Automated Malware Analysis Management Report for ZunmmW7pe5.exe

Overview

General Information

Sample Name:	ZunmmW7pe5.exe
Analysis ID:	626600
MD5:	6d87be9212a1a0e92e58e1ed94c589f9
SHA1:	19ce538b2597da454abf835cff676c28b8eb66f7
SHA256:	c2d46d256b8f9490c9599eea11ecef19fde7d4fdd2dea93604cee3cea8e172ac
Infos:

Detection

Rook

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected Rook Ransomware

Malicious sample detected (through community Yara rule)

May disable shadow drive data (uses vssadmin)

Deletes itself after installation

Deletes shadow drive data (may be related to ransomware)

Machine Learning detection for sample

Modifies existing user documents (likely ransomware behavior)

Yara signature match

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Detected potential crypto function

Stores large binary data to the registry

Contains functionality to query CPU information (cpuid)

Sample execution stops while process was sleeping (likely an evasion)

Checks for available system drives (often done to infect USB drives)

Contains functionality to dynamically determine API calls

Uses Microsoft's Enhanced Cryptographic Provider

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Classification

Signatures

AV Detection

Antivirus / Scanner detection for submitted sample

Source: ZunmmW7pe5.exe

Avira: detected

Found malware configuration

Source: 0.0.ZunmmW7pe5.exe.7ff7e3710000.0.unpack

Malware Configuration Extractor: Rook Ransomware {"Ransom Note": "-----------Welcome. Again. --------------------\r\n[+]Whats Happen?[+]\r\n\r\nYour files are encrypted,and currently unavailable. You can check it: all files on you computer has expansion robet.\r\n\r\nBy the way,everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).\r\n\r\n[+] What guarantees?[+]\r\n\r\nIts just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.\r\n\r\nTo check the file capacity, please send 3 files not larger than 1M to us, and we will prove that we are capable of restoring.\r\n\r\nIf you will not cooperate with our service - for us, its does not matter. But you will lose your time and data,cause just we have the private key. In practise - time is much more valuable than money.\r\n\r\nIf we find that a security vendor or law enforcement agency pretends to be you to negotiate with us, we will directly destroy the private key and no longer provide you with decryption services.\r\n\r\nYou have 3 days to contact us for negotiation. Within 3 days, we will provide a 50% discount. If the discount service is not provided for more than 3 days, the files will be leaked to our onion network. Every more than 3 days will increase the number of leaked files.\r\n\r\nPlease use the company email to contact us, otherwise we will not reply.\r\n\r\n[+] How to get access on website?[+] \r\n\r\nYou have two ways:\r\n\r\n1) [Recommended] Using a TOR browser!\r\n\ta) Download and install TOR browser from this site:https://torproject.org/\n\tb) Open our website:gamol6n6p2p4c3ad7gxmx3ur7wwdwlywebo2azv3vv5qlmjmole2zbyd.onion\r\n\r\n2) Our mail box:\r\n\ta)rook@onionmail.org\r\n\tb)securityRook@onionmail.org\r\n\tc)If the mailbox fails or is taken over, please open Onion Network to check the new mailbox\r\n------------------------------------------------------------------------------------------------\r\n!!!DANGER!!!\r\nDONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data.\r\n!!!!!!!\r\n\r\nAGAIN: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, please should not interfere.\r\n!!!!!!!\r\n\r\nONE MORE TIME: Security vendors and law enforcement agencies, please be aware that attacks on us will make us even stronger.\r\n\r\n!!!!!!!\r\n"}

Multi AV Scanner detection for submitted file

Source: ZunmmW7pe5.exe	Virustotal: Detection: 79%	Perma Link
Source: ZunmmW7pe5.exe	Metadefender: Detection: 27%	Perma Link
Source: ZunmmW7pe5.exe	ReversingLabs: Detection: 88%

Machine Learning detection for sample

Source: ZunmmW7pe5.exe

Joe Sandbox ML: detected

Uses Microsoft's Enhanced Cryptographic Provider

Source: C:\Users\user\Desktop\ZunmmW7pe5.exe

Code function: 0_2_00007FF7E371DBF0 CryptAcquireContextW,CryptGenRandom,CryptReleaseContext,CryptReleaseContext,

0_2_00007FF7E371DBF0

Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: -----BEGIN PUBLIC KEY-----MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA4g06WvN+BRr9GeeOkZ4ynnK1uHreCPZyEsc43g3ftVXqsq2Kbdy7Z+XORqxmBi8D5nhDfw3eHRzH8wpcUos3szWKyJLOeKhN6DM5M4FppD8hyuKDTcgsa70Nhapc1Oyjfh3kf3Kc/2CUhnPYEzHefHN3yOq9wxOVGc1S+bcTM3ez8gRuv0fB9ao2bJ	0_2_00007FF7E3711C00
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: -----BEGIN PUBLIC KEY-----MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA4g06WvN+BRr9GeeOkZ4ynnK1uHreCPZyEsc43g3ftVXqsq2Kbdy7Z+XORqxmBi8D5nhDfw3eHRzH8wpcUos3szWKyJLOeKhN6DM5M4FppD8hyuKDTcgsa70Nhapc1Oyjfh3kf3Kc/2CUhnPYEzHefHN3yOq9wxOVGc1S+bcTM3ez8gRuv0fB9ao2bJ	0_2_00007FF7E3711C00
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: -----BEGIN PUBLIC KEY-----MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAns+j6MRzXXSObIDHYp8SUpB7OViyI5uvY583DQjT6YQBsXdIpcrgQwnfI8JtIrBABATftC2L5CnJkGv7gRTPm+1JY0OlzGcJmZqCHIoLBbGriG7jgBs+9RCqtJ/JP9L1NeS4Hmaan8HCxGVT5ysqIxv1pz0Bw1aoAu2mPzIwy0cl3P5b4CygAbBUuo	0_2_00007FF7E3711C00
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: -----BEGIN PUBLIC KEY-----	0_2_00007FF7E3711C00
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: -----BEGIN PUBLIC KEY-----MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAns+j6MRzXXSObIDHYp8SUpB7OViyI5uvY583DQjT6YQBsXdIpcrgQwnfI8JtIrBABATftC2L5CnJkGv7gRTPm+1JY0OlzGcJmZqCHIoLBbGriG7jgBs+9RCqtJ/JP9L1NeS4Hmaan8HCxGVT5ysqIxv1pz0Bw1aoAu2mPzIwy0cl3P5b4CygAbBUuo	0_2_00007FF7E3718FB0
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: -----BEGIN RSA PUBLIC KEY-----	0_2_00007FF7E371CD10
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: -----BEGIN PUBLIC KEY-----	0_2_00007FF7E371CD10
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: -----BEGIN PUBLIC KEY-----MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAns+j6MRzXXSObIDHYp8SUpB7OViyI5uvY583DQjT6YQBsXdIpcrgQwnfI8JtIrBABATftC2L5CnJkGv7gRTPm+1JY0OlzGcJmZqCHIoLBbGriG7jgBs+9RCqtJ/JP9L1NeS4Hmaan8HCxGVT5ysqIxv1pz0Bw1aoAu2mPzIwy0cl3P5b4CygAbBUuo	0_2_00007FF7E372A450
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: -----BEGIN PUBLIC KEY-----MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAns+j6MRzXXSObIDHYp8SUpB7OViyI5uvY583DQjT6YQBsXdIpcrgQwnfI8JtIrBABATftC2L5CnJkGv7gRTPm+1JY0OlzGcJmZqCHIoLBbGriG7jgBs+9RCqtJ/JP9L1NeS4Hmaan8HCxGVT5ysqIxv1pz0Bw1aoAu2mPzIwy0cl3P5b4CygAbBUuo	0_2_00007FF7E372CBB0
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: -----BEGIN PUBLIC KEY-----MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAns+j6MRzXXSObIDHYp8SUpB7OViyI5uvY583DQjT6YQBsXdIpcrgQwnfI8JtIrBABATftC2L5CnJkGv7gRTPm+1JY0OlzGcJmZqCHIoLBbGriG7jgBs+9RCqtJ/JP9L1NeS4Hmaan8HCxGVT5ysqIxv1pz0Bw1aoAu2mPzIwy0cl3P5b4CygAbBUuo	0_2_00007FF7E3723330
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: -----BEGIN PUBLIC KEY-----MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA4g06WvN+BRr9GeeOkZ4ynnK1uHreCPZyEsc43g3ftVXqsq2Kbdy7Z+XORqxmBi8D5nhDfw3eHRzH8wpcUos3szWKyJLOeKhN6DM5M4FppD8hyuKDTcgsa70Nhapc1Oyjfh3kf3Kc/2CUhnPYEzHefHN3yOq9wxOVGc1S+bcTM3ez8gRuv0fB9ao2bJ	0_2_00007FF7E372A070
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: -----BEGIN PUBLIC KEY-----MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAns+j6MRzXXSObIDHYp8SUpB7OViyI5uvY583DQjT6YQBsXdIpcrgQwnfI8JtIrBABATftC2L5CnJkGv7gRTPm+1JY0OlzGcJmZqCHIoLBbGriG7jgBs+9RCqtJ/JP9L1NeS4Hmaan8HCxGVT5ysqIxv1pz0Bw1aoAu2mPzIwy0cl3P5b4CygAbBUuo	0_2_00007FF7E3715720
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: -----BEGIN PUBLIC KEY-----MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAns+j6MRzXXSObIDHYp8SUpB7OViyI5uvY583DQjT6YQBsXdIpcrgQwnfI8JtIrBABATftC2L5CnJkGv7gRTPm+1JY0OlzGcJmZqCHIoLBbGriG7jgBs+9RCqtJ/JP9L1NeS4Hmaan8HCxGVT5ysqIxv1pz0Bw1aoAu2mPzIwy0cl3P5b4CygAbBUuo	0_2_00007FF7E372C6A0
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: -----BEGIN PUBLIC KEY-----MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA4g06WvN+BRr9GeeOkZ4ynnK1uHreCPZyEsc43g3ftVXqsq2Kbdy7Z+XORqxmBi8D5nhDfw3eHRzH8wpcUos3szWKyJLOeKhN6DM5M4FppD8hyuKDTcgsa70Nhapc1Oyjfh3kf3Kc/2CUhnPYEzHefHN3yOq9wxOVGc1S+bcTM3ez8gRuv0fB9ao2bJ	0_2_00007FF7E371C710
Source: ZunmmW7pe5.exe	Binary or memory string: -----BEGIN RSA PUBLIC KEY-----

Source: ZunmmW7pe5.exe

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA

Checks for available system drives (often done to infect USB drives)

Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	File opened: z:	Jump to behavior
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	File opened: x:	Jump to behavior
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	File opened: v:	Jump to behavior
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	File opened: t:	Jump to behavior
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	File opened: r:	Jump to behavior
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	File opened: p:	Jump to behavior
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	File opened: n:	Jump to behavior
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	File opened: l:	Jump to behavior
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	File opened: j:	Jump to behavior
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	File opened: h:	Jump to behavior
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	File opened: f:	Jump to behavior
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	File opened: b:	Jump to behavior
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	File opened: y:	Jump to behavior
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	File opened: w:	Jump to behavior
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	File opened: u:	Jump to behavior
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	File opened: s:	Jump to behavior
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	File opened: q:	Jump to behavior
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	File opened: o:	Jump to behavior
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	File opened: m:	Jump to behavior
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	File opened: k:	Jump to behavior
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	File opened: i:	Jump to behavior
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	File opened: g:	Jump to behavior
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	File opened: e:	Jump to behavior
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	File opened: c:	Jump to behavior
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	File opened: a:	Jump to behavior

Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E3712C00 RtlAllocateHeap,lstrcpyW,lstrcatW,CreateFileW,lstrlen,WriteFile,CloseHandle,lstrcpyW,lstrcatW,FindFirstFileW,lstrcmpiW,lstrcpyW,lstrcatW,lstrcatW,lstrcmpW,lstrlenW,lstrcmpiW,lstrcmpiW,lstrcmpiW,WaitForSingleObject,WaitForSingleObject,RtlAcquirePebLock,RtlLeaveCriticalSection,ReleaseSemaphore,HeapFree,RtlAcquirePebLock,lstrlenW,RtlAllocateHeap,RtlLeaveCriticalSection,ReleaseSemaphore,FindNextFileW,FindClose,lstrlenW,WideCharToMultiByte,RtlAllocateHeap,lstrlenW,WideCharToMultiByte,GetLastError,HeapFree,RtlReleasePrivilege,	0_2_00007FF7E3712C00
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E37130B0 WaitForSingleObject,WaitForSingleObject,RtlAcquirePebLock,RtlLeaveCriticalSection,ReleaseSemaphore,HeapFree,RtlAcquirePebLock,lstrlenW,RtlAllocateHeap,RtlLeaveCriticalSection,ReleaseSemaphore,RtlAllocateHeap,lstrcpyW,lstrcatW,FindFirstFileW,lstrcmpiW,lstrcpyW,lstrcatW,lstrcatW,FindNextFileW,FindClose,lstrlenW,WideCharToMultiByte,RtlAllocateHeap,lstrlenW,WideCharToMultiByte,GetLastError,HeapFree,RtlReleasePrivilege,	0_2_00007FF7E37130B0
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E374313C FindFirstFileExA,	0_2_00007FF7E374313C

Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	File opened: C:\Documents and Settings\user\Application Data\Adobe\Acrobat\DC\	Jump to behavior
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	File opened: C:\Documents and Settings\user\3D Objects\	Jump to behavior
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	File opened: C:\Documents and Settings\user\Application Data\	Jump to behavior
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	File opened: C:\Documents and Settings\user\Application Data\Adobe\Acrobat\	Jump to behavior
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	File opened: C:\Documents and Settings\user\Application Data\Adobe\	Jump to behavior
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	File opened: C:\Documents and Settings\user\	Jump to behavior

Source: ZunmmW7pe5.exe, HowToRestoreYourFiles.txt61.0.dr, HowToRestoreYourFiles.txt77.0.dr, HowToRestoreYourFiles.txt73.0.dr, HowToRestoreYourFiles.txt42.0.dr, HowToRestoreYourFiles.txt114.0.dr, HowToRestoreYourFiles.txt108.0.dr, HowToRestoreYourFiles.txt54.0.dr, HowToRestoreYourFiles.txt95.0.dr, HowToRestoreYourFiles.txt5.0.dr, HowToRestoreYourFiles.txt21.0.dr, HowToRestoreYourFiles.txt102.0.dr, HowToRestoreYourFiles.txt69.0.dr, HowToRestoreYourFiles.txt1.0.dr, HowToRestoreYourFiles.txt30.0.dr, HowToRestoreYourFiles.txt66.0.dr, HowToRestoreYourFiles.txt15.0.dr, HowToRestoreYourFiles.txt111.0.dr, HowToRestoreYourFiles.txt22.0.dr, HowToRestoreYourFiles.txt91.0.dr, HowToRestoreYourFiles.txt34.0.dr

String found in binary or memory: https://torproject.org/

Spam, unwanted Advertisements and Ransom Demands

Yara detected Rook Ransomware

Source: Yara match

File source: Process Memory Space: ZunmmW7pe5.exe PID: 8072, type: MEMORYSTR

May disable shadow drive data (uses vssadmin)

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe vssadmin.exe delete shadows /all /quiet
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe vssadmin.exe delete shadows /all /quiet			Jump to behavior

Deletes shadow drive data (may be related to ransomware)

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe vssadmin.exe delete shadows /all /quiet
Source: ZunmmW7pe5.exe	Binary or memory string: /c vssadmin.exe delete shadows /all /quiet
Source: ZunmmW7pe5.exe, 00000000.00000002.2994795597.00007FF7E374D000.00000080.00000001.01000000.00000000.sdmp	Binary or memory string: memtasmepocsvsssqlsvc$veeambackupGxVssGxBlrGxFWDGxCVDGxCIMgrDefWatchccEvtMgrccSetMgrSavRoamRTVscanQBFCServiceQBIDPServiceIntuit.QuickBooks.FCSQBCFMonitorServiceAcrSch2SvcAcronisAgentCASAD2DWebSvcCAARCUpdateSvcsql.exeoracle.exeocssd.exedbsnmp.exevisio.exewinword.exewordpad.exenotepad.exeexcel.exeonenote.exeoutlook.exesynctime.exeagntsvc.exeisqlplussvc.exexfssvccon.exemydesktopservice.exeocautoupds.exeencsvc.exefirefox.exetbirdconfig.exemydesktopqos.exeocomm.exedbeng50.exesqbcoreservice.exeinfopath.exemsaccess.exemspub.exepowerpnt.exesteam.exethebat.exethunderbird.exeQ:\W:\E:\R:\T:\Y:\U:\I:\O:\P:\A:\S:\D:\F:\G:\H:\J:\K:\L:\Z:\X:\C:\V:\B:\N:\M:\IsWow64Processkernel32.dllWow64DisableWow64FsRedirection/c vssadmin.exe delete shadows /all /quietcmd.exeopenWow64RevertWow64FsRedirection
Source: ZunmmW7pe5.exe, 00000000.00000000.1645153422.00007FF7E3711000.00000080.00000001.01000000.00000003.sdmp	Binary or memory string: memtasmepocsvsssqlsvc$veeambackupGxVssGxBlrGxFWDGxCVDGxCIMgrDefWatchccEvtMgrccSetMgrSavRoamRTVscanQBFCServiceQBIDPServiceIntuit.QuickBooks.FCSQBCFMonitorServiceAcrSch2SvcAcronisAgentCASAD2DWebSvcCAARCUpdateSvcsql.exeoracle.exeocssd.exedbsnmp.exevisio.exewinword.exewordpad.exenotepad.exeexcel.exeonenote.exeoutlook.exesynctime.exeagntsvc.exeisqlplussvc.exexfssvccon.exemydesktopservice.exeocautoupds.exeencsvc.exefirefox.exetbirdconfig.exemydesktopqos.exeocomm.exedbeng50.exesqbcoreservice.exeinfopath.exemsaccess.exemspub.exepowerpnt.exesteam.exethebat.exethunderbird.exeQ:\W:\E:\R:\T:\Y:\U:\I:\O:\P:\A:\S:\D:\F:\G:\H:\J:\K:\L:\Z:\X:\C:\V:\B:\N:\M:\IsWow64Processkernel32.dllWow64DisableWow64FsRedirection/c vssadmin.exe delete shadows /all /quietcmd.exeopenWow64RevertWow64FsRedirection
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe vssadmin.exe delete shadows /all /quiet	Jump to behavior
Source: vssadmin.exe, 00000008.00000002.1705895117.0000027A0F000000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: C:\Users\user\Desktop\C:\Windows\system32\vssadmin.exevssadmin.exe delete shadows /all /quietvssadmin.exe delete shadows /all /quietWinSta0\Default
Source: vssadmin.exe, 00000008.00000002.1705895117.0000027A0F000000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vssadmin.exe delete shadows /all /quiet
Source: vssadmin.exe, 00000008.00000002.1708547648.0000027A0F345000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vssadmin.exedeleteshadows/all/quietE
Source: ZunmmW7pe5.exe	Binary or memory string: memtasmepocsvsssqlsvc$veeambackupGxVssGxBlrGxFWDGxCVDGxCIMgrDefWatchccEvtMgrccSetMgrSavRoamRTVscanQBFCServiceQBIDPServiceIntuit.QuickBooks.FCSQBCFMonitorServiceAcrSch2SvcAcronisAgentCASAD2DWebSvcCAARCUpdateSvcsql.exeoracle.exeocssd.exedbsnmp.exevisio.exewinword.exewordpad.exenotepad.exeexcel.exeonenote.exeoutlook.exesynctime.exeagntsvc.exeisqlplussvc.exexfssvccon.exemydesktopservice.exeocautoupds.exeencsvc.exefirefox.exetbirdconfig.exemydesktopqos.exeocomm.exedbeng50.exesqbcoreservice.exeinfopath.exemsaccess.exemspub.exepowerpnt.exesteam.exethebat.exethunderbird.exeQ:\W:\E:\R:\T:\Y:\U:\I:\O:\P:\A:\S:\D:\F:\G:\H:\J:\K:\L:\Z:\X:\C:\V:\B:\N:\M:\IsWow64Processkernel32.dllWow64DisableWow64FsRedirection/c vssadmin.exe delete shadows /all /quietcmd.exeopenWow64RevertWow64FsRedirection

Modifies existing user documents (likely ransomware behavior)

Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	File moved: C:\Users\user\Desktop\GNLQNHOLWB\BWETZDQDIB.pdf	Jump to behavior
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	File moved: C:\Users\user\Desktop\GNLQNHOLWB\MOCYNWGDZO.mp3	Jump to behavior
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	File moved: C:\Users\user\Desktop\PWZOQIFCAN\IZMFBFKMEB.pdf	Jump to behavior
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	File moved: C:\Users\user\Desktop\PWZOQIFCAN\UBVUNTSCZJ.mp3	Jump to behavior
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	File moved: C:\Users\user\Desktop\GNLQNHOLWB.jpg	Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: ZunmmW7pe5.exe, type: SAMPLE	Matched rule: Detects Babuk ransomware Author: ditekSHen
Source: 0.2.ZunmmW7pe5.exe.7ff7e3710000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Babuk ransomware Author: ditekSHen
Source: 0.0.ZunmmW7pe5.exe.7ff7e3710000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Babuk ransomware Author: ditekSHen

Yara signature match

Source: ZunmmW7pe5.exe, type: SAMPLE	Matched rule: MALWARE_Win_Babuk author = ditekSHen, description = Detects Babuk ransomware
Source: 0.2.ZunmmW7pe5.exe.7ff7e3710000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Babuk author = ditekSHen, description = Detects Babuk ransomware
Source: 0.0.ZunmmW7pe5.exe.7ff7e3710000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Babuk author = ditekSHen, description = Detects Babuk ransomware

