539b0b5d...8505 | IOCs
Logo
Try VMRay Analyzer
VTI SCORE: 100/100
Dynamic Analysis Report
Classification: Riskware, Ransomware

539b0b5d54757e8a2b754ecdc2939eb7cf9db0ed1728e0eca407500222668505 (SHA256)

fcr.exe

Windows Exe (x86-32)

Created at 2018-09-23 19:12:00

...

Notifications (2/3)

Some extracted files may be missing in the report since the maximum number of extracted files was reached during the analysis. You can increase the limit in the configuration settings.

The overall sleep time of all monitored processes was truncated from "1 minute" to "20 seconds" to reveal dormant functionality.

The operating system was rebooted during the analysis.

Indicators

File (3844)
»
Filename Hash Operations Source
\\?\C:\$Recycle.Bin\S-1-5-21-3388679973-3930757225-3770151564-1000\desktop.ini id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\$Recycle.Bin\S-1-5-21-3388679973-3930757225-3770151564-1000\How To Restore Files.txt - Access
\\?\C:\Boot\BOOTSTAT.DAT id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Boot\cs-CZ\How To Restore Files.txt - Access
\\?\C:\Boot\da-DK\How To Restore Files.txt - Access
\\?\C:\Boot\de-DE\How To Restore Files.txt - Access
\\?\C:\Boot\el-GR\How To Restore Files.txt - Access
\\?\C:\Boot\en-US\How To Restore Files.txt - Access
\\?\C:\Boot\es-ES\How To Restore Files.txt - Access
\\?\C:\Boot\fi-FI\How To Restore Files.txt - Access
\\?\C:\Boot\Fonts\How To Restore Files.txt - Access
\\?\C:\Boot\fr-FR\How To Restore Files.txt - Access
\\?\C:\Boot\How To Restore Files.txt - Access
\\?\C:\Boot\hu-HU\How To Restore Files.txt - Access
\\?\C:\Boot\it-IT\How To Restore Files.txt - Access
\\?\C:\Boot\ja-JP\How To Restore Files.txt - Access
\\?\C:\Boot\ko-KR\How To Restore Files.txt - Access
\\?\C:\Boot\nb-NO\How To Restore Files.txt - Access
\\?\C:\Boot\nl-NL\How To Restore Files.txt - Access
\\?\C:\Boot\pl-PL\How To Restore Files.txt - Access
\\?\C:\Boot\pt-BR\How To Restore Files.txt - Access
\\?\C:\Boot\pt-PT\How To Restore Files.txt - Access
\\?\C:\Boot\ru-RU\How To Restore Files.txt - Access
\\?\C:\Boot\sv-SE\How To Restore Files.txt - Access
\\?\C:\Boot\tr-TR\How To Restore Files.txt - Access
\\?\C:\Boot\zh-CN\How To Restore Files.txt - Access
\\?\C:\Boot\zh-HK\How To Restore Files.txt - Access
\\?\C:\Boot\zh-TW\How To Restore Files.txt - Access
\\?\C:\bootmgr - Access
\\?\C:\BOOTSECT.BAK - Access
\\?\C:\BOOTSECT.BAK id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\How To Restore Files.txt - Access
\\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\How To Restore Files.txt - Access
\\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\How To Restore Files.txt - Access
\\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.msi id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.xml id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\How To Restore Files.txt - Access
\\?\C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.msi id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.xml id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\How To Restore Files.txt - Access
\\?\C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\How To Restore Files.txt - Access
\\?\C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\Setup.xml id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\How To Restore Files.txt - Access
\\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\How To Restore Files.txt - Access
\\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\How To Restore Files.txt - Access
\\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\How To Restore Files.txt - Access
\\?\C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\How To Restore Files.txt - Access
\\?\C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Office32MUI.msi id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Office32MUI.xml id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\How To Restore Files.txt - Access
\\?\C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfLR.cab id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\How To Restore Files.txt - Access
\\?\C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\Setup.xml id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\How To Restore Files.txt - Access
\\?\C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OneNoteMUI.msi id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OneNoteMUI.xml id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\How To Restore Files.txt - Access
\\?\C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjectMUI.msi id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjectMUI.xml id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\GrooveLR.cab id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\How To Restore Files.txt - Access
\\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\1033\How To Restore Files.txt - Access
\\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\How To Restore Files.txt - Access
\\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\How To Restore Files.txt - Access
\\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\How To Restore Files.txt - Access
\\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\How To Restore Files.txt - Access
\\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Office32WW.msi id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Office32WW.xml id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ose.exe id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\How To Restore Files.txt - Access
\\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Office32WW.msi id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Office32WW.xml id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\How To Restore Files.txt - Access
\\?\C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Office32WW.msi id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Office32WW.xml id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Adobe\Reader 10.0\Benioku.htm id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Adobe\Reader 10.0\Berime.htm id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Adobe\Reader 10.0\Esl\AiodLite.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Adobe\Reader 10.0\Esl\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Adobe\Reader 10.0\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Adobe\Reader 10.0\IrakHau.htm id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Adobe\Reader 10.0\Leame.htm id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Adobe\Reader 10.0\LeesMij.htm id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Adobe\Reader 10.0\Leggimi.htm id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\HelpCfg\ca_ES\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\HelpCfg\ca_ES\Reader_10.0.helpcfg id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\HelpCfg\cs_CZ\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\HelpCfg\da_DK\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\HelpCfg\de_DE\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\HelpCfg\es_ES\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\HelpCfg\eu_ES\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\HelpCfg\fi_FI\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\HelpCfg\fr_FR\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\HelpCfg\hr_HR\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\HelpCfg\hu_HU\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\HelpCfg\it_IT\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\HelpCfg\ja_JP\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\HelpCfg\ja_JP\Reader_10.0.helpcfg id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\HelpCfg\ko_KR\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\HelpCfg\ko_KR\Reader_10.0.helpcfg id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\HelpCfg\nb_NO\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\HelpCfg\nb_NO\Reader_10.0.helpcfg id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\HelpCfg\nl_NL\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\HelpCfg\nl_NL\Reader_10.0.helpcfg id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\HelpCfg\pl_PL\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\HelpCfg\pl_PL\Reader_10.0.helpcfg id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\HelpCfg\pt_BR\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\HelpCfg\ro_RO\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\HelpCfg\ru_RU\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\HelpCfg\sk_SK\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\HelpCfg\sl_SI\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\HelpCfg\sv_SE\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\HelpCfg\tr_TR\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\HelpCfg\uk_UA\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\HelpCfg\zh_CN\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\HelpCfg\zh_TW\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\constitute_appropriate_sorry.exe id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\Java\Java Update\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\DAO\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\Help\1028\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\Help\1028\hxdsui.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\Help\1031\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\Help\1031\hxdsui.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\Help\1033\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\Help\1033\hxdsui.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\Help\1036\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\Help\1036\hxdsui.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\Help\1040\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\Help\1040\hxdsui.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\Help\1041\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\Help\1041\hxdsui.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\Help\1042\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\Help\1042\hxdsui.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\Help\1046\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\Help\1046\hxdsui.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\Help\1049\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\Help\1049\hxdsui.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\Help\2052\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\Help\2052\hxdsui.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\Help\3082\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\Help\3082\hxdsui.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\Help\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\Help\Hx.HxC id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\Help\Hx.HxT id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\Help\HxRuntime.HxS id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\Help\Keywords.HxK id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\Help\NamedURLs.HxK id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\ink\1.0\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\ink\1.7\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\ink\en-US\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\ink\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\MSEnv\PublicAssemblies\extensibility.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\MSEnv\PublicAssemblies\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\en-US\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\Portal\1033\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\Portal\1033\PortalConnect.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\Portal\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\Stationery\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA6\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA6\VBE6EXT.OLB id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\VC\amd64\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\VC\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\VGX\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\Microsoft.VisualStudio.Tools.Applications.Blueprints.tlb id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\VSTA\AppInfoDocument\AddIns.store id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\VSTA\AppInfoDocument\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\VSTA\AppInfoDocument\Microsoft.VisualStudio.Tools.Office.AppInfoDocument\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\AddInSideAdapters\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\AddInViews\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\Contracts\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\HostSideAdapters\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\PipelineSegments.store id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\1033\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.config id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\VSTO\ActionsPane3.xsd id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\VSTO\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\VSTO\vstoee.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\VSTO\vstoee100.tlb id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\14\BIN\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\regulationspublishers.exe id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\Services\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\TTS20\en-US\enu-dsk\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\TTS20\en-US\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\TTS20\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\System\ado\en-US\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\System\ado\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\System\en-US\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\System\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\System\msadc\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\System\Ole DB\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\desktop.ini id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Google\Chrome\Application\58.0.3029.110\58.0.3029.110.manifest id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Google\Chrome\Application\58.0.3029.110\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Google\Chrome\Application\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Internet Explorer\en-US\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Internet Explorer\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Internet Explorer\SIGNUP\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Internet Explorer\SIGNUP\install.ins id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Java\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Java\jewel.exe id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Java\jre7\bin\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Java\jre7\COPYRIGHT id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Java\jre7\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Java\jre7\lib\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Java\jre7\LICENSE id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Java\jre7\README.txt id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Java\jre7\release id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\as80.xsl id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\as90.xsl id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Microsoft Office\Office14\1033\BHOINTL.DLL id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Microsoft Office\Office14\1033\DL_RES.DLL id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Microsoft Office\Office14\1033\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Microsoft Office\Office14\AUTHZAX.DLL id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Microsoft Office\Office14\BCSLaunch.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Microsoft Office\Office14\DGRMLNCH.DLL id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Microsoft Office\Office14\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\PrivateAssemblies\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\PrivateAssemblies\Microsoft.VisualStudio.Tools.Applications.Project.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\PublicAssemblies\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\PublicAssemblies\Microsoft.VisualStudio.Tools.Applications.Adapter.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\PublicAssemblies\Microsoft.VisualStudio.Tools.Applications.AddInManager.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\AboutBox.zip id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\AppConfigurationInternal.zip id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\1033\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Microsoft.NET\browser accredited mil.exe id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Microsoft.NET\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\adodb.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Microsoft.NET\RedistList\AssemblyList_4_client.xml id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Microsoft.NET\RedistList\AssemblyList_4_extended.xml id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Microsoft.NET\RedistList\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Mozilla Firefox\AccessibleMarshal.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Mozilla Firefox\application.ini id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Mozilla Firefox\breakpadinjector.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Mozilla Firefox\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Mozilla Maintenance Service\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\MSBuild\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\MSBuild\Microsoft.Office.InfoPath.targets id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\Workflow.Targets id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\Workflow.VisualBasic.Targets id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\MSBuild\moore-encouraging-percent.exe id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\FrameworkList.xml id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\SubsetList\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\WinFXList.xml id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\SubsetList\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Uninstall Information\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Uninstall Information\traditions.exe id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Windows Defender\en-US\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Windows Defender\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Windows Mail\en-US\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Windows Mail\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Windows Media Player\en-US\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Windows Media Player\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Windows Media Player\Media Renderer\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Windows Media Player\Skins\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Windows NT\Accessories\en-US\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Windows NT\Accessories\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Windows NT\TableTextService\en-US\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Windows NT\TableTextService\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Windows Photo Viewer\en-US\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Windows Photo Viewer\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Windows Photo Viewer\motorola spank thomas.exe id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Windows Portable Devices\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Windows Sidebar\en-US\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\css\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\js\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\images\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\en-US\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\en-US\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\images\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\images\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\css\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\js\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\css\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\js\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\images\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\images\in_sidebar\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\images\on_desktop\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Windows Sidebar\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Windows Sidebar\mold.exe id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Windows Sidebar\settings.ini id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Common Files\DESIGNER\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\DESIGNER\MSADDNDR.DLL id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Common Files\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\DW\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\EQUATION\1033\EEINTL.DLL id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\EQUATION\1033\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.CNT id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\EQUATION\eqnedt32.exe.manifest id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.HLP id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\EQUATION\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\EURO\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\EURO\MSOEURO.DLL id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\Filters\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\Filters\msgfilt.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\CGMIMP32.CFG id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\Help\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\en-US\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\MSClientDataMgr\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\MSInfo\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\ACEINTL.DLL id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPC.DLL id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\PROOF\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\1033\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\1033\MCABOUT.HTM id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\FBIBLIO.DLL id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\FDATE.DLL id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\Source Engine\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\TextConv\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\AFTRNOON\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\ARCTIC\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\AXIS\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLENDS\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUECALM\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\BREEZE\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\CANYON\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\CAPSULES\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\CASCADE\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\COMPASS\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\CONCRETE\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\DEEPBLUE\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECHO\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECLIPSE\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\EDGE\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\EVRGREEN\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\EXPEDITN\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\ICE\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\INDUST\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\IRIS\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\JOURNAL\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\LAYERS\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\LEVEL\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\NETWORK\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\PAPYRUS\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\PIXEL\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\PROFILE\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\QUAD\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\RADIAL\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\REFINED\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\RICEPAPR\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\RIPPLE\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\RMNSQUE\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\SATIN\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\SKY\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\SLATE\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\SONORA\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\SPRING\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\STRTEDGE\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\STUDIO\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\SUMIPNTG\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\ARFR\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\ENES\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\ENFR\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\ESEN\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\FRAR\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\FREN\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\VBE7.DLL id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\VC\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\VGX\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\Visio Shared\Fonts\BIGFONT.SHX id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\Visio Shared\Fonts\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\VSTO\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\MSOSVINT.DLL id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\Web Folders\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\14\BIN\1033\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\14\BIN\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\palmer still equations.exe id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Common Files\Services\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\en-US\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\System\ado\en-US\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\System\ado\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\System\en-US\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\System\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\System\msadc\en-US\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\System\msadc\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\System\MSMAPI\1033\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\System\MSMAPI\1033\MSMAPI32.DLL id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Common Files\System\Ole DB\How To Restore Files.txt - Access
\\?\C:\Program Files\desktop.ini id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\DVD Maker\en-US\How To Restore Files.txt - Access
\\?\C:\Program Files\DVD Maker\How To Restore Files.txt - Access
\\?\C:\Program Files\DVD Maker\Shared\DvdStyles\How To Restore Files.txt - Access
\\?\C:\Program Files\DVD Maker\Shared\How To Restore Files.txt - Access
\\?\C:\Program Files\How To Restore Files.txt - Access
\\?\C:\Program Files\Internet Explorer\en-US\How To Restore Files.txt - Access
\\?\C:\Program Files\Internet Explorer\How To Restore Files.txt - Access
\\?\C:\Program Files\Internet Explorer\mysimon.exe id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Internet Explorer\SIGNUP\How To Restore Files.txt - Access
\\?\C:\Program Files\Internet Explorer\SIGNUP\install.ins id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\as80.xsl id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\as90.xsl id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\How To Restore Files.txt - Access
\\?\C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\Informix.xsl id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\msjet.xsl id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\How To Restore Files.txt - Access
\\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00004_.GIF id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\How To Restore Files.txt - Access
\\?\C:\Program Files\Microsoft Office\CLIPART\Publisher\Backgrounds\How To Restore Files.txt - Access
\\?\C:\Program Files\Microsoft Office\CLIPART\Publisher\Backgrounds\J0143743.GIF id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Microsoft Office\CLIPART\Publisher\Backgrounds\J0143744.GIF id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Microsoft Office\Document Themes 14\Adjacency.thmx id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Microsoft Office\Document Themes 14\Angles.thmx id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Microsoft Office\Document Themes 14\How To Restore Files.txt - Access
\\?\C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\1033\How To Restore Files.txt - Access
\\?\C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\How To Restore Files.txt - Access
\\?\C:\Program Files\Microsoft Office\MEDIA\OFFICE14\1033\How To Restore Files.txt - Access
\\?\C:\Program Files\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\How To Restore Files.txt - Access
\\?\C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\How To Restore Files.txt - Access
\\?\C:\Program Files\Microsoft Office\MEDIA\OFFICE14\How To Restore Files.txt - Access
\\?\C:\Program Files\Microsoft Office\MEDIA\OFFICE14\LINES\How To Restore Files.txt - Access
\\?\C:\Program Files\Microsoft Office\MEDIA\OFFICE14\OFFICE10.DLL id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Microsoft Office\Office14\1033\ACCDDSUI.DLL id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Microsoft Office\Office14\1033\How To Restore Files.txt - Access
\\?\C:\Program Files\Microsoft Office\Office14\1036\How To Restore Files.txt - Access
\\?\C:\Program Files\Microsoft Office\Office14\1036\MSO.ACL id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Microsoft Office\Office14\3082\How To Restore Files.txt - Access
\\?\C:\Program Files\Microsoft Office\Office14\3082\MSO.ACL id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Microsoft Office\Office14\How To Restore Files.txt - Access
\\?\C:\Program Files\Microsoft Office\Stationery\1033\CURRENCY.GIF id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Microsoft Office\Stationery\1033\CURRENCY.HTM id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Microsoft Office\Stationery\1033\DADSHIRT.GIF id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Microsoft Office\Stationery\1033\DADSHIRT.HTM id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Microsoft Office\Stationery\1033\How To Restore Files.txt - Access
\\?\C:\Program Files\Microsoft Office\Stationery\1033\JUDGESCH.GIF id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Microsoft Office\Stationery\1033\JUDGESCH.HTM id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Microsoft Office\Templates\1033\Access\How To Restore Files.txt - Access
\\?\C:\Program Files\Microsoft Office\Templates\1033\AdjacencyLetter.dotx id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Microsoft Office\Templates\1033\How To Restore Files.txt - Access
\\?\C:\Program Files\Microsoft SQL Server Compact Edition\cat.exe id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Microsoft SQL Server Compact Edition\How To Restore Files.txt - Access
\\?\C:\Program Files\Microsoft SQL Server Compact Edition\v3.5\How To Restore Files.txt - Access
\\?\C:\Program Files\Microsoft Sync Framework\v1.0\Documentation\1033\License Agreements\How To Restore Files.txt - Access
\\?\C:\Program Files\Microsoft Sync Framework\v1.0\Documentation\1033\License Agreements\SynchronizationEula.rtf id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Microsoft Sync Framework\v1.0\Runtime\x64\How To Restore Files.txt - Access
\\?\C:\Program Files\Microsoft Synchronization Services\ADO.NET\v1.0\How To Restore Files.txt - Access
\\?\C:\Program Files\Microsoft Synchronization Services\ADO.NET\v1.0\Microsoft.Synchronization.Data.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Microsoft Synchronization Services\ADO.NET\v1.0\Microsoft.Synchronization.Data.Server.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Microsoft Synchronization Services\ADO.NET\v1.0\Microsoft.Synchronization.Data.SqlServerCe.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Microsoft Synchronization Services\hourunexpected.exe id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Microsoft Synchronization Services\How To Restore Files.txt - Access
\\?\C:\Program Files\Microsoft Synchronization Services\sword.exe id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\How To Restore Files.txt - Access
\\?\C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\Workflow.Targets id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\Workflow.VisualBasic.Targets id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\How To Restore Files.txt - Access
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\How To Restore Files.txt - Access
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\FrameworkList.xml id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\How To Restore Files.txt - Access
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\WinFXList.xml id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\How To Restore Files.txt - Access
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\How To Restore Files.txt - Access
\\?\C:\Program Files\Uninstall Information\How To Restore Files.txt - Access
\\?\C:\Program Files\Uninstall Information\vampire criterion.exe id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Defender\en-US\How To Restore Files.txt - Access
\\?\C:\Program Files\Windows Defender\finds_lingerie_candy.exe id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Defender\How To Restore Files.txt - Access
\\?\C:\Program Files\Windows Defender\picking separated lib.exe id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Journal\en-US\How To Restore Files.txt - Access
\\?\C:\Program Files\Windows Journal\How To Restore Files.txt - Access
\\?\C:\Program Files\Windows Journal\Templates\How To Restore Files.txt - Access
\\?\C:\Program Files\Windows Mail\en-US\How To Restore Files.txt - Access
\\?\C:\Program Files\Windows Mail\How To Restore Files.txt - Access
\\?\C:\Program Files\Windows Mail\sims.exe id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Media Player\en-US\How To Restore Files.txt - Access
\\?\C:\Program Files\Windows Media Player\How To Restore Files.txt - Access
\\?\C:\Program Files\Windows Media Player\Media Renderer\How To Restore Files.txt - Access
\\?\C:\Program Files\Windows Media Player\Network Sharing\How To Restore Files.txt - Access
\\?\C:\Program Files\Windows Media Player\sentence-arrive-unnecessary.exe id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Media Player\Skins\How To Restore Files.txt - Access
\\?\C:\Program Files\Windows NT\Accessories\en-US\How To Restore Files.txt - Access
\\?\C:\Program Files\Windows NT\Accessories\How To Restore Files.txt - Access
\\?\C:\Program Files\Windows NT\TableTextService\en-US\How To Restore Files.txt - Access
\\?\C:\Program Files\Windows NT\TableTextService\How To Restore Files.txt - Access
\\?\C:\Program Files\Windows Photo Viewer\en-US\How To Restore Files.txt - Access
\\?\C:\Program Files\Windows Photo Viewer\How To Restore Files.txt - Access
\\?\C:\Program Files\Windows Portable Devices\How To Restore Files.txt - Access
\\?\C:\Program Files\Windows Sidebar\en-US\How To Restore Files.txt - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\css\How To Restore Files.txt - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\How To Restore Files.txt - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\js\How To Restore Files.txt - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\How To Restore Files.txt - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\How To Restore Files.txt - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\How To Restore Files.txt - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\How To Restore Files.txt - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\How To Restore Files.txt - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\en-US\css\How To Restore Files.txt - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\en-US\How To Restore Files.txt - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\en-US\js\How To Restore Files.txt - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\How To Restore Files.txt - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\images\How To Restore Files.txt - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\en-US\css\How To Restore Files.txt - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\en-US\How To Restore Files.txt - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\en-US\js\How To Restore Files.txt - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\How To Restore Files.txt - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\How To Restore Files.txt - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\css\How To Restore Files.txt - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\en-US\How To Restore Files.txt - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\How To Restore Files.txt - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\How To Restore Files.txt - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\js\How To Restore Files.txt - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\css\How To Restore Files.txt - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\How To Restore Files.txt - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\js\How To Restore Files.txt - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\How To Restore Files.txt - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\How To Restore Files.txt - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\css\How To Restore Files.txt - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\How To Restore Files.txt - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\js\How To Restore Files.txt - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\How To Restore Files.txt - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\How To Restore Files.txt - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\css\How To Restore Files.txt - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\How To Restore Files.txt - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\js\How To Restore Files.txt - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\How To Restore Files.txt - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\How To Restore Files.txt - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\in_sidebar\How To Restore Files.txt - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\on_desktop\How To Restore Files.txt - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\css\How To Restore Files.txt - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\How To Restore Files.txt - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\js\How To Restore Files.txt - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\How To Restore Files.txt - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\120DPI\How To Restore Files.txt - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\144DPI\How To Restore Files.txt - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\How To Restore Files.txt - Access
\\?\C:\Program Files\Windows Sidebar\How To Restore Files.txt - Access
\\?\C:\Program Files\Windows Sidebar\settings.ini id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\ProgramData\Adobe\Acrobat\10.0\Replicate\Security\directories.acrodata id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\ProgramData\Adobe\Acrobat\10.0\Replicate\Security\How To Restore Files.txt - Access
\\?\C:\ProgramData\Adobe\ARM\Reader_10.0.0\AdbeRdrSecUpd10111.msp id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\ProgramData\Adobe\ARM\Reader_10.0.0\AdbeRdrUpd10116_MUI.msp id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\ProgramData\Adobe\ARM\Reader_10.0.0\How To Restore Files.txt - Access
\\?\C:\ProgramData\Microsoft Help\Hx.hxn id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\ProgramData\Microsoft Help\MS.EXCEL.DEV.14.1033.hxn id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\ProgramData\Microsoft\Assistance\Client\1.0\en-US\Help_CValidator.H1D id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\ProgramData\Microsoft\Assistance\Client\1.0\en-US\How To Restore Files.txt - Access
\\?\C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\d42cc0c3858a58db2db37658219e6400_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\How To Restore Files.txt - Access
\\?\C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\How To Restore Files.txt - Access
\\?\C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-US\How To Restore Files.txt - Access
\\?\C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\How To Restore Files.txt - Access
\\?\C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\How To Restore Files.txt - Access
\\?\C:\ProgramData\Microsoft\IdentityCRL\How To Restore Files.txt - Access
\\?\C:\ProgramData\Microsoft\IdentityCRL\ppcrlui.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\ProgramData\Microsoft\MF\How To Restore Files.txt - Access
\\?\C:\ProgramData\Microsoft\MF\Pending.GRL id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\ProgramData\Microsoft\Network\Downloader\How To Restore Files.txt - Access
\\?\C:\ProgramData\Microsoft\OFFICE\AssetLibrary.ico id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\ProgramData\Microsoft\OFFICE\How To Restore Files.txt - Access
\\?\C:\ProgramData\Microsoft\OfficeSoftwareProtectionPlatform\Cache\How To Restore Files.txt - Access
\\?\C:\ProgramData\Microsoft\OfficeSoftwareProtectionPlatform\How To Restore Files.txt - Access
\\?\C:\ProgramData\Microsoft\RAC\PublishedData\How To Restore Files.txt - Access
\\?\C:\ProgramData\Microsoft\RAC\StateData\How To Restore Files.txt - Access
\\?\C:\ProgramData\Microsoft\RAC\Temp\How To Restore Files.txt - Access
\\?\C:\ProgramData\Microsoft\RAC\Temp\sql65F3.tmp id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\ProgramData\Microsoft\User Account Pictures\Default Pictures\How To Restore Files.txt - Access
\\?\C:\ProgramData\Microsoft\User Account Pictures\How To Restore Files.txt - Access
\\?\C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\How To Restore Files.txt - Access
\\?\C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\mpasdlta.vdm id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\ProgramData\Microsoft\Windows Defender\Scans\History\CacheManager\How To Restore Files.txt - Access
\\?\C:\ProgramData\Microsoft\Windows Defender\Scans\History\CacheManager\MpSfc.bin id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\ProgramData\Microsoft\Windows Defender\Scans\History\Results\Resource\How To Restore Files.txt - Access
\\?\C:\ProgramData\Microsoft\Windows Defender\Scans\History\Results\Resource\{1D1DBF3A-752F-47E2-BE70-D848D4A9AFB0} id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\How To Restore Files.txt - Access
\\?\C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\Unknown.Log id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\ProgramData\Microsoft\Windows Defender\Support\How To Restore Files.txt - Access
\\?\C:\ProgramData\Microsoft\Windows NT\MSFax\Common Coverpages\en-US\How To Restore Files.txt - Access
\\?\C:\ProgramData\Microsoft\Windows NT\MSFax\VirtualInbox\en-US\How To Restore Files.txt - Access
