Javascript Dropper #2 - Gandcrab Analysis | IOCs
Logo
Try VMRay Analyzer
VTI SCORE: 100/100
Target: win10_64 | windows_script_file
Classification: Dropper, Trojan, Downloader, Ransomware

e7851a1b3e93968e7f6b92a1a3f59d250402be15a5bcb3262acff1e0a27b912c (SHA256)

bill_87448680672-2706201981722018_4_23_b83d95.pdf.js

JScript

Created at 2018-05-07 10:12:00

...

Notifications (1/1)

Some extracted files may be missing in the report since the maximum number of extracted files was reached during the analysis. You can increase the limit in the configuration settings.

Indicators

File (1046)
»
Filename Hash Operations
C:\$Recycle.Bin\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\$Recycle.Bin\S-1-5-18\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\$Recycle.Bin\S-1-5-21-1462094071-1423818996-289466292-1000\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\bootmgr - Access
C:\bootmgr.CRAB - Access
C:\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Read, Write
C:\Documents and Settings\\CRAB-DECRYPT.txt - Access, Write
C:\PerfLogs\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\Program Files (x86)\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\Program Files\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\Recovery\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\Recovery\WindowsRE\boot.sdi - Access
C:\Recovery\WindowsRE\boot.sdi.CRAB MD5: 6dd0658c809fccdd0e5f01b8b6fcb539
SHA1: 6f384a2865c48a4da03aadc2d9a7c51f36f5685a
SHA256: 3204a9ed1972f903ae6f652c9cf181aec941672b865930a1b922855f3b0be3f2 		Access, Read, Write
C:\Recovery\WindowsRE\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\Recovery\WindowsRE\ReAgent.xml - Access
C:\Recovery\WindowsRE\ReAgent.xml.CRAB MD5: 4d0006210ef2c172a984094956cac824
SHA1: aaba788ba0d9b62a53bab259b119c4486bb895fc
SHA256: c78478d54371220bd3e8e2286fd734d3e0f59b63aa14a471d891ca986b1b600d 		Access, Read, Write
C:\Recovery\WindowsRE\Winre.wim - Access
C:\Recovery\WindowsRE\Winre.wim.CRAB MD5: 54208dce16c52fbaf83953bbae810580
SHA1: c55e63332588c537d1dc9fc02b90a108267fb957
SHA256: 9b296b4bbece594c5756da14e3f9d43b0bc919da71f22d200fc9c0cf14459ffe 		Access, Read, Write
C:\System Volume Information\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\System Volume Information\IndexerVolumeGuid - Access
C:\System Volume Information\IndexerVolumeGuid.CRAB MD5: 80553cac2f001c47170c9cfeeb168f8c
SHA1: 9120d6d129cfc350db673f41d8ebded55daa3d2a
SHA256: ff226841add227ed3b637b475db683672acc9763fcff1f478f999c344571dbe8 		Access, Read, Write
C:\System Volume Information\tracking.log - Access
C:\System Volume Information\tracking.log.CRAB MD5: 9523c8cafaef4f220c70db6d2d4afdfe
SHA1: 60c2e350c95c1e047320b35c00fd10e4d4e5e92a
SHA256: 3c3bc04abc97ab3edb7679ca27e90828b02e3832354d0e576016127abd86de9e 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\0e --Sjj8.png - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\0e --Sjj8.png.CRAB MD5: de932cfce4f8d8655bf33e94012ae88f
SHA1: 38b403e61d74700dab18c089ec5538601dbb4097
SHA256: 4cfb3b93f242954ee16b11201ec8b4f3fcf52d3e25d841cc0fae3021d347c3b3 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\3-ups.jpg - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\3-ups.jpg.CRAB MD5: 73d422769e21e01cefe46aab69fe6938
SHA1: c8a3623f84547d999dfe2e2fc995bb45ec9a3267
SHA256: eaec8dd12217803f1d6ce0f1c7224c9d828dc914b2fe683fcf2f7c8d16205a6f 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\3RUX.wav - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\3RUX.wav.CRAB MD5: 049ca6aff570318c252e045aa67cdf27
SHA1: 8993f69a4c8358f0030d9b2ef533bb7ca2176eb4
SHA256: 280c538e1c1135bd3fb081b10fc18bf2dc541db56e7ac2aaa568cc937bd0ce9a 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\4YuuLKA.odp - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\4YuuLKA.odp.CRAB MD5: ea1226b67aff17964311be77141af658
SHA1: 6b9163d8baf84f17d2f0cb0543cfce1e9fb11cc9
SHA256: c97b61f2fc5cff5f20b3c59535ae380c16857bc84f0be6732cd686bf24334bef 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\5yzpGS XhyEkxX.gif - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\5yzpGS XhyEkxX.gif.CRAB MD5: 57ac9cb3544706c66961d69b5af4cec3
SHA1: b1edf7a455e66a920c0f55000822f0e57170fde3
SHA256: 0f8b276c1f8adb5503e2edfdd98d691a9bb3ef87ccb5c660bd4fadfeca12d60b 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\8g-qzF4N.wav - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\8g-qzF4N.wav.CRAB MD5: 2e172cf40ebdb2f9eabf075619c9fd74
SHA1: 1bffdb77277402cd356690c097cdddc40db135c7
SHA256: 5bd872fa9be9a368b13e4bf3825d03d9074163275c4c5f3a2d4b0e270d75801d 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Acrobat\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Acrobat\DC\Collab\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Acrobat\DC\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Acrobat\DC\Forms\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Acrobat\DC\JSCache\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Acrobat\DC\JSCache\GlobData - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Acrobat\DC\JSCache\GlobData.CRAB MD5: 0b84d1c1efc839727d88a8225eeab7b6
SHA1: faf590ee4e78a69af221edd17ca816e7ca691e4b
SHA256: d5911df33b787e8efd130ac2096b835dc322c3269771df22d7c6d9ff6f8781b4 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Acrobat\DC\JSCache\GlobSettings - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Acrobat\DC\JSCache\GlobSettings.CRAB MD5: cd98530205b6eabe03d214cfea97cad7
SHA1: e6a73af1e98a8315cc0d8f39c4453fcd51012961
SHA256: 7cf51dec1cb7822d3622df73d928cee384c1825ae1e1f6c06e62d898a019e4b0 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Acrobat\DC\Security\addressbook.acrodata - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Acrobat\DC\Security\addressbook.acrodata.CRAB MD5: 4612a93e208119633367d6c6b5edc1de
SHA1: f9a791c29539c697540b5e22d3f4ea883a87a985
SHA256: a9575f9047cf9200a4074fdffe1b1d2b0b97c189860e9eea47a6a7029ead5ddf 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Acrobat\DC\Security\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl.CRAB MD5: 7085701187c81968f64028ca15b79f4e
SHA1: 26a5193965772faa68d9bfe0a72528b0590754a1
SHA256: ea2459710e72c2153a55b305517a9c1bab1f71104bfa065e4822e102c1ccaf15 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl.CRAB MD5: 88422d61f933d86356e851adf5fe25a7
SHA1: 3fcf70391231bdbfcf281783c5f49b0e27c430d0
SHA256: 27c718d0d8342b897afef9c44c3ae6eca7cacd507d8bf7971389c61af4e1d3f5 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Flash Player\AssetCache\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Flash Player\AssetCache\NAHQNPMN\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Flash Player\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Flash Player\NativeCache\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Headlights\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Linguistics\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\LogTransport2\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\LogTransport2\Logs\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\LogTransport2\LogTransport2.cfg - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\LogTransport2\LogTransport2.cfg.CRAB MD5: 8ced5356da89c75cbbf844e0b3c6b341
SHA1: c928b01ca9de33bc0ddec6bd29442c1230e02972
SHA256: bc7847991697a7e46dd2af776eb03888489f8ac668b4f062023c22ef63af4347 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Sonar\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Sonar\Sonar1.0\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Sonar\Sonar1.0\sonar_policy.xml - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Adobe\Sonar\Sonar1.0\sonar_policy.xml.CRAB MD5: 5cf98e5a7a9a6974287769c832fbd876
SHA1: 1e9775c68807187761b6397dcad216e328d2d240
SHA256: aae68b1433f8b530fb4ee870b3e1311032211a51ed998f179eb6c64f03baf22e 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Dggyafw7MArNa.mp3 - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Dggyafw7MArNa.mp3.CRAB MD5: 7891f51df00927876076c0b2a8e8cf05
SHA1: 9a6b226772e302afae4af5fc60701b32f45e73c8
SHA256: ff95cb32bf5548c441fd3820ccc79daf5c8298a8206d96146964e5fe24d5565a 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\ES FtTu75TP_viPEIbW.avi - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\ES FtTu75TP_viPEIbW.avi.CRAB MD5: 2afc33936a14493c6376fdcf5b3d1047
SHA1: ce2f7249ff367bba3daf1cc5f146941e5dbffff4
SHA256: 0651b2d41dafe29106c59f1c6f9d3e184fb08b67ca0f1fc92372ca663551713a 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\f8jDR2JrBEP0JYZ8S.avi - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\f8jDR2JrBEP0JYZ8S.avi.CRAB MD5: c8286841bcff93e4303bf66643db77b5
SHA1: 61051595492b9d98c66e1f3e2bc05536e45c622c
SHA256: 549c1ba56cf5abf030ca082f30a5a773c875774849e738d8096ed0b00b565ca6 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Identities\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Identities\{CA8CA1BB-F2A6-4E9C-B7CC-FB56671763E8}\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\IgMN c6KE0BQMjB3AV4T.png - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\IgMN c6KE0BQMjB3AV4T.png.CRAB MD5: 568a0aa72efff30a9a8f4c95a873e434
SHA1: aae6b5e0a2efc762d7360e8b5bb341e7acc66d9b
SHA256: 3884706d0dcb3f705244dc1c6e0143977dbb491324648590a1a8d36cb585fd7e 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\JHDvV4GFpCMyf.gif - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\JHDvV4GFpCMyf.gif.CRAB MD5: 720ae428b3fd69c34714417fdd71dd32
SHA1: cce04a19b2bd66632fc69d7ca919174d702e3815
SHA256: 1d53368e37699eded509ad518e4c2a61e57f8a38bb8c917fb422a6769ff372ed 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\K nPGgQvdN.flv - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\K nPGgQvdN.flv.CRAB MD5: de05738c31a83fb5e67578abd90f1b94
SHA1: e6defe5f2903aeba31b1bda64b8cad77d7ae25c9
SHA256: 28c9af1e1d45084f5c192a6bfab21baba3df1bf0451c2abd383305b45e82dc55 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\khYklCMkh.avi - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\khYklCMkh.avi.CRAB MD5: 1f14e636a6046325cb5d5053e0f10f8b
SHA1: 951c591aa28db64290f15b5ccf4cfed1155a0ced
SHA256: 0d6c2a14daba554ad71d62f880d818116fe1ebdd1b5e6dbe6474234c2f49cb73 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\LVJC0a8xXrA.flv - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\LVJC0a8xXrA.flv.CRAB MD5: f98c5b503db881496ec6403bd4f708f7
SHA1: 8f3d18bf30f0a5514f9fc773b70edaa83a1c3f28
SHA256: 9c9ab76212545bf3c6bf76195649e0150e7e2be75f013714cf9530c69eed933d 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Macromedia\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\DQQHJZ8C\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Macromedia\Flash Player\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Macromedia\Flash Player\macromedia.com\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sol - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sol.CRAB MD5: 02a7a9f667124534d3cddd98147fb6ff
SHA1: 3a54a41fbcddd36d52fe2f7a3544a8bfc7587e4f
SHA256: 9a54a79b5599a99f7d3a51e2d1bec77a95f62da9ab5be92896ddad12f9708c54 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Access\AccessCache.accdb - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Access\AccessCache.accdb.CRAB MD5: 7c821798fc35fe1735c9fddf46b5ac12
SHA1: 5cfe1c5dc8731a25491286747b0565fbb35e8b51
SHA256: 3c049a648ed6feb3cfdc95f21942c8a1e6ba0b53e8e38700bed9db9873d7a512 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Access\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Access\System.mdw - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Access\System.mdw.CRAB MD5: c8dff0181129c3adcddb33db37269545
SHA1: eae188bbb117f4e511196a614d6786d5d05d8aee
SHA256: 409a60a459416a625eb1782fe97065f2faf1d2a2b8ee1e1f29daf3d4449995df 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\AddIns\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\Style\APASixthEditionOfficeOnline.xsl - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\Style\APASixthEditionOfficeOnline.xsl.CRAB MD5: 9d5f61fe9c5d36adcce2f721ea85e250
SHA1: 7204b03b6da05179b8220be83e244fa0bdb5e63d
SHA256: eb031246ad32516244102dbbc6ef3b1d299ce372e75774a79c20e154a258b251 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\Style\CHICAGO.XSL - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\Style\CHICAGO.XSL.CRAB MD5: 4b17366e24f4dd730ab5d6bf7652f5d8
SHA1: c7f24892dd9f30e729bb69d2826af6560a563a76
SHA256: 39af4c643898dfcba63f0038593c9c87f5e3265f93e01c4740720219f151dc0a 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\Style\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\Style\GB.XSL - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\Style\GB.XSL.CRAB MD5: 6f93f0e6d40c004235f9a60bbc905636
SHA1: 9651aeb65f0c750f090f1e85fc36c3bd86dcddc3
SHA256: 4378798cc7572af1fed3f7ad08ec503d54cec1390e40a6c11a419e4fec2011c9 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\Style\GostName.XSL - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\Style\GostName.XSL.CRAB MD5: 1aad2399ec65ba7230119a48a9c74c1b
SHA1: 11cc20a0269bcbcc8e16ed74fd74b8c56ad3813c
SHA256: 11de03b2323817e26a00faf5a54c0747bfd105806361f0b9d06527d05221523a 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\Style\GostTitle.XSL - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\Style\GostTitle.XSL.CRAB MD5: ec35b764f3e0c7730d036bd86dc8f019
SHA1: dc40659e319578c16bba18dc7ad1f22580c831f2
