b19772a73b055bc8e9cb8064e33
SHA256 54de6ff987682096f635cc240cab77f16574ee773e590c2fa2b5fe8a5f5b032c
SHA512 b8eefe3f582d9cc9b216ee39a5f82359bf93d77a6a6e95826a26fa587bcb6e855d5586a1edf8ac7f8dc9876a53bede3db21d06d9c39d756a2d2c4cea1166352d

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\alert_lrg.gif

MD5 42c0f6f58e6be7b9a2ab1fd075bbc55e
SHA1 b924bcc78ca3515a3d9b71d6610df25b9b3ea4d8
SHA256 82ded1476660bfd9c7157002a3030e3b4742f2cceff60f44c0214b2b060ce0e4
SHA512 da20fac333e63522730efa004ffa338b25970775a3693da8aee45af8f4977059ebb59ab6c4b548cbe40a0675966addea7bf4f6c70661246976b5e884b39af8d0

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg

MD5 8a131e686f2b7559aa448ad87c8a0132
SHA1 f88ed9c516826735a432107ac2dba6c13725b199
SHA256 a83bc2250f4f51be3fddf5baaa9bd12e727984467b3f4dc23db66167366c487b
SHA512 53bfec80311d91e1a08ccb9b466605f3b6d1d7959aae8105fcacf12abdb8e5e43561737de13210187f180f637962f15aefa97c9bdad753bee2cdda40f476334d

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\aspx_file.gif

MD5 65dfca25c9f496d84a2c1b231442c5b0
SHA1 c1a44986ae16b985f4d666ad36523444b6d23933
SHA256 ceb8c1d2b3c079833d7b19e93c9a8c0f7b6ca21151f564ddea481d963b402de8
SHA512 d2b8ee94a477357a2b7d5cdb70cab216f5cc85bc26788896bd896100757f8eee3087fb957f5c01f2b26d975cf0f9e8bd007faa4706b6e50412ee3e230047199d

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\branding_Full2.gif

MD5 96cddaa44774e82d7aedc762665122a5
SHA1 58337de5dc14d9d1b650cb8ad048d7b021e07472
SHA256 eddc8bacddd596337b4981eef8468a6aa817786701eade0742b799ff616421b4
SHA512 defd1153a33c4470b96d401639eede169c22ac57a3e1c92c258d3e76966f1b7b01a8aa055dd2828bcb33b20e276a70e7775de74c4aac39e4c0136d93eae58a98

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg

MD5 f25f79fab2656119ca12fd4832de08f5
SHA1 a5eb7a3538f4437b738335a14ba55ef862294a4f
SHA256 a2b83ec797c25f2f69d9d55618fa6462cb3f5de692c6183c0cfa7e877a6f3966
SHA512 3ad26bcf24f111a7b8c3b266b41337809a08ac24c0b1db9007759f53fcc704e6fd6ae6752bdf67eb05a3e23df0efe6b7f3ca94ead6bd8688d23034ceea6ba25c

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\folder.gif

MD5 00bf6bdae4682f81c2575d04bd4978d1
SHA1 c33b8cf1852c1806ae6af92fdb1bece081e1acf5
SHA256 94b4ca1eaa2008cce5cd2a723fca7921b74058e5f314d3f8102aacf72f2617c0
SHA512 e47119be4ad9f29693beced9542f3be7c542299cd6ec93f5a19fc97ce27cb51699b855a06415f8fd8c390d32b2fe40c4af9cabc875ea722eeae6fa3a221f8076

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\headerGRADIENT_Tall.gif

MD5 f0d736c834fdadbcb62fcd6985125005
SHA1 dfe2836694900f5f2adfcd49cc8ae7e793482ab8
SHA256 1e7c219bb4604d435709a121e1afe4022549479f5c0eaf1bc0d5fb5af385a707
SHA512 111cff8bb0c51c30fed2b2557fc1a71b0a4293e7b7fb7a100051255deae90f5809e838fd37be82dfad288efa2e6369050487fbbb04860fecaa085fe625e370e5

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\help.jpg

MD5 51cd650a2589c3bcb1a747f3a5f2de0b
SHA1 2cef3e6720773715570093806010b42c7d3dec29
SHA256 27ec5aba2b778260f91ee4b8996baddf73c92dcb02c73dc6360a1337bedbc594
SHA512 1609826d62336399fc8e6e20f796ccf71eeb8deddb3e760a31a48ef956ad9755ec248bc50b723190e0f763a0f8804896986edf9261e4fec4b89a02da55585bf9

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\HelpIcon_solid.gif

MD5 9e6538e1ee09f96bd696ffdf941b0c31
SHA1 8bf05ee8eabcb10b77a8dbe9ad523ccf6f593110
SHA256 f8e89edd113c82ea85647c4f4b7561567e51c0ad2b8b5c4edc4d668813b63e5d
SHA512 95f72b43725e93194be0e1c14e87774147cdfdba8046cc7283a22e90ae7f2e4e2c82b5d4b0da3302e80ceb9f2b51e73a7bbae3522ac9cd3911f9d53d39a93539

