Doc Dropper - Gandcrab Analysis | IOCs
Logo
Try VMRay Analyzer
VTI SCORE: 100/100
Target: Windows 10 (64-bit), MS Office 2016 | ms_office
Classification: Dropper, Trojan, Downloader, Ransomware

99eb1d90eb5f0d012f35fcc2a7dedd2229312794354843637ebb7f40b74d0809 (SHA256)

sample_file.doc

Word Document

Created at 2018-04-20 18:19:00

...

Notifications (2/3)

Some extracted files may be missing in the report since the maximum number of extracted files was reached during the analysis. You can increase the limit in the configuration settings.

The overall sleep time of all monitored processes was truncated from "1 minute, 10 seconds" to "1 minute, 10 seconds" to reveal dormant functionality.

The operating system was rebooted during the analysis because the sample installed a startup script or application for persistence.

Indicators

File (1698)
»
Filename Hash Operations
CONOUT$ - Access
C:\ - Access
C:\$GetCurrent\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\$GetCurrent\Logs\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\$GetCurrent\Logs\downlevel_2017_09_07_02_02_39_766.log - Access
C:\$GetCurrent\Logs\downlevel_2017_09_07_02_02_39_766.log.CRAB MD5: bad8e21f809a72fb580cbc79e424970c
SHA1: 2b367b94f8310e44fcfc2d456744c9ba5433d53e
SHA256: 6e13581e49d679f41d95bcea62a0146cac376e9a1c248ecb9632913cc8f18d45 		Access, Read, Write
C:\$GetCurrent\Logs\oobe_2017_09_07_03_08_57_737.log - Access
C:\$GetCurrent\Logs\oobe_2017_09_07_03_08_57_737.log.CRAB MD5: 2813c6ca7dc3a40a8bf7bab20b3cf54a
SHA1: 0b767acf023cd9f81b1fbbf7128e5beca950a6d0
SHA256: 207492f4fc8a69f59c9b52a31275ac2cf069633516f1df39db68ed99fb286430 		Access, Read, Write
C:\$GetCurrent\Logs\PartnerSetupCompleteResult.log - Access
C:\$GetCurrent\Logs\PartnerSetupCompleteResult.log.CRAB MD5: 4b6a466e94b2579803cbb6c86353039f
SHA1: c13230b6188a2b52ac2161d3c48f009c759f70be
SHA256: 65cec1c93592ce22cb28ba4bb16268a761f5c4b437b6d4057f721717d728badc 		Access, Read, Write
C:\$GetCurrent\SafeOS\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\$GetCurrent\SafeOS\GetCurrentRollback.ini - Access
C:\$GetCurrent\SafeOS\GetCurrentRollback.ini.CRAB MD5: 4876fb0d382bda368434e62cc92f2568
SHA1: 482ca1081f016b930e1839f7cd58727ba500ab06
SHA256: c9f2e8ec64f1616fad670eccddbc834a4ebcf82f23c1247a08e296f8dbfb668b 		Access, Read, Write
C:\$Recycle.Bin\\CRAB-DECRYPT.txt - Access
C:\$Recycle.Bin\S-1-5-18\\CRAB-DECRYPT.txt - Access
C:\$Recycle.Bin\S-1-5-21-1051304884-625712362-2192934891-1000\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\588bce7c90097ed212\1025\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\588bce7c90097ed212\1025\eula.rtf - Access
C:\588bce7c90097ed212\1025\eula.rtf.CRAB MD5: e0ee79085d0f792a63fed4ac62a03590
SHA1: 591d081035954005a5eed9fc69a3606d4e5173a9
SHA256: 3652374d5f3b3a5beccea4bf7600c7ec7b9f8481aec705ce559b68480ba71130 		Access, Read, Write
C:\588bce7c90097ed212\1025\LocalizedData.xml - Access
C:\588bce7c90097ed212\1025\LocalizedData.xml.CRAB MD5: efb9f8d05f6e00784e596d6b764a0983
SHA1: 72c2fac851a3dda86ca7e92d80e3d884276d87ca
SHA256: 0b63892ee62a36c5c881a091f2b2e269ef334331a48e2077645db4e9d8812e01 		Access, Read, Write
C:\588bce7c90097ed212\1028\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\588bce7c90097ed212\1028\eula.rtf - Access
C:\588bce7c90097ed212\1028\eula.rtf.CRAB MD5: fc78f7df948670f32794282c5dd53492
SHA1: 95cf20ddf4f496b454383cbe8ebd640cfa3c8e27
SHA256: 3c4375dcbb02d2be6d17f252afef01e14c3f9096b1cda0af5025291f55ab3281 		Access, Read, Write
C:\588bce7c90097ed212\1028\LocalizedData.xml - Access
C:\588bce7c90097ed212\1028\LocalizedData.xml.CRAB MD5: 9085235dfd32d6a25994037cb5be029b
SHA1: 376d5857c977d2f199ce6210c7cd4cdca80a4bf0
SHA256: 1576dfc0006b99e8ea81dfd4562fc757c2c64be5c23ec08dd45cd4123c6b7963 		Access, Read, Write
C:\588bce7c90097ed212\1029\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\588bce7c90097ed212\1029\eula.rtf - Access
C:\588bce7c90097ed212\1029\eula.rtf.CRAB MD5: 98f1878d9375fe5cc208ebeef8b49b6f
SHA1: 62b4e51a0d4ed13e9ab4c69f62c302aedbc28fa1
SHA256: 698dd01cc8f9048f33414514ff6fcc9719e184cfe7684487e03754cca85a66a0 		Access, Read, Write
C:\588bce7c90097ed212\1029\LocalizedData.xml - Access
C:\588bce7c90097ed212\1029\LocalizedData.xml.CRAB MD5: c65ae7342465df4e8edfc0204f7c4257
SHA1: dfc15473b8a225523bc49180fdbc661161e47a32
SHA256: fd701f74b03cdcf32898c5f8b9c55846dfd4230454c32c63bd2f368e83cffad3 		Access, Read, Write
C:\588bce7c90097ed212\1030\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\588bce7c90097ed212\1030\eula.rtf - Access
C:\588bce7c90097ed212\1030\eula.rtf.CRAB MD5: 98664501c0d12ddea631ac9b4da6bc81
SHA1: eb05b24645fff243d275be80cf5900aaa09ccbcd
SHA256: ddac908a72047342ca6a2c976ce78f988644bfe722f9626b4daaf39b8a7e8a20 		Access, Read, Write
C:\588bce7c90097ed212\1030\LocalizedData.xml - Access
C:\588bce7c90097ed212\1030\LocalizedData.xml.CRAB MD5: 477e1684a91737ea995cc2e3308aed1b
SHA1: b62d31d6ad2bd18f5df8ae967c7edaffb96da700
SHA256: d7fe6e7726d258605b23be9245c9962eede8cd883a3634468027df90c8ae92bd 		Access, Read, Write
C:\588bce7c90097ed212\1031\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\588bce7c90097ed212\1031\eula.rtf - Access
C:\588bce7c90097ed212\1031\eula.rtf.CRAB MD5: b444708a822f1cc53b2eb13731716a2a
SHA1: 498a293a092447be9a91706641e29bb39cbe33d1
SHA256: 008114a1d791e17b08e368193fb4e3978ba87e5a4971d8c103bef3c5a25cf3b9 		Access, Read, Write
C:\588bce7c90097ed212\1031\LocalizedData.xml - Access
C:\588bce7c90097ed212\1031\LocalizedData.xml.CRAB MD5: 68707c343a0f51c469bcbf20a74df565
SHA1: b296016070469d0bf7aed2f953a029825996efc7
SHA256: c13c94eb18ebb0d8d9c583c5102a9d051cd965cf5aaea3511df7da045c750afe 		Access, Read, Write
C:\588bce7c90097ed212\1032\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\588bce7c90097ed212\1032\eula.rtf - Access
C:\588bce7c90097ed212\1032\eula.rtf.CRAB MD5: 7cdd119628054dd683f1edb6ea80f1b3
SHA1: 930cc685d3f1e99bb732558dadde865f79d6e95e
SHA256: 5dfac09314a8eff8032ee84c5eb81cf0997971c23d3cc8f0acb9c9e71ffa2ed0 		Access, Read, Write
C:\588bce7c90097ed212\1032\LocalizedData.xml - Access
C:\588bce7c90097ed212\1032\LocalizedData.xml.CRAB MD5: 016470d9b73d4212e30e451c63e4be1d
SHA1: 79b3b9481c405325a4fc851a4b392a9f9c5c55ab
SHA256: 0e3eabcef7fb2f9ac410ecb27a2df677faa480a11a4746435019747e7823df2d 		Access, Read, Write
C:\588bce7c90097ed212\1033\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\588bce7c90097ed212\1033\eula.rtf - Access
C:\588bce7c90097ed212\1033\eula.rtf.CRAB MD5: e9eb45a97c023a3ef15ba90310d8d33d
SHA1: bf0d06291154e0c5c12bcc206b495a2ac2dea4fd
SHA256: eafb9d7b4f64bee82ed9562c55408b055a654518c25f454f382b603dd596d384 		Access, Read, Write
C:\588bce7c90097ed212\1033\LocalizedData.xml - Access
C:\588bce7c90097ed212\1033\LocalizedData.xml.CRAB MD5: bfbbede50207ac1eca8a01505d5e4986
SHA1: 4ce2e7e15b9c3c0c64e8ac35b5246907e5eb0a09
SHA256: 21b8e4bb4c35206da918f7037a2f83d8cd14f40fd919ff2b004a8c52f87946c3 		Access, Read, Write
C:\588bce7c90097ed212\1035\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\588bce7c90097ed212\1035\eula.rtf - Access
C:\588bce7c90097ed212\1035\eula.rtf.CRAB MD5: 8c1af5712382a26f6924a93e7fc0d93a
SHA1: 19474f278f697341b89c8484da814e57c09bc6f9
SHA256: d52d131d2308250a4011de30e9c7dcce6a0c9a3082f74a8720848af1bde7b049 		Access, Read, Write
C:\588bce7c90097ed212\1035\LocalizedData.xml - Access
C:\588bce7c90097ed212\1035\LocalizedData.xml.CRAB MD5: d5646a5282a4fc8fa720454ce8b6b31d
SHA1: 3f46718f37f639dfa4444967315dceebb9abad25
SHA256: e4d149f582920a2fb62c1c0279eecb576ff9caeec03a26b44da3d1224888a46c 		Access, Read, Write
C:\588bce7c90097ed212\1036\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\588bce7c90097ed212\1036\eula.rtf - Access
C:\588bce7c90097ed212\1036\eula.rtf.CRAB MD5: 5ea1a58d18f16fb325b632c4ce9b9d6f
SHA1: 2becb1dd5c8e484c155b906e8f9cc8bbee9c6218
SHA256: 0a5528285fbb7288b148c9d8ec7f0d4a18e071ca3e620850c8cc65f1b92cdb25 		Access, Read, Write
C:\588bce7c90097ed212\1036\LocalizedData.xml - Access
C:\588bce7c90097ed212\1036\LocalizedData.xml.CRAB MD5: 4452fc9174e0868f7158a2f3660eba47
SHA1: 0c03b628d61a8a93b46328778088d34941d56ed5
SHA256: 95430a918ebe9077ab7d07637389827454d35b8dc4cfa48ca48b1d50599c502f 		Access, Read, Write
C:\588bce7c90097ed212\1037\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\588bce7c90097ed212\1037\eula.rtf - Access
C:\588bce7c90097ed212\1037\eula.rtf.CRAB MD5: d6c61d37e0e5743f149fdcf6373757e4
SHA1: 8d3b69cfe0e1da293556115efb63f90c482fe57c
SHA256: 26824e4737911cdcc7355dd687f8ee8f1a3597008429b49ce0e5e9532fc8c22c 		Access, Read, Write
C:\588bce7c90097ed212\1037\LocalizedData.xml - Access
C:\588bce7c90097ed212\1037\LocalizedData.xml.CRAB MD5: 356816dc245c05fb6d0fa8bb16835056
SHA1: b0959780b24c56ff01e4ffe0a09e10c564ca4f1f
SHA256: 35a23767965ac72e51d67e83654b0bb8298cf7b63b689f0b8e5c233b1ce90c40 		Access, Read, Write
C:\588bce7c90097ed212\1038\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\588bce7c90097ed212\1038\eula.rtf - Access
C:\588bce7c90097ed212\1038\eula.rtf.CRAB MD5: 569ae5801e7e21b25f4965ca3f187ecb
SHA1: 87a9a8ea59174ed178d59c20ab8f864f5db75172
SHA256: 691851910a379e82291c9106e35a1816c6dd766217b045284f4e32bccc5d953f 		Access, Read, Write
C:\588bce7c90097ed212\1038\LocalizedData.xml - Access
C:\588bce7c90097ed212\1038\LocalizedData.xml.CRAB MD5: faa7851f59fb98cd416aeb464e0f3ec2
SHA1: 2a97849653ce4aa23b6ade43fdb5249f05b7cb30
SHA256: 453b5c1ae6ae970c4ed69755fd6e69e0bdc5ee3bb916bf2c57a0a1cb4c5f1c2d 		Access, Read, Write
C:\588bce7c90097ed212\1040\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\588bce7c90097ed212\1040\eula.rtf - Access
C:\588bce7c90097ed212\1040\eula.rtf.CRAB MD5: 729d6d05389a3ed5617b0afa04ea3cba
SHA1: b49f9f2ca39df496fb85cd4a8ee4fa667e81f592
SHA256: 3f984d7c582d62c711c88937a383f5f0bf67236b5695457895c246a88328398c 		Access, Read, Write
C:\588bce7c90097ed212\1040\LocalizedData.xml - Access
C:\588bce7c90097ed212\1040\LocalizedData.xml.CRAB MD5: 6c65cff8091aff35ead8528dafdaef7d
SHA1: 8b78afec0d89fc4c3ac8bbe72da26dd3da73ee8d
SHA256: 92520bfa7b6e3ed69c9b48cb3fa46e4f63fc10b6f312c48c0f77e93ffc5e1d6f 		Access, Read, Write
C:\588bce7c90097ed212\1041\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\588bce7c90097ed212\1041\eula.rtf - Access
C:\588bce7c90097ed212\1041\eula.rtf.CRAB MD5: 28cf1c81807c4677c5c377a1b0bc8ec6
SHA1: 12ae75c1394116460c8e97fcbf19179e114dd64f
SHA256: 11461d22c200894b1af107e08d56eaa78691e1fbb216998487599d132db0cb85 		Access, Read, Write
C:\588bce7c90097ed212\1041\LocalizedData.xml - Access
C:\588bce7c90097ed212\1041\LocalizedData.xml.CRAB MD5: 5287bfd58f2a16c301934543e4e32d08
SHA1: b02364656c5d4c9b7619ce1a3f5d748c48b25089
SHA256: e1ebeffe33e95513a2dd2ee1196a40c5a3070f6e966d7853f40b7f1b0fd94c30 		Access, Read, Write
C:\588bce7c90097ed212\1042\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\588bce7c90097ed212\1042\eula.rtf - Access
C:\588bce7c90097ed212\1042\eula.rtf.CRAB MD5: e8c6d5e9e045decec52c72388adb28b0
SHA1: ad1657f811e3cff1d67f8cf08a891f82f407d130
SHA256: 116b9e619a524e73696b5139a852c84c9933a9e17559b33b8cecd382b84f0758 		Access, Read, Write
C:\588bce7c90097ed212\1042\LocalizedData.xml - Access
C:\588bce7c90097ed212\1042\LocalizedData.xml.CRAB MD5: 8d7be19eceaec02c483eda072859366c
SHA1: 9d046079f352dcb09eb48c78de308cb7c4894b9f
SHA256: d120d44be6a45b49656a5b1970956af5ab929307060079bd74091d7761135958 		Access, Read, Write
C:\588bce7c90097ed212\1043\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\588bce7c90097ed212\1043\eula.rtf - Access
C:\588bce7c90097ed212\1043\eula.rtf.CRAB MD5: e30ff3c47a215c6f6108387119904c6c
SHA1: 125f512a901516932d9d3325fbc0095a6358d710
SHA256: db407a33e5140bb393531978a20653f5242c0212dc9f1e269815821131366f10 		Access, Read, Write
C:\588bce7c90097ed212\1043\LocalizedData.xml - Access
C:\588bce7c90097ed212\1043\LocalizedData.xml.CRAB MD5: 760a90ed6f4db84353c3b26f833edd4b
SHA1: 463d214af24ddabc2ad255bcd2911db14a5729c1
SHA256: 5d13e0337dad60f2e90627e38cb2bd78ef1f50321a0424c989860a25de98faef 		Access, Read, Write
C:\588bce7c90097ed212\1044\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\588bce7c90097ed212\1044\eula.rtf - Access
C:\588bce7c90097ed212\1044\eula.rtf.CRAB MD5: 8512bddec63e9c514664c2de4fac0389
SHA1: a66715923a9f2490270d8ea3e9fcc29faca1a36d
SHA256: 0151986bb0dccbe56cdf0cda2bc699046204641dfd7c9d57b457d1165364fcce 		Access, Read, Write
C:\588bce7c90097ed212\1044\LocalizedData.xml - Access
C:\588bce7c90097ed212\1044\LocalizedData.xml.CRAB MD5: e48730c27d18446724bddfd306c7d745
SHA1: 9527abe38f82fc0527cf50325899d2851577197c
SHA256: a9d22cdb8f1fd3b2bb7e23a9877f85e6c1c57235a8963321b7f37f2b891d936e 		Access, Read, Write
C:\588bce7c90097ed212\1045\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\588bce7c90097ed212\1045\eula.rtf - Access
C:\588bce7c90097ed212\1045\eula.rtf.CRAB MD5: ce7c9662ae09686f611caf106b9a5e18
SHA1: 002b118bceceda6e5583dd2249f1509f78f20a55
SHA256: 7817a5c14e5b01652121ef48dd4b1772ac89b633dd668157c5aad2aaae3e36c3 		Access, Read, Write
C:\588bce7c90097ed212\1045\LocalizedData.xml - Access
C:\588bce7c90097ed212\1045\LocalizedData.xml.CRAB MD5: d11a7fe535ce6274869bb78b47e65432
SHA1: 6d4027940be35b1ee0b4c5889403fc3cc32f924e
SHA256: be13dfd99484bca26941b19c0ade6e3ae26900fb055b4e0776ea494a9a355a8e 		Access, Read, Write
C:\588bce7c90097ed212\1046\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\588bce7c90097ed212\1046\eula.rtf - Access
C:\588bce7c90097ed212\1046\eula.rtf.CRAB MD5: eb64d6eb06fabfe52dffb31036aad101
SHA1: 76ea72559b7bf97aa3d863dd9fb57ad99a833858
SHA256: 87246ca7dd34803080a9b80e19c451f69faa9c1e4c274943accd4571bd3adfcb 		Access, Read, Write
C:\588bce7c90097ed212\1046\LocalizedData.xml - Access
C:\588bce7c90097ed212\1046\LocalizedData.xml.CRAB MD5: 9471cce90841ce6340e8bf6f2ed2e0e2
SHA1: ce65e9f57d3312c82d35f9a860dedbfc7fd4327f
SHA256: e6683994daadcb8db37d464bac14d88888149c197a925f3ed215d74e9b0d17f7 		Access, Read, Write
C:\588bce7c90097ed212\1049\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\588bce7c90097ed212\1049\eula.rtf - Access
C:\588bce7c90097ed212\1049\eula.rtf.CRAB MD5: 57c1554fe65f86a69da09783b5456fe7
SHA1: f7496e9397811faf4994b87f2eb515e121911e10
SHA256: bea333df7ff17319e507edb399bf8526312a0cf3d69afdd33faab72858a4565a 		Access, Read, Write
C:\588bce7c90097ed212\1049\LocalizedData.xml - Access
C:\588bce7c90097ed212\1049\LocalizedData.xml.CRAB MD5: 8b4962fb49fb7f6203daeb2997868430
SHA1: db7fa3834ccb32d7292b78f12ca9ad5cf46d2a94
SHA256: c036f8fe64299c6a3ec624eda477af35732bfdfd0910aa05f790f53f3b49424f 		Access, Read, Write
C:\588bce7c90097ed212\1053\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\588bce7c90097ed212\1053\eula.rtf - Access
C:\588bce7c90097ed212\1053\eula.rtf.CRAB MD5: 3c969f4d3444229cb03ee2b022ae463c
SHA1: c9e2a8df4d26ee342fd8ebec84661176a41517b1
SHA256: a812cda6d5dc72c6e9af27b5e95825571c6a0efc9da651e953cfea55a098344b 		Access, Read, Write
C:\588bce7c90097ed212\1053\LocalizedData.xml - Access
C:\588bce7c90097ed212\1053\LocalizedData.xml.CRAB MD5: 4ec04e453d762f8a3eb5594bd31e3a87
SHA1: a42d0faccc1d087d0de73ce9c4649c5aa757daf1
SHA256: cb582ae31f1e9f00f175e732505c0a93efd641add1756345171dacfc94e2b9d3 		Access, Read, Write
C:\588bce7c90097ed212\1055\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\588bce7c90097ed212\1055\eula.rtf - Access
C:\588bce7c90097ed212\1055\eula.rtf.CRAB MD5: c76e175ba33e729b13792c5cf914f62d
SHA1: fbc00c507944df90b4d2b2bb9e2e15fe76d2151b
SHA256: fc2ec148c09e2d1e709ecfea5d7ac61d5d13a237c4aaeff89693d8afa8f2659d 		Access, Read, Write
C:\588bce7c90097ed212\1055\LocalizedData.xml - Access
C:\588bce7c90097ed212\1055\LocalizedData.xml.CRAB MD5: f23ea0286e44d91b492c3c370f3e4cb5
SHA1: 2bd5a91042d20c78beb6972ff8154d2905c2e8ef
SHA256: 31ab10a1db306e8da17d2ddebb2c8b5379ce034f2a02007b5ee2e09dc41a7e2c 		Access, Read, Write
C:\588bce7c90097ed212\2052\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\588bce7c90097ed212\2052\eula.rtf - Access
C:\588bce7c90097ed212\2052\eula.rtf.CRAB MD5: 6a123b212eafa13f8552ffdaed8c6987
SHA1: b43775fa91c4483ba72a1a4fc683a6f0abc3e9a0
SHA256: c973116e8d2526d4bc30196fbea37b395b016ad5d9f29cc5d77924902ba59acc 		Access, Read, Write
C:\588bce7c90097ed212\2052\LocalizedData.xml - Access
C:\588bce7c90097ed212\2052\LocalizedData.xml.CRAB MD5: 2f61fb43a9d00bebc56e25288276b896
SHA1: 68ba024aa51985edf8deddd22844538b3c7e5d71
SHA256: 981f7739bfac08c606477dd7595f951948868b857bf8499615e18a0c887d9a0c 		Access, Read, Write
C:\588bce7c90097ed212\2070\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\588bce7c90097ed212\2070\eula.rtf - Access
C:\588bce7c90097ed212\2070\eula.rtf.CRAB MD5: fd893188e9e3dbd1a78672c68913d4c1
SHA1: fe7fdbf2e7ab7b9c32eefb87f74d778d36c9d4c5
SHA256: 10dc246116521567dd8cb8b0feb5f467cc8bb4a88ce6f3634857e242e9538f51 		Access, Read, Write
C:\588bce7c90097ed212\2070\LocalizedData.xml - Access
C:\588bce7c90097ed212\2070\LocalizedData.xml.CRAB MD5: ace38479fd1ba914091d5291c06aacf5
SHA1: 4fdb4406b9f15142261e6196e6a781cf696c0a91
SHA256: aa98fc92cd9f8061a22b015bf38718ab0639c95c9c266cc7e9fd0f6bee5661ad 		Access, Read, Write
C:\588bce7c90097ed212\3076\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\588bce7c90097ed212\3076\eula.rtf - Access
C:\588bce7c90097ed212\3076\eula.rtf.CRAB MD5: 6050e37c19a07b12fb4f118f53dcd897
SHA1: c22677863e99ef1c5150c50e075abaa84ae96f97
SHA256: 16eb7be44721812de04b621f290b36a7566c8473a103087527b08a65d356522c 		Access, Read, Write
C:\588bce7c90097ed212\3076\LocalizedData.xml - Access
C:\588bce7c90097ed212\3076\LocalizedData.xml.CRAB MD5: 622db4d718031bd62e50d131d5af1a55
SHA1: cb0755d4d0caaa48f7b8859bb5f23b5163abc334
SHA256: 79ff36ea6d1e4f36427225bfc85e32648a6e740dd9113627c9a9a9c62799a120 		Access, Read, Write
C:\588bce7c90097ed212\3082\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\588bce7c90097ed212\3082\eula.rtf - Access
C:\588bce7c90097ed212\3082\eula.rtf.CRAB MD5: 1b359b0ac5ad71f624d8732bac4e52f4
SHA1: 11b1cfab74c219e3012fa35657a040a9e397ed19
SHA256: 8863da9d173726ec62a0fed0a6fc69631a0edfaed44cb530f125bb6e567beaf2 		Access, Read, Write
C:\588bce7c90097ed212\3082\LocalizedData.xml - Access
C:\588bce7c90097ed212\3082\LocalizedData.xml.CRAB MD5: 87352ef4fd7b198a9171e50378cc55d2
SHA1: a19e47598cbfa02998b9f7e2cc8afc9f7a2e2b8c
SHA256: 192fe6e62a16cd0c7b8c0ec7f5c65dc21b340237147b0f31a952767e28d3c6bb 		Access, Read, Write
C:\588bce7c90097ed212\Client\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\588bce7c90097ed212\Client\Parameterinfo.xml - Access
C:\588bce7c90097ed212\Client\Parameterinfo.xml.CRAB MD5: 4f7174ee650eab169a17d8481c607c29
SHA1: 7a97a9749fbc335956d002d3b55c0b3a01e5a7fb
SHA256: 3c9c912d68b0596ddfe4598acb6b69c0c6ae06c2fd57652749762f9ae1a22860 		Access, Read, Write
C:\588bce7c90097ed212\Client\UiInfo.xml - Access
C:\588bce7c90097ed212\Client\UiInfo.xml.CRAB MD5: 7ba892317a596bed3bf0fd7fe6a5db13
SHA1: 37acdf0e50ec42f28f0a2fa4db30fdab65644551
SHA256: 9729db6544b5e433314cf0314af0ffd99912c953c19b932ca32f7d74ce271843 		Access, Read, Write
C:\588bce7c90097ed212\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\588bce7c90097ed212\DHtmlHeader.html - Access
C:\588bce7c90097ed212\DHtmlHeader.html.CRAB MD5: 236ec177c2349523c0646c19dda083aa
SHA1: 2ceae09e886b4e51db2d34ddc13e4331a723ad52
SHA256: 6d2dc47da113cd885de9af29019667e2f4b5891905310d8c4711f2e5011910c7 		Access, Read, Write
C:\588bce7c90097ed212\Extended\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\588bce7c90097ed212\Extended\Parameterinfo.xml - Access
C:\588bce7c90097ed212\Extended\Parameterinfo.xml.CRAB MD5: 1075df4e6fd9ced8375ba1eebc8f96a2
SHA1: 416795e50a0cc7fb080a17bbad68c08589eb6830
SHA256: 0dc8bd03de85e4072ddda330e83d006fbd73b3c59132b86db6523ae5c80b9e20 		Access, Read, Write
C:\588bce7c90097ed212\Extended\UiInfo.xml - Access
C:\588bce7c90097ed212\Extended\UiInfo.xml.CRAB MD5: b583b6cb380e7aa4634659c7f69ce108
SHA1: 07a8bcf84e642a258fda6a5af2fad2c14e04e55b
SHA256: b965e67ac794cbc3e99affdaa1c02ba19908e41a38c17cdfbe66fec1b4d72bc9 		Access, Read, Write
C:\588bce7c90097ed212\Graphics\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\588bce7c90097ed212\header.bmp - Access
C:\588bce7c90097ed212\header.bmp.CRAB MD5: 966b9ae783b4912c46c2c2ab2396af40
SHA1: 8e83969075860dce14aebc40e4937b8e93d09e62
SHA256: 0b792db2303c87d654261c30454872d1848138878149b57977ae4908c62858c4 		Access, Read, Write
C:\588bce7c90097ed212\netfx_Core.mzz - Access
C:\588bce7c90097ed212\netfx_Core.mzz.CRAB - Access, Read, Write
C:\588bce7c90097ed212\netfx_Core_x64.msi - Access
C:\588bce7c90097ed212\netfx_Core_x64.msi.CRAB MD5: 4b234254e808ea9d683f21087739bed7
SHA1: ec2330748b3d97a50ccedcac73bd390011d2b57e
SHA256: 638f037b8c43b1accc3b1335fcea49af92a1cf990d92b75e622827971dffc5b5 		Access, Read, Write
C:\588bce7c90097ed212\netfx_Core_x86.msi - Access
C:\588bce7c90097ed212\netfx_Core_x86.msi.CRAB MD5: 0aa8cdb0f7979d71b5369cf18e7334a4
SHA1: a256d93681b6658556651c48073bf9d79e8d2817
SHA256: 5bdd30fff816d560f7929864ec40eae321c38a2933ac9478df86662c480e2115 		Access, Read, Write
C:\588bce7c90097ed212\netfx_Extended.mzz - Access
C:\588bce7c90097ed212\netfx_Extended.mzz.CRAB MD5: 3efc89a4d4a3b2117ae5c2f550857e84
SHA1: 042abe9b2779447d230821ada4e03a94125a9cde
SHA256: 17680248feeff5d7391198871257c3dbc4f097d0f5d159cac80a9d61793848ca 		Access, Read, Write
C:\588bce7c90097ed212\netfx_Extended_x64.msi - Access
C:\588bce7c90097ed212\netfx_Extended_x64.msi.CRAB MD5: 0b96bcc0168e488b995d82d4fc7b18e3
SHA1: 7b0859cb59d0e322b7e2d409da1bca33499ec3fe
SHA256: 10696167e48603290a277ae878900eacd2bf7cd5e9eaa1d460a219b421d28c98 		Access, Read, Write
C:\588bce7c90097ed212\netfx_Extended_x86.msi - Access
C:\588bce7c90097ed212\netfx_Extended_x86.msi.CRAB MD5: f09886ff9bb0c50f539b82b149e71b41
SHA1: 109485910d4b9981a0391b0d62bed4c6814813d7
SHA256: 2a3c915870879227585115c60257b0e30d3f9d450ee243011cb369aad084bfc0 		Access, Read, Write
C:\588bce7c90097ed212\ParameterInfo.xml - Access
C:\588bce7c90097ed212\ParameterInfo.xml.CRAB MD5: 8d9e1648f9b44d272601ab288e34c8a0
SHA1: 11466d19122f82fddb096052f23ca5d60001080f
SHA256: 19deb955eae5945670a8054109ab73ee468104d17f5363a066d600a5fd129d7f 		Access, Read, Write
C:\588bce7c90097ed212\RGB9RAST_x64.msi - Access
C:\588bce7c90097ed212\RGB9RAST_x64.msi.CRAB MD5: 67f134f7d48f395f2081a6a79293c90f
SHA1: 0acec509ef9c074b5ebd7349db4cae16d6805c80
SHA256: 328ea3897709acfdb0a7f25a905bde482434482c8cffc760085ec3b267f06346 		Access, Read, Write
C:\588bce7c90097ed212\RGB9Rast_x86.msi - Access
C:\588bce7c90097ed212\RGB9Rast_x86.msi.CRAB MD5: bfbf157776a72d1b9c5873713e0259fc