\\?\C:\ProgramData\Microsoft\Windows NT\MSScan\How To Restore Files.txt - Access
\\?\C:\ProgramData\Mozilla\logs\How To Restore Files.txt - Access
\\?\C:\ProgramData\Package Cache\42D5BEC7DDFBD49E76467529CBC2868987BF8460\packages\Patch\x64\How To Restore Files.txt - Access
\\?\C:\ProgramData\Package Cache\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\packages\vcRuntimeMinimum_x86\How To Restore Files.txt - Access
\\?\C:\ProgramData\Package Cache\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\packages\vcRuntimeAdditional_amd64\How To Restore Files.txt - Access
\\?\C:\ProgramData\Package Cache\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\packages\vcRuntimeMinimum_x86\How To Restore Files.txt - Access
\\?\C:\ProgramData\Package Cache\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\packages\vcRuntimeAdditional_x86\How To Restore Files.txt - Access
\\?\C:\ProgramData\Package Cache\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\packages\vcRuntimeMinimum_amd64\How To Restore Files.txt - Access
\\?\C:\ProgramData\Package Cache\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\packages\vcRuntimeAdditional_amd64\How To Restore Files.txt - Access
\\?\C:\ProgramData\Package Cache\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\packages\vcRuntimeMinimum_amd64\How To Restore Files.txt - Access
\\?\C:\ProgramData\Package Cache\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\packages\vcRuntimeAdditional_x86\How To Restore Files.txt - Access
\\?\C:\ProgramData\Package Cache\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\packages\vcRuntimeMinimum_x86\How To Restore Files.txt - Access
\\?\C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\state.rsm id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\ProgramData\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\packages\vcRuntimeMinimum_amd64\How To Restore Files.txt - Access
\\?\C:\ProgramData\Package Cache\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\packages\vcRuntimeAdditional_amd64\How To Restore Files.txt - Access
\\?\C:\ProgramData\Package Cache\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\packages\vcRuntimeAdditional_amd64\vc_runtimeAdditional_x64.msi id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\ProgramData\Package Cache\{e52a6842-b0ac-476e-b48f-378a97a67346}\state.rsm id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\ProgramData\Package Cache\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\How To Restore Files.txt - Access
\\?\C:\ProgramData\Package Cache\{f325f05b-f963-4640-a43b-c8a494cdda0f}\state.rsm id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\ProgramData\Package Cache\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\packages\vcRuntimeAdditional_x86\How To Restore Files.txt - Access
\\?\C:\ProgramData\Package Cache\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\packages\vcRuntimeAdditional_x86\vc_runtimeAdditional_x86.msi id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\ProgramData\Sun\Java\Java Update\How To Restore Files.txt - Access
\\?\C:\Recovery\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\How To Restore Files.txt - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Acrobat\10.0\AdobeCMapFnt10.lst id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Acrobat\10.0\How To Restore Files.txt - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Color\ACECache11.lst id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Color\How To Restore Files.txt - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Color\Profiles\How To Restore Files.txt - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Color\Profiles\wscRGB.icc id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\How To Restore Files.txt - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\How To Restore Files.txt - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\manifests\How To Restore Files.txt - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\GDIPFONTCACHEV1.DAT id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\How To Restore Files.txt - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\IconCache.db id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\How To Restore Files.txt - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Adobe\Acrobat\10.0\How To Restore Files.txt - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Adobe\Acrobat\10.0\rdrmessage.zip id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Adobe\Acrobat\10.0\ReaderMessages id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875 id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\How To Restore Files.txt - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875 id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973 id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1DAF2884EC4DFA96BA4A58D4DBC9C406 id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\23B523C9E7746F715D33C6527C18EB9D id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3130B1871A126520A8C47861EFE3ED4D id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3388ECC3F7BC4A9271C10ED8621E5A65_F55C512047947B70F94DE5DEC6D6838D id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\How To Restore Files.txt - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\How To Restore Files.txt - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\AU\au.cab id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\AU\How To Restore Files.txt - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\Deployment\deployment.properties id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\Deployment\How To Restore Files.txt - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\jre1.7.0_45\How To Restore Files.txt - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\69-LUmry m-.bmp id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\6cHawfktiEZ.wav id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\6tU1DrgevnlBIXwjA.mp3 id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\8hzaVpqj7b2yZS4hQQX8.m4a id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Adobe\Acrobat\10.0\Security\How To Restore Files.txt - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\b2ut2.avi id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Cj O Dl60Ws_W.ots id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\D3kKjfyCTl.avi id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\F7hYN.ots id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\f8Ro3n.pptx id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\G_LitrMcKt.wav id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\GxY9j-YD0CfIAbkw0.png id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\h-HTnXxEnveIM20.m4a id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\H4rg2nkN_C8pmo9n.jpg id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\h84ce25Cd2e.csv id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\How To Restore Files.txt - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\HQDxBZD6HlJy7LLor.m4a id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\jLfOoXctrtajuOXkJWbB.gif id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\LtrqqbP.mkv id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3388679973-3930757225-3770151564-1000\How To Restore Files.txt - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\How To Restore Files.txt - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Office\How To Restore Files.txt - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Outlook\How To Restore Files.txt - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Protect\How To Restore Files.txt - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Publisher Building Blocks\How To Restore Files.txt - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Templates\How To Restore Files.txt - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Mozilla\Firefox\How To Restore Files.txt - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Mozilla\Firefox\profiles.ini id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\qMoHu7gI.flv id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\QQm9 JXI33bPKtzQI.m4a id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\qUPt7PlaxE1RY9rpDm.m4a id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Rh3gf-zsV.wav id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\RhM7dZ0Ojg60m.wav id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\SKC4gL-p7lgC.wav id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\t5N8NdUoe08ojpA.jpg id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\T8IXEpn4.bmp id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\tIzLrD3rrMP1SB9mMw.png id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Tj9TheJG.m4a id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\TnW-fj.wav id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\uJGJLL_Kx3MtJ4.m4a id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\xg1VxzzdA.mp3 id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\yHeObV_6Ud6G.pps id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\Aclviho ASldjfl.contact id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\Administrator.contact id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\asdlfk poopvy.contact id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\chucu jadnvk.contact id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\desktop.ini id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\How To Restore Files.txt - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\0q-Q_imoU.swf id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\4JBCyaw.csv id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\7pTl.mkv id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\aTwMt9g.mp4 id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\d-NecsGi8.bmp id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\d_G3ceZPcut.jpg id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\desktop.ini id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\dJjV63BFqSdhoi-qlwb4.swf id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\E1c0EvVSo6.bmp id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Ekrbf PTRlhOI\1W93a.bmp id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Ekrbf PTRlhOI\How To Restore Files.txt - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\fBf0Oz9VQVAQ.png id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\g9OegMPzW9kZL_.mkv id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\How To Restore Files.txt - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\JqFv3gGSzwIUH88WXe.m4a id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\KN__ldK9BzJbp.swf id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\lMz_LTptxP.pptx id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\m6vXf5ro7c02MA17KNj.png id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\MisCVZb4-.avi id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\mRSY.bmp id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\mtAEz8sW0z74.mp4 id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\n_6ArotS1kRdXv.bmp id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\NKOzGRkpkR3YahGa.avi id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\NL5p.flv id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\NlZFxMAHl.wav id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\0cdYs09W.xlsx id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\5M5 seT-5vd_voX\33UdZO u-6J7rJrw.pptx id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\5M5 seT-5vd_voX\3giUFeu.csv id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\5M5 seT-5vd_voX\aYtHQeH.rtf id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\5M5 seT-5vd_voX\d-65AiIcrHa.docx id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\5M5 seT-5vd_voX\drbC7FYWGRTf41U.odt id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\5M5 seT-5vd_voX\e0CFMAdmU03fxj-.odp id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\5M5 seT-5vd_voX\How To Restore Files.txt - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\69q9P8O1O.docx id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\7dgl8s-3Gjx7.pptx id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\desktop.ini id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\djWv5qVlO-f36Hg32j.pptx id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\How To Restore Files.txt - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Downloads\desktop.ini id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Downloads\How To Restore Files.txt - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\desktop.ini id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\How To Restore Files.txt - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Links\desktop.ini id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Links\How To Restore Files.txt - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Links\Suggested Sites.url id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Links\Web Slice Gallery.url id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\How To Restore Files.txt - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\IE Add-on site.url id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\IE site on Microsoft.com.url id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft At Home.url id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft At Work.url id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft Store.url id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\How To Restore Files.txt - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Autos.url id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Entertainment.url id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Money.url id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Sports.url id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN.url id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSNBC News.url id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Get Windows Live.url id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\How To Restore Files.txt - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Windows Live Gallery.url id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Windows Live Mail.url id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Windows Live Spaces.url id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\How To Restore Files.txt - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Links\desktop.ini id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Links\Desktop.lnk id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Links\Downloads.lnk id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Links\How To Restore Files.txt - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Links\RecentPlaces.lnk id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\8oa0-m3WJaKwnSuLh9e\0TuiOM62.m4a id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\8oa0-m3WJaKwnSuLh9e\4t-7-GHSbfJZ.wav id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\8oa0-m3WJaKwnSuLh9e\6 6JppDDb.m4a id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\8oa0-m3WJaKwnSuLh9e\90gCcG7fd.mp3 id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\8oa0-m3WJaKwnSuLh9e\9Q08f8qI8-EUS1ATwKx.mp3 id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\8oa0-m3WJaKwnSuLh9e\g6X_J7o YDKthVPeAz10\How To Restore Files.txt - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\8oa0-m3WJaKwnSuLh9e\g6X_J7o YDKthVPeAz10\Ky4nV51oSl2.wav id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\8oa0-m3WJaKwnSuLh9e\How To Restore Files.txt - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\8oa0-m3WJaKwnSuLh9e\iJ-ZpQPb5YO5-LGM1KVt.m4a id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\8oa0-m3WJaKwnSuLh9e\kW7zlhMdpM8TV\bJvTdW4mA2Z4wQ.m4a id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\8oa0-m3WJaKwnSuLh9e\kW7zlhMdpM8TV\How To Restore Files.txt - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\8oa0-m3WJaKwnSuLh9e\Ls0PdHw.mp3 id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\BBn5CvTVgKWX.wav id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\desktop.ini id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\ET-7EbrfGtKuwqVif3Bz.m4a id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\GcQTiaw8mWqp.mp3 id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\HhuwU2FyuyIkneVE0.m4a id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\How To Restore Files.txt - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\Ja5mOI9ZMBy.m4a id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\KQeyWfmit_woScYM.mp3 id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\kTM8.mp3 id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\vlkjgqIMwZdhJeRkz.mp3 id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\WOUo-AhtDHZS.mp3 id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\YYxxAR3wBsO-qZ5.wav id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\17OCGHFRMI5H.jpg id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\3_jeQviZoYNlnOtMBcq.png id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\6wzmOUQs0Tg8egP.jpg id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\82U1GLPSN4SRNIud.gif id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\9NWJiKv80-C.jpg id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\_Xpe4np2fCU7yRHo Xj.png id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\AagfwO5FfrKxIJ.gif id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\be8uU4s7v.bmp id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\bVC-tf9cuKZd9WIKBbf.gif id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\BXRrb4wqQer.jpg id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\c1M5lwW.bmp id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\cQRffh50TJ.png id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\desktop.ini id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\DuvSsdgB.png id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\ghoVSrE2rI.png id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\How To Restore Files.txt - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\iAeOeT.jpg id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\KU8coeDggn.gif id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\Lhdb7FgPQ1J3_Q8MQ.jpg id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\M3H2AMCOsHfNXWLKK.png id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\mkItPg.bmp id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\mLz5aTSV45LFpR.jpg id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\mqSXx4krgCAtBWFKak6.gif id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\N3cQX8Etk.bmp id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\NqV8Oj332_g4dk.gif id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\Qhdj.gif id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\QkQ63xnrFn3yf00M- H.gif id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\Ssj2-RG.gif id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\usLic1N81-rLloJD.gif id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\vs9s rE86URZWip2n.png id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\W1S7Fs61QLru.gif id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\w2-6Kr.gif id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\zCfM_ObF5iT.gif id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\zUMBWC.png id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\ZxDAg1y5.png id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Saved Games\desktop.ini id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Saved Games\How To Restore Files.txt - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Searches\desktop.ini id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Searches\Everywhere.search-ms - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Searches\Everywhere.search-ms id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Searches\How To Restore Files.txt - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Searches\Indexed Locations.search-ms - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Searches\Indexed Locations.search-ms id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\1 82DV\8xX2fIJi.swf id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\1 82DV\ArpKK-QGNbVoL.flv id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\1 82DV\CouoxFa1.flv id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\1 82DV\g05j9Qz\7-2tJN OYWR8M0.flv id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\1 82DV\g05j9Qz\How To Restore Files.txt - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\1 82DV\g05j9Qz\TIi8YPbDlaOLAKiDaS\2UPKA7hyi.flv id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\1 82DV\g05j9Qz\TIi8YPbDlaOLAKiDaS\7_1TF.avi id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\1 82DV\g05j9Qz\TIi8YPbDlaOLAKiDaS\CrdUTJLjqC0FOs7WZSy\How To Restore Files.txt - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\1 82DV\g05j9Qz\TIi8YPbDlaOLAKiDaS\How To Restore Files.txt - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\1 82DV\g05j9Qz\TIi8YPbDlaOLAKiDaS\IFs 473n3ew8.flv id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\1 82DV\g05j9Qz\TIi8YPbDlaOLAKiDaS\PM9iKKYIkn9z1tAP9I.swf id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\1 82DV\g05j9Qz\tuZYcwv.mp4 id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\1 82DV\How To Restore Files.txt - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\1 82DV\lp0OA0hCWhhS.mp4 id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\6SgVBsYZdT.swf id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\BDLjWOroke8o.swf id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\desktop.ini id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\How To Restore Files.txt - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\hUrKRx28Hz-Nx\How To Restore Files.txt - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\hUrKRx28Hz-Nx\IEaKhwDUaCNJ5.mkv id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\hUrKRx28Hz-Nx\lMHvIe3HLUK9sBCYE5a.swf id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\hUrKRx28Hz-Nx\Tly1NB.mkv id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\ISzELKWmrU6cLqu\82NPkSzIwNQa.mp4 id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\ISzELKWmrU6cLqu\fWCi8GqHv.flv id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\ISzELKWmrU6cLqu\How To Restore Files.txt - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\ISzELKWmrU6cLqu\mXRNnT5\1805vjPgt2k9.mp4 id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\ISzELKWmrU6cLqu\mXRNnT5\How To Restore Files.txt - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\ISzELKWmrU6cLqu\uvT3U1eLcUuXN33LX1.flv id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\Z9nkSGY0laIlN\8YBa.mkv id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\Z9nkSGY0laIlN\bc3GSd9GTrIuC8yT.avi id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\Z9nkSGY0laIlN\How To Restore Files.txt - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\Z9nkSGY0laIlN\JwY69bt7Heb.flv id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\Z9nkSGY0laIlN\wP80jSXk-sTG.mkv id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\zkHjeCw.swf id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\All Users\Microsoft Help\How To Restore Files.txt - Access
\\?\C:\Users\All Users\Microsoft Help\MS.EXCEL.14.1033.hxn id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\All Users\Microsoft\Crypto\RSA\S-1-5-18\6d14e4b1d8ca773bab785d1be032546e_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\How To Restore Files.txt - Access
\\?\C:\Users\All Users\Microsoft\IdentityCRL\ppcrlconfig.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\All Users\Microsoft\MF\Active.GRL id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\All Users\Microsoft\OFFICE\DocumentRepository.ico id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\All Users\Microsoft\RAC\PublishedData\RacWmiDatabase.sdf id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\All Users\Microsoft\RAC\StateData\RacDatabase.sdf id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\All Users\Microsoft\RAC\Temp\sql65A4.tmp id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\All Users\Mozilla\logs\maintenanceservice-install.log id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\All Users\Package Cache\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\packages\Patch\x64\How To Restore Files.txt - Access
\\?\C:\Users\All Users\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\How To Restore Files.txt - Access
\\?\C:\Users\All Users\Package Cache\{3c3aafc8-d898-43ec-998f-965ffdae065a}\How To Restore Files.txt - Access
\\?\C:\Users\All Users\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\How To Restore Files.txt - Access
\\?\C:\Users\All Users\Package Cache\{e52a6842-b0ac-476e-b48f-378a97a67346}\How To Restore Files.txt - Access
\\?\C:\Users\All Users\Package Cache\{f325f05b-f963-4640-a43b-c8a494cdda0f}\How To Restore Files.txt - Access
\\?\C:\Users\All Users\Sun\Java\Java Update\jaureglist.xml id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\Default\Contacts\How To Restore Files.txt - Access
\\?\C:\Users\Default\Desktop\desktop.ini id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\Default\Desktop\How To Restore Files.txt - Access
\\?\C:\Users\Default\Documents\desktop.ini id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\Default\Documents\How To Restore Files.txt - Access
\\?\C:\Users\Default\Downloads\desktop.ini id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\Default\Downloads\How To Restore Files.txt - Access
\\?\C:\Users\Default\Favorites\desktop.ini id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\Default\Favorites\How To Restore Files.txt - Access
\\?\C:\Users\Default\Favorites\Links\How To Restore Files.txt - Access
\\?\C:\Users\Default\How To Restore Files.txt - Access
\\?\C:\Users\Default\Links\desktop.ini id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\Default\Links\Desktop.lnk id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\Default\Links\How To Restore Files.txt - Access
\\?\C:\Users\Default\Music\desktop.ini id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\Default\Music\How To Restore Files.txt - Access
\\?\C:\Users\desktop.ini id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\How To Restore Files.txt - Access
\\?\C:\Users\Public\desktop.ini id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\Public\Desktop\Adobe Reader X.lnk id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\Public\Desktop\desktop.ini id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\Public\Desktop\Google Chrome.lnk id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\Public\Desktop\How To Restore Files.txt - Access
\\?\C:\Users\Public\Desktop\Mozilla Firefox.lnk id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\Public\Documents\desktop.ini id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\Public\Documents\How To Restore Files.txt - Access
\\?\C:\Users\Public\Downloads\desktop.ini id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\Public\Downloads\How To Restore Files.txt - Access
\\?\C:\Users\Public\How To Restore Files.txt - Access
\\?\C:\Users\Public\Libraries\desktop.ini id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\Public\Libraries\How To Restore Files.txt - Access
\\?\C:\Users\Public\Libraries\RecordedTV.library-ms id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\Public\Music\desktop.ini id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\Public\Music\How To Restore Files.txt - Access
\\?\C:\Users\Public\Music\Sample Music\desktop.ini id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\Public\Music\Sample Music\How To Restore Files.txt - Access
\\?\C:\Users\Public\Pictures\desktop.ini id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\Public\Pictures\How To Restore Files.txt - Access
\\?\C:\Users\Public\Pictures\Sample Pictures\How To Restore Files.txt - Access
\\?\C:\Users\Public\Recorded TV\desktop.ini id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\Public\Recorded TV\How To Restore Files.txt - Access
\\?\C:\Users\Public\Recorded TV\Sample Media\desktop.ini id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\Public\Recorded TV\Sample Media\How To Restore Files.txt - Access
\\?\C:\Users\Public\Videos\desktop.ini id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\Public\Videos\How To Restore Files.txt - Access
\\?\C:\Users\Public\Videos\Sample Videos\desktop.ini id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\Public\Videos\Sample Videos\How To Restore Files.txt - Access
\\?\C:\$Recycle.Bin\S-1-5-21-3388679973-3930757225-3770151564-1000\desktop.ini - Access
\\?\C:\$Recycle.Bin\S-1-5-21-3388679973-3930757225-3770151564-1000\desktop.ini id-bry0hIIfVldG0S8v.BDKR MD5: fbe94016941560ea4cfc8bd43d61f9e6
SHA1: 60a65e6535b2cbd123801ba7478add28bd573667
SHA256: 83ca2fe67add25d9313327f22289e4dd2ff2bd361cf18605ea39928111099a10
SSDeep: 24:A0zOjR14uHUpx98MAyt7A9KMYVP3NY3z3m8MGQ2bkRyIa58rlzgBbKW5WcGII:A0zOjRy3pv8eq4YJI+8rlf4I
ImpHash: None 		Access, Write Created File
\\?\C:\$Recycle.Bin\S-1-5-21-3388679973-3930757225-3770151564-1000\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Boot\BCD - Access
\\?\C:\Boot\BCD id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Boot\BCD.LOG - Access
\\?\C:\Boot\BCD.LOG id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Boot\BOOTSTAT.DAT - Access
\\?\C:\Boot\BOOTSTAT.DAT id-bry0hIIfVldG0S8v.BDKR MD5: 72d52273c11706dcfe5c310a76fcd056
SHA1: a4733a9db918a60ce85f199669c70840b61ee721
SHA256: 5c66aeedcb39d381dc1211890c5d7df121827567e00400a4cf8483f05a6e77ba
SSDeep: 1536:k6le6/v66n+oNEV7QiUXCsm40vjRUTUF8rnOIHQSGz:fe6H66fNhDsJrRoUarnO7z
ImpHash: None 		Access, Write Created File
\\?\C:\Boot\cs-CZ\bootmgr.exe.mui - Access
\\?\C:\Boot\cs-CZ\bootmgr.exe.mui id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Boot\cs-CZ\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Boot\da-DK\bootmgr.exe.mui - Access
\\?\C:\Boot\da-DK\bootmgr.exe.mui id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Boot\da-DK\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Boot\de-DE\bootmgr.exe.mui - Access
\\?\C:\Boot\de-DE\bootmgr.exe.mui id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Boot\de-DE\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Boot\el-GR\bootmgr.exe.mui - Access
\\?\C:\Boot\el-GR\bootmgr.exe.mui id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Boot\el-GR\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Boot\en-US\bootmgr.exe.mui - Access
\\?\C:\Boot\en-US\bootmgr.exe.mui id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Boot\en-US\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access Created File
\\?\C:\Boot\en-US\memtest.exe.mui - Access
\\?\C:\Boot\en-US\memtest.exe.mui id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Boot\es-ES\bootmgr.exe.mui - Access
\\?\C:\Boot\es-ES\bootmgr.exe.mui id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Boot\es-ES\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Boot\fi-FI\bootmgr.exe.mui - Access
\\?\C:\Boot\fi-FI\bootmgr.exe.mui id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Boot\fi-FI\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Boot\Fonts\chs_boot.ttf - Access
\\?\C:\Boot\Fonts\chs_boot.ttf id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Boot\Fonts\cht_boot.ttf - Access
\\?\C:\Boot\Fonts\cht_boot.ttf id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Boot\Fonts\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Boot\Fonts\jpn_boot.ttf - Access
\\?\C:\Boot\Fonts\jpn_boot.ttf id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Boot\Fonts\kor_boot.ttf - Access
\\?\C:\Boot\Fonts\kor_boot.ttf id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Boot\Fonts\wgl4_boot.ttf - Access
\\?\C:\Boot\Fonts\wgl4_boot.ttf id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Boot\fr-FR\bootmgr.exe.mui - Access
\\?\C:\Boot\fr-FR\bootmgr.exe.mui id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Boot\fr-FR\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Boot\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Boot\hu-HU\bootmgr.exe.mui - Access
\\?\C:\Boot\hu-HU\bootmgr.exe.mui id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Boot\hu-HU\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Boot\it-IT\bootmgr.exe.mui - Access
\\?\C:\Boot\it-IT\bootmgr.exe.mui id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Boot\it-IT\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Boot\ja-JP\bootmgr.exe.mui - Access
\\?\C:\Boot\ja-JP\bootmgr.exe.mui id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Boot\ja-JP\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Boot\ko-KR\bootmgr.exe.mui - Access
\\?\C:\Boot\ko-KR\bootmgr.exe.mui id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Boot\ko-KR\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Boot\memtest.exe - Access
\\?\C:\Boot\memtest.exe id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Boot\nb-NO\bootmgr.exe.mui - Access
\\?\C:\Boot\nb-NO\bootmgr.exe.mui id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Boot\nb-NO\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Boot\nl-NL\bootmgr.exe.mui - Access
\\?\C:\Boot\nl-NL\bootmgr.exe.mui id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Boot\nl-NL\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Boot\pl-PL\bootmgr.exe.mui - Access
\\?\C:\Boot\pl-PL\bootmgr.exe.mui id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Boot\pl-PL\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Boot\pt-BR\bootmgr.exe.mui - Access
\\?\C:\Boot\pt-BR\bootmgr.exe.mui id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Boot\pt-BR\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Boot\pt-PT\bootmgr.exe.mui - Access
\\?\C:\Boot\pt-PT\bootmgr.exe.mui id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Boot\pt-PT\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Boot\ru-RU\bootmgr.exe.mui - Access
\\?\C:\Boot\ru-RU\bootmgr.exe.mui id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Boot\ru-RU\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Boot\sv-SE\bootmgr.exe.mui - Access
\\?\C:\Boot\sv-SE\bootmgr.exe.mui id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Boot\sv-SE\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Boot\tr-TR\bootmgr.exe.mui - Access
\\?\C:\Boot\tr-TR\bootmgr.exe.mui id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Boot\tr-TR\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Boot\zh-CN\bootmgr.exe.mui - Access
\\?\C:\Boot\zh-CN\bootmgr.exe.mui id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Boot\zh-CN\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Boot\zh-HK\bootmgr.exe.mui - Access
\\?\C:\Boot\zh-HK\bootmgr.exe.mui id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Boot\zh-HK\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Boot\zh-TW\bootmgr.exe.mui - Access
\\?\C:\Boot\zh-TW\bootmgr.exe.mui id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Boot\zh-TW\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\bootmgr - Access
\\?\C:\bootmgr id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\BOOTSECT.BAK - Access
\\?\C:\BOOTSECT.BAK id-bry0hIIfVldG0S8v.BDKR MD5: e559c8f71c2c05152bdee0b19369a4ef
SHA1: 495aa1177edb89d2587f8ebe4b5ac7f882f672e9
SHA256: 143fa2c75ce4c21254f9c497658968abf051de946d20081e9b9fd1a8952ce164
SSDeep: 192:KU7zRENZwrlAv4L6mugT/72rE5qXY17o3ZdvPnLWSY+WJdoBQKCBQ22rGCC:KU7SNmr24t3T/72rrXY1YvPnCgNNgFAi
ImpHash: None 		Access, Write Created File
\\?\C:\hiberfil.sys - Access
\\?\C:\hiberfil.sys id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab - Access
\\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access Created File
\\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.msi - Access
\\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.msi id-bry0hIIfVldG0S8v.BDKR MD5: 177037e5b5edbbc61857d1a199559bd7
SHA1: 933d106284abdee55cf049875ca14036f9a493e2
SHA256: 8485cd217d485fecab34bb3eed0deaeffda4e11ac9142d7c421ad16982d4eb18
SSDeep: 49152:uJVyJ8YiSnIVsPY76bfgsrGX5dTex4S120ytJyha16CZtW:iAnpqsPTme1oA
ImpHash: None 		Access, Write Created File
\\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.xml id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PptLR.cab id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.msi - Access
\\?\C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.msi id-bry0hIIfVldG0S8v.BDKR MD5: 57f2562f705f46d61d2489aa0ec06a3b
SHA1: f1f8e9c802f031f01a3e0ec232aba9a346760157
SHA256: 405f8f6f48dacf4ab2b95acb4addb0fd8e3c7731032c4098b9da00e08d0e106d
SSDeep: 49152:NRd20FpgIGemqzyubbR1dTex4S120ytJyhaLz6CCHmG:/d28iYbRy1oLO
ImpHash: None 		Access, Write Created File
\\?\C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.xml - Access
\\?\C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.xml id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PubLR.cab id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlkLR.cab - Access
\\?\C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlkLR.cab id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access Created File
\\?\C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\Setup.xml - Access
\\?\C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\Setup.xml id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\WordLR.cab id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access Created File
\\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.cab - Access
\\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.en\Proof.cab id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.cab - Access
\\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.es\Proof.cab id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.cab - Access
\\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proof.fr\Proof.cab id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proofing.msi - Access
\\?\C:\MSOCache\All Users\{90140000-002C-0409-1000-0000000FF1CE}-C\Proofing.msi id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Office32MUI.msi - Access
\\?\C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Office32MUI.msi id-bry0hIIfVldG0S8v.BDKR MD5: 83a082dd0b105678128646cb7e7d98cc
SHA1: 6667e75ca35cd6587208be41cf314b3f08340d1b
SHA256: 1989a7f0e5a04e9f3eff84b5e73eb3ad5bea3c75d98d51026eed4d9f1d8ed5b4
SSDeep: 24576:Xnsf/iX55QGz2gQZDBoRIUzwousRr3sLgV3NQU:XsfaXvQnNYwou8808U
ImpHash: None 		Access, Write Created File
\\?\C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Office32MUI.xml - Access
\\?\C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\Office32MUI.xml id-bry0hIIfVldG0S8v.BDKR MD5: 6da763db0d8ad5596a8147589428d4a0
SHA1: d91d675d12acd916678eb32664cfb4bd0f06a729
SHA256: 18e0c5d4e438c00092ebe0131f6f79140d7828b20ea85d707a513e0988bf2077
SSDeep: 48:BHgWqXy/7K4dmuXpCNmkz8Z3Q148xEzdq4YJI+8rlf4I:Zf/m4FgEkIxQYzYLJrI
ImpHash: None 		Access, Write Created File
\\?\C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\OWOW32LR.cab - Access
\\?\C:\MSOCache\All Users\{90140000-0043-0409-1000-0000000FF1CE}-C\OWOW32LR.cab id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfLR.cab - Access
\\?\C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfLR.cab id-bry0hIIfVldG0S8v.BDKR MD5: 82bd51c19cb1bc2d4153de29983b3201
SHA1: 16307b90c068549b34e08704fd1c97c0b8dec41e
SHA256: b03cb9c6e331679105d5bd69375a7fc8edd74279e20d98825e7dc6024f5832cf
SSDeep: 196608:cn8E+H9F7/iHXDI2CPKBUq6qMuGm9vqrRxoi93nnedBwzSlmKwDhANZbPhn:cn8rdFDX2J5uuGyCEi9uIQmlANRh
ImpHash: None 		Access, Write Created File
\\?\C:\MSOCache\All Users\{90140000-0044-0409-1000-0000000FF1CE}-C\InfoPathMUI.msi id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access Created File
\\?\C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\Setup.xml - Access
\\?\C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\Setup.xml id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\MSOCache\All Users\{90140000-0054-0409-1000-0000000FF1CE}-C\VisioLR.cab id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OneNoteMUI.msi - Access
\\?\C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OneNoteMUI.msi id-bry0hIIfVldG0S8v.BDKR MD5: 691614b3155b3145ceaa44b59480c0de
SHA1: 184ee3db1b48b18bd1439f1476759d6514e14dac
SHA256: 46190c5171e6390a4695112608a1e7673066449f3b2199e33bf315ac28a4aa60
SSDeep: 49152:huZWUQ+pIs4P7SaQ8ndTex4S120ytJyhaK6C3oA:hpUCx7W1oI
ImpHash: None 		Access, Write Created File
\\?\C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OneNoteMUI.xml - Access
\\?\C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OneNoteMUI.xml id-bry0hIIfVldG0S8v.BDKR MD5: b16aa0fd30d6f970c87160fd1e9cdeb8
SHA1: 480e1eedfa7ef69adc680c93304e1310a182a996
SHA256: 41e23418b5aad54459fb2b8594142ac6f8b933f39a6a0d432d67ccb2f87dca70
SSDeep: 48:pWejJ/TYRXVYsB/BWpj94Wr2fGVYDwJ2i9XlI5Vdq4YJI+8rlf4I:rjJ/ElKsB/BW6OVt2z5eLJrI
ImpHash: None 		Access, Write Created File
\\?\C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OnoteLR.cab - Access
\\?\C:\MSOCache\All Users\{90140000-00A1-0409-1000-0000000FF1CE}-C\OnoteLR.cab id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjectMUI.msi - Access
\\?\C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjectMUI.msi id-bry0hIIfVldG0S8v.BDKR MD5: 39a5b96e63ef539ebc2d35afdbf2dcda
SHA1: e7757486bfcc1f0481c851b0cf5f59d21c1f4aea
SHA256: c31a5d3f1aaf8363899a9752f9e4142b6822a0fa88b520c543612863552acc12
SSDeep: 49152:CoDdzl/+RrzFRi6VFhKvIIQ5HRYnSt20yeJji34mElfaC:N5zlGRrzFRimFhSIkqA47
ImpHash: None 		Access, Write Created File
\\?\C:\MSOCache\All Users\{90140000-00B4-0409-1000-0000000FF1CE}-C\ProjectMUI.xml id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\GrooveLR.cab - Access
\\?\C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\GrooveLR.cab id-bry0hIIfVldG0S8v.BDKR MD5: 54f2948fa040ad05b6b004f9f5a2b575
SHA1: 51478d55d1e114e938d5ad40560181fb7eeaf0c9
SHA256: cb713e40d1d0600b76851aa023e28ac9cb5c6fca3f21e162ad0a2268d274e5d9
SSDeep: 98304:58ZLnjNjye38Cq3Q3o4go90+8DInrjxrXg5l3P1LH:GZLjNjyQ8Cq3Q36/+8DOx76/1LH
ImpHash: None 		Access, Write Created File
\\?\C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\GrooveMUI.msi id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\MSOCache\All Users\{90140000-00BA-0409-1000-0000000FF1CE}-C\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access Created File
\\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\1033\dwintl20.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\1033\How To Restore Files.txt - Access, Write
\\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\branding.xml - Access
\\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\branding.xml id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\MSOCache\All Users\{90140000-0115-0409-1000-0000000FF1CE}-C\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access Created File
\\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\AccessMUI.msi id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\Access.en-us\How To Restore Files.txt - Access
\\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\AccessMUISet.msi - Access
\\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\AccessMUISet.msi id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\MSOCache\All Users\{90140000-0117-0409-1000-0000000FF1CE}-C\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access Created File
\\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access Created File
\\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Office32WW.msi - Access
\\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Office32WW.msi id-bry0hIIfVldG0S8v.BDKR MD5: 31cc57358649d34d7e6d9d150b2efbe8
SHA1: 8236fe81b5394e995404bea12dd90669a37b8870
SHA256: 37dc8c0c7dee19670a6aab4f64c4f8de979c22932b55219fc124dab1f22ca435
SSDeep: 49152:zmkyGUc0HJCVmVw8yDNEUsAZVbJ80BqEI2SI:KJJc+kV2w8i6UsAZVbJZT
ImpHash: None 		Access, Write Created File
\\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Office32WW.xml - Access
\\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\Office32WW.xml id-bry0hIIfVldG0S8v.BDKR MD5: ec29c5eb6891667052a7e8590d6fc87e
SHA1: c0f89869c5c478be92750ba172465b830391cead
SHA256: e1315aa2ae2b1c3149cb2b622d768e7aae2b609f0c2b7ef20d6ee9de9b6f968a