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\image1.gif

MD5 77bd4f8807abea386d744ba96c33b8d5
SHA1 d9e81e6f355a8d60c4afdd31fa40de753f3ca8b0
SHA256 485b8cdc78c3db3be230e9049fd3146fed497adc92060ecc056cc8fd5e4bd24e
SHA512 ee093a3c886359bbaa993c555b11a0ec26b14a29fd731f2a8b7e99b301b3f65144c4e7cb63479a2a4c7a49a316d69960d234125a2a6eae4b35f671fd4ffbeb98

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\image2.gif

MD5 417c58aad74b0cd90e76f77c8d2c2ac1
SHA1 b4d89ea1738f85e1a73a03f8a38b6454f9dd45ea
SHA256 41f2b910cc16dce9f4ecc40a191ad5de91485398ebb9668504c03e17a4e16e5e
SHA512 212e3b9e957bdeb5bd5e382e2381ebf3cf7cee00cacef60dce44e7cb697059287e8622efa54be63a10100d24609c568b2f2a17c43d9b852a32bb966cf26cfbb0

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\requiredBang.gif

MD5 f45e0aec75bddf174dc418ea3669cc76
SHA1 7b17407b945d748715714fcadcf5c54392971870
SHA256 3a1ee21a59e73f7f4e8b7535501ef6b0b528019472d9e5c5778331758e35200a
SHA512 7c8460d7665034838ab8862c286394390750501ab9d681c52bf44da7824d620d85d7ff57dcbe761f4a9a091c6de7be89efaaaa1ff4ab4002ee5902bfac914b15

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg

MD5 a3b3139f75205d176f310bc8d087cb5d
SHA1 92825048c870c302d7e4d88df8cc4e98233a5837
SHA256 f4d10fe6cd6ff7ff82d8002606c29d551fd788ba4b8a623003e1c5c6bcedc843
SHA512 028bccdf0968818ea38777290e822d128a68a9446214668d417b6afc04cd191adc1a215dc529e3e58cba982aad4bed786c8fbb98e0ff3683dd56b10fdebcdeb9

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\yellowCORNER.gif

MD5 3d615f1cfe48e6b70d468e544ac2b576
SHA1 3205d086f7dad7f589beb2a240d7207f901de8ab
SHA256 464163505bea41ef2cbde3924b909c072a42f7421772aaa11388caf9c971432d
SHA512 d5f708106872b157a370522b9ea537d71fc57478175a532cee21a1aeee114146f5c9e1615c25d7c8f2c54c74134706bfc577b671bf3084a0aa8ab1b97197a542

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallCommon.sql

MD5 7497c087a3da874668d19c22c50a87f8
SHA1 c479cd4d93678b90112f45fa649a85ab442aa8dc
SHA256 43375589c0d8f88db5a56e2cace01db528901fba53112ccac9c7599a695d3ed6
SHA512 40ccfe68ec49502f1acf96e10381fa2c2fc7bec1ef6fb67975251a7edda56f5639163345933fe21a63cd9b5298655cdd05cfc1892346940c9118e3a5eff69790

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallMembership.sql

MD5 c1512547915914e7c189d211a82241e8
SHA1 e084887cd497dada81f1687a12988d0d18e54a6a
SHA256 760a54b3641fb7cca0dcd91cb40b01c63ba861db9f90f8406cbb2d362b95c042
SHA512 119e4b7685aec7059aacaa7be253da8db02f95af59e573f890833135d5fa020800651fae2d5744864794916114c4fb37cf4ab8f6f228e22cf7b1d30ccb41ff53

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallPersistSqlState.sql

MD5 d81911b2e6954cd40ad650ea71988abf
SHA1 7a6e901f33f975a7e87cdf5b3bf83a33d181eaff
SHA256 886e94a9d9ab98e9c8cbd9d5078277cb831a046eebbaf334ecaf775d5ea41395
SHA512 4fcf4b55de4987656153b8605830fa9e5c2b3532c3080ae698bb671411ebfc17e88c3df8a0927459c1ef3a99eabe1f21b80d08bdc0016ef4e5f492a3132e81fd

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallProfile.SQL

MD5 83cc3ff8578f31abee66540cbff4f422
SHA1 845be9ac25babae73dc5cfa1b598fc50cccf303d
SHA256 2622b503767c00ce292bd572b9378580b43269d1424adfa2e9ff8eac808a87d0
SHA512 8d8e7b44b62571b7a574d38efe25e6c21a9f816498c27117676068e623b5ce3a245f5a4c59523adf0be923d8cc67f1ee7be8eb89c869105fdde5fcdcef311fe2

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallSqlState.sql

MD5 dbc0f9949992cae6be61e2f2ca30327d
SHA1 d5dcd522af48c4dd905f242176bd4e80aa0fb262
SHA256 e6f2b8a0b68d8c9306b45c79f6853bcbc3f85b11aeb51a57bd0858f3880b6839
SHA512 c3c6708f167b45fe3044f1b58e3bc211e5cf1bcf37cabf3f09b51e0222148cc859137310c3d1c3200387f69035ee474a0129413672ad3c48059d1287a69a0d35