SHA1: 8bf52c5ea033cc60794bf402c91e524a6113ce40
SHA256: 4f19bb4ad6040b56d87459f1ceecfdf2579985941f95d62fcb546da6d2b3e090 		Access, Read, Write
C:\588bce7c90097ed212\SetupUi.xsd - Access
C:\588bce7c90097ed212\SetupUi.xsd.CRAB MD5: d5871eab77b2c199f5c8dc7d9375de0e
SHA1: 528a31062d88d8291e1365e62c8577792f6cd82f
SHA256: f4bb98350d055a1cf0df930d0078ac4bad67c701af247e7de678865672c983cf 		Access, Read, Write
C:\588bce7c90097ed212\SplashScreen.bmp - Access
C:\588bce7c90097ed212\SplashScreen.bmp.CRAB MD5: 7b7541b98e61ca5018f2945ccb08a28c
SHA1: 373ee2fbdb680395026f3367037b992474cfa1b4
SHA256: d625615c9910919ad12dfe2a01f2f944f281b596c61c3a74f89b99424bf2305b 		Access, Read, Write
C:\588bce7c90097ed212\Strings.xml - Access
C:\588bce7c90097ed212\Strings.xml.CRAB MD5: f983abe3470a86bf34111dd796c160d7
SHA1: df3dbd246ace76a9a4f9202705fec2adaedd2e1a
SHA256: eb59e59d300cfca5f0b7020ba8fc5132b5c45748e3dd25295e9dcee7727c0a86 		Access, Read, Write
C:\588bce7c90097ed212\UiInfo.xml - Access
C:\588bce7c90097ed212\UiInfo.xml.CRAB MD5: 41d88dbaffbc443aac37b927370f0090
SHA1: 48ac658b32bc1ebd7cfaa5d18c70569312a45675
SHA256: b69f25f0421df8d40208e3c31d7e7d03021fa628321e558b2af26486465860e1 		Access, Read, Write
C:\588bce7c90097ed212\watermark.bmp - Access
C:\588bce7c90097ed212\watermark.bmp.CRAB MD5: 698a9e47c10d672a843c0f865a97db26
SHA1: 9328ac331e5dcac65889772861b254207eaf95fc
SHA256: c180f2d2971b9a339341ffa1f71f9b18cac76493c164a08145f12b1845eb3de9 		Access, Read, Write
C:\bootmgr - Access
C:\bootmgr.CRAB - Access
C:\\CRAB-DECRYPT.txt - Access, Write
C:\Documents and Settings\\CRAB-DECRYPT.txt - Access
C:\ESD\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Logs\Application.evtx - Access
C:\Logs\Application.evtx.CRAB MD5: 7f90b5e902be2863777689a769f88902
SHA1: 934055c465c39ee05d15da254ee3448c0311f33d
SHA256: 8beb1755d81f0082aca6cfce52f3951f38695d0d1e361077459fd0ecf64d0a28 		Access, Read, Write
C:\Logs\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Logs\HardwareEvents.evtx - Access
C:\Logs\HardwareEvents.evtx.CRAB MD5: 7da8af571dd359da3037e99733fd30a1
SHA1: be189d2aebe95fbed314a5318ab261cffdd5559f
SHA256: 1f28d9dff31207c57b1aec8fc598fb6611abb7a82976c605db1c3d1812097255 		Access, Read, Write
C:\Logs\Internet Explorer.evtx - Access
C:\Logs\Internet Explorer.evtx.CRAB MD5: cb6678e12827cf1bae30038c8cf305fb
SHA1: 0069888f3f6270f00856845f3fb61cda6474a31b
SHA256: 112935506bc65e2dc36d55982dd218e50a43e93adf52acef16b5b65800fa80b7 		Access, Read, Write
C:\Logs\Key Management Service.evtx - Access
C:\Logs\Key Management Service.evtx.CRAB MD5: b7401d0e3515394855582e5fc95ab936
SHA1: 84b205b28b509304a3eca697f169e66bce2d32e3
SHA256: 648e0b0681921e7fa8221e7a8a23b127c41d56d0d08ee5c1856c3195e1b60865 		Access, Read, Write
C:\Logs\Microsoft-Client-Licensing-Platform%4Admin.evtx - Access
C:\Logs\Microsoft-Client-Licensing-Platform%4Admin.evtx.CRAB MD5: 4fed42d09e065ac03804d1a0a0dc5190
SHA1: fe9c318c8a7ee974f0583de5d8b6563365f9cb3b
SHA256: c2fe5405071cb378dd6a90e13efdfc24d908b893011f728e2713bb6da01b6b87 		Access, Read, Write
C:\Logs\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx - Access
C:\Logs\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx.CRAB MD5: 17c09ee76359d14e07a8ae404dd58df1
SHA1: 09aea001a99251236d67fe4729cb07742f35392c
SHA256: 840c31c3e0c3c1444304fb60bfedb017d080fe7e4b61d47352950f8b8f476fbd 		Access, Read, Write
C:\Logs\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx - Access
C:\Logs\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx.CRAB MD5: 100d32fff7745c5dbb210b272090795f
SHA1: f8e24fa1ed58c076b3aa1a68f51833484e80ccc4
SHA256: 146dc28ccc9cfdca73d3fb23ee7f0d50a1e67ef129893718125eaa4938294c7b 		Access, Read, Write
C:\Logs\Microsoft-Windows-AppLocker%4EXE and DLL.evtx - Access
C:\Logs\Microsoft-Windows-AppLocker%4EXE and DLL.evtx.CRAB MD5: f46de226c7529c21bcc5e4f930076e20
SHA1: 649aa2ba08ac7197f6455bb37259ccbc5b4401c0
SHA256: 7930c069b149294f5244b2299fc566c26b27520717796b8f2a1f1cb6614230f9 		Access, Read, Write
C:\Logs\Microsoft-Windows-AppLocker%4MSI and Script.evtx - Access
C:\Logs\Microsoft-Windows-AppLocker%4MSI and Script.evtx.CRAB MD5: b5d014bd0046abae59437f455c7a788a
SHA1: 972282d62216fa1f38dd58891cbe571b73979143
SHA256: 1b75960982505d152232098790448609f6d41b31e856cc74b6b411cba30fad8d 		Access, Read, Write
C:\Logs\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx - Access
C:\Logs\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx.CRAB MD5: 62ff389996a2dc930b757b11ec79bcb2
SHA1: 96369f580091d3c0d5dc2768d462829d8ef5cc35
SHA256: 4d2103e6557508c94e3cf0f2a97dccc66e4ed0e5702c3523b82c8ab2771a6de2 		Access, Read, Write
C:\Logs\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx - Access
C:\Logs\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx.CRAB MD5: 873dc5ef9125e0e7c7df4a474b2496eb
SHA1: a91a5de55ca7c6b52b72deb8dffaab0c236e1e3e
SHA256: 8776f3a125b7b6f4c4465c0021d7a79e70d9d8c4c5fbe4f697c8b9b46b4feaf1 		Access, Read, Write
C:\Logs\Microsoft-Windows-AppModel-Runtime%4Admin.evtx - Access
C:\Logs\Microsoft-Windows-AppModel-Runtime%4Admin.evtx.CRAB MD5: cac745804ebd18c96f087c2b2a4eddc3
SHA1: 539624e8f8c13e908c2cc83f56d09ce298008569
SHA256: dd3b453db87701e76e4a9d44757e3b1fbd5bae6410c88eb0b6ce71df5bae9ce3 		Access, Read, Write
C:\Logs\Microsoft-Windows-AppReadiness%4Admin.evtx - Access
C:\Logs\Microsoft-Windows-AppReadiness%4Admin.evtx.CRAB MD5: 97e17c67703bec8ab6e82b7416bc9781
SHA1: 50617af7d9ced15e7c233919bbb79d6d415c314c
SHA256: 0a600a7116661203ddf590e24f4fc2af7b2b8315054bab2b589a113e47b5fb78 		Access, Read, Write
C:\Logs\Microsoft-Windows-AppReadiness%4Operational.evtx - Access
C:\Logs\Microsoft-Windows-AppReadiness%4Operational.evtx.CRAB MD5: 04414c2caa00cf8ca7e03bde0b8770fa
SHA1: 8f6f3d453a41d36fc884e4f46b9b022966521bb4
SHA256: 8acfcab56cf0607d0ee7776dbd37f517dd691a01bc537b493d271e617eada152 		Access, Read, Write
C:\Logs\Microsoft-Windows-AppXDeployment%4Operational.evtx - Access
C:\Logs\Microsoft-Windows-AppXDeployment%4Operational.evtx.CRAB MD5: ef5b55329591834bfda001af69a2dd16
SHA1: 56572d83769b80a1ea10d1c6c0fb95856b91e5fe
SHA256: 410f5541febd8bfac6ef4b1bb68125fdac7a381077efd510332608d10eb500ba 		Access, Read, Write
C:\Logs\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx - Access
C:\Logs\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx.CRAB MD5: a8285003ba67f3f6b7865800aa381047
SHA1: 8261e9d1e96779bee2b17ac1a27e4e39c89986d1
SHA256: bc876f007cdbebfa5bbaa748fb35fdfc145ae1140a971aaa1789f3e177879143 		Access, Read, Write
C:\Logs\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx - Access
C:\Logs\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx.CRAB MD5: 188d95b7dce334c7e8cdc2e5af7f1ddb
SHA1: 34e603fd4aea9d1c0fa9836494e8a875762252e8
SHA256: 211856bb5861d4bbba4b2eec9c6799e2efb4007a403a79a2e506b2f99b867ee6 		Access, Read, Write
C:\Logs\Microsoft-Windows-AppxPackaging%4Operational.evtx - Access
C:\Logs\Microsoft-Windows-AppxPackaging%4Operational.evtx.CRAB MD5: 658c415406ad215d9bc349241f0bd53c
SHA1: 244649cd32be6e7eb3b8d8ca149cac0bf73a273f
SHA256: 7f2b042b507687f725b40bbcc1c61d95b59de78aa2d945884099ebce11a4d816 		Access, Read, Write
C:\Logs\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx - Access
C:\Logs\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx.CRAB MD5: b9950850ff73e267527705b44fb81b03
SHA1: 811d5d12d664dcd39e2688cabf921ebe3ef61a59
SHA256: 34915130bce0fbe0344e125a55237e894a12b0968272d1002fae61b1138a68c8 		Access, Read, Write
C:\Logs\Microsoft-Windows-Bits-Client%4Operational.evtx - Access
C:\Logs\Microsoft-Windows-Bits-Client%4Operational.evtx.CRAB MD5: 627165bc248e033c1dfce99c543a4a3c
SHA1: 96c786bfa9aaf95ae589fc40458ba0f993ee0a3a
SHA256: 4b5c36a8b1972837835307294c674266e5609ac62f4fa1adc5be786d23152a09 		Access, Read, Write
C:\Logs\Microsoft-Windows-CodeIntegrity%4Operational.evtx - Access
C:\Logs\Microsoft-Windows-CodeIntegrity%4Operational.evtx.CRAB MD5: 3610aba1557d95f929bdd9ec1c555b2c
SHA1: 57f1787e1653643f077a47c80012f3466ad1b305
SHA256: 1584132ca98fb5db5cd1a8fe3e7630521c824e02819616e02267e65ecb79fa49 		Access, Read, Write
C:\Logs\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx - Access
C:\Logs\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx.CRAB MD5: 637772da2b4ba9485becb248ee19703c
SHA1: f5b3975c0553c60fa9994b8414f4a2676a9869c0
SHA256: 0555e09ed80d910d45a61a259511050ca70dba2a7cd612d4d19560be87e10200 		Access, Read, Write
C:\Logs\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx - Access
C:\Logs\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx.CRAB MD5: 88a48ff0d133400852af06e94f9ed661
SHA1: 664509e402a27c1cd4fbb8c1f44a72f14c5b7910
SHA256: 52c402a361e481eb3b6ffbc894db470980101dc5656f133d0210126a1acc7a61 		Access, Read, Write
C:\Logs\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx - Access
C:\Logs\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx.CRAB MD5: 2473eddd5c7f45a0d8095c2216bd619c
SHA1: 5f76b91e3bf0b5108ab0bcc64ef9e70094bdb394
SHA256: 98d7865e116f5fbdc26a6803f282d2c6b90856b28ac026861c990fcc1b1e8190 		Access, Read, Write
C:\Logs\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx - Access
C:\Logs\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx.CRAB MD5: 93660431b7ea31e96ef829a9ce4d0503
SHA1: ed9d16cf5ac7dbe1e111c89083b738e5ae7e2db9
SHA256: 9019f59b60b90c330462984ae88c18cbed629602a7e0d4c09ada8879865390f0 		Access, Read, Write
C:\Logs\Microsoft-Windows-DeviceSetupManager%4Admin.evtx - Access
C:\Logs\Microsoft-Windows-DeviceSetupManager%4Admin.evtx.CRAB MD5: d9fc2ec04c5d4704e059273780e0c4bc
SHA1: 541a3c7d52232c07cf778785ef35c7d07bc0c991
SHA256: 41d5c4ccedcf87e6b336487fe01b3094eea7333e98cdbf332152dbdcc383b182 		Access, Read, Write
C:\Logs\Microsoft-Windows-DeviceSetupManager%4Operational.evtx - Access
C:\Logs\Microsoft-Windows-DeviceSetupManager%4Operational.evtx.CRAB MD5: aa384fd8086d7f5b9240b006b7ff3c3b
SHA1: b4c263e038d17c17b61b2c3e9acc1c0b0101fc1d
SHA256: 5143d1bc745fab0d976bb2f04bf467fca715cf3570c718f1231fe6fa8c04afd9 		Access, Read, Write
C:\Logs\Microsoft-Windows-Dhcp-Client%4Admin.evtx - Access
C:\Logs\Microsoft-Windows-Dhcp-Client%4Admin.evtx.CRAB MD5: b9015f2350a863f5dcc8242d5de56d99
SHA1: 314a7676fde8e6bc6f0ded9b444eea7ca5f4b19f
SHA256: 116f3b734a49a01eb41973fcfb2cedcbd18b1029a812dff521d941063e32cf9a 		Access, Read, Write
C:\Logs\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx - Access
C:\Logs\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx.CRAB MD5: a162b352efb8c210251e101f430c6955
SHA1: 5deb21149ca50569d2a4a75f781490eb91fe537d
SHA256: 3ccb857efa0d15348d3de69ac505def244288947b12edcf4c287dd3e6ebe8dd8 		Access, Read, Write
C:\Logs\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx - Access
C:\Logs\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx.CRAB MD5: 04ebde9e2bb7c86b8679f973421863de
SHA1: a62187abed0dc735eb4204ca97cd67751329ef4a
SHA256: 3b04267fbc30eaf4ac08d6bd7481a96c11dfa740ee558db5e28ac8238cc71007 		Access, Read, Write
C:\Logs\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx - Access
C:\Logs\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx.CRAB MD5: ed85f273d6602f98776086eba73d1bce
SHA1: d046792142e289d20286e6b57bc783d92e18980c
SHA256: 06aba96d487bc33cfe269594a37c361ceebf40af0088e53a96b951bf2441640b 		Access, Read, Write
C:\Logs\Microsoft-Windows-GroupPolicy%4Operational.evtx - Access
C:\Logs\Microsoft-Windows-GroupPolicy%4Operational.evtx.CRAB MD5: 8df1a9385f65fdb314ab900d6548ff34
SHA1: 30015db80547bf0fd65ccad32e61ece8ea85b764
SHA256: b4cb3dac4d17b8c87ade56aa2dd5543a6a5c2c2226065e98f140f8609706b821 		Access, Read, Write
C:\Logs\Microsoft-Windows-HotspotAuth%4Operational.evtx - Access
C:\Logs\Microsoft-Windows-HotspotAuth%4Operational.evtx.CRAB MD5: 4fc959f1bdb2fb0d8f217c6f759e8a15
SHA1: 4e555d147520df4834543cc11617bfe8813dbb3d
SHA256: c4a230cbd3da14526773a600651ac36b3e07352198892e23508071b5df33571f 		Access, Read, Write
C:\Logs\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx - Access
C:\Logs\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx.CRAB MD5: 0bf1b607a4fcfcac2a9d829bd64371e8
SHA1: 9fade27942ce94bf0d9ead56e55c241362065bb8
SHA256: bb8ae8c49185edfbed634e6022b9bfe37c307559dc72ab5e4228228249c1473a 		Access, Read, Write
C:\Logs\Microsoft-Windows-International%4Operational.evtx - Access
C:\Logs\Microsoft-Windows-International%4Operational.evtx.CRAB MD5: ed64b3dcfd9322d3a1cd133c847729f7
SHA1: 204c560c5687784dfa9dc9c0ff278a0ae557e7af
SHA256: 6ba9974bb9dac3f247b6b3c662da8d9a2e599e838f7fe7a9eda8898aa780452c 		Access, Read, Write
C:\Logs\Microsoft-Windows-Kernel-Boot%4Operational.evtx - Access
C:\Logs\Microsoft-Windows-Kernel-Boot%4Operational.evtx.CRAB MD5: 67adad2ca2d808ad1391e362da0bda53
SHA1: 3886f312c77fe84a384eee3c647233daca1e86dd
SHA256: 5174eb6b4b92a74050e140d8a0da4f16638255e8472e60ab405e492f53ea6116 		Access, Read, Write
C:\Logs\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx - Access
C:\Logs\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx.CRAB MD5: 8defb5b51bc67eb2d4b7781106a62259
SHA1: cdefb1c73921be197d582594b07433a310610ef6
SHA256: 7b7233a1320252be2808c196a85fc18dc39dbcedbea212f4b9de05a59eaccb11 		Access, Read, Write
C:\Logs\Microsoft-Windows-Kernel-PnP%4Configuration.evtx - Access
C:\Logs\Microsoft-Windows-Kernel-PnP%4Configuration.evtx.CRAB MD5: bfe61045b4f881cb2b4f5912f6aa8a34
SHA1: 40853247055406a59178b0ef5fc028b945d225c5
SHA256: 17fbb304e17bd84d29196383c026159ec1149480311ea78511267242894f4bbc 		Access, Read, Write
C:\Logs\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx - Access
C:\Logs\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx.CRAB MD5: 84fb2f0edb38f3453a4bc9fc095a16f1
SHA1: b06884ba6e69f988d1afe3dd738cb101e4282af4
SHA256: 9b68c5cc08a322d3f351c285a3581b122dbdfa3ac00a3cf418d726fedc4f5acd 		Access, Read, Write
C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx - Access
C:\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.CRAB MD5: bd6f2f6ce4ae7426d6a364506322aa06
SHA1: c4f125f1cda906b8bffbfb180020cbcbf96ce845
SHA256: f32d27030db4eb486fa050928042e9ed692767a3b56e0fd150fb2671145d9bf9 		Access, Read, Write
C:\Logs\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx - Access
C:\Logs\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx.CRAB MD5: 857020e0173ec53868c0099dfc115592
SHA1: ccdaea97eea807382db9f05b0e91b8b2eee77922
SHA256: be74fd4f76d19d9e457214799fe9597a6e27c55667c5a751a308cb423df1f47b 		Access, Read, Write
C:\Logs\Microsoft-Windows-Kernel-WHEA%4Errors.evtx - Access
C:\Logs\Microsoft-Windows-Kernel-WHEA%4Errors.evtx.CRAB MD5: 05564a8976875199fdec356a7a44cd3a
SHA1: a5f0c3d5c3820af0e14bddb92dc7ee9d2ac3bb9d
SHA256: 66e703810db18800316d42e889ca1c5faecb3153fea3149a428da5d1059b9c01 		Access, Read, Write
C:\Logs\Microsoft-Windows-Kernel-WHEA%4Operational.evtx - Access
C:\Logs\Microsoft-Windows-Kernel-WHEA%4Operational.evtx.CRAB MD5: 6a11892945e3c5d0cbb97f7a95ac175a
SHA1: cecf75639b7ee02622801fd0f81ea216b9840275
SHA256: 6fdac5cba09b717eb2eff7b839190b32dc24eff2298f0051f27b3db334184109 		Access, Read, Write
C:\Logs\Microsoft-Windows-Known Folders API Service.evtx - Access
C:\Logs\Microsoft-Windows-Known Folders API Service.evtx.CRAB MD5: 179dd6036962489ff8a85995de382c0a
SHA1: 5944301ad95ceefff8f2af6bdd8d2ffddc8293c9
SHA256: 84d2e69ae97a963af81041bda9641a696d586be80b84366128ea373add939809 		Access, Read, Write
C:\Logs\Microsoft-Windows-LiveId%4Operational.evtx - Access
C:\Logs\Microsoft-Windows-LiveId%4Operational.evtx.CRAB MD5: 24574045855021bff63b3211576943a8
SHA1: 311be5a994d93d907f4c1f444ef1edf0c31d705f
SHA256: c7b8c107b7f858ddec7e511e73b37960382fab33f6a1f9254c8085ce1b2d32ce 		Access, Read, Write
C:\Logs\Microsoft-Windows-MUI%4Admin.evtx - Access
C:\Logs\Microsoft-Windows-MUI%4Admin.evtx.CRAB MD5: 2e35ae6ace8db3d4cc13e529a361a343
SHA1: b6fe6271cdd76d025bdc219c6456824da0bc7a02
SHA256: e70e8404801446c2213a1b7a313a9495e7afa9e3f11dc0eac9c54ef12a0e41b2 		Access, Read, Write
C:\Logs\Microsoft-Windows-MUI%4Operational.evtx - Access
C:\Logs\Microsoft-Windows-MUI%4Operational.evtx.CRAB MD5: 8801d9fc8d9e2802865b316ac2588d1b
SHA1: 97646b779486106ae7257653c3915de96eac3f15
SHA256: 73de5d48de4393c1148667fbb361f3860217276e2adb89cd612c66151e432321 		Access, Read, Write
C:\Logs\Microsoft-Windows-NCSI%4Operational.evtx - Access
C:\Logs\Microsoft-Windows-NCSI%4Operational.evtx.CRAB MD5: 6ef35c35c2f70156ec03b1a2500b95dc
SHA1: fc81ab22a038b778e221c73c9d2a2879f7a73f74
SHA256: 7d552fd59f53f6440ae106c6ffc3f4f539433259371b7bdd93e493f7617b1ca8 		Access, Read, Write
C:\Logs\Microsoft-Windows-NetworkProfile%4Operational.evtx - Access
C:\Logs\Microsoft-Windows-NetworkProfile%4Operational.evtx.CRAB MD5: 06a666ec48d42b1d6c2628aefe801e36
SHA1: aa3c8326512f5729ff40e0128725e501e5212022
SHA256: 1aff35d48939f70ce3e9929c051115527e8f7f412e1bc21db8b0c037a84e4290 		Access, Read, Write
C:\Logs\Microsoft-Windows-Ntfs%4Operational.evtx - Access
C:\Logs\Microsoft-Windows-Ntfs%4Operational.evtx.CRAB MD5: 2c315ae780a6eef762f7d827f7d69ff8
SHA1: 2064b14d8000d585e2152b1e71a1f74a271cdcb5
SHA256: 154d09856e16b68cb6a5d5c622ed944dfc3f9b96c73c54a4fe6e491418b176f8 		Access, Read, Write
C:\Logs\Microsoft-Windows-Ntfs%4WHC.evtx - Access
C:\Logs\Microsoft-Windows-Ntfs%4WHC.evtx.CRAB MD5: 8fa2758cd39784df01a0d23f21508ae6
SHA1: 4ac08dc6c693848b08279e39ad4ddaf3752cf3a5
SHA256: 4481bf22aef46bdd8102111693f69f1c77c5da50b29e3e2c02c4627f0fad68d5 		Access, Read, Write
C:\Logs\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx - Access
C:\Logs\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.CRAB MD5: 1d6395b662449d98313ba8adfb20f09c
SHA1: d270bf96b277bbbf2cc8e5113d418036452dc976
SHA256: b6a0383d22d9ac4427bc715c4739f38be8669bdcc187138d25edc3e0afec1aea 		Access, Read, Write
C:\Logs\Microsoft-Windows-ReadyBoost%4Operational.evtx - Access
C:\Logs\Microsoft-Windows-ReadyBoost%4Operational.evtx.CRAB MD5: b51fd7bc6029de9a3dec1ef5cc294cb0
SHA1: d0c84b08cab1e6f2b35bf03b7cac466701a9c72b
SHA256: 697fa1c5e66b530ae91c348f4c7f5fd7eece0cf43c636374dbdde1a5cd78f7ec 		Access, Read, Write
C:\Logs\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx - Access
C:\Logs\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx.CRAB MD5: f7221caf8bae1569101ae146d12de31a
SHA1: a3361a27f375d76c19b7010c3e68dbf74bc85527
SHA256: fa30adad0936029fff0c12f6a7bc534de024745549ae7219aabdc73127be94a1 		Access, Read, Write
C:\Logs\Microsoft-Windows-SettingSync%4Debug.evtx - Access
C:\Logs\Microsoft-Windows-SettingSync%4Debug.evtx.CRAB MD5: 250b177a209a1ed220c140a8afa588a9
SHA1: 4d1b6d52409e3cdb2ed0cfc9765a8ce9bbcd6d8d
SHA256: 5cc66b08d22f3fc5fa3d80e557fb62efeff219c2dc456bf746723628ab3fad0a 		Access, Read, Write
C:\Logs\Microsoft-Windows-SettingSync%4Operational.evtx - Access
C:\Logs\Microsoft-Windows-SettingSync%4Operational.evtx.CRAB MD5: ae28bcdb7b35f3e73997bdfd52dbd450
SHA1: a1ed47b3621bf9ecc8a9952cbceb8f5af3d42967
SHA256: d6a5b8e870726a64fd72ac47621d84905e2d8cb5d178887d8e76963fd943157a 		Access, Read, Write
C:\Logs\Microsoft-Windows-Shell-Core%4ActionCenter.evtx - Access
C:\Logs\Microsoft-Windows-Shell-Core%4ActionCenter.evtx.CRAB MD5: 0223718243dc59e31561ad77a6278165
SHA1: a512156acd466355022f41e3cc7d85099ff9a460
SHA256: ace8b180b065ab394adcbf79728c0fb67cd04eb2891fc7dc3d1d9c21b0ea940e 		Access, Read, Write
C:\Logs\Microsoft-Windows-Shell-Core%4Operational.evtx - Access
C:\Logs\Microsoft-Windows-Shell-Core%4Operational.evtx.CRAB MD5: 19d8cba894fbb15558d4afee0b050bdc
SHA1: a73e45753fb200c2c420de1f35e8d7e0a7b6efcd
SHA256: 34e10bfa16be0366072ed6c8355f7ad398312d326d295ba7da95027febb178a9 		Access, Read, Write
C:\Logs\Microsoft-Windows-SmbClient%4Connectivity.evtx - Access
C:\Logs\Microsoft-Windows-SmbClient%4Connectivity.evtx.CRAB MD5: 224afcb19fd5c371b6b1aef1e37eac3f
SHA1: c5051f5e69c8688f22ec84eb52d74ac87ff83d73
SHA256: 7bbba71b947c3cd3b7b68a0d7c586b06d212cf21a5e6603b5f2aabe2b93e9828 		Access, Read, Write
C:\Logs\Microsoft-Windows-SMBClient%4Operational.evtx - Access
C:\Logs\Microsoft-Windows-SMBClient%4Operational.evtx.CRAB MD5: e16e5caf3c3edf749bea0c55cac272e7
SHA1: edd17f2f96e69d74a6e3656c928817e1433cdcc1
SHA256: 88e024313bbfb38a260ee4a4e767cec6f18c033ffec3293c7720bf999e0a5ca2 		Access, Read, Write
C:\Logs\Microsoft-Windows-SmbClient%4Security.evtx - Access
C:\Logs\Microsoft-Windows-SmbClient%4Security.evtx.CRAB MD5: 576a516a5550cb113202325e378e391f
SHA1: f8876bfec5755154431190396a71b9da2e1e58f2
SHA256: 9bf4dd097fe889d8a58553b7cd4f52c85e5c8844b4273f55dfd743bd1d7a1b3f 		Access, Read, Write
C:\Logs\Microsoft-Windows-SMBServer%4Audit.evtx - Access
C:\Logs\Microsoft-Windows-SMBServer%4Audit.evtx.CRAB MD5: c03f22778f555f88763b9a42c6c30a22
SHA1: a35ce8d365b4b653088dc3ffa77b23f16678b343
SHA256: 7511391ac7a48074078f46e644fc081e7cedb67196b712feb348edca1c57bf19 		Access, Read, Write
C:\Logs\Microsoft-Windows-SMBServer%4Connectivity.evtx - Access
C:\Logs\Microsoft-Windows-SMBServer%4Connectivity.evtx.CRAB MD5: b7ffc29ebfa9b64c0d252b329008ecac
SHA1: 28fbb0ece4c500452dc355c320045cfccb2414ed
SHA256: ce3d77102e590b84b20f78a3e3f31b542d2fb0e59999da0dd675a16527075ed6 		Access, Read, Write
C:\Logs\Microsoft-Windows-SMBServer%4Operational.evtx - Access
C:\Logs\Microsoft-Windows-SMBServer%4Operational.evtx.CRAB MD5: edf1166cf3648afca4df64fff4d78762
SHA1: 969495b391d8eb247095366b94529fb37cb71bf7
SHA256: f2a15263de6d98ed50280e0683510d764cf7b917337726d7fecd7539e65e2677 		Access, Read, Write
C:\Logs\Microsoft-Windows-SMBServer%4Security.evtx - Access
C:\Logs\Microsoft-Windows-SMBServer%4Security.evtx.CRAB MD5: ae60a69864a0de9393631e7171b345b4
SHA1: be65961de1fc5e076855ba875aa1d83ebe2f4374
SHA256: 9749966d540864e5ef2660e66545ad44eaaac7447768ec9992bb2f4ced9148c4 		Access, Read, Write
C:\Logs\Microsoft-Windows-Store%4Operational.evtx - Access
C:\Logs\Microsoft-Windows-Store%4Operational.evtx.CRAB MD5: 53231c4af2509ffafdc14570a14fca24
SHA1: 9ee94ccd68e1d5d087ab82bcd81ac086d250671c
SHA256: efee6942763de0d44e4e0188fdb320f3457d0c293c76c99181c74a28eb64c3f4 		Access, Read, Write
C:\Logs\Microsoft-Windows-TaskScheduler%4Maintenance.evtx - Access
C:\Logs\Microsoft-Windows-TaskScheduler%4Maintenance.evtx.CRAB MD5: 75a6b18883f1aead71213da97847599d
SHA1: 4606cb34be6fafacde13c24dffaa3ef10402d20e
SHA256: 1162d7b6e1d9f7eb2c329a65f221f7065150d18c5084e5f6240a94efd39378ad 		Access, Read, Write
C:\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx - Access
C:\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx.CRAB MD5: 25e75c8c597db6ffed8393a9e6fce999
SHA1: 564821a4aa4234b416b1e21a1c09243dcb1a189a