SSDeep: 96:kyab+OB3oYIwpPtMYkBbtH6kRS8wAAkFoeDjtAnH6+ilLN8kqWm5LJrI:kyabnBQwpKYkPH69ALFH3Wa+ilLWLC
ImpHash: None 		Access, Write Created File
\\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ose.exe - Access
\\?\C:\MSOCache\All Users\{91140000-0011-0000-1000-0000000FF1CE}-C\ose.exe id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Office32WW.msi - Access
\\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Office32WW.msi id-bry0hIIfVldG0S8v.BDKR MD5: fc817d46c4afaae5b19f639df294a12a
SHA1: e38cc40647ebfc5ade54da223a1068a419082035
SHA256: b7eebb5e80eda1dd3397c3f808644b501564bff27679722ceb524208ffd863a8
SSDeep: 49152:38j4i+MxuhVLNdQqq4u+aPSHGl0BqEI2Ss:sjhurbQqqN+a6VP
ImpHash: None 		Access, Write Created File
\\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\Office32WW.xml id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\MSOCache\All Users\{91140000-003B-0000-1000-0000000FF1CE}-C\ose.exe id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access Created File
\\?\C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Office32WW.msi - Access
\\?\C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Office32WW.msi id-bry0hIIfVldG0S8v.BDKR MD5: d1ef3210d6931db061dd5d13b0eec43d
SHA1: b92efd4037b0e30abc0dad6bbe58434c9e17760f
SHA256: dbc442777eeac3bd9d6625dd2b7d1e21933cd8f8c8c2808aeee88c99df3421af
SSDeep: 24576:HthKrn4fli3w3wvDO6F/Ash9can6XAjTy1vBoy5Ry0BqEI2S+o0k4Xqb91:NhKrnOluw3wvKQoOcPJoyO0BqEI2Sr
ImpHash: None 		Access, Write Created File
\\?\C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\Office32WW.xml id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\MSOCache\All Users\{91140000-0057-0000-1000-0000000FF1CE}-C\ose.exe id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\pagefile.sys - Access
\\?\C:\pagefile.sys id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Adobe\Reader 10.0\Benioku.htm - Access
\\?\C:\Program Files (x86)\Adobe\Reader 10.0\Benioku.htm id-bry0hIIfVldG0S8v.BDKR MD5: 511fe10185620f8c814ab724e9b6570d
SHA1: 252b3ff3dffd861d0f06065c53049da0e04dceab
SHA256: 68f38e3ac6ac6c96f78a6c5e647aff8506faf1240fb2af53833a8f6ab8613563
SSDeep: 384:UifYJsfCxCxqJFniH/2JJPOQ0EUlxyvFwvGRG5AiMPTUdlK9pgl97e0uTRuQCUC:URJsfJgFnnJ88wv/ruIRe0uTgb
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files (x86)\Adobe\Reader 10.0\Berime.htm - Access
\\?\C:\Program Files (x86)\Adobe\Reader 10.0\Berime.htm id-bry0hIIfVldG0S8v.BDKR MD5: f4717e803245f8cf3e84269e172d35e9
SHA1: 7455a943a0b6fa8cfce852a58d98b134edb1ad97
SHA256: 7774c1c7e68be740ecdb40a480ca33d030a3f686a5cc88ec0a02f2ee630dab41
SSDeep: 384:/G04TEJHrRoSUH4Dusbnj9tI0aTS20EIiLgHadd6C:/JUC+SNL6gHeD
ImpHash: None 		Access, Write Modified File
\\?\C:\Program Files (x86)\Adobe\Reader 10.0\Esl\AiodLite.dll - Access
\\?\C:\Program Files (x86)\Adobe\Reader 10.0\Esl\AiodLite.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Adobe\Reader 10.0\Esl\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files (x86)\Adobe\Reader 10.0\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files (x86)\Adobe\Reader 10.0\IrakHau.htm - Access
\\?\C:\Program Files (x86)\Adobe\Reader 10.0\IrakHau.htm id-bry0hIIfVldG0S8v.BDKR MD5: eb73bb3968e73b83a7c578433aea7442
SHA1: 5c661c737ad8f50d770acb947dcb90a2836bd93e
SHA256: 207f1d92025943a30a44180117edae22bbe81a5dea8fc771b7181fd5b375f620
SSDeep: 384:gFAYLZ32R0bNRq0+uNXAvSC26Wy7h3dv1fkoTtkZFu7CbEC:gFxBNRrNBAFB7FdtaFu7m
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files (x86)\Adobe\Reader 10.0\Leame.htm - Access
\\?\C:\Program Files (x86)\Adobe\Reader 10.0\Leame.htm id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Adobe\Reader 10.0\LeesMij.htm id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroPDF.CAT - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroPDF.CAT id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroPDF.CHS - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroPDF.CHS id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroPDF.CHT - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroPDF.CHT id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroPDF.CZE - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroPDF.CZE id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroPDF.DAN - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroPDF.DAN id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroPDF.DEU - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroPDF.DEU id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroPDF.dll - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroPDF.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroPDF.ESP - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroPDF.ESP id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroPDF.EUQ - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroPDF.EUQ id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroPDF.FRA - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroPDF.FRA id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroPDF.HRV - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroPDF.HRV id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroPDF.HUN - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroPDF.HUN id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroPDF.ITA - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroPDF.ITA id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroPDF.JPN - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroPDF.JPN id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroPDF.KOR - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroPDF.KOR id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroPDF.NLD - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroPDF.NLD id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroPDF.NOR - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroPDF.NOR id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroPDF.POL - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroPDF.POL id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroPDF.PTB - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroPDF.PTB id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroPDF.RUM - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroPDF.RUM id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroPDF.RUS - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroPDF.RUS id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroPDF.SKY - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroPDF.SKY id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroPDF.SLV - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroPDF.SLV id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroPDF.SUO - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroPDF.SUO id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroPDF.SVE - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroPDF.SVE id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroPDF.TUR - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroPDF.TUR id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroPDF.UKR - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroPDF.UKR id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\PDFShell.CAT - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\PDFShell.CAT id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\PDFShell.CHS - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\PDFShell.CHS id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\PDFShell.CHT - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\PDFShell.CHT id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\PDFShell.CZE - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\PDFShell.CZE id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\PDFShell.DAN - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\PDFShell.DAN id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\PDFShell.DEU - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\PDFShell.DEU id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\pdfshell.dll - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\pdfshell.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\PDFShell.ESP - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\PDFShell.ESP id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\PDFShell.EUQ - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\PDFShell.EUQ id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\PDFShell.FRA - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\PDFShell.FRA id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\PDFShell.HRV - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\PDFShell.HRV id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\PDFShell.HUN - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\PDFShell.HUN id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\PDFShell.ITA - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\PDFShell.ITA id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\PDFShell.JPN - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\PDFShell.JPN id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\PDFShell.KOR - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\PDFShell.KOR id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\PDFShell.NLD - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\PDFShell.NLD id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\PDFShell.NOR - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\PDFShell.NOR id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\PDFShell.POL - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\PDFShell.POL id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AcrobatUpdater.exe - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AcrobatUpdater.exe id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files (x86)\Common Files\Adobe\HelpCfg\ca_ES\How To Restore Files.txt - Access, Write
\\?\C:\Program Files (x86)\Common Files\Adobe\HelpCfg\ca_ES\Reader_10.0.helpcfg id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\HelpCfg\cs_CZ\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\HelpCfg\da_DK\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\HelpCfg\de_DE\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\HelpCfg\es_ES\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\HelpCfg\eu_ES\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\HelpCfg\fi_FI\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\HelpCfg\fr_FR\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\HelpCfg\hr_HR\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\HelpCfg\hu_HU\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\HelpCfg\it_IT\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\HelpCfg\ja_JP\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\HelpCfg\ko_KR\How To Restore Files.txt - Access, Write
\\?\C:\Program Files (x86)\Common Files\Adobe\HelpCfg\ko_KR\Reader_10.0.helpcfg id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\Program Files (x86)\Common Files\Adobe\HelpCfg\nb_NO\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\HelpCfg\nl_NL\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\HelpCfg\pl_PL\How To Restore Files.txt - Access, Write
\\?\C:\Program Files (x86)\Common Files\Adobe\HelpCfg\pt_BR\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\HelpCfg\ro_RO\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\HelpCfg\ru_RU\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\HelpCfg\sk_SK\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\HelpCfg\sl_SI\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\HelpCfg\sv_SE\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\HelpCfg\tr_TR\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\HelpCfg\uk_UA\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\HelpCfg\zh_CN\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\Adobe\HelpCfg\zh_TW\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\constitute_appropriate_sorry.exe - Access
\\?\C:\Program Files (x86)\Common Files\constitute_appropriate_sorry.exe id-bry0hIIfVldG0S8v.BDKR MD5: 801fc65b70eff4b604eb76704b16f823
SHA1: 4433ba91617a620913054b2f6634d2e7b4b05eba
SHA256: de142cbab86ef799d82abe9b7053e068f3f383276b6f0d6c1d570bddfc1dfc58
SSDeep: 1536:G1qk/yJ8saiTX2AYuq2ROKolFLK/mskcmDQ5GCWwMkQvWiXrEWx4:KqkqJ8YbDrwLxsYQA7vWiXg84
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files (x86)\Common Files\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files (x86)\Common Files\Java\Java Update\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files (x86)\Common Files\Java\Java Update\jaucheck.exe - Access
\\?\C:\Program Files (x86)\Common Files\Java\Java Update\jaucheck.exe id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\DAO\dao360.dll - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\DAO\dao360.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\DAO\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access Created File
\\?\C:\Program Files (x86)\Common Files\microsoft shared\Help\1028\How To Restore Files.txt - Access, Write
\\?\C:\Program Files (x86)\Common Files\microsoft shared\Help\1028\hxdsui.dll id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\Program Files (x86)\Common Files\microsoft shared\Help\1031\How To Restore Files.txt - Access, Write
\\?\C:\Program Files (x86)\Common Files\microsoft shared\Help\1031\hxdsui.dll id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\Program Files (x86)\Common Files\microsoft shared\Help\1033\How To Restore Files.txt - Access, Write
\\?\C:\Program Files (x86)\Common Files\microsoft shared\Help\1033\hxdsui.dll id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\Program Files (x86)\Common Files\microsoft shared\Help\1036\How To Restore Files.txt - Access, Write
\\?\C:\Program Files (x86)\Common Files\microsoft shared\Help\1036\hxdsui.dll id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\Program Files (x86)\Common Files\microsoft shared\Help\1040\How To Restore Files.txt - Access, Write
\\?\C:\Program Files (x86)\Common Files\microsoft shared\Help\1040\hxdsui.dll id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\Program Files (x86)\Common Files\microsoft shared\Help\1041\How To Restore Files.txt - Access, Write
\\?\C:\Program Files (x86)\Common Files\microsoft shared\Help\1041\hxdsui.dll id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\Program Files (x86)\Common Files\microsoft shared\Help\1042\How To Restore Files.txt - Access, Write
\\?\C:\Program Files (x86)\Common Files\microsoft shared\Help\1042\hxdsui.dll id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\Program Files (x86)\Common Files\microsoft shared\Help\1046\How To Restore Files.txt - Access, Write
\\?\C:\Program Files (x86)\Common Files\microsoft shared\Help\1046\hxdsui.dll id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\Program Files (x86)\Common Files\microsoft shared\Help\1049\How To Restore Files.txt - Access, Write
\\?\C:\Program Files (x86)\Common Files\microsoft shared\Help\1049\hxdsui.dll id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\Program Files (x86)\Common Files\microsoft shared\Help\2052\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\Help\2052\hxdsui.dll id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\Program Files (x86)\Common Files\microsoft shared\Help\3082\How To Restore Files.txt - Access, Write
\\?\C:\Program Files (x86)\Common Files\microsoft shared\Help\3082\hxdsui.dll id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\Program Files (x86)\Common Files\microsoft shared\Help\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files (x86)\Common Files\microsoft shared\Help\Hx.HxC - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\Help\Hx.HxC id-bry0hIIfVldG0S8v.BDKR MD5: a2f8235d04c7216134f6dff07715bc88
SHA1: f99a0b9fbf52b9ee8bdab76e858768aa3df7d626
SHA256: 2c67b279cecdfa68d078d15ebfa3e975a4a80fcbf3f2ce4f54640b15f1fff1d7
SSDeep: 48:Olot2V4DXcn7CNLsqyq90fq4YJI+8rlf4I:Olong74LLJrI
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files (x86)\Common Files\microsoft shared\Help\Hx.HxT - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\Help\Hx.HxT id-bry0hIIfVldG0S8v.BDKR MD5: 4ce68fe292679057fa43c91f242e0a13
SHA1: fdcdace9ccfce1737e425bc60b205aa5fe5ee34c
SHA256: da1019cafacc914ddfd19301711e909fb155fe3ec0566b13f86f6e401c710c48
SSDeep: 24:08y9Bc3mYC4loxiNQF572GSD0eUA2yt7A9KMYVP3NY3z3m8MGQ2bkRyIa58rlzgi:08y9MIuQF5KEPAVq4YJI+8rlf4I
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files (x86)\Common Files\microsoft shared\Help\HxRuntime.HxS - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\Help\HxRuntime.HxS id-bry0hIIfVldG0S8v.BDKR MD5: 6e6070144d17cd661fe87db7be52fcaf
SHA1: 2a249cbaab039a9e7ff7cbc4639a2b279c4cc196
SHA256: fec627f2a504d66463a0a4338594144857d32c153fe0f2d6ded42048f256cd93
SSDeep: 768:p7eruG+TfFVB2TW3bnmF2mVl/QuDTBhPqS:p737fFPsGmF2mdTBgS
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files (x86)\Common Files\microsoft shared\Help\Keywords.HxK - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\Help\Keywords.HxK id-bry0hIIfVldG0S8v.BDKR MD5: daaf30229d921cf064bc1f90300f22fa
SHA1: 0d87b5772895f5d1203911f26d321e9de4669536
SHA256: 37560690709c794dcc7dab3aa40918ffed68372b7406060b862441a5f7068791
SSDeep: 24:cYlPix/zUfSe602TwoSrhRyt7A9KMYVP3NY3z3m8MGQ2bkRyIa58rlzgBbKW5Wcw:cYlqxrUL6lTUUq4YJI+8rlf4I
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files (x86)\Common Files\microsoft shared\Help\NamedURLs.HxK - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\Help\NamedURLs.HxK id-bry0hIIfVldG0S8v.BDKR MD5: 3549b829c8bf1f1a49c6ca3d17d4ecd6
SHA1: 4110cf5cc87b87a0dc235771bc8e195d15fb0d7f
SHA256: 02cd8fc28de7aac223f0ce95960a36a765a8c54173718a2240d943dc4d28bbdd
SSDeep: 24:Qjkb2Ty9iXyt7A9KMYVP3NY3z3m8MGQ2bkRyIa58rlzgBbKW5WcGII:Uudq4YJI+8rlf4I
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files (x86)\Common Files\microsoft shared\ink\1.0\How To Restore Files.txt - Access, Write
\\?\C:\Program Files (x86)\Common Files\microsoft shared\ink\1.7\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\ink\en-US\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\ink\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\MSEnv\PublicAssemblies\extensibility.dll - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\MSEnv\PublicAssemblies\extensibility.dll id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\Program Files (x86)\Common Files\microsoft shared\MSEnv\PublicAssemblies\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\en-US\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access Created File
\\?\C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\msinfo32.exe - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\msinfo32.exe id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\How To Restore Files.txt - Access, Write
\\?\C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\MSOINTL.DLL id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Csi.dll - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Csi.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access Created File
\\?\C:\Program Files (x86)\Common Files\microsoft shared\Portal\1033\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files (x86)\Common Files\microsoft shared\Portal\1033\PortalConnect.dll - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\Portal\1033\PortalConnect.dll id-bry0hIIfVldG0S8v.BDKR MD5: 40ff810dfbdf4d6f86be16f3151936dc
SHA1: 361e87b764476192d96aa7675748c4378f2bd19e
SHA256: 349ac0c059f40e9162d1d252de60d0fe7abe83daa90491b4841283a0b83d1f0e
SSDeep: 384:topa0EyWloykrk8jGzDR6JTZJAZNxReW2lF7FW7I7XC:pQTjGXYRZJExkJSI7S
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files (x86)\Common Files\microsoft shared\Portal\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access Created File
\\?\C:\Program Files (x86)\Common Files\microsoft shared\Portal\PortalConnectCore.dll - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\Portal\PortalConnectCore.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Bears.htm - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Bears.htm id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Bears.jpg - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Bears.jpg id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini id-bry0hIIfVldG0S8v.BDKR MD5: c491f18baefb4935fe278ffd5137ab2d
SHA1: 17da60d023707647570cb04a9347aabefd851198
SHA256: ee5f1318085bc34e1f3e3f24fc490fc502de8a183fbafc7f37102a0f5197eb1f
SSDeep: 24:d9tVcQ3zt+KjMARhs9nwJwMrdmzsMhVk5/eyt7A9KMYVP3NY3z3m8MGQ2bkRyIaG:tVttMA8WJwiCZhVkRtq4YJI+8rlf4I
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Garden.htm - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Garden.htm id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Garden.jpg - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Garden.jpg id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Green Bubbles.htm - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Green Bubbles.htm id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\Stationery\GreenBubbles.jpg - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\Stationery\GreenBubbles.jpg id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Hand Prints.htm - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Hand Prints.htm id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\Stationery\HandPrints.jpg - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\Stationery\HandPrints.jpg id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\Stationery\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Orange Circles.htm - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Orange Circles.htm id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\Stationery\OrangeCircles.jpg - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\Stationery\OrangeCircles.jpg id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Peacock.htm - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Peacock.htm id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Peacock.jpg - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Peacock.jpg id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Roses.htm - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Roses.htm id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Roses.jpg - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Roses.jpg id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Shades of Blue.htm - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Shades of Blue.htm id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\Wkconv.exe id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA6\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA6\VBE6EXT.OLB - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA6\VBE6EXT.OLB id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\Program Files (x86)\Common Files\microsoft shared\VC\amd64\How To Restore Files.txt - Access, Write
\\?\C:\Program Files (x86)\Common Files\microsoft shared\VC\amd64\msdia80.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\VC\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files (x86)\Common Files\microsoft shared\VC\msdia100.dll - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\VC\msdia100.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\VGX\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files (x86)\Common Files\microsoft shared\VGX\VGX.dll - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\VGX\VGX.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\How To Restore Files.txt - Access, Write
\\?\C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\Microsoft.VisualStudio.Tools.Applications.Blueprints.tlb id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\VSTA\AppInfoDocument\AddIns.store id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\VSTA\AppInfoDocument\How To Restore Files.txt - Access, Write
\\?\C:\Program Files (x86)\Common Files\microsoft shared\VSTA\AppInfoDocument\Microsoft.VisualStudio.Tools.Office.AppInfoDocument\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\AddInSideAdapters\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\AddInViews\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\Contracts\How To Restore Files.txt - Access, Write
\\?\C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\HostSideAdapters\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\PipelineSegments.store id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\1033\How To Restore Files.txt - Access, Write
\\?\C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\1033\VSTOInstallerUI.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\How To Restore Files.txt - Access, Write
\\?\C:\Program Files (x86)\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.config id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\VSTO\ActionsPane3.xsd - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\VSTO\ActionsPane3.xsd id-bry0hIIfVldG0S8v.BDKR MD5: 589befb430425e842d8b18fdeb0424b4
SHA1: f0c4af4627cd8b199ef0ddd8276375adffbdc7a5
SHA256: c45f9a34aa77f288bc5a548b13ed7033b7df32b5c2cd729ca45afe796b16bab5
SSDeep: 24:qMKY3TjcCEqnyt7A9KMYVP3NY3z3m8MGQ2bkRyIa58rlzgBbKW5WcGII:q+39Eq4YJI+8rlf4I
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files (x86)\Common Files\microsoft shared\VSTO\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files (x86)\Common Files\microsoft shared\VSTO\vstoee.dll - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\VSTO\vstoee.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\VSTO\vstoee100.tlb id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\14\BIN\FPSRVUTL.DLL id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\14\BIN\How To Restore Files.txt - Access, Write
\\?\C:\Program Files (x86)\Common Files\regulationspublishers.exe - Access
\\?\C:\Program Files (x86)\Common Files\regulationspublishers.exe id-bry0hIIfVldG0S8v.BDKR MD5: 29d826493bd78082e4cfdd8078227630
SHA1: 4b4bcb7d80517972aed37efae1a2c4584be79172
SHA256: 213ce9d4bb028d2d0b153f304ea0c9a998a6fd6e4291a67250212fca7215217c
SSDeep: 1536:4Ty4bNFU0wivT6lT80pZnF9XKdNHhzerkjjZd45Xhnyg/i:SXb00wi76znzABckpIcKi
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files (x86)\Common Files\Services\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access Created File
\\?\C:\Program Files (x86)\Common Files\Services\verisign.bmp - Access
\\?\C:\Program Files (x86)\Common Files\Services\verisign.bmp id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\TTS20\en-US\enu-dsk\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\TTS20\en-US\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\TTS20\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\TTS20\MSTTSCommon.dll - Access
\\?\C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\TTS20\MSTTSCommon.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\TTS20\MSTTSDecWrp.dll - Access
\\?\C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\TTS20\MSTTSDecWrp.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\TTS20\MSTTSEngine.dll - Access
\\?\C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\TTS20\MSTTSEngine.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\TTS20\MSTTSLoc.dll - Access
\\?\C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\TTS20\MSTTSLoc.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\System\ado\en-US\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\System\ado\How To Restore Files.txt - Access, Write
\\?\C:\Program Files (x86)\Common Files\System\DirectDB.dll - Access
\\?\C:\Program Files (x86)\Common Files\System\DirectDB.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Common Files\System\en-US\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\System\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files (x86)\Common Files\System\msadc\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\System\Ole DB\en-US\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Common Files\System\Ole DB\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\desktop.ini - Access
\\?\C:\Program Files (x86)\desktop.ini id-bry0hIIfVldG0S8v.BDKR MD5: c93b2ec4e64ea5a3730c00a3cf3b4029
SHA1: 4e9995ed5690f4429373b96a211635ff8c6a0b8d
SHA256: 6eacaffd7e15d37f68b7683c09c8fb652f6a47a0c866f0eaab968731e138809a
SSDeep: 24:nx3KsWuCpeR6mfy04vNWK1yt7A9KMYVP3NY3z3m8MGQ2bkRyIa58rlzgBbKW5Wcw:nx9zP9Wj4q4YJI+8rlf4I
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files (x86)\Google\Chrome\Application\58.0.3029.110\58.0.3029.110.manifest - Access
\\?\C:\Program Files (x86)\Google\Chrome\Application\58.0.3029.110\58.0.3029.110.manifest id-bry0hIIfVldG0S8v.BDKR MD5: df620193f5a10255319b622cb7fa0a7e
SHA1: 6ba3131e8a3f4c6d3a706ac529ec1509cd2acf9c
SHA256: b864dc60ce46818e849d55ec785f26dbb0f9721cb6275bf4d6c0a951c72c416f
SSDeep: 24:Sl5YJIhHGSISyt7A9KMYVP3NY3z3m8MGQ2bkRyIa58rlzgBbKW5WcGII:SnLHGxq4YJI+8rlf4I
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files (x86)\Google\Chrome\Application\58.0.3029.110\chrome.dll - Access
\\?\C:\Program Files (x86)\Google\Chrome\Application\58.0.3029.110\chrome.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Google\Chrome\Application\58.0.3029.110\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files (x86)\Google\Chrome\Application\chrome.exe - Access
\\?\C:\Program Files (x86)\Google\Chrome\Application\chrome.exe id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Google\Chrome\Application\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access Created File
\\?\C:\Program Files (x86)\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files (x86)\Internet Explorer\en-US\hmmapi.dll.mui - Access
\\?\C:\Program Files (x86)\Internet Explorer\en-US\hmmapi.dll.mui id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Internet Explorer\en-US\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files (x86)\Internet Explorer\en-US\iedvtool.dll.mui - Access
\\?\C:\Program Files (x86)\Internet Explorer\en-US\iedvtool.dll.mui id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Internet Explorer\en-US\ieinstal.exe.mui - Access
\\?\C:\Program Files (x86)\Internet Explorer\en-US\ieinstal.exe.mui id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Internet Explorer\en-US\ielowutil.exe.mui - Access
\\?\C:\Program Files (x86)\Internet Explorer\en-US\ielowutil.exe.mui id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Internet Explorer\en-US\iexplore.exe.mui - Access
\\?\C:\Program Files (x86)\Internet Explorer\en-US\iexplore.exe.mui id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Internet Explorer\en-US\jsdbgui.dll.mui - Access
\\?\C:\Program Files (x86)\Internet Explorer\en-US\jsdbgui.dll.mui id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Internet Explorer\en-US\jsdebuggeride.dll.mui - Access
\\?\C:\Program Files (x86)\Internet Explorer\en-US\jsdebuggeride.dll.mui id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Internet Explorer\en-US\JSProfilerCore.dll.mui - Access
\\?\C:\Program Files (x86)\Internet Explorer\en-US\JSProfilerCore.dll.mui id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Internet Explorer\en-US\jsprofilerui.dll.mui - Access
\\?\C:\Program Files (x86)\Internet Explorer\en-US\jsprofilerui.dll.mui id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Internet Explorer\ExtExport.exe - Access
\\?\C:\Program Files (x86)\Internet Explorer\ExtExport.exe id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Internet Explorer\hmmapi.dll - Access
\\?\C:\Program Files (x86)\Internet Explorer\hmmapi.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Internet Explorer\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files (x86)\Internet Explorer\ie8props.propdesc - Access
\\?\C:\Program Files (x86)\Internet Explorer\ie8props.propdesc id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Internet Explorer\iecompat.dll - Access
\\?\C:\Program Files (x86)\Internet Explorer\iecompat.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Internet Explorer\iedvtool.dll - Access
\\?\C:\Program Files (x86)\Internet Explorer\iedvtool.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Internet Explorer\ieinstal.exe - Access
\\?\C:\Program Files (x86)\Internet Explorer\ieinstal.exe id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Internet Explorer\ielowutil.exe - Access
\\?\C:\Program Files (x86)\Internet Explorer\ielowutil.exe id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Internet Explorer\ieproxy.dll - Access
\\?\C:\Program Files (x86)\Internet Explorer\ieproxy.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Internet Explorer\IEShims.dll - Access
\\?\C:\Program Files (x86)\Internet Explorer\IEShims.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Internet Explorer\iexplore.exe - Access
\\?\C:\Program Files (x86)\Internet Explorer\iexplore.exe id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Internet Explorer\jsdbgui.dll - Access
\\?\C:\Program Files (x86)\Internet Explorer\jsdbgui.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Internet Explorer\jsdebuggeride.dll - Access
\\?\C:\Program Files (x86)\Internet Explorer\jsdebuggeride.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Internet Explorer\JSProfilerCore.dll - Access
\\?\C:\Program Files (x86)\Internet Explorer\JSProfilerCore.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Internet Explorer\jsprofilerui.dll - Access
\\?\C:\Program Files (x86)\Internet Explorer\jsprofilerui.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Internet Explorer\msdbg2.dll - Access
\\?\C:\Program Files (x86)\Internet Explorer\msdbg2.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Internet Explorer\pdm.dll - Access
\\?\C:\Program Files (x86)\Internet Explorer\pdm.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Internet Explorer\SIGNUP\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files (x86)\Internet Explorer\SIGNUP\install.ins - Access
\\?\C:\Program Files (x86)\Internet Explorer\SIGNUP\install.ins id-bry0hIIfVldG0S8v.BDKR MD5: a2dec721264954257b3ea07a070a517f
SHA1: 6f5571b9382f1830547799528108e3fe202ec740
SHA256: 719d1cc79f7bf4b3144e9502285ca91e617c8a6371bd1cddd3b3a33e38975041
SSDeep: 24:xwCQEh93RbNrYf9xaP5WJHU5osnL+FJ+k9yjyt7A9KMYVP3NY3z3m8MGQ2bkRyIV:xJZz3R58FxO3+Yo+kDq4YJI+8rlf4I
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files (x86)\Internet Explorer\sqmapi.dll - Access
\\?\C:\Program Files (x86)\Internet Explorer\sqmapi.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Java\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files (x86)\Java\jewel.exe - Access
\\?\C:\Program Files (x86)\Java\jewel.exe id-bry0hIIfVldG0S8v.BDKR MD5: 54978f8ed867529a59ab3dccb61ae79a
SHA1: 4ec991c51caba9c3c638ad1ccde81281669a1ecd
SHA256: 0be17bd8aae57f930d4a3a02f7b03f43371d32015217d86bade56644ceb8f99b
SSDeep: 1536:wwYKfTQ2r7ePNeO1U/hZsbnK/9qEaXisP54Xf42:DlbQ2r7ePNeOKL8KVUXisKXfz
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files (x86)\Java\jre7\bin\awt.dll - Access
\\?\C:\Program Files (x86)\Java\jre7\bin\awt.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Java\jre7\bin\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access Created File
\\?\C:\Program Files (x86)\Java\jre7\COPYRIGHT - Access
\\?\C:\Program Files (x86)\Java\jre7\COPYRIGHT id-bry0hIIfVldG0S8v.BDKR MD5: 5d34e1f75a73745fb119aaa8e088628c
SHA1: 2f796b74489eb69e64aaf1c19f4d097166095c30
SHA256: 09ef4c54de4240fbcb382701b1cdbf7abcb9fc519f3f53c310f41a42f7d91fae
SSDeep: 96:+2kJ/PcKxrGWvA5F+sxbJKdEnbJsqM6NSTvgrOLJrI:+xPcKMWoH+21YCNSTvgKC
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files (x86)\Java\jre7\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files (x86)\Java\jre7\lib\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Java\jre7\LICENSE - Access
\\?\C:\Program Files (x86)\Java\jre7\LICENSE id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\Program Files (x86)\Java\jre7\README.txt id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\Program Files (x86)\Java\jre7\release id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\as80.xsl id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\as90.xsl id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\How To Restore Files.txt - Access, Write
\\?\C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access Created File
\\?\C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\msmdlocal.dll - Access
\\?\C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\msmdlocal.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Microsoft Office\Office14\1033\BHOINTL.DLL - Access
\\?\C:\Program Files (x86)\Microsoft Office\Office14\1033\BHOINTL.DLL id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Microsoft Office\Office14\1033\DL_RES.DLL id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Microsoft Office\Office14\1033\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files (x86)\Microsoft Office\Office14\AUTHZAX.DLL - Access
\\?\C:\Program Files (x86)\Microsoft Office\Office14\AUTHZAX.DLL id-bry0hIIfVldG0S8v.BDKR MD5: 8d143e332d58077c273354287b67d3c6
SHA1: 6a4fe65f9b3870387d01bacc8747cc0f3942765b
SHA256: 3760da5e0ef923ff826017186e1762024018a62c4304b3da6477e26497c0599b
SSDeep: 1536:dgrZnGvBrHtH/MXONT7YbEn7UEPzwgYXWqVXL:dnvBrNHkeObgZzhGXL
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files (x86)\Microsoft Office\Office14\BCSLaunch.dll - Access
\\?\C:\Program Files (x86)\Microsoft Office\Office14\BCSLaunch.dll id-bry0hIIfVldG0S8v.BDKR MD5: d90376280e58363efc59d023021588a8
SHA1: 03d88bfe867ce483cc71a212a01e3f62732ee67b
SHA256: be754f447f4c893021238b14026aa99afec8a2e585ae57a59efd9e67470de57b
SSDeep: 768:BhKIFsTu4XsTDuL6es3lCBoS8f42/Xl9/0FZSxpP4YIkp20VBqr4mL8TgyBdU5ch:/fuZqDuL6eGYiSobfbOszfq6TKsrfsM
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files (x86)\Microsoft Office\Office14\DGRMLNCH.DLL - Access
\\?\C:\Program Files (x86)\Microsoft Office\Office14\DGRMLNCH.DLL id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Microsoft Office\Office14\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\PrivateAssemblies\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\PrivateAssemblies\Microsoft.VisualStudio.Tools.Applications.Project.dll - Access
\\?\C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\PrivateAssemblies\Microsoft.VisualStudio.Tools.Applications.Project.dll id-bry0hIIfVldG0S8v.BDKR MD5: ec9d20286423d89eedd48b2ca2f46682
SHA1: 9342e597596befd9d62640c201ff07831f3a8fae
SHA256: 8326bc4e9417cac5c926d8cb5c8675d6f5bb580efb26dc5fa2f73a0994035cdd
SSDeep: 3072:qjw3PKFuvMZz+J5J7D6d5TnXNhNLd1R6Fp/fo9MXxWxe2JHGp:lfK8M8PJ7Ds5TNLdT6DmMYrGp
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\PublicAssemblies\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access Created File
\\?\C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\PublicAssemblies\Microsoft.VisualStudio.Tools.Applications.Adapter.dll - Access
\\?\C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\PublicAssemblies\Microsoft.VisualStudio.Tools.Applications.Adapter.dll id-bry0hIIfVldG0S8v.BDKR MD5: 94078855f7c671cb315994c35a752622
SHA1: 521f98e7be196e760f1f8e5a23a926f8b58956b2
SHA256: b69d046ad4e70f188b531b5de650cbff397eb37b99df0413feff315599bf4739
SSDeep: 3072:eBOlGScfij6jRN0Y3f7ieCzR4B+LGE+gwGk6r4jPnAHTWnku/Kx88laI9TPF+iMx:cx6j6v0YWe4R4pEGWrCnA6tCV8qPA+Uf
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\PublicAssemblies\Microsoft.VisualStudio.Tools.Applications.AddInManager.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\AboutBox.zip id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\How To Restore Files.txt - Access, Write
\\?\C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\AppConfigurationInternal.zip id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\How To Restore Files.txt - Access, Write
\\?\C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\1033\How To Restore Files.txt - Access, Write
\\?\C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\1033\VSTAClientPkgUI.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\VSTAClientPkg.dll - Access
\\?\C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\VSTAClientPkg.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Microsoft.NET\browser accredited mil.exe - Access
\\?\C:\Program Files (x86)\Microsoft.NET\browser accredited mil.exe id-bry0hIIfVldG0S8v.BDKR MD5: da7346a53c62b39276b50798d6f6b57c
SHA1: 565d2fdebcd6713175db31cc5e29e10b9ad8227a
SHA256: 1517de1edeea9689667ea4568aa8efe510cd36c81bf5ff0481e74280765422e6
SSDeep: 1536:OrguZwDtDjdySaTqJnNFkGF4aJ4wnsX7e3DEoJkSryrF:OsuZc5pyUbHFXjC7A4o6rF
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files (x86)\Microsoft.NET\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\adodb.dll - Access
\\?\C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\adodb.dll id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\Microsoft.mshtml.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Microsoft.NET\RedistList\AssemblyList_4_client.xml - Access
\\?\C:\Program Files (x86)\Microsoft.NET\RedistList\AssemblyList_4_client.xml id-bry0hIIfVldG0S8v.BDKR MD5: a92e62c9436968fdb6596dcef9fb9cd8
SHA1: e16d87e59a1ab7559d5e01285ea24e438031782b
SHA256: 3a4ef8ffaf881154efd0ad3173383bf4ca1655415fd925d2ea5ba04f6ebe4c6a
SSDeep: 384:a73h7l5NDb0f1jnZNVIKsGunJhqEIXpeSXG+Wc6n7eQu0C:EFF4f1CKqXqESosVW97eZ
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files (x86)\Microsoft.NET\RedistList\AssemblyList_4_extended.xml - Access
\\?\C:\Program Files (x86)\Microsoft.NET\RedistList\AssemblyList_4_extended.xml id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\Program Files (x86)\Microsoft.NET\RedistList\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files (x86)\Mozilla Firefox\AccessibleMarshal.dll - Access
\\?\C:\Program Files (x86)\Mozilla Firefox\AccessibleMarshal.dll id-bry0hIIfVldG0S8v.BDKR MD5: 262f10a862bff1d90de910e5a374cdcd
SHA1: 80b0ec3e113419c70525f384b09d075235f09797
SHA256: 9e9be592896cc94b00212880c8c8c7eab59a2185f164fa3be8eb19347fc3fcfa
SSDeep: 384:Fm6ZOTYSDqNlLv8x7ZbqdIEEHRCuAzUZiqC7pSaUBbEBC50E7EAojFhMYD0C:ETUvtv8DboExCII7Sa+TV/3G
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files (x86)\Mozilla Firefox\application.ini - Access
\\?\C:\Program Files (x86)\Mozilla Firefox\application.ini id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\Program Files (x86)\Mozilla Firefox\breakpadinjector.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Mozilla Firefox\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files (x86)\Mozilla Maintenance Service\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access Created File
\\?\C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe - Access
\\?\C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\MSBuild\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files (x86)\MSBuild\Microsoft.Office.InfoPath.targets - Access
\\?\C:\Program Files (x86)\MSBuild\Microsoft.Office.InfoPath.targets id-bry0hIIfVldG0S8v.BDKR MD5: 0c032dba276e54921618dc7f190ff086
SHA1: 2517004957b7fb35e2112ce27ce71a2a47b7d72c
SHA256: 04101da152fa635b5c3e79210756496df790729dd002ccc92bcf45ed3ce1b6d5
SSDeep: 48:L/+/ASXAwdwMTlt9864qtm46Zsq4YJI+8rlf4I:Lmvdwci6bXILJrI
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\Workflow.Targets - Access
\\?\C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\Workflow.Targets id-bry0hIIfVldG0S8v.BDKR MD5: 099eb4d6f90eb8dcfaf0f5e9e69cc350
SHA1: 36b5bc709815060fb8e2b9ee218745ea2a8957c9
SHA256: f38b4956aed2ff9a8d6704e337b6b5d96062f62d7155189c33029f8ebc2d3938
SSDeep: 96:dNxyVDAbZ/5m7v+hC1zETX2SzCmNrVw4LUGUiaas7+CIGwhZsLJrI:nWDASb+0WV3TURrAGysC
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\Workflow.VisualBasic.Targets - Access
\\?\C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\Workflow.VisualBasic.Targets id-bry0hIIfVldG0S8v.BDKR MD5: 0f2e57c88c5e1ad4ebfd8a79f6e0985d
SHA1: 17c75560aec0e67b90f35aae8769be1e1cd082e7
SHA256: ab166f087bebfe6be8c698f6c2c7b2a48ec308db020f42bd29e7464bcdb2e847
SSDeep: 96:I4dSe0wJ6foFrUcNoHowgEDsCt3VgCqjOe4jRmaaepD9uR3m9pZELJrI:I4dwq6igcCHTlZtqCqjOe49oWEhmXqC
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.Targets - Access
\\?\C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.Targets id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.VisualBasic.Targets - Access