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallRoles.sql

MD5 75e9c640523c8400c941bbcc74da3e7c
SHA1 1c1275322131b7166e57e950e20007b3cb52e5b7
SHA256 f7d0d9d8c39117f990450206642b52fec04401b45a79e42b70583dc7ea2e7cc8
SHA512 9342d3cca5544eafc5d4304b495b411e351939ad09431dd8cd7efc5851df0d74da90434bed7fbc7cd1119a399b2ca589ded665f9963478aa9140b382434404be

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallPersonalization.sql

MD5 e70f90ed9ad03b1fbda7b574938a59d8
SHA1 921b41285e6f6a5650dc740fd10b8124d0360fcb
SHA256 587f8e85ff0c5a29c3fcad6ae9a925d7d648db2f2430cc1ffd77bf101f139ad2
SHA512 cd76538a6b0745d0e8a1a5808d101414f83b58c656c1068e59637ec90006863a500352f217f2412c055632466dd3cd47439c23f7458f67b71d3368fd4841b2ef

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallSqlStateTemplate.sql

MD5 bbcd27db1745966a1bc22091fe51e83a
SHA1 d87384f6215848210981a705a2f62b887ac27dd4
SHA256 80c5f84fadc2dba93e5aff966d66ab8d9814c8a4748faf3e8bb1214e1a150d75
SHA512 015bdae81ced18aa4e6e6e698baf38a4fb0ea5976fda7d732ad232524718d7d867ce222fc9f46427801f7dbf64476e36834e48d9ed3983ec4120cfce71190a12

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallWebEventSqlProvider.sql

MD5 d93feebefa356bde982eb2117a17b2a5
SHA1 a2de5e8b29a4bbdd34af00deb17847588c1587b5
SHA256 4f7ae1ecbe06996cc8cd5fbbc38d7bee154e30575ccd6d51970d98d400f69fea
SHA512 45d2c091001c2daf628b33ff0bf2d506c2577dcece802fd520fde616fb5eb1aea4c9dcb45f28c32c6e77fa955fa6966535957741460528ad9764f6d18d9873cc

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallCommon.sql

MD5 61aad74f9a3edf709f11469e8b52a433
SHA1 f6519ec452667bea209b73a0e30a30f04b3210d8
SHA256 e66f0e761598e5f84ae4087ebc502d79c2a117064b2c45f725ebab5e40ce59e6
SHA512 bee2ede482f5ddeed967d3ff854b95adb74cc8a2d452072d9c2f7f8d2ccc2b60347fca4466612cc24b178d0061e6249dd41f53404a7ef072d000f154b18b9a30

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallPersistSqlState.sql

MD5 6bcc8b0d26edc27e31b7c2b6b38e9626
SHA1 b9b22d13867d7edfc4b3ef003bd0b179f1d44f0f
SHA256 87054856cb58e6b2e4dd19db00e98813a41174eabaac9d826d7cc375657b4751
SHA512 55d636facb4da1f7e7200b7dd068b792bc46e0503632c5055de4323593fb48c67c774fc5c8996d4cbadb158a461f97150ac4d15d12039d88d4b8f2785f229907

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallMembership.sql

MD5 d010626df71b6aaf6b2aa85c3e504ecf
SHA1 741a41b7dc1653424c3c989c70f35653e2336f83
SHA256 3f2e5c8a38ad871d32a9ef8183d75a45bb6cdd373966959274610f6d6f49fc4f
SHA512 33f1f70eaced1dbd633ae8769cce165e5501d59fa6971733657cd7f4f6b6f7b99157e41064e66d6c8f8ec0b374e8b10afb119ab9c885cd16c8acd11f055ee91a

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallPersonalization.sql

MD5 1d139a7ea6da8cb268080e52e7088f83
SHA1 bfab81c1bbe194acb5d415a5e8231f9eabbc46f9
SHA256 67622b4b021cde3089c7ce3abb3f394a2e06583588becf702eec14f472530bb3
SHA512 82e7c8fe7d9d0525e9c22bb35d1711b1352275dcc1e6ccfd24994bc7b553261f6d8e8fdb54c9c83df21a766a7a82b2a5bc75926a6f3983158ed455a0d7cea27b

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UnInstallProfile.SQL

MD5 1d7bcce60394e087b148c9abeca3daa4
SHA1 7f95158c8295568e5c77aefe8096961f66a7aa7b
SHA256 df88feb5c8136d07dcf24fdff037e416be9506a96e97a223945bb020f118b9ab
SHA512 3c83a5975d61b5be51f64c094a1dac8315bf779fe7aa4915e24a69b70e3046f545e1b0e9539d9b972abade97751f90651335b2b0c0b5ae0fb6a5032387a2431c

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallRoles.sql

MD5 74c168a8b2661f7f30ae356a2a264d17
SHA1 46e4c617cba2d0d3cdbd320bfcbbbb88a59a7730
SHA256 e1fa7e2ebae224b63effc4545c35fb5a88336f564df3b4ae3431f055c9e20280
SHA512 59a35fa37c019bbfc09524011579f5f232793b6cd83ee7cdaa32513a4b6fbb1680a9e44269fbf90c596a8d63bd66d58ad7f0c1c9bf089ec25ea319954b3b759d