SHA256: 36d8084a1aa00ce971ece9f37dbeaca331219ce65e5ab6b3e1194917ca6a1d77 		Access, Read, Write
C:\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx - Access
C:\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx.CRAB MD5: 173e7ac8dd199692ed525e286c989819
SHA1: 5b3915f97822bef3c7b829aa41a1cf1774e4b095
SHA256: b217eb29561993a3fa31e0f6e49faec5f0a7e89eb09b91364762b37d8df2f76b 		Access, Read, Write
C:\Logs\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx - Access
C:\Logs\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx.CRAB MD5: af578cba4e6fbb8f1e3d0ddcbcfa8276
SHA1: e62487a547ffb35e0dda0c557a56a7a9e95c1578
SHA256: fdd13bad07a206e6da83a34f0338ac37467bc34dac4388533b91eb2df36d5f6c 		Access, Read, Write
C:\Logs\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx - Access
C:\Logs\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx.CRAB MD5: 6b63e72c28d3fa7e581ae752391de389
SHA1: f895ecc11afa3f1a18c65b85a326663116734191
SHA256: 994c1f73cffede23a419c9fe395a53652381ab8c38548778314f2eec981e7ae1 		Access, Read, Write
C:\Logs\Microsoft-Windows-TWinUI%4Operational.evtx - Access
C:\Logs\Microsoft-Windows-TWinUI%4Operational.evtx.CRAB MD5: bc58a50aecd8ca5b4a9b9d227baa9566
SHA1: bedc492732f9d6623ea89a3f03f17ee577944321
SHA256: d2313a47f6ee91e73a288b6a20b12e1090f3bfd3cea3cb34ddb73292179e24d4 		Access, Read, Write
C:\Logs\Microsoft-Windows-User Profile Service%4Operational.evtx - Access
C:\Logs\Microsoft-Windows-User Profile Service%4Operational.evtx.CRAB MD5: 1c5726a0110505e607fb1f8910a96544
SHA1: 580ac71708182cb66280116f38e7718e57e228b8
SHA256: bae961f1f0219fd2b1f193de77dc0f09ebfd9a21689822b5c0a00438983d716d 		Access, Read, Write
C:\Logs\Microsoft-Windows-UserPnp%4ActionCenter.evtx - Access
C:\Logs\Microsoft-Windows-UserPnp%4ActionCenter.evtx.CRAB MD5: b4d3983b3fbbc1c4e8ef5728871ac8f6
SHA1: 20dfbeafa1622ad13205f871447cd24879031af8
SHA256: 647522124e1c1597036d8671e463ef752bd7d0e78bce8bf2f6de3e239920f99b 		Access, Read, Write
C:\Logs\Microsoft-Windows-UserPnp%4DeviceInstall.evtx - Access
C:\Logs\Microsoft-Windows-UserPnp%4DeviceInstall.evtx.CRAB MD5: bd59a16033c007f1209e7352c6c17a43
SHA1: 23f45f84d87abddf80250600d7f63b165a07ac66
SHA256: a529e885b3370b67709193ecf139704e3bde9ab1187f0dbdadfb4d8e828ae71d 		Access, Read, Write
C:\Logs\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx - Access
C:\Logs\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx.CRAB MD5: bc623ff38dfc389beeb59962756f8b51
SHA1: 640ea99e7267fb7c13d6f1b6a3fcf3283480e5ed
SHA256: 9e17f9c99fd965526186268da03b2703024bc7e3a17b063c8771feada7c75a25 		Access, Read, Write
C:\Logs\Microsoft-Windows-Wcmsvc%4Operational.evtx - Access
C:\Logs\Microsoft-Windows-Wcmsvc%4Operational.evtx.CRAB MD5: 7217dcb5a65cf58612751fe279a1059a
SHA1: 60c9d7eed3d0e84f04437c67941ccfa4dc666735
SHA256: 514ee02ee15832d0a6d4243c762e913f3b0971676fbfe1ae617d5e4762588d60 		Access, Read, Write
C:\Logs\Microsoft-Windows-Windows Defender%4Operational.evtx - Access
C:\Logs\Microsoft-Windows-Windows Defender%4Operational.evtx.CRAB MD5: f51edb2b8fccbf7c1ad9d6411ee541d1
SHA1: 47827d025a9ce34f107617c1d9115e1de5861083
SHA256: f27b3523c38c01fd1d9978acf25c592719bdb3ffa01c38bf082d920a47cc3edb 		Access, Read, Write
C:\Logs\Microsoft-Windows-Windows Defender%4WHC.evtx - Access
C:\Logs\Microsoft-Windows-Windows Defender%4WHC.evtx.CRAB MD5: 5bcddf4e0e903b29664913331746719a
SHA1: 5934352df15fc0d1f4b2252c8ad4aede9155e71e
SHA256: 331e0daf493fcbd36056f0efe9815a38323c72e6dbca67b7479ffe40b92c0bf7 		Access, Read, Write
C:\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx - Access
C:\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx.CRAB MD5: 7b9769e0cabfe410eac07bc7fbef6186
SHA1: 73df11621ed4bbf720ce4867781bdf93c26f781d
SHA256: a5251bd3aaedaabaa80730dff0bf3890cd69cae0813629727afdbea26894beaf 		Access, Read, Write
C:\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx - Access
C:\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx.CRAB MD5: e9d048c075acd396b35f617d242b9c68
SHA1: 2de11ca0d2505b4660d6223ea71e5f848ac17cfe
SHA256: 6e305c266477f3aaea7e5af6d1d158814cc86ce9e56d79d56dee06fc87ba2dbb 		Access, Read, Write
C:\Logs\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx - Access
C:\Logs\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx.CRAB MD5: 3fa814ab96cf0ec92e3dfafea26ee016
SHA1: f923d20a054ed142594ea41ae1c3a108245980b2
SHA256: ac6dd799f54bc893d0064cc8afb67452f68e69770fb524c7f75b9b2135aed39d 		Access, Read, Write
C:\Logs\Microsoft-Windows-Winlogon%4Operational.evtx - Access
C:\Logs\Microsoft-Windows-Winlogon%4Operational.evtx.CRAB MD5: 9ed8e4a513c163c36432d9350491fb02
SHA1: 126105c65974235563ab9865aefa937846a9ce63
SHA256: c9a9d2c75a2c170e03b2f33c007bffc5bebdbae1b9feac1d36c8fc959081841e 		Access, Read, Write
C:\Logs\Microsoft-Windows-WMI-Activity%4Operational.evtx - Access
C:\Logs\Microsoft-Windows-WMI-Activity%4Operational.evtx.CRAB MD5: 34fd22406c472dd3f54b57a4f2783bfe
SHA1: 7c68ff886f739fa1e64b7e05aa686f815bb1f982
SHA256: 003378574a1513fdc20cbead5ede9c82b0619a1bba4d76b4eb818fb20cfef6e4 		Access, Read, Write
C:\Logs\Security.evtx - Access
C:\Logs\Security.evtx.CRAB MD5: 60bdf3b7bad53a224cd3fc0c2ec87a87
SHA1: 58e1004b804187bdb76795fc4e2acb931506459b
SHA256: 0d1500e165ad3c965df55ad790d18f8c9597949b24df8a6dddb2b7342d173f19 		Access, Read, Write
C:\Logs\Setup.evtx - Access
C:\Logs\Setup.evtx.CRAB MD5: 692843ab9af214eeb5eebcadacbd7ee6
SHA1: fa752abe9a0de7c9dab50e9e5357981d1eca0062
SHA256: fc8045d94bf988037d77ec1a47f26459a2637ffd7b9f7d0ffe5aae9fb06813a0 		Access, Read, Write
C:\Logs\System.evtx - Access
C:\Logs\System.evtx.CRAB MD5: db7fcab9160616485817806cae1b1630
SHA1: ee0693e6fc274ae1f22e475f67108de7c61a5602
SHA256: e1e0d19d57f364d940b39f858b6983f658401fe149c452cbeb9dfffb925be195 		Access, Read, Write
C:\Logs\Windows PowerShell.evtx - Access
C:\Logs\Windows PowerShell.evtx.CRAB MD5: 07809453e791e629e8db38554712d1b7
SHA1: 846fe6c9097d502a1defd43a09e20387faee878c
SHA256: b000c2dfed304b753afb2f70846e79524cd9de695d66a58956d49c84fe487814 		Access, Read, Write
C:\MalwarebytesLABs - Access
C:\PerfLogs\\CRAB-DECRYPT.txt - Access
C:\Program Files (x86)\\CRAB-DECRYPT.txt - Access, Write
C:\Program Files\\CRAB-DECRYPT.txt - Access, Write
C:\Program Files\Microsoft Office\root\Client - Access
C:\Program Files\WindowsPowerShell\Modules - Access
C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Commands.Management - Access
C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Commands.Management\Microsoft.PowerShell.Commands.Management.dll - Access
C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Commands.Utility - Access
C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Commands.Utility\Microsoft.PowerShell.Commands.Utility.dll - Access
C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation - Access
C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Microsoft.PowerShell.Operation.Validation.psd1 - Access
C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\Microsoft.PowerShell.Operation.Validation.cdxml - Access
C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\Microsoft.PowerShell.Operation.Validation.dll - Access
C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\Microsoft.PowerShell.Operation.Validation.ni.dll - Access
C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\Microsoft.PowerShell.Operation.Validation.psd1 - Access
C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\Microsoft.PowerShell.Operation.Validation.psm1 - Access
C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\Microsoft.PowerShell.Operation.Validation.xaml - Access
C:\Program Files\WindowsPowerShell\Modules\Modules.cdxml - Access
C:\Program Files\WindowsPowerShell\Modules\Modules.dll - Access
C:\Program Files\WindowsPowerShell\Modules\Modules.ni.dll - Access
C:\Program Files\WindowsPowerShell\Modules\Modules.psd1 - Access
C:\Program Files\WindowsPowerShell\Modules\Modules.psm1 - Access
C:\Program Files\WindowsPowerShell\Modules\Modules.xaml - Access
C:\Program Files\WindowsPowerShell\Modules\PackageManagement - Access
C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\PackageManagement.psd1 - Access
C:\Program Files\WindowsPowerShell\Modules\PackageManagement\PackageManagement.cdxml - Access
C:\Program Files\WindowsPowerShell\Modules\PackageManagement\PackageManagement.dll - Access
C:\Program Files\WindowsPowerShell\Modules\PackageManagement\PackageManagement.ni.dll - Access
C:\Program Files\WindowsPowerShell\Modules\PackageManagement\PackageManagement.psd1 - Access
C:\Program Files\WindowsPowerShell\Modules\PackageManagement\PackageManagement.psm1 - Access
C:\Program Files\WindowsPowerShell\Modules\PackageManagement\PackageManagement.xaml - Access
C:\Program Files\WindowsPowerShell\Modules\Pester - Access
C:\Program Files\WindowsPowerShell\Modules\Pester\3.3.5\Pester.psd1 - Access
C:\Program Files\WindowsPowerShell\Modules\Pester\3.3.5\Pester.psm1 - Access
C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1 - Access
C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psm1 - Access
C:\Program Files\WindowsPowerShell\Modules\Pester\Pester.cdxml - Access
C:\Program Files\WindowsPowerShell\Modules\Pester\Pester.dll - Access
C:\Program Files\WindowsPowerShell\Modules\Pester\Pester.ni.dll - Access
C:\Program Files\WindowsPowerShell\Modules\Pester\Pester.psd1 - Access
C:\Program Files\WindowsPowerShell\Modules\Pester\Pester.psm1 - Access
C:\Program Files\WindowsPowerShell\Modules\Pester\Pester.xaml - Access
C:\Program Files\WindowsPowerShell\Modules\PowerShellGet - Access
C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1 - Access
C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1 - Access
C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\PowerShellGet.cdxml - Access
C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\PowerShellGet.dll - Access
C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\PowerShellGet.ni.dll - Access
C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\PowerShellGet.psd1 - Access
C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\PowerShellGet.psm1 - Access
C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\PowerShellGet.xaml - Access
C:\Program Files\WindowsPowerShell\Modules\PSReadline - Access
C:\Program Files\WindowsPowerShell\Modules\PSReadline\1.1\PSReadline.psd1 - Access
C:\Program Files\WindowsPowerShell\Modules\PSReadline\1.1\PSReadLine.psm1 - Access
C:\Program Files\WindowsPowerShell\Modules\PSReadline\1.2\PSReadline.psd1 - Access
C:\Program Files\WindowsPowerShell\Modules\PSReadline\1.2\PSReadLine.psm1 - Access
C:\Program Files\WindowsPowerShell\Modules\PSReadline\PSReadline.cdxml - Access
C:\Program Files\WindowsPowerShell\Modules\PSReadline\PSReadline.dll - Access
C:\Program Files\WindowsPowerShell\Modules\PSReadline\PSReadline.ni.dll - Access
C:\Program Files\WindowsPowerShell\Modules\PSReadline\PSReadline.psd1 - Access
C:\Program Files\WindowsPowerShell\Modules\PSReadline\PSReadline.psm1 - Access
C:\Program Files\WindowsPowerShell\Modules\PSReadline\PSReadline.xaml - Access
C:\ProgramData\Oracle\Java\javapath - Access
C:\Recovery\\CRAB-DECRYPT.txt - Access
C:\System Volume Information\\CRAB-DECRYPT.txt - Access
C:\Users - Access
C:\Users\\CRAB-DECRYPT.txt - Access
C:\Users\Default User\\CRAB-DECRYPT.txt - Access
C:\Users\Default.migrated\AppData\\CRAB-DECRYPT.txt - Access
C:\Users\Default.migrated\AppData\Local\\CRAB-DECRYPT.txt - Access
C:\Users\Default.migrated\AppData\Local\Microsoft\\CRAB-DECRYPT.txt - Access
C:\Users\Default.migrated\\CRAB-DECRYPT.txt - Access
C:\Users\Default.migrated\Documents\\CRAB-DECRYPT.txt - Access
C:\Users\Default.migrated\Documents\My Music\\CRAB-DECRYPT.txt - Access
C:\Users\Default.migrated\Documents\My Pictures\\CRAB-DECRYPT.txt - Access
C:\Users\Default.migrated\Documents\My Videos\\CRAB-DECRYPT.txt - Access
C:\Users\Default\AppData\\CRAB-DECRYPT.txt - Access
C:\Users\Default\AppData\Local\Application Data\\CRAB-DECRYPT.txt - Access
C:\Users\Default\AppData\Local\\CRAB-DECRYPT.txt - Access
C:\Users\Default\AppData\Local\History\\CRAB-DECRYPT.txt - Access
C:\Users\Default\AppData\Local\Microsoft\\CRAB-DECRYPT.txt - Access
C:\Users\Default\AppData\Local\Microsoft\InputPersonalization\\CRAB-DECRYPT.txt - Access
C:\Users\Default\AppData\Local\Microsoft\InputPersonalization\TrainedDataStore\\CRAB-DECRYPT.txt - Access
C:\Users\Default\AppData\Local\Microsoft\Windows Sidebar\\CRAB-DECRYPT.txt - Access
C:\Users\Default\AppData\Local\Microsoft\Windows Sidebar\Gadgets\\CRAB-DECRYPT.txt - Access
C:\Users\Default\AppData\Local\Microsoft\Windows Sidebar\settings.ini - Access
C:\Users\Default\AppData\Local\Microsoft\Windows Sidebar\settings.ini.CRAB - Access
C:\Users\Default\AppData\Local\Microsoft\WindowsApps\\CRAB-DECRYPT.txt - Access
C:\Users\Default\AppData\Local\Temp\\CRAB-DECRYPT.txt - Access
C:\Users\Default\AppData\Local\Temporary Internet Files\\CRAB-DECRYPT.txt - Access
C:\Users\Default\AppData\Roaming\\CRAB-DECRYPT.txt - Access
C:\Users\Default\AppData\Roaming\Microsoft\\CRAB-DECRYPT.txt - Access
C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\\CRAB-DECRYPT.txt - Access
C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\\CRAB-DECRYPT.txt - Access
C:\Users\Default\AppData\Roaming\Microsoft\Network\Connections\_hiddencm\\CRAB-DECRYPT.txt - Access
C:\Users\Default\AppData\Roaming\Microsoft\Network\Connections\Cm\\CRAB-DECRYPT.txt - Access
C:\Users\Default\AppData\Roaming\Microsoft\Network\Connections\\CRAB-DECRYPT.txt - Access
C:\Users\Default\AppData\Roaming\Microsoft\Network\\CRAB-DECRYPT.txt - Access
C:\Users\Default\Application Data\\CRAB-DECRYPT.txt - Access
C:\Users\Default\Cookies\\CRAB-DECRYPT.txt - Access
C:\Users\Default\\CRAB-DECRYPT.txt - Access
C:\Users\Default\Desktop\\CRAB-DECRYPT.txt - Access
C:\Users\Default\Documents\\CRAB-DECRYPT.txt - Access
C:\Users\Default\Documents\My Music\\CRAB-DECRYPT.txt - Access
C:\Users\Default\Documents\My Pictures\\CRAB-DECRYPT.txt - Access
C:\Users\Default\Documents\My Videos\\CRAB-DECRYPT.txt - Access
C:\Users\Default\Downloads\\CRAB-DECRYPT.txt - Access
C:\Users\Default\Favorites\\CRAB-DECRYPT.txt - Access
C:\Users\Default\Links\\CRAB-DECRYPT.txt - Access
C:\Users\Default\Music\\CRAB-DECRYPT.txt - Access
C:\Users\Default\My Documents\\CRAB-DECRYPT.txt - Access
C:\Users\Default\NetHood\\CRAB-DECRYPT.txt - Access
C:\Users\Default\NTUSER.DAT.LOG1 - Access
C:\Users\Default\NTUSER.DAT.LOG1.CRAB - Access
C:\Users\Default\NTUSER.DAT.LOG2 - Access
C:\Users\Default\NTUSER.DAT.LOG2.CRAB - Access
C:\Users\Default\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TM.blf - Access
C:\Users\Default\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TM.blf.CRAB - Access
C:\Users\Default\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000001.regtrans-ms - Access
C:\Users\Default\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000001.regtrans-ms.CRAB - Access
C:\Users\Default\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000002.regtrans-ms - Access
C:\Users\Default\NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000002.regtrans-ms.CRAB - Access
C:\Users\Default\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf - Access
C:\Users\Default\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf.CRAB - Access
C:\Users\Default\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms - Access
C:\Users\Default\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms.CRAB - Access
C:\Users\Default\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms - Access
C:\Users\Default\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms.CRAB - Access
C:\Users\Default\Pictures\\CRAB-DECRYPT.txt - Access
C:\Users\Default\PrintHood\\CRAB-DECRYPT.txt - Access
C:\Users\Default\Recent\\CRAB-DECRYPT.txt - Access
C:\Users\Default\Saved Games\\CRAB-DECRYPT.txt - Access
C:\Users\Default\SendTo\\CRAB-DECRYPT.txt - Access
C:\Users\Default\Start Menu\\CRAB-DECRYPT.txt - Access
C:\Users\Default\Templates\\CRAB-DECRYPT.txt - Access
C:\Users\Default\Videos\\CRAB-DECRYPT.txt - Access
C:\Users\FD1HVy - Access
C:\Users\FD1HVy\AppData\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Local\Microsoft\Windows\PowerShell - Access
C:\Users\FD1HVy\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache - Access, Read
C:\Users\FD1HVy\AppData\Local\Microsoft\WindowsApps - Access
C:\Users\FD1HVy\AppData\Local\Temp\ - Access
C:\Users\FD1HVy\AppData\Local\Temp\__PSScriptPolicyTest_35syrs1n.w3d.ps1 MD5: c4ca4238a0b923820dcc509a6f75849b
SHA1: 356a192b7913b04c54574d18c28d46e6395428ab
SHA256: 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b 		Access, Write
C:\Users\FD1HVy\AppData\Local\Temp\__PSScriptPolicyTest_cygv5j12.bxt.psm1 MD5: c4ca4238a0b923820dcc509a6f75849b
SHA1: 356a192b7913b04c54574d18c28d46e6395428ab
SHA256: 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b 		Access, Write
C:\Users\FD1HVy\AppData\Local\Temp\__PSScriptPolicyTest_gbsbmxho.bhs.psm1 MD5: c4ca4238a0b923820dcc509a6f75849b
SHA1: 356a192b7913b04c54574d18c28d46e6395428ab
SHA256: 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b 		Access, Write
C:\Users\FD1HVy\AppData\Local\Temp\__PSScriptPolicyTest_pcfxszbc.ddv.ps1 MD5: c4ca4238a0b923820dcc509a6f75849b
SHA1: 356a192b7913b04c54574d18c28d46e6395428ab
SHA256: 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b 		Access, Write
C:\Users\FD1HVy\AppData\Local\Temp\PHfW.exe MD5: 368a8f05fa7be1fcc24f445c444acb30
SHA1: 909bee1d1a19f2ea43ba38e826d49c0e7cf958b3
SHA256: 846ad2d7e1e133ae4bc2decbc22ae686a44cccaffbee15b4d9b23143f6aa8d3f 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\02QNH7-.m4a - Access
C:\Users\FD1HVy\AppData\Roaming\02QNH7-.m4a.CRAB MD5: 67f02dca81fd958c624d674d53e42816
SHA1: c4f2c978c079dc3e252f0a03992b567c8ce0c8d2
SHA256: 4baeba1af944f9667fe327bbff70c91515fa3b9e1ec07a02b1570140c933a86e 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\2oUNrYIA3zn9-w8eBm_.swf - Access
C:\Users\FD1HVy\AppData\Roaming\2oUNrYIA3zn9-w8eBm_.swf.CRAB MD5: e94b6ab84f76c7d05a4eb3b2bda553ec
SHA1: 5895dfbd3bbc9cb4fa213e5b74e5309ab8c4e3d9
SHA256: a3b0a9fb83d903803a84fcefc259ca473e871c133e5e1254c64beadb90c06d7c 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\9b_EQebyn-_mWdpXc6.mp3 - Access
C:\Users\FD1HVy\AppData\Roaming\9b_EQebyn-_mWdpXc6.mp3.CRAB MD5: 4fa6250c8edf4b3d3aae39e68281d97c
SHA1: a9ecdee8f1be05b03f40af176b62d115fc7c7ef0
SHA256: 609ed33c874a0f8ee8b3ce1e6622d2fa28d81f57f3273af0be70ff4f42a282dc 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\Adobe\Acrobat\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Adobe\Acrobat\DC\Collab\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Adobe\Acrobat\DC\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Adobe\Acrobat\DC\Forms\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Adobe\Acrobat\DC\JSCache\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Adobe\Acrobat\DC\JSCache\GlobData - Access
C:\Users\FD1HVy\AppData\Roaming\Adobe\Acrobat\DC\JSCache\GlobData.CRAB MD5: 4a625eed9574d07dc5a48e532058d11d
SHA1: 1586e3323d232ad987e7686ba51f4bb2b90833f8
SHA256: ddf2419b1dc04d8ce06105b1d47844cfa50294a5ab9a89a7232cc8ba14191548 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\Adobe\Acrobat\DC\JSCache\GlobSettings - Access
C:\Users\FD1HVy\AppData\Roaming\Adobe\Acrobat\DC\JSCache\GlobSettings.CRAB MD5: 11131b04c53a0a218a07a28400b711e4
SHA1: 6fc35c421b84e095e478e70f3148d657a8ecb106
SHA256: 4285c6873d53096ff9fb5789c8eab347ade04a91c1128dcd8383940d9fbbbfc8 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\Adobe\Acrobat\DC\Security\addressbook.acrodata - Access
C:\Users\FD1HVy\AppData\Roaming\Adobe\Acrobat\DC\Security\addressbook.acrodata.CRAB MD5: 9388cf6aaa98030f8f756f9b2c125717
SHA1: 2660241b8132681e3640d6b7a22f4e53bda3706d
SHA256: bef66c3594571a8478ad9d9c1358be62f01fa82247899daba7086e96430de599 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\Adobe\Acrobat\DC\Security\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl - Access
C:\Users\FD1HVy\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl.CRAB MD5: 9ec88a06223e8c24a5ebad30238687ae
SHA1: 50c9f0aa4875ae3f83cdc04e955f23ecad10d162
SHA256: e57ef8c1cb5e69700d98bc5d5410c66ee21d253a565515e659c6a978fcd0ad7f 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl - Access
C:\Users\FD1HVy\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl.CRAB MD5: e7c0e01643f73bef2a252fa98a066072
SHA1: da383042b8a9ef9fa2f488e3b39b21054af409da
SHA256: 03c8950708b0c2dfd61bf383137bbc5338802430a1a9cec11039989b42e94b07 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Adobe\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Adobe\Flash Player\AssetCache\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Adobe\Flash Player\AssetCache\G7ZD37Y5\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Adobe\Flash Player\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Adobe\Flash Player\NativeCache\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Adobe\Headlights\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Adobe\Linguistics\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Adobe\LogTransport2\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Adobe\LogTransport2\Logs\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Adobe\LogTransport2\LogTransport2.cfg - Access
C:\Users\FD1HVy\AppData\Roaming\Adobe\LogTransport2\LogTransport2.cfg.CRAB MD5: 2d883d71dab7eae582dce322784d55a7
SHA1: 69bf69b09439d6395c4eb36ef64861ba41aebbf8
SHA256: 267ce1bd195ffe5c0ab81741b538bca3d8bdbc32fa35385117dfe7aa48ac66f9 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\Adobe\Sonar\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Adobe\Sonar\Sonar1.0\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Adobe\Sonar\Sonar1.0\sonar_policy.xml - Access
C:\Users\FD1HVy\AppData\Roaming\Adobe\Sonar\Sonar1.0\sonar_policy.xml.CRAB MD5: 6fe9a4e2dab914d2615d77ed6dec0e52
SHA1: 9201124f995d333b106ea738ec9a9b3de971a0fd
SHA256: 1ab30607a398fa08cd5b5137e9f2cf8e7d3cb40076f2190c6e1a9750e0dec25f 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\agGHfzYqqx.mp3 - Access
C:\Users\FD1HVy\AppData\Roaming\agGHfzYqqx.mp3.CRAB MD5: 80c2371200fcaa6221fd6048db3aac4d
SHA1: 4f9c9a1ace16867c0e738de8fed4863a318e9c1c
SHA256: dd88460d06fc985ec666052c6904aa790eee6cd306c0eb574d46a1e3343deeca 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\AhWG4Et.avi - Access
C:\Users\FD1HVy\AppData\Roaming\AhWG4Et.avi.CRAB MD5: 5e4e5c052af1b4795b2ba2f535385600
SHA1: 66d30f246691bd423506ee25c6c6594b9c33adbe