Detected potential crypto function

Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E3711C00	0_2_00007FF7E3711C00
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E3712C00	0_2_00007FF7E3712C00
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E3724300	0_2_00007FF7E3724300
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E3713970	0_2_00007FF7E3713970
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E37130B0	0_2_00007FF7E37130B0
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E3712070	0_2_00007FF7E3712070
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E37227C0	0_2_00007FF7E37227C0
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E3737F20	0_2_00007FF7E3737F20
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E37234B0	0_2_00007FF7E37234B0
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E371ACC0	0_2_00007FF7E371ACC0
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E37394C0	0_2_00007FF7E37394C0
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E371CD10	0_2_00007FF7E371CD10
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E3720460	0_2_00007FF7E3720460
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E372EC60	0_2_00007FF7E372EC60
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E37313B0	0_2_00007FF7E37313B0
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E3736340	0_2_00007FF7E3736340
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E3720AB0	0_2_00007FF7E3720AB0
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E372BAB0	0_2_00007FF7E372BAB0
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E37472C0	0_2_00007FF7E37472C0
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E371BAF0	0_2_00007FF7E371BAF0
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E373DAF8	0_2_00007FF7E373DAF8
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E3738240	0_2_00007FF7E3738240
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E373F9AC	0_2_00007FF7E373F9AC
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E37219F0	0_2_00007FF7E37219F0
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E371D120	0_2_00007FF7E371D120
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E3716920	0_2_00007FF7E3716920
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E3718150	0_2_00007FF7E3718150
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E3737980	0_2_00007FF7E3737980
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E3736180	0_2_00007FF7E3736180
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E37368B0	0_2_00007FF7E37368B0
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E37388D0	0_2_00007FF7E37388D0
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E3714900	0_2_00007FF7E3714900
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E3737EF0	0_2_00007FF7E3737EF0
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E371A820	0_2_00007FF7E371A820
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E373A020	0_2_00007FF7E373A020
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E3735840	0_2_00007FF7E3735840
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E372F050	0_2_00007FF7E372F050
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E373D87C	0_2_00007FF7E373D87C
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E3717FD0	0_2_00007FF7E3717FD0
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E3742F30	0_2_00007FF7E3742F30
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E3738F60	0_2_00007FF7E3738F60
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E371D780	0_2_00007FF7E371D780
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E3716EA0	0_2_00007FF7E3716EA0
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E372F6A0	0_2_00007FF7E372F6A0
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E37306C0	0_2_00007FF7E37306C0
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E3731F00	0_2_00007FF7E3731F00
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E3716640	0_2_00007FF7E3716640
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E3717650	0_2_00007FF7E3717650
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E3735650	0_2_00007FF7E3735650
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E3738660	0_2_00007FF7E3738660
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E3735E90	0_2_00007FF7E3735E90
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E374A5A8	0_2_00007FF7E374A5A8
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E37395D0	0_2_00007FF7E37395D0
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E3746DF0	0_2_00007FF7E3746DF0
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E3737520	0_2_00007FF7E3737520

Source: ZunmmW7pe5.exe	Virustotal: Detection: 79%
Source: ZunmmW7pe5.exe	Metadefender: Detection: 27%
Source: ZunmmW7pe5.exe	ReversingLabs: Detection: 88%

Source: C:\Users\user\Desktop\ZunmmW7pe5.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\ZunmmW7pe5.exe

Code function: 0_2_00007FF7E3711660 CreateToolhelp32Snapshot,Process32FirstW,lstrcmpW,OpenProcess,TerminateProcess,CloseHandle,Process32NextW,FindCloseChangeNotification,

0_2_00007FF7E3711660

Source: unknown	Process created: C:\Users\user\Desktop\ZunmmW7pe5.exe "C:\Users\user\Desktop\ZunmmW7pe5.exe"
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe vssadmin.exe delete shadows /all /quiet
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe vssadmin.exe delete shadows /all /quiet	Jump to behavior

Source: C:\Users\user\Desktop\ZunmmW7pe5.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8036:120:WilError_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8036:304:WilStaging_02
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Mutant created: \Sessions\1\BaseNamedObjects\asfgjkl878645165456fa888
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7980:120:WilError_02
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7980:304:WilStaging_02

Source: classification engine

Classification label: mal100.rans.winEXE@7/291@0/0

Source: C:\Users\user\Desktop\ZunmmW7pe5.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: ZunmmW7pe5.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: ZunmmW7pe5.exe

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\ZunmmW7pe5.exe

Code function: 0_2_00007FF7E3711310 LoadLibraryA,GetProcAddress,ShellExecuteW,LoadLibraryA,GetProcAddress,

0_2_00007FF7E3711310

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Hooking and other Techniques for Hiding and Protection

Deletes itself after installation

Source: C:\Users\user\Desktop\ZunmmW7pe5.exe

File deleted: c:\users\user\desktop\zunmmw7pe5.exe

Jump to behavior

Stores large binary data to the registry

Source: C:\Users\user\Desktop\ZunmmW7pe5.exe

Key value created or modified: HKEY_CURRENT_USER\Software RookPrivateKey

Jump to behavior

Source: C:\Users\user\Desktop\ZunmmW7pe5.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Sample execution stops while process was sleeping (likely an evasion)

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\ZunmmW7pe5.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\ZunmmW7pe5.exe

Code function: 0_2_00007FF7E3713970 GetProcessHeap,GetCommandLineW,CommandLineToArgvW,SetProcessShutdownParameters,RtlInitializeCriticalSection,CreateFileW,SHEmptyRecycleBinA,GetSystemInfo,RtlAllocateHeap,CreateSemaphoreA,CreateSemaphoreA,RtlInitializeCriticalSection,RtlAllocateHeap,CreateSemaphoreA,CreateSemaphoreA,RtlInitializeCriticalSection,RtlAllocateHeap,RtlAllocateHeap,CreateThread,CreateThread,lstrlenW,lstrlenW,RtlAllocateHeap,lstrcpyW,HeapFree,lstrlenW,lstrlenW,lstrlenW,RtlAllocateHeap,lstrcpyW,lstrlenW,HeapFree,lstrlenW,OpenMutexA,CreateMutexExA,GetLogicalDrives,WaitForSingleObject,WaitForSingleObject,RtlAcquirePebLock,RtlLeaveCriticalSection,ReleaseSemaphore,WaitForMultipleObjects,WaitForSingleObject,WaitForSingleObject,RtlAcquirePebLock,RtlLeaveCriticalSection,ReleaseSemaphore,WaitForMultipleObjects,CloseHandle,CloseHandle,HeapFree,HeapFree,RtlDeleteCriticalSection,CloseHandle,ExitProcess,

0_2_00007FF7E3713970

Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E3712C00 RtlAllocateHeap,lstrcpyW,lstrcatW,CreateFileW,lstrlen,WriteFile,CloseHandle,lstrcpyW,lstrcatW,FindFirstFileW,lstrcmpiW,lstrcpyW,lstrcatW,lstrcatW,lstrcmpW,lstrlenW,lstrcmpiW,lstrcmpiW,lstrcmpiW,WaitForSingleObject,WaitForSingleObject,RtlAcquirePebLock,RtlLeaveCriticalSection,ReleaseSemaphore,HeapFree,RtlAcquirePebLock,lstrlenW,RtlAllocateHeap,RtlLeaveCriticalSection,ReleaseSemaphore,FindNextFileW,FindClose,lstrlenW,WideCharToMultiByte,RtlAllocateHeap,lstrlenW,WideCharToMultiByte,GetLastError,HeapFree,RtlReleasePrivilege,	0_2_00007FF7E3712C00
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E37130B0 WaitForSingleObject,WaitForSingleObject,RtlAcquirePebLock,RtlLeaveCriticalSection,ReleaseSemaphore,HeapFree,RtlAcquirePebLock,lstrlenW,RtlAllocateHeap,RtlLeaveCriticalSection,ReleaseSemaphore,RtlAllocateHeap,lstrcpyW,lstrcatW,FindFirstFileW,lstrcmpiW,lstrcpyW,lstrcatW,lstrcatW,FindNextFileW,FindClose,lstrlenW,WideCharToMultiByte,RtlAllocateHeap,lstrlenW,WideCharToMultiByte,GetLastError,HeapFree,RtlReleasePrivilege,	0_2_00007FF7E37130B0
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E374313C FindFirstFileExA,	0_2_00007FF7E374313C

Source: C:\Users\user\Desktop\ZunmmW7pe5.exe

API call chain: ExitProcess graph end node

Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	File opened: C:\Documents and Settings\user\Application Data\Adobe\Acrobat\DC\	Jump to behavior
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	File opened: C:\Documents and Settings\user\3D Objects\	Jump to behavior
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	File opened: C:\Documents and Settings\user\Application Data\	Jump to behavior
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	File opened: C:\Documents and Settings\user\Application Data\Adobe\Acrobat\	Jump to behavior
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	File opened: C:\Documents and Settings\user\Application Data\Adobe\	Jump to behavior
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	File opened: C:\Documents and Settings\user\	Jump to behavior

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Source: C:\Users\user\Desktop\ZunmmW7pe5.exe

Code function: 0_2_00007FF7E37403F4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF7E37403F4

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\ZunmmW7pe5.exe

Code function: 0_2_00007FF7E3711310 LoadLibraryA,GetProcAddress,ShellExecuteW,LoadLibraryA,GetProcAddress,

0_2_00007FF7E3711310

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Source: C:\Users\user\Desktop\ZunmmW7pe5.exe

0_2_00007FF7E3713970

Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E37403F4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF7E37403F4
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E374AB44 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00007FF7E374AB44
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E373B340 SetUnhandledExceptionFilter,	0_2_00007FF7E373B340
Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Code function: 0_2_00007FF7E373B1A0 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF7E373B1A0

Creates a process in suspended mode (likely to inject code)

Source: C:\Users\user\Desktop\ZunmmW7pe5.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet			Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\vssadmin.exe vssadmin.exe delete shadows /all /quiet			Jump to behavior

Contains functionality to query CPU information (cpuid)

Source: C:\Users\user\Desktop\ZunmmW7pe5.exe

Code function: 0_2_00007FF7E374A3F0 cpuid

0_2_00007FF7E374A3F0

Source: C:\Users\user\Desktop\ZunmmW7pe5.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\ZunmmW7pe5.exe

Code function: 0_2_00007FF7E373B08C GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF7E373B08C