\\?\C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.VisualBasic.Targets id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\MSBuild\moore-encouraging-percent.exe - Access
\\?\C:\Program Files (x86)\MSBuild\moore-encouraging-percent.exe id-bry0hIIfVldG0S8v.BDKR MD5: f1987a1019e00f506dfbbcecec85c0ee
SHA1: 28c18690ed1accf76607369fb426c7b33f6d6ac8
SHA256: 52f655d654a44f726863dd5edc7411e9f74b401a9c5128d4415469f39cd0d3d8
SSDeep: 1536:uVQkLtGN81GBTDUYWJik+sWRR++TvC8CaTH7eH4a6lLUxro:eQkkJyH+sKI+19GYa6ZUy
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\PresentationBuildTasks.dll - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\PresentationBuildTasks.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\PresentationCore.dll - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\PresentationCore.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Aero.dll - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Aero.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Classic.dll - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Classic.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.dll - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Luna.dll - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Luna.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Royale.dll - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Royale.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\ReachFramework.dll - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\ReachFramework.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\FrameworkList.xml id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\SubsetList\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\System.IdentityModel.dll - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\System.IdentityModel.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\System.IdentityModel.Selectors.dll - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\System.IdentityModel.Selectors.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\System.IO.Log.dll - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\System.IO.Log.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\System.Printing.dll - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\System.Printing.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\System.Runtime.Serialization.dll - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\System.Runtime.Serialization.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\System.ServiceModel.dll - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\System.ServiceModel.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\System.Speech.dll - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\System.Speech.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.Activities.dll - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.Activities.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.ComponentModel.dll - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.ComponentModel.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.Runtime.dll - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.Runtime.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\UIAutomationClient.dll - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\UIAutomationClient.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\UIAutomationClientsideProviders.dll - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\UIAutomationClientsideProviders.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\UIAutomationProvider.dll - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\UIAutomationProvider.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\UIAutomationTypes.dll - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\UIAutomationTypes.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\WindowsBase.dll - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\WindowsBase.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\WindowsFormsIntegration.dll - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\WindowsFormsIntegration.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\WinFXList.xml - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\WinFXList.xml id-bry0hIIfVldG0S8v.BDKR MD5: 6a4a6981520710bef83e74c9d054e321
SHA1: f0fc015f4e9b0dd0843a6d51bda9e3ac425d41cb
SHA256: daf2a7d354108faf7eadae2991470ea4ac5423f8e908738263b5936f8a7be998
SSDeep: 96:gaiJHVUe5gOZy5HX+zWWOEnkJcFxb6RkhQW3+0A7GLJrI:gBYwgVHX+artuFxb6yhQS+X7GC
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Conversion.v3.5.dll - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Conversion.v3.5.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Engine.dll - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Engine.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Framework.dll - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Framework.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Utilities.v3.5.dll - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Utilities.v3.5.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.VisualC.STLCLR.dll - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.VisualC.STLCLR.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access Created File
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\SubsetList\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.AddIn.Contract.dll - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.AddIn.Contract.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.AddIn.dll - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.AddIn.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.ComponentModel.DataAnnotations.dll - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.ComponentModel.DataAnnotations.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.Core.dll - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.Core.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.DataSetExtensions.dll - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.DataSetExtensions.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Entity.Design.dll - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Entity.Design.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Entity.dll - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Entity.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Linq.dll - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Linq.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Services.Client.dll - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Services.Client.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Services.Design.dll - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Services.Design.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Services.dll - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Services.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.DirectoryServices.AccountManagement.dll - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.DirectoryServices.AccountManagement.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.Management.Instrumentation.dll - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.Management.Instrumentation.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.Net.dll - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.Net.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.ServiceModel.Web.dll - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.ServiceModel.Web.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Abstractions.dll - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Abstractions.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.DynamicData.Design.dll - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.DynamicData.Design.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.DynamicData.dll - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.DynamicData.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Entity.Design.dll - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Entity.Design.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Entity.dll - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Entity.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Extensions.Design.dll - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Extensions.Design.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Extensions.dll - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Extensions.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Routing.dll - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Routing.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.Windows.Presentation.dll - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.Windows.Presentation.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.WorkflowServices.dll - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.WorkflowServices.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.Xml.Linq.dll - Access
\\?\C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.Xml.Linq.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Uninstall Information\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access Created File
\\?\C:\Program Files (x86)\Uninstall Information\traditions.exe - Access
\\?\C:\Program Files (x86)\Uninstall Information\traditions.exe id-bry0hIIfVldG0S8v.BDKR MD5: ca7769cc76c9e89667c21d74ff536444
SHA1: aeaa4805c311da6c4bbfec4a9795e7969372420a
SHA256: b9d154cf58ddff675fe1478cd475668beb482ff005d1a5033ee64fad7c160a64
SSDeep: 1536:HEpHZ9jBIQ9ltJo091jbvSI6mIu2MHNDMt8X/5vxoq:HEpHjNIIHB7zdmGQCBpl
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files (x86)\Windows Defender\en-US\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files (x86)\Windows Defender\en-US\MpAsDesc.dll.mui - Access
\\?\C:\Program Files (x86)\Windows Defender\en-US\MpAsDesc.dll.mui id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Windows Defender\en-US\MpEvMsg.dll.mui - Access
\\?\C:\Program Files (x86)\Windows Defender\en-US\MpEvMsg.dll.mui id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Windows Defender\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files (x86)\Windows Defender\MpAsDesc.dll - Access
\\?\C:\Program Files (x86)\Windows Defender\MpAsDesc.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Windows Defender\MpClient.dll - Access
\\?\C:\Program Files (x86)\Windows Defender\MpClient.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Windows Defender\MpOAV.dll - Access
\\?\C:\Program Files (x86)\Windows Defender\MpOAV.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Windows Defender\MsMpLics.dll - Access
\\?\C:\Program Files (x86)\Windows Defender\MsMpLics.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Windows Mail\en-US\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files (x86)\Windows Mail\en-US\msoeres.dll.mui - Access
\\?\C:\Program Files (x86)\Windows Mail\en-US\msoeres.dll.mui id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Windows Mail\en-US\WinMail.exe.mui - Access
\\?\C:\Program Files (x86)\Windows Mail\en-US\WinMail.exe.mui id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Windows Mail\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access Created File
\\?\C:\Program Files (x86)\Windows Mail\msoe.dll - Access
\\?\C:\Program Files (x86)\Windows Mail\msoe.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Windows Mail\MSOERES.dll - Access
\\?\C:\Program Files (x86)\Windows Mail\MSOERES.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Windows Mail\oeimport.dll - Access
\\?\C:\Program Files (x86)\Windows Mail\oeimport.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Windows Mail\wab.exe - Access
\\?\C:\Program Files (x86)\Windows Mail\wab.exe id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Windows Mail\wabfind.dll - Access
\\?\C:\Program Files (x86)\Windows Mail\wabfind.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Windows Mail\wabimp.dll - Access
\\?\C:\Program Files (x86)\Windows Mail\wabimp.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Windows Mail\wabmig.exe - Access
\\?\C:\Program Files (x86)\Windows Mail\wabmig.exe id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Windows Mail\WinMail.exe - Access
\\?\C:\Program Files (x86)\Windows Mail\WinMail.exe id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Windows Media Player\en-US\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access Created File
\\?\C:\Program Files (x86)\Windows Media Player\en-US\mpvis.dll.mui - Access
\\?\C:\Program Files (x86)\Windows Media Player\en-US\mpvis.dll.mui id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Windows Media Player\en-US\setup_wm.exe.mui - Access
\\?\C:\Program Files (x86)\Windows Media Player\en-US\setup_wm.exe.mui id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Windows Media Player\en-US\wmlaunch.exe.mui - Access
\\?\C:\Program Files (x86)\Windows Media Player\en-US\wmlaunch.exe.mui id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Windows Media Player\en-US\WMPDMC.exe.mui - Access
\\?\C:\Program Files (x86)\Windows Media Player\en-US\WMPDMC.exe.mui id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Windows Media Player\en-US\WMPDMCCore.dll.mui - Access
\\?\C:\Program Files (x86)\Windows Media Player\en-US\WMPDMCCore.dll.mui id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Windows Media Player\en-US\wmplayer.exe.mui - Access
\\?\C:\Program Files (x86)\Windows Media Player\en-US\wmplayer.exe.mui id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Windows Media Player\en-US\WMPMediaSharing.dll.mui - Access
\\?\C:\Program Files (x86)\Windows Media Player\en-US\WMPMediaSharing.dll.mui id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Windows Media Player\en-US\wmpnssci.dll.mui - Access
\\?\C:\Program Files (x86)\Windows Media Player\en-US\wmpnssci.dll.mui id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Windows Media Player\en-US\wmpnssui.dll.mui - Access
\\?\C:\Program Files (x86)\Windows Media Player\en-US\wmpnssui.dll.mui id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Windows Media Player\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files (x86)\Windows Media Player\Media Renderer\avtransport.xml - Access
\\?\C:\Program Files (x86)\Windows Media Player\Media Renderer\avtransport.xml id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Windows Media Player\Media Renderer\connectionmanager_dmr.xml - Access
\\?\C:\Program Files (x86)\Windows Media Player\Media Renderer\connectionmanager_dmr.xml id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Windows Media Player\Media Renderer\DMR_120.jpg - Access
\\?\C:\Program Files (x86)\Windows Media Player\Media Renderer\DMR_120.jpg id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Windows Media Player\Media Renderer\DMR_120.png - Access
\\?\C:\Program Files (x86)\Windows Media Player\Media Renderer\DMR_120.png id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Windows Media Player\Media Renderer\DMR_48.jpg - Access
\\?\C:\Program Files (x86)\Windows Media Player\Media Renderer\DMR_48.jpg id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Windows Media Player\Media Renderer\DMR_48.png - Access
\\?\C:\Program Files (x86)\Windows Media Player\Media Renderer\DMR_48.png id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Windows Media Player\Media Renderer\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files (x86)\Windows Media Player\Media Renderer\RenderingControl.xml - Access
\\?\C:\Program Files (x86)\Windows Media Player\Media Renderer\RenderingControl.xml id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Windows Media Player\mpvis.DLL - Access
\\?\C:\Program Files (x86)\Windows Media Player\mpvis.DLL id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Windows Media Player\setup_wm.exe - Access
\\?\C:\Program Files (x86)\Windows Media Player\setup_wm.exe id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Windows Media Player\Skins\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files (x86)\Windows Media Player\Skins\Revert.wmz - Access
\\?\C:\Program Files (x86)\Windows Media Player\Skins\Revert.wmz id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Windows Media Player\wmlaunch.exe - Access
\\?\C:\Program Files (x86)\Windows Media Player\wmlaunch.exe id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Windows Media Player\wmpconfig.exe - Access
\\?\C:\Program Files (x86)\Windows Media Player\wmpconfig.exe id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Windows Media Player\WMPDMC.exe - Access
\\?\C:\Program Files (x86)\Windows Media Player\WMPDMC.exe id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Windows Media Player\WMPDMCCore.dll - Access
\\?\C:\Program Files (x86)\Windows Media Player\WMPDMCCore.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Windows Media Player\wmpenc.exe - Access
\\?\C:\Program Files (x86)\Windows Media Player\wmpenc.exe id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Windows Media Player\wmplayer.exe - Access
\\?\C:\Program Files (x86)\Windows Media Player\wmplayer.exe id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Windows Media Player\WMPMediaSharing.dll - Access
\\?\C:\Program Files (x86)\Windows Media Player\WMPMediaSharing.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Windows Media Player\wmpnssci.dll - Access
\\?\C:\Program Files (x86)\Windows Media Player\wmpnssci.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Windows Media Player\WMPNSSUI.dll - Access
\\?\C:\Program Files (x86)\Windows Media Player\WMPNSSUI.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Windows Media Player\wmprph.exe - Access
\\?\C:\Program Files (x86)\Windows Media Player\wmprph.exe id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Windows Media Player\wmpshare.exe - Access
\\?\C:\Program Files (x86)\Windows Media Player\wmpshare.exe id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Windows NT\Accessories\en-US\How To Restore Files.txt - Access, Write
\\?\C:\Program Files (x86)\Windows NT\Accessories\How To Restore Files.txt - Access, Write
\\?\C:\Program Files (x86)\Windows NT\TableTextService\en-US\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files (x86)\Windows NT\TableTextService\en-US\TableTextService.dll.mui - Access
\\?\C:\Program Files (x86)\Windows NT\TableTextService\en-US\TableTextService.dll.mui id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Windows NT\TableTextService\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files (x86)\Windows NT\TableTextService\TableTextService.dll - Access
\\?\C:\Program Files (x86)\Windows NT\TableTextService\TableTextService.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Windows NT\TableTextService\TableTextServiceAmharic.txt - Access
\\?\C:\Program Files (x86)\Windows NT\TableTextService\TableTextServiceAmharic.txt id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Windows NT\TableTextService\TableTextServiceArray.txt - Access
\\?\C:\Program Files (x86)\Windows NT\TableTextService\TableTextServiceArray.txt id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Windows NT\TableTextService\TableTextServiceDaYi.txt - Access
\\?\C:\Program Files (x86)\Windows NT\TableTextService\TableTextServiceDaYi.txt id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Windows NT\TableTextService\TableTextServiceSimplifiedQuanPin.txt - Access
\\?\C:\Program Files (x86)\Windows NT\TableTextService\TableTextServiceSimplifiedQuanPin.txt id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Windows NT\TableTextService\TableTextServiceSimplifiedShuangPin.txt - Access
\\?\C:\Program Files (x86)\Windows NT\TableTextService\TableTextServiceSimplifiedShuangPin.txt id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Windows NT\TableTextService\TableTextServiceSimplifiedZhengMa.txt - Access
\\?\C:\Program Files (x86)\Windows NT\TableTextService\TableTextServiceSimplifiedZhengMa.txt id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Windows NT\TableTextService\TableTextServiceYi.txt - Access
\\?\C:\Program Files (x86)\Windows NT\TableTextService\TableTextServiceYi.txt id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Windows Photo Viewer\en-US\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access Created File
\\?\C:\Program Files (x86)\Windows Photo Viewer\en-US\ImagingDevices.exe.mui - Access
\\?\C:\Program Files (x86)\Windows Photo Viewer\en-US\ImagingDevices.exe.mui id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Windows Photo Viewer\en-US\PhotoAcq.dll.mui - Access
\\?\C:\Program Files (x86)\Windows Photo Viewer\en-US\PhotoAcq.dll.mui id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Windows Photo Viewer\en-US\PhotoViewer.dll.mui - Access
\\?\C:\Program Files (x86)\Windows Photo Viewer\en-US\PhotoViewer.dll.mui id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Windows Photo Viewer\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe - Access
\\?\C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Windows Photo Viewer\ImagingEngine.dll - Access
\\?\C:\Program Files (x86)\Windows Photo Viewer\ImagingEngine.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Windows Photo Viewer\motorola spank thomas.exe - Access
\\?\C:\Program Files (x86)\Windows Photo Viewer\motorola spank thomas.exe id-bry0hIIfVldG0S8v.BDKR MD5: a5369a71f79fc1ebc19659e7847d3eb5
SHA1: 59a857c66e0d80b2cf12df566fec82d4231b2bf7
SHA256: 38039cfbc9c337fffecf30dd3db56c6b08dc38496dd7ea44a35fa9d8575ba99d
SSDeep: 1536:XP4OfQFHKvvubM2glB1ZFNugwcXv1HmMzp5hib6SvTr+:XPHf4K3XlDZFNKAdZjiu
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files (x86)\Windows Photo Viewer\PhotoAcq.dll - Access
\\?\C:\Program Files (x86)\Windows Photo Viewer\PhotoAcq.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Windows Photo Viewer\PhotoBase.dll - Access
\\?\C:\Program Files (x86)\Windows Photo Viewer\PhotoBase.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Windows Photo Viewer\PhotoViewer.dll - Access
\\?\C:\Program Files (x86)\Windows Photo Viewer\PhotoViewer.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Windows Portable Devices\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files (x86)\Windows Portable Devices\sqmapi.dll - Access
\\?\C:\Program Files (x86)\Windows Portable Devices\sqmapi.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Windows Sidebar\en-US\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files (x86)\Windows Sidebar\en-US\sbdrop.dll.mui - Access
\\?\C:\Program Files (x86)\Windows Sidebar\en-US\sbdrop.dll.mui id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Windows Sidebar\en-US\Sidebar.exe.mui - Access
\\?\C:\Program Files (x86)\Windows Sidebar\en-US\Sidebar.exe.mui id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\drag.png - Access
\\?\C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\drag.png id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\css\How To Restore Files.txt - Access, Write
\\?\C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\How To Restore Files.txt - Access, Write
\\?\C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\js\How To Restore Files.txt - Access, Write
\\?\C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\icon.png - Access
\\?\C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\icon.png id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\images\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\logo.png - Access
\\?\C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\logo.png id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\en-US\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\en-US\css\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\en-US\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\en-US\js\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\images\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\en-US\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\images\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\css\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\js\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\How To Restore Files.txt - Access, Write
\\?\C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\How To Restore Files.txt - Access, Write
\\?\C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\drag.png - Access
\\?\C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\drag.png id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\css\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\How To Restore Files.txt - Access, Write
\\?\C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\js\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\icon.png - Access
\\?\C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\icon.png id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\images\How To Restore Files.txt - Access, Write
\\?\C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\images\in_sidebar\How To Restore Files.txt - Access, Write
\\?\C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\images\on_desktop\How To Restore Files.txt - Access, Write
\\?\C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\logo.png - Access
\\?\C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\logo.png id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\en-US\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\How To Restore Files.txt - Access, Write
\\?\C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\How To Restore Files.txt - Access
\\?\C:\Program Files (x86)\Windows Sidebar\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files (x86)\Windows Sidebar\mold.exe - Access
\\?\C:\Program Files (x86)\Windows Sidebar\mold.exe id-bry0hIIfVldG0S8v.BDKR MD5: 4b4943adb26080c61fad0f507920ce90
SHA1: 94364f579e2a854b02ad3518f2c9fb1f2188c9a6
SHA256: c746479bb3fd3bbf6c9a8647a5b44c034a931b73b08ec40da07f6de62adc6bc4
SSDeep: 1536:RySala7kaYFNeDW9TFHYNmqa8RgIPTXjPGyhcRLfOxe4oZr6Mr:8LlrFFNhj0tBgabGkcRqxe4Q
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files (x86)\Windows Sidebar\sbdrop.dll - Access
\\?\C:\Program Files (x86)\Windows Sidebar\sbdrop.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Windows Sidebar\settings.ini - Access
\\?\C:\Program Files (x86)\Windows Sidebar\settings.ini id-bry0hIIfVldG0S8v.BDKR MD5: f02767f875429d652e73e7458623fdfd
SHA1: 1805ac19198835a5f394e86c6abfa84ab82ca2ea
SHA256: 4af149f18c55bdada275dffa4103e61bcde7f710d817eb449c5931aa86a611c6
SSDeep: 24:3of3fR7UQcm6DtanJgfyt7A9KMYVP3NY3z3m8MGQ2bkRyIa58rlzgBbKW5WcGII:3onJimyQnJgaq4YJI+8rlf4I
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files (x86)\Windows Sidebar\sidebar.exe - Access
\\?\C:\Program Files (x86)\Windows Sidebar\sidebar.exe id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files (x86)\Windows Sidebar\ti-skip-independence.exe - Access
\\?\C:\Program Files (x86)\Windows Sidebar\ti-skip-independence.exe id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Common Files\DESIGNER\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files\Common Files\DESIGNER\MSADDNDR.DLL - Access
\\?\C:\Program Files\Common Files\DESIGNER\MSADDNDR.DLL id-bry0hIIfVldG0S8v.BDKR MD5: 374bb9a5e4930d25cea562b26d0e2925
SHA1: 74d27edd53488a08c755c8ab7a120bd7694238fd
SHA256: ae76f565b8f7b0585a8f96cac8f00ef4c9cf9d418d697285f5daf7f6aa59e6d1
SSDeep: 1536:vo5aGdoXCByWBH3SDxYRCOjMemd2/IT2LamnRJDHfhQeGhOsvRs6nVj7NBMvIv:kaGdWyBHCGXdY0NTrH5bGnHV7U4
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files\Common Files\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access Created File
\\?\C:\Program Files\Common Files\Microsoft Shared\DW\DBGHELP.DLL - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\DW\DBGHELP.DLL id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\DW\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access Created File
\\?\C:\Program Files\Common Files\Microsoft Shared\EQUATION\1033\EEINTL.DLL - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\EQUATION\1033\EEINTL.DLL id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\Program Files\Common Files\Microsoft Shared\EQUATION\1033\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.CNT - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.CNT id-bry0hIIfVldG0S8v.BDKR MD5: 33c5ee7119d4836b1e093a0c36af88ba
SHA1: ee3fe1a772f8f7a8ef4d740395348133bb0e7e6f
SHA256: 2a1b9d0d78ab2ffdc806cd9ce2842379b52373dfbcb34e7f349eb15c9f16b909
SSDeep: 48:YM14PDDIe5KBWO8hZB2mGAlPpGn3wQ9/eSKISNrNhjWAc+oFOJMXvDq4YJI+8rlf:YMEDVLDhZBBs19/pknC/dFt/OLJrI
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE id-bry0hIIfVldG0S8v.BDKR MD5: bef6c84fd4210e38ad0d7a3012c677bc
SHA1: 924f4d51703bb3da943d3671ebb010799310962f
SHA256: ddc709faa8110ab685075b1abbdbc5e81971223d9d52c5bfb6105900bf7a1789
SSDeep: 12288:wyrHf6TGKKnjXHvk3ZiCzVnPFqBL/rauwO+1aiBLaJS/vhJD:THRjXEiyVW/uuHGh
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files\Common Files\Microsoft Shared\EQUATION\eqnedt32.exe.manifest - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\EQUATION\eqnedt32.exe.manifest id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.HLP id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\EQUATION\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files\Common Files\Microsoft Shared\EURO\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files\Common Files\Microsoft Shared\EURO\MSOEURO.DLL - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\EURO\MSOEURO.DLL id-bry0hIIfVldG0S8v.BDKR MD5: 88a9110ab89a2935447d498732971cf3
SHA1: 1624cbb0c897b406725185c69306b9420be35e2a
SHA256: 6bf8fb76b276d7be3d8dc802cbaf7c083e0e2ca5762b485c650b92ac08cd7082
SSDeep: 768:rKNwimoxRX0oBUzuQQSsyakSY64iTtt27C3bWPxzH8QDkI+jS+1Syd+c:rDimoDX3OzuQQSfakSYEs78AHDkHjSa9
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files\Common Files\Microsoft Shared\Filters\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files\Common Files\Microsoft Shared\Filters\msgfilt.dll - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\Filters\msgfilt.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\CGMIMP32.CFG - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\CGMIMP32.CFG id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\CGMIMP32.FLT id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files\Common Files\Microsoft Shared\Help\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll id-bry0hIIfVldG0S8v.BDKR MD5: 2f8841d4b0b1e312ea07fb07ebd15b25
SHA1: 1c40fbec2f0e8ada2e76d673bdc6f0b226c504a4
SHA256: b37a3091b1a60e6a9e3bd25c146b4a87e5bc27f8d8cdfed65c49abd0aae0fde8
SSDeep: 24576:4J0XmmKIIfJZhNpfy9LvbbORL7y3P0KFKglfvG5EW1i:0UmmKTfBNFGLP0f5K4g1Gpi
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files\Common Files\Microsoft Shared\Help\ITIRCL55.DLL - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\Help\ITIRCL55.DLL id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\Alphabet.xml - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\Alphabet.xml id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\Content.xml - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\Content.xml id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\ConvertInkStore.exe - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\ConvertInkStore.exe id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\How To Restore Files.txt - Access, Write
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\en-US\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\FlickAnimation.avi - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\FlickAnimation.avi id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\FlickLearningWizard.exe - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\FlickLearningWizard.exe id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access Created File
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\hwrcommonlm.dat - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\hwrcommonlm.dat id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\hwrenalm.dat - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\hwrenalm.dat id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\hwrenclm.dat - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\hwrenclm.dat id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\hwrlatinlm.dat - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\hwrlatinlm.dat id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\hwruklm.dat - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\hwruklm.dat id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\hwruksh.dat - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\hwruksh.dat id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\hwrusalm.dat - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\hwrusalm.dat id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\hwrusash.dat - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\hwrusash.dat id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\InkDiv.dll - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\InkDiv.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\InkObj.dll - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\InkObj.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\InkWatson.exe - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\InkWatson.exe id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipscat.xml - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipscat.xml id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipschs.xml - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipschs.xml id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipscht.xml - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipscht.xml id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipscsy.xml - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipscsy.xml id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipsdan.xml - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipsdan.xml id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipsdeu.xml - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipsdeu.xml id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipsen.xml - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipsen.xml id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipsesp.xml - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\ipsesp.xml id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\IPSEventLogMsg.dll - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\IPSEventLogMsg.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\How To Restore Files.txt - Access, Write
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\MSClientDataMgr\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files\Common Files\Microsoft Shared\MSClientDataMgr\MSCDM.DLL - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\MSClientDataMgr\MSCDM.DLL id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\msinfo32.exe.mui - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\msinfo32.exe.mui id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\MSInfo\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access Created File
\\?\C:\Program Files\Common Files\Microsoft Shared\MSInfo\msinfo32.exe - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\MSInfo\msinfo32.exe id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\ACEINTL.DLL - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\ACEINTL.DLL id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\ACEODBCI.DLL id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\1033\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACECORE.DLL - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ACECORE.DLL id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\OFFICE14\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access Created File
\\?\C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access Created File
\\?\C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPC.DLL - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPC.DLL id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\PROOF\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files\Common Files\Microsoft Shared\PROOF\MSLID.DLL - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\PROOF\MSLID.DLL id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\1033\How To Restore Files.txt - Access, Write
\\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\1033\MCABOUT.HTM id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\FBIBLIO.DLL - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\FBIBLIO.DLL id-bry0hIIfVldG0S8v.BDKR MD5: 12a12dca09e09f5152f73057a44d39ba
SHA1: 69a2c14a776028e53d14f9aad344029eb501fbee
SHA256: 01e490f40e2287378abcbf23cf48273dcb06b98a484ea86bbe309add3ba73a1e
SSDeep: 3072:qrSERCgiFYodTPPf9P95oCRUHiBZ/x4grx8WKUGW:qbCgi/dTPn9l5zL5t98NW
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\FDATE.DLL - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\FDATE.DLL id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\FPERSON.DLL id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\Smart Tag\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files\Common Files\Microsoft Shared\Source Engine\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access Created File
\\?\C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.htm - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.htm id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.jpg - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.jpg id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Blue_Gradient.jpg - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Blue_Gradient.jpg id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Cave_Drawings.gif - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Cave_Drawings.gif id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Connectivity.gif - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Connectivity.gif id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\Program Files\Common Files\Microsoft Shared\Stationery\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files\Common Files\Microsoft Shared\TextConv\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access Created File
\\?\C:\Program Files\Common Files\Microsoft Shared\TextConv\MSCONV97.DLL - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\TextConv\MSCONV97.DLL id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\AFTRNOON\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\ARCTIC\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\AXIS\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLENDS\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUECALM\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUEPRNT\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\BOLDSTRI\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\BREEZE\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\CANYON\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\CAPSULES\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\CASCADE\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\COMPASS\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\CONCRETE\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\DEEPBLUE\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECHO\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\ECLIPSE\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\EDGE\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\EVRGREEN\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\EXPEDITN\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\How To Restore Files.txt - Access, Write
\\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\ICE\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\INDUST\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\IRIS\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\JOURNAL\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\LAYERS\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\LEVEL\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\NETWORK\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\PAPYRUS\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\PIXEL\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\PROFILE\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\QUAD\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\RADIAL\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\REFINED\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\RICEPAPR\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\RIPPLE\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\RMNSQUE\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\SATIN\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\SKY\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\SLATE\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\SONORA\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\SPRING\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\STRTEDGE\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\STUDIO\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\SUMIPNTG\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\THEMES14\THEMES.INF id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\ARFR\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\ARFR\MSB1ARFR.ITS - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\ARFR\MSB1ARFR.ITS id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\ENES\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\ENES\MSB1ENES.ITS - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\ENES\MSB1ENES.ITS id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\ENFR\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\ENFR\MSB1ENFR.ITS id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\ESEN\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\ESEN\MSB1ESEN.DLL - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\ESEN\MSB1ESEN.DLL id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\FRAR\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\FRAR\MSB1FRAR.ITS - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\FRAR\MSB1FRAR.ITS id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\FREN\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\FREN\MSB1FREN.DLL - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\FREN\MSB1FREN.DLL id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\MSB1AR.LEX - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\TRANSLAT\MSB1AR.LEX id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\FM20.CHM id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\1033\How To Restore Files.txt - Access, Write
\\?\C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access Created File
\\?\C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\VBE7.DLL - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\VBA\VBA7\VBE7.DLL id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\Program Files\Common Files\Microsoft Shared\VC\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access Created File
\\?\C:\Program Files\Common Files\Microsoft Shared\VC\msdia100.dll - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\VC\msdia100.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\VGX\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files\Common Files\Microsoft Shared\VGX\VGX.dll - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\VGX\VGX.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\Visio Shared\Fonts\BIGFONT.SHX - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\Visio Shared\Fonts\BIGFONT.SHX id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\Visio Shared\Fonts\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\VSTO\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\How To Restore Files.txt - Access, Write
\\?\C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\MSOSVINT.DLL id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\Web Folders\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files\Common Files\Microsoft Shared\Web Folders\MSOSV.DLL - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\Web Folders\MSOSV.DLL id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\14\BIN\1033\FPEXT.MSG id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\14\BIN\1033\How To Restore Files.txt - Access, Write
\\?\C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\14\BIN\How To Restore Files.txt - Access, Write
\\?\C:\Program Files\Common Files\palmer still equations.exe - Access