SHA256: 8093f51ddf4d2eaea2374e714053444d00f368472de8ff56db74098d20414ed7 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\cZ7CzOo.swf - Access
C:\Users\FD1HVy\AppData\Roaming\cZ7CzOo.swf.CRAB MD5: b0fd55020c84b2a9e803b8eda326420b
SHA1: a94c2207ee2b6d6c6ae697f8f3910f5995221b25
SHA256: ab9c48ede1fdebf1ed769473f36d7d15413a54d0a26f97ff61c4c45fb5eec859 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\DX12g0.flv - Access
C:\Users\FD1HVy\AppData\Roaming\DX12g0.flv.CRAB MD5: e63d082f08dd866e7555b85c11ac020b
SHA1: c13e30fe6e89990c1f2669292c40335b22ddae5f
SHA256: a2b2ea3497a5658b82fe7baa80ce4e6391b9d1590229d7c85a705460d6dab31d 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\DxoEAnru.m4a - Access
C:\Users\FD1HVy\AppData\Roaming\DxoEAnru.m4a.CRAB MD5: 260ea36517a3cbac047f5c84c457d891
SHA1: 8f2540c5db10f194f7773192eeef508944bb83e3
SHA256: 7dbd983af4b7367fd2ada0ed8895a8a7ecb66159ca4b3c17cbf1eb5c8b9ef3e4 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\e6N3L.bmp - Access
C:\Users\FD1HVy\AppData\Roaming\e6N3L.bmp.CRAB MD5: 03fe275bb26a3af0ec6f226c3c9415ae
SHA1: 7f71343b98ce82cca57538bf3ecd6176da886632
SHA256: 13f836ed8c366f0e7c23ca6445fc0e88324d24b8385d66ff4558ef408a9daa61 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\elVartYShnl.odp - Access
C:\Users\FD1HVy\AppData\Roaming\elVartYShnl.odp.CRAB MD5: 0ed44fb94f70c0fe3f4bff89b18aea3d
SHA1: 7962c491b2c5359a9c747fa3ff506c2293bfbf9b
SHA256: c161c379a449fc221b122dd94bdf69f64687424c356dd2236e7957dc005c2f33 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\eo4d2qL.wav - Access
C:\Users\FD1HVy\AppData\Roaming\eo4d2qL.wav.CRAB MD5: 2d194459d7fb83fce5ae6f0e75f9267f
SHA1: 6602931f366e7aad1abb5ef6a90ae805453ca861
SHA256: 194d59c1258e0722b12839db07255bc0566a5e970646cc513411ceb0c411a13e 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\fiIX7K.bmp - Access
C:\Users\FD1HVy\AppData\Roaming\fiIX7K.bmp.CRAB MD5: 55fd377d42a00adc2b9f5ad5ffbcdcaf
SHA1: fcda3c607eddb8b8a2dee377ef4de8867841adfc
SHA256: 401ec4fbe2455c1c71fc3ace792bfe2b7dd553d06e76b1f0315ef7f4f5d2f581 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\g6-JFVm7lu6U9x3fZ.wav - Access
C:\Users\FD1HVy\AppData\Roaming\g6-JFVm7lu6U9x3fZ.wav.CRAB MD5: c5438fdd366774523f4910d70ce03234
SHA1: ed064811cc74c586c35b0c2386a458fa07df20ca
SHA256: 40d8a6774b7a2f62165467758af96132ae20cb85260259b5ef9da41d704246fa 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\heJjGiHHExhzv.wav - Access
C:\Users\FD1HVy\AppData\Roaming\heJjGiHHExhzv.wav.CRAB MD5: e894752b1db14adedd259fe2479af8ac
SHA1: 2fb55719f4a41b6c3b551338de5db906fa896162
SHA256: ca8298d530c4d59c3cc39ca7c4bec96deeedfcfda300827e3c92db26b26fee7d 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\Ja SFgovZVYsq.gif - Access
C:\Users\FD1HVy\AppData\Roaming\Ja SFgovZVYsq.gif.CRAB MD5: 281028c49da9a753f929b69546507a93
SHA1: 15da6531e30090b6e3091b2a8462f90028ecb79b
SHA256: 67c0110e19596242677563d5ca2a374e027d3b283754bcd59653e7ccb6dadfe9 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\Jw08Q7.flv - Access
C:\Users\FD1HVy\AppData\Roaming\Jw08Q7.flv.CRAB MD5: 2f1fd74b4b4354835ab1db8b29758448
SHA1: 16436e508cf1cafdabc247f423973f393e34b278
SHA256: e43607bcaa3a691e823fb9974d6829abef703dc714db9a083a9da92b6c570757 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\Macromedia\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\XCVUDUNH\#AppContainer\aa.online-metrix.net\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\XCVUDUNH\#AppContainer\aa.online-metrix.net\fpc.swf\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\XCVUDUNH\#AppContainer\aa.online-metrix.net\fpc.swf\session.sol - Access
C:\Users\FD1HVy\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\XCVUDUNH\#AppContainer\aa.online-metrix.net\fpc.swf\session.sol.CRAB MD5: 5773c4d8ea039e4259263835fb22f5e1
SHA1: abb07551dae9bddd14ec787044f986a24a962fd2
SHA256: ff32f70e010c0c1b286a641a789ea0e1d622243c38dd2baeec1218912909c778 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\XCVUDUNH\#AppContainer\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\XCVUDUNH\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Macromedia\Flash Player\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Macromedia\Flash Player\macromedia.com\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#aa.online-metrix.net\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#aa.online-metrix.net\settings.sol - Access
C:\Users\FD1HVy\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#aa.online-metrix.net\settings.sol.CRAB MD5: a0837aef55ace29c29cdf2f0b6920b33
SHA1: a568a52a7d9e0948e05b7c772c603e7229c2c426
SHA256: 5bd90ccb53f5a6634a2dbfb2553907d4e9ddc8d5301eace561d1e00cec70a8ef 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sol - Access
C:\Users\FD1HVy\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sol.CRAB MD5: 99d99212c7ef0a0cd6a2ceddd6a5a7c9
SHA1: 720c499891a1b748cc4a5cd8cf37310356fd801a
SHA256: ba537cf9407f6911685d8139b8485f4c4b7f2ed466f8a2f286a2b062c0c005d3 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\MbKHyQXBm8.png - Access
C:\Users\FD1HVy\AppData\Roaming\MbKHyQXBm8.png.CRAB MD5: 910c47f242251e3ff9fc2e5681783859
SHA1: e57028fb71324046101ea5f8c413cc640f993d4c
SHA256: 41229340f9d53e9f81153985c5715237ae248622f42b0e9e316b0271facd4725 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Access\AccessCache.accdb - Access
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Access\AccessCache.accdb.CRAB MD5: 54e3fe0c6f9702c4fe420aa4cea8366f
SHA1: b12e4914d87b67d0d2b5d425eb935eb5d40da39d
SHA256: ff700219aa01216a64eb419cd14e1fea541a3fc0c14bcccc169e66fe50b363b3 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Access\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Access\System.mdw - Access
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Access\System.mdw.CRAB MD5: f92fa350379a1d800465bcd0cf28ff0c
SHA1: ec27bd704114d14944a369d89fbcc4e71eed0e84
SHA256: d29effe808b09c3971d2f7f84cbde5db62a117fb7f5e305a5dc33a09b1a4f384 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\Microsoft\AddIns\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Bibliography\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Bibliography\Style\APASixthEditionOfficeOnline.xsl - Access
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Bibliography\Style\APASixthEditionOfficeOnline.xsl.CRAB MD5: 06cb1b1474739b4c0e4b2527773b1163
SHA1: 5d02d1e3cab83a1be04411390c630da04b494749
SHA256: b15f6e4cd9cf6ebba50202f08e759c0743a84c2e84bc0bf9dfeead44b29fd689 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Bibliography\Style\CHICAGO.XSL - Access
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Bibliography\Style\CHICAGO.XSL.CRAB MD5: 4a55af7c6ca6bd175084d7e5ec1fc7ba
SHA1: 29a65e7b3c0daf568eca8b66377c2d2f3e9c7dfe
SHA256: 53e172b7ec93f571818e7e20dfd5d22c6c2a52c7fa435efbf5fc7990ac1b3ba7 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Bibliography\Style\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Bibliography\Style\GB.XSL - Access
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Bibliography\Style\GB.XSL.CRAB MD5: 5f2498b344669888776a894cf475869e
SHA1: dda24a22608520bf62305ea6ac1c9aa62c96ee35
SHA256: f3167d22d4ad47ea1e3885e52b14fa4030326de0860e2369298d8ed4b91cf013 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Bibliography\Style\GostName.XSL - Access
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Bibliography\Style\GostName.XSL.CRAB MD5: bd60b176cbf5bf98274788bac3ea318c
SHA1: a41769f7832aae3bc6151ce53c36e0aa027ed570
SHA256: 18767aceafc79f457a8ebb8cbe2ce1b4aa997f22799ba232612dca002aaa9454 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Bibliography\Style\GostTitle.XSL - Access
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Bibliography\Style\GostTitle.XSL.CRAB MD5: 08eac3cd78f0fc1cfbf406a936a85da3
SHA1: 71df1dd9967ffd1de09b4e9114b8ae65d6ebfd82
SHA256: 8cb4640001e007cb54c25ee07feff9d425ef0984c1efacd1cd11de52f3bbe594 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Bibliography\Style\HarvardAnglia2008OfficeOnline.xsl - Access
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Bibliography\Style\HarvardAnglia2008OfficeOnline.xsl.CRAB MD5: 89e875b3b166d1d74fd2733b3815a3a8
SHA1: 3a4214bdb2c78cd3050c17604727702e21218ad0
SHA256: 8ff73f52699a7d0148c3d8a53690f6f9f23c56045590ba23e032a7374b177893 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Bibliography\Style\IEEE2006OfficeOnline.xsl - Access
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Bibliography\Style\IEEE2006OfficeOnline.xsl.CRAB MD5: 905c68e11e37fc4f518bb3f0e1e35c84
SHA1: 2a8c34133c0d9cc8d18c787e475ac8a73354eb7a
SHA256: f20c38f4a091451cc92d2ed985f12a493bb5e9a4f05eac9208ba2e7e2b4fbde8 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Bibliography\Style\ISO690.XSL - Access
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Bibliography\Style\ISO690.XSL.CRAB MD5: fbc020b6ca4ba4c86424c69355e8eef6
SHA1: 3450688175250ebd63e6496c70a4bd7f26d931c8
SHA256: 61b58d0637b9fa26d040ce67382fb5a535789de9a49ad0ccaedefad17fe03a89 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Bibliography\Style\ISO690Nmerical.XSL - Access
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Bibliography\Style\ISO690Nmerical.XSL.CRAB MD5: 38ae6a3cc5aa3b6ef88ca7a0fa8116e8
SHA1: d55d322702a8856da3658928e71e61f49c613c83
SHA256: 8cfcc93d9bb0c0b7d45e1bd3e8fc82a81b064d2eee3e129a7820110751baa3ef 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Bibliography\Style\MLASeventhEditionOfficeOnline.xsl - Access
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Bibliography\Style\MLASeventhEditionOfficeOnline.xsl.CRAB MD5: b8b1dcfcdf4afb34f131a0ee5f8238ca
SHA1: 47465ecbb8ae840ce4f8e825b26ec967e57a1654
SHA256: 9e67ecb3b11fe05f10b6c98df3ba2ae13afed2ab5eed1fe879a0ca98f745111a 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Bibliography\Style\SIST02.XSL - Access
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Bibliography\Style\SIST02.XSL.CRAB MD5: fe3be5f5b14b03e191f98940eb6977d6
SHA1: 7a004aeca9995debbe8f0b9ea2261946047b41b8
SHA256: 7c2bebdc9257dc40342f1bc66740faea63a998569de32dad717b565f3eab93e5 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Bibliography\Style\TURABIAN.XSL - Access
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Bibliography\Style\TURABIAN.XSL.CRAB MD5: c859271b22b01b7217d6e25ac39ab0cb
SHA1: 3e8407d89c1cd51df79261aeb597a41586882c64
SHA256: 3680cef0fb31b53952164fde51f8f4adefeafd943b24d23dbea01a3e422463c6 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\Microsoft\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Credentials\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Crypto\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Crypto\RSA\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1051304884-625712362-2192934891-1000\83aa4cc77f591dfc2374580bbd95f6ba_33d770d0-06bc-47c5-8714-222cdac43a71 - Access
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1051304884-625712362-2192934891-1000\83aa4cc77f591dfc2374580bbd95f6ba_33d770d0-06bc-47c5-8714-222cdac43a71.CRAB MD5: 6bd9780b6b74e78a6559755633078e00
SHA1: 5b5258e0d9944398ffdbb312ea3c7fba09f1810d
SHA256: 79b2b3b4718a3fdc63664e8f681587a1f20c3485fc4ca0ff8946dac2f3c33137 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1051304884-625712362-2192934891-1000\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Document Building Blocks\1033\16\Built-In Building Blocks.dotx - Access
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Document Building Blocks\1033\16\Built-In Building Blocks.dotx.CRAB MD5: 99a8ab0fe14da95676f363a969853a0e
SHA1: 6be92fcaca143a3870214df1d0723a3fc1c03654
SHA256: bff8bdb182d5ef27685bd4b29972984654a77c1185c2910df28ed151bf4d13c3 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Document Building Blocks\1033\16\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Document Building Blocks\1033\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Document Building Blocks\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Excel\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Excel\XLSTART\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Microsoft\ibpbzu.exe MD5: e715ecd8129977094f9e31bc42da0090
SHA1: 16acd6b38bbe74e3288ee0ae8640fcffa6c31c08
SHA256: f4c0e3d6639404086afc0219e7a99a3e74937668e148d20acd8a259bc88ff559 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\Microsoft\InputMethod\Chs\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Microsoft\InputMethod\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Internet Explorer\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Internet Explorer\UserData\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Microsoft\MMC\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Microsoft\MS Project\16\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Microsoft\MS Project\16\en-US\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Microsoft\MS Project\16\en-US\Global.MPT - Access
C:\Users\FD1HVy\AppData\Roaming\Microsoft\MS Project\16\en-US\Global.MPT.CRAB MD5: 4fe0c11ed3211cdb072a4364cf14b0d4
SHA1: c565544d7309623d985ae91237abd9978e02078a
SHA256: b82af1575ac2c673d7210a2ae0b89c468c0afe1ac7cd7ea7f7fdf5cadf9fad74 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\Microsoft\MS Project\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Network\Connections\_hiddencm\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Network\Connections\Cm\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Network\Connections\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Network\Connections\Pbk\_hiddenPbk\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Network\Connections\Pbk\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Network\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Office\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Office\MSO1033.acl - Access
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Office\MSO1033.acl.CRAB MD5: bd10dbf3a848bb6f97a7f6747f6db024
SHA1: e6327f7216431219d5d12db0e4d31940d22a8d78
SHA256: 43fde4167cfe2a5c6f3ead88984661dff8448eb564f14afc4fb567058054b144 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Office\Recent\con2.LNK - Access
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Office\Recent\con2.LNK.CRAB MD5: 3ec4cb5b3601dae19278112e2691a00b
SHA1: 53667cb724a7cb94776ffbec41d4efe5f2ed4839
SHA256: d82a3666175f6235661f470ec0884a34e38e667d396a7dd540f9ab6437bc8eaa 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Office\Recent\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Office\Recent\Database1.LNK - Access
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Office\Recent\Database1.LNK.CRAB MD5: 689b6903d16555d13ea4d72885959f8d
SHA1: 313fa9878d4caa3af555e1bc0dcb0a39ff04c11a
SHA256: a15a9aac49d7eda73ce2e4d0348e48e6e22c2888ebf127fd3a4543d5a45dc3d6 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Office\Recent\Database2.LNK - Access
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Office\Recent\Database2.LNK.CRAB MD5: 99752cf9378acbab1f56bd2314fd2506
SHA1: 55fe66d505760a0b1b1132a6393c65687f596a3e
SHA256: a125d78fc0fb84e85ca268d6b9ff1fe863392a14558733c4a44679d7a0053115 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Office\Recent\Documents.LNK - Access
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Office\Recent\Documents.LNK.CRAB MD5: 54eee01d4cfc0ca08276e28e351f4094
SHA1: c890980bd4000fc83a11f2a4264d1dc003a57c30
SHA256: 2a74f51ea191925ee2330e4b4cda40ddaf69a5390c28c382b4e1483f584a3216 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Office\Recent\Global.LNK - Access
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Office\Recent\Global.LNK.CRAB MD5: d9c7fef803a90a25467e99793c886e73
SHA1: ba22b24ce27c3cdcc4094a25faa53d9858cd4df3
SHA256: 822f0de81eb78fa7bbaf1d7b78a5d178cbbf6e66fa97a14f696283a01fb36035 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Office\Recent\index.dat - Access
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Office\Recent\index.dat.CRAB MD5: 05ff64a2bd64f4a2d73d739dda08c432
SHA1: f20eaca064d5a9d1648650e19b55bf5b0b87bdf5
SHA256: 18605b2667d901b9e4c7f57451d1bd42c2827a317114eac22e135edb19dc95c6 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Office\Recent\sample_file.LNK - Access
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Office\Recent\sample_file.LNK.CRAB MD5: 272b13403ea5a253b88108e376571e67
SHA1: e7eed02bb4705500f876a09af17856524f6d031a
SHA256: d20cfcaa992501a71cc7ef72d8a773f4fb3a59d3255c1ee057701b337ef7f2c2 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Office\Recent\Templates.LNK - Access
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Office\Recent\Templates.LNK.CRAB MD5: 2ebd65eb057c371257c58c0adaa2aecd
SHA1: e5ca2e55bfc33897a5cbdb3a1ae5912775761c45
SHA256: ae53f507e7cf216133a3b8c43ddbb850738807378eba1e4db2cbfad292a82f0d 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Outlook\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Outlook\Outlook.srs - Access
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Outlook\Outlook.srs.CRAB MD5: 376efe022e99e4575becd031cae83fee
SHA1: c6f76bd38e52647f6f07bb8ee3592009ceda123e
SHA256: eb4c0b53d144d019b3430b48705a2aa979a83f03b569185209fdd1ca925c5ea2 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Outlook\Outlook.xml - Access
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Outlook\Outlook.xml.CRAB MD5: 400c4200cfe1f201d9c6796a07f155be
SHA1: ead8afbc6847e75a646c1a66c6a9d7ed870a16c9
SHA256: c2327b77763821026cad6e703496af5c6d37e7eaf659a66d81a66596e8f03900 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\Microsoft\PowerPoint\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Proof\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Protect\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Protect\CREDHIST - Access
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Protect\CREDHIST.CRAB MD5: 30745a45cbdaa2e9229c0315825eedf7
SHA1: a1e31e5d3fdbb9ba54307ebffe349dd556de1b00
SHA256: 67472f05d19753d134259284a099458895dc1f585530435dbe81daca3c3989c9 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Protect\S-1-5-21-1051304884-625712362-2192934891-1000\5c218343-f813-4ba1-8332-5b3fa0f5717a - Access
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Protect\S-1-5-21-1051304884-625712362-2192934891-1000\5c218343-f813-4ba1-8332-5b3fa0f5717a.CRAB MD5: ae740ede26e98dce0b9df0374db6ee62
SHA1: 4af63ca0866ef9c33c0494eff4a6e577531a0abb
SHA256: c460cd5ec6419690559ad9e3814c764308842f10184305159a684efbc4bf3cab 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Protect\S-1-5-21-1051304884-625712362-2192934891-1000\7a70842e-d6a2-46c1-966c-384a4ef9d347 - Access
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Protect\S-1-5-21-1051304884-625712362-2192934891-1000\7a70842e-d6a2-46c1-966c-384a4ef9d347.CRAB MD5: 24e1cdf3f9c20c10808c34760a7509c6
SHA1: 6aa10ffa6ca410c4fe115df9c1e61c93bd7fbbce
SHA256: fcbd8596a42fb1184902363e353287c8486806880fcade6153d8ca2204ae6276 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Protect\S-1-5-21-1051304884-625712362-2192934891-1000\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Protect\S-1-5-21-1051304884-625712362-2192934891-1000\e01a7a31-687e-4cfa-9cfe-700ac08104e6 - Access
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Protect\S-1-5-21-1051304884-625712362-2192934891-1000\e01a7a31-687e-4cfa-9cfe-700ac08104e6.CRAB MD5: 44f8d3ead2e9721d4e82cc72fa58c59c
SHA1: 38d77729fcf993a54d74214f0447492b3e9ac95f
SHA256: 485005981d61293501a146023a5b9a51b2f6e1eeefece7d16359a795e947c8ac 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Protect\S-1-5-21-1051304884-625712362-2192934891-1000\Preferred - Access
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Protect\S-1-5-21-1051304884-625712362-2192934891-1000\Preferred.CRAB MD5: 377799a1a97344bc72150bdc3bc3d4a2
SHA1: 63d17167bd77caecf5915dad9cf02c910256428a
SHA256: 6aac6a1dd276b48b60e387e3d042938cd6b47b14c396b2b58e9bf2745c749164 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Protect\SYNCHIST - Access
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Protect\SYNCHIST.CRAB MD5: 49787f54069a7acc8a49921c185351c9
SHA1: 02acbc1e162b85978827a5a92182aa71a09ab373
SHA256: 4ffd7720084698f859db138900ea438f8d0e3ded13541723e24dc9cddb374bd2 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Publisher Building Blocks\ContentStore.xml - Access
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Publisher Building Blocks\ContentStore.xml.CRAB MD5: f27f4ee912cf89cf41a61c0cceac3d69
SHA1: cbb64ec5ec81f460a09848371b5933be6a3df2f9
SHA256: 4bcd0d14104927d152c3f3a2e0827117e9ca2465599e33e9440a07b490af02a1 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Publisher Building Blocks\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Publisher\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Signatures\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Speech\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Stationery\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Microsoft\SystemCertificates\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Microsoft\SystemCertificates\My\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Microsoft\SystemCertificates\My\CRLs\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Microsoft\SystemCertificates\My\CTLs\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Templates\Cashflow analysis.xltm - Access
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Templates\Cashflow analysis.xltm.CRAB MD5: add5ee23dce180a3912ed0587f2f313b
SHA1: 18a47be487b279c4d8d51170a33e2b755ec5d287
SHA256: 00d5a06498200b47b42954d5f28916ac2ef7c20e1634422bc577b89dfc79fcb4 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Templates\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Templates\LiveContent\16\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Templates\LiveContent\16\User\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Templates\LiveContent\16\User\Document Themes\1033\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Templates\LiveContent\16\User\Document Themes\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Templates\LiveContent\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Templates\Normal.dotm - Access
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Templates\Normal.dotm.CRAB MD5: d4dc57e4f3186ceb75a0ee70c6e09262
SHA1: 91fce05de63c8a79d8b613145cd0e335fab84040
SHA256: 9f578548299d48c2865704c9260190ad738b983a9f49b217173c895e15dc98c7 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Templates\Welcome to Excel.xltx - Access