SHA256: 5c4f76f59bbbca63e4d305ec729fe62046100cf484ea89a7228ce8fe9e2d15e6 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\Style\HarvardAnglia2008OfficeOnline.xsl - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\Style\HarvardAnglia2008OfficeOnline.xsl.CRAB MD5: 22b9aabb2f646bcfdc1d23e9224c37c3
SHA1: 6f81c0fd86207297b4b1dfd3284b16787b07aa50
SHA256: f954251780ca8e8c9f965acde9bd26a415a4aafee28387aec1c6722210aeb371 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\Style\IEEE2006OfficeOnline.xsl - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\Style\IEEE2006OfficeOnline.xsl.CRAB MD5: bee61378e2c1acc77147e215d809e1f8
SHA1: ac26145bf55cef68b1aeab08553b1649385f65b4
SHA256: 0c2088f4e58914f3d3f36cfe45d7668c383b1ec1a52bda3533d8011862094a0f 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\Style\ISO690.XSL - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\Style\ISO690.XSL.CRAB MD5: e3fd71ff84c02a2239c3225dc3ff95cd
SHA1: 6250b79f6be0168b6bfcfbb1ea83d8499eea6adb
SHA256: 08c4612e98cdad00572f03ddf17948e1c9eac0034f020145098efd3a1a98b5b6 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\Style\ISO690Nmerical.XSL - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\Style\ISO690Nmerical.XSL.CRAB MD5: 5dcb2880f700180270702a41ed03f90c
SHA1: 8b8f90c99ab29981c47cb133c3af740dea730f0a
SHA256: d44eb47b99a5d42b382be55b77412953b4ad57e50404b35276ba1876e6a1fe3f 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\Style\MLASeventhEditionOfficeOnline.xsl - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\Style\MLASeventhEditionOfficeOnline.xsl.CRAB MD5: 79905211bb394e0f45a20a22a108e26b
SHA1: 442e166b55ce1bc0910533337de9bab1123498d2
SHA256: bf7f50b6c149dce3c2302145281b51757599e1cf72b172e3a38d3cea18e1ff70 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\Style\SIST02.XSL - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\Style\SIST02.XSL.CRAB MD5: 1f4559cecc0fa52dde9fd9b1ba9afe08
SHA1: 27316fc551ccb8e3de952cb30cf99ca2933eb178
SHA256: 8c9eef55206ad2633fe4235d546755976fadf2ebc62d9c49918b4ba1b709fbdf 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\Style\TURABIAN.XSL - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Bibliography\Style\TURABIAN.XSL.CRAB MD5: e58cb579be380da32075c8587c998bcb
SHA1: 934e3f1335e9bbaaf22a371d80c6dcd7cf318d8b
SHA256: 8acdf8446356f3c52e8490e4e9f258048cd9ae280021b465f3e7787fa68a140e 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Credentials\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Crypto\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Crypto\RSA\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1462094071-1423818996-289466292-1000\46a78fa46b43fb180b4fa21773f8ff3e_427a1946-e0ff-4097-8c9e-ca2c1e22780b.CRAB MD5: ff0f68836d4f7e3f08908faa381cbe5d
SHA1: 4883b6ab27d054a3a5ac5e0891504882c625e091
SHA256: be58e82be4e1f4d7c87adc340ca7382a763ca80e520f0001faccd3bed251cf2d 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1462094071-1423818996-289466292-1000\83aa4cc77f591dfc2374580bbd95f6ba_427a1946-e0ff-4097-8c9e-ca2c1e22780b - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1462094071-1423818996-289466292-1000\83aa4cc77f591dfc2374580bbd95f6ba_427a1946-e0ff-4097-8c9e-ca2c1e22780b.CRAB MD5: 11ac367f9467c3a90a57fbf91614b9a7
SHA1: 3de04933f5f34e17008f9c7e9b0324032ad2d5ad
SHA256: dfe28b12872bb2ee2ba4e44bc35f96bd2eda6e6811967d3afa489595f67dd7c6 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1462094071-1423818996-289466292-1000\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Document Building Blocks\1033\16\Built-In Building Blocks.dotx - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Document Building Blocks\1033\16\Built-In Building Blocks.dotx.CRAB MD5: 75a8e473f54615fe7479b3124ba5afb6
SHA1: 4941fe577924812adfc50f0378764f8f405c1777
SHA256: 859b24df0534d7d3e737dab3ab18e9136980b8d9a47a280c84ad563c7cad0784 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Document Building Blocks\1033\16\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Document Building Blocks\1033\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Document Building Blocks\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Excel\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Excel\XLSTART\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Internet Explorer\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Internet Explorer\UserData\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\MMC\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\MS Project\16\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\MS Project\16\en-US\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\MS Project\16\en-US\Global.MPT - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\MS Project\16\en-US\Global.MPT.CRAB MD5: fde7aef723d4e1ebdf5972378d4b3953
SHA1: 0150d3d45c0c414a6aafe92694164fdcecc8ba86
SHA256: f7e087a55997436a1a766c4e1b19966dead71b161e712858489969b6b84766ec 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\MS Project\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Network\Connections\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Network\Connections\Pbk\_hiddenPbk\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Network\Connections\Pbk\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Network\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\nuatrx.exe MD5: 59565c950f30350b34a374da0595b267
SHA1: c9acbcf7ff4758fa4d3534fe9158540b64a1cd4a
SHA256: 3c7ecfccf72e83f5d9426cf456d567c3a0a9586876a19ecb11e7b14b7d58e0e0 		Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Office\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Office\MSO1033.acl - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Office\MSO1033.acl.CRAB MD5: c8a311654d98cfca53e71bd2569542af
SHA1: ccc97ef553fe488012bf8f8465819e07aa0228bc
SHA256: a628c5f60b4594bf1cfa33967b3b8ae0bdd10043aed376ed1afcedaad455511b 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Office\Recent\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Office\Recent\Database1.LNK - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Office\Recent\Database1.LNK.CRAB MD5: 58920a0bcb39bd7d0e6bbbd6d478dd2c
SHA1: 46ed77b212d799d236bb316f461aeea6fe054e0c
SHA256: f07e4d09546839dab4bf321338dacd1c4ffd864f4066b338a572c1a585d8b4d1 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Office\Recent\Documents.LNK - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Office\Recent\Documents.LNK.CRAB MD5: c28025550d26368bf99185dfad3f8566
SHA1: 41e33a1a0cd8bd965ad55848276c30d06cae5bc9
SHA256: 5ff894a7cbca86b45e023a469e99a12b8c85178eeebe571e963f6621b0bdfc29 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Office\Recent\Global.LNK - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Office\Recent\Global.LNK.CRAB MD5: e7edef31240c290bc68bebea1b609e8e
SHA1: e5d7d8c781645e9733fde077cbcbaef67d817811
SHA256: 19d893ce65d0c28890a2e454f08e53d902b964761cf4525144bd7e42255a7e29 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Office\Recent\index.dat - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Office\Recent\index.dat.CRAB MD5: 309e622a1e227ed6f83ccab86750946a
SHA1: 576977b6f0887b0aca1b04434adfcb8e5ecf698f
SHA256: 47dccd0d8a5969b4a7cb96e8dd42e5640a185dc5291cc21033d65d6edb85d477 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Office\Recent\Templates.LNK - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Office\Recent\Templates.LNK.CRAB MD5: bdbf45587f0f37f146367a06995702d7
SHA1: 7eb292b28522ed2374f8e2e10d5100f696bf84be
SHA256: e1a4fbeb16be6ed6c161153ddfbebd5fbfa947ba294db108a96b9c4a6f616cb6 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\OneNote\16.0\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\OneNote\16.0\Preferences.dat - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\OneNote\16.0\Preferences.dat.CRAB MD5: b423432d70e4ed9bb47949228428d199
SHA1: 60249294be93d0d0e766dc7ca3145dd85cd538ed
SHA256: 835b58e2c2721fd49c1b27ab25d4bcc51b561d745aa04e357e624fd5b8865e00 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\OneNote\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Outlook\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Outlook\Outlook.srs - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Outlook\Outlook.srs.CRAB MD5: cb2a3202b34a75fc9e23fc70de612cd5
SHA1: 7aca71fd745a337429867574c0f8202031d3f528
SHA256: a3d2e5bc2645a29a274643b6de9bf30785c417d89900f9d1a79cc5f6b8b6dc08 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Outlook\Outlook.xml - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Outlook\Outlook.xml.CRAB MD5: 9df3f73bf68e8d035cc6cfac629f35dd
SHA1: 8795c56c06ca42ce7b9411cae2979ef5563cd29e
SHA256: 55aa17d69ccf568d0be0bcfd9dd13f6436424af0a44e7956be18f9cfc1004259 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\PowerPoint\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Proof\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Protect\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Protect\CREDHIST - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Protect\CREDHIST.CRAB MD5: e33260e697cae0b0bee3481867466e28
SHA1: f544a07d5fad4e16208ff1515a93adc3ac419d9b
SHA256: 08982d6a8ee2dde1b30ecd0303a78ff3be01adacf32239878e2006125bd8037a 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Protect\S-1-5-21-1462094071-1423818996-289466292-1000\2bee18a0-05e9-4ff8-a362-afe43ec984b0 - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Protect\S-1-5-21-1462094071-1423818996-289466292-1000\2bee18a0-05e9-4ff8-a362-afe43ec984b0.CRAB MD5: 263dd7b7f80d339239f7d99d234a2b83
SHA1: c113191ae14d189c607556761d1527aaf3a569cb
SHA256: 466dd1844f2540341411028b79e624bc5eb7b73d62b5abee57d0e6b6a15e6f77 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Protect\S-1-5-21-1462094071-1423818996-289466292-1000\496f2c5b-a90f-4380-b805-3bf6ac63451b - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Protect\S-1-5-21-1462094071-1423818996-289466292-1000\496f2c5b-a90f-4380-b805-3bf6ac63451b.CRAB MD5: 3c64c47a09ef59ff30604b2d5cf5df63
SHA1: 5c7a5e877e59de50fe15d724a87d10190884c170
SHA256: a7a37b69648e207c868c1fbf4e96f1fb29c5de3f06f8e2a27f9d76cb4cdcb111 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Protect\S-1-5-21-1462094071-1423818996-289466292-1000\5b8a3202-35dc-4437-b5d7-374f5e872415 - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Protect\S-1-5-21-1462094071-1423818996-289466292-1000\5b8a3202-35dc-4437-b5d7-374f5e872415.CRAB MD5: 853f897e599aadb4a1461dcf3a04e884
SHA1: 426aab5b2c08e3d1849efcf2f809813a36e6ff14
SHA256: ce1c6fa3dbb3ca8c6e14588cdbd2e8f3b7d4991d48d0ee0b2196a61811579e2a 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Protect\S-1-5-21-1462094071-1423818996-289466292-1000\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Protect\S-1-5-21-1462094071-1423818996-289466292-1000\d7746ecf-458e-4e71-8557-8ac80457022a - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Protect\S-1-5-21-1462094071-1423818996-289466292-1000\d7746ecf-458e-4e71-8557-8ac80457022a.CRAB MD5: 30ae3c733cae8363332e9e2a37fe63d6
SHA1: 92c6a0915bf33999093c5cc58b2488134a2d6b31
SHA256: 0e86892a4a26faebfcea454688d3a2087543a794e25494eae57abff4b5b434c5 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Protect\S-1-5-21-1462094071-1423818996-289466292-1000\Preferred - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Protect\S-1-5-21-1462094071-1423818996-289466292-1000\Preferred.CRAB MD5: ffa8eb28ac620dc777e9b8ddbcaf3f70
SHA1: c85e747b928c3bce8144023408d0a5cfd8b13b0a
SHA256: a81225083c4423b8316115bcfe40c36deb9b1682c0c5ac1f8afbbf054a2cdfc7 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Protect\SYNCHIST - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Protect\SYNCHIST.CRAB MD5: 6a47810b43acdedb259761d829215859
SHA1: 65755d46c9753b241a7f788068affc3f3dd27fad
SHA256: 83b8a77f3f0748fd97dd98036662ab26a9655db203776c8943fea1a5f9c812a8 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Publisher Building Blocks\ContentStore.xml - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Publisher Building Blocks\ContentStore.xml.CRAB MD5: 56543dbf9cede5816094ce0471b8ca96
SHA1: 559bc0a6706442da09704fff3cae3b8ab61918da
SHA256: 9d0854ed89ee4e1a4e3f8df81b2943e7b5f8f53b645e58b2b94068ba6c0df8cb 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Publisher Building Blocks\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Publisher\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Speech\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\SystemCertificates\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\SystemCertificates\My\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\SystemCertificates\My\CRLs\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\SystemCertificates\My\CTLs\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\Calendar insights.xltm - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\Calendar insights.xltm.CRAB MD5: 4bbb076010beca28c800066082403ae3
SHA1: 35805ed2c3bb4e43a539b41db78dd7d38ca61b1a
SHA256: 99a07901769d6b0a4add7464b40f10523bf104bf38f26eb57c8c0cc60beda782 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\Cashflow analysis.xltm - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\Cashflow analysis.xltm.CRAB MD5: aafd1a8c1bdc3a02d046047423372792
SHA1: cc73dfed07a1141322f9df25a1a3c20d7ba077a6
SHA256: cd8d6fae0b34bb44d443028137c51f07929934450ca823848137888e130d9d54 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\Email Insights.xltm - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\Email Insights.xltm.CRAB MD5: e2e4764cb05885c4c939eb04078c6162
