VTI SCORE: 93/100
Dynamic Analysis Report |
Classification: |
Ransomware
|
Threat Names: | - |
Minecraft client 2020.exe
Windows Exe (x86-32)
Created at 2020-09-30T11:30:00
Remarks
(0x0200001D): The maximum number of extracted files was exceeded. Some files may be missing in the report.
(0x0200001B): The maximum number of file reputation requests per analysis (150) was exceeded.
This is a filtered view
This list contains only the embedded files, downloaded files, and dropped files
Filters: |
There are no files for this filter
There are no files in this analysis
Filename | Category | Type | Severity | Actions |
---|
C:\Users\FD1HVy\Desktop\Minecraft client 2020.exe | Sample File | Binary |
Malicious
|
...
|
»
PE Information
»
Image Base | 0x400000 |
Entry Point | 0xce54e5 |
Size Of Code | 0x1800 |
Size Of Initialized Data | 0x17b400 |
File Type | FileType.executable |
Subsystem | Subsystem.windows_gui |
Machine Type | MachineType.i386 |
Compile Timestamp | 2012-01-29 18:49:03+00:00 |
Sections (5)
»
Name | Virtual Address | Virtual Size | Raw Data Size | Raw Data Offset | Flags | Entropy |
---|---|---|---|---|---|---|
.text | 0x401000 | 0x1688 | 0x0 | 0x0 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 0.0 |
.rdata | 0x403000 | 0x820 | 0x0 | 0x0 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 0.0 |
.data | 0x404000 | 0x38bb | 0x0 | 0x0 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 0.0 |
.vmp0 | 0x408000 | 0x499c50 | 0x0 | 0x0 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 0.0 |
.vmp1 | 0x8a2000 | 0x523df0 | 0x523e00 | 0x400 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 7.96 |
Imports (12)
»
user32.dll (1)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
RegisterClassExA | 0x0 | 0xd57000 | 0x988ed4 | 0x4e72d4 | 0x0 |
kernel32.dll (1)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
lstrlenA | 0x0 | 0xd57008 | 0x988edc | 0x4e72dc | 0x0 |
shell32.dll (1)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
ShellExecuteA | 0x0 | 0xd57010 | 0x988ee4 | 0x4e72e4 | 0x0 |
advapi32.dll (1)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
RegCreateKeyExA | 0x0 | 0xd57018 | 0x988eec | 0x4e72ec | 0x0 |
shlwapi.dll (1)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
PathFindFileNameA | 0x0 | 0xd57020 | 0x988ef4 | 0x4e72f4 | 0x0 |
gdi32.dll (1)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
CreateFontIndirectA | 0x0 | 0xd57028 | 0x988efc | 0x4e72fc | 0x0 |
comctl32.dll (1)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
InitCommonControls | 0x0 | 0xd57030 | 0x988f04 | 0x4e7304 | 0x0 |
WTSAPI32.dll (1)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
WTSSendMessageW | 0x0 | 0xd57038 | 0x988f0c | 0x4e730c | 0x0 |
kernel32.dll (1)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
VirtualQuery | 0x0 | 0xd57040 | 0x988f14 | 0x4e7314 | 0x0 |
user32.dll (1)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
GetProcessWindowStation | 0x0 | 0xd57048 | 0x988f1c | 0x4e731c | 0x0 |
kernel32.dll (12)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
LocalAlloc | 0x0 | 0xd57050 | 0x988f24 | 0x4e7324 | 0x0 |
LocalFree | 0x0 | 0xd57054 | 0x988f28 | 0x4e7328 | 0x0 |
GetModuleFileNameW | 0x0 | 0xd57058 | 0x988f2c | 0x4e732c | 0x0 |
GetProcessAffinityMask | 0x0 | 0xd5705c | 0x988f30 | 0x4e7330 | 0x0 |
SetProcessAffinityMask | 0x0 | 0xd57060 | 0x988f34 | 0x4e7334 | 0x0 |
SetThreadAffinityMask | 0x0 | 0xd57064 | 0x988f38 | 0x4e7338 | 0x0 |
Sleep | 0x0 | 0xd57068 | 0x988f3c | 0x4e733c | 0x0 |
ExitProcess | 0x0 | 0xd5706c | 0x988f40 | 0x4e7340 | 0x0 |
FreeLibrary | 0x0 | 0xd57070 | 0x988f44 | 0x4e7344 | 0x0 |
LoadLibraryA | 0x0 | 0xd57074 | 0x988f48 | 0x4e7348 | 0x0 |
GetModuleHandleA | 0x0 | 0xd57078 | 0x988f4c | 0x4e734c | 0x0 |
GetProcAddress | 0x0 | 0xd5707c | 0x988f50 | 0x4e7350 | 0x0 |
user32.dll (2)
»
API Name | Ordinal | IAT Address | Thunk RVA | Thunk Offset | Hint |
---|---|---|---|---|---|
GetProcessWindowStation | 0x0 | 0xd57084 | 0x988f58 | 0x4e7358 | 0x0 |
GetUserObjectInformationW | 0x0 | 0xd57088 | 0x988f5c | 0x4e735c | 0x0 |
Memory Dumps (14)
»
Name | Process ID | Start VA | End VA | Dump Reason | PE Rebuild | Bitness | Entry Point | AV | YARA | Actions |
---|---|---|---|---|---|---|---|---|---|---|
buffer | 1 | 0x00DE0000 | 0x00DE0FFF | Content Changed |
![]() |
32-bit | - |
![]() |
![]() |
...