\\?\C:\Program Files\Common Files\palmer still equations.exe id-bry0hIIfVldG0S8v.BDKR MD5: 3adc1d5fe5d3eded25bb25dc7d9929b3
SHA1: 9545676e72900501bc432247ccd165f1f64803a2
SHA256: b88f37a58925ddc471c052bf8d7831a2ed3073b970a5cc7552827331e74bb87c
SSDeep: 1536:fePP2jayKHKDWWHu2PZKk9B7AxzaB3eMWUZti:fem7KqDWUuSvMxzaB3BW8U
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files\Common Files\Services\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files\Common Files\Services\verisign.bmp - Access
\\?\C:\Program Files\Common Files\Services\verisign.bmp id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\en-US\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\MSTTSCommon.dll - Access
\\?\C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\MSTTSCommon.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\MSTTSEngine.dll - Access
\\?\C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\MSTTSEngine.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\MSTTSLoc.dll - Access
\\?\C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\MSTTSLoc.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Common Files\System\ado\en-US\How To Restore Files.txt - Access, Write
\\?\C:\Program Files\Common Files\System\ado\How To Restore Files.txt - Access, Write
\\?\C:\Program Files\Common Files\System\DirectDB.dll - Access
\\?\C:\Program Files\Common Files\System\DirectDB.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Common Files\System\en-US\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\System\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files\Common Files\System\msadc\en-US\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\System\msadc\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\System\MSMAPI\1033\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files\Common Files\System\MSMAPI\1033\MSMAPI32.DLL id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\Program Files\Common Files\System\Ole DB\en-US\How To Restore Files.txt - Access
\\?\C:\Program Files\Common Files\System\Ole DB\How To Restore Files.txt - Access, Write
\\?\C:\Program Files\Common Files\System\wab32.dll - Access
\\?\C:\Program Files\Common Files\System\wab32.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Common Files\System\wab32res.dll - Access
\\?\C:\Program Files\Common Files\System\wab32res.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\desktop.ini - Access
\\?\C:\Program Files\desktop.ini id-bry0hIIfVldG0S8v.BDKR MD5: 5627575c2d68077c10c443eb6ae0253a
SHA1: a8b418afd8bcf785a3770c442d36d16c74d68a1b
SHA256: b5d55be4a896ec4c8bd8f4f3e29a78d8955f2f3db20b1732827ae348b7b39b0d
SSDeep: 24:jI/3zO+ryk5EBefyt7A9KMYVP3NY3z3m8MGQ2bkRyIa58rlzgBbKW5WcGII:jOO++22Pq4YJI+8rlf4I
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files\DVD Maker\audiodepthconverter.ax - Access
\\?\C:\Program Files\DVD Maker\audiodepthconverter.ax id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\DVD Maker\bod_r.TTF - Access
\\?\C:\Program Files\DVD Maker\bod_r.TTF id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\DVD Maker\directshowtap.ax - Access
\\?\C:\Program Files\DVD Maker\directshowtap.ax id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\DVD Maker\DVDMaker.exe - Access
\\?\C:\Program Files\DVD Maker\DVDMaker.exe id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\DVD Maker\en-US\DVDMaker.exe.mui - Access
\\?\C:\Program Files\DVD Maker\en-US\DVDMaker.exe.mui id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\DVD Maker\en-US\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files\DVD Maker\en-US\OmdProject.dll.mui - Access
\\?\C:\Program Files\DVD Maker\en-US\OmdProject.dll.mui id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\DVD Maker\en-US\WMM2CLIP.dll.mui - Access
\\?\C:\Program Files\DVD Maker\en-US\WMM2CLIP.dll.mui id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\DVD Maker\Eurosti.TTF - Access
\\?\C:\Program Files\DVD Maker\Eurosti.TTF id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\DVD Maker\fieldswitch.ax - Access
\\?\C:\Program Files\DVD Maker\fieldswitch.ax id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\DVD Maker\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files\DVD Maker\offset.ax - Access
\\?\C:\Program Files\DVD Maker\offset.ax id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\DVD Maker\OmdBase.dll - Access
\\?\C:\Program Files\DVD Maker\OmdBase.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\DVD Maker\OmdProject.dll - Access
\\?\C:\Program Files\DVD Maker\OmdProject.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\DVD Maker\Pipeline.dll - Access
\\?\C:\Program Files\DVD Maker\Pipeline.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\DVD Maker\PipeTran.dll - Access
\\?\C:\Program Files\DVD Maker\PipeTran.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\DVD Maker\rtstreamsink.ax - Access
\\?\C:\Program Files\DVD Maker\rtstreamsink.ax id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\DVD Maker\rtstreamsource.ax - Access
\\?\C:\Program Files\DVD Maker\rtstreamsource.ax id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\DVD Maker\SecretST.TTF - Access
\\?\C:\Program Files\DVD Maker\SecretST.TTF id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\DVD Maker\Shared\Common.fxh - Access
\\?\C:\Program Files\DVD Maker\Shared\Common.fxh id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\DVD Maker\Shared\DissolveAnother.png - Access
\\?\C:\Program Files\DVD Maker\Shared\DissolveAnother.png id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\DVD Maker\Shared\DissolveNoise.png - Access
\\?\C:\Program Files\DVD Maker\Shared\DissolveNoise.png id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\How To Restore Files.txt - Access
\\?\C:\Program Files\DVD Maker\Shared\DvdStyles\How To Restore Files.txt - Access
\\?\C:\Program Files\DVD Maker\Shared\Filters.xml - Access
\\?\C:\Program Files\DVD Maker\Shared\Filters.xml id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\DVD Maker\Shared\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access Created File
\\?\C:\Program Files\DVD Maker\Shared\Parity.fx - Access
\\?\C:\Program Files\DVD Maker\Shared\Parity.fx id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\DVD Maker\soniccolorconverter.ax - Access
\\?\C:\Program Files\DVD Maker\soniccolorconverter.ax id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\DVD Maker\sonicsptransform.ax - Access
\\?\C:\Program Files\DVD Maker\sonicsptransform.ax id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\DVD Maker\WMM2CLIP.dll - Access
\\?\C:\Program Files\DVD Maker\WMM2CLIP.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files\Internet Explorer\en-US\hmmapi.dll.mui - Access
\\?\C:\Program Files\Internet Explorer\en-US\hmmapi.dll.mui id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Internet Explorer\en-US\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files\Internet Explorer\en-US\iedvtool.dll.mui - Access
\\?\C:\Program Files\Internet Explorer\en-US\iedvtool.dll.mui id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Internet Explorer\en-US\ieinstal.exe.mui - Access
\\?\C:\Program Files\Internet Explorer\en-US\ieinstal.exe.mui id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Internet Explorer\en-US\ielowutil.exe.mui - Access
\\?\C:\Program Files\Internet Explorer\en-US\ielowutil.exe.mui id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui - Access
\\?\C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Internet Explorer\en-US\jsdbgui.dll.mui - Access
\\?\C:\Program Files\Internet Explorer\en-US\jsdbgui.dll.mui id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Internet Explorer\en-US\jsdebuggeride.dll.mui - Access
\\?\C:\Program Files\Internet Explorer\en-US\jsdebuggeride.dll.mui id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Internet Explorer\en-US\JSProfilerCore.dll.mui - Access
\\?\C:\Program Files\Internet Explorer\en-US\JSProfilerCore.dll.mui id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Internet Explorer\en-US\jsprofilerui.dll.mui - Access
\\?\C:\Program Files\Internet Explorer\en-US\jsprofilerui.dll.mui id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Internet Explorer\hmmapi.dll - Access
\\?\C:\Program Files\Internet Explorer\hmmapi.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Internet Explorer\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access Created File
\\?\C:\Program Files\Internet Explorer\ie8props.propdesc - Access
\\?\C:\Program Files\Internet Explorer\ie8props.propdesc id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Internet Explorer\iecompat.dll - Access
\\?\C:\Program Files\Internet Explorer\iecompat.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Internet Explorer\iedvtool.dll - Access
\\?\C:\Program Files\Internet Explorer\iedvtool.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Internet Explorer\ieinstal.exe - Access
\\?\C:\Program Files\Internet Explorer\ieinstal.exe id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Internet Explorer\ielowutil.exe - Access
\\?\C:\Program Files\Internet Explorer\ielowutil.exe id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Internet Explorer\ieproxy.dll - Access
\\?\C:\Program Files\Internet Explorer\ieproxy.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Internet Explorer\IEShims.dll - Access
\\?\C:\Program Files\Internet Explorer\IEShims.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Internet Explorer\iexplore.exe - Access
\\?\C:\Program Files\Internet Explorer\iexplore.exe id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Internet Explorer\jsdbgui.dll - Access
\\?\C:\Program Files\Internet Explorer\jsdbgui.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Internet Explorer\jsdebuggeride.dll - Access
\\?\C:\Program Files\Internet Explorer\jsdebuggeride.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Internet Explorer\JSProfilerCore.dll - Access
\\?\C:\Program Files\Internet Explorer\JSProfilerCore.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Internet Explorer\jsprofilerui.dll - Access
\\?\C:\Program Files\Internet Explorer\jsprofilerui.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Internet Explorer\msdbg2.dll - Access
\\?\C:\Program Files\Internet Explorer\msdbg2.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Internet Explorer\mysimon.exe - Access
\\?\C:\Program Files\Internet Explorer\mysimon.exe id-bry0hIIfVldG0S8v.BDKR MD5: f3ecc6d2e8f4137308481d40bf2a91a9
SHA1: 19ae9b15e879900d212bf80504046e51bcd97bdd
SHA256: 4c3758b7b5e273a3bc8e106593015efcc1d426886165366a20302c7f60ebdbc2
SSDeep: 1536:xTVf11cUz0+Q3xaat7sMcvNFP+qB8bhH7G1gzTpcohdKhapvat:JVz0/1sM2NFP+qq1H7ogzpvKh3
ImpHash: None 		Access Created File
\\?\C:\Program Files\Internet Explorer\pdm.dll - Access
\\?\C:\Program Files\Internet Explorer\pdm.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Internet Explorer\SIGNUP\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access Created File
\\?\C:\Program Files\Internet Explorer\SIGNUP\install.ins - Access
\\?\C:\Program Files\Internet Explorer\SIGNUP\install.ins id-bry0hIIfVldG0S8v.BDKR MD5: c4f1e7f839fcf898b1ce4df3af92fe00
SHA1: 66855311d32211e5ff15f0add1f2c25af86ba230
SHA256: 3ca23132fddd9589f3e4b431e28bbc701f2e3e86246ec6b64677a8456bc719e0
SSDeep: 24:D+xwx1nuP8f9HKz4/huK2SgHliI6GchBC8szK4yt7A9KMYVP3NY3z3m8MGQ2bkRL:Dqen5VvZkFiDhBC0q4YJI+8rlf4I
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files\Internet Explorer\sqmapi.dll - Access
\\?\C:\Program Files\Internet Explorer\sqmapi.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\as80.xsl - Access
\\?\C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\as80.xsl id-bry0hIIfVldG0S8v.BDKR MD5: 777136169b449588e0d0cef26bfb8fb4
SHA1: 7119df2d3ad185d0512a3ec000067f594fb1d1a7
SHA256: f9c5bad3dea331949e20a5a028b23cbf8c41ce5da68324f522f90ee9eedabdb7
SSDeep: 384:8+9h/W4YFFkT8ju6jnHeJab38pJQhLmjBYoUhrh52J9avHXlyiF7cmIC:B/HZIa6zUab387QEVYoUhrf2q/lyiFhp
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\as90.xsl - Access
\\?\C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\as90.xsl id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\Informix.xsl id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\msjet.xsl id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\msmdlocal.dll - Access
\\?\C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\msmdlocal.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AG00004_.GIF id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Microsoft Office\CLIPART\PUB60COR\How To Restore Files.txt - Access, Write
\\?\C:\Program Files\Microsoft Office\CLIPART\Publisher\Backgrounds\How To Restore Files.txt - Access, Write
\\?\C:\Program Files\Microsoft Office\CLIPART\Publisher\Backgrounds\J0143743.GIF id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Microsoft Office\Document Themes 14\Adjacency.thmx - Access
\\?\C:\Program Files\Microsoft Office\Document Themes 14\Adjacency.thmx id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Microsoft Office\Document Themes 14\Angles.thmx id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Microsoft Office\Document Themes 14\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\1033\CAGCAT10.MML id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\1033\How To Restore Files.txt - Access, Write
\\?\C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\CAGCAT10.DLL - Access
\\?\C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\CAGCAT10.DLL id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Microsoft Office\MEDIA\CAGCAT10\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files\Microsoft Office\MEDIA\OFFICE14\1033\How To Restore Files.txt - Access, Write
\\?\C:\Program Files\Microsoft Office\MEDIA\OFFICE14\1033\OFFICE10.MML id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\How To Restore Files.txt - Access
\\?\C:\Program Files\Microsoft Office\MEDIA\OFFICE14\BULLETS\How To Restore Files.txt - Access, Write
\\?\C:\Program Files\Microsoft Office\MEDIA\OFFICE14\How To Restore Files.txt - Access, Write
\\?\C:\Program Files\Microsoft Office\MEDIA\OFFICE14\LINES\How To Restore Files.txt - Access
\\?\C:\Program Files\Microsoft Office\MEDIA\OFFICE14\OFFICE10.DLL id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Microsoft Office\Office14\1033\ACCDDSUI.DLL - Access
\\?\C:\Program Files\Microsoft Office\Office14\1033\ACCDDSUI.DLL id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\Program Files\Microsoft Office\Office14\1033\ACCESS12.ACC id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Microsoft Office\Office14\1033\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files\Microsoft Office\Office14\1036\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access Created File
\\?\C:\Program Files\Microsoft Office\Office14\1036\MSO.ACL - Access
\\?\C:\Program Files\Microsoft Office\Office14\1036\MSO.ACL id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Microsoft Office\Office14\3082\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files\Microsoft Office\Office14\3082\MSO.ACL - Access
\\?\C:\Program Files\Microsoft Office\Office14\3082\MSO.ACL id-bry0hIIfVldG0S8v.BDKR MD5: 3d7b32296f8a276e18c8ccde042f5ebd
SHA1: c2d8ceded0f53363d61842b50ca0a780da8f367a
SHA256: a7b1c784e612dcc6cd8b67d51d5546d75445ee7ed4665d1be2d45c69a17d94f2
SSDeep: 1536:O+ohZiGTY4RCj3uE6mf9CDxbLQttq5C3eKl:OVmG8hj3uEjf9CDxbLQTq8Jl
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files\Microsoft Office\Office14\ACCDDS.DLL - Access
\\?\C:\Program Files\Microsoft Office\Office14\ACCDDS.DLL id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Microsoft Office\Office14\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access Created File
\\?\C:\Program Files\Microsoft Office\Stationery\1033\CURRENCY.GIF - Access
\\?\C:\Program Files\Microsoft Office\Stationery\1033\CURRENCY.GIF id-bry0hIIfVldG0S8v.BDKR MD5: a2c7c6ecd7fad6540453e0f1f5fc704f
SHA1: c23a17c32d9d58ad98c090f687d4c142df3a146f
SHA256: b1f61bd80ff9770590955f6840e441f6338e13ad45abda878609669419f13965
SSDeep: 192:7EuSJ3T5bMTdghDw7t6BenyP+Es1fjv1th8COwC:ou6dBS7eP+BFjdtTC
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files\Microsoft Office\Stationery\1033\CURRENCY.HTM - Access
\\?\C:\Program Files\Microsoft Office\Stationery\1033\CURRENCY.HTM id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\Program Files\Microsoft Office\Stationery\1033\DADSHIRT.GIF id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\Program Files\Microsoft Office\Stationery\1033\DADSHIRT.HTM id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\Program Files\Microsoft Office\Stationery\1033\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files\Microsoft Office\Stationery\1033\JUDGESCH.GIF id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\Program Files\Microsoft Office\Stationery\1033\JUDGESCH.HTM id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\Program Files\Microsoft Office\Templates\1033\Access\Assets.accdt id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Microsoft Office\Templates\1033\Access\How To Restore Files.txt - Access, Write
\\?\C:\Program Files\Microsoft Office\Templates\1033\AdjacencyLetter.dotx - Access
\\?\C:\Program Files\Microsoft Office\Templates\1033\AdjacencyLetter.dotx id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\Program Files\Microsoft Office\Templates\1033\AdjacencyMergeLetter.dotx id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Microsoft Office\Templates\1033\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files\Microsoft SQL Server Compact Edition\cat.exe - Access
\\?\C:\Program Files\Microsoft SQL Server Compact Edition\cat.exe id-bry0hIIfVldG0S8v.BDKR MD5: 79de45cb1457cdd36c57ab2a80e65d85
SHA1: 99f925a4c6cd238a4cb7f194dbed72f1300b9dd0
SHA256: 8decab9fdbd7e9d8f3b19ffb65fb915c1aa5ebe53270ce54c224ee9639916539
SSDeep: 1536:mVCxL6tk2xhUakM1ByvzLsrkIlkj24h35VWA2nXEuPdBXekL:mVCxLX2xhUlaCnsrkIlwh35UAruPff
ImpHash: None 		Access Created File
\\?\C:\Program Files\Microsoft SQL Server Compact Edition\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files\Microsoft SQL Server Compact Edition\v3.5\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files\Microsoft SQL Server Compact Edition\v3.5\sqlceca35.dll - Access
\\?\C:\Program Files\Microsoft SQL Server Compact Edition\v3.5\sqlceca35.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Microsoft Sync Framework\v1.0\Documentation\1033\License Agreements\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files\Microsoft Sync Framework\v1.0\Documentation\1033\License Agreements\SynchronizationEula.rtf - Access
\\?\C:\Program Files\Microsoft Sync Framework\v1.0\Documentation\1033\License Agreements\SynchronizationEula.rtf id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\Program Files\Microsoft Sync Framework\v1.0\Runtime\x64\FeedSync.dll - Access
\\?\C:\Program Files\Microsoft Sync Framework\v1.0\Runtime\x64\FeedSync.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Microsoft Sync Framework\v1.0\Runtime\x64\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access Created File
\\?\C:\Program Files\Microsoft Synchronization Services\ADO.NET\v1.0\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files\Microsoft Synchronization Services\ADO.NET\v1.0\Microsoft.Synchronization.Data.dll - Access
\\?\C:\Program Files\Microsoft Synchronization Services\ADO.NET\v1.0\Microsoft.Synchronization.Data.dll id-bry0hIIfVldG0S8v.BDKR MD5: d7407bfe931489d4351b9d03ea6e939c
SHA1: a487c862ee785d8bcaab622ccadc4058e084efe3
SHA256: b278029dedc866bc7d4c47b1db91cccb0749be3a96fdf48398176dbdb7b995da
SSDeep: 3072:6iw8cKXmQiIuzKOg3N13thmQzG9Z4wKqZYl3AMu5mpL:aumQiIuzKOgDthmQzG9ZFYl3GmpL
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files\Microsoft Synchronization Services\ADO.NET\v1.0\Microsoft.Synchronization.Data.Server.dll - Access
\\?\C:\Program Files\Microsoft Synchronization Services\ADO.NET\v1.0\Microsoft.Synchronization.Data.Server.dll id-bry0hIIfVldG0S8v.BDKR MD5: 938f43829ad29314f472f03b3b6ef1de
SHA1: 82f1b23291838fd3b65b3b8efa6a39ac96db81c5
SHA256: 2baa7faeaf7d826e03bbed0d5b299e1e426d2abbc5432a349813cca062799448
SSDeep: 3072:bxTWp7hSG0mkfO/kwQXWKVHk6UZsj1xZktSjSbccSEl:b9KkJBX1VEUZktSjSbL9
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files\Microsoft Synchronization Services\ADO.NET\v1.0\Microsoft.Synchronization.Data.SqlServerCe.dll - Access
\\?\C:\Program Files\Microsoft Synchronization Services\ADO.NET\v1.0\Microsoft.Synchronization.Data.SqlServerCe.dll id-bry0hIIfVldG0S8v.BDKR MD5: 9966aa242ef248814a80d47cce4a2a83
SHA1: 64a796d090325b3c23ecaaf55c8d10a3843ff683
SHA256: 6f7cc45bf97eed7d9f2a832d9eba7d42a697b1588b70c3197ce6a4b43ea37da7
SSDeep: 1536:I3QuXLcH+cysxvL9K8KMHWmo0Zpio1UyyupZjnWnZEUxpeFmENK+eX9pr9YD:kQ6cH+0fBLo0rFaFsZzW2U3eYEmXSD
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files\Microsoft Synchronization Services\hourunexpected.exe - Access
\\?\C:\Program Files\Microsoft Synchronization Services\hourunexpected.exe id-bry0hIIfVldG0S8v.BDKR MD5: fb5d9f517f2d8eed55c434264f784edf
SHA1: 546fe9d5b88dad84dcbfe49199fe870d32985030
SHA256: 4dd34c2185ebe494409e694d5241b392ff455f8a48bee5e8105d78b79c64676a
SSDeep: 1536:cE3j/AY8KB8VMKK5/tabXIS6uVoa2crI8276l:bT5Ki/8bXJBya2cuO
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files\Microsoft Synchronization Services\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files\Microsoft Synchronization Services\sword.exe - Access
\\?\C:\Program Files\Microsoft Synchronization Services\sword.exe id-bry0hIIfVldG0S8v.BDKR MD5: 98a2d1f2b865eba3b16561b4fbde124a
SHA1: ee3562ed363c2904e5301d74189659c31afe9c4a
SHA256: 5a3789ce3ba2bb493dae79aa4be77bdab6d60b54e0e744ce2f42b11790f7abe4
SSDeep: 1536:fEaaa+K10e357/FSJ3oaotov3UyhoiXfftr4DBcSRL+8jSs/kCDC:85ajr5hQo7tofhoiXtrWBcSRL+8jFC
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\Workflow.Targets - Access
\\?\C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\Workflow.Targets id-bry0hIIfVldG0S8v.BDKR MD5: 8854cd5a5501ad02f96f0bfb5be42e55
SHA1: a4ca49dad9721c6080d147df3eff11a65c65c212
SHA256: 5dc6a962488b8a043fabbc0ae80da6ad8614bbbb68584b5599481ab27ef4db07
SSDeep: 192:lDPi6zVYYIUHAko8yt94o0BQ1v6/NVPHDdIbfazC:5Pi65YYIUgkut94/G1v6/XxICC
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\Workflow.VisualBasic.Targets - Access
\\?\C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\Workflow.VisualBasic.Targets id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access Created File
\\?\C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.Targets - Access
\\?\C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.Targets id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.VisualBasic.Targets - Access
\\?\C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.VisualBasic.Targets id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationBuildTasks.dll - Access
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationBuildTasks.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationCore.dll - Access
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationCore.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Aero.dll - Access
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Aero.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Classic.dll - Access
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Classic.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.dll - Access
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Luna.dll - Access
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Luna.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Royale.dll - Access
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Royale.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ReachFramework.dll - Access
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ReachFramework.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\FrameworkList.xml - Access
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\FrameworkList.xml id-bry0hIIfVldG0S8v.BDKR MD5: 1672d6009067a882f325133069780bc9
SHA1: 3873351bda7a074ff354dbd696e3eabc8d7f47de
SHA256: 5dc82476437d825a76f5e6f3de34bcb30d4cee10681c9061048ca6c3ab8498c1
SSDeep: 192:J+t7sCVWDtfxbQdKvjhUmDWi9EOO++SisUOWY1HTJEYCg0utC:J+trkD1FQGUmDbVO++SisUOW0JEmPtC
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.IdentityModel.dll - Access
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.IdentityModel.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.IdentityModel.Selectors.dll - Access
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.IdentityModel.Selectors.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.IO.Log.dll - Access
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.IO.Log.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Printing.dll - Access
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Printing.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Runtime.Serialization.dll - Access
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Runtime.Serialization.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.ServiceModel.dll - Access
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.ServiceModel.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Speech.dll - Access
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Speech.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.Activities.dll - Access
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.Activities.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.ComponentModel.dll - Access
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.ComponentModel.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.Runtime.dll - Access
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Workflow.Runtime.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\UIAutomationClient.dll - Access
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\UIAutomationClient.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\UIAutomationClientsideProviders.dll - Access
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\UIAutomationClientsideProviders.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\UIAutomationProvider.dll - Access
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\UIAutomationProvider.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\UIAutomationTypes.dll - Access
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\UIAutomationTypes.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\WindowsBase.dll - Access
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\WindowsBase.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\WindowsFormsIntegration.dll - Access
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\WindowsFormsIntegration.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\WinFXList.xml - Access
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\WinFXList.xml id-bry0hIIfVldG0S8v.BDKR MD5: 9016644bd719e2bfd0aafaec9b47a633
SHA1: 3d7fd3df0199bf973d3991f36fa4f4fb5b12a6a9
SHA256: 0d4a9239baf55f110f2711e20109b4a2d0449c7360a45756abe4b446673dfbac
SSDeep: 96:w3BGuV5DDsHxCUL5F8bIkIcLx8GJf+xLJrI:w3k+DDUx5OhpLqGJ8C
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access Created File
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Conversion.v3.5.dll - Access
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Conversion.v3.5.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Engine.dll - Access
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Engine.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Framework.dll - Access
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Framework.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Utilities.v3.5.dll - Access
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Utilities.v3.5.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.VisualC.STLCLR.dll - Access
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.VisualC.STLCLR.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.AddIn.Contract.dll - Access
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.AddIn.Contract.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.AddIn.dll - Access
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.AddIn.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.ComponentModel.DataAnnotations.dll - Access
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.ComponentModel.DataAnnotations.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Core.dll - Access
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Core.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.DataSetExtensions.dll - Access
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.DataSetExtensions.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Entity.Design.dll - Access
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Entity.Design.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Entity.dll - Access
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Entity.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Linq.dll - Access
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Linq.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Services.Client.dll - Access
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Services.Client.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Services.Design.dll - Access
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Services.Design.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Services.dll - Access
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Services.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.DirectoryServices.AccountManagement.dll - Access
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.DirectoryServices.AccountManagement.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Management.Instrumentation.dll - Access
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Management.Instrumentation.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Net.dll - Access
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Net.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.ServiceModel.Web.dll - Access
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.ServiceModel.Web.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Abstractions.dll - Access
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Abstractions.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.DynamicData.Design.dll - Access
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.DynamicData.Design.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.DynamicData.dll - Access
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.DynamicData.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Entity.Design.dll - Access
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Entity.Design.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Entity.dll - Access
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Entity.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Extensions.Design.dll - Access
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Extensions.Design.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Extensions.dll - Access
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Extensions.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Routing.dll - Access
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Routing.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Windows.Presentation.dll - Access
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Windows.Presentation.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.WorkflowServices.dll - Access
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.WorkflowServices.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Xml.Linq.dll - Access
\\?\C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Xml.Linq.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Uninstall Information\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files\Uninstall Information\vampire criterion.exe - Access
\\?\C:\Program Files\Uninstall Information\vampire criterion.exe id-bry0hIIfVldG0S8v.BDKR MD5: 53dbf3a72879953dcb8e1ac8b778a678
SHA1: 7e78d67937741e0bb066f8543799ddc07b1cdbd9
SHA256: dd25532a887252cf5ff9fc3bf4854071ecf03dd70b6dba034c3f5136f6deac30
SSDeep: 1536:NTYacQzuVgOm+SBv0Kswiv+CtE+1q3PNyHzkP+kCmB3ElEX:GEzu3Av0KscRPNezkP+kCk3ElEX
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files\Windows Defender\en-US\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access Created File
\\?\C:\Program Files\Windows Defender\en-US\MpAsDesc.dll.mui - Access
\\?\C:\Program Files\Windows Defender\en-US\MpAsDesc.dll.mui id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Defender\en-US\MpEvMsg.dll.mui - Access
\\?\C:\Program Files\Windows Defender\en-US\MpEvMsg.dll.mui id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Defender\en-US\MsMpRes.dll.mui - Access
\\?\C:\Program Files\Windows Defender\en-US\MsMpRes.dll.mui id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Defender\finds_lingerie_candy.exe - Access
\\?\C:\Program Files\Windows Defender\finds_lingerie_candy.exe id-bry0hIIfVldG0S8v.BDKR MD5: 950967ba1657249a4e1340bb50d2cc11
SHA1: c18d5a6edf5c5650c4d14df5ac737f94307bce2d
SHA256: 8e7be5c41647d375b950a6dd5ea278bf1ad5a9ff03dc038734082b2943153f8a
SSDeep: 1536:g4MYwS6xX43IziPXB42NPNQhyGF7toQ2vu3ru/EwzTlP:aYwf4aiPBBNCyotolu3r1ip
ImpHash: None 		Access Created File
\\?\C:\Program Files\Windows Defender\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files\Windows Defender\MpAsDesc.dll - Access
\\?\C:\Program Files\Windows Defender\MpAsDesc.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Defender\MpClient.dll - Access
\\?\C:\Program Files\Windows Defender\MpClient.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Defender\MpCmdRun.exe - Access
\\?\C:\Program Files\Windows Defender\MpCmdRun.exe id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Defender\MpCommu.dll - Access
\\?\C:\Program Files\Windows Defender\MpCommu.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Defender\MpEvMsg.dll - Access
\\?\C:\Program Files\Windows Defender\MpEvMsg.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Defender\MpOAV.dll - Access
\\?\C:\Program Files\Windows Defender\MpOAV.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Defender\MpRTP.dll - Access
\\?\C:\Program Files\Windows Defender\MpRTP.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Defender\MpSvc.dll - Access
\\?\C:\Program Files\Windows Defender\MpSvc.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Defender\MSASCui.exe - Access
\\?\C:\Program Files\Windows Defender\MSASCui.exe id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Defender\MsMpCom.dll - Access
\\?\C:\Program Files\Windows Defender\MsMpCom.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Defender\MsMpLics.dll - Access
\\?\C:\Program Files\Windows Defender\MsMpLics.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Defender\MsMpRes.dll - Access
\\?\C:\Program Files\Windows Defender\MsMpRes.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Defender\picking separated lib.exe - Access
\\?\C:\Program Files\Windows Defender\picking separated lib.exe id-bry0hIIfVldG0S8v.BDKR MD5: e509cd916aebab4db072fc364c5e1ec1
SHA1: 08be03159771efe63ba6db1f607b483695267de8
SHA256: 4e6d796716a369116216302d2eac6a2e4db64522db40ee117b986dc745f5b54d
SSDeep: 1536:sJa6dbOhr6zEN54jZm1p1MB/Fu1985VThJD27GEGWMT33SSGrT5:sJa6dahmoN5sZE1cFuLSVTI+L8
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files\Windows Journal\en-US\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files\Windows Journal\en-US\JNTFiltr.dll.mui - Access
\\?\C:\Program Files\Windows Journal\en-US\JNTFiltr.dll.mui id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Journal\en-US\jnwdui.dll.mui - Access
\\?\C:\Program Files\Windows Journal\en-US\jnwdui.dll.mui id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Journal\en-US\jnwmon.dll.mui - Access
\\?\C:\Program Files\Windows Journal\en-US\jnwmon.dll.mui id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Journal\en-US\Journal.exe.mui - Access
\\?\C:\Program Files\Windows Journal\en-US\Journal.exe.mui id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Journal\en-US\MSPVWCTL.DLL.mui - Access
\\?\C:\Program Files\Windows Journal\en-US\MSPVWCTL.DLL.mui id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Journal\en-US\NBMapTIP.dll.mui - Access
\\?\C:\Program Files\Windows Journal\en-US\NBMapTIP.dll.mui id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Journal\en-US\PDIALOG.exe.mui - Access
\\?\C:\Program Files\Windows Journal\en-US\PDIALOG.exe.mui id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Journal\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files\Windows Journal\InkSeg.dll - Access
\\?\C:\Program Files\Windows Journal\InkSeg.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Journal\JNTFiltr.dll - Access
\\?\C:\Program Files\Windows Journal\JNTFiltr.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Journal\JNWDRV.dll - Access
\\?\C:\Program Files\Windows Journal\JNWDRV.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Journal\jnwdui.dll - Access
\\?\C:\Program Files\Windows Journal\jnwdui.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Journal\jnwmon.dll - Access
\\?\C:\Program Files\Windows Journal\jnwmon.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Journal\jnwppr.dll - Access
\\?\C:\Program Files\Windows Journal\jnwppr.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Journal\Journal.exe - Access
\\?\C:\Program Files\Windows Journal\Journal.exe id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Journal\MSPVWCTL.DLL - Access
\\?\C:\Program Files\Windows Journal\MSPVWCTL.DLL id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Journal\NBDoc.DLL - Access
\\?\C:\Program Files\Windows Journal\NBDoc.DLL id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Journal\NBMapTIP.dll - Access
\\?\C:\Program Files\Windows Journal\NBMapTIP.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Journal\PDIALOG.exe - Access
\\?\C:\Program Files\Windows Journal\PDIALOG.exe id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Journal\Templates\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files\Windows Mail\en-US\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files\Windows Mail\en-US\msoeres.dll.mui - Access
\\?\C:\Program Files\Windows Mail\en-US\msoeres.dll.mui id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Mail\en-US\WinMail.exe.mui - Access
\\?\C:\Program Files\Windows Mail\en-US\WinMail.exe.mui id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Mail\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files\Windows Mail\msoe.dll - Access
\\?\C:\Program Files\Windows Mail\msoe.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Mail\MSOERES.dll - Access
\\?\C:\Program Files\Windows Mail\MSOERES.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Mail\oeimport.dll - Access
\\?\C:\Program Files\Windows Mail\oeimport.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Mail\sims.exe - Access
\\?\C:\Program Files\Windows Mail\sims.exe id-bry0hIIfVldG0S8v.BDKR MD5: 96da6101cb717108db4137fffd606bcf
SHA1: ed8f586365be0f73dc3abd76991eb97ee36b5373
SHA256: 8cc69e7dd8bfb8ec26283fba407f1cd2698bd12f76b64f1e5d6658683c397f83
SSDeep: 1536:xcUopVBe7mI+mGyHX/lnGryqLFKS6YbuUhct8YG1QVQ8VMV:x16074yPutBb/hcf1VQ+C
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files\Windows Mail\wab.exe - Access
\\?\C:\Program Files\Windows Mail\wab.exe id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Mail\wabfind.dll - Access
\\?\C:\Program Files\Windows Mail\wabfind.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Mail\wabimp.dll - Access
\\?\C:\Program Files\Windows Mail\wabimp.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Mail\wabmig.exe - Access
\\?\C:\Program Files\Windows Mail\wabmig.exe id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Mail\WinMail.exe - Access
\\?\C:\Program Files\Windows Mail\WinMail.exe id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Media Player\en-US\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access Created File
\\?\C:\Program Files\Windows Media Player\en-US\mpvis.dll.mui - Access
\\?\C:\Program Files\Windows Media Player\en-US\mpvis.dll.mui id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Media Player\en-US\setup_wm.exe.mui - Access
\\?\C:\Program Files\Windows Media Player\en-US\setup_wm.exe.mui id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Media Player\en-US\wmlaunch.exe.mui - Access
\\?\C:\Program Files\Windows Media Player\en-US\wmlaunch.exe.mui id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Media Player\en-US\WMPDMC.exe.mui - Access
\\?\C:\Program Files\Windows Media Player\en-US\WMPDMC.exe.mui id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Media Player\en-US\WMPDMCCore.dll.mui - Access
\\?\C:\Program Files\Windows Media Player\en-US\WMPDMCCore.dll.mui id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Media Player\en-US\wmplayer.exe.mui - Access
\\?\C:\Program Files\Windows Media Player\en-US\wmplayer.exe.mui id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Media Player\en-US\WMPMediaSharing.dll.mui - Access
\\?\C:\Program Files\Windows Media Player\en-US\WMPMediaSharing.dll.mui id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Media Player\en-US\wmpnetwk.exe.mui - Access
\\?\C:\Program Files\Windows Media Player\en-US\wmpnetwk.exe.mui id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Media Player\en-US\wmpnscfg.exe.mui - Access
\\?\C:\Program Files\Windows Media Player\en-US\wmpnscfg.exe.mui id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Media Player\en-US\wmpnssci.dll.mui - Access
\\?\C:\Program Files\Windows Media Player\en-US\wmpnssci.dll.mui id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Media Player\en-US\wmpnssui.dll.mui - Access
\\?\C:\Program Files\Windows Media Player\en-US\wmpnssui.dll.mui id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Media Player\en-US\WMPSideShowGadget.exe.mui - Access
\\?\C:\Program Files\Windows Media Player\en-US\WMPSideShowGadget.exe.mui id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Media Player\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files\Windows Media Player\Media Renderer\avtransport.xml - Access
\\?\C:\Program Files\Windows Media Player\Media Renderer\avtransport.xml id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Media Player\Media Renderer\connectionmanager_dmr.xml - Access
\\?\C:\Program Files\Windows Media Player\Media Renderer\connectionmanager_dmr.xml id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Media Player\Media Renderer\DMR_120.jpg - Access
\\?\C:\Program Files\Windows Media Player\Media Renderer\DMR_120.jpg id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Media Player\Media Renderer\DMR_120.png - Access
\\?\C:\Program Files\Windows Media Player\Media Renderer\DMR_120.png id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Media Player\Media Renderer\DMR_48.jpg - Access
\\?\C:\Program Files\Windows Media Player\Media Renderer\DMR_48.jpg id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Media Player\Media Renderer\DMR_48.png - Access
\\?\C:\Program Files\Windows Media Player\Media Renderer\DMR_48.png id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Media Player\Media Renderer\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access Created File
\\?\C:\Program Files\Windows Media Player\Media Renderer\RenderingControl.xml - Access
\\?\C:\Program Files\Windows Media Player\Media Renderer\RenderingControl.xml id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Media Player\mpvis.DLL - Access
\\?\C:\Program Files\Windows Media Player\mpvis.DLL id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Media Player\Network Sharing\ConnectionManager.xml - Access
\\?\C:\Program Files\Windows Media Player\Network Sharing\ConnectionManager.xml id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Media Player\Network Sharing\ContentDirectory.xml - Access
\\?\C:\Program Files\Windows Media Player\Network Sharing\ContentDirectory.xml id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Media Player\Network Sharing\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files\Windows Media Player\Network Sharing\MediaReceiverRegistrar.xml - Access