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallSqlState.sql

MD5 2c4d15542a775787e416a24a5ea42528
SHA1 c3d6f7a5ec380b67b4176c4dff194cfd7d06ce0e
SHA256 f1a22545c502ce18e466e67da81613209646f945da7f7cdb702e3c82a1a07483
SHA512 b353e90ec3bb39fe1ba07688726103a23e3cda1aa2483ecdf5559004ea88b0dcaf9bc52a4ac61d5635ed57b409eea559fe1859c7d01322564ab008c6c6222b9f

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallSqlStateTemplate.sql

MD5 b36d4b95b72644a22b9872655cc9c107
SHA1 8eac430372cd355cbca2532029f372fadd3847d4
SHA256 ef075542a31885215b85b1374024720efa3120a7d4ac7ed9e842c24a9de4ab64
SHA512 969d490eb5f8193cf753ffb38a4da33dee9dd8f5adb7e8a37af45c92335ed1555cf45b003fa1aa7b98243c1022c3d80edce2c4bb2c56e8bb5dfa4d10268f68b7

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallWebEventSqlProvider.sql

MD5 6c8e7a78992c7ea9c00bdab0a5a29bd4
SHA1 71769593437cefe003b9e3e0a50e77da3cf3881c
SHA256 81b8381d13bc74ae9c86d4a91a8c311f383e54cb689a638306fce4711da0f23b
SHA512 6674b0f1c807669d893c378dc83bf2b95db2201299c8d4afb06bcd5e8addae7c11ee77fb93b2a132ec05bfc6443972e9a1410d8500fbc5e8e49ce9c23f7a6ff0

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SQL\en\SqlPersistenceService_Logic.sql

MD5 b1f265a99bc7decbd7149056029de05a
SHA1 1abdb6381b8f5546ae2b3f7d5491c858707780c3
SHA256 4fe6af3082b244a57e3d3d13bd2152ff3a724c69ddcb7c052f2b65a7f69ed622
SHA512 eb372f01e3530e5c7f9a6c8fda4b8317ef1f966c73dc64fa7f5377959bd32ffef5b7f2bc0c141ca5cda240f7e8999bc42c419dc03a553035325b9de6bec198d0

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SQL\en\SqlPersistenceService_Schema.sql

MD5 eba0f1236a32b0908c2d59b4ad7802eb
SHA1 8545a10beb2aca9393c7a86963a32e942427f0f5
SHA256 6b75af745c95d23dc641f95dc257e00d83b5ee8e7c4950b029c06879c87cd897
SHA512 bc3ad1c8ae735357d60294085a780f443efe6753f418b1fd221c7ff014b1829c76967d759d11df75bb1ffd918e18abe2fce7484ce238167a96a2aec7b40a379e

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SQL\en\Tracking_Logic.sql

MD5 cbc7fe675cd619ff9e085bdee48f34a1
SHA1 b7beb0e5ce5ea8ff6f87c30c524fd2f0ccd7c5c1
SHA256 c973fb484621e398c3ee4f4ee7779e8012c1bb8992add5ba633a4aafef8a52d3
SHA512 f1e6960ad7b49972b7c6bc17ba72636dc49097a53858b7443932a9eac9470c8e28258c53809ae8e131e924ea5d366e2ea1cdd848fdeac8528cd972eed4d9493a

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SQL\en\Tracking_Schema.sql

MD5 2f8137035243f883794af0c7487d29bf
SHA1 e84900a6e75b347c46414ea3d2aa4138d59886ff
SHA256 2836550dd82ef09a45225b1ff42fb5162cbaf68310e53351092098141df51450
SHA512 00a1cc48976b24a309b4beae9c996eaac00925c630779e9a29be1362d25b9d413577dca76db42a7e35a2e08050d60dbd9bb69fd9f657351c07be3b8a66b33a93

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group1\1 - Desktop.lnk

MD5 6fed9c1e181cbe5e029e7276d34b9d06
SHA1 117dc716d0906063848709d6da0d61e1afd4c985
SHA256 347c341bdba08e7ed6423344ce7dab31f1441faf1ac31309f49ae2f093ccc018
SHA512 2fe14b3a297335c0d1cf53ca65650a9fc4f2d1e44cf7d628da3f3da263af469413f7fb58352d4914f1493847f94f2c32d443bcac82930466c69865f8adb12672

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\1 - Run.lnk

MD5 552406b7f46974c8aae173f1e28ee68b
SHA1 fa1683f452483044daa8d20a7fba697f7d4e0fec
SHA256 6186b3fd8b3ef575382ff63178322c54250aaaa3008561148559d4c662e440ae
SHA512 42b0d0409f4fd189cd542405148d02680061d7c4189c3903868992f15af191355ed89f48880136f31ee5fd53f4e795e93cf8068d18b4d050bcb403f52c730ba3