SHA1: 0b51e0fd9edf5408109a5a51f8b88a24a29317d2
SHA256: e90537aa2c6aef41c38ac48ae9d741a789d835eaa2921670186218638ba8bb60 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03090430[[fn=Banded]].thmx - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03090430[[fn=Banded]].thmx.CRAB MD5: a460c47aeea26c2823b65f2eae2a22cd
SHA1: 7579f311e3b7978dc029563f68d217060339594b
SHA256: 662379a2bbc473f1e3d8e64a12888ba2eb38da266861f35547556e21e12a554a 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03090434[[fn=Wood Type]].thmx - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03090434[[fn=Wood Type]].thmx.CRAB MD5: a1ed4fc22d3694254376f560990212f8
SHA1: d5284dc822318c6a470477849118ea53eef2f2ba
SHA256: e381bad358bf3fc6e3d87e4f4b7a17589b4f89e564fc82cb671b8f5edcf50548 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457444[[fn=Basis]].thmx - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457444[[fn=Basis]].thmx.CRAB MD5: dca1ec9e6070fdd76b4aa28f1d596cf0
SHA1: 33701040bcdc81d07ce7a7c3b85ad91f1416740c
SHA256: da10ea6f99f516d84dc6e49e6131572b664d8e2730a8c55dbe4dac7b4ba86dd2 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457464[[fn=Dividend]].thmx - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457464[[fn=Dividend]].thmx.CRAB MD5: 086b745fa9f70cf724dccc72e123f3ee
SHA1: ef11726f16ed826c558213dc121c2aaca2f3a13b
SHA256: 44962559070034fa2c69d1fa7eaa2ed76a32f7f22e33f963a1c5dd02d1d5d8ec 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457475[[fn=Frame]].thmx - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457475[[fn=Frame]].thmx.CRAB MD5: 29aa7cb19c4e87c1e0b05f07a8b3fc7f
SHA1: a7a75157f17aba4991051904210b5e045d364342
SHA256: 725af70bef554bd9a51372cb98bb2183de6831d7615de241018e3ace966556ee 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457485[[fn=Mesh]].thmx - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457485[[fn=Mesh]].thmx.CRAB MD5: 6a0523ddb837ded9b9abd29b101ff964
SHA1: e1a32c24b2fa69ab3bd6745d0a8e65c28996e5fc
SHA256: 45845682f9b471c786cc8042a9ff77b2ec4007558fa9e78d3005ebf7ec0b2a60 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457491[[fn=Metropolitan]].thmx - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457491[[fn=Metropolitan]].thmx.CRAB MD5: 0727161699fa06e693c748ec6e6689db
SHA1: a1bc091cd24824ffab06d13262f2743d0c980f40
SHA256: 98dde0efd23feaa29d853065794f7a63311568d3e7d77f49dca946bdd0e3d2a5 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457496[[fn=Parallax]].thmx - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457496[[fn=Parallax]].thmx.CRAB MD5: 17bffcce12bff7bd31b79a431904b969
SHA1: c309c6feedb7c87daf9ed8b45a49f359fb366eb6
SHA256: afc402a04b4db0060079a0dd525623c5456bfee6114ceb8a55bc977712050ff6 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457503[[fn=Quotable]].thmx - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457503[[fn=Quotable]].thmx.CRAB MD5: 2a68b269820f668bb2b7ac3920d7325a
SHA1: a0461f44e5a37b0f403ba94f24f4d8864ec87939
SHA256: 516521d26e6c2105ea22119de4100b2e1e2909a04bc775bebcd9d1ab4aedd676 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457510[[fn=Savon]].thmx - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457510[[fn=Savon]].thmx.CRAB MD5: 6287da3ef6b46e47291d95ad28998088
SHA1: 6a492e57ce162d0fa6a8eb79e8ae3dcb70cb009a
SHA256: 864b33bac82959e9c0712aed203c62d68ab6dbd0f7e8bef85e38c6eeb0fc1922 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457515[[fn=View]].thmx - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM03457515[[fn=View]].thmx.CRAB MD5: 9f55f8673acba92f6c949fb24313aad7
SHA1: 57e049b816a676e1b431c993649b2e4b8a05be96
SHA256: 8eb412d29c90058facc9081354c733050779e0249164b23c1c4718592d0603ce 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033917[[fn=Berlin]].thmx - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033917[[fn=Berlin]].thmx.CRAB MD5: bca46f4d814649098da197788588fada
SHA1: 0e064a80fbc1a445b128166130f506568cbece0c
SHA256: 11a46089125e0c566ab6775710c75fcaba467ee42e26a230a302518c42a5c105 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033919[[fn=Circuit]].thmx - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033919[[fn=Circuit]].thmx.CRAB MD5: 34a1947a0801dc17406c0f93298d3344
SHA1: e906487821586696e9ee07c989ef507102853228
SHA256: d1d5cf429d60a63024df22188bc4d83a4e70ac27db8d83004b92a62c2fafd30d 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033921[[fn=Damask]].thmx - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033921[[fn=Damask]].thmx.CRAB MD5: 87f3343e4fa6b1075a4a6dda370ae4ef
SHA1: 7c9dc78324bd90528d700a2697f4622c1ebf166e
SHA256: 4b763633d94080af1e94f70fa03f02a032d2441ec857ceba86026dcf4557e121 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033925[[fn=Droplet]].thmx - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033925[[fn=Droplet]].thmx.CRAB MD5: ff9a0134b66d23d2d391e81d74b9da4c
SHA1: 851ff8117c36f3b5a534d7323673d3bdda6c1816
SHA256: f22aa22a42f7d88fd6e53644891547b2db66f6911d6f7f9d5c28e0226cbd0415 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033927[[fn=Main Event]].thmx - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033927[[fn=Main Event]].thmx.CRAB MD5: 811fe4f8f3551b10c3b288af1df6f4e4
SHA1: 8f61501425a2e27f87fd964f1b5acaecc0295904
SHA256: ed2503ccf496978f87aa2ae6bb873fb368097d6015b20b0fc0f8a9fff35320d9 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033929[[fn=Slate]].thmx - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033929[[fn=Slate]].thmx.CRAB MD5: e3ef62246d153a0248ef13cac5ce313e
SHA1: 7fa265a039078dcf59e3e57bdcbd96a62b437c97
SHA256: 871a1b45ea01805fcac5da6238a7a57f1e9ad23a2a52529a5b491e12094da9fe 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033937[[fn=Vapor Trail]].thmx - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM04033937[[fn=Vapor Trail]].thmx.CRAB MD5: 1a94e709ec47286968495a1e6a9e394e
SHA1: b6b4dd4cbf8a8800a704257063a1f854677bf24c
SHA256: b1c66ed8e4b904906b7b9dfb8c76044dfd19faef64827b1364c55cfa149647a0 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM10001103[[fn=Headlines]].thmx - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM10001103[[fn=Headlines]].thmx.CRAB MD5: b87c44634d59b40b0d08f1a26d23b89b
SHA1: d59cffac4af7d3db894e6b58c6e347907c7b09b8
SHA256: 70bec1ff8c9e618328760545d5fd4e667b97a990c825c8ca9f82f9f6492b5617 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM10001104[[fn=Feathered]].thmx - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM10001104[[fn=Feathered]].thmx.CRAB MD5: cc31a460bf806c1a60ef66530c5c6e62
SHA1: 762b32766df675ac722f8b0dd0e6472c1abd2a3c
SHA256: 3444320e6b538a9563af27c85900f43a577f142008ebd2ce7a05769dd414c84a 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM10001105[[fn=Crop]].thmx - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM10001105[[fn=Crop]].thmx.CRAB MD5: 6d9bea2525934483f38de564ef9152fb
SHA1: 25459981954281794c7c32fcb145fb2c7c24f62a
SHA256: d871044e5f2c8122fe8682ceefaf5c41f3c0411eafefcaf9ea014f8f34733b88 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM10001106[[fn=Badge]].thmx - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM10001106[[fn=Badge]].thmx.CRAB MD5: eb6956b567d3cb161775b38264a69d46
SHA1: d6302bf5550b2df8fded165597c82b4b9282afad
SHA256: 8b156f86bb4a9e14febdf95965a2aee9d3cc10890aecdcaa41362ca60b684338 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM10001114[[fn=Gallery]].thmx - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM10001114[[fn=Gallery]].thmx.CRAB MD5: 09fba22ccdbbd5e9727d33297c512d93
SHA1: 5c1adeda5f78fbaf9ff751165fd421a43a466a62
SHA256: 96d94f8256e2396032dac04f1f5c2fdf7181c17230e5448865193377ce18297e 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM10001115[[fn=Parcel]].thmx - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\TM10001115[[fn=Parcel]].thmx.CRAB MD5: 05d45c4912a07008dd8ff74c5bdbd264
SHA1: acfbeafab51722807d153d465257da55fed169f4
SHA256: fc8bda262788332ba541e8cf887a62b3d0c0b029a7587d7e8b26a9e2c98f2696 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328884[[fn=architecture]].glox - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328884[[fn=architecture]].glox.CRAB MD5: 573a188e1e8bacab9835fb24b43d5197
SHA1: 9d0a837cdf55dd95ac8e95ee889df162335a4aa2
SHA256: 0bcd27e4236428956699b226bd5389c532ddb301d6620359104f6b141dee19b2 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328893[[fn=BracketList]].glox - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328893[[fn=BracketList]].glox.CRAB MD5: 941bc2f4151b3ed9036f5b3368d6d9da
SHA1: fcc833319ecbe400e8ba68c12dc16ad45f1f6c4a
SHA256: 815134c93cc7f0b380d8c3ab9126dbb200d634df468f5407cd3da6c075e55ab1 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328905[[fn=Chevron Accent]].glox - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328905[[fn=Chevron Accent]].glox.CRAB MD5: cd859ddb9c70bd5001be20406e2df3ec
SHA1: 6cf307388b8b389a8dcfb2df8d1f7c1407c56dcc
SHA256: 1b5cbe6160f58a2adcefb037ef7a25e465ef638ee0a07d5ca72f339ea267bbef 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328908[[fn=Circle Process]].glox - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328908[[fn=Circle Process]].glox.CRAB MD5: 371585d6e5b6f9eb7f311940abf87416
SHA1: 57e649659ec989829e9128762f1f7a8b0073e4c1
SHA256: 6329a05ea923c5b300ee4149130cb8190bab7705f88dca15b654070d8e55c65a 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328916[[fn=Converging Text]].glox - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328916[[fn=Converging Text]].glox.CRAB MD5: c6550e85d9e01aad6a583ca60dcf76d6
SHA1: 9a8deefd26082ea58ced2381351fa19222db84e6
SHA256: 1baccac113e2c180bc96dfe546039523417a47e4b7d1817e28ee3d5d3f647df9 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328919[[fn=Hexagon Radial]].glox - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328919[[fn=Hexagon Radial]].glox.CRAB MD5: 49ee0c17ba11d86b1409b9850b7270f0
SHA1: 37958796c416f518feeef71fc8d179115165e679
SHA256: d0bbbb96daf29fe3f27f18c795e55254619b7cb95c762b902556b18dd58e8b62 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328925[[fn=Interconnected Block Process]].glox - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328925[[fn=Interconnected Block Process]].glox.CRAB MD5: 9cb82e00614a8cfc963702afc3753b73
SHA1: 72cf6f9ce0b71d4373ffb50937a8db03ab57414e
SHA256: 259b6731ab2d1aaa3eaff3ad4f0ea8fc79e7792c5ffdf0974eb9eec2db3d13ac 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328932[[fn=Picture Frame]].glox - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328932[[fn=Picture Frame]].glox.CRAB MD5: 6eadfb64e7fbd29ead2c579c91371619
SHA1: cdb5d74d9e1cb217b9a738eb4dbdd34045c493e1
SHA256: 3e126687f69bbb24e64be0804a7d446ce7bd6df9461f97e5249d7db248311574 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328935[[fn=Picture Organization Chart]].glox - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328935[[fn=Picture Organization Chart]].glox.CRAB MD5: 43f1c80a716115c7873efcec0f17e9f7
SHA1: 60584563a3948468fd9a2b911a57e735fb7518fc
SHA256: 24ce49282030c17aa86a7c737f3a6529f3ec9a49511bdf86e57e42cd374f6220 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328940[[fn=Radial Picture List]].glox - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328940[[fn=Radial Picture List]].glox.CRAB MD5: 3c677cad9c8902cc6a4516c8a80b5891
SHA1: ee58a0ba281d7c03dae0c0194f053e2d59433004
SHA256: f5809065f63f64fe21ef55c7708c027ffff460035d4facefddb0f0d4f757612a 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328951[[fn=Tabbed Arc]].glox - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328951[[fn=Tabbed Arc]].glox.CRAB MD5: aa2e671200612d8688dedeb0b2454717
SHA1: c508b8c648ae7826e044d565d4c2de2f5cfd3c72
SHA256: f4ed3af89971a480b97d07222cd73c7d345ea1eb63472b0f4d930507f1fa7e1d 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328972[[fn=Tab List]].glox - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328972[[fn=Tab List]].glox.CRAB MD5: 5b91225625c2f8a750f8c31857b3d03f
SHA1: 81239c47d3fce80eab6ea797d905f31238f73555
SHA256: e6c265cfe4974f049a8c137e72d1ac73c3e4fe924771a6c38d0b1065553bca3e 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328975[[fn=Theme Picture Accent]].glox - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328975[[fn=Theme Picture Accent]].glox.CRAB MD5: 27c072c9c2262188a90ea7c6445580be
SHA1: 82a5b97d4befa0c31443bcf2bc869ed6fbc11f2b
SHA256: 6e09ddf3c6794aae03a462357def841709a2e09cde17f977e494aeb2a5466d98 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328983[[fn=Theme Picture Alternating Accent]].glox - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328983[[fn=Theme Picture Alternating Accent]].glox.CRAB MD5: a8e99e0621051bebf0edeb32a2322cb8
SHA1: da7a56722b01e000a4d60404f49b04006fa997c2
SHA256: 3dca1c4ff1baa5ae81b1b6d066f2ae8efd2487acb07646c34ac74d6d125daafd 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328986[[fn=Theme Picture Grid]].glox - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328986[[fn=Theme Picture Grid]].glox.CRAB MD5: d0803a1397d0ef0a607b42fca60480f5
SHA1: af68b6ff60c395694b26d5f50c589e9a3c4f44af
SHA256: a28428e3facc10e125826f6ae7630954ec3c28ecab6de32d23fe5822d7552df9 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328990[[fn=Varying Width List]].glox - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328990[[fn=Varying Width List]].glox.CRAB MD5: 0364a244657afdd3b6e253017b797d8b
SHA1: 57f2e9ecc924ee05e26ce425082e31abdaf3b686