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

⊘No contacted IP infos

Name	Type	MD5	SHA1	SHA256
C:\Documents and Settings\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\CLR_v2.0_32\UsageLogs\howtorestoreyourfiles.txt.Rook (copy)	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\3D Objects\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\AppData\Local\Adobe\ARM\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\AppData\Local\Adobe\ARM\S\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\AppData\Local\Adobe\ARM\{291AA914-A987-4CE9-BD63-AC0A92D435E5}\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt21.lst.Rook	PGP\011Secret Sub-key -	524136C47461F448ECA116B8BA9BF4D9	DB4A33F5763BA0964F04D6A6DCF8EEBEEF202432	F55D36EEE0465C29D618B81552CC0DE5A1DE5BA6E0D172C29B8AED5D81FF8B20
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt21.lst.Rook	data	DC452B0FAC7EA25177C6041944989CDD	69EBF17FFD565AA62F086F76ABC28F93B720D07F	FFCDC603DAEDF772A54F00FDE883FC26039FE1D0530777482CC2BDFDA19C2A02
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt21.lst.Rook	data	F8BD16339FA33D903066A363C067D27B	84D8C68DDB78EF71466CF2A3E3023453C81B16D2	1C146135FC08657505233FD058DFA34F6F826F99F17C766E90CB24AF750E0760
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheRdr65536.dat.Rook	data	0EA226A6D268E527C14C8B7261900458	72D361D45E519482B25225C8378A6C6B4FC28FC4	15A97E85612BF50D0CCDE77D7AE5A80FB8FE30F06744815A061A9E90F904155B
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Reader\Files\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Reader\Files\TESTING.Rook	data	A57E57E3C2239A0C522601122E5EE727	B881D07CFCA064F12B4FCB9F8909CE19CA332F4A	52736B5F60165A324C17BBE5F2E9AB997EAC7E98AA58AEB9B03E5A794587753B
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Reader\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Reader\SOPHIA.json.Rook	data	59FD9542CB701828F487E0F1BE570D5F	AAF88BCC4FCE9BEE570CC4A8CDC488CC553518A8	38B6F6CF277C9646E0B5ED558AD196230F1A6FE4284D9F155DC3061424986077
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents.Rook	data	40280AE29CCD2955847ED110868BA68A	795897E8891BEDAE4DE904727E57F5158FB5C1A3	0EC7AF79008CB7C15DA5CD2D9A275E924BBA3BB4DA234BBAEB0AF91971BDBAC3
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\ToolsSearchCacheRdr\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache.bin.Rook	data	6A37309E354D08FABBD692670358C633	65EFE9E2921073258BBA96569E861650A9227E3C	6D88AE87F284A96B420E266D56CEB0C4A363AA6F2E434B54E5E42D57DE0E50F5
C:\Users\user\AppData\Local\Adobe\Acrobat\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\AppData\Local\Adobe\Color\ACECache11.lst.Rook	data	1B794924D1DD881266AD571BAA53C296	78701080E25502DAFC6FBC341B182EAC7A029AC3	71EB7B55938137E9625534335A06FEF2C0158DA28C31F179A9DDAB484B9AC45F
C:\Users\user\AppData\Local\Adobe\Color\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\AppData\Local\Adobe\Color\Profiles\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\AppData\Local\Adobe\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\AppData\Local\Comms\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\AppData\Local\Comms\UnistoreDB\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\AppData\Local\Comms\UnistoreDB\USS.jcp.Rook	data	7B3C45555D21132929AD44A8EF58D6B8	002C80D0D54B275799662D40F63CD978EE8CCAE8	E35B85831F317CFABDDB8EA1970BBD34013C612F52B24AF0059231532F5F457B
C:\Users\user\AppData\Local\Comms\UnistoreDB\USSres00001.jrs.Rook	data	9D114D4C08E13FDA7E02630FA290E927	8F8ADD9927C2D2D4CECBF1FEE34EC6089B65DC04	B615478E617EF11644D347FC2E73E9495A61A52EC107C6E2BB31D54665AD92DD
C:\Users\user\AppData\Local\Comms\UnistoreDB\USSres00002.jrs.Rook	data	1825BF691F69DD82164A3A13E00B66E6	239665FA7E28270254FF3B99C1DC6366183394A7	055CC13AA6AEF835F1F0C3BC257BD69F5CA3BC93740B66FA7AA3E07CD4A9FB16
C:\Users\user\AppData\Local\Comms\UnistoreDB\USStmp.jtx.Rook	data	9B305A76846F1896F42941FD38DE1F4E	D0FD364C09D3EB83B1C020F37192FDB72564FFE1	EA26A33D765C0893E458F31B56AD4246955532C0D5F4F7AEBA4AFE901F934281
C:\Users\user\AppData\Local\Comms\Unistore\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\AppData\Local\Comms\Unistore\data\AggregateCache.uca.Rook	data	DDC69C49A4CC61AF79BE4E3E22139588	1FFA68AE78088E53A52DD97DDF899A1A1A4536B8	66609A678DE4466CA7C70DA8A4DFE951E6A8A75FF52A8493765976A6821C5F1F
C:\Users\user\AppData\Local\Comms\Unistore\data\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\AppData\Local\ConnectedDevicesPlatform\CDPGlobalSettings.cdp.Rook	data	E1D5EDA0A269B1F98A03FB24A6A3C442	9319E42B74EE6EED212E1504D0E98CF5FEEB479F	9C1C4EDF9D94E8F7D23C3D2E0D7D2EDA15E87AEE4FDED5428F4B3746691B438A
C:\Users\user\AppData\Local\ConnectedDevicesPlatform\Connected Devices Platform certificates.sst.Rook	data	BD1BEB14DE09694607086CE6BF037D55	6831FD562379842FECC7D2BA7ED681A90DC7355E	C9CE3952273A33DF7E787F5BF4A5CD3AA011D6B8D4E086D2EA0E9352977BC4A1
C:\Users\user\AppData\Local\ConnectedDevicesPlatform\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\AppData\Local\ConnectedDevicesPlatform\L.user.cdp.Rook	data	8911050C45CAC22B475104DDC916AEFC	39B417425EEE6EACE202F09D2EC75DF690EB85A3	4450C1E96EEE3B344DBFE9A3FC2C119F73A610B81F27A9CCEDE3CF8D95337DF4
C:\Users\user\AppData\Local\ConnectedDevicesPlatform\L.user.cdpresource.Rook	data	233790AFC4079116C25F720414D8ADA2	5FB6C6114FB6D0399E165A830FA807651D10AA32	23B7A6C32DF9D6D3FC456365EFB324CD3A9ECF2913772BE857E1560573EC5991
C:\Users\user\AppData\Local\ConnectedDevicesPlatform\L.user\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\AppData\Local\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\howtorestoreyourfiles.txt.Rook	data	3EABF51E8670170127E92745ADA00301	36DD155F87C2793CE9E39496688B63A13AC0FFFB	60251F55058DD1CB6C90F9897FCC42726C57C8AF73CB822770D480B3BD49E501
C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\vncpassword.exe.log.Rook	data	C00ABE5C441AED38A89AE99AB5565082	CFFCEDDECD4D808C6653A3E6E0554F89BF9598B9	2C04688ED7F4D6808C25EE07D90668D001D28919EAD818A1CDF7CF822A65ACFD
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\mmc.exe.log.Rook	data	8EA40DAAFC9645EDE70C6E9EB48A72DA	8FFC6D4EFE9E1751C3CF446DAFE6A8042C3D97F3	1D8F442FE2BDFBD34A30B4F038B040B1245D27E8F04C76CEEF5198844F5E8386
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log.Rook	data	45E8DDC5A1FCA1EB8280490D96210FC2	FE3D54B2D77BB37C5212A6AB8DAF7A8CC5257D00	011833BF2F0742337E121E4F375FD89DB4DE68911C5C676E91DB10DAE4174F55
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log.Rook	data	D5DE0A9E064955E7FEFD9675BA58ED1C	3AD33E375D1CD3F33150F552FF358584EB21D501	18C33A5EB0220D6F0F177AF8DE2D75EBA17AB817DEB75DA27F6AD18D49B576CE
C:\Users\user\AppData\Local\Microsoft\Credentials\DFBE70A7E5CC19A398EBF1B96859CE5D.Rook	data	2F273B15F7A8CEA40A2B267400635B0B	819CAC3EBB1F4B2B6F446C8525C7B4701BAA6CE6	F8D238B82C223DC507B621D3D9F7F920594E164620D233356BACE848B181EE89
C:\Users\user\AppData\Local\Microsoft\Credentials\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\AppData\Local\Microsoft\Event Viewer\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\AppData\Local\Microsoft\Event Viewer\RecentViews.Rook	DOS executable (COM)	C084D757D0D752CC5F14772D00C79A76	CACF820E737E03335DCFEC89A5619B1DB73E2B13	3EE581ACF110EB1656389BBBB275E3B2EA0D28E642BF5EA762CEC4EF597D07A6
C:\Users\user\AppData\Local\Microsoft\Event Viewer\Settings.Xml.Rook	data	B0D1D4C2AF2CA4C47F3FCDAB4865AD1F	CAB81B4911638BA9A797247D237CC85DF3EB8020	7F5A051837D24374A456AF5C7020CC5CB7B988CE7EF5DFB0DE10ABC2030A5C52