|
buffer | 1 | 0x00DE0000 | 0x00DE0FFF | Content Changed |
![]() |
32-bit | - |
![]() |
![]() |
...
|
buffer | 1 | 0x00E00000 | 0x00E00FFF | Content Changed |
![]() |
32-bit | - |
![]() |
![]() |
...
|
buffer | 1 | 0x00E00000 | 0x00E00FFF | First Execution |
![]() |
32-bit | 0x00E00015 |
![]() |
![]() |
...
|
buffer | 1 | 0x00E20000 | 0x00E20FFF | Content Changed |
![]() |
32-bit | - |
![]() |
![]() |
...
|
buffer | 1 | 0x00E20000 | 0x00E20FFF | Content Changed |
![]() |
32-bit | - |
![]() |
![]() |
...
|
buffer | 1 | 0x00E30000 | 0x00E30FFF | Content Changed |
![]() |
32-bit | - |
![]() |
![]() |
...
|
buffer | 1 | 0x00E30000 | 0x00E30FFF | Content Changed |
![]() |
32-bit | - |
![]() |
![]() |
...
|
buffer | 1 | 0x00E40000 | 0x00E40FFF | Content Changed |
![]() |
32-bit | - |
![]() |
![]() |
...
|
buffer | 1 | 0x00E40000 | 0x00E40FFF | Content Changed |
![]() |
32-bit | - |
![]() |
![]() |
...
|
buffer | 1 | 0x00F50000 | 0x00F50FFF | Content Changed |
![]() |
32-bit | - |
![]() |
![]() |
...
|
buffer | 1 | 0x00F50000 | 0x00F50FFF | Content Changed |
![]() |
32-bit | - |
![]() |
![]() |
...
|
buffer | 1 | 0x00F60000 | 0x00F60FFF | First Execution |
![]() |
32-bit | 0x00F6000F |
![]() |
![]() |
...
|
buffer | 1 | 0x00F60000 | 0x00F60FFF | Marked Executable |
![]() |
32-bit | - |
![]() |
![]() |
...
|
C:\588bce7c90097ed212\DHtmlHeader.html | Dropped File | Text |
Unknown
|
...
|
»
C:\588bce7c90097ed212\header.bmp | Modified File | Image |
Unknown
|
...
|
»
C:\588bce7c90097ed212\SplashScreen.bmp | Modified File | Image |
Unknown
|
...
|
»
C:\588bce7c90097ed212\watermark.bmp | Dropped File | Image |
Unknown
|
...
|
»
C:\Program Files\Java\jre1.8.0_144\bin\server\Xusage.txt | Dropped File | Stream |
Unknown
|
...
|
»
C:\Program Files\Java\jre1.8.0_144\lib\deploy\ffjcext.zip | Dropped File | ZIP |
Unknown
|
...
|
»
C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash.gif | Dropped File | Image |
Unknown
|
...
|
»
C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash@2x.gif | Dropped File | Image |
Unknown
|
...
|
»
C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash_11-lic.gif | Modified File | Image |
Unknown
|
...
|
»
C:\Program Files\Java\jre1.8.0_144\lib\deploy\splash_11@2x-lic.gif | Modified File | Image |
Unknown
|
...
|
»
C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_CopyDrop32x32.gif | Dropped File | Image |
Unknown
|
...
|
»
C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_LinkDrop32x32.gif | Modified File | Image |
Unknown
|
...
|
»
C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_MoveDrop32x32.gif | Dropped File | Image |
Unknown
|
...
|
»
C:\Program Files\Java\jre1.8.0_144\lib\images\cursors\win32_MoveNoDrop32x32.gif | Modified File | Image |
Unknown
|
...
|
»
C:\Program Files\Java\jre1.8.0_144\lib\jvm.hprof.txt | Dropped File | Stream |
Unknown
|
...
|
»
C:\Program Files\Java\jre1.8.0_144\THIRDPARTYLICENSEREADME-JAVAFX.txt | Modified File | Stream |
Unknown
|
...
|
»
C:\Program Files\Java\jre1.8.0_144\THIRDPARTYLICENSEREADME.txt | Dropped File | Stream |
Unknown
|
...