SHA256: bbb0be6f960687ae2e25902b765afd6c47e7db9af66934eee7ff5994127e3894 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328998[[fn=Rings]].glox - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\TM03328998[[fn=Rings]].glox.CRAB MD5: 9e012b5185e39a3b1511b272800ed11a
SHA1: 5cdb61849e565d4ad9fb8efc4ed70612a6c757ad
SHA256: 029c35a08d3d8a1242c3f6fc51cf404c797532a457ad45ccfedca1685caeaeab 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\User\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\User\Document Themes\1033\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\User\Document Themes\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\User\SmartArt Graphics\1033\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\16\User\SmartArt Graphics\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\LiveContent\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\Normal.dotm - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\Normal.dotm.CRAB MD5: 9e0aac0ff25bc9ea51220b795bb16a5c
SHA1: ad8436a5fff9c2d9edd56700b41b82907f0f3a43
SHA256: a162c8b4afb32d730661713edd17a106cda46236142f6e59bea66e8f4d7cbbd6 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\Process Map for Basic Flowchart.xltx - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\Process Map for Basic Flowchart.xltx.CRAB MD5: 929b5339511da21b305abf06cc8c6d06
SHA1: bfd3bf38a0e30cafb4a75cdae8256746cf1a0ee4
SHA256: 0a3099d09838dc9e7348288268a5a821492c4435bbd86126a69c3500289ba312 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\Process Map for Cross-Functional Flowchart.xltx - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\Process Map for Cross-Functional Flowchart.xltx.CRAB MD5: b0dd5be59b66ffdc04917a34e2b119b9
SHA1: 68fc685162acc17bd75fba3a2016b50097e3e74a
SHA256: 65461b81b752af965419a79b9e20541e92286212436749b0876bb8c72b2840d0 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\Stock symbols comparison.xltm - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\Stock symbols comparison.xltm.CRAB MD5: 2f8a6df18f29d15406e5969050e4ded5
SHA1: ce23ddc1041085b3ea8ce34f3f1dcefc0882b9e1
SHA256: 1699a8aacb9b3b401928e2b3527dd14b62bc78da75aa360000db5c47e9dfc62f 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\Welcome to Excel.xltx - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Templates\Welcome to Excel.xltx.CRAB MD5: ec83bf408d850121ef3732b06fd8ebfb
SHA1: 6ece5e589941c61cde1df5e9cebc662399cb1d29
SHA256: a38ac565ead58459e48ea3e01f95d78bc04c68b712b207f06acdc8f8e5ad5728 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\UProof\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC.CRAB MD5: e1ca960a724c60bd3c4770d451f7ead8
SHA1: 58f217eff689235b8fb6399b6e33c24b7364da12
SHA256: 1c4ad1deaed832b7ead9f421b5ff92783e26c3d6f56a9d63243f663e595b7382 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Vault\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Word\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\Word\STARTUP\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Extensions\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Crash Reports\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Crash Reports\events\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Crash Reports\InstallTime20170518000419 - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Crash Reports\InstallTime20170518000419.CRAB MD5: 9b4c57b3a3fe71a4489507604e8ba9d3
SHA1: 9fb7b037e7440a5391f3da1ea02eedf66eb0c4a3
SHA256: b6671d35c8c0eb9d4fa263f0e2984472038147bf7c3fa921c7389e0aaaba665a 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\profiles.ini - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\profiles.ini.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\addons.json - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\addons.json.CRAB MD5: 40db0ba19ff6e428582f71c2ce2ae386
SHA1: 87b77690eeda068e41b15bea55b10d481b799f51
SHA256: d3b62d716e8b3bb24d469ce9ce0981f36ffd79305e673088029f2d064d8be572 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\blocklist-addons.json - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\blocklist-addons.json.CRAB MD5: e0180764995ff8247f6679d4be36f734
SHA1: 3c27201da8660c7cf779f0bd90bea10c878e365e
SHA256: 59d9863f90ab095823450eeddbdd48696a27882abea59711dcae68dc664fd9e9 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\blocklist-gfx.json - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\blocklist-gfx.json.CRAB MD5: 772ab337d819069fef2e59397407451d
SHA1: 891323e22893ab7e99495999acbd7bb9d8c2507d
SHA256: 9965d0e6557761a9f122577189df8a788a550de9463dc4c14bb9073564ad4012 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\blocklist-plugins.json - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\blocklist-plugins.json.CRAB MD5: c2ee76c017c8e618bf9474bbb4eb947e
SHA1: bc80bb9dd4b3e60d0f62554409d2952630fef544
SHA256: c538802c1f27842dfe4fdf23330d67f6ddf760183a976d65f135694b74b622d4 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\blocklist.xml - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\blocklist.xml.CRAB MD5: e27cf6876f2c7e23576a533128b1921a
SHA1: 301760d2d562e19dc3eb77a45f8e2b0b3f8fc99d
SHA256: 5ffa0c351aed0a6b810b8f68af43d931da1d52dbe2ecadbdb5f6b7289185dcc6 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\bookmarkbackups\bookmarks-2017-05-24_14_kL0o5I+exwq3TXuLDkMF9w==.jsonlz4 - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\bookmarkbackups\bookmarks-2017-05-24_14_kL0o5I+exwq3TXuLDkMF9w==.jsonlz4.CRAB MD5: 9dfcb3941994104aba4b87b240f96ae1
SHA1: c050bbed788ce9e8e712475dc12cc8af87b30268
SHA256: 378286578fc4cdf4a51c2bb2370fe26aecf3509f21f627c67b5a466d43556309 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\bookmarkbackups\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\cert8.db - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\cert8.db.CRAB MD5: 5e7acd6476419852bf19613da56a29b0
SHA1: b69ef31af2930c8b7d35063f154b2d72ec8d02cd
SHA256: 2e922c83dd9aa50dae5bcad23df886c1029550bd86afa64dbbe3abd5007fba9b 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\compatibility.ini - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\compatibility.ini.CRAB MD5: 6b6d66ec736533313b0584d81d89b1d7
SHA1: 25d44e0e3b44a515679c9a266d180ab483e9cb8a
SHA256: 830c996bb0ea41ece9901595747718ebe7c9e64311957ac3772ce1571cac8085 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\containers.json - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\containers.json.CRAB MD5: d861c5af6c5a8b09400eda3406d8193e
SHA1: 4c3b672a681bd5d204ded429d4ce6a8d92fdfa01
SHA256: 3394b4a6f107bc0bdae3a0f6aa7edabf11a1a9f255d31f686a1353daefbc0562 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\content-prefs.sqlite - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\content-prefs.sqlite.CRAB MD5: 3bc428ba34128305a6e90058557d75d5
SHA1: ebed683cfef7df63c3e89108d09ada399c6134ce
SHA256: c952c89ed8339c125391ed313554c18203ae5c6167323a4716e08703c5c9d212 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\cookies.sqlite - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\cookies.sqlite.CRAB MD5: 6be884cb970d80dc4c5e0946d06ab59d
SHA1: d9cdc9f5ce7eb8fc6a5d4915c52c126abe694ba4
SHA256: 11cc3d3eecc347e2e0e20d6b578d0633c349a4cf821d8e4fda778d3de0c945fe 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\crashes\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\crashes\events\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\crashes\store.json.mozlz4 - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\crashes\store.json.mozlz4.CRAB MD5: 3b297cb2bb0414b4c92765be86b2081d
SHA1: f3a60b1e0b93605efb2bbaee7c018225cc9dd03b
SHA256: f1e70928df1fc12953c813986c4afac63882b9b54e9ad8ad5a462ff0a49e6b0a 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\datareporting\archived\2017-05\1495592260754.fe0bc3a3-866c-458a-ad46-a730981653d6.main.jsonlz4 - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\datareporting\archived\2017-05\1495592260754.fe0bc3a3-866c-458a-ad46-a730981653d6.main.jsonlz4.CRAB MD5: 6ea171bcc2b10342881641359f3e5d3e
SHA1: d55402a0f3ed304b6895beb858b44697f0935143
SHA256: 31e2f41e548243599cf5c9ff57c4394c7760ca9e240f34936853da10bd8f9087 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\datareporting\archived\2017-05\1495592289365.f6bd7dec-4421-47ce-b829-1080689ec7ca.main.jsonlz4 - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\datareporting\archived\2017-05\1495592289365.f6bd7dec-4421-47ce-b829-1080689ec7ca.main.jsonlz4.CRAB MD5: ea78f2756f105db21ae259d0bcd11901
SHA1: e8e4ddb0d032754e95e7080f4307e26424374a48
SHA256: d903387cfcc6c18fa46b35571d4c60b4bc26bf15379a88a808af8d667a42ea4c 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\datareporting\archived\2017-05\1495596278120.31e5ce24-c2bf-486b-b29e-534113b7c6dc.main.jsonlz4 - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\datareporting\archived\2017-05\1495596278120.31e5ce24-c2bf-486b-b29e-534113b7c6dc.main.jsonlz4.CRAB MD5: 5bc3bdac761c21e06dd15218d551945e
SHA1: 7e85eebf32f421a2648a77dc25d6a90ac67902ca
SHA256: 9c2be6386d97b014bc97a4479dd2708e0a08c07a05b48d9c63aeb8fb1b9ca10d 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\datareporting\archived\2017-05\1495597242414.2e462298-aeda-4ee5-bf23-a73bdf74947f.main.jsonlz4 - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\datareporting\archived\2017-05\1495597242414.2e462298-aeda-4ee5-bf23-a73bdf74947f.main.jsonlz4.CRAB MD5: 763edc1b585093524fbd7372eb64f4f8
SHA1: a6bbf62c17abbc44380eb8c5e68b93e72266fff2
SHA256: 7fcabe18e778912bead3788d194f33d92212bf62e25c8ce7b2dc8809cd5eb5b5 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\datareporting\archived\2017-05\1495597261897.a7b36bf3-f762-448c-874e-9388e91739b4.main.jsonlz4 - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\datareporting\archived\2017-05\1495597261897.a7b36bf3-f762-448c-874e-9388e91739b4.main.jsonlz4.CRAB MD5: 4e921961043cbbeccd9a3ecb1142baa9
SHA1: 4b31567c70c8d7b2493a858b2ed5070497031eb8
SHA256: 7c25de750ff3d7d9732557f0db16cf2bcf07d0fa0962b3e51c46c2ce66ac8302 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\datareporting\archived\2017-05\1495599783008.23c86977-85eb-412a-ae39-c4c6ea9a5744.main.jsonlz4 - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\datareporting\archived\2017-05\1495599783008.23c86977-85eb-412a-ae39-c4c6ea9a5744.main.jsonlz4.CRAB MD5: 419b1675bbf8cc512e4f4d405e2607da
SHA1: 36cb9a00f85e5676518068cb2ff7203e2a1daddf
SHA256: 9178a248357e4ade1b3fd840f10cbcb4ad2232d646fdcd5d53f6539d48e527fb 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\datareporting\archived\2017-05\1495600032629.d896fec9-1a7a-4db1-a3a2-e46d95b631a5.main.jsonlz4 - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\datareporting\archived\2017-05\1495600032629.d896fec9-1a7a-4db1-a3a2-e46d95b631a5.main.jsonlz4.CRAB MD5: c29a0978622b36ead5d18087907044ae
SHA1: ff26824ed752e59a84379a022009758c4b221c07
SHA256: 370509354b74bcbe77964c40f82dfa074dd1ec4fc752269f0efcbfd2b8f41344 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\datareporting\archived\2017-05\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\datareporting\archived\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\datareporting\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\datareporting\session-state.json - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\datareporting\session-state.json.CRAB MD5: c8b1038658078b06c8f1193a73df769d
SHA1: dd810317389a165d94dca13b1605374ae44d3120
SHA256: 549f42dd91621c5d7a6eb68d3480878098530fcc66dd393729726944fbcdbc69 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\datareporting\state.json - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\datareporting\state.json.CRAB MD5: ef053f7613985d2c3755f506a5a97415
SHA1: 46bc4ebd8c00911d5729f17d5738b0777ccacb76
SHA256: e683bcad5f5d159ee51df95c8daf87a22e24818be522722b1ae8a4c33d515149 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\extensions.ini - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\extensions.ini.CRAB MD5: 5588bbbb0cf9ab783cc8bbb7ad43e8d7
SHA1: cbee9e0e3ac2e41957615c45eefd6a8155353aa1
SHA256: fa7afc9fa2c00f89c25b8b17e05afb4867380c1a69599622f477d0557d31dbeb 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\extensions.json - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\extensions.json.CRAB MD5: 8bf3d5fb7bfe2cf57286f05e6efd3bcb
SHA1: ea843ecca836736b0433e3ad0f4b1a7e912280ce
SHA256: 60282d27e9263559a3190f59d8a4cd01d0a12bfa3414fb725c934b55a8b8a621 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\formhistory.sqlite - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\formhistory.sqlite.CRAB MD5: b65db1612370e5243f239f7ddb578586
SHA1: 8cec9133c38c031c04541ad2669023a07c44901f
SHA256: 080a928b635fe1a2e7d8799009b04bc41e9d04dd72a748ad7d5174b09585bdac 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\gmp-gmpopenh264\1.6\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\gmp-gmpopenh264\1.6\gmpopenh264.info - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\gmp-gmpopenh264\1.6\gmpopenh264.info.CRAB MD5: d2402498f0132ca41b2979dec34fb29a
SHA1: f180e9b62fc83c2179ffa849c7c30d0efe030c77