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Templates\Welcome to Excel.xltx.CRAB MD5: 89c9ef561b5aa7b14592df253f769b32
SHA1: e0479292325aa155f4a5a403bb63a41f834aac1b
SHA256: 432706fb16e332ad285d61631f3500b56cf40a43882fd460abfae0f781380654 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Templates\~$Normal.dotm - Access
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Templates\~$Normal.dotm.CRAB MD5: 69a88f7da770e42221789ef666c40e0d
SHA1: 034c1e037c52f05d0ccc56093435b021c8c37751
SHA256: 32b6e4f7e68ec760254b588ac16ab95162623a17e52020f1f49893f8f394b640 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\Microsoft\UProof\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC - Access
C:\Users\FD1HVy\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC.CRAB MD5: cb5cf207d8efd564577db560f23e5cdb
SHA1: 42b5f611e64e038cecc2c62aa5cf3ceb79640055
SHA256: ef979ea33a871a860b2d3905926381778a94171ff5efd8feecb3d66093c7f4b4 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Vault\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Word\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Microsoft\Word\STARTUP\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Mozilla\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Extensions\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Crash Reports\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Crash Reports\events\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Crash Reports\InstallTime20170824053622 - Access
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Crash Reports\InstallTime20170824053622.CRAB MD5: e8287ff38d361108ddfc60ff0cf19c55
SHA1: f308a1142041b783b3520346c7750456621a3dd3
SHA256: 8f9a73ad048f6e7b72dd650f670f1dacb53ffc13d27eaf332cb996c78abf7d2b 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Pending Pings\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\profiles.ini - Access
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\profiles.ini.CRAB MD5: cb604d48605dce97d5ebdfc7bf4861f0
SHA1: 67dbc85f9b24db52090fce94632f2f2db374f39d
SHA256: 6586fd50d50aae78ed69cd313c059751c7a1ff474aadcf437f7699ee96fc7eb5 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\addons.json - Access
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\addons.json.CRAB MD5: 2b0dcfcb95c21739521f19d8ee77bd55
SHA1: 38f024d535de7d5f2c7e8ef7d4136eb451ffad48
SHA256: 78cfaff41dd79ee086dd9e8cb034506f0ef80f85880fe9fdda17c2fec20a09d4 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\addonStartup.json.lz4 - Access
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\addonStartup.json.lz4.CRAB MD5: 997e0c5919a140b4f0eb5e508599982d
SHA1: cd335e8709fafce94d4ca0ea8c38f143e831216f
SHA256: a3b25303725a557776505bc7bdf4dac6648aaa2f5953b0408c0d863c90506730 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\blocklist.xml - Access
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\blocklist.xml.CRAB MD5: ba0e41da95329ff57aaefcc74a31f456
SHA1: e06ba0fed87766b6d852c7f7c5e07fb3487653aa
SHA256: 6eab62f4faa29a72ee825ff3a90abd01eb517cf5b8199b91b887950fb3641b88 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\bookmarkbackups\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\cert8.db - Access
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\cert8.db.CRAB MD5: 5432bd6d70f14b348e12c2d033aedd82
SHA1: 9002dadc7a094f998502323988c4297dc5a6352a
SHA256: f608a8c5fe4696a06b0c686715335f635f638dcaf739e9c4b7a38d893fc3f9ff 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\compatibility.ini - Access
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\compatibility.ini.CRAB MD5: 3f5eeeadaa175edce8b4176a723f4c0f
SHA1: b51b0679e236deedf79e08fb96dce1d766015bb6
SHA256: 9f2c684f395521e0952c779a3998b318fe3b66f90f8d9f1cbf633e56f4fec5fb 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\containers.json - Access
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\containers.json.CRAB MD5: 22853b51033aa1ec2dd0b837ccd27a60
SHA1: 5c18d83ce47f0c7a3842b01cf8666a57c3512227
SHA256: c4f08e72905538a76554247745606b4058306f8188f92e3c9b919dd11bd88bd3 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\content-prefs.sqlite - Access
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\content-prefs.sqlite.CRAB MD5: ac806ad8fb43a1f10e2981bed435b975
SHA1: d5fe978b6fd408caa2375243065106218f2ebdba
SHA256: 415b664ede88fa87e46ec71bf838b64d0cfe4ef5514ca295e6e626263212ff8c 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\cookies.sqlite - Access
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\cookies.sqlite.CRAB MD5: 281be5676557903e201c95c72cb10604
SHA1: 2c874d4f190d8056de3865af3de20988cf51510c
SHA256: 3f0a20332a453fe8bf6fad564f1c962b1ebc24dad036a458106d89835c54f6d3 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\crashes\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\crashes\events\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\crashes\store.json.mozlz4 - Access
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\crashes\store.json.mozlz4.CRAB MD5: a979807d5f1964f8ab75a8652dc1d487
SHA1: 7874d497eb627262dcfe60397e923cee8f7711af
SHA256: a43db74c50101fe735fc17cb2fcc3ace860f65d7b86fc1b6a65a4cf253cb39db 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\datareporting\archived\2017-12\1513694905834.da7c9676-f8c5-46e7-a28d-350079b8e30e.main.jsonlz4 - Access
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\datareporting\archived\2017-12\1513694905834.da7c9676-f8c5-46e7-a28d-350079b8e30e.main.jsonlz4.CRAB MD5: 363a8d7c798c32c9ce05d8b7a336d052
SHA1: 1d16771d1f118211068eed75d911601fddd2cfe7
SHA256: 540e54cf52611062acf8331c4fdb273395952039865d9f2bb34e56da53e36d9c 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\datareporting\archived\2017-12\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\datareporting\archived\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\datareporting\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\datareporting\session-state.json - Access
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\datareporting\session-state.json.CRAB MD5: 1f482847d5ed00ec31500ae507479ddd
SHA1: dc2d3e79e32e95c68353caaddd11a88e8d8ec0b9
SHA256: 8e654c6c4a75906222cc2da0f5e8c9309ecefcb21929b25ea7fcf25e634fe969 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\datareporting\state.json - Access
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\datareporting\state.json.CRAB MD5: 647f46f052d2759349aa6012c4d3927c
SHA1: 52a726babbea764465d6e9e03bb4c8bda75dcaf1
SHA256: 7db0b72e8e79cc9f4327ee8b516c0a6ab7217c9e6245257601fcc8491f0d308c 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\extensions.json - Access
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\extensions.json.CRAB MD5: 3f6c034a731718be3f53f938e9ea8c5d
SHA1: 83179d2dd8879c1d9e2d9e3f7cd5cdb42d70f56a
SHA256: 5fa9d0440e2e28c531eed6b7fa39a0ab7043d12613a1dbdf1c483174c3ed3f30 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\favicons.sqlite - Access
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\favicons.sqlite.CRAB MD5: 2e16bbae3a6acb36fcc192e179a8d98c
SHA1: a2418491edc6fd7629f231290336b9cc2b765aaf
SHA256: 6b83b09e567b681ac5d05e02d1bc7dfb5860041fd6da10c9d0a2633cccea42c7 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\gmp-gmpopenh264\1.6\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\gmp-gmpopenh264\1.6\gmpopenh264.info - Access
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\gmp-gmpopenh264\1.6\gmpopenh264.info.CRAB MD5: da73002cd0ec6dd8c4ee9352ef310c70
SHA1: c76fabc43cde76a1622bddab8d2e9d10eca4ce89
SHA256: 58e81435cfe900bdaf3e0dc23bb5ab2649b6641512f67ff21a4466753ce72c30 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\gmp-gmpopenh264\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\gmp-widevinecdm\1.4.8.903\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\gmp-widevinecdm\1.4.8.903\LICENSE.txt - Access
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\gmp-widevinecdm\1.4.8.903\LICENSE.txt.CRAB MD5: eb26c99392f366a569dd3813669e778f
SHA1: e42b69471d7d6ec68048a9ad68295312c24a5d81
SHA256: 198b8e400351fb63af45af7b4945db793fe72357a5bfc7c3c70784370d5e417f 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\gmp-widevinecdm\1.4.8.903\manifest.json - Access
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\gmp-widevinecdm\1.4.8.903\manifest.json.CRAB MD5: c77fb9656f0fc12c883599593633e734
SHA1: 1605724433d87dea43857847fc6a540651f24217
SHA256: 907e05fcdd282d9e9ab9e9232687458dfd12338e547aa8ae67011427f96f8884 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\gmp-widevinecdm\1.4.8.903\widevinecdm.dll.lib - Access
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\gmp-widevinecdm\1.4.8.903\widevinecdm.dll.lib.CRAB MD5: fb5f69dfcdea709774760adb3e9d11f8
SHA1: dc364fb2235feb4b70a2eeeaea4abe5dcdba07cb
SHA256: 2ef192ee5b03e346bed5f5dfbd416eac31387dec2315628af71fce8f7da7ecc4 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\gmp-widevinecdm\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\gmp\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\gmp\WINNT_x86_64-msvc\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\handlers.json - Access
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\handlers.json.CRAB MD5: 7810251ac4472d6b12e47c6c31202f94
SHA1: 93b5058003636e5b0c9540e90b4bc09b4ab9955b
SHA256: 78d9abd95f55b63784b6ceb1e1a58f85dfb6e7e296937de4dd932b031cbd7000 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\key3.db - Access
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\key3.db.CRAB MD5: 98c6672181ba2e1d4f2b5c6057f98913
SHA1: 52f0fbc00c466dfd5d3b94d8d7e27436cd402e6d
SHA256: 792f8cc369528cea1f6b15510868d28dd484d4233107ade4462730eed191a5ef 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\minidumps\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\permissions.sqlite - Access
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\permissions.sqlite.CRAB MD5: 7bb3bc6d286134b212c2a91d18d2deb4
SHA1: 1f64c8a496cf9cd5825d6418f55c6b14f8445165
SHA256: 257cbdb94f7a12aedf7340d664dd1b0fd789b83a8b5e1db1497f4bed4e4c2c71 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\places.sqlite - Access
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\places.sqlite.CRAB MD5: 227549b3cb1c261fcd824a4bbba3991d
SHA1: 38a944a9e50eaf42c85d06c45f45c8975beca7fe
SHA256: 43877fc51617912eb36e098e1733722f5643198c9864371ef0c4ffdd93099047 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\pluginreg.dat - Access
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\pluginreg.dat.CRAB MD5: 020edd1b65ad62f17b15a6e423811099
SHA1: cc20b62c7a11270326eef90e5cb0e9179b9f5ea2
SHA256: 9a26cf7dcd8a97d56a6490984951d12c9f0c8dc3c04ac197d15bcec3828895cd 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\prefs.js - Access
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\prefs.js.CRAB MD5: b327c80c2a17fc05a6d6f2102eec1973
SHA1: 5ff1efe636c064cb8393f7552cd5f766a8b96095
SHA256: 5dc9488298a0db0482bb3bedb339cd7e1bebb00d6e4df355a267c331dfbc81b9 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\saved-telemetry-pings\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\search.json.mozlz4 - Access
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\search.json.mozlz4.CRAB MD5: e030a1aa65128ab80fff5dec1c89834a
SHA1: 4e24af5378b068033605e4818d4cf18e52de11e3
SHA256: 2a9010c440f01350f831b666a16faa529ffc639296cc6803647e86fb7c3ff9f3 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\secmod.db - Access
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\secmod.db.CRAB MD5: a8db3c29ffabbb18be7d72bb58c29036
SHA1: 8987d038b8751b1815601974dc1d25dc394bc45c
SHA256: 55036fc07bc541a505fc50d08af10b3da92ae3286e08bf650a6323099d4b4d8a 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\sessionCheckpoints.json - Access
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\sessionCheckpoints.json.CRAB MD5: c85fb821fc583934e0d09c973b410d86
SHA1: 1a083dcb5ff404ebde8552f034c498468ea25f9b
SHA256: 30f487f310afdae1fdbf5d609738f78a49a547d4b534604cc34e1d5e7985c74d 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\sessionstore-backups\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\sessionstore-backups\previous.js - Access
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\sessionstore-backups\previous.js.CRAB MD5: 4c276335d8e318b552ff92ed8c49a2ab
SHA1: 9223be242c05297bf762dc694f9549a956a2fbd5
SHA256: 55725bb26863f593086e3a2bd694ea01ab9e5621dddfad36e4306bf03732e2c4 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\sessionstore-backups\upgrade.js-20170824053622 - Access
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\sessionstore-backups\upgrade.js-20170824053622.CRAB MD5: 6461af11d76f5cd0d5b98eda7ba265f7
SHA1: 742d049c1b27f5322c8deddc81c445fe26c1b4ee
SHA256: 5acae0666be666ba2471d37c24dea6b74cf00ce12db28a3f078d844ac6196b66 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\sessionstore.js - Access
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\sessionstore.js.CRAB MD5: 86cf9b3c0b5ff3db5eb9e0db6197e387
SHA1: 7df1cd62e9c086c92c72d1f305e2873c42eaf471
SHA256: 05c20f2c66f43374ad84e077ac6b7536d3736f662e964b481dacb9af4e89ad09 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\SiteSecurityServiceState.txt - Access
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\SiteSecurityServiceState.txt.CRAB MD5: 015987fa1676c9d385cea6a8a4dad7e8
SHA1: b6aec28d0afd9395e721475f7317dba71bfacb4e
SHA256: 8045170f7096a46ea7f36388b8f73aef5d24450f2f18e3d3e01e8d1c6093b87e 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\storage.sqlite - Access
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\storage.sqlite.CRAB MD5: 383d951b81af70857da482f3e4cee452
SHA1: 49244f04381cb858afdb187a24d3e84025a8de1e
SHA256: 9628930cf9cbfb8f025d9c2e50ee999b185dc7d3df72b6e222e2b7593499e4d7 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\storage\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\storage\permanent\chrome\.metadata - Access
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\storage\permanent\chrome\.metadata-v2 - Access
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\storage\permanent\chrome\.metadata-v2.CRAB MD5: 17abd686cf500fd7d9fc7a976b3693d4
SHA1: 6ec29e473f69ae1f4131ed58bc5f9e1130d73713
SHA256: 428a78941ff694a5c8f8e07254cdd7aa5b371143d34a2c59342d9ec697ff41e4 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\storage\permanent\chrome\.metadata.CRAB MD5: 87c3d1ad0a33c48e35bb74341184d332
SHA1: 8e096ef5941cbe24f0bba437811a2f2684563076
SHA256: 5ac778418bc124be425f5146dea605eaafa19cf56d0ca131dd659d0544cb6bf4 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\storage\permanent\chrome\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\storage\permanent\chrome\idb\2918063365piupsah.files\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\storage\permanent\chrome\idb\2918063365piupsah.sqlite - Access
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\storage\permanent\chrome\idb\2918063365piupsah.sqlite.CRAB MD5: 6740f3b1417132a1c9ef0caade81cba3
SHA1: c69fd32cce377d8e663e3b079ff2cbbf9cf897f8
SHA256: 30bfa1b114a2e9de113b8e46a9d08fe542436207cb226ce1e8a88a85509413e0 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\storage\permanent\chrome\idb\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\storage\permanent\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\storage\permanent\moz-safe-about+home\.metadata - Access
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\storage\permanent\moz-safe-about+home\.metadata-v2 - Access
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\storage\permanent\moz-safe-about+home\.metadata-v2.CRAB MD5: 8f74971aea96385204fb73778dbc5161
SHA1: 07e9b0100c7dbac75ca8d84882a773c80e05e3b6
SHA256: 6cf28b5ba77db9e84162aacde1a6aacf7196cbf9482075e84542cc14a8160c4b 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\storage\permanent\moz-safe-about+home\.metadata.CRAB MD5: b034f7788d4ea1bc175c7cccffd78bbf
SHA1: c276328465e2fbe31d949b44e80e876c17f29553
SHA256: 26e0854db0151dbd9ba6750c75378331f5f115618cf415fd67eacffbdf8382d0 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\storage\permanent\moz-safe-about+home\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\storage\permanent\moz-safe-about+home\idb\818200132aebmoouht.files\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\storage\permanent\moz-safe-about+home\idb\818200132aebmoouht.sqlite - Access
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\storage\permanent\moz-safe-about+home\idb\818200132aebmoouht.sqlite.CRAB MD5: 4851322d07848094c12123b1e617a380
SHA1: 55363070e2fe8cffb3473e7aba75f50d2e314da6
SHA256: 4a2cae2a6dd771635a3152f7fa7bf52e20fa034cb956e72cfc23f6e0000df905 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\storage\permanent\moz-safe-about+home\idb\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\times.json - Access
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\times.json.CRAB MD5: b1c762c78ff03feae90a140444865ce8
SHA1: 7f9cbb75cd1758ae88a3317fb0f1a41545a0bc50
SHA256: 0ddbe6304f5cd77767a805cce80dbf2bdbfb6daf636e8f2aef76fefbeab7365c 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\webappsstore.sqlite - Access
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\webappsstore.sqlite.CRAB MD5: 48b6fbc429e4cfc24f34d2af0e13076d
SHA1: e5aedb77fb7ee9359937909a0d27291c2e34ae62
SHA256: a2cb38c5a7fdc7892620973fc0dbc8a3fa309d6cce3c79a180ec616bddf5b00d 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\xulstore.json - Access
C:\Users\FD1HVy\AppData\Roaming\Mozilla\Firefox\Profiles\w7cr0hor.default\xulstore.json.CRAB MD5: cd7dfa0ee0676bb0093c6f8b45abc8dd
SHA1: 41870542be98d4532e1d11cae97dc365b0bb6283
SHA256: 36970f26278487af4344d155c1a10c7a2b1f3b6002a76bfe6409a76f5841fc87 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\mTXC 3V.avi - Access
C:\Users\FD1HVy\AppData\Roaming\mTXC 3V.avi.CRAB MD5: 37863e1538760d0c5017e7df051e0024
SHA1: b63cc8bee39a0e71cd0b04433a86179e0032eefd
SHA256: 50008d8a73dcd9907fd52c88d4ae461cc95e20d96c6880933edd4b5e065f8b9c 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\nDxx_AcLmR8Id.jpg - Access
C:\Users\FD1HVy\AppData\Roaming\nDxx_AcLmR8Id.jpg.CRAB MD5: 90c339b9c39bae8aa84ff7037b5615ea
SHA1: 3eb15962aae30d65b9f6a4653db39962b9bc34ef
SHA256: 557993af3520c284a440e3eab25bcbe7beff866a7f83690c278c953f23eef084 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\nqG5jvy_8vyLOs.avi - Access
C:\Users\FD1HVy\AppData\Roaming\nqG5jvy_8vyLOs.avi.CRAB MD5: b08a0817705e7e06aeb2cfb0501acc4b
SHA1: 0abc640be68a66fce8ad050be7f45743b0ce49bd
SHA256: 9f38035a8917551672b147c4e654809a19db3b9481784d55b333e85c7cde84e3 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\P-6J-4erJllWGU.odt - Access
C:\Users\FD1HVy\AppData\Roaming\P-6J-4erJllWGU.odt.CRAB MD5: 6203da6f4b7964a02a225de84080253d
SHA1: 92fffe80dd417aae3a444b8a587d3f05a3c006df
SHA256: 11d23be91ec76696806d15ce94f43426765002da2d500cc149ac17126dc01b38 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\q-bzLPjgvN.wav - Access
C:\Users\FD1HVy\AppData\Roaming\q-bzLPjgvN.wav.CRAB MD5: 9d97617146228c68e8e3a57b17c698a9
SHA1: 6d23dd01f1750b6b8f0fafa796083c92070f91c1
SHA256: 488fc950a24444872faa723ee79b5f9445968f67df6b7d1a73765909a63238b4 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\Skype\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Skype\RootTools\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Skype\RootTools\roottools.conf - Access
C:\Users\FD1HVy\AppData\Roaming\Skype\RootTools\roottools.conf.CRAB MD5: b4242d7a84e108c80be7e967829149ae
SHA1: 5f3798c1ca8d19b7fa7fbc4dbecfbf1e1628b847
SHA256: e50235dc6249e9c8f4d4c0ba17e503f0d9f2f870bfde9a30963eaf156b74b357 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\Sun\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Sun\Java\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\Sun\Java\Deployment\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\AppData\Roaming\TH-SgXsaCxAtFhs.mp3 - Access
C:\Users\FD1HVy\AppData\Roaming\TH-SgXsaCxAtFhs.mp3.CRAB MD5: 01585fd730857068dfd3b8841d51a9e0
SHA1: 812a6364f79ecdc4d294f19649c69ff313a7083d
SHA256: 865e4efa7adffe2b1ad471dec2d3ead2542750a7ce7b31f49c1642e435c76420 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\tmXYFRsX11CKD.gif - Access
C:\Users\FD1HVy\AppData\Roaming\tmXYFRsX11CKD.gif.CRAB MD5: ca59e274b2f8cd4f2418b26b698e0fc4
SHA1: ca58ffb7ba8dabd06f35ebeaed072dc66497f206
SHA256: d02baf1663bab5b0f7f0ef9e5c6cda26f3fb27f85c7b5ef9bbc4bdff6ed33f08 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\v07Ls34TtI2e2.pptx - Access
C:\Users\FD1HVy\AppData\Roaming\v07Ls34TtI2e2.pptx.CRAB MD5: 7ed2106e005cdf9306f129a5d3a2600e
SHA1: 442a8cd6ab0755979309e59788c611013d28853c
SHA256: 74417a0d720395e4fa71a014bf668111ee71006832095055b457bf48cbedc5ac 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\XIyJzuCAZKp7FI8XtdfZ.wav - Access
C:\Users\FD1HVy\AppData\Roaming\XIyJzuCAZKp7FI8XtdfZ.wav.CRAB MD5: 5a5d556710b23275521c34150f4dd5b8
SHA1: 1c7da574e6a37e98da5d9d9254779eae2def96fc
SHA256: da4c06540ab8f3db834f0987a3c9bba82296ed859f951132a8d8ab6969cebac6 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\ZCj BRzcwQ34J_4sU.jpg - Access
C:\Users\FD1HVy\AppData\Roaming\ZCj BRzcwQ34J_4sU.jpg.CRAB MD5: aaf92a7440e97b7a63ae6a3789910a56
SHA1: 518c887f8a2bdcb09974d1de3f6f8b3d02f6808d
SHA256: 837bdaeaa14b658bcf237efca2d6060aac01fe545b88924da0f3301f764cbf5d 		Access, Read, Write
C:\Users\FD1HVy\AppData\Roaming\Zpb7MEqh0 CYJOL.m4a - Access
C:\Users\FD1HVy\AppData\Roaming\Zpb7MEqh0 CYJOL.m4a.CRAB MD5: e063c56502179e5ec0081c5658a2ecc1
SHA1: d36fd39c6e9fabe09f95e73eceae5f9abbc556d1
SHA256: a25d6a217198ae15fe9774079b4f695cab39b90747bf8ea80fbaff348d5ec721 		Access, Read, Write
C:\Users\FD1HVy\Application Data\\CRAB-DECRYPT.txt - Access
C:\Users\FD1HVy\Contacts\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\Cookies\\CRAB-DECRYPT.txt - Access, Write
C:\Users\FD1HVy\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\Desktop\3YtnfBFuH2syxVeLR.swf - Access
C:\Users\FD1HVy\Desktop\3YtnfBFuH2syxVeLR.swf.CRAB MD5: c8278c37ac0b254c4ec5f793c287b917
SHA1: b93396dc74dc3cc51a98b9a8023275ca7bc034cf
SHA256: ecbc33898a8d510771b2fec5e92386b008662fa66864b95f84518da6aa392a5c 		Access, Read, Write
C:\Users\FD1HVy\Desktop\58mWnEiPpJO.ods - Access
C:\Users\FD1HVy\Desktop\58mWnEiPpJO.ods.CRAB MD5: b80402ab80dcde08904cd9a592e9eb91
SHA1: f3fcb819af04ad751800686abfe843a56af5cc14