\\?\C:\Program Files\Windows Media Player\Network Sharing\MediaReceiverRegistrar.xml id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Media Player\Network Sharing\wmpnss_bw120.jpg - Access
\\?\C:\Program Files\Windows Media Player\Network Sharing\wmpnss_bw120.jpg id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Media Player\Network Sharing\wmpnss_bw120.png - Access
\\?\C:\Program Files\Windows Media Player\Network Sharing\wmpnss_bw120.png id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Media Player\Network Sharing\wmpnss_bw32.bmp - Access
\\?\C:\Program Files\Windows Media Player\Network Sharing\wmpnss_bw32.bmp id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Media Player\Network Sharing\wmpnss_bw32.jpg - Access
\\?\C:\Program Files\Windows Media Player\Network Sharing\wmpnss_bw32.jpg id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Media Player\Network Sharing\wmpnss_bw48.bmp - Access
\\?\C:\Program Files\Windows Media Player\Network Sharing\wmpnss_bw48.bmp id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Media Player\Network Sharing\wmpnss_bw48.jpg - Access
\\?\C:\Program Files\Windows Media Player\Network Sharing\wmpnss_bw48.jpg id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Media Player\Network Sharing\wmpnss_bw48.png - Access
\\?\C:\Program Files\Windows Media Player\Network Sharing\wmpnss_bw48.png id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color120.jpg - Access
\\?\C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color120.jpg id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color120.png - Access
\\?\C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color120.png id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color32.bmp - Access
\\?\C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color32.bmp id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color32.jpg - Access
\\?\C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color32.jpg id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color48.bmp - Access
\\?\C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color48.bmp id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color48.jpg - Access
\\?\C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color48.jpg id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color48.png - Access
\\?\C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color48.png id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Media Player\sentence-arrive-unnecessary.exe - Access
\\?\C:\Program Files\Windows Media Player\sentence-arrive-unnecessary.exe id-bry0hIIfVldG0S8v.BDKR MD5: 413b407e077da9fa9c741c0493ab8a2e
SHA1: 1209f72ea4aa883ec51867dda7a389ee7bda16c9
SHA256: 252cb1534778d4fefe3da49ea3336a8efb94a0ec0a7d087fdc6a8e1513d1a335
SSDeep: 1536:JYIZRHHoESmuinEy1kWOWbi48X7vQech14tY:JZHHoESmuiEy13aDIeY14q
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files\Windows Media Player\setup_wm.exe - Access
\\?\C:\Program Files\Windows Media Player\setup_wm.exe id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Media Player\Skins\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files\Windows Media Player\Skins\Revert.wmz - Access
\\?\C:\Program Files\Windows Media Player\Skins\Revert.wmz id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Media Player\wmlaunch.exe - Access
\\?\C:\Program Files\Windows Media Player\wmlaunch.exe id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Media Player\wmpconfig.exe - Access
\\?\C:\Program Files\Windows Media Player\wmpconfig.exe id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Media Player\WMPDMC.exe - Access
\\?\C:\Program Files\Windows Media Player\WMPDMC.exe id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Media Player\WMPDMCCore.dll - Access
\\?\C:\Program Files\Windows Media Player\WMPDMCCore.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Media Player\wmpenc.exe - Access
\\?\C:\Program Files\Windows Media Player\wmpenc.exe id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Media Player\wmplayer.exe - Access
\\?\C:\Program Files\Windows Media Player\wmplayer.exe id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Media Player\WMPMediaSharing.dll - Access
\\?\C:\Program Files\Windows Media Player\WMPMediaSharing.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Media Player\wmpnetwk.exe - Access
\\?\C:\Program Files\Windows Media Player\wmpnetwk.exe id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Media Player\wmpnscfg.exe - Access
\\?\C:\Program Files\Windows Media Player\wmpnscfg.exe id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Media Player\wmpnssci.dll - Access
\\?\C:\Program Files\Windows Media Player\wmpnssci.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Media Player\WMPNSSUI.dll - Access
\\?\C:\Program Files\Windows Media Player\WMPNSSUI.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Media Player\wmprph.exe - Access
\\?\C:\Program Files\Windows Media Player\wmprph.exe id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Media Player\wmpshare.exe - Access
\\?\C:\Program Files\Windows Media Player\wmpshare.exe id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Media Player\WMPSideShowGadget.exe - Access
\\?\C:\Program Files\Windows Media Player\WMPSideShowGadget.exe id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows NT\Accessories\en-US\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files\Windows NT\Accessories\en-US\wordpad.exe.mui - Access
\\?\C:\Program Files\Windows NT\Accessories\en-US\wordpad.exe.mui id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows NT\Accessories\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files\Windows NT\Accessories\wordpad.exe - Access
\\?\C:\Program Files\Windows NT\Accessories\wordpad.exe id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows NT\Accessories\WordpadFilter.dll - Access
\\?\C:\Program Files\Windows NT\Accessories\WordpadFilter.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows NT\TableTextService\en-US\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access Created File
\\?\C:\Program Files\Windows NT\TableTextService\en-US\TableTextService.dll.mui - Access
\\?\C:\Program Files\Windows NT\TableTextService\en-US\TableTextService.dll.mui id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows NT\TableTextService\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files\Windows NT\TableTextService\TableTextService.dll - Access
\\?\C:\Program Files\Windows NT\TableTextService\TableTextService.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows NT\TableTextService\TableTextServiceAmharic.txt - Access
\\?\C:\Program Files\Windows NT\TableTextService\TableTextServiceAmharic.txt id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows NT\TableTextService\TableTextServiceArray.txt - Access
\\?\C:\Program Files\Windows NT\TableTextService\TableTextServiceArray.txt id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows NT\TableTextService\TableTextServiceDaYi.txt - Access
\\?\C:\Program Files\Windows NT\TableTextService\TableTextServiceDaYi.txt id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows NT\TableTextService\TableTextServiceSimplifiedQuanPin.txt - Access
\\?\C:\Program Files\Windows NT\TableTextService\TableTextServiceSimplifiedQuanPin.txt id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows NT\TableTextService\TableTextServiceSimplifiedShuangPin.txt - Access
\\?\C:\Program Files\Windows NT\TableTextService\TableTextServiceSimplifiedShuangPin.txt id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows NT\TableTextService\TableTextServiceSimplifiedZhengMa.txt - Access
\\?\C:\Program Files\Windows NT\TableTextService\TableTextServiceSimplifiedZhengMa.txt id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows NT\TableTextService\TableTextServiceYi.txt - Access
\\?\C:\Program Files\Windows NT\TableTextService\TableTextServiceYi.txt id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Photo Viewer\en-US\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access Created File
\\?\C:\Program Files\Windows Photo Viewer\en-US\ImagingDevices.exe.mui - Access
\\?\C:\Program Files\Windows Photo Viewer\en-US\ImagingDevices.exe.mui id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Photo Viewer\en-US\PhotoAcq.dll.mui - Access
\\?\C:\Program Files\Windows Photo Viewer\en-US\PhotoAcq.dll.mui id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Photo Viewer\en-US\PhotoViewer.dll.mui - Access
\\?\C:\Program Files\Windows Photo Viewer\en-US\PhotoViewer.dll.mui id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Photo Viewer\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files\Windows Photo Viewer\ImagingDevices.exe - Access
\\?\C:\Program Files\Windows Photo Viewer\ImagingDevices.exe id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Photo Viewer\ImagingEngine.dll - Access
\\?\C:\Program Files\Windows Photo Viewer\ImagingEngine.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Photo Viewer\PhotoAcq.dll - Access
\\?\C:\Program Files\Windows Photo Viewer\PhotoAcq.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Photo Viewer\PhotoBase.dll - Access
\\?\C:\Program Files\Windows Photo Viewer\PhotoBase.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Photo Viewer\PhotoViewer.dll - Access
\\?\C:\Program Files\Windows Photo Viewer\PhotoViewer.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Portable Devices\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files\Windows Portable Devices\sqmapi.dll - Access
\\?\C:\Program Files\Windows Portable Devices\sqmapi.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Sidebar\en-US\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files\Windows Sidebar\en-US\sbdrop.dll.mui - Access
\\?\C:\Program Files\Windows Sidebar\en-US\sbdrop.dll.mui id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Sidebar\en-US\Sidebar.exe.mui - Access
\\?\C:\Program Files\Windows Sidebar\en-US\Sidebar.exe.mui id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\drag.png - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\drag.png id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\calendar.html - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\calendar.html id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\css\calendar.css - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\css\calendar.css id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\css\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\gadget.xml - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\gadget.xml id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\js\calendar.js - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\js\calendar.js id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\js\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access Created File
\\?\C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\icon.png - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\icon.png id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\logo.png - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\logo.png id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\drag.png - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\drag.png id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\How To Restore Files.txt - Access, Write
\\?\C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access Created File
\\?\C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\icon.png - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\icon.png id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\How To Restore Files.txt - Access, Write
\\?\C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\logo.png - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\logo.png id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\drag.png - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\drag.png id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\en-US\css\How To Restore Files.txt - Access, Write
\\?\C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\en-US\How To Restore Files.txt - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\en-US\js\How To Restore Files.txt - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\icon.png - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\icon.png id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\images\How To Restore Files.txt - Access, Write
\\?\C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\drag.png - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\drag.png id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\en-US\css\How To Restore Files.txt - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\en-US\How To Restore Files.txt - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\en-US\js\How To Restore Files.txt - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access Created File
\\?\C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\icon.png - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\icon.png id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\How To Restore Files.txt - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\logo.png - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\logo.png id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\css\flyout.css - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\css\flyout.css id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\css\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\css\main.css - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\css\main.css id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\css\settings.css - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\css\settings.css id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\en-US\gadget.xml - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\en-US\gadget.xml id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\en-US\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\flyout.html - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\flyout.html id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access Created File
\\?\C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\How To Restore Files.txt - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\js\How To Restore Files.txt - Access, Write
\\?\C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\main.html - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\main.html id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\MCESidebarCtrl.dll - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\MCESidebarCtrl.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\settings.html - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\settings.html id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\drag.png - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\drag.png id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\css\How To Restore Files.txt - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\How To Restore Files.txt - Access, Write
\\?\C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\js\How To Restore Files.txt - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access Created File
\\?\C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\icon.png - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\icon.png id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\How To Restore Files.txt - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\logo.png - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\logo.png id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\drag.png - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\drag.png id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\css\How To Restore Files.txt - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\How To Restore Files.txt - Access, Write
\\?\C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\js\How To Restore Files.txt - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\icon.png - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\icon.png id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\How To Restore Files.txt - Access, Write
\\?\C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\drag.png - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\drag.png id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\css\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access Created File
\\?\C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\css\settings.css - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\css\settings.css id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\css\slideShow.css - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\css\slideShow.css id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\gadget.xml - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\gadget.xml id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\js\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\js\slideShow.js - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\js\slideShow.js id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\settings.html - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\settings.html id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\slideShow.html - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\slideShow.html id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\icon.png - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\icon.png id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\blank.png - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\blank.png id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\in_sidebar\bg_sidebar.png - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\in_sidebar\bg_sidebar.png id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\in_sidebar\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access Created File
\\?\C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\in_sidebar\slideshow_glass_frame.png - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\in_sidebar\slideshow_glass_frame.png id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\next_down.png - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\next_down.png id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\next_hov.png - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\next_hov.png id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\next_rest.png - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\next_rest.png id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\on_desktop\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\on_desktop\slideshow_glass_frame.png - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\on_desktop\slideshow_glass_frame.png id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\pause_down.png - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\pause_down.png id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\pause_hov.png - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\pause_hov.png id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\pause_rest.png - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\pause_rest.png id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\play_down.png - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\play_down.png id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\play_hov.png - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\play_hov.png id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\play_rest.png - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\play_rest.png id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\prev_down.png - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\prev_down.png id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\prev_hov.png - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\prev_hov.png id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\prev_rest.png - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\prev_rest.png id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\reveal_down.png - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\reveal_down.png id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\reveal_hov.png - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\reveal_hov.png id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\reveal_rest.png - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\reveal_rest.png id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\Tulip.jpg - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\Tulip.jpg id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\logo.png - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\logo.png id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\drag.png - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\drag.png id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\css\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\gadget.xml - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\gadget.xml id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\js\How To Restore Files.txt - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\settings.html - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\settings.html id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\weather.html - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\weather.html id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\icon.png - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\icon.png id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\120DPI\How To Restore Files.txt - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\144DPI\How To Restore Files.txt - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\How To Restore Files.txt - Access, Write
\\?\C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\logo.png - Access
\\?\C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\logo.png id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Sidebar\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files\Windows Sidebar\sbdrop.dll - Access
\\?\C:\Program Files\Windows Sidebar\sbdrop.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Sidebar\settings.ini - Access
\\?\C:\Program Files\Windows Sidebar\settings.ini id-bry0hIIfVldG0S8v.BDKR MD5: 9767e41441f36496be4a9c9e32de8768
SHA1: 19ded89b60d64f5394192c48e5eb8714b00c7ae3
SHA256: 2a67da9084f6aaf25fffcc85ae4716da74bb137d3be6dca504c6fbd0294f2440
SSDeep: 24:c4lyDkWFfVyt7A9KMYVP3NY3z3m8MGQ2bkRyIa58rlzgBbKW5WcGII:1EkWFQq4YJI+8rlf4I
ImpHash: None 		Access, Write Created File
\\?\C:\Program Files\Windows Sidebar\sidebar.exe - Access
\\?\C:\Program Files\Windows Sidebar\sidebar.exe id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Program Files\Windows Sidebar\wlsrvc.dll - Access
\\?\C:\Program Files\Windows Sidebar\wlsrvc.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\ProgramData\Adobe\Acrobat\10.0\Replicate\Security\directories.acrodata - Access
\\?\C:\ProgramData\Adobe\Acrobat\10.0\Replicate\Security\directories.acrodata id-bry0hIIfVldG0S8v.BDKR MD5: 1950e3843c283f6f4cda859584f89fe6
SHA1: 8ddb6d5c169cab371a89dd178a848f4fbb956b00
SHA256: f51521e564fa813acecbbf3474469d60f0198a5000c4f4b90275be24707dd3f6
SSDeep: 24:dZbM0f7RRYcpYsiNPE7Zhg+FWRyt7A9KMYVP3NY3z3m8MGQ2bkRyIa58rlzgBbKX:n5bYTahHTq4YJI+8rlf4I
ImpHash: None 		Access, Write Created File
\\?\C:\ProgramData\Adobe\Acrobat\10.0\Replicate\Security\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access Created File
\\?\C:\ProgramData\Adobe\ARM\Reader_10.0.0\AdbeRdrSecUpd10111.msp - Access
\\?\C:\ProgramData\Adobe\ARM\Reader_10.0.0\AdbeRdrSecUpd10111.msp id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\ProgramData\Adobe\ARM\Reader_10.0.0\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access Created File
\\?\C:\ProgramData\Microsoft Help\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access Created File
\\?\C:\ProgramData\Microsoft Help\Hx.hxn - Access
\\?\C:\ProgramData\Microsoft Help\Hx.hxn id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\ProgramData\Microsoft\Assistance\Client\1.0\en-US\Help_CValidator.H1D - Access
\\?\C:\ProgramData\Microsoft\Assistance\Client\1.0\en-US\Help_CValidator.H1D id-bry0hIIfVldG0S8v.BDKR MD5: 145be59dbc75725b9f2a17ce0f75078c
SHA1: bb25e1e50c4345a7d17448dd059d2f9b47eb83c0
SHA256: 7395078e61ab27aceea6f2bace6d1d289b7956f1dbab81416be0b37aa0ee270e
SSDeep: 192:jkek6eJtz/nYAQ4fuw6+b3LGfeAKb3N1trHasPbowFSkQOU+MoRH3phN/kY2oX+x:jktDTQcBfLgiHasD1ll5vvXDwOC
ImpHash: None 		Access, Write Created File
\\?\C:\ProgramData\Microsoft\Assistance\Client\1.0\en-US\Help_MKWD_BestBet.H1W id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\ProgramData\Microsoft\Assistance\Client\1.0\en-US\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\d42cc0c3858a58db2db37658219e6400_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\How To Restore Files.txt - Access, Write
\\?\C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\How To Restore Files.txt - Access
\\?\C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\How To Restore Files.txt - Access
\\?\C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-US\How To Restore Files.txt - Access, Write
\\?\C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\How To Restore Files.txt - Access, Write
\\?\C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-US\How To Restore Files.txt - Access
\\?\C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\How To Restore Files.txt - Access
\\?\C:\ProgramData\Microsoft\IdentityCRL\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\ProgramData\Microsoft\IdentityCRL\ppcrlconfig.dll - Access
\\?\C:\ProgramData\Microsoft\IdentityCRL\ppcrlconfig.dll id-bry0hIIfVldG0S8v.BDKR MD5: 97be1a9fec336f02d06bc061ae389ad6
SHA1: 48217593c999fc6fc26e5d227d986ff6e6076b6f
SHA256: 0088df61a66fbc79388a960462aa3f89a834b0bb388124e05870e8e5f243dc7b
SSDeep: 384:pZt1Z5wF8PA2x4opqq6kgW8b2D9VV1+eRnWVuuoyXC:Lt1wep4op6kgrI3HWI7x
ImpHash: None 		Access Modified File
\\?\C:\ProgramData\Microsoft\IdentityCRL\ppcrlui.dll - Access
\\?\C:\ProgramData\Microsoft\IdentityCRL\ppcrlui.dll id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\ProgramData\Microsoft\MF\Active.GRL - Access
\\?\C:\ProgramData\Microsoft\MF\Active.GRL id-bry0hIIfVldG0S8v.BDKR MD5: 4bc309961dd2428090d87ccd3ffd2e1b
SHA1: ae878fa268282c2be0f724df950551d074b3eb36
SHA256: 9b53d585a6de733703b9fe9f90b6aecc397b2a71f93a937d3c6dfa3d1d205b83
SSDeep: 384:lM+xFkq6+8Bd4Bi9zysqMPPhORPAk9pt8pbseRe9+v5NOmLC:OoFkqJBqzrRwTztibsA5hNOz
ImpHash: None 		Access Modified File
\\?\C:\ProgramData\Microsoft\MF\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\ProgramData\Microsoft\MF\Pending.GRL - Access
\\?\C:\ProgramData\Microsoft\MF\Pending.GRL id-bry0hIIfVldG0S8v.BDKR MD5: 074009f5a5fc2de61e8e8e2f8dc3443f
SHA1: 4fd80c091a9f6ac04458d9935b654d4dc4c39f7b
SHA256: 0a9577dc38f41e7afe2c600110a5e3c75d8760a3373c6a79e0b082c6617e3895
SSDeep: 384:/w4Ztph9QsDb9l2WlWn8lSDOngkY/JP6uHVme2+y1MXD6C:/xLlWn8le34KVme2+TXDD
ImpHash: None 		Access, Write Created File
\\?\C:\ProgramData\Microsoft\Network\Downloader\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\ProgramData\Microsoft\Network\Downloader\qmgr0.dat - Access
\\?\C:\ProgramData\Microsoft\Network\Downloader\qmgr0.dat id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\ProgramData\Microsoft\OFFICE\AssetLibrary.ico - Access
\\?\C:\ProgramData\Microsoft\OFFICE\AssetLibrary.ico id-bry0hIIfVldG0S8v.BDKR MD5: 7d17d933e11a9df9b0b91d6255f17edd
SHA1: 0c8c12a25cdac091570c61cad4397c8f58363458
SHA256: d80b778b9b408819497661d242ee757b5ba927ee5d4f945e52507ff0fbf19bb5
SSDeep: 96:Ri6LMduVF3fIbGpgHuc9FFsxznbMG7AGNNLd91JYFdhjWJyGtLJrI:RLLBVBwbeTacbYG7VTd9qqpC
ImpHash: None 		Access Created File
\\?\C:\ProgramData\Microsoft\OFFICE\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\ProgramData\Microsoft\OfficeSoftwareProtectionPlatform\Cache\cache.dat id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\ProgramData\Microsoft\OfficeSoftwareProtectionPlatform\Cache\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\ProgramData\Microsoft\OfficeSoftwareProtectionPlatform\How To Restore Files.txt - Access, Write
\\?\C:\ProgramData\Microsoft\RAC\PublishedData\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\ProgramData\Microsoft\RAC\PublishedData\RacWmiDatabase.sdf - Access
\\?\C:\ProgramData\Microsoft\RAC\PublishedData\RacWmiDatabase.sdf id-bry0hIIfVldG0S8v.BDKR MD5: 09ae3f0f598872f00f4b09407cc9132a
SHA1: 98fa056002b6ceba880459e1152863fa5e6c78eb
SHA256: e41b8aa6bef3a0d6ba1b22b1ef9321c319f927a360b8aa7a0b428070e670cc86
SSDeep: 3072:84CmlxEid2mtXGt0dttAgFvvTz6/mluPQmFi8uGYzB4l1fyu0tmnru1J:8reJt2edsgFnXsKuPQn8uGYzSPqu0MrI
ImpHash: None 		Access Modified File
\\?\C:\ProgramData\Microsoft\RAC\StateData\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access Created File
\\?\C:\ProgramData\Microsoft\RAC\StateData\RacDatabase.sdf - Access
\\?\C:\ProgramData\Microsoft\RAC\StateData\RacDatabase.sdf id-bry0hIIfVldG0S8v.BDKR MD5: 52756a195b152b14449c60db092b8676
SHA1: fcd5b4c29b99db3764da47e760fc2d9831f8d60c
SHA256: 35f384b411811d3fdf9a2393a237b1e0edc4edf182b3f78f7069937355e4fbc2
SSDeep: 12288:IhTIxpIbYp/BZoUWA7ABonajEnr47+SVW3CRdkSlU/XTtAc:RpIbHUWA7AB5d7KCLbyKc
ImpHash: None 		Access Modified File
\\?\C:\ProgramData\Microsoft\RAC\Temp\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access Created File
\\?\C:\ProgramData\Microsoft\RAC\Temp\sql65A4.tmp - Access
\\?\C:\ProgramData\Microsoft\RAC\Temp\sql65A4.tmp id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\ProgramData\Microsoft\RAC\Temp\sql65F3.tmp - Access
\\?\C:\ProgramData\Microsoft\RAC\Temp\sql65F3.tmp id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\ProgramData\Microsoft\User Account Pictures\Default Pictures\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\ProgramData\Microsoft\User Account Pictures\Default Pictures\usertile10.bmp - Access
\\?\C:\ProgramData\Microsoft\User Account Pictures\Default Pictures\usertile10.bmp id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\ProgramData\Microsoft\User Account Pictures\Default Pictures\usertile11.bmp - Access
\\?\C:\ProgramData\Microsoft\User Account Pictures\Default Pictures\usertile11.bmp id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\ProgramData\Microsoft\User Account Pictures\Default Pictures\usertile12.bmp - Access
\\?\C:\ProgramData\Microsoft\User Account Pictures\Default Pictures\usertile12.bmp id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\ProgramData\Microsoft\User Account Pictures\Default Pictures\usertile13.bmp - Access
\\?\C:\ProgramData\Microsoft\User Account Pictures\Default Pictures\usertile13.bmp id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\ProgramData\Microsoft\User Account Pictures\Default Pictures\usertile14.bmp - Access
\\?\C:\ProgramData\Microsoft\User Account Pictures\Default Pictures\usertile14.bmp id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\ProgramData\Microsoft\User Account Pictures\Default Pictures\usertile15.bmp - Access
\\?\C:\ProgramData\Microsoft\User Account Pictures\Default Pictures\usertile15.bmp id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\ProgramData\Microsoft\User Account Pictures\Default Pictures\usertile16.bmp - Access
\\?\C:\ProgramData\Microsoft\User Account Pictures\Default Pictures\usertile16.bmp id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\ProgramData\Microsoft\User Account Pictures\Default Pictures\usertile17.bmp - Access
\\?\C:\ProgramData\Microsoft\User Account Pictures\Default Pictures\usertile17.bmp id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\ProgramData\Microsoft\User Account Pictures\Default Pictures\usertile18.bmp - Access
\\?\C:\ProgramData\Microsoft\User Account Pictures\Default Pictures\usertile18.bmp id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\ProgramData\Microsoft\User Account Pictures\Default Pictures\usertile19.bmp - Access
\\?\C:\ProgramData\Microsoft\User Account Pictures\Default Pictures\usertile19.bmp id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\ProgramData\Microsoft\User Account Pictures\Default Pictures\usertile20.bmp - Access
\\?\C:\ProgramData\Microsoft\User Account Pictures\Default Pictures\usertile20.bmp id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\ProgramData\Microsoft\User Account Pictures\Default Pictures\usertile21.bmp - Access
\\?\C:\ProgramData\Microsoft\User Account Pictures\Default Pictures\usertile21.bmp id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\ProgramData\Microsoft\User Account Pictures\Default Pictures\usertile22.bmp - Access
\\?\C:\ProgramData\Microsoft\User Account Pictures\Default Pictures\usertile22.bmp id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\ProgramData\Microsoft\User Account Pictures\Default Pictures\usertile23.bmp - Access
\\?\C:\ProgramData\Microsoft\User Account Pictures\Default Pictures\usertile23.bmp id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\ProgramData\Microsoft\User Account Pictures\Default Pictures\usertile24.bmp - Access
\\?\C:\ProgramData\Microsoft\User Account Pictures\Default Pictures\usertile24.bmp id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\ProgramData\Microsoft\User Account Pictures\Default Pictures\usertile25.bmp - Access
\\?\C:\ProgramData\Microsoft\User Account Pictures\Default Pictures\usertile25.bmp id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\ProgramData\Microsoft\User Account Pictures\Default Pictures\usertile26.bmp - Access
\\?\C:\ProgramData\Microsoft\User Account Pictures\Default Pictures\usertile26.bmp id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\ProgramData\Microsoft\User Account Pictures\Default Pictures\usertile27.bmp - Access
\\?\C:\ProgramData\Microsoft\User Account Pictures\Default Pictures\usertile27.bmp id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\ProgramData\Microsoft\User Account Pictures\Default Pictures\usertile28.bmp - Access
\\?\C:\ProgramData\Microsoft\User Account Pictures\Default Pictures\usertile28.bmp id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\ProgramData\Microsoft\User Account Pictures\Default Pictures\usertile29.bmp - Access
\\?\C:\ProgramData\Microsoft\User Account Pictures\Default Pictures\usertile29.bmp id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\ProgramData\Microsoft\User Account Pictures\Default Pictures\usertile30.bmp - Access
\\?\C:\ProgramData\Microsoft\User Account Pictures\Default Pictures\usertile30.bmp id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\ProgramData\Microsoft\User Account Pictures\Default Pictures\usertile31.bmp - Access
\\?\C:\ProgramData\Microsoft\User Account Pictures\Default Pictures\usertile31.bmp id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\ProgramData\Microsoft\User Account Pictures\Default Pictures\usertile32.bmp - Access
\\?\C:\ProgramData\Microsoft\User Account Pictures\Default Pictures\usertile32.bmp id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\ProgramData\Microsoft\User Account Pictures\Default Pictures\usertile33.bmp - Access
\\?\C:\ProgramData\Microsoft\User Account Pictures\Default Pictures\usertile33.bmp id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\ProgramData\Microsoft\User Account Pictures\Default Pictures\usertile34.bmp - Access
\\?\C:\ProgramData\Microsoft\User Account Pictures\Default Pictures\usertile34.bmp id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\ProgramData\Microsoft\User Account Pictures\Default Pictures\usertile35.bmp - Access
\\?\C:\ProgramData\Microsoft\User Account Pictures\Default Pictures\usertile35.bmp id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\ProgramData\Microsoft\User Account Pictures\Default Pictures\usertile36.bmp - Access
\\?\C:\ProgramData\Microsoft\User Account Pictures\Default Pictures\usertile36.bmp id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\ProgramData\Microsoft\User Account Pictures\Default Pictures\usertile37.bmp - Access
\\?\C:\ProgramData\Microsoft\User Account Pictures\Default Pictures\usertile37.bmp id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\ProgramData\Microsoft\User Account Pictures\Default Pictures\usertile38.bmp - Access
\\?\C:\ProgramData\Microsoft\User Account Pictures\Default Pictures\usertile38.bmp id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\ProgramData\Microsoft\User Account Pictures\Default Pictures\usertile39.bmp - Access
\\?\C:\ProgramData\Microsoft\User Account Pictures\Default Pictures\usertile39.bmp id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\ProgramData\Microsoft\User Account Pictures\Default Pictures\usertile40.bmp - Access
\\?\C:\ProgramData\Microsoft\User Account Pictures\Default Pictures\usertile40.bmp id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\ProgramData\Microsoft\User Account Pictures\Default Pictures\usertile41.bmp - Access
\\?\C:\ProgramData\Microsoft\User Account Pictures\Default Pictures\usertile41.bmp id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\ProgramData\Microsoft\User Account Pictures\Default Pictures\usertile42.bmp - Access
\\?\C:\ProgramData\Microsoft\User Account Pictures\Default Pictures\usertile42.bmp id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\ProgramData\Microsoft\User Account Pictures\Default Pictures\usertile43.bmp - Access
\\?\C:\ProgramData\Microsoft\User Account Pictures\Default Pictures\usertile43.bmp id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\ProgramData\Microsoft\User Account Pictures\Default Pictures\usertile44.bmp - Access
\\?\C:\ProgramData\Microsoft\User Account Pictures\Default Pictures\usertile44.bmp id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\ProgramData\Microsoft\User Account Pictures\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access Created File
\\?\C:\ProgramData\Microsoft\User Account Pictures\user.bmp id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access Created File
\\?\C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\mpasbase.vdm - Access
\\?\C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\mpasbase.vdm id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\mpasdlta.vdm - Access
\\?\C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\mpasdlta.vdm id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\ProgramData\Microsoft\Windows Defender\Scans\History\CacheManager\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access Created File
\\?\C:\ProgramData\Microsoft\Windows Defender\Scans\History\CacheManager\MpSfc.bin - Access
\\?\C:\ProgramData\Microsoft\Windows Defender\Scans\History\CacheManager\MpSfc.bin id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\ProgramData\Microsoft\Windows Defender\Scans\History\Results\Resource\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\ProgramData\Microsoft\Windows Defender\Scans\History\Results\Resource\{1D1DBF3A-752F-47E2-BE70-D848D4A9AFB0} - Access
\\?\C:\ProgramData\Microsoft\Windows Defender\Scans\History\Results\Resource\{1D1DBF3A-752F-47E2-BE70-D848D4A9AFB0} id-bry0hIIfVldG0S8v.BDKR MD5: 2c67c4781bcad69a3116cea4b7f2e3cd
SHA1: d1cf114f74b9c6e2809c52d52ce1a15ebd19ecf3
SHA256: e3ffa39e4717797df588278141dbdc9ff62da0f9638d2155bb1a737303e10bc1
SSDeep: 192:OyZtBI2QWxSn98KDRK0hcRZpDA+Cs2qPdUm4UYm2ABMKC:b7BpN898KDXC1DA+CtqqmsmMKC
ImpHash: None 		Access, Write Created File
\\?\C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\Unknown.Log - Access
\\?\C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\Unknown.Log id-bry0hIIfVldG0S8v.BDKR MD5: 3a28f312d8a33ffc5dd145b01de98a2c
SHA1: 3b63db53608a241a4b591c449afe3a6381fa75df
SHA256: ae5ec292e88e75d469613756b488ead3ed98c7ae91654a208529a463abcba478
SSDeep: 192:LAdtZ1IZMft+Sm3xwpmKGsB8Zd0e+uKUn56C:LSb1Iql+SAMmKGsB8Zie+uKCAC
ImpHash: None 		Access, Write Created File
\\?\C:\ProgramData\Microsoft\Windows Defender\Support\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\ProgramData\Microsoft\Windows Defender\Support\MPLog-07132009-221054.log - Access
\\?\C:\ProgramData\Microsoft\Windows Defender\Support\MPLog-07132009-221054.log id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\ProgramData\Microsoft\Windows NT\MSFax\Common Coverpages\en-US\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\ProgramData\Microsoft\Windows NT\MSFax\VirtualInbox\en-US\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\ProgramData\Microsoft\Windows NT\MSScan\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\ProgramData\Microsoft\Windows NT\MSScan\WelcomeScan.jpg - Access
\\?\C:\ProgramData\Microsoft\Windows NT\MSScan\WelcomeScan.jpg id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\ProgramData\Mozilla\logs\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access Created File
\\?\C:\ProgramData\Mozilla\logs\maintenanceservice-install.log - Access
\\?\C:\ProgramData\Mozilla\logs\maintenanceservice-install.log id-bry0hIIfVldG0S8v.BDKR MD5: 7f321db4517ab2c0931e149626235422
SHA1: da848e74a2e89f00810dd7f573a818da4d92743e
SHA256: 389071fe710d338566acf64ab2095d5351b6ecd442ffe0ea3f45cdc0b2183a15
SSDeep: 24:hyvuI/AdFyCCqBHXRnyt7A9KMYVP3NY3z3m8MGQ2bkRyIa58rlzgBbKW5WcGII:MZWfCqB30q4YJI+8rlf4I
ImpHash: None 		Access Modified File
\\?\C:\ProgramData\Package Cache\42D5BEC7DDFBD49E76467529CBC2868987BF8460\packages\Patch\x64\How To Restore Files.txt - Access
\\?\C:\ProgramData\Package Cache\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\packages\Patch\x64\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access Created File
\\?\C:\ProgramData\Package Cache\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\packages\vcRuntimeMinimum_x86\How To Restore Files.txt - Access, Write
\\?\C:\ProgramData\Package Cache\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\packages\vcRuntimeMinimum_x86\vc_runtimeMinimum_x86.msi id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\How To Restore Files.txt - Access
\\?\C:\ProgramData\Package Cache\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\packages\vcRuntimeAdditional_amd64\How To Restore Files.txt - Access
\\?\C:\ProgramData\Package Cache\{3c3aafc8-d898-43ec-998f-965ffdae065a}\How To Restore Files.txt - Access
\\?\C:\ProgramData\Package Cache\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\packages\vcRuntimeMinimum_x86\How To Restore Files.txt - Access, Write
\\?\C:\ProgramData\Package Cache\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\packages\vcRuntimeMinimum_x86\vc_runtimeMinimum_x86.msi id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\ProgramData\Package Cache\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\packages\vcRuntimeAdditional_x86\How To Restore Files.txt - Access, Write
\\?\C:\ProgramData\Package Cache\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\packages\vcRuntimeAdditional_x86\vc_runtimeAdditional_x86.msi id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\ProgramData\Package Cache\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\packages\vcRuntimeMinimum_amd64\How To Restore Files.txt - Access, Write
\\?\C:\ProgramData\Package Cache\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\packages\vcRuntimeMinimum_amd64\vc_runtimeMinimum_x64.msi id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\ProgramData\Package Cache\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\packages\vcRuntimeAdditional_amd64\How To Restore Files.txt - Access, Write
\\?\C:\ProgramData\Package Cache\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\packages\vcRuntimeAdditional_amd64\vc_runtimeAdditional_x64.msi id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\ProgramData\Package Cache\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\packages\vcRuntimeMinimum_amd64\How To Restore Files.txt - Access, Write
\\?\C:\ProgramData\Package Cache\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\packages\vcRuntimeMinimum_amd64\vc_runtimeMinimum_x64.msi id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\ProgramData\Package Cache\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\packages\vcRuntimeAdditional_x86\How To Restore Files.txt - Access, Write