SHA256: 7fc3d76c3f60778cee29cd9f4fccb81e352d356e29021fd835b1924f65608b1b 		Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\gmp-gmpopenh264\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\gmp-widevinecdm\1.4.8.903\\CRAB-DECRYPT.txt - Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\gmp-widevinecdm\1.4.8.903\LICENSE.txt - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\gmp-widevinecdm\1.4.8.903\LICENSE.txt.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\gmp-widevinecdm\1.4.8.903\manifest.json - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\gmp-widevinecdm\1.4.8.903\manifest.json.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\gmp-widevinecdm\1.4.8.903\widevinecdm.dll.lib - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\gmp-widevinecdm\1.4.8.903\widevinecdm.dll.lib.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\gmp-widevinecdm\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\gmp\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\gmp\WINNT_x86-msvc\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\key3.db - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\key3.db.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\kinto.sqlite - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\kinto.sqlite.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\mimeTypes.rdf - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\mimeTypes.rdf.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\minidumps\\CRAB-DECRYPT.txt - Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\permissions.sqlite - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\permissions.sqlite.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\places.sqlite - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\places.sqlite.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\pluginreg.dat - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\pluginreg.dat.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\prefs.js - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\prefs.js.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\revocations.txt - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\revocations.txt.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\saved-telemetry-pings\\CRAB-DECRYPT.txt - Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\saved-telemetry-pings\d896fec9-1a7a-4db1-a3a2-e46d95b631a5 - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\saved-telemetry-pings\d896fec9-1a7a-4db1-a3a2-e46d95b631a5.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\search.json.mozlz4 - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\search.json.mozlz4.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\secmod.db - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\secmod.db.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\sessionCheckpoints.json - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\sessionCheckpoints.json.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\sessionstore-backups\\CRAB-DECRYPT.txt - Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\sessionstore-backups\previous.js - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\sessionstore-backups\previous.js.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\sessionstore-backups\upgrade.js-20170518000419 - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\sessionstore-backups\upgrade.js-20170518000419.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\sessionstore.js - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\sessionstore.js.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\SiteSecurityServiceState.txt - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\SiteSecurityServiceState.txt.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\storage.sqlite - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\storage.sqlite.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\storage\\CRAB-DECRYPT.txt - Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\storage\permanent\chrome\.metadata - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\storage\permanent\chrome\.metadata-v2 - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\storage\permanent\chrome\.metadata-v2.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\storage\permanent\chrome\.metadata.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\storage\permanent\chrome\\CRAB-DECRYPT.txt - Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\storage\permanent\chrome\idb\2918063365piupsah.files\\CRAB-DECRYPT.txt - Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\storage\permanent\chrome\idb\2918063365piupsah.sqlite - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\storage\permanent\chrome\idb\2918063365piupsah.sqlite.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\storage\permanent\chrome\idb\\CRAB-DECRYPT.txt - Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\storage\permanent\\CRAB-DECRYPT.txt - Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\storage\permanent\moz-safe-about+home\.metadata - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\storage\permanent\moz-safe-about+home\.metadata-v2 - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\storage\permanent\moz-safe-about+home\.metadata-v2.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\storage\permanent\moz-safe-about+home\.metadata.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\storage\permanent\moz-safe-about+home\\CRAB-DECRYPT.txt - Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\storage\permanent\moz-safe-about+home\idb\818200132aebmoouht.files\1 - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\storage\permanent\moz-safe-about+home\idb\818200132aebmoouht.files\1.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\storage\permanent\moz-safe-about+home\idb\818200132aebmoouht.files\\CRAB-DECRYPT.txt - Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\storage\permanent\moz-safe-about+home\idb\818200132aebmoouht.files\journals\\CRAB-DECRYPT.txt - Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\storage\permanent\moz-safe-about+home\idb\818200132aebmoouht.sqlite - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\storage\permanent\moz-safe-about+home\idb\818200132aebmoouht.sqlite.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\storage\permanent\moz-safe-about+home\idb\\CRAB-DECRYPT.txt - Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\times.json - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\times.json.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\webappsstore.sqlite - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\webappsstore.sqlite.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\xulstore.json - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\8i341t8m.default\xulstore.json.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Mozilla\Firefox\Profiles\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\nPCYwUf.odt - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\nPCYwUf.odt.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\pk VyWtD0SvDXAAZW.xlsx - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\pk VyWtD0SvDXAAZW.xlsx.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Q5xtIBb.jpg - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Q5xtIBb.jpg.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\R1GjJAMZBhB.bmp - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\R1GjJAMZBhB.bmp.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\RlCCh-GO1wqgJ-bEt.flv - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\RlCCh-GO1wqgJ-bEt.flv.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Skype\\CRAB-DECRYPT.txt - Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Skype\RootTools\\CRAB-DECRYPT.txt - Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Skype\RootTools\roottools.conf - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Skype\RootTools\roottools.conf.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Sun\\CRAB-DECRYPT.txt - Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Sun\Java\\CRAB-DECRYPT.txt - Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Sun\Java\Deployment\\CRAB-DECRYPT.txt - Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\svdQucS_.bmp - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\svdQucS_.bmp.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\t07oBodXmsqNsVjwvA0.odt - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\t07oBodXmsqNsVjwvA0.odt.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\vP8hh9nKFzaGoMthz.m4a - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\vP8hh9nKFzaGoMthz.m4a.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\WgMk6d82qig-ExDOCd.wav - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\WgMk6d82qig-ExDOCd.wav.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\wWRbxbuPycLCx9nPPST.mp3 - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\wWRbxbuPycLCx9nPPST.mp3.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\YxJ7LmF.swf - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\YxJ7LmF.swf.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\YXyDVl5tVJHYH.docx - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\YXyDVl5tVJHYH.docx.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\Application Data\\CRAB-DECRYPT.txt - Access
C:\Users\CIiHmnxMn6Ps\Contacts\Aclviho ASldjfl.contact - Access
C:\Users\CIiHmnxMn6Ps\Contacts\Aclviho ASldjfl.contact.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\Contacts\asdlfk poopvy.contact - Access
C:\Users\CIiHmnxMn6Ps\Contacts\asdlfk poopvy.contact.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\Contacts\chucu jadnvk.contact - Access
C:\Users\CIiHmnxMn6Ps\Contacts\chucu jadnvk.contact.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\Contacts\\CRAB-DECRYPT.txt - Access, Write
C:\Users\CIiHmnxMn6Ps\Contacts\lulcit amkdfe.contact - Access
C:\Users\CIiHmnxMn6Ps\Contacts\lulcit amkdfe.contact.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\Contacts\sikvnb huvuib.contact - Access
C:\Users\CIiHmnxMn6Ps\Contacts\sikvnb huvuib.contact.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\Cookies\\CRAB-DECRYPT.txt - Access, Write
C:\Users\CIiHmnxMn6Ps\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access, Write
C:\Users\CIiHmnxMn6Ps\Desktop\34rcSrGk W7Hu_l0T.swf - Access
C:\Users\CIiHmnxMn6Ps\Desktop\34rcSrGk W7Hu_l0T.swf.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\Desktop\3mHfkmGglaKNYaBK9.mp4 - Access
C:\Users\CIiHmnxMn6Ps\Desktop\3mHfkmGglaKNYaBK9.mp4.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\Desktop\4_L-92figvYhCIBhrEs.doc - Access
C:\Users\CIiHmnxMn6Ps\Desktop\4_L-92figvYhCIBhrEs.doc.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\Desktop\6YKIhANz79ThqLL.flv - Access
C:\Users\CIiHmnxMn6Ps\Desktop\6YKIhANz79ThqLL.flv.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\Desktop\7i2BoLr0e_.flv - Access
C:\Users\CIiHmnxMn6Ps\Desktop\7i2BoLr0e_.flv.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\Desktop\aavQmwiw.jpg - Access
C:\Users\CIiHmnxMn6Ps\Desktop\aavQmwiw.jpg.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\Desktop\bill_87448680672-2706201981722018_4_23_b83d95.pdf.js MD5: bfab3690a906743ec191091655e00fca
SHA1: 17e645c63995a54a8e1a83856f1c571db355bd91
SHA256: e7851a1b3e93968e7f6b92a1a3f59d250402be15a5bcb3262acff1e0a27b912c 		Access
C:\Users\CIiHmnxMn6Ps\Desktop\bill_87448680672-2706201981722018_4_23_b83d95.pdf.js.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\Desktop\GU8fC-.flv - Access
C:\Users\CIiHmnxMn6Ps\Desktop\GU8fC-.flv.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\Desktop\oS9Q-aZua tTeFXYxb.mp3 - Access
C:\Users\CIiHmnxMn6Ps\Desktop\oS9Q-aZua tTeFXYxb.mp3.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\Desktop\PA9T.m4a - Access
C:\Users\CIiHmnxMn6Ps\Desktop\PA9T.m4a.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\Desktop\qO-hImZ4SPYdB.png - Access
C:\Users\CIiHmnxMn6Ps\Desktop\qO-hImZ4SPYdB.png.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\Desktop\rQp9g527R.swf - Access
C:\Users\CIiHmnxMn6Ps\Desktop\rQp9g527R.swf.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\Desktop\SiPH2MlMciWhHcAm88E.pdf - Access
C:\Users\CIiHmnxMn6Ps\Desktop\SiPH2MlMciWhHcAm88E.pdf.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\Desktop\Sxnzn9rS_0a.gif - Access
C:\Users\CIiHmnxMn6Ps\Desktop\Sxnzn9rS_0a.gif.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\Desktop\UBQHStBxOC.swf - Access
C:\Users\CIiHmnxMn6Ps\Desktop\UBQHStBxOC.swf.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\Desktop\uPzP1fSCYo9DQgW.mkv - Access
C:\Users\CIiHmnxMn6Ps\Desktop\uPzP1fSCYo9DQgW.mkv.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\Desktop\Ut30lj.mp4 - Access
C:\Users\CIiHmnxMn6Ps\Desktop\Ut30lj.mp4.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\Desktop\UwtnYLs3pX ny6EOTE.gif - Access
C:\Users\CIiHmnxMn6Ps\Desktop\UwtnYLs3pX ny6EOTE.gif.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\Desktop\WBEU1XtTlLyiky1TXdx.mp4 - Access
C:\Users\CIiHmnxMn6Ps\Desktop\WBEU1XtTlLyiky1TXdx.mp4.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\Desktop\WipFpQ.m4a - Access
C:\Users\CIiHmnxMn6Ps\Desktop\WipFpQ.m4a.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\Desktop\Y6DMc98RPkT\7MmCJyo8.avi - Access
C:\Users\CIiHmnxMn6Ps\Desktop\Y6DMc98RPkT\7MmCJyo8.avi.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\Desktop\Y6DMc98RPkT\\CRAB-DECRYPT.txt - Access, Write
C:\Users\CIiHmnxMn6Ps\Desktop\Y6DMc98RPkT\CzbfoDLAlNUP.avi - Access
C:\Users\CIiHmnxMn6Ps\Desktop\Y6DMc98RPkT\CzbfoDLAlNUP.avi.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\Desktop\Y6DMc98RPkT\eUoly2Vr92uz.wav - Access