SHA256: baa7972573679ebbb5d5b862af4d9fe73d234b76b668d31433abb7bb75bf4149 		Access, Read, Write
C:\Users\FD1HVy\Desktop\5a0xsIsvo9B Pz5hE.flv - Access
C:\Users\FD1HVy\Desktop\5a0xsIsvo9B Pz5hE.flv.CRAB MD5: 2bac7e95040f699d8a1eda05a833da1d
SHA1: fc7147d95c05290f694a01dc0c9dab470614d0c5
SHA256: adf2360ed627cafc9b7863d6cd1e0f40342d8da94d90e495714b70f6faa5328e 		Access, Read, Write
C:\Users\FD1HVy\Desktop\6DFLkl3W-.swf - Access
C:\Users\FD1HVy\Desktop\6DFLkl3W-.swf.CRAB MD5: cb009eff5ed70f5608f3b92dc27a0f1b
SHA1: 12890a644339b95e74b7eeeb9ce058b4ade275fd
SHA256: 3a38f3c219cfa81aa2db26c5b009008908c7ffcbecf9a620c937812fdcd8eaac 		Access, Read, Write
C:\Users\FD1HVy\Desktop\C7oIN7zl yMfBY.mkv - Access
C:\Users\FD1HVy\Desktop\C7oIN7zl yMfBY.mkv.CRAB MD5: 2703efdf6ee84c947ed3774f96fb1a3e
SHA1: 164460869ec0b850f341d2489c473eec2bcf9276
SHA256: 379a6409045510a5f2f3e539adaa5b0038accdabe381fbf0515c4f48d3cfba8e 		Access, Read, Write
C:\Users\FD1HVy\Desktop\CgT8pG5C0n_2xIEfr_F.flv - Access
C:\Users\FD1HVy\Desktop\CgT8pG5C0n_2xIEfr_F.flv.CRAB MD5: 2b15737a007669bdbd5dde09b23a182b
SHA1: 547d13c868f2cd41e76468feee708d2ed5555d77
SHA256: eef9de46f2e85de24fb6e2b8ee92e86d90c791ebe3998f8119804037e9a32a00 		Access, Read, Write
C:\Users\FD1HVy\Desktop\CokgiJbfo.swf - Access
C:\Users\FD1HVy\Desktop\CokgiJbfo.swf.CRAB MD5: 196bb61a9e666fb3666d5620447cc471
SHA1: a98a007e8bac6b1e9359653751b2042fe9683263
SHA256: 0366888fd3737c4945f57febdd91e5afa0cbe265be50a6707cfbd4a78c4d3fa5 		Access, Read, Write
C:\Users\FD1HVy\Desktop\dCKKx1mIUZT.xlsx - Access
C:\Users\FD1HVy\Desktop\dCKKx1mIUZT.xlsx.CRAB MD5: 1a108e9da3a05707b00a190dbac8c439
SHA1: 84bcd508694c0bed027c0db50ad4c82800c33c8a
SHA256: 2f203ae4e7658127497ba4a61b0a57b7025bc6c77b5f93a99eea348741b6dc67 		Access, Read, Write
C:\Users\FD1HVy\Desktop\jIagDhQZbJ.gif - Access
C:\Users\FD1HVy\Desktop\jIagDhQZbJ.gif.CRAB MD5: 6354f6b7f7d78bf9a9f4ad388420971b
SHA1: 6e29fcae585436c890c854dab84b6233e29eee70
SHA256: b720a2f5cba296223c86c987d8bc60dc6cd964651cd44d9f54fa0b9b10a885ee 		Access, Read, Write
C:\Users\FD1HVy\Desktop\jXrYf3.gif - Access
C:\Users\FD1HVy\Desktop\jXrYf3.gif.CRAB MD5: 25148c146af4fe26ca07c4a93649a676
SHA1: 2348fd89b057fb088631ef0c0252323edaee82ba
SHA256: 040fd5641e507fac74558441b1a9b2ced6194f84b5a87a982b68fb11cbca3844 		Access, Read, Write
C:\Users\FD1HVy\Desktop\KtvotL7\6d4RVnD5zczUhoZiuu\0qL6S4uErTccQAF-Dv.m4a - Access
C:\Users\FD1HVy\Desktop\KtvotL7\6d4RVnD5zczUhoZiuu\0qL6S4uErTccQAF-Dv.m4a.CRAB MD5: 19378060e2671098edf0616c7143cc51
SHA1: 6fcb6bfe24e710150af37e5b94de082fcc7a468d
SHA256: 33537f33f5b5bd1fcee1f598834590675297d90794705e41ff8da9345c08117e 		Access, Read, Write
C:\Users\FD1HVy\Desktop\KtvotL7\6d4RVnD5zczUhoZiuu\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\Desktop\KtvotL7\6d4RVnD5zczUhoZiuu\hFrFPxb8MV.flv - Access
C:\Users\FD1HVy\Desktop\KtvotL7\6d4RVnD5zczUhoZiuu\hFrFPxb8MV.flv.CRAB MD5: b001cf7d367a9d460f6f573d89f59dbb
SHA1: 53f42fa889377890745acc3a4d472c2f98679830
SHA256: c25b6b83f8c9372aed9b1e0ea15c5aba8a2b6292d9b496ceaf5abfcb40670b4d 		Access, Read, Write
C:\Users\FD1HVy\Desktop\KtvotL7\6d4RVnD5zczUhoZiuu\nPxPXby_sXNq.m4a - Access
C:\Users\FD1HVy\Desktop\KtvotL7\6d4RVnD5zczUhoZiuu\nPxPXby_sXNq.m4a.CRAB MD5: a698a3dc436379741d6b1e0b68a0835e
SHA1: e3f63f120187dbff3ab6ab4d59c6edcf58c59be6
SHA256: fef637519ff7baf0802ead873401a05748a6f541fc903dc78d43fab6b804e2b4 		Access, Read, Write
C:\Users\FD1HVy\Desktop\KtvotL7\6d4RVnD5zczUhoZiuu\z TAdGvNC.gif - Access
C:\Users\FD1HVy\Desktop\KtvotL7\6d4RVnD5zczUhoZiuu\z TAdGvNC.gif.CRAB MD5: 45b58fb92c40fa7fef581fd6ae08d8c5
SHA1: f03f55b5bb9d372d0931f4374a85c92315cc1831
SHA256: 1000aaeca08620afa6fbe6d7b66807deba77b342e4999290b8eceaf036db8d52 		Access, Read, Write
C:\Users\FD1HVy\Desktop\KtvotL7\6d4RVnD5zczUhoZiuu\Z0c7R042i.gif - Access
C:\Users\FD1HVy\Desktop\KtvotL7\6d4RVnD5zczUhoZiuu\Z0c7R042i.gif.CRAB MD5: 8679353ac113940435a10f2d5e241e7d
SHA1: be7277a5cae39c3852986e78e7f16a7bb15df423
SHA256: 7d5615dda7452d2700cba747b588e26c4fff8a6e80671237a8009396bb012178 		Access, Read, Write
C:\Users\FD1HVy\Desktop\KtvotL7\75_MC9kMrPv.docx - Access
C:\Users\FD1HVy\Desktop\KtvotL7\75_MC9kMrPv.docx.CRAB MD5: 56327a2a2ae5c6350884a20d426c604d
SHA1: 8ecb1e6e6c781ee265c1440e564a0ae884f3be8e
SHA256: 23005a2758576733867c826a429643297fd02162301e53b6d8a2537b0f9519d4 		Access, Read, Write
C:\Users\FD1HVy\Desktop\KtvotL7\_hBA.mp3 - Access
C:\Users\FD1HVy\Desktop\KtvotL7\_hBA.mp3.CRAB MD5: 134b9c81c4b174de8eb6187fe625a549
SHA1: abf18aaa3a498cd9797ed2549c015e69ffbb3f3a
SHA256: 16b97ffc5d0378edcec0ae9a0003c00c2f7b95a93b7326689e3780a514957c84 		Access, Read, Write
C:\Users\FD1HVy\Desktop\KtvotL7\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\Desktop\KtvotL7\dhBExWsWg.mkv - Access
C:\Users\FD1HVy\Desktop\KtvotL7\dhBExWsWg.mkv.CRAB MD5: 70b21038e4449a7e94bc661cd84784c3
SHA1: 2bf6c660953b525ff3a9654063fb06da98651412
SHA256: bda7c3d2e45f36f5908e99a344e88588650dec5ba08ee172e53d78ae3a445e1a 		Access, Read, Write
C:\Users\FD1HVy\Desktop\KtvotL7\lehvzlvqqsCKy\9wMt0MFWi9yy6f_c4.xls - Access
C:\Users\FD1HVy\Desktop\KtvotL7\lehvzlvqqsCKy\9wMt0MFWi9yy6f_c4.xls.CRAB MD5: 6573a49ebfcfeab2ad727d5d3548c255
SHA1: 20e8753ffd6c715ed996febf4edf236878d9690e
SHA256: 11b6420e3ad16424f56199ad4f6cd8356fb2e68c9a2b9c6fcc8e0cd780d16e32 		Access, Read, Write
C:\Users\FD1HVy\Desktop\KtvotL7\lehvzlvqqsCKy\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\Desktop\KtvotL7\lehvzlvqqsCKy\d7b9sC4Na0cYWewrK-84.wav - Access
C:\Users\FD1HVy\Desktop\KtvotL7\lehvzlvqqsCKy\d7b9sC4Na0cYWewrK-84.wav.CRAB MD5: 5b5395a141fa74b38bb36af0fec09222
SHA1: 0dfc4db2de81f9d0f5396c1d4c6f22fbbd4cf8aa
SHA256: 772d87fb5fa5c74409b1761034b9e66db304b32713d4d1bb32f020656e17eacb 		Access, Read, Write
C:\Users\FD1HVy\Desktop\KtvotL7\lehvzlvqqsCKy\eKX86jnwCfyeb.wav - Access
C:\Users\FD1HVy\Desktop\KtvotL7\lehvzlvqqsCKy\eKX86jnwCfyeb.wav.CRAB MD5: c2d50136c699f47af3f8a323084f0fb9
SHA1: 14aa1900df3717e3f59c22510968cebbfe2fcd3c
SHA256: 6f9e2a4052d0d7081debaf07308836e96dafada570e2b155f4524016f3050fff 		Access, Read, Write
C:\Users\FD1HVy\Desktop\KtvotL7\lehvzlvqqsCKy\fyqw2Kf8C8q6X3cE.png - Access
C:\Users\FD1HVy\Desktop\KtvotL7\lehvzlvqqsCKy\fyqw2Kf8C8q6X3cE.png.CRAB MD5: 63bdd86c03a02c877f4aae58e61b7200
SHA1: 713e16f1c920384a8238fba885f505e52f465b16
SHA256: 839a9347e08bc44f3199a46052724294a1d42e10973e16a68358b0c1d75b1a14 		Access, Read, Write
C:\Users\FD1HVy\Desktop\KtvotL7\lehvzlvqqsCKy\hn0sCrkZ4N.avi - Access
C:\Users\FD1HVy\Desktop\KtvotL7\lehvzlvqqsCKy\hn0sCrkZ4N.avi.CRAB MD5: bb3525b19da38c55b29933fec5ec7f78
SHA1: dce12ead82c9e1bae9ee57358cc29069d7324f42
SHA256: c14ebf53d6168462826e2c26c53b8d527757da97205b752c02d1db86207f2b94 		Access, Read, Write
C:\Users\FD1HVy\Desktop\KtvotL7\lehvzlvqqsCKy\LHNKQwe8rphIR.ods - Access
C:\Users\FD1HVy\Desktop\KtvotL7\lehvzlvqqsCKy\LHNKQwe8rphIR.ods.CRAB MD5: e9410f73014028e62256e3728ebc5bd6
SHA1: 134164e0d27af53fd848bbb8e14c94e89bdab175
SHA256: c545b8fc44b8d7700a7ae3a942a009c1ef73e5c1b45ecde095a096a1c3b20dd5 		Access, Read, Write
C:\Users\FD1HVy\Desktop\KtvotL7\nQ8N8\1YAFu-V.m4a - Access
C:\Users\FD1HVy\Desktop\KtvotL7\nQ8N8\1YAFu-V.m4a.CRAB MD5: a285f2a94025bf35cd0906f3ade283ef
SHA1: b8e5b29b4446bc4cfa22ceb6f295ad4b7c0268bc
SHA256: 1febc00e1b4a57aa11e09b073cf23db3d6bd2db9b69abe49bfc78d40b8faf727 		Access, Read, Write
C:\Users\FD1HVy\Desktop\KtvotL7\nQ8N8\as1G1E6Jqs.flv - Access
C:\Users\FD1HVy\Desktop\KtvotL7\nQ8N8\as1G1E6Jqs.flv.CRAB MD5: 2741e0db14ea02486ff664bd5f35e4df
SHA1: 59e94d4a60a138f6c0f8183fe35c7b0fde277a28
SHA256: 2e9b0ea1146c05fd6822c61c157f7f4fc3a70eebce6e5943f2b52e330ae02dce 		Access, Read, Write
C:\Users\FD1HVy\Desktop\KtvotL7\nQ8N8\\CRAB-DECRYPT.txt MD5: e8f6b452de05919e2baeb615a5dfe297
SHA1: 24b50140df9160e7979da3c80f63b51e04a92c43
SHA256: 9e1527eaa0937124bfac8c113068620e7aa84346be89852e6af7050985fa5f9c 		Access, Write
C:\Users\FD1HVy\Desktop\KtvotL7\nQ8N8\jdDr_ w.csv - Access
C:\Users\FD1HVy\Desktop\KtvotL7\nQ8N8\jdDr_ w.csv.CRAB MD5: 5aaddfb2cb348c62b7b2fa0102b14da5
SHA1: 185bb7995670724b64de3afceebf809c8d7a997f
SHA256: fc96b3315ce37a1a0eeadb78cd92e4cb624fc47f7ef54e7ec75ba196fe1b1e59 		Access, Read, Write
C:\Users\FD1HVy\Desktop\KtvotL7\pEGtyK.jpg - Access
C:\Users\FD1HVy\Desktop\KtvotL7\pEGtyK.jpg.CRAB MD5: 62c384e67daac1d906632d0e8c57faaf
SHA1: 50139f719e6ef4180cc0b874de0b027759649fc5
SHA256: fb6c028defe697b0e9ea47e38a3c5e7959e7921c3f7dd6e8918ee1f5550976a6 		Access, Read, Write
C:\Users\FD1HVy\Desktop\KtvotL7\U9s6.swf - Access
C:\Users\FD1HVy\Desktop\KtvotL7\U9s6.swf.CRAB MD5: 1289b4180694beba62fc63c614c41ca8
SHA1: 6529ed79732aa8f9154771595fe14ab7609d6f8a
SHA256: a263511b8bc185985e8ea9639c0559f5cd3d2061bf04e62c3106adb56c7e6547 		Access, Read, Write
C:\Users\FD1HVy\Desktop\MZtNFJefBk1P2f.xlsx - Access
C:\Users\FD1HVy\Desktop\MZtNFJefBk1P2f.xlsx.CRAB MD5: 5107118c0173a59827ba0fafa40aa3f9
SHA1: e945082402c64fc50ac2d29b93d2190bf926c232
SHA256: d21bcae064fc876437dadf3b4c532961fbcc1f936972f2738fcb16b11baeff75 		Access, Read, Write
C:\Users\FD1HVy\Desktop\nat_UUQ7K.gif - Access
C:\Users\FD1HVy\Desktop\nat_UUQ7K.gif.CRAB MD5: 679a1b7cd25933b6e56c4a8e9f369cc3
SHA1: 0eba867bc6fd1fe52479488ffa616d639e99add1
SHA256: 05e2ac69a30d3b73f825ea9fccb351c82cbda549d1158edba7cd9b6e5a9f82d8 		Access, Read, Write
C:\Users\FD1HVy\Desktop\oSrvpE HbMBs23rh.png - Access
C:\Users\FD1HVy\Desktop\oSrvpE HbMBs23rh.png.CRAB MD5: 01bd55baf0e9118d4774fafdf68ee232
SHA1: cbfa83bc11127eec5af0b9f5f916bed2415b9a28
SHA256: f85548dc2462ca165d2fdd29867f51a62f040a53b009fcd2430f8f9801879063 		Access, Read, Write
C:\Users\FD1HVy\Desktop\PDRBVKUuD1Ueb7.ods - Access
C:\Users\FD1HVy\Desktop\PDRBVKUuD1Ueb7.ods.CRAB MD5: c8ae3b32396d8e5b9c5837a6e913dc06
SHA1: e57cf6b4e8d36577253c8d2d969be96713a86338
SHA256: 590ee1223dd10173d4af8e472ecc5506d08b7c4198dec47ea40ecae660c88bc8 		Access, Read, Write
C:\Users\FD1HVy\Desktop\PQwk.swf - Access
C:\Users\FD1HVy\Desktop\PQwk.swf.CRAB MD5: 5a9c4cc9d25ab9ead15900ac41ca8486
SHA1: 48294fee36725223b4b71fa9ca7d589d467f9cac
SHA256: a3d2341be6dd74b818a2ac909366112b6269da9ae417534d58463837a55e9b09 		Access, Read, Write
C:\Users\FD1HVy\Desktop\QgdzGCqfkC.flv - Access
C:\Users\FD1HVy\Desktop\QgdzGCqfkC.flv.CRAB MD5: 20a391d46ae4211098ae405078eb25a6
SHA1: 22843c17e289a84dc29d7e299fa05f2ce4beefa8
SHA256: b72cb4f0f5dbda926fc2f381216efab172a9ed32b5ad6162393ee95807f57992 		Access, Read, Write
C:\Users\FD1HVy\Desktop\qMoyhXrD.m4a - Access
C:\Users\FD1HVy\Desktop\qMoyhXrD.m4a.CRAB MD5: f339971caabf5eab360d9aac9275a3ac
SHA1: 79085e53e0cfb6af44cdcfbd329113d38b3a8c74
SHA256: 544f033f9e8deece636d13d87526854650c80d4dd8d6a7a2e86dec21ac6a1d48 		Access, Read, Write
C:\Users\FD1HVy\Desktop\RJM4k-y4s3a.flv - Access
C:\Users\FD1HVy\Desktop\RJM4k-y4s3a.flv.CRAB MD5: a271cc0063a89aff630c141abe55d41d
SHA1: 8e32ba7bc1981e9e054a792b55c105d1891e2d74
SHA256: e1cdcbd88a264c74b324e5affcdae53ca5872098c8619073662c780ab5404776 		Access, Read, Write
C:\Users\FD1HVy\Desktop\RzoorB.ppt - Access
C:\Users\FD1HVy\Desktop\RzoorB.ppt.CRAB MD5: 718462d88da8d5c6b5a580da7d2669e1
SHA1: eb1a069580e5f85f48f0a9ca8cb81859d7f63f83
SHA256: 755a70913112ba89afda8e31afe3effae97bef39f8a0b9e2255f37aecfa3f050 		Access, Read, Write
C:\Users\FD1HVy\Desktop\sample_file.doc MD5: 16ba8f5d604b4b9a366ae2d5b2107e68
SHA1: 878f05a0ddc78db92cd844b5d13be93e7b25f343
SHA256: 99eb1d90eb5f0d012f35fcc2a7dedd2229312794354843637ebb7f40b74d0809 		Access
C:\Users\FD1HVy\Desktop\sample_file.doc.CRAB MD5: cb33a0ea6b98a27a7daebb4f8ee6c9f8
SHA1: 79ea11a42554e8a3023729676dbbac33cfe2e8ed
SHA256: fbad8d83df69450a8f7635c81b7b338c8f26177c9985079c32688ccd52a78949 		Access, Read, Write
C:\Users\FD1HVy\Desktop\sMAcMsm4ECtN.mkv - Access
C:\Users\FD1HVy\Desktop\sMAcMsm4ECtN.mkv.CRAB MD5: 23bbca34d65f1f7fe7df87a4e5e3fa9e
SHA1: 5d4d9fe9bf8ec1c9463787d7f1c7d7e747c05649
SHA256: 8d78631074063f77ed248ffd397dba2e0c1a5d16a7fae0064b667d39ad8eeb14 		Access, Read, Write
C:\Users\FD1HVy\Desktop\SnZid9RwbE.mp3 - Access
C:\Users\FD1HVy\Desktop\SnZid9RwbE.mp3.CRAB MD5: 53c8cb1cab11d19e8f7dd568eaeb6808
SHA1: 6151bd91f116c7ebbcfad67f6ed3b73921ebe9b8
SHA256: aad0a78b2bbc64d0713f1085e1a6a23248052d78409d7d1e5bceb755e1993a27 		Access, Read, Write
C:\Users\FD1HVy\Desktop\ss9tA-.csv - Access
C:\Users\FD1HVy\Desktop\ss9tA-.csv.CRAB MD5: 1a08c464e54440ad3a31a3799a4bc8da
SHA1: 5dbc9e721a948ac5fb72812def1ed50dde0c96bc
SHA256: 29d970263a8bf02c735ca41aed3e0a9ba209cca72b78be571a8abf9b7232b552 		Access, Read, Write
C:\Users\FD1HVy\Desktop\USiAwCYMA9Lkr7o7PP.mp4 - Access
C:\Users\FD1HVy\Desktop\USiAwCYMA9Lkr7o7PP.mp4.CRAB MD5: a1d2f9854ac344b7a7c3730cd9e20ff0
SHA1: a665deacdff5a9dcb2400cfe53c7519e057605ad
SHA256: f4bd14e0d82f850b4591b8d99b77dbf4efde1e0f70be9705b664a7b0f7a2ec32 		Access, Read, Write
C:\Users\FD1HVy\Desktop\V72JJY7J e3zEt9r.gif - Access
C:\Users\FD1HVy\Desktop\V72JJY7J e3zEt9r.gif.CRAB MD5: def7df1e6a9da18d1c1c3e1398b129df
SHA1: d99f98781a586b3362a91196d3a9c86ed2120d25
SHA256: ab0ba97f482b50e75efbb91d389cdba541bc66c3a5a0fe83b1335aaa703dfdfe 		Access, Read, Write
C:\Users\FD1HVy\Desktop\VJJVWDcXp7MqmUGGF.m4a - Access
C:\Users\FD1HVy\Desktop\VJJVWDcXp7MqmUGGF.m4a.CRAB MD5: ddfe914632468dc29535587af1cc86cd
SHA1: cbedea15d75709992ac7cca0744f636dbd852395
SHA256: 26ed4314bd05336525a5483b1243d24d3f65e2e47a153032e0623b09ce436fe7 		Access, Read, Write
C:\Users\FD1HVy\Desktop\VVLx2.flv - Access
C:\Users\FD1HVy\Desktop\VVLx2.flv.CRAB MD5: e87129c9b402db819bdcf22c05b778f9
SHA1: 85f875dbfa51ac081d625f6f94fbcc620673b382
SHA256: 7e108f2ac9cd0b85ced992bc9f51ff69ea11a5216d5d56b897fa15f2f38f29d3 		Access, Read, Write
C:\Users\FD1HVy\Desktop\~$mple_file.doc - Access
C:\Users\FD1HVy\Desktop\~$mple_file.doc.CRAB - Access, Read, Write
C:\Users\FD1HVy\Documents - Access
C:\Users\FD1HVy\Documents\-0fJmL3bi.pptx - Access
C:\Users\FD1HVy\Documents\-0fJmL3bi.pptx.CRAB - Access, Read, Write
C:\Users\FD1HVy\Documents\06jV T28Xs4TvJMPi4z.xlsx - Access
C:\Users\FD1HVy\Documents\06jV T28Xs4TvJMPi4z.xlsx.CRAB - Access, Read, Write
C:\Users\FD1HVy\Documents\0C0XEtqYbFfOyhEsq3.docx - Access
C:\Users\FD1HVy\Documents\0C0XEtqYbFfOyhEsq3.docx.CRAB - Access, Read, Write
C:\Users\FD1HVy\Documents\1H_111VdHTZJJc3.xls - Access
C:\Users\FD1HVy\Documents\1H_111VdHTZJJc3.xls.CRAB - Access, Read, Write
C:\Users\FD1HVy\Documents\5D0qyNlmFgdRx9dZO.docx - Access
C:\Users\FD1HVy\Documents\5D0qyNlmFgdRx9dZO.docx.CRAB - Access, Read, Write
C:\Users\FD1HVy\Documents\6-j2WJobEBBb9GmGfa.pptx - Access
C:\Users\FD1HVy\Documents\6-j2WJobEBBb9GmGfa.pptx.CRAB - Access, Read, Write
C:\Users\FD1HVy\Documents\8j9c-cEZcmln.pptx - Access
C:\Users\FD1HVy\Documents\8j9c-cEZcmln.pptx.CRAB - Access, Read, Write
C:\Users\FD1HVy\Documents\_VTdzbn25.docx - Access
C:\Users\FD1HVy\Documents\_VTdzbn25.docx.CRAB - Access, Read
C:\Users\FD1HVy\Documents\AF0ngRXXmaR.ppt - Access
C:\Users\FD1HVy\Documents\AF0ngRXXmaR.ppt.CRAB - Access, Read, Write
C:\Users\FD1HVy\Documents\Ai1M7-pOZVjhtn4dLoMr.doc - Access
C:\Users\FD1HVy\Documents\Ai1M7-pOZVjhtn4dLoMr.doc.CRAB - Access, Read, Write
C:\Users\FD1HVy\Documents\Br59.rtf - Access
C:\Users\FD1HVy\Documents\Br59.rtf.CRAB - Access, Read, Write
C:\Users\FD1HVy\Documents\cf19s7.pptx - Access
C:\Users\FD1HVy\Documents\cf19s7.pptx.CRAB - Access, Read, Write
C:\Users\FD1HVy\Documents\\CRAB-DECRYPT.txt - Access, Write
C:\Users\FD1HVy\Documents\CyNfJ6443Hfo.xlsx - Access
C:\Users\FD1HVy\Documents\CyNfJ6443Hfo.xlsx.CRAB - Access, Read
C:\Users\FD1HVy\Documents\Database1.accdb - Access
C:\Users\FD1HVy\Documents\Database1.accdb.CRAB - Access, Read
C:\Users\FD1HVy\Documents\Database2.accdb - Access
C:\Users\FD1HVy\Documents\Database2.accdb.CRAB - Access, Read
C:\Users\FD1HVy\Documents\edbdc6QeQPsH6ASF.ppt - Access
C:\Users\FD1HVy\Documents\edbdc6QeQPsH6ASF.ppt.CRAB - Access, Read
C:\Users\FD1HVy\Documents\f4KrkJW2mNQb_4F.ppt - Access
C:\Users\FD1HVy\Documents\f4KrkJW2mNQb_4F.ppt.CRAB - Access, Read
C:\Users\FD1HVy\Documents\FbWu0 gkV 0.docx - Access
C:\Users\FD1HVy\Documents\FbWu0 gkV 0.docx.CRAB - Access, Read
C:\Users\FD1HVy\Documents\Gy2hEHoXoYHLzZf.xlsx - Access
C:\Users\FD1HVy\Documents\Gy2hEHoXoYHLzZf.xlsx.CRAB - Access, Read
C:\Users\FD1HVy\Documents\IcLI.pptx - Access
C:\Users\FD1HVy\Documents\IcLI.pptx.CRAB - Access, Read
C:\Users\FD1HVy\Documents\iRYQhHd6ZnI.pdf - Access
C:\Users\FD1HVy\Documents\iRYQhHd6ZnI.pdf.CRAB - Access, Read
C:\Users\FD1HVy\Documents\ixdm1 Ue4mi.pdf - Access
C:\Users\FD1HVy\Documents\ixdm1 Ue4mi.pdf.CRAB - Access, Read
C:\Users\FD1HVy\Documents\JfPKGiVOE9RS.xlsx - Access
C:\Users\FD1HVy\Documents\JfPKGiVOE9RS.xlsx.CRAB - Access, Read
C:\Users\FD1HVy\Documents\JN-S-AtXXa.ods - Access
C:\Users\FD1HVy\Documents\JN-S-AtXXa.ods.CRAB - Access, Read
C:\Users\FD1HVy\Documents\lDDus455bEC.pptx - Access
C:\Users\FD1HVy\Documents\lDDus455bEC.pptx.CRAB - Access, Read
C:\Users\FD1HVy\Documents\LpyxD7Sru0K1.csv - Access
C:\Users\FD1HVy\Documents\LpyxD7Sru0K1.csv.CRAB - Access, Read
C:\Users\FD1HVy\Documents\mNfJ.csv - Access
C:\Users\FD1HVy\Documents\mNfJ.csv.CRAB - Access, Read
C:\Users\FD1HVy\Documents\My Music\\CRAB-DECRYPT.txt - Access
C:\Users\FD1HVy\Documents\My Pictures\\CRAB-DECRYPT.txt - Access
C:\Users\FD1HVy\Documents\My Shapes\_private\\CRAB-DECRYPT.txt - Access
C:\Users\FD1HVy\Documents\My Shapes\\CRAB-DECRYPT.txt - Access
C:\Users\FD1HVy\Documents\My Videos\\CRAB-DECRYPT.txt - Access
C:\Users\FD1HVy\Documents\n3oxqqGeLT2.docx - Access
C:\Users\FD1HVy\Documents\n3oxqqGeLT2.docx.CRAB - Access, Read
C:\Users\FD1HVy\Documents\NfOMPr_PuTTmJS.ppt - Access
C:\Users\FD1HVy\Documents\NfOMPr_PuTTmJS.ppt.CRAB - Access, Read
C:\Users\FD1HVy\Documents\nsCarGwc WrmGcvn1C.odt - Access
C:\Users\FD1HVy\Documents\nsCarGwc WrmGcvn1C.odt.CRAB - Access, Read
C:\Users\FD1HVy\Documents\O-nlVfF.pptx - Access
C:\Users\FD1HVy\Documents\O-nlVfF.pptx.CRAB - Access, Read
C:\Users\FD1HVy\Documents\o3eEsXejz1XDZ7.xlsx - Access
C:\Users\FD1HVy\Documents\o3eEsXejz1XDZ7.xlsx.CRAB - Access, Read
C:\Users\FD1HVy\Documents\OitZoUEZJ317i.doc - Access
C:\Users\FD1HVy\Documents\OitZoUEZJ317i.doc.CRAB - Access, Read
C:\Users\FD1HVy\Documents\oKmD89Dfe8C_pPf6dT.xls - Access
C:\Users\FD1HVy\Documents\oKmD89Dfe8C_pPf6dT.xls.CRAB - Access, Read
C:\Users\FD1HVy\Documents\Outlook Files\\CRAB-DECRYPT.txt - Access
C:\Users\FD1HVy\Documents\Outlook Files\kkcie@kdj.kd.pst - Access
C:\Users\FD1HVy\Documents\Outlook Files\kkcie@kdj.kd.pst.CRAB - Access, Read
C:\Users\FD1HVy\Documents\ozq HhdBwesGYW.csv - Access
C:\Users\FD1HVy\Documents\ozq HhdBwesGYW.csv.CRAB - Access, Read
C:\Users\FD1HVy\Documents\PnZNN_8rP.doc - Access
C:\Users\FD1HVy\Documents\PnZNN_8rP.doc.CRAB - Access, Read
C:\Users\FD1HVy\Documents\QJ-Cwnm.odp - Access
C:\Users\FD1HVy\Documents\QJ-Cwnm.odp.CRAB - Access, Read
C:\Users\FD1HVy\Documents\qjBeiI 42MzZtOoYfc-z.xlsx - Access
C:\Users\FD1HVy\Documents\qjBeiI 42MzZtOoYfc-z.xlsx.CRAB - Access, Read
C:\Users\FD1HVy\Documents\RHiKd8RHK7rrt4ctEhH.xlsx - Access
C:\Users\FD1HVy\Documents\RHiKd8RHK7rrt4ctEhH.xlsx.CRAB - Access, Read
C:\Users\FD1HVy\Documents\rjydiFRRf8tHAs2.odt - Access
C:\Users\FD1HVy\Documents\rjydiFRRf8tHAs2.odt.CRAB - Access, Read
C:\Users\FD1HVy\Documents\SwkI.docx - Access
C:\Users\FD1HVy\Documents\SwkI.docx.CRAB - Access, Read
C:\Users\FD1HVy\Documents\T1hyWjL3VFrTv0vOPr.rtf - Access
C:\Users\FD1HVy\Documents\T1hyWjL3VFrTv0vOPr.rtf.CRAB - Access, Read
C:\Users\FD1HVy\Documents\TM2P8tFsH0lBrKBSnx.xlsx - Access
C:\Users\FD1HVy\Documents\TM2P8tFsH0lBrKBSnx.xlsx.CRAB - Access, Read
C:\Users\FD1HVy\Documents\UTShq02xps5QRee.ots - Access
C:\Users\FD1HVy\Documents\UTShq02xps5QRee.ots.CRAB - Access, Read
C:\Users\FD1HVy\Documents\VdeHwGMyNPfIDVNvpfY.rtf - Access
C:\Users\FD1HVy\Documents\VdeHwGMyNPfIDVNvpfY.rtf.CRAB - Access, Read
C:\Users\FD1HVy\Documents\vDjzW4lIYP9.pptx - Access
C:\Users\FD1HVy\Documents\vDjzW4lIYP9.pptx.CRAB - Access, Read
C:\Users\FD1HVy\Documents\vdW-b6mHnh31jiB.odt - Access
C:\Users\FD1HVy\Documents\vdW-b6mHnh31jiB.odt.CRAB - Access, Read
C:\Users\FD1HVy\Documents\WindowsPowerShell\Microsoft.PowerShell_profile.ps1 - Access
C:\Users\FD1HVy\Documents\WindowsPowerShell\Modules - Access
C:\Users\FD1HVy\Documents\WindowsPowerShell\profile.ps1 - Access
C:\Users\FD1HVy\Documents\XrPH.docx - Access
C:\Users\FD1HVy\Documents\XrPH.docx.CRAB - Access, Read
C:\Users\FD1HVy\Documents\YHy B3coZWLQC.xls - Access
C:\Users\FD1HVy\Documents\YHy B3coZWLQC.xls.CRAB - Access, Read
C:\Users\FD1HVy\Documents\zbfP5nB_GJFxpU2x2K3.pps - Access
C:\Users\FD1HVy\Documents\zbfP5nB_GJFxpU2x2K3.pps.CRAB - Access, Read
C:\Users\FD1HVy\Documents\zfS_qYUqV v-scd.csv - Access
C:\Users\FD1HVy\Documents\zfS_qYUqV v-scd.csv.CRAB - Access, Read
C:\Users\FD1HVy\Documents\ZyiDYB4GuSyGpvVwOoYs.ots - Access
C:\Users\FD1HVy\Documents\ZyiDYB4GuSyGpvVwOoYs.ots.CRAB - Access, Read
C:\Users\FD1HVy\Downloads\\CRAB-DECRYPT.txt - Access
C:\Users\FD1HVy\Favorites\Bing.url - Access
C:\Users\FD1HVy\Favorites\Bing.url.CRAB - Access, Read
C:\Users\FD1HVy\Favorites\\CRAB-DECRYPT.txt - Access
C:\Users\FD1HVy\Favorites\Links\\CRAB-DECRYPT.txt - Access
C:\Users\FD1HVy\Links\\CRAB-DECRYPT.txt - Access
C:\Users\FD1HVy\Music\8XKr9UondK7HfQ_.wav - Access
C:\Users\FD1HVy\Music\8XKr9UondK7HfQ_.wav.CRAB - Access, Read
C:\Users\FD1HVy\Music\cncm99iBl_pZ y19GI1.mp3 - Access
C:\Users\FD1HVy\Music\cncm99iBl_pZ y19GI1.mp3.CRAB - Access, Read
C:\Users\FD1HVy\Music\\CRAB-DECRYPT.txt - Access
C:\Users\FD1HVy\Music\e0xXYk0RvA.wav - Access
C:\Users\FD1HVy\Music\e0xXYk0RvA.wav.CRAB - Access, Read
C:\Users\FD1HVy\Music\IgBW.m4a - Access
C:\Users\FD1HVy\Music\IgBW.m4a.CRAB - Access, Read
C:\Users\FD1HVy\Music\vFZyOE7kpL4WdPzfE nh.wav - Access
C:\Users\FD1HVy\Music\vFZyOE7kpL4WdPzfE nh.wav.CRAB - Access, Read
C:\Users\FD1HVy\Music\WOvQSzstN 6DMRwpD9V\5azA5dB.mp3 - Access
C:\Users\FD1HVy\Music\WOvQSzstN 6DMRwpD9V\5azA5dB.mp3.CRAB - Access, Read
C:\Users\FD1HVy\Music\WOvQSzstN 6DMRwpD9V\7SyMDxz.m4a - Access
C:\Users\FD1HVy\Music\WOvQSzstN 6DMRwpD9V\7SyMDxz.m4a.CRAB - Access, Read
C:\Users\FD1HVy\Music\WOvQSzstN 6DMRwpD9V\BYRGcfMS2xhsA2P8LOqd.mp3 - Access
C:\Users\FD1HVy\Music\WOvQSzstN 6DMRwpD9V\BYRGcfMS2xhsA2P8LOqd.mp3.CRAB - Access, Read
C:\Users\FD1HVy\Music\WOvQSzstN 6DMRwpD9V\\CRAB-DECRYPT.txt - Access
C:\Users\FD1HVy\Music\WOvQSzstN 6DMRwpD9V\Fi xD_oU8B0.m4a - Access
C:\Users\FD1HVy\Music\WOvQSzstN 6DMRwpD9V\Fi xD_oU8B0.m4a.CRAB - Access, Read
C:\Users\FD1HVy\Music\WOvQSzstN 6DMRwpD9V\g2iNgl1Ejue.mp3 - Access
C:\Users\FD1HVy\Music\WOvQSzstN 6DMRwpD9V\g2iNgl1Ejue.mp3.CRAB - Access, Read
C:\Users\FD1HVy\Music\WOvQSzstN 6DMRwpD9V\iSy-5H_mW7fO_0bny.wav - Access