C:\Users\user\AppData\Local\Microsoft\Event Viewer\Views\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\AppData\Local\Microsoft\Feeds Cache\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\AppData\Local\Microsoft\Feeds\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\AppData\Local\Microsoft\GameDVR\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\AppData\Local\Microsoft\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies\DNTException\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies\DNTException\Low\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies\ESE\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies\Low\ESE\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies\Low\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies\PrivacIE\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\AppData\Local\Microsoft\Windows\INetCookies\PrivacIE\Low\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\AppData\Local\Microsoft\input\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\AppData\Local\Microsoft\input\af-ZA\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\AppData\Local\Microsoft\input\ar-AE\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\AppData\Local\Microsoft\input\ar-BH\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\AppData\Local\Microsoft\input\ar-DZ\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\AppData\Local\Microsoft\input\ar-EG\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\AppData\Local\Microsoft\input\ar-IQ\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\AppData\Local\Microsoft\input\ar-JO\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\AppData\Local\Microsoft\input\ar-KW\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Collab\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Forms\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\JSCache\GlobData.Rook	data	F342F81E075A32AADE4BA56EC313B4C2	E457D56E61E0A4565824DAA25CAFAF5190D0C72A	335D7BFF63C3936BF5DEC6C950CFD42F65ACAFA805D71D06C22F1B205206F874
C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\JSCache\GlobSettings.Rook	data	113BA9541F5582EF95A8B65ADB108402	8C4BD778CF5E245F084258D897FE4BEAC8EEEBA2	96390BE0CDF7CF029F085A4445A2E6E83DE26D73F72FE1D3F348788898737F17
C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\JSCache\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl.Rook	data	510B3D79D154E73BEDC253736F367882	4F26C8627C70D1CB4F5CC2C00588CB0FC365B7F6	0A24D69CB29B886D19E36AD31204B585AE2DB81C8FB153A7624E2EDED6B9A60C
C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl.Rook	data	45E277DDD6E2A5A2D084EE67F58AD13C	1223B8828B1BC5211BDBBFC85EC50CF04105DCBC	1D92820D60A487F7ADAF4375C7EEAAD7C6AEC96B8B6CA3A06089EAF8AFC6B46D
C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\ES_session_store.Rook	data	A990D98FD151DBB8AC16E6C807E7E420	F4342212E0FCE4DA85F7E985089216A16FF2C2E0	261EDED39E013046D408131DFBE02492403723EF88747CABAD9ECA81B0DBB365
C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\ES_session_storei.Rook	data	B151A641B9B233DC2B781644105E59BB	D03ACA22C2E78CA5475750C3CB2BECAE3AF2F7EC	8DD042D7E9129C7B85748B8A3ABF7E659EAAB3223B1F43649789512B286FC417
C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\ES_session_storek.Rook	data	5533844DE13B189DA28C93531A16219A	E6157687DA561C5E01E874616FAC3FA1BD184D83	6A894701E7356EE1A85B0EE8210A52574B1350A02CF8E1F108DB2F0103C3C5C2
C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\addressbook.acrodata.Rook	data	A8847CCF87E692A78A73B309AC1500C6	E151EE9680B3A8B732ACD3A5ED7AE0301C2C60E4	3A43C5A657FB3A78FE647050A054C431900A094907098A0CE3AA4386A3CAA1C2
C:\Users\user\AppData\Roaming\Adobe\Acrobat\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\AppData\Roaming\Adobe\Flash Player\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\AppData\Roaming\Adobe\Flash Player\NativeCache\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\AppData\Roaming\Adobe\Headlights\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\AppData\Roaming\Adobe\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\AppData\Roaming\Adobe\Linguistics\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\AppData\Roaming\Adobe\LogTransport2\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\AppData\Roaming\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\AppData\Roaming\Microsoft\AddIns\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\AppData\Roaming\Microsoft\Credentials\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\AppData\Roaming\Microsoft\Excel\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\AppData\Roaming\Microsoft\Excel\XLSTART\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\AppData\Roaming\Microsoft\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\AppData\Roaming\Microsoft\MMC\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\AppData\Roaming\Microsoft\MMC\eventvwr.Rook	data	711715D21CAAB601BD95AED954EB36DE	AA349C7CA0FE30036E9FB7D5053F668630C7CAB2	5EDE41CA22FF57DC3DE421E229AEBB4BBB84D799C7F9A08C2F0F1DE81EF31161
C:\Users\user\AppData\Roaming\Microsoft\MMC\services.Rook	data	D402A14C76A75CA6E26281A8A885D67B	1D169C1886EF5BE1F70336D919F29B13CDDB117B	179713D7A9E3B788340AA6C515FB3DD7B93B3FC5F2974ED900DA3E55C88317FC
C:\Users\user\AppData\Roaming\Microsoft\Network\Connections\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\AppData\Roaming\Microsoft\Network\Connections\Pbk\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\AppData\Roaming\Microsoft\Network\Connections\Pbk\_hiddenPbk\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\AppData\Roaming\Microsoft\Network\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\AppData\Roaming\Microsoft\Office\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\AppData\Roaming\Microsoft\Office\MSO1033.acl.Rook	data	8814823ECBC93835AC369DA1CBAFAB45	2FE7436E6F1B6410532B0DCA4C828D0406D51CB6	929838F2EFFF7221238E0E92A1F61F71009A0BBA50359D1F4122B2BBDF8E8BBB
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Templates.LNK.Rook	data	9EE12A7CE59DDB0C9626D452D7DC0E54	629EC24A565BE9E979C8F55EAF25C68EE2790F7D	7D3572418923BE97EA62EA17D21EFEECCE65C658877B240595E6B76FA10FB83D
C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat.Rook	data	CFDDB0D71D9772C79370768F186CB22D	E158D0C4CA48259669661D2ACBCC0A2C0E85D4F3	64EF6B30A2BBF38651EFF18A981F3887EAD37172D36DCCF2DBCE5AA2AB19B6B0
C:\Users\user\AppData\Roaming\Microsoft\Proof\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\AppData\Roaming\Microsoft\Protect\CREDHIST.Rook	data	13356B43352ECE6B09453586AF6B5B27	4D2669C6BA875931623C7DF0285CFB818FBB674D	32FBAE59D543A85769C7D24822A48FDFD8786B3203A91E264E36DB92F03D7702
C:\Users\user\AppData\Roaming\Microsoft\Protect\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\AppData\Roaming\Microsoft\Protect\S-1-5-21-2660496737-530772487-1027249058-1002\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\AppData\Roaming\Microsoft\Protect\S-1-5-21-2660496737-530772487-1027249058-1002\Preferred.Rook	data	DF39A76926EF4C894A306EBEA4C39C8B	AC24C1E1C68C18E0927D4C333106DA10902BAC13	BF94BAB520A09C492D68EBA37B386440BDC6E62F4E14E80C2DDC4005BFFFC068
C:\Users\user\AppData\Roaming\Microsoft\Protect\S-1-5-21-2660496737-530772487-1027249058-1002\a05d339e-a3c6-48e3-9c59-a78ea2f33bb9.Rook	data	570CAE203AD4E9A3758A5A042FFAA5A6	B1AD44250833F2F483974D92F03A05F75986022E	27A6486D932DA51E56B0C99355A7609C72FF7EBCC438EA73DA8181DDBF050997
C:\Users\user\AppData\Roaming\Microsoft\Protect\S-1-5-21-2660496737-530772487-1027249058-1002\b1b54341-cda4-4fa0-b7cc-364639891c64.Rook	data	BAB9590B0B0CD13F29770630590AE87E	22B7161B848B1B53A31962CEE5D841D8B916C782	1A95DADDAF913363D129E22D85D056ABFB497AF6CA712B14F7A61064078C7DD5
C:\Users\user\AppData\Roaming\Microsoft\Protect\S-1-5-21-2660496737-530772487-1027249058-1002\dfa83e9c-42e3-4d47-9b21-73b797a8d8bd.Rook	data	E8D459F0F8A9F8A028F59C29BB492EDA	D2564D024F5C1CC35DE46EA7199A222310A1ACD9	EBBC9A7A362C50F4FFD438293F7C0B654E7515B0D0785C5860A57F1008C405D8
C:\Users\user\AppData\Roaming\Microsoft\Protect\SYNCHIST.Rook	data	65ED4C58B2B7338EA57D1D2E27E4CF5D	538FBF247660CF82A88137F4948F1E640BBC6143	83B126A5D106A0DAC8C2ED971BF124FE0765827E670DA48DDA9F3783AC8801EB
C:\Users\user\AppData\Roaming\Microsoft\Speech\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\AppData\Roaming\Microsoft\Spelling\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\AppData\Roaming\Microsoft\Spelling\en-US\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\AppData\Roaming\Microsoft\Spelling\en-US\default.acl.Rook	data	BE56C6DA4719B9CBB08F8B5D5A4FF0F7	C40CC1AA7648D2DA2DDDEAF4820F95A48A952500	20C2F24298B8922D607DD51385D0053634F34945F46E90A9890FD93D45DFAC3A
C:\Users\user\AppData\Roaming\Microsoft\Spelling\en-US\default.dic.Rook	data	594C3E2FE4DA99639AB4E69429A42311	79427555C3B7742A73A07E40484EB24EF8FD8AC4	B34A74ED5F405CCA78625BDABC1FD9F1B3D13906734E720342BD2D60327685D5
C:\Users\user\AppData\Roaming\Microsoft\Spelling\en-US\default.exc.Rook	data	CD0DBCF3BA6055E8B48710BB42FBB8E5	A4F5D75FE0AFD4D91BCA65427E27F4F7D6001F36	9C5242B0024F0E6C9B5D799BA9612643EAB89F3FAA2392DC4DC08D9282F30C09