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\2 - Search.lnk

MD5 06e62917c4dfaf0930fd759a47c1aa81
SHA1 d507cc917ef75f301a2b1e6fd0223bcf2bcf03b4
SHA256 bd72decdcb677b0ee44f46320cfd3e63f4d12cfcd9c40a8e7bb131efe3f9b6aa
SHA512 052393614b1946ba380a2ed08b2ae805c7b380dd039225b3c8531ba2cb758d4a6d4866ea51f2255f26cbfa8062a2af43aa6832ea6f67cb292aee016294d9ce15

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\3 - Windows Explorer.lnk

MD5 99e901afbf559a316f3edc497ae347e6
SHA1 e64b8d36f49c63f06b75fab3a4e7f8a9dcf1c59e
SHA256 f3cad74a5879521077f09b1d74b23a5010194b4e0507205ef05c02d7af39646b
SHA512 19b5f3644577f11b7d61714ee4b77f8200d9afa1a3a1a28ce934deb47971d81e73945b46640492ff1ce05e4b3a7691cc458561a2850ad533c581883a3d6c0bcb

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\4 - Control Panel.lnk

MD5 cc57e93a9412d35a9f14be67bc184f6b
SHA1 4f9c1fdd828bf6b30517f90d48903c3362ae650b
SHA256 d7afd09d3e1171ca26047a3483c0d026cd206cb2799022273416434e624e72f7
SHA512 43cd7f78db2dd2fe2b155781c204ca87b2f9481a142ad52593ae40449d8a25ab86797ddb0daa03058ce657f025bf6b21ef34225ae7ca86ee951622b4060b00ee

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group2\5 - Task Manager.lnk

MD5 4d7e148e950e49b346db4b3e4d68cc4d
SHA1 9684ead6ddb72cc3622316bda39415e355f25783
SHA256 5b91f5f63f3f08a4e0ed4aa205dd589695f191ce5ae6f1e51b494ae1aac144ed
SHA512 0ab9234380aaf02c145a33dcd23d36d8dd0a8da6cb02a0733f2c398956a171253577d9adecfd7632df3b7b3de13c3ea027cc5b93c42b12a99d6f3765d53a5542

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\01a - Windows PowerShell.lnk

MD5 15c757684c415f7b27276aaca2f7a8d2
SHA1 792e526cd12019979a425aa6f5823579aa92d7ef
SHA256 5326ced0cbdc611fad6bb069f5c8641fbda194e6c8fa6745ddff37a31130dc5d
SHA512 6acdac6d0b43415e2c13c778327a9e6f8eb5e6f8bd033c7eda44535ccc94852ef813b9f447e6451616e4d1e4de368bcf346d1b9e281ad8ae4d48966c315bdeb2

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\01 - Command Prompt.lnk

MD5 ec7c8d1c6ca7cde523dcc1375be53af6
SHA1 2d54a733f97d3b8f6ae8b42fbc4898ff74fd4431
SHA256 0c521ebf278b96477255d1be829452bf6834a316b8ae47da98772a70845bc3a0
SHA512 a125104e5f0c3ed34b50a215dbded309c6c79eb2ae855f9cc82593862ef6527dffcb2aafb75651e2cf4b7bceca01e88a6722496e81176859106d6bcdf95a8f92

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\02 - Command Prompt.lnk

MD5 df77b4cd053d34174fe6d689d84b0164
SHA1 a474459c758ec5016be24dcf4a8b954fbccb55f1
SHA256 b308bce03b037d66a5ed7511cb9eebe26370813066bbcb527854c7440b4d4263
SHA512 25eb5c63dafd84073cf28b9a5bf451dfc89547b233d2f8416be37be5e1610f21cf77f7abb376c601fb37a81b17393e993eb1d393faa2ac7d3afc55f24d7aed2c

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\02a - Windows PowerShell.lnk

MD5 1cd948ca8434e16b59a832411f0fc634
SHA1 6f141c891ff70d35ddd4d1af9453c6e23fe6a520
SHA256 fa1364d30860c37d5bf703636956b8476c0c3e2208501b3f97779fe5d3ab5ae5
SHA512 698ded91f26553f497a35b67c3f154d8b99499808463720ed541e6ca1c8aad2a640fe522add85d1bc5aad0c9db7c657c1116622aaf584660ee257f22b9cb07a2

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\03 - Computer Management.lnk

MD5 3fbf381100457bf1ca666ca49286609a
SHA1 18c5108d9174349cb26cbef01111fce21011ec75
SHA256 61623cc921764822a4a59f985ca13f170d76d2f42f40b72708cf2c9075a35e85
SHA512 ce708043b96dc133229e0407473c5618a34c7f91daadacb3ad6c73f8e255c59c87acd81387f39e61ca6e8e45e396d756d104d538fcb4cbc056282568eaeb1f94

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\04 - Disk Management.lnk

MD5 202839b27760814f21a208d28211420e
SHA1 2b0c16d877081c77c98bb640a581f1312dfda72e
SHA256 28d2e6fcb6f0e04ffa34a1f1d660d5a0ced1ee6a019a022e5fd9baa21528ddc8
SHA512 9fa1120e75d76ede21beaa218cb4a2b71d6e0e4370e7542d9ea616c61ef3c5e76ed589e807105116e040068f668e6fa2f5815e3984d2fe4a567d5eabe048dd36