C:\Users\FD1HVy\Music\WOvQSzstN 6DMRwpD9V\iSy-5H_mW7fO_0bny.wav.CRAB - Access, Read
C:\Users\FD1HVy\Music\WOvQSzstN 6DMRwpD9V\lW7aSkPzsKRu.m4a - Access
C:\Users\FD1HVy\Music\WOvQSzstN 6DMRwpD9V\lW7aSkPzsKRu.m4a.CRAB - Access, Read
C:\Users\FD1HVy\Music\WOvQSzstN 6DMRwpD9V\m_Q5.wav - Access
C:\Users\FD1HVy\Music\WOvQSzstN 6DMRwpD9V\m_Q5.wav.CRAB - Access, Read
C:\Users\FD1HVy\Music\WOvQSzstN 6DMRwpD9V\TBYYu.wav - Access
C:\Users\FD1HVy\Music\WOvQSzstN 6DMRwpD9V\TBYYu.wav.CRAB - Access, Read
C:\Users\FD1HVy\Music\WOvQSzstN 6DMRwpD9V\Usg8kes6SkGgH.m4a - Access
C:\Users\FD1HVy\Music\WOvQSzstN 6DMRwpD9V\Usg8kes6SkGgH.m4a.CRAB - Access, Read
C:\Users\FD1HVy\Music\wz5Q5Oeqnj83 GZF5.m4a - Access
C:\Users\FD1HVy\Music\wz5Q5Oeqnj83 GZF5.m4a.CRAB - Access, Read
C:\Users\FD1HVy\Music\XIH1zhazZ.mp3 - Access
C:\Users\FD1HVy\Music\XIH1zhazZ.mp3.CRAB - Access, Read
C:\Users\FD1HVy\Music\xZRV-VRm4dbZ8k4\_HePOGhMBfYD058.mp3 - Access
C:\Users\FD1HVy\Music\xZRV-VRm4dbZ8k4\_HePOGhMBfYD058.mp3.CRAB - Access, Read
C:\Users\FD1HVy\Music\xZRV-VRm4dbZ8k4\\CRAB-DECRYPT.txt - Access
C:\Users\FD1HVy\Music\xZRV-VRm4dbZ8k4\D8FguvX.mp3 - Access
C:\Users\FD1HVy\Music\xZRV-VRm4dbZ8k4\D8FguvX.mp3.CRAB - Access, Read
C:\Users\FD1HVy\Music\xZRV-VRm4dbZ8k4\DBO-RSHudyAtj-RlTubj.wav - Access
C:\Users\FD1HVy\Music\xZRV-VRm4dbZ8k4\DBO-RSHudyAtj-RlTubj.wav.CRAB - Access, Read
C:\Users\FD1HVy\Music\xZRV-VRm4dbZ8k4\DGI4vf8.mp3 - Access
C:\Users\FD1HVy\Music\xZRV-VRm4dbZ8k4\DGI4vf8.mp3.CRAB - Access, Read
C:\Users\FD1HVy\Music\xZRV-VRm4dbZ8k4\eDzslKd2O1.mp3 - Access
C:\Users\FD1HVy\Music\xZRV-VRm4dbZ8k4\eDzslKd2O1.mp3.CRAB - Access, Read
C:\Users\FD1HVy\Music\xZRV-VRm4dbZ8k4\nVD1jMJXBF7YRS2_gzhO.wav - Access
C:\Users\FD1HVy\Music\xZRV-VRm4dbZ8k4\nVD1jMJXBF7YRS2_gzhO.wav.CRAB - Access, Read
C:\Users\FD1HVy\Music\xZRV-VRm4dbZ8k4\ocvq5cWJ-AdJX.mp3 - Access
C:\Users\FD1HVy\Music\xZRV-VRm4dbZ8k4\ocvq5cWJ-AdJX.mp3.CRAB - Access, Read
C:\Users\FD1HVy\Music\xZRV-VRm4dbZ8k4\RpZ3Xc9VkCAf_ UnOV.wav - Access
C:\Users\FD1HVy\Music\xZRV-VRm4dbZ8k4\RpZ3Xc9VkCAf_ UnOV.wav.CRAB - Access, Read
C:\Users\FD1HVy\Music\xZRV-VRm4dbZ8k4\u4Lass9yFIos I5RQWd.m4a - Access
C:\Users\FD1HVy\Music\xZRV-VRm4dbZ8k4\u4Lass9yFIos I5RQWd.m4a.CRAB - Access, Read
C:\Users\FD1HVy\Music\Yv7Ftl3F09hnBjx4vDR.wav - Access
C:\Users\FD1HVy\Music\Yv7Ftl3F09hnBjx4vDR.wav.CRAB - Access, Read
C:\Users\FD1HVy\Music\z5GYkMs5t.m4a - Access
C:\Users\FD1HVy\Music\z5GYkMs5t.m4a.CRAB - Access, Read
C:\Users\FD1HVy\My Documents\\CRAB-DECRYPT.txt - Access
C:\Users\FD1HVy\NetHood\\CRAB-DECRYPT.txt - Access
C:\Users\FD1HVy\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf - Access
C:\Users\FD1HVy\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf.CRAB - Access
C:\Users\FD1HVy\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms - Access
C:\Users\FD1HVy\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms.CRAB - Access
C:\Users\FD1HVy\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms - Access
C:\Users\FD1HVy\NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms.CRAB - Access
C:\Users\FD1HVy\ntuser.ini - Access
C:\Users\FD1HVy\ntuser.ini.CRAB - Access, Read
C:\Users\FD1HVy\OneDrive\\CRAB-DECRYPT.txt - Access
C:\Users\FD1HVy\Pictures\Camera Roll\\CRAB-DECRYPT.txt - Access
C:\Users\FD1HVy\Pictures\\CRAB-DECRYPT.txt - Access
C:\Users\FD1HVy\Pictures\hVFIY.png - Access
C:\Users\FD1HVy\Pictures\hVFIY.png.CRAB - Access, Read
C:\Users\FD1HVy\Pictures\jJ8mB\_EwYk2q tK h2VhRe.jpg - Access
C:\Users\FD1HVy\Pictures\jJ8mB\_EwYk2q tK h2VhRe.jpg.CRAB - Access, Read
C:\Users\FD1HVy\Pictures\jJ8mB\\CRAB-DECRYPT.txt - Access
C:\Users\FD1HVy\Pictures\jJ8mB\FlnwG8qn7iA8VvmIzna\5ujP.jpg - Access
C:\Users\FD1HVy\Pictures\jJ8mB\FlnwG8qn7iA8VvmIzna\5ujP.jpg.CRAB - Access, Read
C:\Users\FD1HVy\Pictures\jJ8mB\FlnwG8qn7iA8VvmIzna\7lIrX6a\BiIHzG8JKENJcxppZ5Dc.jpg - Access
C:\Users\FD1HVy\Pictures\jJ8mB\FlnwG8qn7iA8VvmIzna\7lIrX6a\BiIHzG8JKENJcxppZ5Dc.jpg.CRAB - Access, Read
C:\Users\FD1HVy\Pictures\jJ8mB\FlnwG8qn7iA8VvmIzna\7lIrX6a\bWKk.png - Access
C:\Users\FD1HVy\Pictures\jJ8mB\FlnwG8qn7iA8VvmIzna\7lIrX6a\bWKk.png.CRAB - Access, Read
C:\Users\FD1HVy\Pictures\jJ8mB\FlnwG8qn7iA8VvmIzna\7lIrX6a\\CRAB-DECRYPT.txt - Access
C:\Users\FD1HVy\Pictures\jJ8mB\FlnwG8qn7iA8VvmIzna\7lIrX6a\s_ qaN6Q_6AP8S.jpg - Access
C:\Users\FD1HVy\Pictures\jJ8mB\FlnwG8qn7iA8VvmIzna\7lIrX6a\s_ qaN6Q_6AP8S.jpg.CRAB - Access, Read
C:\Users\FD1HVy\Pictures\jJ8mB\FlnwG8qn7iA8VvmIzna\comuSmTYxB\5dr6uGRL9LK.gif - Access
C:\Users\FD1HVy\Pictures\jJ8mB\FlnwG8qn7iA8VvmIzna\comuSmTYxB\5dr6uGRL9LK.gif.CRAB - Access, Read
C:\Users\FD1HVy\Pictures\jJ8mB\FlnwG8qn7iA8VvmIzna\comuSmTYxB\\CRAB-DECRYPT.txt - Access
C:\Users\FD1HVy\Pictures\jJ8mB\FlnwG8qn7iA8VvmIzna\comuSmTYxB\Dw_y8M1l.jpg - Access
C:\Users\FD1HVy\Pictures\jJ8mB\FlnwG8qn7iA8VvmIzna\comuSmTYxB\Dw_y8M1l.jpg.CRAB - Access, Read
C:\Users\FD1HVy\Pictures\jJ8mB\FlnwG8qn7iA8VvmIzna\comuSmTYxB\ts9a1ZFmkfPLzfmEAP.jpg - Access
C:\Users\FD1HVy\Pictures\jJ8mB\FlnwG8qn7iA8VvmIzna\comuSmTYxB\ts9a1ZFmkfPLzfmEAP.jpg.CRAB - Access, Read
C:\Users\FD1HVy\Pictures\jJ8mB\FlnwG8qn7iA8VvmIzna\comuSmTYxB\vInbQ8Syjp2d7\-S1f9wAJn.jpg - Access
C:\Users\FD1HVy\Pictures\jJ8mB\FlnwG8qn7iA8VvmIzna\comuSmTYxB\vInbQ8Syjp2d7\-S1f9wAJn.jpg.CRAB - Access, Read
C:\Users\FD1HVy\Pictures\jJ8mB\FlnwG8qn7iA8VvmIzna\comuSmTYxB\vInbQ8Syjp2d7\2aw4w81o3DFWfT-WwQ.bmp - Access
C:\Users\FD1HVy\Pictures\jJ8mB\FlnwG8qn7iA8VvmIzna\comuSmTYxB\vInbQ8Syjp2d7\2aw4w81o3DFWfT-WwQ.bmp.CRAB - Access, Read
C:\Users\FD1HVy\Pictures\jJ8mB\FlnwG8qn7iA8VvmIzna\comuSmTYxB\vInbQ8Syjp2d7\\CRAB-DECRYPT.txt - Access
C:\Users\FD1HVy\Pictures\jJ8mB\FlnwG8qn7iA8VvmIzna\comuSmTYxB\vInbQ8Syjp2d7\cyPILVniYbns9jSEv2A1.jpg - Access
C:\Users\FD1HVy\Pictures\jJ8mB\FlnwG8qn7iA8VvmIzna\comuSmTYxB\vInbQ8Syjp2d7\cyPILVniYbns9jSEv2A1.jpg.CRAB - Access, Read
C:\Users\FD1HVy\Pictures\jJ8mB\FlnwG8qn7iA8VvmIzna\comuSmTYxB\vInbQ8Syjp2d7\KnQu_Ib-e1e.png - Access
C:\Users\FD1HVy\Pictures\jJ8mB\FlnwG8qn7iA8VvmIzna\comuSmTYxB\vInbQ8Syjp2d7\KnQu_Ib-e1e.png.CRAB - Access, Read
C:\Users\FD1HVy\Pictures\jJ8mB\FlnwG8qn7iA8VvmIzna\comuSmTYxB\vInbQ8Syjp2d7\kThd5OHZJ\\CRAB-DECRYPT.txt - Access
C:\Users\FD1HVy\Pictures\jJ8mB\FlnwG8qn7iA8VvmIzna\comuSmTYxB\vInbQ8Syjp2d7\O_Yc nVeBil2M4fIBX\\CRAB-DECRYPT.txt - Access
C:\Users\FD1HVy\Pictures\jJ8mB\FlnwG8qn7iA8VvmIzna\comuSmTYxB\vInbQ8Syjp2d7\O_Yc nVeBil2M4fIBX\G5MDS6EDWyI.jpg - Access
C:\Users\FD1HVy\Pictures\jJ8mB\FlnwG8qn7iA8VvmIzna\comuSmTYxB\vInbQ8Syjp2d7\O_Yc nVeBil2M4fIBX\G5MDS6EDWyI.jpg.CRAB - Access, Read
C:\Users\FD1HVy\Pictures\jJ8mB\FlnwG8qn7iA8VvmIzna\comuSmTYxB\vInbQ8Syjp2d7\O_Yc nVeBil2M4fIBX\k8Lcagnl6W9E7tF.gif - Access
C:\Users\FD1HVy\Pictures\jJ8mB\FlnwG8qn7iA8VvmIzna\comuSmTYxB\vInbQ8Syjp2d7\O_Yc nVeBil2M4fIBX\k8Lcagnl6W9E7tF.gif.CRAB - Access, Read
C:\Users\FD1HVy\Pictures\jJ8mB\FlnwG8qn7iA8VvmIzna\comuSmTYxB\vInbQ8Syjp2d7\O_Yc nVeBil2M4fIBX\V1sg_IGvpNq8.gif - Access
C:\Users\FD1HVy\Pictures\jJ8mB\FlnwG8qn7iA8VvmIzna\comuSmTYxB\vInbQ8Syjp2d7\O_Yc nVeBil2M4fIBX\V1sg_IGvpNq8.gif.CRAB - Access, Read
C:\Users\FD1HVy\Pictures\jJ8mB\FlnwG8qn7iA8VvmIzna\comuSmTYxB\vInbQ8Syjp2d7\PmFXKCUPXBcdHjs0.bmp - Access
C:\Users\FD1HVy\Pictures\jJ8mB\FlnwG8qn7iA8VvmIzna\comuSmTYxB\vInbQ8Syjp2d7\PmFXKCUPXBcdHjs0.bmp.CRAB - Access, Read
C:\Users\FD1HVy\Pictures\jJ8mB\FlnwG8qn7iA8VvmIzna\comuSmTYxB\vInbQ8Syjp2d7\V0JbnnP81i\5IsTuOq_762rS3uGw.png - Access
C:\Users\FD1HVy\Pictures\jJ8mB\FlnwG8qn7iA8VvmIzna\comuSmTYxB\vInbQ8Syjp2d7\V0JbnnP81i\5IsTuOq_762rS3uGw.png.CRAB - Access, Read
C:\Users\FD1HVy\Pictures\jJ8mB\FlnwG8qn7iA8VvmIzna\comuSmTYxB\vInbQ8Syjp2d7\V0JbnnP81i\\CRAB-DECRYPT.txt - Access
C:\Users\FD1HVy\Pictures\jJ8mB\FlnwG8qn7iA8VvmIzna\comuSmTYxB\vInbQ8Syjp2d7\V0JbnnP81i\txMx_XwF_3.jpg - Access
C:\Users\FD1HVy\Pictures\jJ8mB\FlnwG8qn7iA8VvmIzna\comuSmTYxB\vInbQ8Syjp2d7\V0JbnnP81i\txMx_XwF_3.jpg.CRAB - Access, Read
C:\Users\FD1HVy\Pictures\jJ8mB\FlnwG8qn7iA8VvmIzna\comuSmTYxB\vInbQ8Syjp2d7\V0JbnnP81i\WdgO1y0b9sTOIQU74ZC.gif - Access
C:\Users\FD1HVy\Pictures\jJ8mB\FlnwG8qn7iA8VvmIzna\comuSmTYxB\vInbQ8Syjp2d7\V0JbnnP81i\WdgO1y0b9sTOIQU74ZC.gif.CRAB - Access, Read
C:\Users\FD1HVy\Pictures\jJ8mB\FlnwG8qn7iA8VvmIzna\\CRAB-DECRYPT.txt - Access
C:\Users\FD1HVy\Pictures\jJ8mB\FlnwG8qn7iA8VvmIzna\efiQWECJx.bmp - Access
C:\Users\FD1HVy\Pictures\jJ8mB\FlnwG8qn7iA8VvmIzna\efiQWECJx.bmp.CRAB - Access, Read
C:\Users\FD1HVy\Pictures\jJ8mB\FlnwG8qn7iA8VvmIzna\TJaIFSScpPFx\bJQy5P.jpg - Access
C:\Users\FD1HVy\Pictures\jJ8mB\FlnwG8qn7iA8VvmIzna\TJaIFSScpPFx\bJQy5P.jpg.CRAB - Access, Read
C:\Users\FD1HVy\Pictures\jJ8mB\FlnwG8qn7iA8VvmIzna\TJaIFSScpPFx\\CRAB-DECRYPT.txt - Access
C:\Users\FD1HVy\Pictures\jJ8mB\FlnwG8qn7iA8VvmIzna\TJaIFSScpPFx\hDikpPVPk.jpg - Access
C:\Users\FD1HVy\Pictures\jJ8mB\FlnwG8qn7iA8VvmIzna\TJaIFSScpPFx\hDikpPVPk.jpg.CRAB - Access, Read
C:\Users\FD1HVy\Pictures\jJ8mB\FlnwG8qn7iA8VvmIzna\TJaIFSScpPFx\ikEQfJ5_ZHdFc.gif - Access
C:\Users\FD1HVy\Pictures\jJ8mB\FlnwG8qn7iA8VvmIzna\TJaIFSScpPFx\ikEQfJ5_ZHdFc.gif.CRAB - Access, Read
C:\Users\FD1HVy\Pictures\jJ8mB\FlnwG8qn7iA8VvmIzna\TJaIFSScpPFx\nk3nbPIYfLs4x07wJ.gif - Access
C:\Users\FD1HVy\Pictures\jJ8mB\FlnwG8qn7iA8VvmIzna\TJaIFSScpPFx\nk3nbPIYfLs4x07wJ.gif.CRAB - Access, Read
C:\Users\FD1HVy\Pictures\jJ8mB\FlnwG8qn7iA8VvmIzna\TJaIFSScpPFx\vmshNxHSOQoT.bmp - Access
C:\Users\FD1HVy\Pictures\jJ8mB\FlnwG8qn7iA8VvmIzna\TJaIFSScpPFx\vmshNxHSOQoT.bmp.CRAB - Access, Read
C:\Users\FD1HVy\Pictures\jJ8mB\FlnwG8qn7iA8VvmIzna\TJaIFSScpPFx\y0NsqWYVq3.jpg - Access
C:\Users\FD1HVy\Pictures\jJ8mB\FlnwG8qn7iA8VvmIzna\TJaIFSScpPFx\y0NsqWYVq3.jpg.CRAB - Access, Read
C:\Users\FD1HVy\Pictures\jJ8mB\FlnwG8qn7iA8VvmIzna\ZPGtvNw.bmp - Access
C:\Users\FD1HVy\Pictures\jJ8mB\FlnwG8qn7iA8VvmIzna\ZPGtvNw.bmp.CRAB - Access, Read
C:\Users\FD1HVy\Pictures\jJ8mB\iJZbAuk4TzPFE0-IX0yX.png - Access
C:\Users\FD1HVy\Pictures\jJ8mB\iJZbAuk4TzPFE0-IX0yX.png.CRAB - Access, Read
C:\Users\FD1HVy\Pictures\jJ8mB\n5UPsqzg.png - Access
C:\Users\FD1HVy\Pictures\jJ8mB\n5UPsqzg.png.CRAB - Access, Read
C:\Users\FD1HVy\Pictures\jJ8mB\P4pG8yX7JX.jpg - Access
C:\Users\FD1HVy\Pictures\jJ8mB\P4pG8yX7JX.jpg.CRAB - Access, Read
C:\Users\FD1HVy\Pictures\Saved Pictures\\CRAB-DECRYPT.txt - Access
C:\Users\FD1HVy\PrintHood\\CRAB-DECRYPT.txt - Access
C:\Users\FD1HVy\Recent\\CRAB-DECRYPT.txt - Access
C:\Users\FD1HVy\Saved Games\\CRAB-DECRYPT.txt - Access
C:\Users\FD1HVy\Searches\\CRAB-DECRYPT.txt - Access
C:\Users\FD1HVy\Searches\Everywhere.search-ms - Access
C:\Users\FD1HVy\Searches\Everywhere.search-ms.CRAB - Access, Read
C:\Users\FD1HVy\Searches\Indexed Locations.search-ms - Access
C:\Users\FD1HVy\Searches\Indexed Locations.search-ms.CRAB - Access, Read
C:\Users\FD1HVy\Searches\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms - Access
C:\Users\FD1HVy\Searches\winrt--{S-1-5-21-1051304884-625712362-2192934891-1000}-.searchconnector-ms.CRAB - Access, Read
C:\Users\FD1HVy\SendTo\\CRAB-DECRYPT.txt - Access
C:\Users\FD1HVy\Start Menu\\CRAB-DECRYPT.txt - Access
C:\Users\FD1HVy\Templates\\CRAB-DECRYPT.txt - Access
C:\Users\FD1HVy\Videos\04wiePIT.swf - Access
C:\Users\FD1HVy\Videos\04wiePIT.swf.CRAB - Access, Read
C:\Users\FD1HVy\Videos\2j3i_Lv_6p.mp4 - Access
C:\Users\FD1HVy\Videos\2j3i_Lv_6p.mp4.CRAB - Access, Read
C:\Users\FD1HVy\Videos\7xX0LKB_.mp4 - Access
C:\Users\FD1HVy\Videos\7xX0LKB_.mp4.CRAB - Access, Read
C:\Users\FD1HVy\Videos\9DacIikfIkX 20nTL-1.avi - Access
C:\Users\FD1HVy\Videos\9DacIikfIkX 20nTL-1.avi.CRAB - Access, Read
C:\Users\FD1HVy\Videos\bnLzb.swf - Access
C:\Users\FD1HVy\Videos\bnLzb.swf.CRAB - Access, Read
C:\Users\FD1HVy\Videos\\CRAB-DECRYPT.txt - Access
C:\Users\FD1HVy\Videos\d4WYV4lg2fVP2kVD0s.mp4 - Access
C:\Users\FD1HVy\Videos\d4WYV4lg2fVP2kVD0s.mp4.CRAB - Access, Read
C:\Users\FD1HVy\Videos\e1a51uu0C Hca.mp4 - Access
C:\Users\FD1HVy\Videos\e1a51uu0C Hca.mp4.CRAB - Access, Read
C:\Users\FD1HVy\Videos\FtS1uC Fp.mp4 - Access
C:\Users\FD1HVy\Videos\FtS1uC Fp.mp4.CRAB - Access, Read
C:\Users\FD1HVy\Videos\i7x2aGiKw5LAAkmGf.mp4 - Access
C:\Users\FD1HVy\Videos\i7x2aGiKw5LAAkmGf.mp4.CRAB - Access, Read
C:\Users\FD1HVy\Videos\I_HNPpN1Uh5jlv1Co.avi - Access
C:\Users\FD1HVy\Videos\I_HNPpN1Uh5jlv1Co.avi.CRAB - Access, Read
C:\Users\FD1HVy\Videos\IvmZ.swf - Access
C:\Users\FD1HVy\Videos\IvmZ.swf.CRAB - Access, Read
C:\Users\FD1HVy\Videos\J0jWIM8B0YR.mp4 - Access
C:\Users\FD1HVy\Videos\J0jWIM8B0YR.mp4.CRAB - Access, Read
C:\Users\FD1HVy\Videos\j5IV.mkv - Access
C:\Users\FD1HVy\Videos\j5IV.mkv.CRAB - Access, Read
C:\Users\FD1HVy\Videos\jmxzUtYA_.flv - Access
C:\Users\FD1HVy\Videos\jmxzUtYA_.flv.CRAB - Access, Read
C:\Users\FD1HVy\Videos\kkG91p6l-Fj7Bpge6.mp4 - Access
C:\Users\FD1HVy\Videos\kkG91p6l-Fj7Bpge6.mp4.CRAB - Access, Read
C:\Users\FD1HVy\Videos\kMcR0.mkv - Access
C:\Users\FD1HVy\Videos\kMcR0.mkv.CRAB - Access, Read
C:\Users\FD1HVy\Videos\P4pjXYuNsZS.avi - Access
C:\Users\FD1HVy\Videos\P4pjXYuNsZS.avi.CRAB - Access, Read
C:\Users\FD1HVy\Videos\p_O9_RlNXLZqo_CP.swf - Access
C:\Users\FD1HVy\Videos\p_O9_RlNXLZqo_CP.swf.CRAB - Access, Read
C:\Users\FD1HVy\Videos\PmEG5TRLE.flv - Access
C:\Users\FD1HVy\Videos\PmEG5TRLE.flv.CRAB - Access, Read
C:\Users\FD1HVy\Videos\PtJSVBcywVLa.swf - Access
C:\Users\FD1HVy\Videos\PtJSVBcywVLa.swf.CRAB - Access, Read
C:\Users\FD1HVy\Videos\QJnVGj4G.swf - Access
C:\Users\FD1HVy\Videos\QJnVGj4G.swf.CRAB - Access, Read
C:\Users\FD1HVy\Videos\s9-lmKv4iWBJv.flv - Access
C:\Users\FD1HVy\Videos\s9-lmKv4iWBJv.flv.CRAB - Access, Read
C:\Users\FD1HVy\Videos\SMyn.mp4 - Access
C:\Users\FD1HVy\Videos\SMyn.mp4.CRAB - Access, Read
C:\Users\FD1HVy\Videos\TSch7Rh_L5i_lC.flv - Access
C:\Users\FD1HVy\Videos\TSch7Rh_L5i_lC.flv.CRAB - Access, Read
C:\Users\FD1HVy\Videos\uzdeG0D_x4.swf - Access
C:\Users\FD1HVy\Videos\uzdeG0D_x4.swf.CRAB - Access, Read
C:\Users\FD1HVy\Videos\wHCY6G H.mkv - Access
C:\Users\FD1HVy\Videos\wHCY6G H.mkv.CRAB - Access, Read
C:\Users\FD1HVy\Videos\WRuFtpic.mkv - Access
C:\Users\FD1HVy\Videos\WRuFtpic.mkv.CRAB - Access, Read
C:\Users\FD1HVy\Videos\XoSEs2.avi - Access
C:\Users\FD1HVy\Videos\XoSEs2.avi.CRAB - Access, Read
C:\Users\FD1HVy\Videos\y06 s3uhnsTa.mkv - Access
C:\Users\FD1HVy\Videos\y06 s3uhnsTa.mkv.CRAB - Access, Read
C:\Users\FD1HVy\Videos\YCsU2jX4ETqZC.swf - Access
C:\Users\FD1HVy\Videos\YCsU2jX4ETqZC.swf.CRAB - Access, Read
C:\Users\Public\AccountPictures\\CRAB-DECRYPT.txt - Access
C:\Users\Public\\CRAB-DECRYPT.txt - Access
C:\Users\Public\Documents\\CRAB-DECRYPT.txt - Access
C:\Users\Public\Documents\My Music\\CRAB-DECRYPT.txt - Access
C:\Users\Public\Documents\My Pictures\\CRAB-DECRYPT.txt - Access
C:\Users\Public\Documents\My Videos\\CRAB-DECRYPT.txt - Access
C:\Users\Public\Downloads\\CRAB-DECRYPT.txt - Access
C:\Users\Public\Libraries\\CRAB-DECRYPT.txt - Access
C:\Users\Public\Libraries\RecordedTV.library-ms - Access
C:\Users\Public\Libraries\RecordedTV.library-ms.CRAB - Access, Read
C:\Users\Public\Music\\CRAB-DECRYPT.txt - Access
C:\Users\Public\Pictures\\CRAB-DECRYPT.txt - Access
C:\Users\Public\Videos\\CRAB-DECRYPT.txt - Access
C:\WINDOWS - Access
C:\Windows10Upgrade\2052\\CRAB-DECRYPT.txt - Access
C:\Windows10Upgrade\2052\DWINTL20.DLL - Access
C:\Windows10Upgrade\2052\DWINTL20.DLL.CRAB - Access
C:\Windows10Upgrade\Configuration.ini - Access
C:\Windows10Upgrade\Configuration.ini.CRAB - Access
C:\Windows10Upgrade\\CRAB-DECRYPT.txt - Access
C:\Windows10Upgrade\dll1\\CRAB-DECRYPT.txt - Access
C:\Windows10Upgrade\dll2\\CRAB-DECRYPT.txt - Access
C:\Windows10Upgrade\DW20.EXE - Access
C:\Windows10Upgrade\DW20.EXE.CRAB - Access
C:\Windows10Upgrade\DWDCW20.DLL - Access
C:\Windows10Upgrade\DWDCW20.DLL.CRAB - Access
C:\Windows10Upgrade\DWTRIG20.EXE - Access
C:\Windows10Upgrade\DWTRIG20.EXE.CRAB - Access
C:\Windows10Upgrade\GatherOSState.EXE - Access
C:\Windows10Upgrade\GatherOSState.EXE.CRAB - Access
C:\Windows10Upgrade\GetCurrentRollback.EXE - Access
C:\Windows10Upgrade\GetCurrentRollback.EXE.CRAB - Access
C:\Windows10Upgrade\resources\amd64\BiosBlocks.xml - Access
C:\Windows10Upgrade\resources\amd64\BiosBlocks.xml.CRAB - Access
C:\Windows10Upgrade\resources\amd64\\CRAB-DECRYPT.txt - Access
C:\Windows10Upgrade\resources\amd64\hwcompat.txt - Access
C:\Windows10Upgrade\resources\amd64\hwcompat.txt.CRAB - Access
C:\Windows10Upgrade\resources\amd64\hwexclude.txt - Access
C:\Windows10Upgrade\resources\amd64\hwexclude.txt.CRAB - Access
C:\Windows10Upgrade\resources\amd64\nxquery.cat - Access
C:\Windows10Upgrade\resources\amd64\nxquery.cat.CRAB - Access
C:\Windows10Upgrade\resources\amd64\nxquery.inf - Access
C:\Windows10Upgrade\resources\amd64\nxquery.inf.CRAB - Access
C:\Windows10Upgrade\resources\\CRAB-DECRYPT.txt - Access
C:\Windows10Upgrade\resources\hwcompatShared.txt - Access
C:\Windows10Upgrade\resources\hwcompatShared.txt.CRAB - Access
C:\Windows10Upgrade\resources\i386\BiosBlocks.xml - Access
C:\Windows10Upgrade\resources\i386\BiosBlocks.xml.CRAB - Access
C:\Windows10Upgrade\resources\i386\\CRAB-DECRYPT.txt - Access
C:\Windows10Upgrade\resources\i386\hwcompat.txt - Access
C:\Windows10Upgrade\resources\i386\hwcompat.txt.CRAB - Access
C:\Windows10Upgrade\resources\i386\hwexclude.txt - Access
C:\Windows10Upgrade\resources\i386\hwexclude.txt.CRAB - Access
C:\Windows10Upgrade\resources\i386\nxquery.cat - Access
C:\Windows10Upgrade\resources\i386\nxquery.cat.CRAB - Access
C:\Windows10Upgrade\resources\i386\nxquery.inf - Access
C:\Windows10Upgrade\resources\i386\nxquery.inf.CRAB - Access
C:\Windows10Upgrade\resources\ux\block.png - Access
C:\Windows10Upgrade\resources\ux\block.png.CRAB - Access
C:\Windows10Upgrade\resources\ux\bluelogo.png - Access
C:\Windows10Upgrade\resources\ux\bluelogo.png.CRAB - Access
C:\Windows10Upgrade\resources\ux\bullet.png - Access
C:\Windows10Upgrade\resources\ux\bullet.png.CRAB - Access
C:\Windows10Upgrade\resources\ux\\CRAB-DECRYPT.txt - Access
C:\Windows10Upgrade\resources\ux\default.css - Access
C:\Windows10Upgrade\resources\ux\default.css.CRAB - Access
C:\Windows10Upgrade\resources\ux\default.htm - Access
C:\Windows10Upgrade\resources\ux\default.htm.CRAB - Access
C:\Windows10Upgrade\resources\ux\default_eos.css - Access
C:\Windows10Upgrade\resources\ux\default_eos.css.CRAB - Access
C:\Windows10Upgrade\resources\ux\default_eos.htm - Access
C:\Windows10Upgrade\resources\ux\default_eos.htm.CRAB - Access
C:\Windows10Upgrade\resources\ux\default_oobe.css - Access
C:\Windows10Upgrade\resources\ux\default_oobe.css.CRAB - Access
C:\Windows10Upgrade\resources\ux\default_oobe.htm - Access
C:\Windows10Upgrade\resources\ux\default_oobe.htm.CRAB - Access
C:\Windows10Upgrade\resources\ux\eula.css - Access
C:\Windows10Upgrade\resources\ux\eula.css.CRAB - Access
C:\Windows10Upgrade\resources\ux\EULA\\CRAB-DECRYPT.txt - Access
C:\Windows10Upgrade\resources\ux\EULA\EULA_ar-sa.htm - Access
C:\Windows10Upgrade\resources\ux\EULA\EULA_ar-sa.htm.CRAB - Access
C:\Windows10Upgrade\resources\ux\EULA\EULA_bg-bg.htm - Access
C:\Windows10Upgrade\resources\ux\EULA\EULA_bg-bg.htm.CRAB - Access
C:\Windows10Upgrade\resources\ux\EULA\EULA_cs-cz.htm - Access
C:\Windows10Upgrade\resources\ux\EULA\EULA_cs-cz.htm.CRAB - Access
C:\Windows10Upgrade\resources\ux\EULA\EULA_da-dk.htm - Access
C:\Windows10Upgrade\resources\ux\EULA\EULA_da-dk.htm.CRAB - Access
C:\Windows10Upgrade\resources\ux\EULA\EULA_de-de.htm - Access
C:\Windows10Upgrade\resources\ux\EULA\EULA_de-de.htm.CRAB - Access
C:\Windows10Upgrade\resources\ux\EULA\EULA_el-gr.htm - Access
C:\Windows10Upgrade\resources\ux\EULA\EULA_el-gr.htm.CRAB - Access
C:\Windows10Upgrade\resources\ux\EULA\EULA_en-gb.htm - Access
C:\Windows10Upgrade\resources\ux\EULA\EULA_en-gb.htm.CRAB - Access
C:\Windows10Upgrade\resources\ux\EULA\EULA_en-us.htm - Access
C:\Windows10Upgrade\resources\ux\EULA\EULA_en-us.htm.CRAB - Access
C:\Windows10Upgrade\resources\ux\EULA\EULA_es-es.htm - Access
C:\Windows10Upgrade\resources\ux\EULA\EULA_es-es.htm.CRAB - Access
C:\Windows10Upgrade\resources\ux\EULA\EULA_es-mx.htm - Access
C:\Windows10Upgrade\resources\ux\EULA\EULA_es-mx.htm.CRAB - Access
C:\Windows10Upgrade\resources\ux\EULA\EULA_et-ee.htm - Access
C:\Windows10Upgrade\resources\ux\EULA\EULA_et-ee.htm.CRAB - Access
C:\Windows10Upgrade\resources\ux\EULA\EULA_fi-fi.htm - Access
C:\Windows10Upgrade\resources\ux\EULA\EULA_fi-fi.htm.CRAB - Access
C:\Windows10Upgrade\resources\ux\EULA\EULA_fr-ca.htm - Access
C:\Windows10Upgrade\resources\ux\EULA\EULA_fr-ca.htm.CRAB - Access
C:\Windows10Upgrade\resources\ux\EULA\EULA_fr-fr.htm - Access
C:\Windows10Upgrade\resources\ux\EULA\EULA_fr-fr.htm.CRAB - Access
C:\Windows10Upgrade\resources\ux\EULA\EULA_he-il.htm - Access
C:\Windows10Upgrade\resources\ux\EULA\EULA_he-il.htm.CRAB - Access
C:\Windows10Upgrade\resources\ux\EULA\EULA_hr-hr.htm - Access
C:\Windows10Upgrade\resources\ux\EULA\EULA_hr-hr.htm.CRAB - Access
C:\Windows10Upgrade\resources\ux\EULA\EULA_hu-hu.htm - Access
C:\Windows10Upgrade\resources\ux\EULA\EULA_hu-hu.htm.CRAB - Access
C:\Windows10Upgrade\resources\ux\EULA\EULA_it-it.htm - Access
C:\Windows10Upgrade\resources\ux\EULA\EULA_it-it.htm.CRAB - Access
C:\Windows10Upgrade\resources\ux\EULA\EULA_ja-jp.htm - Access
C:\Windows10Upgrade\resources\ux\EULA\EULA_ja-jp.htm.CRAB - Access
C:\Windows10Upgrade\resources\ux\EULA\EULA_ko-kr.htm - Access
C:\Windows10Upgrade\resources\ux\EULA\EULA_ko-kr.htm.CRAB - Access
C:\Windows10Upgrade\resources\ux\EULA\EULA_lt-lt.htm - Access
C:\Windows10Upgrade\resources\ux\EULA\EULA_lt-lt.htm.CRAB - Access
C:\Windows10Upgrade\resources\ux\EULA\EULA_lv-lv.htm - Access
C:\Windows10Upgrade\resources\ux\EULA\EULA_lv-lv.htm.CRAB - Access
C:\Windows10Upgrade\resources\ux\EULA\EULA_nb-no.htm - Access
C:\Windows10Upgrade\resources\ux\EULA\EULA_nb-no.htm.CRAB - Access
C:\Windows10Upgrade\resources\ux\EULA\EULA_nl-nl.htm - Access
C:\Windows10Upgrade\resources\ux\EULA\EULA_nl-nl.htm.CRAB - Access
C:\Windows10Upgrade\resources\ux\EULA\EULA_pl-pl.htm - Access
C:\Windows10Upgrade\resources\ux\EULA\EULA_pl-pl.htm.CRAB - Access
C:\Windows10Upgrade\resources\ux\EULA\EULA_pt-br.htm - Access
C:\Windows10Upgrade\resources\ux\EULA\EULA_pt-br.htm.CRAB - Access
C:\Windows10Upgrade\resources\ux\EULA\EULA_pt-pt.htm - Access
C:\Windows10Upgrade\resources\ux\EULA\EULA_pt-pt.htm.CRAB - Access
C:\Windows10Upgrade\resources\ux\EULA\EULA_ro-ro.htm - Access
C:\Windows10Upgrade\resources\ux\EULA\EULA_ro-ro.htm.CRAB - Access
C:\Windows10Upgrade\resources\ux\EULA\EULA_ru-ru.htm - Access
C:\Windows10Upgrade\resources\ux\EULA\EULA_ru-ru.htm.CRAB - Access