\\?\C:\ProgramData\Package Cache\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\packages\vcRuntimeAdditional_x86\vc_runtimeAdditional_x86.msi id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\ProgramData\Package Cache\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\packages\vcRuntimeMinimum_x86\cab1.cab id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\ProgramData\Package Cache\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\packages\vcRuntimeMinimum_x86\How To Restore Files.txt - Access, Write
\\?\C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\How To Restore Files.txt - Access
\\?\C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\state.rsm id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\ProgramData\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\packages\vcRuntimeMinimum_amd64\How To Restore Files.txt - Access, Write
\\?\C:\ProgramData\Package Cache\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\packages\vcRuntimeAdditional_amd64\cab1.cab id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\ProgramData\Package Cache\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\packages\vcRuntimeAdditional_amd64\How To Restore Files.txt - Access, Write
\\?\C:\ProgramData\Package Cache\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\packages\vcRuntimeAdditional_amd64\vc_runtimeAdditional_x64.msi id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\ProgramData\Package Cache\{e52a6842-b0ac-476e-b48f-378a97a67346}\How To Restore Files.txt - Access
\\?\C:\ProgramData\Package Cache\{e52a6842-b0ac-476e-b48f-378a97a67346}\state.rsm id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\ProgramData\Package Cache\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\How To Restore Files.txt - Access
\\?\C:\ProgramData\Package Cache\{f325f05b-f963-4640-a43b-c8a494cdda0f}\How To Restore Files.txt - Access
\\?\C:\ProgramData\Package Cache\{f325f05b-f963-4640-a43b-c8a494cdda0f}\state.rsm id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\ProgramData\Package Cache\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\packages\vcRuntimeAdditional_x86\How To Restore Files.txt - Access, Write
\\?\C:\ProgramData\Package Cache\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\packages\vcRuntimeAdditional_x86\vc_runtimeAdditional_x86.msi id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\ProgramData\Sun\Java\Java Update\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\ProgramData\Sun\Java\Java Update\jaureglist.xml - Access
\\?\C:\ProgramData\Sun\Java\Java Update\jaureglist.xml id-bry0hIIfVldG0S8v.BDKR MD5: a122ebba4d5d1da5270c502f27bc22f8
SHA1: 5928c2693008d0fb631e465150da803bc4f107d4
SHA256: 224b15d6fdcf125e40c2ee37bc5fb5ebb90b811b7b6cdb6d8e0b335838295d5b
SSDeep: 24:C4I47trFpv55Yq1QZ5iZnyt7A9KMYVP3NY3z3m8MGQ2bkRyIa58rlzgBbKW5WcGn:C4I475/55YcQZ8cq4YJI+8rlf4I
ImpHash: None 		Access Modified File
\\?\C:\Recovery\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\boot.sdi - Access
\\?\C:\Recovery\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\boot.sdi id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Recovery\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Acrobat\10.0\AdobeCMapFnt10.lst id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Acrobat\10.0\How To Restore Files.txt - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Color\ACECache11.lst - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Color\ACECache11.lst id-bry0hIIfVldG0S8v.BDKR MD5: 47e8caeb948d514e775778cde681b9d1
SHA1: 083d7e78e4d59997ab0c13f04521bfc13397931b
SHA256: 99458e0d1233f6601d8717697c7bb7ac567a5e923d00c76b3e5accc8da63e343
SSDeep: 48:puQjyd7Ie43eimQIA09fyiO9LiEnPRjXmq4YJI+8rlf4I:pvCEnYA09fy199pjXBLJrI
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Color\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Color\Profiles\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Color\Profiles\wscRGB.icc id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\How To Restore Files.txt - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\How To Restore Files.txt - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\manifests\How To Restore Files.txt - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\GDIPFONTCACHEV1.DAT - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\GDIPFONTCACHEV1.DAT id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\How To Restore Files.txt - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\IconCache.db id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\How To Restore Files.txt - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Adobe\Acrobat\10.0\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Adobe\Acrobat\10.0\rdrmessage.zip - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Adobe\Acrobat\10.0\rdrmessage.zip id-bry0hIIfVldG0S8v.BDKR MD5: dc763c5a815b15430820430d6217a6b3
SHA1: dced9d9d8b2e0c5110eb2152c5a37d234a396414
SHA256: f8ede373c0b4abb1b0976c2618d6ba41a6cb739d59b873fe9264c5c76022941b
SSDeep: 768:66St/MovCVve+czsM8qKaoXk8HRMHYSyCftKmKSHV5aOEj6HXrQ2OPPHs5V:6jA9eNzsM8qAHRE1KmR7aOH7xOXc
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Adobe\Acrobat\10.0\ReaderMessages - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Adobe\Acrobat\10.0\ReaderMessages id-bry0hIIfVldG0S8v.BDKR MD5: 8017995e48ac446c33a226fd66aa3952
SHA1: 2755346812b60ca1f83db312d1546ee34c9d90e3
SHA256: 197ea9f0f8e8baa98bd1d3c0cd0dad3f3a37ea026efb18bd052939968214c80e
SSDeep: 192:bwF4h8wpKIdLdA5Ym07pkNfXqUhVJz0GNDIMtaRbVofpKC:rlpKepkhVJz0IDBweKC
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B id-bry0hIIfVldG0S8v.BDKR MD5: 304698d43bc7a1ddfddf18a45db069ae
SHA1: 3cbcb493064f9687f78603af6aeeda42fd5f3e29
SHA256: 1daa575b50e8d5eaf6eada4ceb786f33b0b8cb715432fb6b74d84397740e394a
SSDeep: 24:RROYQxhEdUUllnhZ+OihgNd6kgAOAbRyt7A9KMYVP3NY3z3m8MGQ2bkRyIa58rlf:RROlxhEaWhhdPg64q4YJI+8rlf4I
ImpHash: None 		Access Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875 id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\024823B39FBEACCDB5C06426A8168E99_6D5CAB161A1C65362A913D29BE09D91B id-bry0hIIfVldG0S8v.BDKR MD5: 92e363ee9ff8d3c20a63c726db116229
SHA1: 235beaa3b0fb40b674fd982562b520f4a2481d4a
SHA256: 7dabe67f018ae48a8d21eab39432d173dcfb389bd9fb286e7816a8ee3f460e1d
SSDeep: 24:pr3/8fP39gPvVcpbab0aHMUrwGlAIyt7A9KMYVP3NY3z3m8MGQ2bkRyIa58rlzgi:prP8H39glcp80yrwBq4YJI+8rlf4I
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0F1583FFF42FFF476A09801ACB69213F_E3F4A8C96454D7D3441D2C1BCE81F875 id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1BB09BEEC155258835C193A7AA85AA5B_A7B2B53AF2A12E2CB0A41B96D21D7973 id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1DAF2884EC4DFA96BA4A58D4DBC9C406 id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\How To Restore Files.txt - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\index.dat id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\AU\au.cab id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\AU\How To Restore Files.txt - Access, Write
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\Deployment\deployment.properties - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\Deployment\deployment.properties id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\Deployment\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\jre1.7.0_45\Data1.cab id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\LocalLow\Sun\Java\jre1.7.0_45\How To Restore Files.txt - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\69-LUmry m-.bmp - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\69-LUmry m-.bmp id-bry0hIIfVldG0S8v.BDKR MD5: 7739b67cfa2308436f07c2b0d3a18471
SHA1: 20ed136bcc8b0704175c7331116707c0dbed6cff
SHA256: c0271950ed4931d7e621cd91815ca08a026926c6c8fc06e72c9efe315ca79449
SSDeep: 1536:Wi2VVP6dJUTM+n2erkwZWJZUfSFM0X30R9VvwaTOV4Oh:WpVPUJGVn2XuuUSF/0Rj3TOVh
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\6cHawfktiEZ.wav - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\6cHawfktiEZ.wav id-bry0hIIfVldG0S8v.BDKR MD5: 74196b6cbbac5a2a5bda885894ddbace
SHA1: c01623cef4f1bc28e5d2e8b75207266d1d5a827b
SHA256: f6386f49000c1597541c59d4a14ffa3a7586b802b396a196bf6dc04e4130d15d
SSDeep: 1536:3cquFoRLQi3zctBjclvJ97xVNxL4rDhLngt5+013M0VgB8bXxMQm5Z95WFg5DmzM:3YuBsBArxTiD4PgaC5ZnWFgH
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\6tU1DrgevnlBIXwjA.mp3 - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\6tU1DrgevnlBIXwjA.mp3 id-bry0hIIfVldG0S8v.BDKR MD5: 9a1b566a5049b8c5953e3de5d4527d95
SHA1: 37de813cfdbfebb8c2674095609092561fb6560a
SHA256: 371771b39c6fed0331a5d99db8f21ecb9b3db595015bbefbeac61711c2f9ceb1
SSDeep: 1536:S2zKrxUqnGvp8jVqQ//PJGOnfsiO5lIqBj+KRoPR1yxU4wtk:hz+er9G3hsb7IqBZRoPPySrtk
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\8hzaVpqj7b2yZS4hQQX8.m4a - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\8hzaVpqj7b2yZS4hQQX8.m4a id-bry0hIIfVldG0S8v.BDKR MD5: 54b97649c76109e04322e484beeac332
SHA1: 961c52cca1cb254f00a14dcad7372f3a35487416
SHA256: 490baaf2353847db605226db0de454313009f09266874c475fd9fedfd9d7b6e8
SSDeep: 192:YFX15aD1S0TxIjNBxqTpNblTt/CADhOYMJwcJplHt4C:w1QDguxIhBxybfTIYMpXJWC
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Adobe\Acrobat\10.0\Security\How To Restore Files.txt - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\b2ut2.avi - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\b2ut2.avi id-bry0hIIfVldG0S8v.BDKR MD5: 3aa85c381ed748c4f7c2a61e19d7405c
SHA1: a7ee6109686f24f809a1dbf48bbba99c762f3b7c
SHA256: aa76962136c61d3abf754df910566375a15422c4bcd3ada46b7f79887a97de2f
SSDeep: 768:7Y3+GzSD3Ul8TD1nXGKUYWqb6lQpj96hdoekF80+znmQt4O6AphMiDDdZ9tOzt1i:7Y3+GGD1TRnWc+lQT6hdoekFgTV4ODe+
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Cj O Dl60Ws_W.ots - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Cj O Dl60Ws_W.ots id-bry0hIIfVldG0S8v.BDKR MD5: 6955f1104df29bf1e341a412ba0e032e
SHA1: eccc748f07844dbf5c5f2b553d773e92d77417ce
SHA256: 64a7a1f2445e0c3f5681b5c28e9ead8b54b7e8674c8220cd47c8d32b1b9acd9b
SSDeep: 1536:J5tb1zBpGYVr2BWXdoaOuRVMNajIqMHWXdf5bkM1iSVuPP+KpXbEunVU8x:J5psBWhOWeiIqMcboM1iSVknTVVx
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\D3kKjfyCTl.avi - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\D3kKjfyCTl.avi id-bry0hIIfVldG0S8v.BDKR MD5: 5bf4c15ab027ee29f3bdb1de392eff85
SHA1: d36bee25b3344cfdaff6ff777f8d66c2407a8e0c
SHA256: 732cda4b99eb64d1eee884fee3c001e84137f10dfcc59b33fea42a7b2aff05f9
SSDeep: 1536:Hg/GCzed6w7G19/nw/yURksUSjMf0rk+qh2k9VRBmUCblNiQAngTtTWVlf9KVH3e:A/a8bPw/y+U2M1phBVPmUCblQJn0TWVD
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\F7hYN.ots - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\F7hYN.ots id-bry0hIIfVldG0S8v.BDKR MD5: f4b2f9af9106c1930704727f0703ab7a
SHA1: 856ffde8b1ac77d2c4ddf5df45b994ca0d588d72
SHA256: e5f418aebcb112c1900417abba07722a16825f670feeb5cfe5a2dd5e159bc16f
SSDeep: 192:uC4nUt+/Ct12FR1H/J2TT+qFPkYmPHwiGYZUC:uxtqGR1fJu+0PkYmZGYmC
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\f8Ro3n.pptx - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\f8Ro3n.pptx id-bry0hIIfVldG0S8v.BDKR MD5: 1b69f3a3d55ac1ee35cfe684a83775bb
SHA1: c66c3d620465a6ab0073becdb8da62559ccf53ae
SHA256: efb25ca61318c15323c8413755ea2dbbbfeaf2b6a37395003f6bfa034416f514
SSDeep: 1536:OG3vQ1Q/D0UIlEz+QiQB6/vGzYaYDMYumqoqjV8p1Pq:Ou4K/D0UIlEKOE/vGzUgYHqoWqpxq
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\G_LitrMcKt.wav - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\G_LitrMcKt.wav id-bry0hIIfVldG0S8v.BDKR MD5: 6f7f19e001c9c2dd31d79c9a89e339da
SHA1: 567d416ce78b1d835abc7e0d20773c5b49483615
SHA256: 20cd41c84a57a03111060a648c7996d2eb7eea071ed972bd8fcc5fe4dc010030
SSDeep: 1536:he65tS33s1WjIBPbHh+caxFYiCrzOQxr7X2:heX81WjId+T4DzO0n2
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\GxY9j-YD0CfIAbkw0.png - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\GxY9j-YD0CfIAbkw0.png id-bry0hIIfVldG0S8v.BDKR MD5: 740488d40dacf379dc10dfab80fbc689
SHA1: f457f7a1c363bc2447b7ccfa8fb47d0130da010f
SHA256: b9523f35de254092d1ed7cbd1f60f10faa5f44261996ebc126ea3254ad3b5c50
SSDeep: 1536:jRbYSqzXpPm7wasQCOQ/yHvd2k6jBXkoIUNEv5docig6ayqyM:jRbICwaZCONFecTBdodg6qyM
ImpHash: None 		Access, Write Modified File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\h-HTnXxEnveIM20.m4a - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\h-HTnXxEnveIM20.m4a id-bry0hIIfVldG0S8v.BDKR MD5: bb931ac949bd2a1c17ba687842237096
SHA1: fda049d3fa42b446b8254b2e955fd8454d02953a
SHA256: 59af9a9c463910cc38cf0d12c6531b8cd4df42a3aefa1780dded304957ea875c
SSDeep: 768:4z82oI9a/aONAUOAj2nnMtL3x/ZGAUwOMw:4BoI9HUOTngL3x/ZGAUwOp
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\H4rg2nkN_C8pmo9n.jpg - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\H4rg2nkN_C8pmo9n.jpg id-bry0hIIfVldG0S8v.BDKR MD5: b92fafaa5f47a0915b065cd125135403
SHA1: 25c0706c2cf13ba1f2569d3a0dab0a6ed8cc0193
SHA256: c02a5c40f46748dcbefc07ab6e38b4509508df6b1df4fa6dd4ddfd93d5a7311e
SSDeep: 96:tLrnNHbOJTIsep4flMG/LSktniu4IN6ZySnJwZA5/6UU396rvWErLJrI:tpQ+CD/LSktrD6ZyGw2N6UUN63C
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\h84ce25Cd2e.csv - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\h84ce25Cd2e.csv id-bry0hIIfVldG0S8v.BDKR MD5: 29a32b32aa51eb7722c9e9a014808bfa
SHA1: ed5f7726e0c22c1c05e3cc27154b5af6dfa0862a
SHA256: 5d82010290166130130abad0d3abc73d820f1ddd448179b914feb875d13f5a45
SSDeep: 768:Ap8p1muzBCM307l8JXJszPmHK2IRIq4cEbMPsgFe3RjAGo+pYac:o48DJQXJs7UUEoEggOOp/c
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\HQDxBZD6HlJy7LLor.m4a - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\HQDxBZD6HlJy7LLor.m4a id-bry0hIIfVldG0S8v.BDKR MD5: e25bd90de064c5b67885474c65af25f8
SHA1: cc1cbe8b3f6a8e9adaa63d45fd27eda3cf1c68ee
SHA256: c3e195cf4e28ccf640880ff3c942a3ebab7f54bed893d9f080ce32cd7c22d938
SSDeep: 384:ds8nEIuUqsqjIf5+2sWVKG4QxypLGveIC:dnDnh8V3QxypLGvu
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\jLfOoXctrtajuOXkJWbB.gif - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\jLfOoXctrtajuOXkJWbB.gif id-bry0hIIfVldG0S8v.BDKR MD5: 621c9aed108813b50ba7b456e7880b52
SHA1: 1f9948e15fd885ce8c36e444094d4491c1c3b2ba
SHA256: 1c2f137f7b6ec77aee009c7e56a70e57fa3167fe9e0b4799827c9009d1489c72
SSDeep: 1536:sUpLjid5X5nD9f7tALLJiw1xeRO6PloMZnIW3ivU7cni/h1qBk2IiBFYebm:rpLu7N7qiw1oROcloM5IFUn/Id8ebm
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\LtrqqbP.mkv - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\LtrqqbP.mkv id-bry0hIIfVldG0S8v.BDKR MD5: 6bbce428735936b71b15bc4427b05d34
SHA1: a32ce0b0b7f04bc0bf978f88aa9d71c3cd2de43b
SHA256: 0e261927eb46a24fa2ded108ec305738d161e08226882e3c654a712fac1773a9
SSDeep: 1536:rHcxTaIZelPZUxIIF0jA7rOpNWi/HXAiEOyjtwdvoe:+dGPeuIF0EwF/XAHphq
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3388679973-3930757225-3770151564-1000\How To Restore Files.txt - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\How To Restore Files.txt - Access, Write
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\How To Restore Files.txt - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Office\How To Restore Files.txt - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Outlook\How To Restore Files.txt - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Protect\How To Restore Files.txt - Access, Write
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Publisher Building Blocks\How To Restore Files.txt - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Microsoft\Templates\How To Restore Files.txt - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Mozilla\Firefox\How To Restore Files.txt - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Mozilla\Firefox\profiles.ini id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\qMoHu7gI.flv - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\qMoHu7gI.flv id-bry0hIIfVldG0S8v.BDKR MD5: d99354bfdf21e3f6f18048149a743abe
SHA1: ae8b56be8459f061b73f0315ccacb94ba528cff8
SHA256: c3a004dd0db9e90485383ceabeebeb5f8d439c004a19d16ecb903b19fa6d9b7c
SSDeep: 1536:pr53xdV/jmVRbeBwlM8YnG930aK9wL7KAIT:pRxLmRbC2YG69hAY
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\QQm9 JXI33bPKtzQI.m4a - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\QQm9 JXI33bPKtzQI.m4a id-bry0hIIfVldG0S8v.BDKR MD5: 1e03262e8da850ed21c31d34fd58c0d0
SHA1: e8c8bf606f160323117299ba4b3e2c985e01e2a4
SHA256: f03ad9066bea4a8032144b49bb7b3ced0d148c0e8da88b6a3543f6b69f8f6cd2
SSDeep: 1536:sclaJxNvLWn5Cd8vFAlmTpP0oTDcxpFhCR/7p4oP:scsXFWn5CyGlmVlTkw7JP
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\qUPt7PlaxE1RY9rpDm.m4a - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\qUPt7PlaxE1RY9rpDm.m4a id-bry0hIIfVldG0S8v.BDKR MD5: bb4ec5b94642e15cabc7d588643da490
SHA1: cf35780ae02dbc7dd1c992df8c0dbcafcd692a44
SHA256: 6c4c6f48a35a1ac332499f924250215b4973abe3099e6019d158b0f69ae260d5
SSDeep: 1536:HVWdSINDc+7KR7Rhec/8IigMW3hAcDhBU:mtKlLecE5WRR9O
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\Rh3gf-zsV.wav id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\RhM7dZ0Ojg60m.wav id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\SKC4gL-p7lgC.wav id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\t5N8NdUoe08ojpA.jpg id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\T8IXEpn4.bmp id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\tIzLrD3rrMP1SB9mMw.png id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\Aclviho ASldjfl.contact - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\Aclviho ASldjfl.contact id-bry0hIIfVldG0S8v.BDKR MD5: 284af0b3e25e20e635b7d11d9925d731
SHA1: 80ccc97cace96eb0c095bfcfea6533f3142d9601
SHA256: 640fe851682e657950df81f152dac71bf35aea6acf6462ad14dfd47c9346adcc
SSDeep: 48:5DygQa0/g+eMClRPxfF0ZhDX93wHcq4YJI+8rlf4I:5K1g+elrShDXVqLJrI
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\Administrator.contact - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\Administrator.contact id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\asdlfk poopvy.contact id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\chucu jadnvk.contact id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Contacts\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access Created File
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\0q-Q_imoU.swf - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\0q-Q_imoU.swf id-bry0hIIfVldG0S8v.BDKR MD5: 65a78a94aa65731bf60c8d8f2661edf0
SHA1: a1462b944aac8f0ee4e507f4ad9f0286538f90a0
SHA256: 43543e0e4cf550e103f0d7641c9fd3c0bd10099311556a3356413c3d2840b45b
SSDeep: 768:2D1d8KArNqH5dZTczBtbJDP+RBvvfiv5kG8zNV0uppFtGGHoOWo9iUSEEcNgdJkX:UfvcltJPO4v5kqupXoZ+BGJ8x
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\4JBCyaw.csv - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\4JBCyaw.csv id-bry0hIIfVldG0S8v.BDKR MD5: c1389180f9ecafc8580c3e6904ff4085
SHA1: f0b7044bf9b1d26cc00dbc35e767d46b79cac1b5
SHA256: 0cfa657ff28a29bb3bc6197d1a16274a1484d82c2a7b49a1efcd8aafab89dd13
SSDeep: 1536:ymUVlDZoC+jdt1JI2gQ8w+eQI07VWSaPOPWkHD4+C4mHdyHzWoCyEIaO4Y/r:yZDZUW2gHwplYNE1kj4PdyREI+Y/r
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\7pTl.mkv - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\7pTl.mkv id-bry0hIIfVldG0S8v.BDKR MD5: 1970a81d3699d2107da9eaae53d08424
SHA1: 5f3e7e4b0abee993a06f4e581b1ea7c319fe9ebf
SHA256: 164be9739678963a4273d9ae85e1c182a10f9ca901ea55c9f7308bc487984e87
SSDeep: 1536:RE0noYxw7/I6BGnH9AAtfS7uamiPBelHlqPMu:3xwTGdA4fuuUPBeNle
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\aTwMt9g.mp4 - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\aTwMt9g.mp4 id-bry0hIIfVldG0S8v.BDKR MD5: 2e87d3a6a13da59eac0d7c77663182da
SHA1: 8b616aafa8fff2774b412c63091affacc0fc1583
SHA256: 1067a7c8328ba64c9a35f20110a8efad5bd8262bc89a5ef60465ca8fd8dba907
SSDeep: 768:Gm86U/7FbF98JxAxCA0pgZSvehQoLxgVRoj6XLRNuy:PU/FX8jAMBpg0vehm+j6XLd
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\d-NecsGi8.bmp - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\d-NecsGi8.bmp id-bry0hIIfVldG0S8v.BDKR MD5: 9179aae19484a9f8af3ea59b55b8f6e6
SHA1: a950243b57f109d6cef49b6b5d8707583c8cb1f1
SHA256: d30e11ecca39e549b724ab579da55665c1e0d6a0e4fa7b4799ecb20dab02536c
SSDeep: 1536:OMYqBu4QX4umfH+94hGSvdEOO/8HS2d1qy/WzY/dqCdw5Hr4aav:DYMu4Ru2+9+GSDO/hHmVqIw5HcBv
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\d_G3ceZPcut.jpg - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\d_G3ceZPcut.jpg id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\desktop.ini - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\desktop.ini id-bry0hIIfVldG0S8v.BDKR MD5: 3242c3a4a83b6e46607e22d7eeb64d3c
SHA1: 8b3d55add57dfdbb6b3131078a3bc206a9e93c99
SHA256: e020aa6367b531b4c47a51b4540dde085ad4c6ec49a709a19d2ce3dc74ff526c
SSDeep: 24:MRFuaOcgbKtr6qI4wS3I230EYfCJsfyt7A9KMYVP3NY3z3m8MGQ2bkRyIa58rlzL:UuavkqYC/q4YJI+8rlf4I
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\dJjV63BFqSdhoi-qlwb4.swf - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\dJjV63BFqSdhoi-qlwb4.swf id-bry0hIIfVldG0S8v.BDKR MD5: 8689e0348fec81725b75add1e3863301
SHA1: 86907c98d1575f071ea9178a57174120d398e816
SHA256: a2460627ea8e64be66bfe26b45d46988bd306b16db1e03906f6cc57e59aa69cd
SSDeep: 1536:aTCk2FvETR+SXC66CN3E+SfH/7cKL4fkRoE6Tl934lyi3qL:aTCk2i1FPEdHekRVSlF
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\E1c0EvVSo6.bmp id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Ekrbf PTRlhOI\1W93a.bmp id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\Ekrbf PTRlhOI\How To Restore Files.txt - Access, Write
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\fBf0Oz9VQVAQ.png id-bry0hIIfVldG0S8v.BDKR - Access, Write
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\fcr.exe MD5: f1927e7f90416bf39fc7991bbc57e1b3
SHA1: 2367249568ca4a34f8824a9313b03d16d1d7c0bc
SHA256: 539b0b5d54757e8a2b754ecdc2939eb7cf9db0ed1728e0eca407500222668505
SSDeep: 192:yrj2/2OzcYKNEmkmTjtiIKZIF/2oQlLkMBBm4C:j/2OzcJNEmkmTjkI/92oQjBU7
ImpHash: 930ddd1c5a61dbaa873661edbf374853 		Access Sample File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\fcr.exe id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\g9OegMPzW9kZL_.mkv id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\JqFv3gGSzwIUH88WXe.m4a id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\KN__ldK9BzJbp.swf id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\lMz_LTptxP.pptx id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\m6vXf5ro7c02MA17KNj.png id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\MisCVZb4-.avi id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\mRSY.bmp id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\mtAEz8sW0z74.mp4 id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\n_6ArotS1kRdXv.bmp id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\NKOzGRkpkR3YahGa.avi id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\NL5p.flv id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\NlZFxMAHl.wav id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\0cdYs09W.xlsx - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\0cdYs09W.xlsx id-bry0hIIfVldG0S8v.BDKR MD5: 818bbb8a2c824dfea431d9b721af80d3
SHA1: 64f49e09263ff46badc0b41f337426578550538d
SHA256: 425477ce03200f0b5f7c9a7e22221f5d8b90261e14c5a339cc46d04937d8ea02
SSDeep: 768:v9MhvZ31gj952ka+k1DZa1b+3gZoaHwE8MjJon2lLrB:o1wn2k6Ha1y/aHwEB229B
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\5M5 seT-5vd_voX\33UdZO u-6J7rJrw.pptx - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\5M5 seT-5vd_voX\33UdZO u-6J7rJrw.pptx id-bry0hIIfVldG0S8v.BDKR MD5: 276f45e66916bbe5bb9abc0a89755587
SHA1: 3524a86ce978b4898a64b461be977a6d54f6dcd6
SHA256: a38b092596190edff89e6765f93ac199e278fbe6c75f652367ce086f6cf665ba
SSDeep: 1536:sAZ1tms/NbDZM0F37UNtSsEhCLfAnyOPcf3E2G1pnSysuwyeap6PZp8:scmcJDZMIQ3SxCgP8Deauwyeal
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\5M5 seT-5vd_voX\3giUFeu.csv - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\5M5 seT-5vd_voX\3giUFeu.csv id-bry0hIIfVldG0S8v.BDKR MD5: c9ebcf59b31e9501452d3048cbbde1f5
SHA1: 718d570d0838ec9c71c58235d4dce7d25569e6ab
SHA256: 33bc454aa624dc7c6c6f0d8f6c107867be7210cd626a957f1ce4424094c411ae
SSDeep: 96:dgJexVFeAIcsrriGgFIyfh2M/AmwnwaS/YYbbeHFnRY3TrTBPLJrI:dhxTsPiTZAmw1SYK4FnRaC
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\5M5 seT-5vd_voX\aYtHQeH.rtf - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\5M5 seT-5vd_voX\aYtHQeH.rtf id-bry0hIIfVldG0S8v.BDKR MD5: 78d054232a2401053d9305e2a03c0a9f
SHA1: 5343d9b4a7c9854a4c7be07cf37012c79aeb4f3f
SHA256: 76e6e6235a8ee335abed2eadbc611e943ef90aba7a315f45dc2adcd349081048
SSDeep: 768:1RqJAPtzyvG3v2i1B4pQImVZNAul69AgLIIoSQCQzXJVMSN66/dsKxBL7Hu2:1aglyevrGUv7YugKhBzPMOdlx1bu2
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\5M5 seT-5vd_voX\d-65AiIcrHa.docx - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\5M5 seT-5vd_voX\d-65AiIcrHa.docx id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\5M5 seT-5vd_voX\drbC7FYWGRTf41U.odt id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\5M5 seT-5vd_voX\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\69q9P8O1O.docx - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\69q9P8O1O.docx id-bry0hIIfVldG0S8v.BDKR MD5: 84089f63bf35898b4bde659ad46c85a3
SHA1: ab653c3d0d35574846239ca6595c076320a6d4be
SHA256: 8f76e9a749f5738edccc8b1686f1f614b9fb12d0c3824e4241f8b36e02f65386
SSDeep: 1536:lCAVq4oJbjQoWuUoQ+whCFL1YXfCJJk90cDW+/ZqiqZhWx8+SyzSFjn4Wad8CxaO:XRUbjjWznqF5ISS90GP0DnJaJxaMn
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\7dgl8s-3Gjx7.pptx - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\7dgl8s-3Gjx7.pptx id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\desktop.ini id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\djWv5qVlO-f36Hg32j.pptx id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Documents\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Downloads\desktop.ini - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Downloads\desktop.ini id-bry0hIIfVldG0S8v.BDKR MD5: 605ba1c86a5c4ce093d16b2384a76d76
SHA1: f72ba60650b6b1833197d6cd4948a9134f267287
SHA256: 0e10069251ff60bc85aef64a5cab516b524309b23a9ad1908f1c459cea58ade8
SSDeep: 24:VqqB+9ZNunAQyclYba3jAuUoAyt7A9KMYVP3NY3z3m8MGQ2bkRyIa58rlzgBbKW8:4e+9zi7BSa3jAGXq4YJI+8rlf4I
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Downloads\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\desktop.ini - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\desktop.ini id-bry0hIIfVldG0S8v.BDKR MD5: b5275694ce2be28d65ce0def6c0ce276
SHA1: ca525a9e73cbcf1d0a43db99a99d2abfc946b4e5
SHA256: 849bb61924459c490d7895c0b8539425463cb8cf8100901f15d49d8e480b5784
SSDeep: 48:OrIddOSrLV13rVcCn8iWJq4YJI+8rlf4I:OUdlTWa8inLJrI
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Links\desktop.ini - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Links\desktop.ini id-bry0hIIfVldG0S8v.BDKR MD5: 7c3f36f598544844977cbd86afa56d1b
SHA1: 546969b210476c3ebf94421da1f2d2dfa9c1def4
SHA256: 22355f7d46f69e09b4eaac649d3cb1ad06fc603c94ad962ddf6a26ddec469c51
SSDeep: 24:xqpawTOPNgSrWyyt7A9KMYVP3NY3z3m8MGQ2bkRyIa58rlzgBbKW5WcGII:xq0wC1sq4YJI+8rlf4I
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Links\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Links\Suggested Sites.url - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Links\Suggested Sites.url id-bry0hIIfVldG0S8v.BDKR MD5: 68033e6e4e3340a479a1510efe96f070
SHA1: 0480f56721f72843b7aff59b69300779914c1fd4
SHA256: 22b34ec6a871dfabed9941bb961fc15aeebf8f78d2fe7d785f37b88484d2f8cd
SSDeep: 24:z45m+mwYH7wyt7A9KMYVP3NY3z3m8MGQ2bkRyIa58rlzgBbKW5WcGII:0myYH7Hq4YJI+8rlf4I
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Links\Web Slice Gallery.url - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Links\Web Slice Gallery.url id-bry0hIIfVldG0S8v.BDKR MD5: 7b09517bf630861f8da72e5c6d7fd40d
SHA1: 05f22e773b4a3fc29a02e008cf029268c5f7c241
SHA256: 1bb1fa3790f6a2604237ca73c785ab6811a852f66cd6e9ae7c7df8fc7ee782e7
SSDeep: 24:+c/Jyz1YhOiRyUhRk2jyt7A9KMYVP3NY3z3m8MGQ2bkRyIa58rlzgBbKW5WcGII:+kyBiRy65Oq4YJI+8rlf4I
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\IE Add-on site.url - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\IE Add-on site.url id-bry0hIIfVldG0S8v.BDKR MD5: d15d4b5e0893d76521152b484f13c5cd
SHA1: 1425da00f387071ccab91042334b62ed8326aff6
SHA256: 4145940e50a8ef1595a7339748ed4b01ec7e463c985fad625477b80e6d7795d2
SSDeep: 24:HhjhCfzJ66kodDNcWwhEQmyt7A9KMYVP3NY3z3m8MGQ2bkRyIa58rlzgBbKW5Wcw:/IJ66kodDNcWwhEQFq4YJI+8rlf4I
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\IE site on Microsoft.com.url - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\IE site on Microsoft.com.url id-bry0hIIfVldG0S8v.BDKR MD5: 6075093bf457c8c2ac818970b6f959cb
SHA1: 3365505a0a0a309619e5db0bf7e479bce4fef3ed
SHA256: 055dda57246ff4211c33028788e85e4c56b9aca8ea92a5bd4e534117a987b442
SSDeep: 24:9SaJaP+/y96ltS+Ivyt7A9KMYVP3NY3z3m8MGQ2bkRyIa58rlzgBbKW5WcGII:9SaJD/a6eBqq4YJI+8rlf4I
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft At Home.url - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft At Home.url id-bry0hIIfVldG0S8v.BDKR MD5: e22ce0d543adc971a43b3aa1c0c09179
SHA1: bf258a56153d825ee1464ffdcad344d726253a7b
SHA256: 56ac69b9e747ff85ec3cdb00d64ee0ef97136cf4ac33aa5b35975d7b9e63017e
SSDeep: 24:IiMHvF9Py4NFaRyt7A9KMYVP3NY3z3m8MGQ2bkRyIa58rlzgBbKW5WcGII:IBvFRPFaUq4YJI+8rlf4I
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft At Work.url - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft At Work.url id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Microsoft Websites\Microsoft Store.url id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Autos.url - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Autos.url id-bry0hIIfVldG0S8v.BDKR MD5: 1c7dbc316aa02bbfe7eb5bd1c0e69365
SHA1: ca89e23fe0ab0e8fae4801e92b04420406cda5bd
SHA256: 71cba5552d49f58c2a1433ab0de92031b63b9a75262bee41baea179db21bcccc
SSDeep: 24:XpuNuKjltQiJLwzjyt7A9KMYVP3NY3z3m8MGQ2bkRyIa58rlzgBbKW5WcGII:XpuNuK5tQiFq4YJI+8rlf4I
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Entertainment.url - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Entertainment.url id-bry0hIIfVldG0S8v.BDKR MD5: 92e363ee9ff8d3c20a63c726db116229
SHA1: 235beaa3b0fb40b674fd982562b520f4a2481d4a
SHA256: 7dabe67f018ae48a8d21eab39432d173dcfb389bd9fb286e7816a8ee3f460e1d
SSDeep: 24:pr3/8fP39gPvVcpbab0aHMUrwGlAIyt7A9KMYVP3NY3z3m8MGQ2bkRyIa58rlzgi:prP8H39glcp80yrwBq4YJI+8rlf4I
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Money.url id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN Sports.url id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSN.url id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\MSN Websites\MSNBC News.url id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Get Windows Live.url - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Get Windows Live.url id-bry0hIIfVldG0S8v.BDKR MD5: 734d93b90317e27590deca88f0c2b667
SHA1: ba40a88969ea79e9d4cb97259b5e377244284f26
SHA256: b041e4f9ae8e4be70ab42077903c438d474951db15462cd6e0d9b13991f94e9f
SSDeep: 24:pem4si1Ru2H0qAmDPDHjEfyt7A9KMYVP3NY3z3m8MGQ2bkRyIa58rlzgBbKW5Wcw:pem4D1RuA07mDPDYaq4YJI+8rlf4I
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Windows Live Gallery.url - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Windows Live Gallery.url id-bry0hIIfVldG0S8v.BDKR MD5: 7d17d933e11a9df9b0b91d6255f17edd
SHA1: 0c8c12a25cdac091570c61cad4397c8f58363458
SHA256: d80b778b9b408819497661d242ee757b5ba927ee5d4f945e52507ff0fbf19bb5
SSDeep: 96:Ri6LMduVF3fIbGpgHuc9FFsxznbMG7AGNNLd91JYFdhjWJyGtLJrI:RLLBVBwbeTacbYG7VTd9qqpC
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Windows Live Mail.url id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Favorites\Windows Live\Windows Live Spaces.url id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Links\desktop.ini - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Links\desktop.ini id-bry0hIIfVldG0S8v.BDKR MD5: 06e50b2d51abf67d88dd8a7015dca069
SHA1: a66ca9a87cdec1ca2c6e03ff327507ee9556dc3c
SHA256: a74b86983e490edfaf1e7c670773661d8a30d5e1edf0f305dbe7503f8fe78a8c
SSDeep: 24:NffkfC2kceB0VRb0j/iXuEQIr6eLMCyLfyt7A9KMYVP3NY3z3m8MGQ2bkRyIa58B:NfsfCXcdLr0eov2q4YJI+8rlf4I
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Links\Desktop.lnk - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Links\Desktop.lnk id-bry0hIIfVldG0S8v.BDKR MD5: da7a72a26bb9a39946779886ae973bbc
SHA1: ac02d2a303cbba64d69d26211283b12ee45c65bd
SHA256: cf422c77f35be4cba6c41d2607c7e6c18c71d4ce999d2ef6d5d31cae9c2564a0
SSDeep: 24:MP8WWDVLWP+v88hFvDk1jkktfw7yt7A9KMYVP3NY3z3m8MGQ2bkRyIa58rlzgBb8:aM38jkyY2q4YJI+8rlf4I
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Links\Downloads.lnk - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Links\Downloads.lnk id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Links\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Links\RecentPlaces.lnk id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\8oa0-m3WJaKwnSuLh9e\0TuiOM62.m4a - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\8oa0-m3WJaKwnSuLh9e\0TuiOM62.m4a id-bry0hIIfVldG0S8v.BDKR MD5: f3ecc6d2e8f4137308481d40bf2a91a9
SHA1: 19ae9b15e879900d212bf80504046e51bcd97bdd
SHA256: 4c3758b7b5e273a3bc8e106593015efcc1d426886165366a20302c7f60ebdbc2
SSDeep: 1536:xTVf11cUz0+Q3xaat7sMcvNFP+qB8bhH7G1gzTpcohdKhapvat:JVz0/1sM2NFP+qq1H7ogzpvKh3
ImpHash: None 		Access Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\8oa0-m3WJaKwnSuLh9e\4t-7-GHSbfJZ.wav - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\8oa0-m3WJaKwnSuLh9e\4t-7-GHSbfJZ.wav id-bry0hIIfVldG0S8v.BDKR MD5: 35c36abc9f443123af0f6d3f821aa0de
SHA1: b366a5692eed88d8cbeed9b56b27504ece44aed2
SHA256: 1aa4649a5c64e2a6fd5e3f42b1413b2a530628f13745fae1971f8e883e85b90d
SSDeep: 1536:M46eBZ1sYdZs0jdx/82XdygUv+zfAlMTuzLlEFggV1XqO:IojZBxU2Xdyge+zfMMThygVhB
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\8oa0-m3WJaKwnSuLh9e\6 6JppDDb.m4a - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\8oa0-m3WJaKwnSuLh9e\6 6JppDDb.m4a id-bry0hIIfVldG0S8v.BDKR MD5: c0d6e5c1e801d613a9114bf2ce2b9046
SHA1: 5ea230e9003731c8bce9f684b3034232cbbe2455
SHA256: 9b3b51b422b00ecc0874bd99715777efc650613cb8dbcea8d667a9904fac71b5
SSDeep: 768:mb2Ph90c9OmVx+S6J9MRACMDpZLmVldjYTCiEJjhf/UKY4:mb2T9V7+t72MDptSjj0CX1hft
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\8oa0-m3WJaKwnSuLh9e\90gCcG7fd.mp3 - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\8oa0-m3WJaKwnSuLh9e\90gCcG7fd.mp3 id-bry0hIIfVldG0S8v.BDKR MD5: ba50b940571b551c2742502dcb997eb7
SHA1: 04c0d1976c0df36714be4e6929576087eeeeb311
SHA256: 9facccf723fba8b337df455161dd930399f4cd1615356e014a335b78853aae01
SSDeep: 768:qz/4yrbmmB/Kg6pOE+/yDSbQjuR2azN7fpimGrkO146lVprJn42kj:q7Hx/Z6pOHyOkjjg7fpimP36VpVBkj
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\8oa0-m3WJaKwnSuLh9e\9Q08f8qI8-EUS1ATwKx.mp3 - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\8oa0-m3WJaKwnSuLh9e\9Q08f8qI8-EUS1ATwKx.mp3 id-bry0hIIfVldG0S8v.BDKR MD5: df7bd0b33233fa7616395fbd5a564d0b
SHA1: b4cfee9d3df0cc49b17aa5d323468d03f6bff034
SHA256: ad42fd5292425c38065b4cd0e8bed4535e5eaff39128d8e0e235cd8da9c878b8
SSDeep: 192:/sypd7kSK2PVIvjl/4rECb0kUAZg/fbX197cdmzC:/sidojnCbzUAZgL197cdmzC
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\8oa0-m3WJaKwnSuLh9e\g6X_J7o YDKthVPeAz10\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\8oa0-m3WJaKwnSuLh9e\g6X_J7o YDKthVPeAz10\Ky4nV51oSl2.wav - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\8oa0-m3WJaKwnSuLh9e\g6X_J7o YDKthVPeAz10\Ky4nV51oSl2.wav id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\8oa0-m3WJaKwnSuLh9e\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\8oa0-m3WJaKwnSuLh9e\iJ-ZpQPb5YO5-LGM1KVt.m4a - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\8oa0-m3WJaKwnSuLh9e\iJ-ZpQPb5YO5-LGM1KVt.m4a id-bry0hIIfVldG0S8v.BDKR MD5: b45976e2e7f653b70ce59277775bbf10
SHA1: d513cff44cbea9ed0ebfc135d49d80fcef89e02b
SHA256: 465d15cad676f7d4548500c7746387ab3f9e93750c56dcb6f9fb772bab0387e2
SSDeep: 192:iCdrrM/0qheg7qXn9+m31a9+ELT7HNuMlitIRlPFdKIWDtOZiwP3L+RIH9QC:iCe/0FYqj31a9dbK+T9bZZ3L++QC
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\8oa0-m3WJaKwnSuLh9e\kW7zlhMdpM8TV\bJvTdW4mA2Z4wQ.m4a id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\8oa0-m3WJaKwnSuLh9e\kW7zlhMdpM8TV\How To Restore Files.txt - Access, Write
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\8oa0-m3WJaKwnSuLh9e\Ls0PdHw.mp3 - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\8oa0-m3WJaKwnSuLh9e\Ls0PdHw.mp3 id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\BBn5CvTVgKWX.wav - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\BBn5CvTVgKWX.wav id-bry0hIIfVldG0S8v.BDKR MD5: 336fd45e80deb05bb5ac47e0407be7e8
SHA1: 6c8df5cf9bbdf984b8d3125ee8f08419f651304a
SHA256: 8d5d70d4aba8caee4a0cce231a03ee2186a790e583412c5e7f6a8a8d7cd8e355
SSDeep: 1536:hzYmvWmMZzvSb8R1q1zg9W6JUwuuC2zQMPOg6NiLjq0Lry/J:tP1zOW6JGIcMPOgBL5ro
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\desktop.ini - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\desktop.ini id-bry0hIIfVldG0S8v.BDKR MD5: a6053afeed621b1bd177e1fcb9266a88
SHA1: 890ae5c79aba196b88ea26ab6465695a05be7085
SHA256: ca34bf83106e263fd21b866060b6dff323de8fba58a6aa8c0e5d755bca6ec132
SSDeep: 24:QNZfJ2ut+hb7n6rs6m89/SrnNa+3zvQuQM3yt7A9KMYVP3NY3z3m8MGQ2bkRyIaG:af0hbD6A6mm/0n9QuLCq4YJI+8rlf4I
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\ET-7EbrfGtKuwqVif3Bz.m4a - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\ET-7EbrfGtKuwqVif3Bz.m4a id-bry0hIIfVldG0S8v.BDKR MD5: 591f24c5eb2ef40f8858575ca801cde4
SHA1: 71822e4e6439fc9947ab7fb61bd48402b53939f2
SHA256: 7868fa7c35a5139f1f6a6aefe383215659efe9754d8c49c931558b527a523420
SSDeep: 1536:zHZWZ8P99oXZvK7sd2V8YTfBKwEcToxU2sRELnjN0:zoZQ9op9d22YTLTo+RG0
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\GcQTiaw8mWqp.mp3 - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\GcQTiaw8mWqp.mp3 id-bry0hIIfVldG0S8v.BDKR MD5: 5ff18865e2a2343565936c7f68fdbf35
SHA1: f0b10758a4a484c82080a984801c813b703fe573
SHA256: fc3cd48490913fdde3350b81ce5f54ab881d5c5cf2f2080b44663c79d3f133c3
SSDeep: 1536:wKJP+HxFXZ205bYZmQZvFKNsE6KvyWzCJF825t9:w7HjoiJikN/6KeTdP
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\HhuwU2FyuyIkneVE0.m4a - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\HhuwU2FyuyIkneVE0.m4a id-bry0hIIfVldG0S8v.BDKR MD5: 5ccddbd330ffaad560920599be3d9c96
SHA1: 7fa17d191818d627129dfeb6e51f1982e89bff6f
SHA256: a8e45ecbeabd3b34498069fac2aac21306a7a848f760a94a9bf94c2ee42c113a
SSDeep: 48:qxnq3qnJ8jMsQqoTPFCkiBF70ZggBEUyX7Y3UWq4YJI+8rlf4I:cnq6nLsQqoD0NBFAq2PwqURLJrI
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\Ja5mOI9ZMBy.m4a - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\Ja5mOI9ZMBy.m4a id-bry0hIIfVldG0S8v.BDKR MD5: 7a7c7e2a1362743429dd7056e6b282ca
SHA1: 19d815e7b9bdefb9e41d38b39b4eacc111326c0b
SHA256: e760c179c2225483c2c48bee8f6fdafb9be632a84889f2953a5a0ec0b7b5cab1
SSDeep: 1536:kOmuwcfPmskQjt+ky2La7ixnJVTh4SxQ/:JxXPms1tNLa72JTxxE
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\KQeyWfmit_woScYM.mp3 - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\KQeyWfmit_woScYM.mp3 id-bry0hIIfVldG0S8v.BDKR MD5: 19f044d9979864c6c54971e101345cdc
SHA1: 2d982cf23f79aec190da973f2b9d25b8e9fb8a06
SHA256: 6f2c2b24e299294cfe6bc9ead9a9e74b4d22e7813823ce8b2a99087a7d1a4596
SSDeep: 384:h+ZULcWPQcTwWtecxyK4Y4ppAFdQaxIkJF2DVMes1qhnZculgZcZDTlKw7XHJ2DA:hY4cvcTF7EY4ppOP7/8BBZcQgZi3J2DA
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\kTM8.mp3 - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\kTM8.mp3 id-bry0hIIfVldG0S8v.BDKR MD5: 1643602fadeb84108d54d6cbeaa11efe
SHA1: ca66317f50388e9bed42ede2a12d0821d0e764d1
SHA256: d7b85aa45bca48d87507d86bf504ddf89f1e36101f7957b842b07337bd072644
SSDeep: 1536:rDeTQYz1O+O8lZUZF5w6Z4w9eT55il5dvu8KE0LZ3qgZN2Rx8ST5GgIo8hgOWvbq:e/3O8lZUZQyHMOuZE0pluxSgIo6gPENX
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\vlkjgqIMwZdhJeRkz.mp3 - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\vlkjgqIMwZdhJeRkz.mp3 id-bry0hIIfVldG0S8v.BDKR MD5: e875393964eabc6de9d2dd845c8fbe7e
SHA1: 7cadffdc69449653ba14adab43ce6301f426a7e2
SHA256: 4121cd3750504e122bea60da3c4a8b972523947db3ac5a2a6ac57ed8d727e5d6
SSDeep: 1536:iEDVejB2Y25Up2Lpbshqo0dAFZU0p0JV0NPT:iE50BwL+hQiFW9Vc
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\WOUo-AhtDHZS.mp3 - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\WOUo-AhtDHZS.mp3 id-bry0hIIfVldG0S8v.BDKR MD5: 2fc1905b32b0f55b26e77275e2d77a35
SHA1: 7757cebb04d5dfc33cd51c4bcda2d103d13a0eaf
SHA256: 656d526c586daf591d04fb8f12889514357cf9a9c293160d053df2ebcb4b1e6b
SSDeep: 1536:uwJGns6fSjhtofbB+EujYRkW/nELyf3f8:lcnfSdtofbWCD/ELy38
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\YYxxAR3wBsO-qZ5.wav - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Music\YYxxAR3wBsO-qZ5.wav id-bry0hIIfVldG0S8v.BDKR MD5: 0207ccd021fe4feaf9710064241ad9ba
SHA1: 9148ce7f2ca9869a75f3f5ce759b696c601fb6a2
SHA256: 895f45b8bace8e08c26cd1adc95c4d77eb8fe31c9ae2b866644352ae6d6363ca
SSDeep: 768:Gfu1bqrlOqV/8ZFQfdwtfbLrjfvEmA3bgjlHrc:GfabW/8ZFQof3fcmVhY
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\NTUSER.DAT - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\NTUSER.DAT id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\ntuser.dat.LOG1 - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\ntuser.dat.LOG1 id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\17OCGHFRMI5H.jpg - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\17OCGHFRMI5H.jpg id-bry0hIIfVldG0S8v.BDKR MD5: 4554457e0b193d3be1e197676e45e4e5
SHA1: 70d06448e5d4be6e550f455366ec1ef87334c8cb
SHA256: 0cfeb2fc6088edf45cb10d5623cd726a2d6c13c89554fe932d9cc6c6f9792dc9
SSDeep: 1536:4xKPHJuJiK73KzzHNDgD9tMXLz7TFTDjaZyZbJ:S0UJ973K3tcD9t2zPhSobJ
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\3_jeQviZoYNlnOtMBcq.png - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\3_jeQviZoYNlnOtMBcq.png id-bry0hIIfVldG0S8v.BDKR MD5: b106d41e581b87a8ef8acd3365828e35
SHA1: f11ef26f1d8586e02942eaca3704835e1223666a
SHA256: 55212888814ea0bebecdb58d6444035eeadce5f5e46c09ccf7cc623fd57800a3
SSDeep: 3072:4mDB62Y7TFdZrbdxlbFQxtwG6DxA1B+K22:r/Y75v1xlFQxtEDxUF22
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\6wzmOUQs0Tg8egP.jpg - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\6wzmOUQs0Tg8egP.jpg id-bry0hIIfVldG0S8v.BDKR MD5: a0c8262200e37aed846edd3e24b90bea
SHA1: ff21f4533a8aa6f5e8c87d5869c8c0b58fdb850e
SHA256: 7c8a1cb924a91217f825350132550b1ec2d49ec416d8521671ccf2a72dc7fbcc
SSDeep: 1536:v4j8Z0cQpi6rPtH4+X7eM/46OmeL3Rh4Y6CSff8Y3S6xIa3bUKpiFKgzmCrl9Naz:v4jls6rPtH4+X6cO/h4Y6C6fp9OqNQzC
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\82U1GLPSN4SRNIud.gif - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\82U1GLPSN4SRNIud.gif id-bry0hIIfVldG0S8v.BDKR MD5: 7e1e9700ba458e5b96391a73fd4f8c19
SHA1: 50a290e07d76dcbf5868b1a7c6d50ec4ee42175c
SHA256: 3c140e0d175dd455a267230ae08e30503bfd3d4c141d50383829ab4bd55980df
SSDeep: 1536:DF5MdEaOgUB0aEFjPryx/S1pnEsb7r+r/Kg29F35v482NkSXRa6z56y:DLaOgPaejPrO4DX2/KZ35g8uRae
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\9NWJiKv80-C.jpg - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\9NWJiKv80-C.jpg id-bry0hIIfVldG0S8v.BDKR MD5: 440ba055fb8d6dc7d27ce0ce894aa35a
SHA1: 7849d1b30a863d8546395b83b9d6d537f0d91b35
SHA256: e95b9f9a816110fededa3e054e44bfb0f803559b34ca79eefd03f7d50ac8e3ab
SSDeep: 768:zZ91k4/bUat5h1vW6XaFcvF43XcJv8AmwOZCQTHxp/c/c+Dn0cZS7s3IM38Bpwir:Fr5ZL+6JvF43cv3UwnDn0cU7zjwinHL
ImpHash: None 		Access Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\AagfwO5FfrKxIJ.gif - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\AagfwO5FfrKxIJ.gif id-bry0hIIfVldG0S8v.BDKR MD5: e32e0b213619aa4ef35cda361bc6711b
SHA1: f31b683bded79c8cef9137c5e2954e65c721f439
SHA256: 9871d9cec2c4fdcd5a155100c78ed5328e4b801603dbefe08217a4ff2d2599fb
SSDeep: 384:fbNBCaO1RKbcGVfzbcWxd26LrtYIcyxzB0CuxA/C:RBCVbGVfzn1qIvzQGq
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\be8uU4s7v.bmp - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\be8uU4s7v.bmp id-bry0hIIfVldG0S8v.BDKR MD5: 4eb855c73776ce484257864e63aba27d
SHA1: 4dd75e5f16da23463d8691f40b6ab1d486e24157
SHA256: ec031f740ad634cf535db64ed6c096391381bb9f6972deadbd03b8599c4406e3
SSDeep: 1536:z3LMmxTeXV/LlsXG2se5tXlva0CZpACB0yuQ5DOzh13Iqd23HVxHV:zaXVJsPPVC0Cf5B0Ll1Yc8HVxHV
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\bVC-tf9cuKZd9WIKBbf.gif - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\bVC-tf9cuKZd9WIKBbf.gif id-bry0hIIfVldG0S8v.BDKR MD5: 7df03fd6beeaf5f99b0d99b6b2fd3175
SHA1: c0fc6030185238e4d6910d123f6fa2e5658c7844
SHA256: bfffdcb6a75471688661a49c3610d9c66b5f8b865214ea464e05ad4276b67126