C:\Users\CIiHmnxMn6Ps\Desktop\Y6DMc98RPkT\eUoly2Vr92uz.wav.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\Desktop\Y6DMc98RPkT\FYvItKqurN\\CRAB-DECRYPT.txt - Access, Write
C:\Users\CIiHmnxMn6Ps\Desktop\Y6DMc98RPkT\FYvItKqurN\lxPpLrs8f\372WcwC5gORqWdRTeA.bmp - Access
C:\Users\CIiHmnxMn6Ps\Desktop\Y6DMc98RPkT\FYvItKqurN\lxPpLrs8f\372WcwC5gORqWdRTeA.bmp.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\Desktop\Y6DMc98RPkT\FYvItKqurN\lxPpLrs8f\4W1rCz2FZaGS9.ots - Access
C:\Users\CIiHmnxMn6Ps\Desktop\Y6DMc98RPkT\FYvItKqurN\lxPpLrs8f\4W1rCz2FZaGS9.ots.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\Desktop\Y6DMc98RPkT\FYvItKqurN\lxPpLrs8f\AwzO3zc1AaQ7GHe13MI.wav - Access
C:\Users\CIiHmnxMn6Ps\Desktop\Y6DMc98RPkT\FYvItKqurN\lxPpLrs8f\AwzO3zc1AaQ7GHe13MI.wav.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\Desktop\Y6DMc98RPkT\FYvItKqurN\lxPpLrs8f\\CRAB-DECRYPT.txt - Access, Write
C:\Users\CIiHmnxMn6Ps\Desktop\Y6DMc98RPkT\FYvItKqurN\lxPpLrs8f\iDnxkFCeYO\\CRAB-DECRYPT.txt - Access, Write
C:\Users\CIiHmnxMn6Ps\Desktop\Y6DMc98RPkT\FYvItKqurN\lxPpLrs8f\iDnxkFCeYO\EKJCdrB.ppt - Access
C:\Users\CIiHmnxMn6Ps\Desktop\Y6DMc98RPkT\FYvItKqurN\lxPpLrs8f\iDnxkFCeYO\EKJCdrB.ppt.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\Desktop\Y6DMc98RPkT\FYvItKqurN\lxPpLrs8f\iDnxkFCeYO\fkoD1.m4a - Access
C:\Users\CIiHmnxMn6Ps\Desktop\Y6DMc98RPkT\FYvItKqurN\lxPpLrs8f\iDnxkFCeYO\fkoD1.m4a.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\Desktop\Y6DMc98RPkT\FYvItKqurN\lxPpLrs8f\iDnxkFCeYO\rjTyTcqxR\0p9klFMeAEeCug.png - Access
C:\Users\CIiHmnxMn6Ps\Desktop\Y6DMc98RPkT\FYvItKqurN\lxPpLrs8f\iDnxkFCeYO\rjTyTcqxR\0p9klFMeAEeCug.png.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\Desktop\Y6DMc98RPkT\FYvItKqurN\lxPpLrs8f\iDnxkFCeYO\rjTyTcqxR\\CRAB-DECRYPT.txt - Access, Write
C:\Users\CIiHmnxMn6Ps\Desktop\Y6DMc98RPkT\FYvItKqurN\lxPpLrs8f\iDnxkFCeYO\rjTyTcqxR\d3-dio7qxDBO-Md.jpg - Access
C:\Users\CIiHmnxMn6Ps\Desktop\Y6DMc98RPkT\FYvItKqurN\lxPpLrs8f\iDnxkFCeYO\rjTyTcqxR\d3-dio7qxDBO-Md.jpg.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\Desktop\Y6DMc98RPkT\FYvItKqurN\lxPpLrs8f\iDnxkFCeYO\rjTyTcqxR\yZ1m.gif - Access
C:\Users\CIiHmnxMn6Ps\Desktop\Y6DMc98RPkT\FYvItKqurN\lxPpLrs8f\iDnxkFCeYO\rjTyTcqxR\yZ1m.gif.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\Desktop\Y6DMc98RPkT\FYvItKqurN\lxPpLrs8f\iDnxkFCeYO\vlxRa57T5f-jpQWmW.swf - Access
C:\Users\CIiHmnxMn6Ps\Desktop\Y6DMc98RPkT\FYvItKqurN\lxPpLrs8f\iDnxkFCeYO\vlxRa57T5f-jpQWmW.swf.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\Desktop\Y6DMc98RPkT\FYvItKqurN\lxPpLrs8f\KOtSnn7.mkv - Access
C:\Users\CIiHmnxMn6Ps\Desktop\Y6DMc98RPkT\FYvItKqurN\lxPpLrs8f\KOtSnn7.mkv.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\Desktop\Y6DMc98RPkT\FYvItKqurN\lxPpLrs8f\m9IV4fI1 ZzJY7ALyqTH.wav - Access
C:\Users\CIiHmnxMn6Ps\Desktop\Y6DMc98RPkT\FYvItKqurN\lxPpLrs8f\m9IV4fI1 ZzJY7ALyqTH.wav.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\Desktop\Y6DMc98RPkT\FYvItKqurN\lxPpLrs8f\x 8ESVxb28.doc - Access
C:\Users\CIiHmnxMn6Ps\Desktop\Y6DMc98RPkT\FYvItKqurN\lxPpLrs8f\x 8ESVxb28.doc.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\Desktop\Y6DMc98RPkT\FYvItKqurN\lxPpLrs8f\yiUKc1U.wav - Access
C:\Users\CIiHmnxMn6Ps\Desktop\Y6DMc98RPkT\FYvItKqurN\lxPpLrs8f\yiUKc1U.wav.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\Desktop\Y6DMc98RPkT\FYvItKqurN\OKq7iC_s-b-Ayh.jpg - Access
C:\Users\CIiHmnxMn6Ps\Desktop\Y6DMc98RPkT\FYvItKqurN\OKq7iC_s-b-Ayh.jpg.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\Desktop\Y6DMc98RPkT\FYvItKqurN\yKH63XJp1y.doc - Access
C:\Users\CIiHmnxMn6Ps\Desktop\Y6DMc98RPkT\FYvItKqurN\yKH63XJp1y.doc.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\Desktop\Y6DMc98RPkT\oz2DPnwzpr8g_T.avi - Access
C:\Users\CIiHmnxMn6Ps\Desktop\Y6DMc98RPkT\oz2DPnwzpr8g_T.avi.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\Documents\5Mgujd5EG91KW-2y8OKV.xlsx - Access
C:\Users\CIiHmnxMn6Ps\Documents\5Mgujd5EG91KW-2y8OKV.xlsx.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\Documents\5YwX aciwKOXyxwVO3vt.pptx - Access
C:\Users\CIiHmnxMn6Ps\Documents\5YwX aciwKOXyxwVO3vt.pptx.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\Documents\aIqb k.ods - Access
C:\Users\CIiHmnxMn6Ps\Documents\aIqb k.ods.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\Documents\CeCO8Pf.docx - Access
C:\Users\CIiHmnxMn6Ps\Documents\CeCO8Pf.docx.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\Documents\ci3jryHf0yy9CjN\4nJLkQ9yMLLKuk5KM\4ih8o.ppt - Access
C:\Users\CIiHmnxMn6Ps\Documents\ci3jryHf0yy9CjN\4nJLkQ9yMLLKuk5KM\4ih8o.ppt.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\Documents\ci3jryHf0yy9CjN\4nJLkQ9yMLLKuk5KM\\CRAB-DECRYPT.txt - Access, Write
C:\Users\CIiHmnxMn6Ps\Documents\ci3jryHf0yy9CjN\4nJLkQ9yMLLKuk5KM\OiKll7QUg0rRum-.pptx - Access
C:\Users\CIiHmnxMn6Ps\Documents\ci3jryHf0yy9CjN\4nJLkQ9yMLLKuk5KM\OiKll7QUg0rRum-.pptx.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\Documents\ci3jryHf0yy9CjN\4nJLkQ9yMLLKuk5KM\OOXw bnNcCQq9 De_Y4.docx - Access
C:\Users\CIiHmnxMn6Ps\Documents\ci3jryHf0yy9CjN\4nJLkQ9yMLLKuk5KM\OOXw bnNcCQq9 De_Y4.docx.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\Documents\ci3jryHf0yy9CjN\4nJLkQ9yMLLKuk5KM\Uzf7Bg2vzl5EDNKaua.pptx - Access
C:\Users\CIiHmnxMn6Ps\Documents\ci3jryHf0yy9CjN\4nJLkQ9yMLLKuk5KM\Uzf7Bg2vzl5EDNKaua.pptx.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\Documents\ci3jryHf0yy9CjN\4nJLkQ9yMLLKuk5KM\YUuE06rq.ots - Access
C:\Users\CIiHmnxMn6Ps\Documents\ci3jryHf0yy9CjN\4nJLkQ9yMLLKuk5KM\YUuE06rq.ots.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\Documents\ci3jryHf0yy9CjN\aaeg.doc - Access
C:\Users\CIiHmnxMn6Ps\Documents\ci3jryHf0yy9CjN\aaeg.doc.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\Documents\ci3jryHf0yy9CjN\\CRAB-DECRYPT.txt - Access, Write
C:\Users\CIiHmnxMn6Ps\Documents\ci3jryHf0yy9CjN\cRq07 4X5BnevZciFsSq.ppt - Access
C:\Users\CIiHmnxMn6Ps\Documents\ci3jryHf0yy9CjN\cRq07 4X5BnevZciFsSq.ppt.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\Documents\ci3jryHf0yy9CjN\dNFKBF0QB.rtf - Access
C:\Users\CIiHmnxMn6Ps\Documents\ci3jryHf0yy9CjN\dNFKBF0QB.rtf.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\Documents\ci3jryHf0yy9CjN\Fn6uJtrJyot0QeS1.csv - Access
C:\Users\CIiHmnxMn6Ps\Documents\ci3jryHf0yy9CjN\Fn6uJtrJyot0QeS1.csv.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\Documents\ci3jryHf0yy9CjN\Ie5epaMPUcju.pdf - Access
C:\Users\CIiHmnxMn6Ps\Documents\ci3jryHf0yy9CjN\Ie5epaMPUcju.pdf.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\Documents\ci3jryHf0yy9CjN\kggfyF.pps - Access
C:\Users\CIiHmnxMn6Ps\Documents\ci3jryHf0yy9CjN\kggfyF.pps.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\Documents\ci3jryHf0yy9CjN\q8CbS\2758g.pdf - Access
C:\Users\CIiHmnxMn6Ps\Documents\ci3jryHf0yy9CjN\q8CbS\2758g.pdf.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\Documents\ci3jryHf0yy9CjN\q8CbS\8JkD6gezfe6nCdg9qJ.ods - Access
C:\Users\CIiHmnxMn6Ps\Documents\ci3jryHf0yy9CjN\q8CbS\8JkD6gezfe6nCdg9qJ.ods.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\Documents\ci3jryHf0yy9CjN\q8CbS\\CRAB-DECRYPT.txt - Access, Write
C:\Users\CIiHmnxMn6Ps\Documents\ci3jryHf0yy9CjN\q8CbS\f80SGZ.pdf - Access
C:\Users\CIiHmnxMn6Ps\Documents\ci3jryHf0yy9CjN\q8CbS\f80SGZ.pdf.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\Documents\ci3jryHf0yy9CjN\q8CbS\htVo\ArSFxbQ9WQ.rtf - Access
C:\Users\CIiHmnxMn6Ps\Documents\ci3jryHf0yy9CjN\q8CbS\htVo\ArSFxbQ9WQ.rtf.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\Documents\ci3jryHf0yy9CjN\q8CbS\htVo\\CRAB-DECRYPT.txt - Access, Write
C:\Users\CIiHmnxMn6Ps\Documents\ci3jryHf0yy9CjN\q8CbS\htVo\hByA2phraHjC83xIj\4pMXQG7lcnqL4F7LGv.pps - Access
C:\Users\CIiHmnxMn6Ps\Documents\ci3jryHf0yy9CjN\q8CbS\htVo\hByA2phraHjC83xIj\4pMXQG7lcnqL4F7LGv.pps.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\Documents\ci3jryHf0yy9CjN\q8CbS\htVo\hByA2phraHjC83xIj\9WSg2PHx2es e0t4L.rtf - Access
C:\Users\CIiHmnxMn6Ps\Documents\ci3jryHf0yy9CjN\q8CbS\htVo\hByA2phraHjC83xIj\9WSg2PHx2es e0t4L.rtf.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\Documents\ci3jryHf0yy9CjN\q8CbS\htVo\hByA2phraHjC83xIj\\CRAB-DECRYPT.txt - Access, Write
C:\Users\CIiHmnxMn6Ps\Documents\ci3jryHf0yy9CjN\q8CbS\htVo\hByA2phraHjC83xIj\FbnUFOtS8v1q89\1rnfm34W_947JMzhlLe.ppt - Access
C:\Users\CIiHmnxMn6Ps\Documents\ci3jryHf0yy9CjN\q8CbS\htVo\hByA2phraHjC83xIj\FbnUFOtS8v1q89\1rnfm34W_947JMzhlLe.ppt.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\Documents\ci3jryHf0yy9CjN\q8CbS\htVo\hByA2phraHjC83xIj\FbnUFOtS8v1q89\a1NZChI6X281vQ.docx - Access
C:\Users\CIiHmnxMn6Ps\Documents\ci3jryHf0yy9CjN\q8CbS\htVo\hByA2phraHjC83xIj\FbnUFOtS8v1q89\a1NZChI6X281vQ.docx.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\Documents\ci3jryHf0yy9CjN\q8CbS\htVo\hByA2phraHjC83xIj\FbnUFOtS8v1q89\a8Gl IC.xlsx - Access
C:\Users\CIiHmnxMn6Ps\Documents\ci3jryHf0yy9CjN\q8CbS\htVo\hByA2phraHjC83xIj\FbnUFOtS8v1q89\a8Gl IC.xlsx.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\Documents\ci3jryHf0yy9CjN\q8CbS\htVo\hByA2phraHjC83xIj\FbnUFOtS8v1q89\\CRAB-DECRYPT.txt - Access, Write
C:\Users\CIiHmnxMn6Ps\Documents\ci3jryHf0yy9CjN\q8CbS\htVo\hByA2phraHjC83xIj\FbnUFOtS8v1q89\QdJzko4w3UtTEqRj.doc - Access
C:\Users\CIiHmnxMn6Ps\Documents\ci3jryHf0yy9CjN\q8CbS\htVo\hByA2phraHjC83xIj\FbnUFOtS8v1q89\QdJzko4w3UtTEqRj.doc.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\Documents\ci3jryHf0yy9CjN\q8CbS\htVo\hByA2phraHjC83xIj\FbnUFOtS8v1q89\Zb17Uxn_tqlTLxelTlIM.rtf - Access
C:\Users\CIiHmnxMn6Ps\Documents\ci3jryHf0yy9CjN\q8CbS\htVo\hByA2phraHjC83xIj\FbnUFOtS8v1q89\Zb17Uxn_tqlTLxelTlIM.rtf.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\Documents\ci3jryHf0yy9CjN\q8CbS\htVo\hByA2phraHjC83xIj\fHpIdw_HpQqOALE9vZ2P.pps - Access
C:\Users\CIiHmnxMn6Ps\Documents\ci3jryHf0yy9CjN\q8CbS\htVo\hByA2phraHjC83xIj\fHpIdw_HpQqOALE9vZ2P.pps.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\Documents\ci3jryHf0yy9CjN\q8CbS\htVo\hByA2phraHjC83xIj\miTR57MHbEwdqQB.pps - Access
C:\Users\CIiHmnxMn6Ps\Documents\ci3jryHf0yy9CjN\q8CbS\htVo\hByA2phraHjC83xIj\miTR57MHbEwdqQB.pps.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\Documents\ci3jryHf0yy9CjN\q8CbS\htVo\hByA2phraHjC83xIj\OWZ4U.pptx - Access
C:\Users\CIiHmnxMn6Ps\Documents\ci3jryHf0yy9CjN\q8CbS\htVo\hByA2phraHjC83xIj\OWZ4U.pptx.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\Documents\ci3jryHf0yy9CjN\q8CbS\htVo\hByA2phraHjC83xIj\vgO2_0TOSav.ppt - Access
C:\Users\CIiHmnxMn6Ps\Documents\ci3jryHf0yy9CjN\q8CbS\htVo\hByA2phraHjC83xIj\vgO2_0TOSav.ppt.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\Documents\ci3jryHf0yy9CjN\q8CbS\htVo\hByA2phraHjC83xIj\vZEtpbkDfGqD.rtf - Access
C:\Users\CIiHmnxMn6Ps\Documents\ci3jryHf0yy9CjN\q8CbS\htVo\hByA2phraHjC83xIj\vZEtpbkDfGqD.rtf.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\Documents\ci3jryHf0yy9CjN\q8CbS\htVo\I2kK7YIMydRb7UFK.docx - Access
C:\Users\CIiHmnxMn6Ps\Documents\ci3jryHf0yy9CjN\q8CbS\htVo\I2kK7YIMydRb7UFK.docx.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\Documents\ci3jryHf0yy9CjN\q8CbS\htVo\SdOfLgWQgSU.ots - Access
C:\Users\CIiHmnxMn6Ps\Documents\ci3jryHf0yy9CjN\q8CbS\htVo\SdOfLgWQgSU.ots.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\Documents\ci3jryHf0yy9CjN\q8CbS\htVo\xPjU8avsXeSBHCcuF6xh.ppt - Access
C:\Users\CIiHmnxMn6Ps\Documents\ci3jryHf0yy9CjN\q8CbS\htVo\xPjU8avsXeSBHCcuF6xh.ppt.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\Documents\ci3jryHf0yy9CjN\q8CbS\kB15-ugapF9.ppt - Access
C:\Users\CIiHmnxMn6Ps\Documents\ci3jryHf0yy9CjN\q8CbS\kB15-ugapF9.ppt.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\Documents\ci3jryHf0yy9CjN\q8CbS\o41qdsUZfnIWVRmDgFd.rtf - Access
C:\Users\CIiHmnxMn6Ps\Documents\ci3jryHf0yy9CjN\q8CbS\o41qdsUZfnIWVRmDgFd.rtf.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\Documents\ci3jryHf0yy9CjN\q8CbS\W1wM4.xls - Access
C:\Users\CIiHmnxMn6Ps\Documents\ci3jryHf0yy9CjN\q8CbS\W1wM4.xls.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\Documents\ci3jryHf0yy9CjN\Sv1MjQVXPGT3ix5d RV.doc - Access
C:\Users\CIiHmnxMn6Ps\Documents\ci3jryHf0yy9CjN\Sv1MjQVXPGT3ix5d RV.doc.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\Documents\\CRAB-DECRYPT.txt - Access, Write
C:\Users\CIiHmnxMn6Ps\Documents\Database1.accdb - Access
C:\Users\CIiHmnxMn6Ps\Documents\Database1.accdb.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\Documents\EKUyDH03JGhMH20FkVD.docx - Access
C:\Users\CIiHmnxMn6Ps\Documents\EKUyDH03JGhMH20FkVD.docx.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\Documents\F1HFBG31Cjk.pptx - Access
C:\Users\CIiHmnxMn6Ps\Documents\F1HFBG31Cjk.pptx.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\Documents\gGpqTAi7ZrEJwAu.docx - Access
C:\Users\CIiHmnxMn6Ps\Documents\gGpqTAi7ZrEJwAu.docx.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\Documents\j2jwdIn1XQqie.xlsx - Access
C:\Users\CIiHmnxMn6Ps\Documents\j2jwdIn1XQqie.xlsx.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\Documents\MO1lZvBT.pptx - Access
C:\Users\CIiHmnxMn6Ps\Documents\MO1lZvBT.pptx.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\Documents\My Music\\CRAB-DECRYPT.txt - Access, Write
C:\Users\CIiHmnxMn6Ps\Documents\My Pictures\\CRAB-DECRYPT.txt - Access, Write
C:\Users\CIiHmnxMn6Ps\Documents\My Shapes\_private\\CRAB-DECRYPT.txt - Access, Write
C:\Users\CIiHmnxMn6Ps\Documents\My Shapes\\CRAB-DECRYPT.txt - Access, Write
C:\Users\CIiHmnxMn6Ps\Documents\My Videos\\CRAB-DECRYPT.txt - Access, Write