|
»
C:\Program Files\Java\jre1.8.0_144\Welcome.html | Modified File | Text |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\Office16\OSPP.HTM | Modified File | Text |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00004_.GIF | Dropped File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00011_.GIF | Dropped File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00021_.GIF | Dropped File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00037_.GIF | Modified File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00038_.GIF | Dropped File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00040_.GIF | Dropped File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00052_.GIF | Modified File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00057_.GIF | Dropped File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00090_.GIF | Dropped File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00092_.GIF | Modified File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00103_.GIF | Modified File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00120_.GIF | Dropped File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00126_.GIF | Dropped File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00129_.GIF | Dropped File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00130_.GIF | Dropped File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00135_.GIF | Dropped File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00139_.GIF | Dropped File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00142_.GIF | Dropped File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00154_.GIF | Modified File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00157_.GIF | Dropped File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00158_.GIF | Modified File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00160_.GIF | Dropped File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00161_.GIF | Modified File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00163_.GIF | Modified File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00164_.GIF | Dropped File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00165_.GIF | Dropped File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00167_.GIF | Modified File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00169_.GIF | Modified File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00170_.GIF | Modified File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00171_.GIF | Dropped File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00172_.GIF | Modified File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00174_.GIF | Dropped File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00175_.GIF | Modified File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\AG00176_.GIF | Dropped File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD10890_.GIF | Modified File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD10972_.GIF | Modified File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19563_.GIF | Modified File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\BD19582_.GIF | Dropped File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0075478.GIF | Dropped File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0099145.JPG | Modified File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0099147.JPG | Dropped File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0099148.JPG | Modified File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0099150.JPG | Modified File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0099152.JPG | Modified File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0099154.JPG | Modified File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0099155.JPG | Modified File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0099156.JPG | Dropped File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0099157.JPG | Dropped File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0099160.JPG | Modified File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0099161.JPG | Modified File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0099162.JPG | Modified File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0099165.JPG | Modified File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0099166.JPG | Modified File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0099167.JPG | Dropped File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0099168.JPG | Dropped File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0099185.JPG | Modified File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0099186.JPG | Modified File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0099187.JPG | Modified File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0099188.JPG | Modified File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0099189.JPG | Modified File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0099190.JPG | Dropped File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0099191.JPG | Modified File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0099192.GIF | Modified File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0099193.GIF | Dropped File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0099194.GIF | Dropped File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0099195.GIF | Modified File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0099196.GIF | Modified File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0099197.GIF | Modified File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0099198.GIF | Modified File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0099199.GIF | Dropped File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0099200.GIF | Dropped File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0099201.GIF | Modified File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0099202.GIF | Modified File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0099203.GIF | Dropped File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0101856.BMP | Dropped File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0101857.BMP | Dropped File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0101858.BMP | Modified File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0101859.BMP | Modified File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0101860.BMP | Modified File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0101861.BMP | Modified File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0101862.BMP | Dropped File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0101863.BMP | Dropped File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0101864.BMP | Modified File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0101865.BMP | Dropped File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0101866.BMP | Dropped File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0101867.BMP | Modified File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0144773.JPG | Modified File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0145168.JPG | Modified File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0145212.JPG | Modified File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0145272.JPG | Modified File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0145361.JPG | Modified File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0145373.JPG | Dropped File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0145669.JPG | Modified File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0145707.JPG | Modified File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0145810.JPG | Dropped File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0145879.JPG | Modified File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0145895.JPG | Dropped File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0145904.JPG | Modified File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0146142.JPG | Dropped File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0148309.JPG | Dropped File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0148757.JPG | Dropped File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0148798.JPG | Dropped File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0149018.JPG | Dropped File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0149118.JPG | Dropped File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0164153.JPG | Modified File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0174952.JPG | Modified File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0175361.JPG | Modified File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0175428.JPG | Dropped File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0177257.JPG | Dropped File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0177806.JPG | Modified File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0178348.JPG | Dropped File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0178459.JPG | Dropped File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0178460.JPG | Dropped File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0178523.JPG | Dropped File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0178632.JPG | Modified File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0178639.JPG | Dropped File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0178932.JPG | Dropped File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0179963.JPG | Modified File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0182689.JPG | Dropped File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0202045.JPG | Dropped File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0216112.JPG | Modified File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0216153.JPG | Dropped File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0227419.JPG | Modified File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0227558.JPG | Modified File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0287641.JPG | Dropped File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0287642.JPG | Dropped File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0287643.JPG | Modified File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0287644.JPG | Dropped File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0287645.JPG | Dropped File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0289430.JPG | Dropped File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0309480.JPG | Modified File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0309567.JPG | Dropped File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0309585.JPG | Modified File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0309598.JPG | Dropped File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0309664.JPG | Modified File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0309705.JPG | Dropped File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0313896.JPG | Dropped File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0313965.JPG | Modified File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0313970.JPG | Modified File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0313974.JPG | Modified File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0314068.JPG | Modified File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0315580.JPG | Dropped File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0315612.JPG | Dropped File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0321179.JPG | Dropped File | Image |
Unknown
|
...
|
»
C:\Program Files\Microsoft Office\root\CLIPART\PUB60COR\J0337280.JPG | Modified File | Image |
Unknown
|
...
|
»
C:\Program Files\Common Files\microsoft shared\VC\HOW TO DECRYPT FILES.txt | Dropped File | Text |
Unknown
|
...
|
»