C:\Windows10Upgrade\resources\ux\EULA\EULA_sk-sk.htm - Access
C:\Windows10Upgrade\resources\ux\EULA\EULA_sk-sk.htm.CRAB - Access
C:\Windows10Upgrade\resources\ux\EULA\EULA_sl-si.htm - Access
C:\Windows10Upgrade\resources\ux\EULA\EULA_sl-si.htm.CRAB - Access
C:\Windows10Upgrade\resources\ux\EULA\EULA_sr-latn-cs.htm - Access
C:\Windows10Upgrade\resources\ux\EULA\EULA_sr-latn-cs.htm.CRAB - Access
C:\Windows10Upgrade\resources\ux\EULA\EULA_sv-se.htm - Access
C:\Windows10Upgrade\resources\ux\EULA\EULA_sv-se.htm.CRAB - Access
C:\Windows10Upgrade\resources\ux\EULA\EULA_th-th.htm - Access
C:\Windows10Upgrade\resources\ux\EULA\EULA_th-th.htm.CRAB - Access
C:\Windows10Upgrade\resources\ux\EULA\EULA_tr-tr.htm - Access
C:\Windows10Upgrade\resources\ux\EULA\EULA_tr-tr.htm.CRAB - Access
C:\Windows10Upgrade\resources\ux\EULA\EULA_uk-ua.htm - Access
C:\Windows10Upgrade\resources\ux\EULA\EULA_uk-ua.htm.CRAB - Access
C:\Windows10Upgrade\resources\ux\EULA\EULA_zh-cn.htm - Access
C:\Windows10Upgrade\resources\ux\EULA\EULA_zh-cn.htm.CRAB - Access
C:\Windows10Upgrade\resources\ux\EULA\EULA_zh-hk.htm - Access
C:\Windows10Upgrade\resources\ux\EULA\EULA_zh-hk.htm.CRAB - Access
C:\Windows10Upgrade\resources\ux\EULA\EULA_zh-tw.htm - Access
C:\Windows10Upgrade\resources\ux\EULA\EULA_zh-tw.htm.CRAB - Access
C:\Windows10Upgrade\resources\ux\GetStarted.png - Access
C:\Windows10Upgrade\resources\ux\GetStarted.png.CRAB - Access
C:\Windows10Upgrade\resources\ux\GetStartedHoverOver.png - Access
C:\Windows10Upgrade\resources\ux\GetStartedHoverOver.png.CRAB - Access
C:\Windows10Upgrade\resources\ux\loading.gif - Access
C:\Windows10Upgrade\resources\ux\loading.gif.CRAB - Access
C:\Windows10Upgrade\resources\ux\lock.png - Access
C:\Windows10Upgrade\resources\ux\lock.png.CRAB - Access
C:\Windows10Upgrade\resources\ux\logo.png - Access
C:\Windows10Upgrade\resources\ux\logo.png.CRAB - Access
C:\Windows10Upgrade\resources\ux\marketing.png - Access
C:\Windows10Upgrade\resources\ux\marketing.png.CRAB - Access
C:\Windows10Upgrade\resources\ux\Microsoft.WinJS\\CRAB-DECRYPT.txt - Access
C:\Windows10Upgrade\resources\ux\Microsoft.WinJS\css\\CRAB-DECRYPT.txt - Access
C:\Windows10Upgrade\resources\ux\Microsoft.WinJS\css\oobe-desktop.css - Access
C:\Windows10Upgrade\resources\ux\Microsoft.WinJS\css\oobe-desktop.css.CRAB - Access
C:\Windows10Upgrade\resources\ux\Microsoft.WinJS\css\ui-dark.css - Access
C:\Windows10Upgrade\resources\ux\Microsoft.WinJS\css\ui-dark.css.CRAB - Access
C:\Windows10Upgrade\resources\ux\Microsoft.WinJS\js\base.js - Access
C:\Windows10Upgrade\resources\ux\Microsoft.WinJS\js\base.js.CRAB - Access
C:\Windows10Upgrade\resources\ux\Microsoft.WinJS\js\\CRAB-DECRYPT.txt - Access
C:\Windows10Upgrade\resources\ux\Microsoft.WinJS\js\ui.js - Access
C:\Windows10Upgrade\resources\ux\Microsoft.WinJS\js\ui.js.CRAB - Access
C:\Windows10Upgrade\resources\ux\NetworkIssueFAQ.mht - Access
C:\Windows10Upgrade\resources\ux\NetworkIssueFAQ.mht.CRAB - Access
C:\Windows10Upgrade\resources\ux\NoNetworkConnection.png - Access
C:\Windows10Upgrade\resources\ux\NoNetworkConnection.png.CRAB - Access
C:\Windows10Upgrade\resources\ux\NoNetworkConnectionHoverOver.png - Access
C:\Windows10Upgrade\resources\ux\NoNetworkConnectionHoverOver.png.CRAB - Access
C:\Windows10Upgrade\resources\ux\pass.png - Access
C:\Windows10Upgrade\resources\ux\pass.png.CRAB - Access
C:\Windows10Upgrade\upgrader_default.log - Access
C:\Windows10Upgrade\upgrader_default.log.CRAB - Access
C:\Windows10Upgrade\upgrader_win10.log - Access
C:\Windows10Upgrade\upgrader_win10.log.CRAB - Access
C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll - Access
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\machine.config - Access, Read
C:\WINDOWS\system32 - Access
C:\WINDOWS\System32\Wbem - Access
C:\WINDOWS\System32\WindowsPowerShell\v1.0\ - Access
C:\Windows\System32\WindowsPowerShell\v1.0\Microsoft.PowerShell_profile.ps1 - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\AppBackgroundTask - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\AppBackgroundTask\AppBackgroundTask.psd1 - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\AppLocker - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\AppLocker\AppLocker.psd1 - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\AppvClient - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\AppvClient\AppvClient.psd1 - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\Appx - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\Appx\Appx.psd1 - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\AssignedAccess - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\AssignedAccess\AssignedAccess.psd1 - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\BitLocker - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psm1 - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\BitsTransfer - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\BitsTransfer\BitsTransfer.psd1 - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\BranchCache - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\BranchCache\BranchCache.psd1 - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\CimCmdlets - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\CimCmdlets\CimCmdlets.psd1 - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\ConfigCI - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\ConfigCI\ConfigCI.psd1 - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\Defender - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\Defender\Defender.psd1 - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\DeliveryOptimization - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\DeliveryOptimization\DeliveryOptimization.psd1 - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\DirectAccessClientComponents - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\DirectAccessClientComponents\DirectAccessClientComponents.psd1 - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\Dism - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\Dism\Dism.psd1 - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\DnsClient - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\DnsClient\DnsClient.psd1 - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\EventTracingManagement - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\EventTracingManagement\EventTracingManagement.psd1 - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\International - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\International\International.psd1 - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\iSCSI - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\iSCSI\iSCSI.psd1 - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\ISE - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\ISE\ISE.psd1 - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\Kds - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\Kds\Kds.psd1 - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Archive - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Archive\Microsoft.PowerShell.Archive.psd1 - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Commands.Management - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Commands.Management\Microsoft.PowerShell.Commands.Management.dll - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Commands.Utility - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Commands.Utility\Microsoft.PowerShell.Commands.Utility.dll - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Diagnostics - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Diagnostics\Microsoft.PowerShell.Diagnostics.psd1 - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Host - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Host\Microsoft.PowerShell.Host.psd1 - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.psd1 - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Management - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Management\en-US\Microsoft.PowerShell.Management.psd1 - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Management\en\Microsoft.PowerShell.Management.psd1 - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Management\Microsoft.PowerShell.Commands.Management.dll - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Management\Microsoft.PowerShell.Commands.Management.dll\Microsoft.PowerShell.Commands.Management.dll - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Management\Microsoft.PowerShell.Management.psd1 - Access, Read
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Management\PSGetModuleInfo.xml - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.ODataUtils - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.ODataUtils\Microsoft.PowerShell.ODataUtils.psd1 - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Security - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Security\Microsoft.PowerShell.Security.psd1 - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Utility - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Utility\en-US\Microsoft.PowerShell.Utility.psd1 - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Utility\en\Microsoft.PowerShell.Utility.psd1 - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Utility\Microsoft.PowerShell.Commands.Utility.dll - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Utility\Microsoft.PowerShell.Commands.Utility.dll\Microsoft.PowerShell.Commands.Utility.dll - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Utility\Microsoft.PowerShell.Utility.psd1 - Access, Read
C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Utility\Microsoft.PowerShell.Utility.psm1 - Access, Read
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Utility\PSGetModuleInfo.xml - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\Microsoft.WSMan.Management - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\Microsoft.WSMan.Management\Microsoft.WSMan.Management.psd1 - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\MMAgent - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\MMAgent\MMAgent.psd1 - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\Modules.cdxml - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\Modules.dll - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\Modules.ni.dll - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\Modules.psd1 - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\Modules.psm1 - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\Modules.xaml - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\MsDtc - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\MsDtc\MsDtc.psd1 - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\MSMQ - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\NetAdapter - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\NetAdapter\NetAdapter.psd1 - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\NetConnection - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\NetConnection\NetConnection.psd1 - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\NetEventPacketCapture - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\NetEventPacketCapture\NetEventPacketCapture.psd1 - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\NetLbfo - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\NetLbfo\NetLbfo.psd1 - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\NetNat - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\NetNat\NetNat.psd1 - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\NetQos - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\NetQos\NetQos.psd1 - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\NetSecurity - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\NetSecurity\NetSecurity.psd1 - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\NetSwitchTeam - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\NetSwitchTeam\NetSwitchTeam.psd1 - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\NetTCPIP - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\NetTCPIP\NetTCPIP.psd1 - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\NetworkConnectivityStatus - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\NetworkConnectivityStatus\NetworkConnectivityStatus.psd1 - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\NetworkSwitchManager - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\NetworkSwitchManager\NetworkSwitchManager.psd1 - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\NetworkTransition - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\NetworkTransition\NetworkTransition.psd1 - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\PcsvDevice - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\PcsvDevice\PcsvDevice.psd1 - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\PKI - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\PKI\PKI.psd1 - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\PnpDevice - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\PnpDevice\PnpDevice.psd1 - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\PrintManagement - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\PrintManagement\PrintManagement.psd1 - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\Provisioning - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\Provisioning\Provisioning.psd1 - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\PSDesiredStateConfiguration.psd1 - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\PSDiagnostics - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\PSDiagnostics\PSDiagnostics.psd1 - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\PSScheduledJob - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\PSScheduledJob\PSScheduledJob.psd1 - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\PSWorkflow - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\PSWorkflow\PSWorkflow.psd1 - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\PSWorkflowUtility - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\PSWorkflowUtility\PSWorkflowUtility.psd1 - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\ScheduledTasks - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\ScheduledTasks\ScheduledTasks.psd1 - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\SecureBoot - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\SecureBoot\SecureBoot.psd1 - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\SmbShare - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\SmbShare\SmbShare.psd1 - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\SmbWitness - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\SmbWitness\SmbWitness.psd1 - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\StartLayout - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\StartLayout\StartLayout.psd1 - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\Storage - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\Storage\Storage.psd1 - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\TLS - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\TLS\TLS.psd1 - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\TroubleshootingPack - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\TroubleshootingPack\TroubleshootingPack.psd1 - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\TrustedPlatformModule - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\TrustedPlatformModule\TrustedPlatformModule.psd1 - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\UEV - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\UEV\UEV.psd1 - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\VpnClient - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\VpnClient\VpnClient.psd1 - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\Wdac - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\Wdac\Wdac.psd1 - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\WindowsDeveloperLicense - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\WindowsDeveloperLicense\WindowsDeveloperLicense.psd1 - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\WindowsErrorReporting - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\WindowsErrorReporting\WindowsErrorReporting.psd1 - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\WindowsErrorReporting\WindowsErrorReporting.psm1 - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\WindowsSearch - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\WindowsSearch\WindowsSearch.psd1 - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\WindowsUpdate - Access
C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules\WindowsUpdate\WindowsUpdate.psd1 - Access
C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe - Access
C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe.config - Access
C:\Windows\System32\WindowsPowerShell\v1.0\profile.ps1 - Access
C:\WINDOWS\system32\wldp.dll - Access
Registry (69)
»
Registry Key Name Operations
HKEY_CLASSES_ROOT\Licenses Access
HKEY_CLASSES_ROOT\Licenses\8804558B-B773-11d1-BC3E-0000F87552E7 Read
HKEY_CLASSES_ROOT\TypeLib Access
HKEY_CLASSES_ROOT\TypeLib\{00020430-0000-0000-C000-000000000046} Access
HKEY_CLASSES_ROOT\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0 Access
HKEY_CLASSES_ROOT\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0\0 Access
HKEY_CLASSES_ROOT\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0\0\win64 Access, Read
HKEY_CLASSES_ROOT\TypeLib\{00020905-0000-0000-C000-000000000046} Access
HKEY_CLASSES_ROOT\TypeLib\{00020905-0000-0000-C000-000000000046}\8.7 Access
HKEY_CLASSES_ROOT\TypeLib\{00020905-0000-0000-C000-000000000046}\8.7\0 Access
HKEY_CLASSES_ROOT\TypeLib\{00020905-0000-0000-C000-000000000046}\8.7\0\win64 Access, Read
HKEY_CLASSES_ROOT\TypeLib\{00020905-0000-0000-C000-000000000046}\8.7\409 Access
HKEY_CLASSES_ROOT\TypeLib\{00020905-0000-0000-C000-000000000046}\8.7\9 Access
HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52} Access
HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}\2.8 Access
HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}\2.8\0 Access
HKEY_CLASSES_ROOT\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}\2.8\0\win64 Access, Read
HKEY_CURRENT_USER Access
HKEY_CURRENT_USER\Control Panel\International Access, Read
HKEY_CURRENT_USER\Environment Access, Read
HKEY_CURRENT_USER\Keyboard Layout\Preload Access, Read
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Access
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce Access, Write
HKEY_CURRENT_USER\Software\Microsoft\Command Processor Access, Read
HKEY_CURRENT_USER\Software\Microsoft\VBA\7.1\Common Access, Read
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration Access
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging Access
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging Access
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\PowerShell\Transcription Access
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System Access
HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Access, Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework Access, Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\AppContext Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\ShellIds Access, Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Wbem\CIMOM Access, Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion Access, Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\W. Europe Standard Time Access, Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\W. Europe Standard Time\Dynamic DST Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Access
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Application\PowerShell Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\HardwareEvents\PowerShell Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Internet Explorer\PowerShell Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service\PowerShell Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\OAlerts\PowerShell Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Security Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\System\PowerShell Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Windows PowerShell\PowerShell Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Tcpip\Parameters Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\PowerShell\3\PowerShellEngine Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\WSMAN Access, Read
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\DNSClient Access
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ConsoleSessionConfiguration Access
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ModuleLogging Access
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging Access
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\PowerShell\Transcription Access
HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Winevt\Publishers\{816ebd75-f7ab-59c0-e2f0-bddfeed66ac2} Access
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment Access, Read
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters Access, Read
Mutex (1)
»
Mutex Name Operations
Global\pc_group=WORKGROUP&ransom_id=bdc31ed2b4197730 Access
URL (12)
»
URL Operations
185.189.58.222/x.exe GET
ipv4bot.whatismyipaddress.com/ GET
130.204.21.137/steass POST
190.140.194.176/steistay?auphei=ee&ay=ores POST
190.140.194.176/eighlo?s=ploa POST
193.33.1.19/ereboa?steapl=deeiss&ss=aib POST
193.33.1.19/erpheab?s=ee&boa=ploreph POST
84.54.187.24/fui?eizaer=b POST
84.54.187.24/eregheyss?ph=zaowlo POST
85.187.48.16/pheade?ai=eyde&ei=gh POST
85.187.48.16/lfeylfui?geeage=ph&oreplow=iess POST
217.75.83.218/aygha?ghaige=uilo&aiscer=oreph POST
IP (11)
»
IP Protocols
185.189.58.222 HTTP, TCP
94.183.71.48 DNS, UDP
89.203.10.56 DNS, UDP
189.75.183.21 DNS, UDP
94.249.60.127 DNS, UDP
130.204.21.137 HTTP, TCP
190.140.194.176 HTTP, TCP
193.33.1.19 HTTP, TCP
84.54.187.24 HTTP, TCP
85.187.48.16 HTTP, TCP
217.75.83.218 HTTP, TCP
Export IOCs
Function Logfile
Download-Icon
Exit-Icon

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy". 


    

   

   

    Before
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    After
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    

     
      

       
       
       
       
      

     
     
     
    

   

  

  

   

    
    

     Screenshot
    

    

     Expand-Icon
    

    

     Exit-Icon
    

   

   

    

     icon_left
    

    

     icon_left
    

   

   

   

   

    image