C:\Users\CIiHmnxMn6Ps\Documents\nuk9oIMMGGHJ.ots - Access
C:\Users\CIiHmnxMn6Ps\Documents\nuk9oIMMGGHJ.ots.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\Documents\ojO39Vcd.xlsx - Access
C:\Users\CIiHmnxMn6Ps\Documents\ojO39Vcd.xlsx.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\Documents\OneNote Notebooks\\CRAB-DECRYPT.txt - Access, Write
C:\Users\CIiHmnxMn6Ps\Documents\OneNote Notebooks\My Notebook\\CRAB-DECRYPT.txt - Access, Write
C:\Users\CIiHmnxMn6Ps\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2 - Access
C:\Users\CIiHmnxMn6Ps\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\Documents\OneNote Notebooks\My Notebook\Quick Notes.one - Access
C:\Users\CIiHmnxMn6Ps\Documents\OneNote Notebooks\My Notebook\Quick Notes.one.CRAB - Access, Read, Write
C:\Users\CIiHmnxMn6Ps\Documents\Outlook Files\\CRAB-DECRYPT.txt - Access
C:\Users\CIiHmnxMn6Ps\Documents\Outlook Files\lcfkj@kiekc.df.pst - Access
C:\Users\CIiHmnxMn6Ps\Documents\Outlook Files\lcfkj@kiekc.df.pst.CRAB - Access, Read
C:\Users\CIiHmnxMn6Ps\Documents\P_uUNmb.docx - Access
C:\Users\CIiHmnxMn6Ps\Documents\P_uUNmb.docx.CRAB - Access, Read
C:\Users\CIiHmnxMn6Ps\Documents\PfGUfo 2jsurl.pptx - Access
C:\Users\CIiHmnxMn6Ps\Documents\PfGUfo 2jsurl.pptx.CRAB - Access, Read
C:\Users\CIiHmnxMn6Ps\Documents\Q-6NOqG.pptx - Access
C:\Users\CIiHmnxMn6Ps\Documents\Q-6NOqG.pptx.CRAB - Access, Read
C:\Users\CIiHmnxMn6Ps\Documents\Qj54fTAb TMlYo.xlsx - Access
C:\Users\CIiHmnxMn6Ps\Documents\Qj54fTAb TMlYo.xlsx.CRAB - Access, Read
C:\Users\CIiHmnxMn6Ps\Documents\QUyrd7CbOPT8BcO.odt - Access
C:\Users\CIiHmnxMn6Ps\Documents\QUyrd7CbOPT8BcO.odt.CRAB - Access, Read
C:\Users\CIiHmnxMn6Ps\Documents\rd20Yh5w2V0oel SGJ.xlsx - Access
C:\Users\CIiHmnxMn6Ps\Documents\rd20Yh5w2V0oel SGJ.xlsx.CRAB - Access, Read
C:\Users\CIiHmnxMn6Ps\Documents\rqTRf6rPG531.docx - Access
C:\Users\CIiHmnxMn6Ps\Documents\rqTRf6rPG531.docx.CRAB - Access, Read
C:\Users\CIiHmnxMn6Ps\Documents\TPG3GnZ2qWo-xJ6v74.rtf - Access
C:\Users\CIiHmnxMn6Ps\Documents\TPG3GnZ2qWo-xJ6v74.rtf.CRAB - Access, Read
C:\Users\CIiHmnxMn6Ps\Documents\xSsyaQq7FXblGGw.csv - Access
C:\Users\CIiHmnxMn6Ps\Documents\xSsyaQq7FXblGGw.csv.CRAB - Access, Read
C:\Users\CIiHmnxMn6Ps\Downloads\\CRAB-DECRYPT.txt - Access
C:\Users\CIiHmnxMn6Ps\Favorites\Bing.url - Access
C:\Users\CIiHmnxMn6Ps\Favorites\Bing.url.CRAB - Access, Read
C:\Users\CIiHmnxMn6Ps\Favorites\\CRAB-DECRYPT.txt - Access
C:\Users\CIiHmnxMn6Ps\Favorites\Links\\CRAB-DECRYPT.txt - Access
C:\Users\CIiHmnxMn6Ps\Links\\CRAB-DECRYPT.txt - Access
C:\Users\CIiHmnxMn6Ps\Music\1O7HGWeE_bm1QZ3.m4a - Access
C:\Users\CIiHmnxMn6Ps\Music\1O7HGWeE_bm1QZ3.m4a.CRAB - Access, Read
C:\Users\CIiHmnxMn6Ps\Music\4glwOL0\\CRAB-DECRYPT.txt - Access
C:\Users\CIiHmnxMn6Ps\Music\4glwOL0\FHhxqUugD3FstVNcKNS.wav - Access
C:\Users\CIiHmnxMn6Ps\Music\4glwOL0\FHhxqUugD3FstVNcKNS.wav.CRAB - Access, Read
C:\Users\CIiHmnxMn6Ps\Music\4glwOL0\YiL7BiS7Bh0uLbqPka.wav - Access
C:\Users\CIiHmnxMn6Ps\Music\4glwOL0\YiL7BiS7Bh0uLbqPka.wav.CRAB - Access, Read
C:\Users\CIiHmnxMn6Ps\Music\5mWME.mp3 - Access
C:\Users\CIiHmnxMn6Ps\Music\5mWME.mp3.CRAB - Access, Read
C:\Users\CIiHmnxMn6Ps\Music\9pNs3Jr4D\CKxMT\5anHeAvR_laZUa\\CRAB-DECRYPT.txt - Access
C:\Users\CIiHmnxMn6Ps\Music\9pNs3Jr4D\CKxMT\5anHeAvR_laZUa\qt31BcQomXRZfOvRfdZd.wav - Access
C:\Users\CIiHmnxMn6Ps\Music\9pNs3Jr4D\CKxMT\5anHeAvR_laZUa\qt31BcQomXRZfOvRfdZd.wav.CRAB - Access, Read
C:\Users\CIiHmnxMn6Ps\Music\9pNs3Jr4D\CKxMT\\CRAB-DECRYPT.txt - Access
C:\Users\CIiHmnxMn6Ps\Music\9pNs3Jr4D\CKxMT\gjL2nlSg2_qQ.m4a - Access
C:\Users\CIiHmnxMn6Ps\Music\9pNs3Jr4D\CKxMT\gjL2nlSg2_qQ.m4a.CRAB - Access, Read
C:\Users\CIiHmnxMn6Ps\Music\9pNs3Jr4D\CKxMT\HJ7RmokGBbchMiAdb7.wav - Access
C:\Users\CIiHmnxMn6Ps\Music\9pNs3Jr4D\CKxMT\HJ7RmokGBbchMiAdb7.wav.CRAB - Access, Read
C:\Users\CIiHmnxMn6Ps\Music\9pNs3Jr4D\\CRAB-DECRYPT.txt - Access
C:\Users\CIiHmnxMn6Ps\Music\9pNs3Jr4D\UU4hc2R9w-z_RZY4vy.mp3 - Access
C:\Users\CIiHmnxMn6Ps\Music\9pNs3Jr4D\UU4hc2R9w-z_RZY4vy.mp3.CRAB - Access, Read
C:\Users\CIiHmnxMn6Ps\Music\9pNs3Jr4D\vq5UwIj.wav - Access
C:\Users\CIiHmnxMn6Ps\Music\9pNs3Jr4D\vq5UwIj.wav.CRAB - Access, Read
C:\Users\CIiHmnxMn6Ps\Music\\CRAB-DECRYPT.txt - Access
C:\Users\CIiHmnxMn6Ps\Music\I8SmMnmBjC5LMsc9G.wav - Access
C:\Users\CIiHmnxMn6Ps\Music\I8SmMnmBjC5LMsc9G.wav.CRAB - Access, Read
C:\Users\CIiHmnxMn6Ps\Music\mmUZx- 8zi6qUmjiyvYC\\CRAB-DECRYPT.txt - Access
C:\Users\CIiHmnxMn6Ps\Music\mmUZx- 8zi6qUmjiyvYC\LUcMwR8 JYOe.mp3 - Access
C:\Users\CIiHmnxMn6Ps\Music\mmUZx- 8zi6qUmjiyvYC\LUcMwR8 JYOe.mp3.CRAB - Access, Read
C:\Users\CIiHmnxMn6Ps\Music\mmUZx- 8zi6qUmjiyvYC\UF6jiQHLOVtLpu3.m4a - Access
C:\Users\CIiHmnxMn6Ps\Music\mmUZx- 8zi6qUmjiyvYC\UF6jiQHLOVtLpu3.m4a.CRAB - Access, Read
C:\Users\CIiHmnxMn6Ps\Music\N0vlVpKB.wav - Access
C:\Users\CIiHmnxMn6Ps\Music\N0vlVpKB.wav.CRAB - Access, Read
C:\Users\CIiHmnxMn6Ps\Music\uSZcy00OxWQqA65CuGl_\5YcYY8n0GHi\\CRAB-DECRYPT.txt - Access
C:\Users\CIiHmnxMn6Ps\Music\uSZcy00OxWQqA65CuGl_\5YcYY8n0GHi\J2BAHx-heR.mp3 - Access
C:\Users\CIiHmnxMn6Ps\Music\uSZcy00OxWQqA65CuGl_\5YcYY8n0GHi\J2BAHx-heR.mp3.CRAB - Access, Read
C:\Users\CIiHmnxMn6Ps\Music\uSZcy00OxWQqA65CuGl_\5YcYY8n0GHi\NxzCZA.wav - Access
C:\Users\CIiHmnxMn6Ps\Music\uSZcy00OxWQqA65CuGl_\5YcYY8n0GHi\NxzCZA.wav.CRAB - Access, Read
C:\Users\CIiHmnxMn6Ps\Music\uSZcy00OxWQqA65CuGl_\7M5NHqWj.m4a - Access
C:\Users\CIiHmnxMn6Ps\Music\uSZcy00OxWQqA65CuGl_\7M5NHqWj.m4a.CRAB - Access, Read
C:\Users\CIiHmnxMn6Ps\Music\uSZcy00OxWQqA65CuGl_\BHIq.m4a - Access
C:\Users\CIiHmnxMn6Ps\Music\uSZcy00OxWQqA65CuGl_\BHIq.m4a.CRAB - Access, Read
C:\Users\CIiHmnxMn6Ps\Music\uSZcy00OxWQqA65CuGl_\\CRAB-DECRYPT.txt - Access
C:\Users\CIiHmnxMn6Ps\Music\uSZcy00OxWQqA65CuGl_\I0iG.m4a - Access
C:\Users\CIiHmnxMn6Ps\Music\uSZcy00OxWQqA65CuGl_\I0iG.m4a.CRAB - Access, Read
C:\Users\CIiHmnxMn6Ps\Music\uSZcy00OxWQqA65CuGl_\vdr4M 7z-bfQy\1rVJ.m4a - Access
C:\Users\CIiHmnxMn6Ps\Music\uSZcy00OxWQqA65CuGl_\vdr4M 7z-bfQy\1rVJ.m4a.CRAB - Access, Read
C:\Users\CIiHmnxMn6Ps\Music\uSZcy00OxWQqA65CuGl_\vdr4M 7z-bfQy\29HmK0.wav - Access
C:\Users\CIiHmnxMn6Ps\Music\uSZcy00OxWQqA65CuGl_\vdr4M 7z-bfQy\29HmK0.wav.CRAB - Access, Read
C:\Users\CIiHmnxMn6Ps\Music\uSZcy00OxWQqA65CuGl_\vdr4M 7z-bfQy\bZj2Hufm2xQPz20kv\\CRAB-DECRYPT.txt - Access
C:\Users\CIiHmnxMn6Ps\Music\uSZcy00OxWQqA65CuGl_\vdr4M 7z-bfQy\bZj2Hufm2xQPz20kv\LlhFu31t.mp3 - Access
C:\Users\CIiHmnxMn6Ps\Music\uSZcy00OxWQqA65CuGl_\vdr4M 7z-bfQy\bZj2Hufm2xQPz20kv\LlhFu31t.mp3.CRAB - Access, Read
C:\Users\CIiHmnxMn6Ps\Music\uSZcy00OxWQqA65CuGl_\vdr4M 7z-bfQy\bZj2Hufm2xQPz20kv\qf8TnY3j37.m4a - Access
C:\Users\CIiHmnxMn6Ps\Music\uSZcy00OxWQqA65CuGl_\vdr4M 7z-bfQy\bZj2Hufm2xQPz20kv\qf8TnY3j37.m4a.CRAB - Access, Read
C:\Users\CIiHmnxMn6Ps\Music\uSZcy00OxWQqA65CuGl_\vdr4M 7z-bfQy\bZj2Hufm2xQPz20kv\roLHBmMYKVka.m4a - Access
C:\Users\CIiHmnxMn6Ps\Music\uSZcy00OxWQqA65CuGl_\vdr4M 7z-bfQy\bZj2Hufm2xQPz20kv\roLHBmMYKVka.m4a.CRAB - Access, Read
C:\Users\CIiHmnxMn6Ps\Music\uSZcy00OxWQqA65CuGl_\vdr4M 7z-bfQy\\CRAB-DECRYPT.txt - Access
C:\Users\CIiHmnxMn6Ps\Music\uSZcy00OxWQqA65CuGl_\vdr4M 7z-bfQy\RVJGDnmzD\9443tYbH HAxp5tXYlYN.mp3 - Access
C:\Users\CIiHmnxMn6Ps\Music\uSZcy00OxWQqA65CuGl_\vdr4M 7z-bfQy\RVJGDnmzD\9443tYbH HAxp5tXYlYN.mp3.CRAB - Access, Read
C:\Users\CIiHmnxMn6Ps\Music\uSZcy00OxWQqA65CuGl_\vdr4M 7z-bfQy\RVJGDnmzD\\CRAB-DECRYPT.txt - Access
C:\Users\CIiHmnxMn6Ps\Music\uSZcy00OxWQqA65CuGl_\vdr4M 7z-bfQy\RVJGDnmzD\vDZDyhX2e.m4a - Access
C:\Users\CIiHmnxMn6Ps\Music\uSZcy00OxWQqA65CuGl_\vdr4M 7z-bfQy\RVJGDnmzD\vDZDyhX2e.m4a.CRAB - Access, Read
C:\Users\CIiHmnxMn6Ps\My Documents\\CRAB-DECRYPT.txt - Access
C:\Users\CIiHmnxMn6Ps\NetHood\\CRAB-DECRYPT.txt - Access
C:\Users\CIiHmnxMn6Ps\ntuser.dat.LOG1 - Access
C:\Users\CIiHmnxMn6Ps\ntuser.dat.LOG1.CRAB - Access
C:\Users\CIiHmnxMn6Ps\ntuser.dat.LOG2 - Access
C:\Users\CIiHmnxMn6Ps\ntuser.dat.LOG2.CRAB - Access
C:\Users\CIiHmnxMn6Ps\NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TM.blf - Access
C:\Users\CIiHmnxMn6Ps\NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TM.blf.CRAB - Access
C:\Users\CIiHmnxMn6Ps\NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TMContainer00000000000000000001.regtrans-ms - Access
C:\Users\CIiHmnxMn6Ps\NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TMContainer00000000000000000001.regtrans-ms.CRAB - Access
C:\Users\CIiHmnxMn6Ps\NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TMContainer00000000000000000002.regtrans-ms - Access
C:\Users\CIiHmnxMn6Ps\NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TMContainer00000000000000000002.regtrans-ms.CRAB - Access
C:\Users\CIiHmnxMn6Ps\ntuser.ini - Access
C:\Users\CIiHmnxMn6Ps\ntuser.ini.CRAB - Access, Read
C:\Users\CIiHmnxMn6Ps\OneDrive\\CRAB-DECRYPT.txt - Access
C:\Users\CIiHmnxMn6Ps\Pictures\9oBLEamwCGJSHcZBK.gif - Access
C:\Users\CIiHmnxMn6Ps\Pictures\9oBLEamwCGJSHcZBK.gif.CRAB - Access, Read
C:\Users\CIiHmnxMn6Ps\Pictures\AxDg0P\5uLKDR9ae\1yRDmnZ0RkaLnZaO0jJZ.jpg - Access
C:\Users\CIiHmnxMn6Ps\Pictures\AxDg0P\5uLKDR9ae\1yRDmnZ0RkaLnZaO0jJZ.jpg.CRAB - Access, Read
C:\Users\CIiHmnxMn6Ps\Pictures\AxDg0P\5uLKDR9ae\5rUXe5EsQ6e9AUEH.png - Access
C:\Users\CIiHmnxMn6Ps\Pictures\AxDg0P\5uLKDR9ae\5rUXe5EsQ6e9AUEH.png.CRAB - Access, Read
C:\Users\CIiHmnxMn6Ps\Pictures\AxDg0P\5uLKDR9ae\\CRAB-DECRYPT.txt - Access
C:\Users\CIiHmnxMn6Ps\Pictures\AxDg0P\5uLKDR9ae\EdDfBBOJandLKRQFzhtp.bmp - Access
C:\Users\CIiHmnxMn6Ps\Pictures\AxDg0P\5uLKDR9ae\EdDfBBOJandLKRQFzhtp.bmp.CRAB - Access, Read
C:\Users\CIiHmnxMn6Ps\Pictures\AxDg0P\5uLKDR9ae\fg4AafVi dOFU.jpg - Access
C:\Users\CIiHmnxMn6Ps\Pictures\AxDg0P\5uLKDR9ae\fg4AafVi dOFU.jpg.CRAB - Access, Read
C:\Users\CIiHmnxMn6Ps\Pictures\AxDg0P\5uLKDR9ae\FJ7wrPWRRAVh3Qa.gif - Access
C:\Users\CIiHmnxMn6Ps\Pictures\AxDg0P\5uLKDR9ae\FJ7wrPWRRAVh3Qa.gif.CRAB - Access, Read
C:\Users\CIiHmnxMn6Ps\Pictures\AxDg0P\5uLKDR9ae\fY16nlf YYJGpFu.png - Access
C:\Users\CIiHmnxMn6Ps\Pictures\AxDg0P\5uLKDR9ae\fY16nlf YYJGpFu.png.CRAB - Access, Read
C:\Users\CIiHmnxMn6Ps\Pictures\AxDg0P\5uLKDR9ae\juth4dPuja.bmp - Access
C:\Users\CIiHmnxMn6Ps\Pictures\AxDg0P\5uLKDR9ae\juth4dPuja.bmp.CRAB - Access, Read
C:\Users\CIiHmnxMn6Ps\Pictures\AxDg0P\5uLKDR9ae\N7D2Hp.gif - Access
C:\Users\CIiHmnxMn6Ps\Pictures\AxDg0P\5uLKDR9ae\N7D2Hp.gif.CRAB - Access, Read
C:\Users\CIiHmnxMn6Ps\Pictures\AxDg0P\5uLKDR9ae\sHfL2n.gif - Access
C:\Users\CIiHmnxMn6Ps\Pictures\AxDg0P\5uLKDR9ae\sHfL2n.gif.CRAB - Access, Read
C:\Users\CIiHmnxMn6Ps\Pictures\AxDg0P\5uLKDR9ae\vgKSZ1H j.gif - Access
C:\Users\CIiHmnxMn6Ps\Pictures\AxDg0P\5uLKDR9ae\vgKSZ1H j.gif.CRAB - Access, Read
C:\Users\CIiHmnxMn6Ps\Pictures\AxDg0P\AYBe 2EG.gif - Access
C:\Users\CIiHmnxMn6Ps\Pictures\AxDg0P\AYBe 2EG.gif.CRAB - Access, Read
C:\Users\CIiHmnxMn6Ps\Pictures\AxDg0P\b8hKKTT g8UxIlG1k_b.png - Access
C:\Users\CIiHmnxMn6Ps\Pictures\AxDg0P\b8hKKTT g8UxIlG1k_b.png.CRAB - Access, Read
C:\Users\CIiHmnxMn6Ps\Pictures\AxDg0P\\CRAB-DECRYPT.txt - Access
C:\Users\CIiHmnxMn6Ps\Pictures\AxDg0P\etx8vj6MA o72p.png - Access
C:\Users\CIiHmnxMn6Ps\Pictures\AxDg0P\etx8vj6MA o72p.png.CRAB - Access, Read
C:\Users\CIiHmnxMn6Ps\Pictures\AxDg0P\G8eeM-NJ_V0uCM0PF yH.jpg - Access
C:\Users\CIiHmnxMn6Ps\Pictures\AxDg0P\G8eeM-NJ_V0uCM0PF yH.jpg.CRAB - Access, Read
C:\Users\CIiHmnxMn6Ps\Pictures\AxDg0P\IHCAw.bmp - Access
C:\Users\CIiHmnxMn6Ps\Pictures\AxDg0P\IHCAw.bmp.CRAB - Access, Read
C:\Users\CIiHmnxMn6Ps\Pictures\AxDg0P\LLluvIYiudzZO31iisP.gif - Access
C:\Users\CIiHmnxMn6Ps\Pictures\AxDg0P\LLluvIYiudzZO31iisP.gif.CRAB - Access, Read
C:\Users\CIiHmnxMn6Ps\Pictures\AxDg0P\P6gz_8esxBcK7m1j14Tw.png - Access
C:\Users\CIiHmnxMn6Ps\Pictures\AxDg0P\P6gz_8esxBcK7m1j14Tw.png.CRAB - Access, Read
C:\Users\CIiHmnxMn6Ps\Pictures\AxDg0P\UnuhOeLGK.png - Access
C:\Users\CIiHmnxMn6Ps\Pictures\AxDg0P\UnuhOeLGK.png.CRAB - Access, Read
C:\Users\CIiHmnxMn6Ps\Pictures\AxDg0P\x5zHu3GZBcWy.png - Access
C:\Users\CIiHmnxMn6Ps\Pictures\AxDg0P\x5zHu3GZBcWy.png.CRAB - Access, Read
C:\Users\CIiHmnxMn6Ps\Pictures\AxDg0P\Xdpn0JNfLBf.png - Access
C:\Users\CIiHmnxMn6Ps\Pictures\AxDg0P\Xdpn0JNfLBf.png.CRAB - Access, Read
C:\Users\CIiHmnxMn6Ps\Pictures\AxDg0P\Z_ KH0UDXnX.png - Access
C:\Users\CIiHmnxMn6Ps\Pictures\AxDg0P\Z_ KH0UDXnX.png.CRAB - Access, Read
C:\Users\CIiHmnxMn6Ps\Pictures\Camera Roll\\CRAB-DECRYPT.txt - Access
C:\Users\CIiHmnxMn6Ps\Pictures\\CRAB-DECRYPT.txt - Access
C:\Users\CIiHmnxMn6Ps\Pictures\D3N6CHyyJgR\bX3h27atuLJaX.jpg - Access
C:\Users\CIiHmnxMn6Ps\Pictures\D3N6CHyyJgR\bX3h27atuLJaX.jpg.CRAB - Access, Read
C:\Users\CIiHmnxMn6Ps\Pictures\D3N6CHyyJgR\\CRAB-DECRYPT.txt - Access
C:\Users\CIiHmnxMn6Ps\Pictures\D3N6CHyyJgR\gUscKQGqJvOmu.jpg - Access
C:\Users\CIiHmnxMn6Ps\Pictures\D3N6CHyyJgR\gUscKQGqJvOmu.jpg.CRAB - Access, Read
C:\Users\CIiHmnxMn6Ps\Pictures\D3N6CHyyJgR\hnUH.png - Access
C:\Users\CIiHmnxMn6Ps\Pictures\D3N6CHyyJgR\hnUH.png.CRAB - Access, Read
C:\Users\CIiHmnxMn6Ps\Pictures\D3N6CHyyJgR\k1sBKHyXQbc.png - Access
C:\Users\CIiHmnxMn6Ps\Pictures\D3N6CHyyJgR\k1sBKHyXQbc.png.CRAB - Access, Read
C:\Users\CIiHmnxMn6Ps\Pictures\D3N6CHyyJgR\kskq9YQ.gif - Access
C:\Users\CIiHmnxMn6Ps\Pictures\D3N6CHyyJgR\kskq9YQ.gif.CRAB - Access, Read
C:\Users\CIiHmnxMn6Ps\Pictures\D3N6CHyyJgR\pi3nZPM8A2xi46.bmp - Access
C:\Users\CIiHmnxMn6Ps\Pictures\D3N6CHyyJgR\pi3nZPM8A2xi46.bmp.CRAB - Access, Read
C:\Users\CIiHmnxMn6Ps\Pictures\D3N6CHyyJgR\qb_Wkxn5UqSmm.png - Access
C:\Users\CIiHmnxMn6Ps\Pictures\D3N6CHyyJgR\qb_Wkxn5UqSmm.png.CRAB - Access, Read