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\04-1 - NetworkStatus.lnk

MD5 c267c3d62f48c75e55ff991fcd6440fc
SHA1 324317d2156d36376fa3d83924e73439e5fbe300
SHA256 539b3de5b0370789251278dc86061945be4929cdd405492cd44c075dda14206a
SHA512 552244bde7f411a8dd8b8d1d7a8791b64e31792d3efd597d667a65aa8fdd147b8abfcb9f20163eb06a6ffbce47cd09d0c2d27907959bd27eb14ce2a610bb5681

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\05 - Device Manager.lnk

MD5 77604a07a29b000c0c8bb8746e6cf52c
SHA1 12cdfdb49675354dc34f9b558cbf5a9e72311500
SHA256 610e9c317448e776b64f86ae9a4673d07eb94504c658c65b7d4bdf21a024d434
SHA512 1b7e9ea3fabe020e288b591d15198aefa9f4328eaf2bdc7b6d0423ae34f809a9de4761bb11438c155251b3973f7697e81c6042b1b5adafb44f07d4c7904db0b6

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\06 - SystemAbout.lnk

MD5 5e82804aecd09095de93186388f5351d
SHA1 068a2bd05c8116a5048f9ddc83f018d303935264
SHA256 3a2514f4abcd18366664948f06c280dc2146bb4c4c357a0e40d0198bed393f8c
SHA512 17f957870263c68a0d505394bf510ea4c22252442975cd1e5f320a4115f16942fa986e340611263dd4b49eae46da64c47fb0a6263229f5c906632a55cf02b508

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\07 - Event Viewer.lnk

MD5 9e3207fc6684357204afb407dc7b05fa
SHA1 14dfd6daa43de475953173696b75b0b5cb51ba6b
SHA256 7924b7f346da694f163299d80f24285caae059c01c536f0e03e3346d492ab9aa
SHA512 5309c43d8045874d07f31c6fbc9133121f58f8ea913edf642a627d09481a2f5494533173765f65183d261122d4ac5dd755b23039615c690d3807620c4990721d

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\10 - AppsAndFeatures.lnk

MD5 2ec82da62f3403cfecf50f49ef208c5f
SHA1 18fb291c5aa95791a50253a0353b8a628f1b8128
SHA256 5d7a74770c42a67897775f3b2ad6a6ce8325b9079764765a6bf9068eb426c4a1
SHA512 ba33a63309a78d0eb363d9c5d808f169714982d924853c73f319516cbbd28c3650db701d5370857ccd1b875cc25ae84db08d65629c85fd3a8907a2b79b926cc9

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\09 - Mobility Center.lnk

MD5 5ad253dd6556f5deff32d755956754ca
SHA1 64b162b57a29f76977dc0b82a77ea3fbd78444e0
SHA256 1e7d65915c32e2d87a3b422883c227f035d644419c809d9ec4fa25d3960b649f
SHA512 1d47058a5b2c0c56045e974aaf76b0653d5b0641c184692620d915ad9cba96b8d27ddbbce60f4b6bfbe4c9d14d5af98970cae8fca38d55b28e65270c3d26edd1

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\08 - PowerAndSleep.lnk

MD5 d1c9382e66f11de7392885184d0d2581
SHA1 ffedb2df80011c290039be5c80e928e5976a3724
SHA256 20d5bc538545084899e354446675c7ef3dc18142e9a5c24bc8e7dd9fd5eea231
SHA512 91fe03c7a7458e0ee36a7ef6965902e1c8b911de786468e39e97108c2a952b8da26bc3a4b842c9e28b0327b63933d83ed5154bb3bb036ceadedd0e00a10a17e0

C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk

MD5 68323d60189d2d437107d3b542da7204
SHA1 deeeb8491b4bc27c5d5d6f04182f26fca6c9c1c0
SHA256 a27ba4327f06276d490f76060f6749938d643bf56db9ceb82d06910b4d17a4b9
SHA512 23475560df1c9745168ab4f3c0ce4b6903201bd4f7c4b29bcf4717332d7c62aba756fce8790c940351423d327b9a41f4207b698b7fab58ec709a84c0b526e3aa

C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk

MD5 28223b45b5b88ca36e5a9af22c84f554
SHA1 8109a05645409347d4832acdd593151e3aa66af6
SHA256 6eb42f3d8e60315eecbc8ab013cb85644ddc11e15d474029d912e779ae464e86
SHA512 2f338683ea1fb138aa932ee2f8ec203eac76f1056f09792bcf989b79fc7101de3c6cf5f41ba72aa9f6bd2e16741e61b0934b9f52bacd27a59733c39b000c36cf

C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Magnify.lnk

MD5 3dfa4f230434fc6c811d3a6298aea10c
SHA1 0cce72879aafad66ba645499c34d6b0ad20f2d0e
SHA256 d5b08767a0036771b34c35daa77c743f1cc0916150bb17d420542e91c370dc7e
SHA512 93824b6dc3fbe272b19209226110aa4139c7f9cf51022cf0b851a821f7a0ef0dbf1da53b5038ae615ed9e1bf71792dc1909e2134f24211f56036a0ffcedfee4b