C:\Users\user\AppData\Roaming\Microsoft\SystemCertificates\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\AppData\Roaming\Microsoft\SystemCertificates\My\CRLs\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\AppData\Roaming\Microsoft\SystemCertificates\My\CTLs\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\AppData\Roaming\Microsoft\SystemCertificates\My\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\AppData\Roaming\Microsoft\Templates\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\1033\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Document Themes\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\1033\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\SmartArt Graphics\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Bibliography Styles\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\AppData\Roaming\Microsoft\Templates\Normal.dotm.Rook	data	56DAFD3DAD280E8796424A7EC7E88ED1	9A6D622AF852B21D3764B1EA1E6D47B3E361FE90	57CA5E1194241A947D75AB37E685E3A7E4F50FDEE84BF51DCEA0881E3D73AB8C
C:\Users\user\AppData\Roaming\Microsoft\Vault\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\AppData\Roaming\Microsoft\Word\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\AppData\Roaming\Microsoft\Word\STARTUP\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\Contacts\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\Desktop\7-Zip File Manager.lnk.Rook	data	296F2E7732B6A8384BAEEC2B1ABAFE32	A80635277870D1BD67D86BCD8395C7A7E92CB400	9A3E1296B63E1CCF1518C0F8BCD3CD4D4014FB14F90D3CBDA8B979DE3C967B0A
C:\Users\user\Desktop\BQJUWOYRTO.xlsx.Rook	data	E1390935C0137506C36B4F6E59A2437D	5E825433E89EB5B780B72B9A7FFB63D85609FDB7	3EC80E006F9CB40CD95DAD5528E22197F6E18A05D704762943553EC583DEECCD
C:\Users\user\Desktop\BUFZSQPCOH.mp3.Rook	data	845F78139D2EF5767EBA2CEC25E9C5E9	F2808798CED3E58B2115E3153E0C8D3E172256A3	345EF3DF517C90CD6BD30B35B31798D8847B389B0469E92EBD3BF32B6B366BF5
C:\Users\user\Desktop\BWDRWEEARI.png.Rook	data	143AC0388AAC6CF66CA3642169B74113	FCF502638A97625BC76DD9453A178C206F74FC4F	63C5674BDF180B430C250861387B4B40ED48132628704F877BCCE87A67BC4E48
C:\Users\user\Desktop\BWDRWEEARI.xlsx.Rook	data	172EA7B42682CB8683AABF4E509AA6BF	45E686ADA5B9319A1300ED7D241528ED9AE6C464	1C6540B5DD053691F806E48B15536C3397C63ADE06F98C6ECFA7317D54BE45A0
C:\Users\user\Desktop\BWETZDQDIB.pdf.Rook	COM executable for DOS	FE06AE29DAC42626E46AF9F86C1EF670	0EAB1848D7499E9A10CE36F8FD1C0E4D8EE6E466	7AB442EC7CAAD4033FBCA09F55C1DDACE9B1F5BBA1029FCD1BC25C387E483781
C:\Users\user\Desktop\DBIQSSCSZX\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\Desktop\DUKNXICOZT.jpg.Rook	data	7111A8D5FA3E23AEF512ED8049E1C021	FFC2719EEF7FA61FDFBF0394DE7DE6542ACC8035	08C141EA53D8C20D34818BD8A3B25372B12665B4AD792745F4EF226E4A8A648A
C:\Users\user\Desktop\DUKNXICOZT.mp3.Rook	data	FB2125A14291A979F76A8F7C5249B3D9	E0BF4B17D4569D85BD01A33420FFEC131DF49866	A0D56C6FEE32830DD6D7200859172F79B2D597787747F107ED6F3A3E5E54326A
C:\Users\user\Desktop\DWTHNHNNJB\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\Desktop\ERWQDBYZVW\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\Desktop\Excel.lnk.Rook	data	1CEA6761A36023DC95C099FE35A3542F	8E771AD5F2536D94B3FB88F3A00D4AA44355D587	EB259C77F6BF550062FAA76660EA215A05B3065D9C5A4A6109A38E4A4565D8A4
C:\Users\user\Desktop\FAAGWHBVUU\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\Desktop\GNLQNHOLWB.docx.Rook	data	F7BDFA533C065049317710EB85F3DEB2	93D41ACF276E0332F9AB5E78EA4516B03AC6C6AF	E04C4E80029DDE55F10BF5E8FE5E6DE20B5D74D9A1E991A04104B61325F99720
C:\Users\user\Desktop\GNLQNHOLWB.jpg.Rook	data	93E6CE71D6D5FEF201D44FF86AE23CCC	640DF63B2625875ADF752D41EEAA23BEDEFC7E38	6F58B057551A762A010F887F25183B73AFCB9A2D58AE1A843B8B2CA0DDE2C048
C:\Users\user\Desktop\GNLQNHOLWB\BWETZDQDIB.pdf.Rook	data	6C24572D782B68CAC72D6DE33760C8D6	74A32D9292679B211EE346F21FF13AB535AEA120	B9FF1B32481F4E45B22C5E14D3AB7375FDF9DE805F4F2525D8C55667729BE2C3
C:\Users\user\Desktop\GNLQNHOLWB\DUKNXICOZT.jpg.Rook	data	93FD53E4A4688B573429DC06A52B1FFF	25D23ED40DE67075CA31486C9FDFCD1CBE4D868B	25E406508F9093E1A602B1987DDCBEC9E4042053B66119112155830CF11A6B7B
C:\Users\user\Desktop\GNLQNHOLWB\GNLQNHOLWB.docx.Rook	data	08D27FAC994C9AB909D85A9073814850	E46B47CA08410AA61CADEC60D0AA1DAFCE2DA453	E584540EE022BB744E1E32DE335FA77A7F26BA36E4795B7F440B8DF368C4EAE1
C:\Users\user\Desktop\GNLQNHOLWB\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\Desktop\GNLQNHOLWB\MOCYNWGDZO.mp3.Rook	data	E736CBBD1321DBCE25ED529CA5C47F41	613075C2CBD152FC7279308B2FB40BFA087D5B6B	9B80B2B999EC1A9CCC3AF4D070E90B86E0DD1390E90B3738B29DF702BAF7B0ED
C:\Users\user\Desktop\GNLQNHOLWB\UBVUNTSCZJ.xlsx.Rook	data	8536B8B9273459D191DB4984C0D0EB66	989582C94C87CC8EE793766D1BF1613C3F14D852	8B597903445FB06EFEEB964A01B66F0D26409E7FDC80310BAE4B28773DC62E24
C:\Users\user\Desktop\GNLQNHOLWB\ZUYYDJDFVF.png.Rook	data	703BB62D8DD33B065BCA835369D4C0DE	53659349A472DC92C391150897F1C80B5107479A	24A230B541B5869B9D709D622D0074D10609F1A8D21AFF0C6864CFC437C3B0F1
C:\Users\user\Desktop\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\Desktop\IZMFBFKMEB.docx.Rook	data	FA7BAE204FA5AEC8D4E9FC4A709BBFF6	0F43FC4A9D9C4AFDEB19881721781ACEE15E58D3	D05A7CC4EF0D4DCE9E24E99A20526EEB79C3E7B4B17EF0D5FEDB70CE2F45C194
C:\Users\user\Desktop\IZMFBFKMEB.pdf.Rook	TeX generic font data	FE5FD87C25F581C4685194DFC41796F7	5BCB53672984CFC2E81B5FFBC4CE297AC4B8EB5B	DC142D4AD5F9C13217FE723D348DCA24AEFB4AD83A64C4EF5563240657A69D95
C:\Users\user\Desktop\IZMFBFKMEB\BWDRWEEARI.xlsx.Rook	data	B80B4888044069A55FFFC7C9E7C4946D	25779E985798F72E1CC94277001F175582280523	87CE45D7A851E83FACA102CBAFEAF6379619E6AF01469587138DFB86EE29D352
C:\Users\user\Desktop\IZMFBFKMEB\DUKNXICOZT.mp3.Rook	data	CBC4D917B52601FF9BA6FE5D57AE37CB	67788EFA5D339EB089B563AF68E309287BCC4C98	9BBBF81F1296BED271786B49EEDC6EB97B533E38D14FAF0CE0246837DD17CA02
C:\Users\user\Desktop\IZMFBFKMEB\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\Desktop\IZMFBFKMEB\IZMFBFKMEB.docx.Rook	data	8C1328052BDCCC9918B68B7DF22E68FC	CDC4FC371418851F96343CDD6A5618AAC0DC78A1	8E86202EDB3B7D6B4ECE539D96E516C9C10DCB6D2164C8EE346E2021AF21F5CA
C:\Users\user\Desktop\IZMFBFKMEB\OVWVVIANZH.png.Rook	data	E7254E3A0EFF1617A3DA9238A00EC049	E21C2F2F95E8E9282E7357F173EEEB32D7C19FAE	0A407E3849872C5D87ED1D15A2CCD457DD8B58B9073266548D35AFA52586C9FD
C:\Users\user\Desktop\IZMFBFKMEB\UBVUNTSCZJ.pdf.Rook	data	2B244EC33398960015DDA9B9AE48C1FF	40A4EDDC987BD18B90F3C39A9C948B0E0B074EA5	9226BA30A370854D9661C81A41CF30A53CAEB7293F68376D7DF221DB3504E4DD
C:\Users\user\Desktop\IZMFBFKMEB\WHZAGPPPLA.jpg.Rook	data	121B5DDD3E539FCF705566715C6965A2	E6400AC9E72D253B0A43DADF79493642D056D433	9B742950BC019F31707CC9F7B0BE680F8F52746288FB299A77E9DC47197AA634
C:\Users\user\Desktop\MIVTQDBATG\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\Desktop\MOCYNWGDZO.mp3.Rook	data	B06AB66861D3DE02FD83CEC13B4D9072	027C877D98B4E57C9C9264F31C96871191B455F6	38973F313EC8296F82A4964702C677D818C2D806D275AA3C1F8D6A5D8A9851D3
C:\Users\user\Desktop\Microsoft Edge.lnk.Rook	data	0FC034C141BAC8E131E3FDD1EFB20525	333585B77C5AEE6C510A4399D1AEBBAECFE7CF20	AD9B4E81F9E966CF0891EFD509D882FFBBEDCFA66935CC73E6BAD7C95EC8A611
C:\Users\user\Desktop\OVWVVIANZH.png.Rook	data	3E646EB6FD53A47966841FF0B0C2D358	CDCBA154812DF4052817009B26BE9F9402134C57	BB38D57EAC56E4F807ECF7763C9DBC88BED2D37690DC5D09C2C3D5D522C01FCE
C:\Users\user\Desktop\PWZOQIFCAN.docx.Rook	data	B0EB7DA5937A99BA2932B2A4AC6C6588	97325F4767053611425D40271A3E49DB20A2CC70	47E0D7F95A070E03C7989083D096F9475BDE6A8FC68533E7419E4E82904B6734
C:\Users\user\Desktop\PWZOQIFCAN\BQJUWOYRTO.xlsx.Rook	data	AFE8D3D1390945F1354938C7EDC3EAAC	54B1ABAA01E35222FD7084F1762357B8108F99C1	64EBF1B6F1251CF1F2E953EDD50B7030C6589D596A2E9464A15E9A36DA7B94DC
C:\Users\user\Desktop\PWZOQIFCAN\BWDRWEEARI.png.Rook	data	CF1C9322C80FE17EEB170068F6756C0D	99D6E545912FE5440CC5AEFBE84756C5386F8D40	91658897525B8949414B68D2AC6D6132B11778E5A8BC53875446B025D8B68983
C:\Users\user\Desktop\PWZOQIFCAN\GNLQNHOLWB.jpg.Rook	data	CBC42516A9A19949255EA72895D6E09B	683648B4BE747D8894E4A41D8458A93A9C0692BA	77CE471794E9BDC51ADA8FE58E579EB49E6911221DD2ACD04CD2D59696D6B411