SSDeep: 1536:8bgwhVR8WIJMW5pGgQ6mqK+YdvuWdal7u9e1k5a+WgrTyPnqH3Vx/Hym9s/enp6t:Gj6WRMwAK+RWdR9n1rKqHX3EqH8
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\BXRrb4wqQer.jpg - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\BXRrb4wqQer.jpg id-bry0hIIfVldG0S8v.BDKR MD5: ac0762f6e923f633ba9932319b776442
SHA1: 37d23d588c262e207ef5bca16430f51c2d915e8a
SHA256: a3878b71623e5571c0bfda66d68e76558095699e775038ba037eddf600bd38af
SSDeep: 1536:udYrKVb9SpVA411oeg6t35HA8UtZzFqpNaTNv95/iKNNELbXfE/VUCFGwUucn:u2ub9aVAcoW5g8o3yNmNvLnELDfEdUCy
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\c1M5lwW.bmp - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\c1M5lwW.bmp id-bry0hIIfVldG0S8v.BDKR MD5: afb9a21804962fae44c88d52b0340050
SHA1: 5fa3820744bc7b1a49c81d35ae0415bbf1e3b760
SHA256: 9746e5c45865d4c276d1227b58182f776b9220b13a2f5a06eb8bb2d3fb2c7416
SSDeep: 1536:tryhdTG6LINy7FbPB3PGozu75/PHuM8/J2:tGdTGuzlGOc//uJB2
ImpHash: None 		Access Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\cQRffh50TJ.png - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\cQRffh50TJ.png id-bry0hIIfVldG0S8v.BDKR MD5: 25077af00b4a748e8d666e5c0bc1cd90
SHA1: cd54386d7af5569e6117df98c6413ee85125c348
SHA256: eeca06de81186cbac9aebe7fa3a3c86bbd3b89be5c7a906115d23c20718af184
SSDeep: 1536:dAXqQGF9H7sPMR6/p8tE3Zm9xKMZShHOATwpGj:dnQGXH7XUB8u3ZcIsAsY
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\desktop.ini - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\desktop.ini id-bry0hIIfVldG0S8v.BDKR MD5: 751f3886ca2bfae3462ee194985a4570
SHA1: 9b11f93476f675aadbb1f1f8b71825851e463ea7
SHA256: 5351bb75ce8128f22d349d59d92cc1c81cae8403968c5e8f4923e2e8cf756622
SSDeep: 24:jXrvmUvaxYoiR8p39+uftEDPwTPnyt7A9KMYVP3NY3z3m8MGQ2bkRyIa58rlzgBQ:Pna2otSuftEDsyq4YJI+8rlf4I
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\DuvSsdgB.png - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\DuvSsdgB.png id-bry0hIIfVldG0S8v.BDKR MD5: aac4dfe775cd41541a7277e2800832a6
SHA1: 37b5ddce43a126ffe0b770575aba5842f0f329f6
SHA256: 6e3339b0b385e9ffaae2f05e5655b131c584bc75c5c9f67c65815378d0890ff5
SSDeep: 768:RJ62hMV6OLJ2OHwe2uaXO685D26cvuDPLHC9nKtb5LaG1+1imXCP9:H3hzxsv2uuL2DPLi9nKtFuZq
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\ghoVSrE2rI.png - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\ghoVSrE2rI.png id-bry0hIIfVldG0S8v.BDKR MD5: 8c49d11a53d8e893ee7b37665d237d63
SHA1: 6404926582bec889813327f03edec28e35b45f11
SHA256: 200fcb52c2988d39a1fc49e965dd2cf42a44522d48f05d8b490cce92c2b2025e
SSDeep: 192:1UxWNXM4IUD0XbRWCxfDvC/tyDoAoq4gvpwekimn8rRZ/jocFhLC:1xNXMZSGQCxfDalcHd4YW3imn83kQLC
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\iAeOeT.jpg - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\iAeOeT.jpg id-bry0hIIfVldG0S8v.BDKR MD5: e0757da2120ebaf4c6d0c51c2c832559
SHA1: ad5fd5dd74e44c617c38631fe8fd808b5d4d8431
SHA256: c8dd44f55f5eb73063f508ecfd5e595e4346e0af4e7a7890302051f95041d603
SSDeep: 3072:/SNTrt944lTjTC77s4smt8T8EBa5euEBi/D:/S54QTjTC77s4sW8T8EwEu1D
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\KU8coeDggn.gif - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\KU8coeDggn.gif id-bry0hIIfVldG0S8v.BDKR MD5: e762e3e81774e4f712eb49c82f261038
SHA1: f4ff7758e9465f1b0ba9ac6240b94e3fea0bbe93
SHA256: 4cbca134c95e0473590065e1bbb13ad8b1c9e75dc2be3e6340e2e9b3b9286444
SSDeep: 1536:0CeCuE0i6jaPeXe+DoO6Dj350K3mnKQOfL8Wk4:7AnDp6DjpsnnOfL8R4
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\Lhdb7FgPQ1J3_Q8MQ.jpg id-bry0hIIfVldG0S8v.BDKR MD5: 8314593c3f8d83d448bb0d8164ed0227
SHA1: 6b0793a9a93e2fdbdd2ded0cc779f556619c1642
SHA256: a3d2a7a3e75ecd5a7f15a5f1cbdecaf50ebfdb7eec48c136630fe672b6f8025f
SSDeep: 1536:W1zDCiynXY3sW27VgG5j1u3wBUf9poxkk2AGK+cF:WJDCXocWTG5xo/oxKAGK+cF
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\M3H2AMCOsHfNXWLKK.png id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\mkItPg.bmp id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\mLz5aTSV45LFpR.jpg id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\mqSXx4krgCAtBWFKak6.gif id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\N3cQX8Etk.bmp id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\NqV8Oj332_g4dk.gif id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\Qhdj.gif id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\QkQ63xnrFn3yf00M- H.gif id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\Ssj2-RG.gif id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\usLic1N81-rLloJD.gif id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\vs9s rE86URZWip2n.png id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\W1S7Fs61QLru.gif id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\w2-6Kr.gif id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\zCfM_ObF5iT.gif id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\zUMBWC.png id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Pictures\ZxDAg1y5.png id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Saved Games\desktop.ini - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Saved Games\desktop.ini id-bry0hIIfVldG0S8v.BDKR MD5: 45ae9046c76e913b6fcc30aa2e3292bc
SHA1: 61c9a1e10d673507c4ca5efc56660733638c047e
SHA256: 2ddf477d85650547545d2cf89b2ab2dc6d76ae9e555191019e989c0157171872
SSDeep: 24:nVlke+/Lb7jmrCXEwQsj8Ryt7A9KMYVP3NY3z3m8MGQ2bkRyIa58rlzgBbKW5Wcw:VCxbO4rQsj8Uq4YJI+8rlf4I
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Saved Games\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Searches\desktop.ini - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Searches\desktop.ini id-bry0hIIfVldG0S8v.BDKR MD5: b7aff0fb1d94a495bf85b0d575edc70f
SHA1: 5fbea8c273b8118ad86f148f195cc4de58c6de21
SHA256: daf94049db58c8fa57887794360d8303cb5300c1ad1463ba0d499e8562784197
SSDeep: 24:rSf8O9yaBxUrqccAPAF/GJPQxneoVaxXyt7A9KMYVP3NY3z3m8MGQ2bkRyIa58rt:g8OBBldZZuiq4YJI+8rlf4I
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Searches\Everywhere.search-ms - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Searches\Everywhere.search-ms id-bry0hIIfVldG0S8v.BDKR MD5: db13f193dcc0126531a2dea81f8afe68
SHA1: d57b90ba4d366281dca86151066d7a771a01f500
SHA256: 5bb3a6548b379d68dc2ba142cf72a0c09b4610f7ee372f4d760ed623a3a7be24
SSDeep: 24:FZ/QFXOQzxDXAStygNHBzyt7A9KMYVP3NY3z3m8MGQ2bkRyIa58rlzgBbKW5WcGn:FZ/GHxT8gN8q4YJI+8rlf4I
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Searches\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Searches\Indexed Locations.search-ms - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Searches\Indexed Locations.search-ms id-bry0hIIfVldG0S8v.BDKR MD5: a6a8c8e24022ae13f9141bbf85a7de7c
SHA1: e87c6b1019982607aceb9e84132c88d315e5de55
SHA256: 176ee2903abb87cd156def082e76fa298e05b2a6204de3d1b485ac062d814f93
SSDeep: 24:1umfA9qxsPi5ni80hYlihv80ivSyt7A9KMYVP3NY3z3m8MGQ2bkRyIa58rlzgBb8:YmfA4xYLYUhv80iJq4YJI+8rlf4I
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\1 82DV\8xX2fIJi.swf - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\1 82DV\8xX2fIJi.swf id-bry0hIIfVldG0S8v.BDKR MD5: 598bc0fc15b94d3f796a6ed28626b07a
SHA1: 291150488e95f5fff97cf3511de8a645f96b3a14
SHA256: 3d2631ebc9137225695dabee799e2c9196dcefe01e2cf7e0e2f38b69f9b98687
SSDeep: 768:9gH39Wm03xz1nf4F45FHgcSdIx9i90wUSHT78gXgv:9gc5c4LH+Cb/Sn8gXW
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\1 82DV\ArpKK-QGNbVoL.flv - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\1 82DV\ArpKK-QGNbVoL.flv id-bry0hIIfVldG0S8v.BDKR MD5: 0789e039a5565ead33cd4977f8ca2720
SHA1: aa6e11457c4c8ea96e343d2ae0600ea657aa0134
SHA256: 94c238c7fe6fdf746d9c506953a181411f0fcd5e6fda2feabde2eb71dd1339d8
SSDeep: 3072:YjcEYMjLvPA29MWgdnal6gDMOj17r/TgnJv8kjnp+pvu:RMjTPDydallDr17rrgn3Yc
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\1 82DV\CouoxFa1.flv - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\1 82DV\CouoxFa1.flv id-bry0hIIfVldG0S8v.BDKR MD5: 4312be93e40fb02c91200fb97fe365ad
SHA1: f061930b46dc193a590574646087c6d21edf0e0e
SHA256: 2dcc63c28404c605beb7cee9703b34b15341e24d93399992063e4b31fc5a108e
SSDeep: 1536:TAEkJbtynzZFZTSmYKvQQWrNsSDyE3rCzg0:MEkJbtyzZF4mYKvQLBX13mzV
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\1 82DV\g05j9Qz\7-2tJN OYWR8M0.flv - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\1 82DV\g05j9Qz\7-2tJN OYWR8M0.flv id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\1 82DV\g05j9Qz\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\1 82DV\g05j9Qz\TIi8YPbDlaOLAKiDaS\2UPKA7hyi.flv id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\1 82DV\g05j9Qz\TIi8YPbDlaOLAKiDaS\7_1TF.avi id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\1 82DV\g05j9Qz\TIi8YPbDlaOLAKiDaS\CrdUTJLjqC0FOs7WZSy\How To Restore Files.txt - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\1 82DV\g05j9Qz\TIi8YPbDlaOLAKiDaS\How To Restore Files.txt - Access, Write
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\1 82DV\g05j9Qz\TIi8YPbDlaOLAKiDaS\IFs 473n3ew8.flv id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\1 82DV\g05j9Qz\TIi8YPbDlaOLAKiDaS\PM9iKKYIkn9z1tAP9I.swf id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\1 82DV\g05j9Qz\tuZYcwv.mp4 id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\1 82DV\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\1 82DV\lp0OA0hCWhhS.mp4 - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\1 82DV\lp0OA0hCWhhS.mp4 id-bry0hIIfVldG0S8v.BDKR MD5: e0691f53f0ca539eac40c39d0b4e5af4
SHA1: 1fa7bbc6aa0de6185de4449b8af47f5054414e4c
SHA256: 5b9ec36d9caff728bfe56c35c5d89a46f2915b63352325183ec2620461f2625a
SSDeep: 1536:BUJBiqVGA2PMkkAfIOdaB/WvxYwJhFzE1:G3VpASAfVO/WZTHFzs
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\6SgVBsYZdT.swf - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\6SgVBsYZdT.swf id-bry0hIIfVldG0S8v.BDKR MD5: 87e95a3d053e8d16db969a160037ce06
SHA1: ee2f9d6cfb40633d28f697c1cbc76f308c5fba0a
SHA256: b65f27ec55c39daf797b1bdb629d96c1fffb5947f19ddfdb906b92ce9d0ac420
SSDeep: 768:ua82rAk1vEj/CG9u9sp8SbsdHhQoFRQ0PWpqWXntL3/5mJvgUVo4l:ua8eAk1cjaGE9OoP5FRP+3tLhmJv/64l
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\BDLjWOroke8o.swf - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\BDLjWOroke8o.swf id-bry0hIIfVldG0S8v.BDKR MD5: c1dae7dadc7941fdb9ad0702d50b85c5
SHA1: a332144b08f6279dee094c7f542a9442fbc12070
SHA256: 48fe092ce69c6890d6013fbe94545f16d01f242fee18ac7a7354540eace5f9c3
SSDeep: 1536:OsmysQzK8UHbL6/4cngAvWgdnUQUkRXxYvwpSaPARcy91qBdiy:9x4V/O4c1OgBUOhYvoqRcy91qBYy
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\desktop.ini - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\desktop.ini id-bry0hIIfVldG0S8v.BDKR MD5: 60b6f4fc139c1050a1fb46aa454e991a
SHA1: 0d63673a755f236393964b196a20faa2cd6df1e7
SHA256: a4e5b6fe6905c92e541156ec805cd93d971e77a14efb246effbc11e90fca703e
SSDeep: 48:g1cKf1yR/d8s7garpDRPonDHq1q4YJI+8rlf4I:kcKfeW+DQbqwLJrI
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\hUrKRx28Hz-Nx\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\hUrKRx28Hz-Nx\IEaKhwDUaCNJ5.mkv - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\hUrKRx28Hz-Nx\IEaKhwDUaCNJ5.mkv id-bry0hIIfVldG0S8v.BDKR MD5: 07ff7eea3ccd46e37d9c657621c74471
SHA1: befe0248b8ccd2054d04bb1dfff5d767f444c128
SHA256: 9aaf061a9eda0f958f0de446211d6f5d26ec3c9ff790b34d46e4d1348be83443
SSDeep: 1536:OOMiDrHXGxGeDHusMZkUcevz/y5tlhBJtL5pK54U7g5tIS6LREfBgW:P3HreDurZk4vz+tlfWg5y3Wft
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\hUrKRx28Hz-Nx\lMHvIe3HLUK9sBCYE5a.swf - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\hUrKRx28Hz-Nx\lMHvIe3HLUK9sBCYE5a.swf id-bry0hIIfVldG0S8v.BDKR MD5: 7d849758bad126610d4a6be01887e162
SHA1: 7e86c69fca0456d7d8827fc6f360e0bb6c5a314f
SHA256: c5d17be709f5f39d2f0bdc138fbad813de7b6c203bed3eaae50f6def136fde2d
SSDeep: 1536:ZUZj9eP0686FKWeKAmdqiAfWkKUWpAAFM:eZj8Pk6MWbAWqiAfWkmVm
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\hUrKRx28Hz-Nx\Tly1NB.mkv - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\hUrKRx28Hz-Nx\Tly1NB.mkv id-bry0hIIfVldG0S8v.BDKR MD5: 358eb6fccde341dd0678e9ef5df60e88
SHA1: 0fbce4b5ea189213769cf83b1d8763322702769d
SHA256: 57ba8285efd1bdfb6dbff4af61c1ba1fe79c92f01d29ea9e24b53d17ad7ec08b
SSDeep: 1536:RazZI0oJ619gGcxiu4R7k6WcP/i/cmzj15Ejn:RWRO61eGUWxhWcPOcmFm7
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\ISzELKWmrU6cLqu\82NPkSzIwNQa.mp4 - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\ISzELKWmrU6cLqu\82NPkSzIwNQa.mp4 id-bry0hIIfVldG0S8v.BDKR MD5: c0c02f17c2c6764c2703525cc2f7bebc
SHA1: d1d001071a71b5d7e30e0c32111e030c59736172
SHA256: a5c642311e62363a181c7b0096cbe92f9ddd9314d5d22c53111246259ed57193
SSDeep: 768:MlcicZ1+AK/r0zPMaG9x0Z1p9gu2e4ObhyI0fJ:MlcBz+Z07MaG9aN92
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\ISzELKWmrU6cLqu\fWCi8GqHv.flv - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\ISzELKWmrU6cLqu\fWCi8GqHv.flv id-bry0hIIfVldG0S8v.BDKR MD5: 2f83c2d4d2cf75f0fa7fff4122a39471
SHA1: bc31fd006e7e0f48258cbd19c1f46b9ba4d5763d
SHA256: 82be7c2ffbfbe63d402405c532189f0e414a47f5a547a2e5e852ace268aa8e59
SSDeep: 768:ndscQxI9t5nUz2+GhC8phL9EpXJdUnFRZ+07aPKNr+Sa2AE:nScQxOtuFchRElMV76KlxjAE
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\ISzELKWmrU6cLqu\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\ISzELKWmrU6cLqu\mXRNnT5\1805vjPgt2k9.mp4 - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\ISzELKWmrU6cLqu\mXRNnT5\1805vjPgt2k9.mp4 id-bry0hIIfVldG0S8v.BDKR MD5: 0a74db67e93937090cfef7c9262c8405
SHA1: 0f230e966ce8d9d3e10ed13a3470c4568df6e526
SHA256: 79f01c6149d24182d3d71cd030d8d8c46e796330cea6f6d84dbd03005a038218
SSDeep: 1536:6E0/PdO0eBMtctLKtkdJxybfEZf+Drh7DJ33/kiPJ/58edNLe2jQABCs2wV9YRIR:23dO0tkLUk7M44PlJ39e2j9Cs239eadA
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\ISzELKWmrU6cLqu\mXRNnT5\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\ISzELKWmrU6cLqu\uvT3U1eLcUuXN33LX1.flv - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\ISzELKWmrU6cLqu\uvT3U1eLcUuXN33LX1.flv id-bry0hIIfVldG0S8v.BDKR MD5: f24a842b32067336f63d76f2da581ac3
SHA1: c7667c1e2cdf0cc0e0afcad808875f7bb9e17804
SHA256: 20d462a4085551d9712146648ab957241fe601569dd65eb4f502ffecad911829
SSDeep: 1536:jGqTTAhijmz7Hrz3u6KtETAiZsNOP7mmTaB1LDawMDiUDqxWByU:jDRa3LvAiao6mT21LyDiW04yU
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\Z9nkSGY0laIlN\8YBa.mkv - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\Z9nkSGY0laIlN\8YBa.mkv id-bry0hIIfVldG0S8v.BDKR MD5: 2913f2e3c9705edc994484abb31db964
SHA1: 0281fff33923391e5ec320dbc93663b447afa129
SHA256: 338b8051686f51dfe6469edd393d73293cff8961d277131df15874bd91373dec
SSDeep: 768:SOilrl6TcwP4JKTBnRKHTCE84iXQCIQMlYwXdIb7VbuD74nyB:SOsrScwPDri+PUC77wXUpuDQi
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\Z9nkSGY0laIlN\bc3GSd9GTrIuC8yT.avi - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\Z9nkSGY0laIlN\bc3GSd9GTrIuC8yT.avi id-bry0hIIfVldG0S8v.BDKR MD5: 3fddc062aa607437b1887ac2b5d08133
SHA1: f5a38cf343834be49554693f05aca5cdec4a423a
SHA256: 05d3cbc1377f08de48882356ceab963a625641acd857616d8328bbeb60d65b5c
SSDeep: 768:3RKp0sj+yUIfzM2xgvLRI1Mh9U3FUqYfARg2vzvcMwSgyhM5uUmwWW:3RJsHUIxO+73FU4Rg2rEBSg15uHW
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\Z9nkSGY0laIlN\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\Z9nkSGY0laIlN\JwY69bt7Heb.flv - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\Z9nkSGY0laIlN\JwY69bt7Heb.flv id-bry0hIIfVldG0S8v.BDKR MD5: 4809344f7f1ec9cd59e44afcd75ea10c
SHA1: eae26966a882110f209467da3f0687f68e1c0251
SHA256: 9c30c8beb7b986eb43db62b37ef73eef375637e60f3fdebe6af9819858150733
SSDeep: 768:ap5+uaSOq1Kz5qm3bRRPivvdETviCCewWg5UjBIgH6D:U+ufPKtqm3XQEH4y1IgaD
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\Z9nkSGY0laIlN\wP80jSXk-sTG.mkv - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\Z9nkSGY0laIlN\wP80jSXk-sTG.mkv id-bry0hIIfVldG0S8v.BDKR MD5: fbda6468d995b06f5621b8c280eadc19
SHA1: 4db42f86a900c0cda4cc38d78abc299cf8cb7dbd
SHA256: 9098beb5fb97d51048bbb6a849f78e73699ebff802f20803601a6093d92597da
SSDeep: 96:wbcdr997Gs6i+rUSkKzLDdx5dvZvxocAmuH8ccsmL9NFMoAPTEdLJrI:wabGsarU1SLj/nAmIY910EdC
ImpHash: None 		Access, Write Created File
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\zkHjeCw.swf - Access
\\?\C:\Users\5p5NrGJn0jS HALPmcxz\Videos\zkHjeCw.swf id-bry0hIIfVldG0S8v.BDKR MD5: fb2a622ba7a1cb0b097262bfd36b278d
SHA1: f4a00b4074aaec2ede68ddbf48c23f2c557be47d
SHA256: d13af1dd414a319b805fb2f45c3ede7f48c8809d6bf23b95b9abc726049f2708
SSDeep: 1536:SRdN9Me9ImnRgjskNsFi4WYu4HHLAnyEp2OamuR23yPgzz3u:TeImRgjsEs44WYu4ncnUOaR2QgzC
ImpHash: None 		Access, Write Created File
\\?\C:\Users\All Users\Adobe\Acrobat\10.0\Replicate\Security\How To Restore Files.txt - Access
\\?\C:\Users\All Users\Adobe\ARM\Reader_10.0.0\AdbeRdrSecUpd10111.msp - Access
\\?\C:\Users\All Users\Adobe\ARM\Reader_10.0.0\AdbeRdrSecUpd10111.msp id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\All Users\Adobe\ARM\Reader_10.0.0\AdbeRdrUpd10110_MUI.msp id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\All Users\Adobe\ARM\Reader_10.0.0\How To Restore Files.txt - Access
\\?\C:\Users\All Users\Microsoft Help\How To Restore Files.txt - Access
\\?\C:\Users\All Users\Microsoft Help\Hx.hxn - Access
\\?\C:\Users\All Users\Microsoft Help\Hx.hxn id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\All Users\Microsoft Help\MS.EXCEL.14.1033.hxn - Access
\\?\C:\Users\All Users\Microsoft Help\MS.EXCEL.14.1033.hxn id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\All Users\Microsoft\Assistance\Client\1.0\en-US\Help_MKWD_AssetId.H1W - Access
\\?\C:\Users\All Users\Microsoft\Assistance\Client\1.0\en-US\Help_MKWD_AssetId.H1W id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\All Users\Microsoft\Assistance\Client\1.0\en-US\How To Restore Files.txt - Access
\\?\C:\Users\All Users\Microsoft\Crypto\RSA\S-1-5-18\6d14e4b1d8ca773bab785d1be032546e_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\Users\All Users\Microsoft\Crypto\RSA\S-1-5-18\How To Restore Files.txt - Access
\\?\C:\Users\All Users\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\How To Restore Files.txt - Access, Write
\\?\C:\Users\All Users\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\How To Restore Files.txt - Access
\\?\C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-US\How To Restore Files.txt - Access
\\?\C:\Users\All Users\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\How To Restore Files.txt - Access
\\?\C:\Users\All Users\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-US\How To Restore Files.txt - Access
\\?\C:\Users\All Users\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\How To Restore Files.txt - Access
\\?\C:\Users\All Users\Microsoft\IdentityCRL\How To Restore Files.txt - Access
\\?\C:\Users\All Users\Microsoft\IdentityCRL\ppcrlconfig.dll - Access
\\?\C:\Users\All Users\Microsoft\IdentityCRL\ppcrlconfig.dll id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\Users\All Users\Microsoft\IdentityCRL\ppcrlui.dll - Access
\\?\C:\Users\All Users\Microsoft\IdentityCRL\ppcrlui.dll id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\All Users\Microsoft\MF\Active.GRL - Access
\\?\C:\Users\All Users\Microsoft\MF\Active.GRL id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\Users\All Users\Microsoft\MF\How To Restore Files.txt - Access
\\?\C:\Users\All Users\Microsoft\MF\Pending.GRL - Access
\\?\C:\Users\All Users\Microsoft\MF\Pending.GRL id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\All Users\Microsoft\Network\Downloader\How To Restore Files.txt - Access
\\?\C:\Users\All Users\Microsoft\Network\Downloader\qmgr1.dat - Access
\\?\C:\Users\All Users\Microsoft\Network\Downloader\qmgr1.dat id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\All Users\Microsoft\OFFICE\DocumentRepository.ico - Access
\\?\C:\Users\All Users\Microsoft\OFFICE\DocumentRepository.ico id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\All Users\Microsoft\OFFICE\How To Restore Files.txt - Access
\\?\C:\Users\All Users\Microsoft\OfficeSoftwareProtectionPlatform\Cache\cache.dat id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\All Users\Microsoft\OfficeSoftwareProtectionPlatform\Cache\How To Restore Files.txt - Access
\\?\C:\Users\All Users\Microsoft\OfficeSoftwareProtectionPlatform\How To Restore Files.txt - Access
\\?\C:\Users\All Users\Microsoft\OfficeSoftwareProtectionPlatform\tokens.dat id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\All Users\Microsoft\RAC\PublishedData\How To Restore Files.txt - Access
\\?\C:\Users\All Users\Microsoft\RAC\PublishedData\RacWmiDatabase.sdf - Access
\\?\C:\Users\All Users\Microsoft\RAC\PublishedData\RacWmiDatabase.sdf id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\Users\All Users\Microsoft\RAC\StateData\How To Restore Files.txt - Access
\\?\C:\Users\All Users\Microsoft\RAC\StateData\RacDatabase.sdf - Access
\\?\C:\Users\All Users\Microsoft\RAC\StateData\RacDatabase.sdf id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\Users\All Users\Microsoft\RAC\Temp\How To Restore Files.txt - Access
\\?\C:\Users\All Users\Microsoft\RAC\Temp\sql65A4.tmp - Access
\\?\C:\Users\All Users\Microsoft\RAC\Temp\sql65A4.tmp id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\How To Restore Files.txt - Access
\\?\C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile10.bmp - Access
\\?\C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile10.bmp id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile11.bmp - Access
\\?\C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile11.bmp id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile12.bmp - Access
\\?\C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile12.bmp id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile13.bmp - Access
\\?\C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile13.bmp id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile14.bmp - Access
\\?\C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile14.bmp id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile15.bmp - Access
\\?\C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile15.bmp id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile16.bmp - Access
\\?\C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile16.bmp id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile17.bmp - Access
\\?\C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile17.bmp id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile18.bmp - Access
\\?\C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile18.bmp id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile19.bmp - Access
\\?\C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile19.bmp id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile20.bmp - Access
\\?\C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile20.bmp id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile21.bmp - Access
\\?\C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile21.bmp id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile22.bmp - Access
\\?\C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile22.bmp id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile23.bmp - Access
\\?\C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile23.bmp id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile24.bmp - Access
\\?\C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile24.bmp id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile25.bmp - Access
\\?\C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile25.bmp id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile26.bmp - Access
\\?\C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile26.bmp id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile27.bmp - Access
\\?\C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile27.bmp id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile28.bmp - Access
\\?\C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile28.bmp id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile29.bmp - Access
\\?\C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile29.bmp id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile30.bmp - Access
\\?\C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile30.bmp id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile31.bmp - Access
\\?\C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile31.bmp id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile32.bmp - Access
\\?\C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile32.bmp id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile33.bmp - Access
\\?\C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile33.bmp id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile34.bmp - Access
\\?\C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile34.bmp id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile35.bmp - Access
\\?\C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile35.bmp id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile36.bmp - Access
\\?\C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile36.bmp id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile37.bmp - Access
\\?\C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile37.bmp id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile38.bmp - Access
\\?\C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile38.bmp id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile39.bmp - Access
\\?\C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile39.bmp id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile40.bmp - Access
\\?\C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile40.bmp id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile41.bmp - Access
\\?\C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile41.bmp id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile42.bmp - Access
\\?\C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile42.bmp id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile43.bmp - Access
\\?\C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile43.bmp id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile44.bmp - Access
\\?\C:\Users\All Users\Microsoft\User Account Pictures\Default Pictures\usertile44.bmp id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\All Users\Microsoft\User Account Pictures\guest.bmp id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\All Users\Microsoft\User Account Pictures\How To Restore Files.txt - Access
\\?\C:\Users\All Users\Microsoft\Windows Defender\Definition Updates\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\How To Restore Files.txt - Access
\\?\C:\Users\All Users\Microsoft\Windows Defender\Definition Updates\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\mpasbase.vdm - Access
\\?\C:\Users\All Users\Microsoft\Windows Defender\Definition Updates\{D2B0B133-42ED-44D3-809A-46EBB62BA863}\mpasbase.vdm id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\All Users\Microsoft\Windows Defender\Scans\History\CacheManager\How To Restore Files.txt - Access
\\?\C:\Users\All Users\Microsoft\Windows Defender\Scans\History\Results\Resource\How To Restore Files.txt - Access
\\?\C:\Users\All Users\Microsoft\Windows Defender\Scans\History\Service\How To Restore Files.txt - Access
\\?\C:\Users\All Users\Microsoft\Windows Defender\Support\How To Restore Files.txt - Access
\\?\C:\Users\All Users\Microsoft\Windows Defender\Support\MPLog-07132009-221054.log - Access
\\?\C:\Users\All Users\Microsoft\Windows Defender\Support\MPLog-07132009-221054.log id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\All Users\Microsoft\Windows NT\MSFax\Common Coverpages\en-US\How To Restore Files.txt - Access
\\?\C:\Users\All Users\Microsoft\Windows NT\MSFax\VirtualInbox\en-US\How To Restore Files.txt - Access
\\?\C:\Users\All Users\Microsoft\Windows NT\MSScan\How To Restore Files.txt - Access
\\?\C:\Users\All Users\Microsoft\Windows NT\MSScan\WelcomeScan.jpg - Access
\\?\C:\Users\All Users\Microsoft\Windows NT\MSScan\WelcomeScan.jpg id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\All Users\Mozilla\logs\How To Restore Files.txt - Access
\\?\C:\Users\All Users\Mozilla\logs\maintenanceservice-install.log - Access
\\?\C:\Users\All Users\Mozilla\logs\maintenanceservice-install.log id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\Users\All Users\Package Cache\42D5BEC7DDFBD49E76467529CBC2868987BF8460\packages\Patch\x64\How To Restore Files.txt - Access
\\?\C:\Users\All Users\Package Cache\42D5BEC7DDFBD49E76467529CBC2868987BF8460\packages\Patch\x64\Windows6.1-KB2999226-x64.msu id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\All Users\Package Cache\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\packages\Patch\x64\How To Restore Files.txt - Access, Write
\\?\C:\Users\All Users\Package Cache\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\packages\Patch\x64\Windows6.1-KB2999226-x64.msu id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\All Users\Package Cache\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\packages\vcRuntimeMinimum_x86\cab1.cab id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\All Users\Package Cache\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\packages\vcRuntimeMinimum_x86\How To Restore Files.txt - Access
\\?\C:\Users\All Users\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\How To Restore Files.txt - Access
\\?\C:\Users\All Users\Package Cache\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\packages\vcRuntimeAdditional_amd64\cab1.cab id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\All Users\Package Cache\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\packages\vcRuntimeAdditional_amd64\How To Restore Files.txt - Access
\\?\C:\Users\All Users\Package Cache\{3c3aafc8-d898-43ec-998f-965ffdae065a}\How To Restore Files.txt - Access
\\?\C:\Users\All Users\Package Cache\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\packages\vcRuntimeMinimum_x86\cab1.cab id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\All Users\Package Cache\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\packages\vcRuntimeMinimum_x86\How To Restore Files.txt - Access
\\?\C:\Users\All Users\Package Cache\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\packages\vcRuntimeAdditional_x86\cab1.cab id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\All Users\Package Cache\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\packages\vcRuntimeAdditional_x86\How To Restore Files.txt - Access
\\?\C:\Users\All Users\Package Cache\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\packages\vcRuntimeMinimum_amd64\cab1.cab id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\All Users\Package Cache\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\packages\vcRuntimeMinimum_amd64\How To Restore Files.txt - Access
\\?\C:\Users\All Users\Package Cache\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\packages\vcRuntimeAdditional_amd64\cab1.cab id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\All Users\Package Cache\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\packages\vcRuntimeAdditional_amd64\How To Restore Files.txt - Access
\\?\C:\Users\All Users\Package Cache\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\packages\vcRuntimeMinimum_amd64\cab1.cab id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\All Users\Package Cache\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\packages\vcRuntimeMinimum_amd64\How To Restore Files.txt - Access
\\?\C:\Users\All Users\Package Cache\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\packages\vcRuntimeAdditional_x86\cab1.cab id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\All Users\Package Cache\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\packages\vcRuntimeAdditional_x86\How To Restore Files.txt - Access
\\?\C:\Users\All Users\Package Cache\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\packages\vcRuntimeMinimum_x86\cab1.cab id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\All Users\Package Cache\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\packages\vcRuntimeMinimum_x86\How To Restore Files.txt - Access
\\?\C:\Users\All Users\Package Cache\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\packages\vcRuntimeMinimum_x86\vc_runtimeMinimum_x86.msi id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\All Users\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\How To Restore Files.txt - Access, Write
\\?\C:\Users\All Users\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\packages\vcRuntimeMinimum_amd64\cab1.cab id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\All Users\Package Cache\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\packages\vcRuntimeMinimum_amd64\How To Restore Files.txt - Access
\\?\C:\Users\All Users\Package Cache\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\packages\vcRuntimeAdditional_amd64\cab1.cab id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\All Users\Package Cache\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\packages\vcRuntimeAdditional_amd64\How To Restore Files.txt - Access
\\?\C:\Users\All Users\Package Cache\{e52a6842-b0ac-476e-b48f-378a97a67346}\How To Restore Files.txt - Access
\\?\C:\Users\All Users\Package Cache\{e52a6842-b0ac-476e-b48f-378a97a67346}\VC_redist.x64.exe id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\All Users\Package Cache\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\How To Restore Files.txt - Access
\\?\C:\Users\All Users\Package Cache\{f325f05b-f963-4640-a43b-c8a494cdda0f}\How To Restore Files.txt - Access
\\?\C:\Users\All Users\Package Cache\{f325f05b-f963-4640-a43b-c8a494cdda0f}\VC_redist.x86.exe id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\All Users\Package Cache\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\packages\vcRuntimeAdditional_x86\cab1.cab id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\All Users\Package Cache\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\packages\vcRuntimeAdditional_x86\How To Restore Files.txt - Access
\\?\C:\Users\All Users\Sun\Java\Java Update\How To Restore Files.txt - Access
\\?\C:\Users\All Users\Sun\Java\Java Update\jaureglist.xml - Access
\\?\C:\Users\All Users\Sun\Java\Java Update\jaureglist.xml id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\Users\Default\AppData\Local\How To Restore Files.txt - Access
\\?\C:\Users\Default\Contacts\How To Restore Files.txt - Access
\\?\C:\Users\Default\Desktop\desktop.ini id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\Users\Default\Desktop\How To Restore Files.txt - Access, Write
\\?\C:\Users\Default\Documents\How To Restore Files.txt - Access, Write
\\?\C:\Users\Default\Downloads\How To Restore Files.txt - Access, Write
\\?\C:\Users\Default\Favorites\How To Restore Files.txt - Access
\\?\C:\Users\Default\Favorites\Links\How To Restore Files.txt - Access
\\?\C:\Users\Default\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access Created File
\\?\C:\Users\Default\Links\desktop.ini id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\Default\Links\How To Restore Files.txt - Access, Write
\\?\C:\Users\Default\Music\How To Restore Files.txt - Access
\\?\C:\Users\Default\NTUSER.DAT id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\desktop.ini - Access
\\?\C:\Users\desktop.ini id-bry0hIIfVldG0S8v.BDKR MD5: 9c5d7bb352ad3bd1526b6e7ef342f3bb
SHA1: 9eae6d02922df9d87cca26f96bd18e7461e25cf7
SHA256: 7b6be372a3cee6edbdb5f00ee3bdf0f0d98fe56b6c137f873ec89a62ba398df5
SSDeep: 24:xZEKXl0QFf+7Eev2bzo9Ryt7A9KMYVP3NY3z3m8MGQ2bkRyIa58rlzgBbKW5WcGn:s2l0WOEBbzkUq4YJI+8rlf4I
ImpHash: None 		Access, Write Created File
\\?\C:\Users\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Users\Public\desktop.ini - Access
\\?\C:\Users\Public\desktop.ini id-bry0hIIfVldG0S8v.BDKR MD5: d9e46bb9a87c802720c8cbe6fc6ee7da
SHA1: 31de90057c0c3c89eb82bcf1cc548974f93d68f9
SHA256: cd88ebaddd5966666d5bbf50cca36464372efad0bf9707292389ed3b503329d1
SSDeep: 24:q/oCV8+XM0oQGGnnzZnMfyt7A9KMYVP3NY3z3m8MGQ2bkRyIa58rlzgBbKW5WcGn:qQa97zZnMaq4YJI+8rlf4I
ImpHash: None 		Access, Write Created File
\\?\C:\Users\Public\Desktop\Adobe Reader X.lnk - Access
\\?\C:\Users\Public\Desktop\Adobe Reader X.lnk id-bry0hIIfVldG0S8v.BDKR MD5: 5f5d225f21ee4d08e8790e2632bebba0
SHA1: 3b0200b51986ebe25147897daff88d637c7e59c7
SHA256: 0ab4b8d183221c74cadc3e859dfae6d8c8cd29c2c64dd016db7fb3a39c452eea
SSDeep: 96:VlEZ7ej+9DPvyOzvS04Xr1Uhdh9bJs6LJrI:Vl8vd6OW04Xr1Uhr9F1C
ImpHash: None 		Access, Write Created File
\\?\C:\Users\Public\Desktop\desktop.ini - Access
\\?\C:\Users\Public\Desktop\desktop.ini id-bry0hIIfVldG0S8v.BDKR MD5: 51831d547790e63e40a17cf4ae2b8b3f
SHA1: 69d7c5c5a5581ed22839b148e393847757954e89
SHA256: 96a67df29f01f8f9c994e8cab66dd6ec2c22acd2c1019c13447a82f38a1d2d76
SSDeep: 24:mlALTigL0xjlnnnr1qRgNyt7A9KMYVP3NY3z3m8MGQ2bkRyIa58rlzgBbKW5WcGn:sA/ngnnJFgq4YJI+8rlf4I
ImpHash: None 		Access, Write Created File
\\?\C:\Users\Public\Desktop\Google Chrome.lnk - Access
\\?\C:\Users\Public\Desktop\Google Chrome.lnk id-bry0hIIfVldG0S8v.BDKR MD5: 48c3d5c3caea2f710fa5d1b0c2ec23c3
SHA1: e4bb55e952959bab29c52ce186f93257199f5a8e
SHA256: bd57b65870fc7ec49251fa597e73baff2ed95bef6fea93ac28cdad482008cecb
SSDeep: 48:PhBj2TH6RLPytsErUv7cwDrR/sQJLjR8KaBdDk/ZPTEiX2NzoHH5Gq4YJI+8rlfX:PhBK76RLqtsXxvRt8dBdDkxX2tynLJrI
ImpHash: None 		Access, Write Created File
\\?\C:\Users\Public\Desktop\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Users\Public\Desktop\Mozilla Firefox.lnk id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\Users\Public\Documents\desktop.ini - Access
\\?\C:\Users\Public\Documents\desktop.ini id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\Users\Public\Documents\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Users\Public\Downloads\desktop.ini - Access
\\?\C:\Users\Public\Downloads\desktop.ini id-bry0hIIfVldG0S8v.BDKR MD5: 9f138a17dcebb5c64c9d243c6956ab35
SHA1: aebd3974b476308520b893bd4c32e0eca0ee4db4
SHA256: 887992bfc76e15c752ff67632bc0a12fdc39bb59e0505c1f9fab804ffe86fd2d
SSDeep: 24:hGKNfjyWzxuxaBKFVhRqpAyt7A9KMYVP3NY3z3m8MGQ2bkRyIa58rlzgBbKW5Wcw:hGKRjROLR4Xq4YJI+8rlf4I
ImpHash: None 		Access, Write Created File
\\?\C:\Users\Public\Downloads\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Users\Public\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access Created File
\\?\C:\Users\Public\Libraries\desktop.ini - Access
\\?\C:\Users\Public\Libraries\desktop.ini id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\Users\Public\Libraries\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Users\Public\Libraries\RecordedTV.library-ms id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\Users\Public\Music\desktop.ini - Access
\\?\C:\Users\Public\Music\desktop.ini id-bry0hIIfVldG0S8v.BDKR MD5: d8a01c5d594e9136c73c2859c151345a
SHA1: fcd3e4ea38721a6f395fc143f87759a5a9b8975a
SHA256: 26107c20949c621579bc9a8015481ec2dd83eff06908777d572836e5cda187a1
SSDeep: 24:hMRwOd9CYkYoaEp/77xcxZDyol8Kd0yt7A9KMYVP3NY3z3m8MGQ2bkRyIa58rlzL:CRB9CTZzBNOhq4YJI+8rlf4I
ImpHash: None 		Access, Write Created File
\\?\C:\Users\Public\Music\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Users\Public\Music\Sample Music\desktop.ini id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\Users\Public\Music\Sample Music\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Users\Public\Music\Sample Music\Kalimba.mp3 id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\Public\Pictures\desktop.ini - Access
\\?\C:\Users\Public\Pictures\desktop.ini id-bry0hIIfVldG0S8v.BDKR MD5: 85c683e06497c14985ac7d1db4504f24
SHA1: b8ee97eb4ab743653699a43e16f3d6d3553d409d
SHA256: 77d51f4e8d68b5046f2f2df2eca0de3a9f64cf7fb77774acdf3f855bf07d6d6e
SSDeep: 24:2zdg3tYYzjkwaxYjIAXM6iSRnyt7A9KMYVP3NY3z3m8MGQ2bkRyIa58rlzgBbKW8:ydYYItaxYjIAXt0q4YJI+8rlf4I
ImpHash: None 		Access, Write Created File
\\?\C:\Users\Public\Pictures\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Users\Public\Pictures\Sample Pictures\Chrysanthemum.jpg id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\Public\Pictures\Sample Pictures\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Users\Public\Recorded TV\desktop.ini - Access
\\?\C:\Users\Public\Recorded TV\desktop.ini id-bry0hIIfVldG0S8v.BDKR MD5: df4196f7e98d11d84894cb4ecf52ba69
SHA1: d3bcfe57cff0ee8b9d7fe54d205ad4bc98b1c4d5
SHA256: 5cf71c4f2583253281983729210b85f0cec2938c5228b865dfafd5288dc75609
SSDeep: 24:kXQ8cb4WtipGOQtPKAyt7A9KMYVP3NY3z3m8MGQ2bkRyIa58rlzgBbKW5WcGII:VZbtXOQSq4YJI+8rlf4I
ImpHash: None 		Access, Write Created File
\\?\C:\Users\Public\Recorded TV\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Users\Public\Recorded TV\Sample Media\desktop.ini id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\Users\Public\Recorded TV\Sample Media\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Users\Public\Recorded TV\Sample Media\win7_scenic-demoshort_raw.wtv id-bry0hIIfVldG0S8v.BDKR - Access
\\?\C:\Users\Public\Videos\desktop.ini - Access
\\?\C:\Users\Public\Videos\desktop.ini id-bry0hIIfVldG0S8v.BDKR MD5: 07b4c0bae9acadc01992fa44e00c2550
SHA1: 48c9bb671eb097825d53968cd2d8d9adc4b9913f
SHA256: e94df3f578ce8f61a5cba7297c428df1dd18e6fabf264c4f7db926d6efc0df91
SSDeep: 24:JwVfyN5N4Gsz6I0AoxISe3WxFxnyt7A9KMYVP3NY3z3m8MGQ2bkRyIa58rlzgBb8:WVyN//hBz2q4YJI+8rlf4I
ImpHash: None 		Access, Write Created File
\\?\C:\Users\Public\Videos\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
\\?\C:\Users\Public\Videos\Sample Videos\desktop.ini id-bry0hIIfVldG0S8v.BDKR - Access, Write
\\?\C:\Users\Public\Videos\Sample Videos\How To Restore Files.txt MD5: 73933c04c859f040ccd57ff5a8fe8d7f
SHA1: 2120deed700ea4e4fc438f652112306c413087d4
SHA256: 58d34dd637391656e1580705b0ac7ed625e253bba4b4774369269f162cf904e3
SSDeep: 12:7MJMLM/4k4/ex+JlvwqP4uWKdC6d1JJM41:7MiLKEex+z48bzd1JN1
ImpHash: None 		Access, Write Created File
C:\windows\searchfiles.exe MD5: f1927e7f90416bf39fc7991bbc57e1b3
SHA1: 2367249568ca4a34f8824a9313b03d16d1d7c0bc
SHA256: 539b0b5d54757e8a2b754ecdc2939eb7cf9db0ed1728e0eca407500222668505
SSDeep: 192:yrj2/2OzcYKNEmkmTjtiIKZIF/2oQlLkMBBm4C:j/2OzcJNEmkmTjkI/92oQjBU7
ImpHash: 930ddd1c5a61dbaa873661edbf374853 		Access Created File
System Paging File - Write
Registry (27)
»
Registry Key Name Operations
HKEY_CURRENT_USER\Software\Microsoft\Command Processor Access
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\AutoRun Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\CompletionChar Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DefaultColor Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DelayedExpansion Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DisableUNCCheck Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\EnableExtensions Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\PathCompletionChar Read
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\DateTime\ Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\DateTime\\orsa Read, Write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\DateTime\\rsa Write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\\ConsentPromptBehaviorAdmin Write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\\EnableLUA Write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\\PromptOnSecureDesktop Write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\searchfiles Write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\unlock Write
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\AutoRun Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\CompletionChar Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\DefaultColor Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\DelayedExpansion Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\DisableUNCCheck Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\EnableExtensions Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\PathCompletionChar Read
Export IOCs
Function Logfile
Download-Icon
Exit-Icon

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy". 


    

   

   

    Before
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    After
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    

     
      

       
       
       
       
      

     
     
     
    

   

  

  

   

    
    

     Screenshot
    

    

     Expand-Icon
    

    

     Exit-Icon
    

   

   

    

     icon_left
    

    

     icon_left
    

   

   

   

   

    image