C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Narrator.lnk

MD5 be027c7005f33f7b514f727b7e630590
SHA1 d43836c3f46de360a46fdb64b4acf32c85faad27
SHA256 2fa5afd33d6150c56ef607303fac08dd885452e042484fad6a7b5db74c3ce509
SHA512 1c6c9a6a2d83b78c20789b96261b0efd0951040dddb7d9cae0084ea6a8abe0210f184f0f257a1cd7e08b9081db656be03ef465b8650bedc743ca5d4e7606ccd2

C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\On-Screen Keyboard.lnk

MD5 d36687cf64ff8ff3aeb3aefe3bb82950
SHA1 1e7656d191333ccede94c3004a47a4ed14a4e066
SHA256 ad56bfdc3bf412090947ae5bd2f4560eaddac98a08216bb99131b623fa6d07df
SHA512 0106cb0bd474a3a70f00b7594dfab5d2ff49a62d19e1b003faf2d901ccc98df6b02f2425ee7971e16ae4735e87d80c9f4fc608e3ff9d7390f9485b5b1bdf2f53

C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Administrative Tools.lnk

MD5 315ff8ca5351c899a20a75b19efcbf6d
SHA1 c5017bdc1c67442ea875a187343faac68b420e64
SHA256 9a8d514cefa7cfbaac610225a9224215223233ed9119aa0a9e4972e6ae60e455
SHA512 f8082a984943a3aac4820b4d43c29de3dd32e1c2cac4a877a49db5e16c6e25997d0972f91f0190a8835d4b792237c4c26b5da0fb3d9b0f26e08beed182e05dc6

C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Control Panel.lnk

MD5 8b0284b4f4477c081da14867d8a6150a
SHA1 5fdf8d2e065b1649081ab75db414e6b6e90c763d
SHA256 b4f404fcd6723dc38c1224dfc4bebdd7a370adb8b7688ff0b23689deeaadc857
SHA512 ae4018a957543496bce8b999a0fe360961815da4a2765af051e409293ac8c2e1589ac2338eaf4525b0819df88d5a0225011430fa94e5ebd032ddead771d9ed12

C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\computer.lnk

MD5 1c256433f33794d51ca4a2d18da9fd88
SHA1 5e7dc4485cce1be1d2d03383b6ec6768fcceee37
SHA256 247aa02d98a198f0fadc8dcd36100d12b73dfcb698d1576b766a148fbec6db12
SHA512 0c723869781a3b9736abc798bad445e010fcab4c485350bfc2fd363a0800c95d08e5da59fc50a25051bef200dbf72d97f82b06b2f0707b7f7493a52823ea9597

C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Command Prompt.lnk

MD5 4f3f10af65884c4a49c57b70b33a01b7
SHA1 c285b719aa0405b4845d3f459d01b588c2117e29
SHA256 4c9497c77fc28f5d5af2cbcbd59e5c017e1e9e0c277d220860633e95e2d74476
SHA512 867ca0cdcd5ea7734c4c661829af0251b067c61d09192c12bfb5217abfcfe9b684e38fe91764d6bf8c9c134ec85647f7053ff3dddd354f8714c816a58acb0ea8

C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Run.lnk

MD5 9f8feb7e6a697b3c35c88a0f92459f80
SHA1 ec0fc245968457e416556d3e120b3de4c8e954db
SHA256 bd2507e106991f2c6f8a0de78148e58a8e8bc4e8da9513bb0e6a8dddfb9269c1
SHA512 796d93fd9e940917dc410b69f0881786f929d64d11784f7093043461d73f53b152aab2684e10e9beef3284afe99926acb1f0eae5debe9860b6352c12b3b6ee59

C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell (x86).lnk

MD5 32d8c80bcd97bfb2a3a0757e4d2e9f1c
SHA1 e8fc1d1950f7e000d799fed44d09a9b44c475b08
SHA256 e3c730d58913d60af5c2c39c2aa32c6a94f57329873569ba19766b80298c6196
SHA512 666afa8b8a981f08d971d6364d34c57217b1464f45ead17950927cef8809417d9ee031b0e7a57957881c6aebb7a41d2cf813ac48767e595c3e03a8be15c3fbe3

C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk

MD5 e7f2794864eb07a3e0976b9b20baaade
SHA1 2e63fce81869723aae4a7b64fb9c356f4515876a
SHA256 1a86efad374698d4aa5ee176806c5d84088440c222bab0fe1e0070bb5adf6ec3
SHA512 87781a2bffa74d55f08971e1535b9103a6dcabf19aa2bc9600d0281adda21d02f830e62fec1eea80213192afeba93cf64543889cebca3aa5b7f50554ef6e3a2b

C:\Windows\WinSxS\amd64_microsoft-windows-msinfo32-exe_31bf3856ad364e35_10.0.19041.1_none_61cd745a990bcfb3\System Information.lnk