C:\Users\user\Desktop\PWZOQIFCAN\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\Desktop\PWZOQIFCAN\IZMFBFKMEB.pdf.Rook	data	551E9561278A9206D326F70553A3749F	7FCE42015CA1D1F2927EF8D87E0517277DD9B58A	3A163191E24DBD66BD5F9BE379564F62640955F2BF09B6C1CCC4CDC293C5F8AD
C:\Users\user\Desktop\PWZOQIFCAN\PWZOQIFCAN.docx.Rook	data	F2998174D60C6BC823D7EC5BFB241BAA	180FEA81380A864F30EBDC44313956C650D1F5F3	45A62A20DF7A1C578BD93784DEC9D58DEB105A93CB33781C7188F004231492B1
C:\Users\user\Desktop\PWZOQIFCAN\UBVUNTSCZJ.mp3.Rook	data	EFF6DE40244DA5A3C0E0C96060FD0446	7E5E1C9C9245AE8B19662A03E0676744526436DB	3D0CC7B3D0B31BB9C0C23A7252E4589E051DEB574B54C47DBB8A7B6FD87AF082
C:\Users\user\Desktop\UBVUNTSCZJ.pdf.Rook	data	84E6242CA40907E165DB78E4A33CFAFF	28EEA0D89B1F548B489FCE6AB83F8EA1878CD170	89A6E5C927D4D63C9C42D603A5233896CDE4DCFFA0D097CCBAD369F9B644EEFC
C:\Users\user\Desktop\UBVUNTSCZJ.xlsx.Rook	data	F1CC3C65B2771E9A6F70065A8F58C37D	A95F243C4DAAC38EC62DB816BE3E5F9CF5E49F79	BAAA3D98649EE59559E2FD3C7C30AA56771550316F24E6496167041BA1D7C102
C:\Users\user\Desktop\WHZAGPPPLA.jpg.Rook	data	D7182900A8A7F79BAABF4C22BEFF3899	1D922B202B4268AFB49A145C2426A74EBFCBFE94	32882FDAE8A297280FBCD33304B4139A6FAC42971DDB4B080DBF7B1BF1F3C757
C:\Users\user\Desktop\WHZAGPPPLA\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\Desktop\Word.lnk.Rook	data	A562C282D42528492A61B5B9081C51D5	A28CC57D5AA1790D9B55DE2B136D4D6C71170381	129DAD9B1726ABA90B98A0A218630301079155C8C288675C6D483B45202C874D
C:\Users\user\Desktop\ZUYYDJDFVF.png.Rook	data	A8A722C7A77D2889127768DE8917F99F	89DB83EECCF6086F57B99FBC540FF5E0756E4E0E	F654DBC6FC01DEC6867B3FD891AE9225F0463D0A111B727F802DE96EED595D46
C:\Users\user\Documents\BQJUWOYRTO.docx.Rook	data	DE4E6A016D85E32C25D74E8A7832119D	37BC89F4450FAD75F747EC65B240B383177BE34C	D03A326EA9BE0EB846FE44EA6C4504241CF28A558E79C611591DF34DF3935960
C:\Users\user\Documents\BQJUWOYRTO\BQJUWOYRTO.docx.Rook	DOS executable (COM)	87F021B32596569E45821DAAF12C3A8E	5CB9CF416D01FD4F03507CB9629FDF25DD873980	2B9BE3D8E99D7A462AF756438C285F9FEA4D0FEDB88EFA3FACE099FEE5695525
C:\Users\user\Documents\BQJUWOYRTO\BUFZSQPCOH.png.Rook	data	D4B26D20CE86928D232D6DE26FCDC2D3	DA2C1420D07BDA9A21DCEA56BE4970EF87B07D7E	2E096242DC108CD9892582C15AC3939F10099972F020A30AC3266791EEC16377
C:\Users\user\Documents\BQJUWOYRTO\BWDRWEEARI.jpg.Rook	data	F623CEE081D35541219EC0914D5B8C0B	A1C01AF5A278D9E4A27E970A09566863428B92E5	949BD2548A1E614BEDD8307770296E172B049019F9EDA4BEA460C01B7F313894
C:\Users\user\Documents\BQJUWOYRTO\GNLQNHOLWB.pdf.Rook	data	B9A2ADAADF1D1C9C3E91E9D315B65C25	D155936B169791E0EBDFB17A451CBBD09A4C412E	97E4B9E8B6B2D64C96ED11C0533CEBE951FD09CBA6100A274AB31EED1997C855
C:\Users\user\Documents\BQJUWOYRTO\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\Documents\BQJUWOYRTO\IZMFBFKMEB.xlsx.Rook	data	1A1D3ABD99896309215FAF4BF49B56DF	4838690C5AB25EAE53C908DA0510AD9E5E67C24C	1212EE2AE26D37A429368EDB88D7AD4192C862B5C29540D7C82D704C695B9742
C:\Users\user\Documents\BQJUWOYRTO\UBVUNTSCZJ.mp3.Rook	data	DC988C6A43AD76BFCD737302E90D435F	8E874698D45E3B5E70E8E974682684B53E9AE6B1	445DAD294197176BA29DCDEC21720113FF0D032473A8CF9364F5C1A0EB8EF510
C:\Users\user\Documents\BUFZSQPCOH.png.Rook	data	EDD65AA8C1391CF41037EA3DF0282784	98DA1BCF6569A6E9C7D171DBB2F43C3930B7B1FD	02F63CDCB0554AE2904EBAE49E90C93EC70C14EE1DEA6DD8FD5F33AA9ADC16FD
C:\Users\user\Documents\BWDRWEEARI.jpg.Rook	data	099A369AEC2A4DA0BEDD457156C02BA5	702928FD7C289DD7A867FD1826961BE85ACC29FE	2D50765BBC9086C47E5A8BEE44F97C345C41355158B1BB8B0D9B2336D00C910F
C:\Users\user\Documents\BWDRWEEARI.xlsx.Rook	data	BD5E41A265B584FDDC9E05CED9F630B5	99621834A84EA517080726BBB3E1373A4A79769D	EF42C7DB29EE1F4A89D641CCAB62E6EA4EB7558168ECFB92352979C75FEC0239
C:\Users\user\Documents\BWETZDQDIB.pdf.Rook	data	19D931EECDFEFB8FEA106795D3A12BA0	F501B7474661DA539F88E145E36CF99230C4B19B	5343C09C63B36A4E3328241CE68170EB9381ED7D57FC8FDC65BF624AADA2BF7B
C:\Users\user\Documents\DBIQSSCSZX\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\Documents\DUKNXICOZT.jpg.Rook	data	61C829587AF5DAE8ED8D552E1A1E8838	190CF39A4E74B922AC40CEA8753344B45AAEDEC0	7F2798E66E2A731212B24E781A092554AE481C6DB68AB1CDBA2B27BEEFC6DBE6
C:\Users\user\Documents\DUKNXICOZT.mp3.Rook	data	78D55D03A65080415F1F32F7D2B4CF76	37349C14D10FB5FC86C92C17DEC6EEA7E5EFDE44	BFC06962168996B1D8079AE909D66DCAB3D551A535AA0644C06C1CB5105E84B8
C:\Users\user\Documents\DWTHNHNNJB\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\Documents\ERWQDBYZVW\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\Documents\FAAGWHBVUU\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\Documents\GNLQNHOLWB.docx.Rook	data	A0D524B7D61B1C803C614D54C66DDC1C	F9047361BF91A78E1659A5E705A0F655CD8D5FF2	B443723465E2E82CD39FABA74BC36B658D3F2B6EE9FDB101683001180D35FB33
C:\Users\user\Documents\GNLQNHOLWB.pdf.Rook	data	138135FBDD18037ED56DB164DADEBCC2	1DE11A7A803530E9D9FD4AF7C1F19ED62676DEEC	83B1EE6C96014B80D103178B036D71B3EA508894F9D178013EDFB24B003177D2
C:\Users\user\Documents\GNLQNHOLWB\BWETZDQDIB.pdf.Rook	data	DE6A3B4E1898C56873D2B8501216DBB7	3E594888BE2CA4F2ECB4B1F70CEC3E86B686504D	45E6D86AEE607D8C25D020ABB6C9AC90A064186691FE3408CA54DA731271D89F
C:\Users\user\Documents\GNLQNHOLWB\DUKNXICOZT.jpg.Rook	data	0BED359C5584701E71A48237F09C4DB5	544F723A45A2DFC1EC5FB5791F9F403E3CC2784A	5323E50648A96991B2B0A47C88DA36488D7857F49A5601C4F36DB36BCB24AAB9
C:\Users\user\Documents\GNLQNHOLWB\GNLQNHOLWB.docx.Rook	data	B9732DA9DA962E97471E3FC341BA664B	5D366DD183AA5366146735783C26356CA5F441F1	7415343CBC66BB67BA97264E4C800153DC84106712BBE3033C028797351904AB
C:\Users\user\Documents\GNLQNHOLWB\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\Documents\GNLQNHOLWB\MOCYNWGDZO.mp3.Rook	data	1FD03287F8C61BDC90A53EAE07BF10A1	7116347E67C37AC4B53490F7F43D85FB2A5D5C1C	ECE4FDE8040F0E8C9268F533A35536C5CA2641DC276C68078C37D7B210C52EE3
C:\Users\user\Documents\GNLQNHOLWB\UBVUNTSCZJ.xlsx.Rook	data	269963A807C6A8AD711A116B28F8C15F	A404D311BE6F074B24F6D2C80181BE6943F9CBE4	20B4FBB7D9DD918B4A0CF33400D75E4B15FFB6CFEDEA54DF13D60CDEB74C0753
C:\Users\user\Documents\GNLQNHOLWB\ZUYYDJDFVF.png.Rook	data	8446444BE71D8363968BC65F1D1642E2	DA8585FFD341ABB28C07658CC85140A5F9D94F24	F82378054DA4D7D2B6E4CE9B30ADFE6715DDDFF6818FAE886E06042905EDA6CE
C:\Users\user\Documents\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\Documents\IZMFBFKMEB.docx.Rook	data	F96EF0896AE938BFB09041877DB78745	06F0D1033A8831A470961493C872192B71DB2C90	698B80D599CB05765DE453D3A1DE4D21C84A20BC6125E180637ABAC4B9912AED
C:\Users\user\Documents\IZMFBFKMEB.xlsx.Rook	data	C09870B7C4D76C338CDE5C46BB4214BA	994EFDA5338554D4FDF903ABFF932EF23403202E	DC4376D061D1B943C7C99DEB9A4E49666B2C608A41A3F5DFA31888D4E94F599F
C:\Users\user\Documents\IZMFBFKMEB\BWDRWEEARI.xlsx.Rook	data	470E0C0E76391C1103EB65615D020579	E45A8019EFB0685A54E11FDB513D5A28866E6F22	2F724014D976E8F379D10B006674BE56666D22A608376D7B8677E63F6FBFD510
C:\Users\user\Documents\IZMFBFKMEB\DUKNXICOZT.mp3.Rook	data	7DA5780300BF948A074EE39D04E3CB5E	18CBD0802CA1490B483D5D36F6FB4DD2771A3B3B	ED0A75D181CECF38822B4F2299B51B00F3D0EE8F9C9F7449B66744029D623A4C
C:\Users\user\Documents\IZMFBFKMEB\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\Documents\IZMFBFKMEB\IZMFBFKMEB.docx.Rook	data	7B780D1502403A2B910EE0AD2BE8B904	4DD6C63B2C3D3C5ED09CEA6A088C63E3B852F6A2	5AF4F4CE7FE671EF6D1B70400C7C7B9313AC92A7DD3CF753290ABEB9FBEADED6
C:\Users\user\Documents\IZMFBFKMEB\OVWVVIANZH.png.Rook	data	5253C5BBC868075F2293153E0FD984A6	4BBEDD9081DADAEF1538DA2D8689BACB460F2438	1D7FEA69D7496D7BA0B222591CDD59C0835EA8059046487AC231AD11C4ADFD70
C:\Users\user\Documents\IZMFBFKMEB\UBVUNTSCZJ.pdf.Rook	data	68505379A54DE0D779C78D5031027E38	A47353525142160BCAD27BA541F70C012928D97F	38F7C8425D3E2FB0F32B7682877414FBFE586B631A5FC11EB3869A7C59CEE9DD
C:\Users\user\Documents\IZMFBFKMEB\WHZAGPPPLA.jpg.Rook	data	F7C26B379E8B3A57410153B872286499	AC28FDF760606DC602294A3338C040D1DF8F94ED	2E28847BCB2F486621217D76BEE125420A42D0DD52116265B49F5A32B3A444EA
C:\Users\user\Documents\MIVTQDBATG\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\Documents\MOCYNWGDZO.mp3.Rook	data	3B5FBD737FB5A2BDBD95B2115176ED02	FBD60006F6BD862B24FE6555C4A068C88B267FDB	AD314D32E88FF20D90FE53F57B1511596F993D4AE6280F1ED8B9643FAFEA061D
C:\Users\user\Documents\OVWVVIANZH.png.Rook	data	AAF9AD86E6E5EA2C67755B7DFC323316	1B70066279823EDADC612140A7F5CCE0800FD20B	1B82D23E77902D24F2407BD8250D1CF7069035FEF55E2973CEAE81774166A803