C:\Users\CIiHmnxMn6Ps\Pictures\D3N6CHyyJgR\tsA 2y56Qpg4qRafrw8u.jpg - Access
C:\Users\CIiHmnxMn6Ps\Pictures\D3N6CHyyJgR\tsA 2y56Qpg4qRafrw8u.jpg.CRAB - Access, Read
C:\Users\CIiHmnxMn6Ps\Pictures\D3N6CHyyJgR\WxDe7hYNueKf.jpg - Access
C:\Users\CIiHmnxMn6Ps\Pictures\D3N6CHyyJgR\WxDe7hYNueKf.jpg.CRAB - Access, Read
C:\Users\CIiHmnxMn6Ps\Pictures\D3N6CHyyJgR\XjL-kzufyJJ.gif - Access
C:\Users\CIiHmnxMn6Ps\Pictures\D3N6CHyyJgR\XjL-kzufyJJ.gif.CRAB - Access, Read
C:\Users\CIiHmnxMn6Ps\Pictures\D3N6CHyyJgR\yj6TD-xkYt 9.bmp - Access
C:\Users\CIiHmnxMn6Ps\Pictures\D3N6CHyyJgR\yj6TD-xkYt 9.bmp.CRAB - Access, Read
C:\Users\CIiHmnxMn6Ps\Pictures\dKYT-erDji.jpg - Access
C:\Users\CIiHmnxMn6Ps\Pictures\dKYT-erDji.jpg.CRAB - Access, Read
C:\Users\CIiHmnxMn6Ps\Pictures\FxTvMYc2uPCahwMM_FH.jpg - Access
C:\Users\CIiHmnxMn6Ps\Pictures\FxTvMYc2uPCahwMM_FH.jpg.CRAB - Access, Read
C:\Users\CIiHmnxMn6Ps\Pictures\lpGq 7bMsABjwsMJW.jpg - Access
C:\Users\CIiHmnxMn6Ps\Pictures\lpGq 7bMsABjwsMJW.jpg.CRAB - Access, Read
C:\Users\CIiHmnxMn6Ps\Pictures\puRAfkJuLj3.jpg - Access
C:\Users\CIiHmnxMn6Ps\Pictures\puRAfkJuLj3.jpg.CRAB - Access, Read
C:\Users\CIiHmnxMn6Ps\Pictures\Saved Pictures\\CRAB-DECRYPT.txt - Access
C:\Users\CIiHmnxMn6Ps\Pictures\v68NdgPpq-11PAYAj-o.gif - Access
C:\Users\CIiHmnxMn6Ps\Pictures\v68NdgPpq-11PAYAj-o.gif.CRAB - Access, Read
C:\Users\CIiHmnxMn6Ps\Pictures\wmA0gqfz68K7nuIBLqw.gif - Access
C:\Users\CIiHmnxMn6Ps\Pictures\wmA0gqfz68K7nuIBLqw.gif.CRAB - Access, Read
C:\Users\CIiHmnxMn6Ps\Pictures\YP -8.bmp - Access
C:\Users\CIiHmnxMn6Ps\Pictures\YP -8.bmp.CRAB - Access, Read
C:\Users\CIiHmnxMn6Ps\PrintHood\\CRAB-DECRYPT.txt - Access
C:\Users\CIiHmnxMn6Ps\Recent\\CRAB-DECRYPT.txt - Access
C:\Users\CIiHmnxMn6Ps\Saved Games\\CRAB-DECRYPT.txt - Access
C:\Users\CIiHmnxMn6Ps\Searches\\CRAB-DECRYPT.txt - Access
C:\Users\CIiHmnxMn6Ps\Searches\Everywhere.search-ms - Access
C:\Users\CIiHmnxMn6Ps\Searches\Everywhere.search-ms.CRAB - Access, Read
C:\Users\CIiHmnxMn6Ps\Searches\Indexed Locations.search-ms - Access
C:\Users\CIiHmnxMn6Ps\Searches\Indexed Locations.search-ms.CRAB - Access, Read
C:\Users\CIiHmnxMn6Ps\SendTo\\CRAB-DECRYPT.txt - Access
C:\Users\CIiHmnxMn6Ps\Start Menu\\CRAB-DECRYPT.txt - Access
C:\Users\CIiHmnxMn6Ps\Templates\\CRAB-DECRYPT.txt - Access
C:\Users\CIiHmnxMn6Ps\Videos\-iWXN.mkv - Access
C:\Users\CIiHmnxMn6Ps\Videos\-iWXN.mkv.CRAB - Access, Read
C:\Users\CIiHmnxMn6Ps\Videos\-R-Kl1rhFWl QDiX4m3m.mp4 - Access
C:\Users\CIiHmnxMn6Ps\Videos\-R-Kl1rhFWl QDiX4m3m.mp4.CRAB - Access, Read
C:\Users\CIiHmnxMn6Ps\Videos\\CRAB-DECRYPT.txt - Access
C:\Users\CIiHmnxMn6Ps\Videos\gYrk.flv - Access
C:\Users\CIiHmnxMn6Ps\Videos\gYrk.flv.CRAB - Access, Read
C:\Users\CIiHmnxMn6Ps\Videos\H8Pp.avi - Access
C:\Users\CIiHmnxMn6Ps\Videos\H8Pp.avi.CRAB - Access, Read
C:\Users\CIiHmnxMn6Ps\Videos\IwOdkCLMr.flv - Access
C:\Users\CIiHmnxMn6Ps\Videos\IwOdkCLMr.flv.CRAB - Access, Read
C:\Users\CIiHmnxMn6Ps\Videos\jUvEEP6AV1TsLx2v4Ra.mkv - Access
C:\Users\CIiHmnxMn6Ps\Videos\jUvEEP6AV1TsLx2v4Ra.mkv.CRAB - Access, Read
C:\Users\CIiHmnxMn6Ps\Videos\KFti_eKeL-oZ.avi - Access
C:\Users\CIiHmnxMn6Ps\Videos\KFti_eKeL-oZ.avi.CRAB - Access, Read
C:\Users\CIiHmnxMn6Ps\Videos\krwIA04EhsgR T_ m9V.mkv - Access
C:\Users\CIiHmnxMn6Ps\Videos\krwIA04EhsgR T_ m9V.mkv.CRAB - Access, Read
C:\Users\CIiHmnxMn6Ps\Videos\lyW8Q0WSnKMjv.flv - Access
C:\Users\CIiHmnxMn6Ps\Videos\lyW8Q0WSnKMjv.flv.CRAB - Access, Read
C:\Users\CIiHmnxMn6Ps\Videos\NMEW.flv - Access
C:\Users\CIiHmnxMn6Ps\Videos\NMEW.flv.CRAB - Access, Read
C:\Users\CIiHmnxMn6Ps\Videos\q2UQarvqfMBMw.flv - Access
C:\Users\CIiHmnxMn6Ps\Videos\q2UQarvqfMBMw.flv.CRAB - Access, Read
C:\Users\CIiHmnxMn6Ps\Videos\Shy2sjYC6fXYZzN3.mkv - Access
C:\Users\CIiHmnxMn6Ps\Videos\Shy2sjYC6fXYZzN3.mkv.CRAB - Access, Read
C:\Users\CIiHmnxMn6Ps\Videos\sL9w.mkv - Access
C:\Users\CIiHmnxMn6Ps\Videos\sL9w.mkv.CRAB - Access, Read
C:\Users\CIiHmnxMn6Ps\Videos\tYTYwIWCYmSr.swf - Access
C:\Users\CIiHmnxMn6Ps\Videos\tYTYwIWCYmSr.swf.CRAB - Access, Read
C:\Users\CIiHmnxMn6Ps\Videos\U9RNrOMa-ues_1\19p-ZG97LDn.avi - Access
C:\Users\CIiHmnxMn6Ps\Videos\U9RNrOMa-ues_1\19p-ZG97LDn.avi.CRAB - Access, Read
C:\Users\CIiHmnxMn6Ps\Videos\U9RNrOMa-ues_1\_At2gAyzrRfymG8aa6M.swf - Access
C:\Users\CIiHmnxMn6Ps\Videos\U9RNrOMa-ues_1\_At2gAyzrRfymG8aa6M.swf.CRAB - Access, Read
C:\Users\CIiHmnxMn6Ps\Videos\U9RNrOMa-ues_1\CHD1U4-5A3fcKnxLU.mkv - Access
C:\Users\CIiHmnxMn6Ps\Videos\U9RNrOMa-ues_1\CHD1U4-5A3fcKnxLU.mkv.CRAB - Access, Read
C:\Users\CIiHmnxMn6Ps\Videos\U9RNrOMa-ues_1\\CRAB-DECRYPT.txt - Access
C:\Users\CIiHmnxMn6Ps\Videos\U9RNrOMa-ues_1\D0ig976NHDQ2gUp9w0J5.flv - Access
C:\Users\CIiHmnxMn6Ps\Videos\U9RNrOMa-ues_1\D0ig976NHDQ2gUp9w0J5.flv.CRAB - Access, Read
C:\Users\CIiHmnxMn6Ps\Videos\U9RNrOMa-ues_1\dk75wRX-.avi - Access
C:\Users\CIiHmnxMn6Ps\Videos\U9RNrOMa-ues_1\dk75wRX-.avi.CRAB - Access, Read
C:\Users\CIiHmnxMn6Ps\Videos\U9RNrOMa-ues_1\Fq06q6u3yO.mkv - Access
C:\Users\CIiHmnxMn6Ps\Videos\U9RNrOMa-ues_1\Fq06q6u3yO.mkv.CRAB - Access, Read
C:\Users\CIiHmnxMn6Ps\Videos\U9RNrOMa-ues_1\HT0Lw1TY.flv - Access
C:\Users\CIiHmnxMn6Ps\Videos\U9RNrOMa-ues_1\HT0Lw1TY.flv.CRAB - Access, Read
C:\Users\CIiHmnxMn6Ps\Videos\U9RNrOMa-ues_1\Jjej7x4SOz7qMu.mp4 - Access
C:\Users\CIiHmnxMn6Ps\Videos\U9RNrOMa-ues_1\Jjej7x4SOz7qMu.mp4.CRAB - Access, Read
C:\Users\CIiHmnxMn6Ps\Videos\U9RNrOMa-ues_1\KIA7SBA.swf - Access
C:\Users\CIiHmnxMn6Ps\Videos\U9RNrOMa-ues_1\KIA7SBA.swf.CRAB - Access, Read
C:\Users\CIiHmnxMn6Ps\Videos\U9RNrOMa-ues_1\nScoDAv1eKJfTjHhZGNN.swf - Access
C:\Users\CIiHmnxMn6Ps\Videos\U9RNrOMa-ues_1\nScoDAv1eKJfTjHhZGNN.swf.CRAB - Access, Read
C:\Users\CIiHmnxMn6Ps\Videos\U9RNrOMa-ues_1\PqtqjrtS6j-Knsx.mkv - Access
C:\Users\CIiHmnxMn6Ps\Videos\U9RNrOMa-ues_1\PqtqjrtS6j-Knsx.mkv.CRAB - Access, Read
C:\Users\CIiHmnxMn6Ps\Videos\U9RNrOMa-ues_1\XeVl2.mp4 - Access
C:\Users\CIiHmnxMn6Ps\Videos\U9RNrOMa-ues_1\XeVl2.mp4.CRAB - Access, Read
C:\Users\CIiHmnxMn6Ps\Videos\U9RNrOMa-ues_1\yuUlwSkuh2huf.mkv - Access
C:\Users\CIiHmnxMn6Ps\Videos\U9RNrOMa-ues_1\yuUlwSkuh2huf.mkv.CRAB - Access, Read
C:\Users\CIiHmnxMn6Ps\Videos\U9RNrOMa-ues_1\zj87hwIO.mp4 - Access
C:\Users\CIiHmnxMn6Ps\Videos\U9RNrOMa-ues_1\zj87hwIO.mp4.CRAB - Access, Read
C:\Users\CIiHmnxMn6Ps\Videos\utx3o.flv - Access
C:\Users\CIiHmnxMn6Ps\Videos\utx3o.flv.CRAB - Access, Read
C:\Users\CIiHmnxMn6Ps\Videos\vwnC.mkv - Access
C:\Users\CIiHmnxMn6Ps\Videos\vwnC.mkv.CRAB - Access, Read
C:\Users\CIiHmnxMn6Ps\Videos\yrH-liw_7NMOiY.swf - Access
C:\Users\CIiHmnxMn6Ps\Videos\yrH-liw_7NMOiY.swf.CRAB - Access, Read
C:\Users\CIIHMN~1\AppData\Local\Temp\busmeat.exe MD5: 786b1337cdef1d420c863ec2080baebd
SHA1: d8af63fb8269b648e575ec1c7132af55c1517843
SHA256: 6a8d922e34de35ac074b7de54d71227fb1a1ed92b9cfbc4daf8d64a9c5bc46b8 		Access, Read, Write
C:\Users\CIIHMN~1\AppData\Local\Temp\\pidor.bmp - Access
C:\Users\CIIHMN~1\Desktop\BILL_8~1.JS - Access
C:\Users\\CRAB-DECRYPT.txt MD5: c0f9e48bf74053ad638796ebbcb2bdf1
SHA1: 32174c0dcfe1d01838ecb03c22f6991065d9890a
SHA256: dda64d29b501f41856c7888de2a276bd73ab9fc3bba5155fe373230fc9e18082 		Access
C:\Users\Default User\\CRAB-DECRYPT.txt - Access
C:\Users\Default\AppData\\CRAB-DECRYPT.txt - Access
C:\Users\Default\AppData\Local\Application Data\\CRAB-DECRYPT.txt - Access
C:\Users\Default\AppData\Local\\CRAB-DECRYPT.txt - Access
C:\Users\Default\AppData\Local\History\\CRAB-DECRYPT.txt - Access
C:\Users\Default\AppData\Local\Microsoft\\CRAB-DECRYPT.txt - Access
C:\Users\Default\AppData\Local\Microsoft\InputPersonalization\\CRAB-DECRYPT.txt - Access
C:\Users\Default\AppData\Local\Microsoft\InputPersonalization\TrainedDataStore\\CRAB-DECRYPT.txt - Access
C:\Users\Default\AppData\Local\Microsoft\Windows Sidebar\\CRAB-DECRYPT.txt - Access
C:\Users\Default\AppData\Local\Microsoft\Windows Sidebar\Gadgets\\CRAB-DECRYPT.txt - Access
C:\Users\Default\AppData\Local\Microsoft\Windows Sidebar\settings.ini - Access
C:\Users\Default\AppData\Local\Microsoft\Windows Sidebar\settings.ini.CRAB - Access, Read
C:\Users\Default\AppData\Local\Temp\\CRAB-DECRYPT.txt - Access
C:\Users\Default\AppData\Local\Temporary Internet Files\\CRAB-DECRYPT.txt - Access
C:\Users\Default\AppData\Roaming\\CRAB-DECRYPT.txt - Access
C:\Users\Default\AppData\Roaming\Microsoft\\CRAB-DECRYPT.txt - Access
C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\\CRAB-DECRYPT.txt - Access
C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\\CRAB-DECRYPT.txt - Access
C:\Users\Default\Application Data\\CRAB-DECRYPT.txt - Access
C:\Users\Default\Cookies\\CRAB-DECRYPT.txt - Access
C:\Users\Default\\CRAB-DECRYPT.txt - Access
C:\Users\Default\Desktop\\CRAB-DECRYPT.txt - Access
C:\Users\Default\Documents\\CRAB-DECRYPT.txt - Access
C:\Users\Default\Documents\My Music\\CRAB-DECRYPT.txt - Access
C:\Users\Default\Documents\My Pictures\\CRAB-DECRYPT.txt - Access
C:\Users\Default\Documents\My Videos\\CRAB-DECRYPT.txt - Access
C:\Users\Default\Downloads\\CRAB-DECRYPT.txt - Access
C:\Users\Default\Favorites\\CRAB-DECRYPT.txt - Access
C:\Users\Default\Links\\CRAB-DECRYPT.txt - Access
C:\Users\Default\Music\\CRAB-DECRYPT.txt - Access
C:\Users\Default\My Documents\\CRAB-DECRYPT.txt - Access
C:\Users\Default\NetHood\\CRAB-DECRYPT.txt - Access
C:\Users\Default\NTUSER.DAT.LOG1 - Access
C:\Users\Default\NTUSER.DAT.LOG1.CRAB - Access, Read
C:\Users\Default\NTUSER.DAT.LOG2 - Access
C:\Users\Default\NTUSER.DAT.LOG2.CRAB - Access, Read
C:\Users\Default\NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TM.blf - Access
C:\Users\Default\NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TM.blf.CRAB - Access, Read
C:\Users\Default\NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TMContainer00000000000000000001.regtrans-ms - Access
C:\Users\Default\NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TMContainer00000000000000000001.regtrans-ms.CRAB - Access, Read
C:\Users\Default\NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TMContainer00000000000000000002.regtrans-ms - Access
C:\Users\Default\NTUSER.DAT{77a2c7ed-26f0-11e5-80da-e41d2d741090}.TMContainer00000000000000000002.regtrans-ms.CRAB - Access, Read
C:\Users\Default\Pictures\\CRAB-DECRYPT.txt - Access
C:\Users\Default\PrintHood\\CRAB-DECRYPT.txt - Access
C:\Users\Default\Recent\\CRAB-DECRYPT.txt - Access
C:\Users\Default\Saved Games\\CRAB-DECRYPT.txt - Access
C:\Users\Default\SendTo\\CRAB-DECRYPT.txt - Access
C:\Users\Default\Start Menu\\CRAB-DECRYPT.txt - Access
C:\Users\Default\Templates\\CRAB-DECRYPT.txt - Access
C:\Users\Default\Videos\\CRAB-DECRYPT.txt - Access
C:\Users\Public\AccountPictures\\CRAB-DECRYPT.txt - Access
C:\Users\Public\\CRAB-DECRYPT.txt - Access
C:\Users\Public\Documents\\CRAB-DECRYPT.txt - Access
C:\Users\Public\Documents\My Music\\CRAB-DECRYPT.txt - Access
C:\Users\Public\Documents\My Pictures\\CRAB-DECRYPT.txt - Access
C:\Users\Public\Documents\My Videos\\CRAB-DECRYPT.txt - Access
C:\Users\Public\Downloads\\CRAB-DECRYPT.txt - Access
C:\Users\Public\Libraries\\CRAB-DECRYPT.txt - Access
C:\Users\Public\Libraries\RecordedTV.library-ms - Access
C:\Users\Public\Libraries\RecordedTV.library-ms.CRAB - Access, Read
C:\Users\Public\Music\\CRAB-DECRYPT.txt - Access
C:\Users\Public\Pictures\\CRAB-DECRYPT.txt - Access
C:\Users\Public\Videos\\CRAB-DECRYPT.txt - Access
C:\Windows\system32 - Access
Registry (18)
»
Registry Key Name Operations
HKEY_CLASSES_ROOT\.JS Access, Read
HKEY_CLASSES_ROOT\JSFile\ScriptEngine Access, Read
HKEY_CURRENT_USER\Control Panel\International Access, Read
HKEY_CURRENT_USER\Keyboard Layout\Preload Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor Access, Read
HKEY_CURRENT_USER\Software\Microsoft\Windows Script Host\Settings Access, Read
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System Access
HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Access, Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Wbem\CIMOM Access, Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion Access, Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Script\Features Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce Access, Write
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\Tcpip\Parameters Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\COM3 Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows Script Host\Settings Access, Read
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\DNSClient Access
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters Access, Read
Mutex (1)
»
Mutex Name Operations
Global\pc_group=WORKGROUP&ransom_id=dce1bb8bd2ca4def Access
URL (5)
»
URL Operations
http://lxgcnmokgusvqx.com/ GET
http://zet.ge/wp/wp-admin/images/5555.exe GET
ipv4bot.whatismyipaddress.com/ GET
85.105.167.110/aysseaf?s=oast POST
78.31.63.30/oaza?erb=scaugh&eigh=ai POST
IP (5)
»
IP Protocols
94.249.60.127 DNS, UDP
189.75.183.21 DNS, UDP
94.183.71.48 DNS, UDP
85.105.167.110 HTTP, TCP
78.31.63.30 HTTP, TCP
Export IOCs
Function Logfile
Download-Icon
Exit-Icon

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy". 


    

   

   

    Before
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    After
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    

     
      

       
       
       
       
      

     
     
     
    

   

  

  

   

    
    

     Screenshot
    

    

     Expand-Icon
    

    

     Exit-Icon
    

   

   

    

     icon_left
    

    

     icon_left
    

   

   

   

   

    image