MD5 267102515235879a2add28ecee9fef93
SHA1 3217314b20725d646ad380774649d5f148648edb
SHA256 1f0c5c4f5ec03cc2d1f35be58c8a2c0ad84acb11e4736ef8580b6555f285186f
SHA512 fe9f997821914915842a3a3fa3191220f3a6b67d2229a631bfed950f60fcf660985fc2cfdee63b48da807dace16ecf613949df46f768487ea604acea73b4cf37

C:\Windows\WinSxS\amd64_microsoft-windows-notepad_31bf3856ad364e35_10.0.19041.117_none_4d353cf1ceb5d6d2\Notepad.lnk

MD5 76f2036dd723ba8fe390a1dcbf2ab638
SHA1 ac561fdbd2c8b7ab2a92b8be9ffab621f1940ff9
SHA256 62fe1a325abf58644fb2bc6e6f3afaa6792b574e212f0255277b335832f7996a
SHA512 68fcba63b367cf6f9673259a152f443e4d3c70a2ef73629aeff84a486c3ce43ba60810b6dcceb8fa1e7a115ba79c0830f417cbd0651fd5c3c4378a5aeda8e442

C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png

MD5 06b177bc2ba14eda2d682120ef9649ff
SHA1 71b81e1e98542282f5ae923336afc393c08b9a4b
SHA256 c014fabbc326c96d2bcc9698c2f331139670cd250058a58a3b0669bae436a8e3
SHA512 8034ca669b781a17ed9cc102ad29d15fc6f9c3344837f981f00d9f35cb6b5fd6a950457c5779177b9035fae7cfc366aa6e5b636783d08b11dd3caf7f4f2e7ad8

C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\Square44x44Logo.targetsize-44_contrast-white.png

MD5 f42ca722b5dd799e73ac9abf5759f123
SHA1 b06629cfd0d62e1792951c38396b8325a3dbd362
SHA256 3f89be95ed057bcbbeb669aff534d113df0748ca621b7486037b1a1d986d2557
SHA512 2afda740126211bb60acc3332b76f17fb6381636ff2d276af738707ce651d3e25842b08408c44b7d12d3445162627fc8971a8416bfa84998f831f77d6eac18be

C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.153_none_90dc0b923cd83016\squaretile-sdk.png

MD5 d3758964b8072affcab6063e488d55fc
SHA1 58f0a03575162324129ab8485fd05590766af5f0
SHA256 8fb367028c4a11674e06de2ea03a7e6888560bf4d3f415a6f3b4d5fb6c33b0ce
SHA512 7d4cf4936f59fc0f7f06195cd052c19294208f47b7acae57b6e0ce02585ccd0905e6dcf2973cee63b9f5f6adfc989c3599ac26e81859d958a400079945774f63

C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png

MD5 55c082e5c753a3be7704ddf066d0e895
SHA1 ced13c44a19f82b143b033378d601f93b1de3388
SHA256 e45f697a81e1cbd46046a50597ba9af08e1d8311647d62a17402cc418b0f63e8
SHA512 8a7dff042cf53601adb5212f9bc6a21e48de61faf38096def0a733188e22b57d0141a7b2885ab426f76c40c73ed92fb0ef80abf0e469c83a7c14166a6830a0eb

C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\Square44x44Logo.targetsize-44_contrast-white.png

MD5 c4be1ce9dc39fb83fd5a2d617c2a4837
SHA1 eca34cd429eaf350804bce704d19ea61c74fd54a
SHA256 403a36ada7f7579d09670f9b98e7dafec1c2e1beecc5fd26ee6b5fd0b4f2505c
SHA512 3e736e36954c970143a82baa806fa88a36db812d09c08a6ab4d19a78e6d0fd2c42c6b8e59b62f7f4c3fc7806f5b1d9f30e934b404de6465e9280300b034fd64e

C:\Windows\WinSxS\amd64_microsoft-windows-sechealthui.appxmain_31bf3856ad364e35_10.0.19041.964_none_90d24b203cdf4e96\squaretile-sdk.png

MD5 cc732d0bd874a5559714f32366affe1a
SHA1 b1b7b5585059d53f44d8e0dbfc260472ab658c71
SHA256 a836ae986ad1fdf66b57b8f55eac652b146a474835c2c0ee3a6afc945bd60bed
SHA512 3d9324b6ff7f7db2248f609f2364c515e39985e7db154df70926194ea141cc67a8283b8ec91b0c0f71b97476755cd272ab6af1d5b44c37f1b5821c91d18d4890

C:\Windows\WinSxS\wow64_microsoft-windows-onedrive-setup_31bf3856ad364e35_10.0.19041.1_none_e585f901f9ce93e6\OneDrive.lnk

MD5 1ccaf905d6c5c8d49bacf72f4e46db29
SHA1 319ec824802b35a1b6ee601c354a5f5946606e93
SHA256 908a71da86c8ead986cc989e3679eb0c11de6c9dd5535dab2870d7df08bd5e72
SHA512 d73949848261568734dc8361b5436d848dd0ed8edcd60b91496c4ab200b3b64a7bae26598bcd640462b19f6cf55b1438f468c4e938ec6dec1fdac704ea6414bb