C:\Users\user\Documents\UBVUNTSCZJ.mp3.Rook	data	3E6E88C63A8926CC2E11D38F8C88B4EC	9E6985100C186B4F3E78C785D1B99EF8B9FAD541	4B1E8B740CEB7CC3CA1534BDAEBA01EA08D00E1C32F3C3E3D3FC5E3B4D2C070C
C:\Users\user\Documents\UBVUNTSCZJ.pdf.Rook	data	D93A8269781DC858661ECB441F21D495	B23B7BE776655EC30D473ADA740C3D7F0F457ADF	1B94FAC915D3ABDC78526CC47BB913E3E9DFCBAB25C5B3850777718CE9E0DE97
C:\Users\user\Documents\UBVUNTSCZJ.xlsx.Rook	data	A23D0D89EA6431E442047758AAFCBB0A	EB4278502DC2B81D70EFD761539D8DB682543FE0	425460AC8AA89DD47686C1F0BE02BC428707E86AC6933307D95FC8DE8E60302A
C:\Users\user\Documents\WHZAGPPPLA.jpg.Rook	data	E50561960C86CF57FABDF61072C270E3	CA7138E72EA320294250235234056634DBF4C131	5B4E0254D368A4BB8A8497BA1E5809E89980E1BBEAFAABEF4A8D95B99DB3A908
C:\Users\user\Documents\WHZAGPPPLA\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\Documents\ZUYYDJDFVF.png.Rook	data	82E377761406746770E41EB777764A8D	B94F3BD4280CF9B87A75CCAF8CDCF55DC52FF54E	F25DB9A30955C6DBAB98BB272D3C5EBC55CA4CF2FB2317F79ECF9C0CFAA6048B
C:\Users\user\Downloads\BQJUWOYRTO.docx.Rook	data	E8FD322EA8709A289F90312477695C55	64246C1814027C9B3E63A4439674E53785706573	982163B28CF7F7EFFF96C771E348164AE634508EC50C4A9AA443FAED9BA42BEA
C:\Users\user\Downloads\BUFZSQPCOH.png.Rook	data	BFFB7EE68DF8B290D7181100BE16CE6C	DEF2DA6FE76B3783794790151325DC7705BF36F4	E7369B5B08D002BB558EACEA531EB6E28F09E9EE829E640B68ED5A6DA1F9A2C9
C:\Users\user\Downloads\BWDRWEEARI.jpg.Rook	data	71FAA68DAA7632600E55B3CC2AD68EE8	69CFB03D090F8A6034E7DCFC7F4F568DF67BF326	C7419512EDC6194D99FB1D861F04E41F8A97A6436520047B020A5FF8CB98F5A2
C:\Users\user\Downloads\BWDRWEEARI.xlsx.Rook	data	8E2BA52925CCFA6B513DA330015DA41F	565013D3862A15096C00FB4D8EFAF688D69ACD75	5D5DEB726B7F7FB4772090644FEA026EE8EBB7F4CFD5821CDA27A85F95FA0406
C:\Users\user\Downloads\BWETZDQDIB.pdf.Rook	data	C8B21D5BEF9641414875EB278FBDAF00	99549FBB6D897AA9BF8820B57B0EEB7A71044AA1	372AEAE82526282DFFB8519F62235F383786C9279312CB2E3267B8AAA65999B6
C:\Users\user\Downloads\DUKNXICOZT.jpg.Rook	data	75B501109FCAC4DCC709BB984F0E5FA8	51C0E9EC110CBAA58A4B5913F427BC0CBE39CDF0	7489C3D1A565543DF29976E56F41778CBED96C27195D8AA8C20E24E721B9D3C0
C:\Users\user\Downloads\DUKNXICOZT.mp3.Rook	data	5A0B2BB1EF3808D2C4FF2E6B13A11153	5671EC89D84B533E36DA1296E5B37F10A735861B	0D233FF2CE4023750393469C876B53DCFD16E56CC9CAAEE5D1904C602EDCE84F
C:\Users\user\Downloads\GNLQNHOLWB.docx.Rook	data	ED8583B743FBAF62AD4258A649E13EF9	3508DACF596C6B237D0639491C8E4139464B945E	3983212D4438BECAD2EDD734AC17672851E3F3CC0F0980D21AF7AAD449D8BC57
C:\Users\user\Downloads\GNLQNHOLWB.pdf.Rook	data	F34F09B8923BA4E42038D36B4B7B23BE	74A3D11D36599D68CAAB917C2B290D25C9CA2E45	7220702D69B223A75BC89CC53DC73BB7F9F3AC09642602DF37FC7B485F3764B3
C:\Users\user\Downloads\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\Downloads\IZMFBFKMEB.docx.Rook	data	FC002ADB57626316B6A0E496DB406E03	B80EF9E21C7DEC61821C018ED0C8C9DCA4ACD3AB	E23FBAABC9CE2802E55A5DB95B1E3D06D0C7B1DFB4DE952FAFDD64135F676881
C:\Users\user\Downloads\IZMFBFKMEB.xlsx.Rook	data	F3FC51F018F4846EDDE7C7F6A25808D4	BA2FBB1CD6854D780B359BB7306B8930379138D5	75AB6B63A81084F2588A0A4EDAAE57C0E4B2FA811B9BFA90A7EA42D8436F7ACB
C:\Users\user\Downloads\MOCYNWGDZO.mp3.Rook	data	36103251B8D98F2F5E3C8DB4272473AE	55B63D8623A706EF96C5499AE78F7C98B6FF5FDD	49F86F0EA906005D5FD3FFB67A466E2414B9F2052E1615F6261D0A43A3C8EA7A
C:\Users\user\Downloads\OVWVVIANZH.png.Rook	data	DE85AAFD6F803F319DAC74129591D49A	C154732FBC328298988683044126E223F4DE6965	70FC73C7A4188C72692FFE48A73D0104953B831F483C66185387FADFA0A19A94
C:\Users\user\Downloads\UBVUNTSCZJ.mp3.Rook	data	D41283A55AA0FA01DE2966D833D5C2F8	B33AD0C56C91EB79BA476911AD280E3344B4DE0C	E5A81890B70E3876D1170DCBD6A3DD63E8A4E784DDD4C5A70512CEDD32B6FB2F
C:\Users\user\Downloads\UBVUNTSCZJ.pdf.Rook	data	620BC4468DEF0EC096A690F17E9C44B5	1DD4266B1D8366D7C72CF5241DD79CD4E72D9CD3	5FBFC98AD2D37D4CF0334D3E6936D7933DE4A30C63DCC660AFEBE71F53C54011
C:\Users\user\Downloads\UBVUNTSCZJ.xlsx.Rook	data	47A884D7441CA5CCFAC6D9602E5D73E8	58F298CF23CE60860B9831AEE044573DBF2E30F9	5CA70B8B1BD629F24CC3F26FA426827B14FD8C1DA2860F0D7CAD374449F1EE0D
C:\Users\user\Downloads\WHZAGPPPLA.jpg.Rook	data	B12A9AE89E320EF759048F1D3598D3E8	6B16FF47CEE1CE58A5449CE4B83F6DA0F074A29A	7E02E20DEA1AC571F8C6C02B3F39E4F350586431D2C2E467B077EB3E35D560B5
C:\Users\user\Downloads\ZUYYDJDFVF.png.Rook	data	836FC254059280D0878898B8DC99CEC9	AFC1DB92AD8B5B55309CC6341A06E4EAA60AD582	B55D3F3BA1B367520DE4A73C7A2D900144A57D3EBE4826F665B2876C673D680E
C:\Users\user\Favorites\Amazon.url.Rook	data	B3669CEF0617C860CE05092A6DE7BE54	24C5BA27D1721F4C1FF3AE28BA148DB9D0D10E89	FF1A1F332280631086A6D1CA2115156FE8F749C233B55814E352DCBD7105D40E
C:\Users\user\Favorites\Bing.url.Rook	data	C37B01721F3F445D6A0B46B4D38722E6	B9BC1A8653615AE33929750DC4B9BEC988A557B6	2036A0A07E665D93AECBE7A5F9B45B128EC7178357C11E6B716D7F03F49D51C7
C:\Users\user\Favorites\Facebook.url.Rook	data	416AFA332377FD9339CC254C43B8337C	7FC6BA15463AB4E59073C37F20F30E35912BDA16	E15F91E36ECC2111693D374BB16EEE9FD53FE23DDB99AFD2DED4370D5714D0DB
C:\Users\user\Favorites\Google.url.Rook	data	B651DE24E10F6ECB15D5B4760AC81FB7	BBE7C4E2ECED680DB98A8E3F1CFABF911CD596AD	8A9895E5F812D3D86C411AE1520E138F851F7F80A6C1E6A106761E3EAB660BDD
C:\Users\user\Favorites\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\Favorites\Links\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\Favorites\Live.url.Rook	data	655FB2AE9A331E26815AC316145C81C3	1F508930CF815C92671AAB08A827558DB00FF59B	F6A2602F14685027573F3342759B49DFEB4EF6477A31ABAA9238C35CBC72298C
C:\Users\user\Favorites\NYTimes.url.Rook	data	0C7C4FA1289F78BE6A3E7987E8220853	43D939CE2D03F8402AC337692A670B8050975F64	5EAF87CEEE1F1997A66352905A711FBEA839C01054855BFA405B3C0EA2AF115F
C:\Users\user\Favorites\Reddit.url.Rook	data	A77CADC1A957733EEDC513917F7CBD3A	8F5B36231BD3D696847727BDBA5ACA4BE9932502	81C18E03DD2620C0B1C871F3CFD63AA7AA2ABC40AF7E9661B139AF74E34FEDFE
C:\Users\user\Favorites\Twitter.url.Rook	data	F0FA3BF587B3128ACA807783E71C17D8	A5A855F25D89E705BCE9AC19EB8646EB23001445	A2E35A6C9175756ACA033EF59950186C3E1DD066572890DBC6E37B7C5D5F3617
C:\Users\user\Favorites\Wikipedia.url.Rook	data	8A862F709D7BAF358DA0F555D93F9C88	4EEEC65545B4B80780560171E551BF948FFDE1C2	6DA42DB412E13E10DCCC21909392829A7F85D90B9036CCE05A5BAC809B1C5862
C:\Users\user\Favorites\Youtube.url.Rook	data	2CC22B876C0A36F9FA6B0E30AA877919	C06FBD2E025FE6B009D32217F51105FFB0C2B4B4	95F9C389842B141AE2E02249C5C923E9ADE2250C755E474AC5843C416A15B48D
C:\Users\user\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\Links\Desktop.lnk.Rook	data	64ABF61CFE2583AF5745F79611953631	D5B3E014285647B22A7F3BE506E6ADF1CA04A393	9F6CA1E2DE9568E8648E3A2D4AAC72A2FE5C55F8E3A2230D2739D49DE55E1A1F
C:\Users\user\Links\Downloads.lnk.Rook	data	7C9F474C41D5ABB80DA356980CE0B7CB	949CD0FB7007A4790D547473C9C2D9013E36F997	5BE412EE116A38F8604854168B04A85D242070405C0381F3B01944B234B1C53B
C:\Users\user\Links\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\Music\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\Pictures\Camera Roll\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\Pictures\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
C:\Users\user\Videos\HowToRestoreYourFiles.txt	ASCII text, with CRLF, LF line terminators	00F71CDE522689585EAA9C62385AFA22	350E319806F7A71267A5E4A749EB190EAD38DBB0	B14EC2FCCCAC5059464E800EDF56049C0277124ABD60EE49C1F726861DF925BF
\Device\ConDrv	ASCII text, with no line terminators	770190F214057CA2F9314CE7B11AB682	5C4BAE9D89D831EB6AC8AC62CD6E57C36AB85DD6	27D034B12FFC63334D76BF8657B26B67E7E0BFED1FB880548389974AB15559D4

ID:	626600
Product:	CloudBasic
Start time:	15:16:19
Start date:	14.05.2022
Sample:	ZunmmW7pe5.exe
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:
Architecture:	WINDOWS
MD5:	6d87be9212a1a0e92e58e1ed94c589f9
SHA1:	19ce538b2597da454abf835cff676c28b8eb66f7
SHA256:	c2d46d256b8f9490c9599eea11ecef19fde7d4fdd2dea93604cee3cea8e172ac
Filetype:	Win64 Executable Console (202006/5) 81.26%

Windows Analysis Report
ZunmmW7pe5.exe

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Screenshots

Behavior Graph

Network Map

Windows Analysis Report ZunmmW7pe5.exe

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Screenshots

Behavior Graph

Network Map

Windows Analysis Report
ZunmmW7pe5.exe