Ransom_CRYPXAS.F117F8

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Arrival Details

This Trojan arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Other System Modifications

This Trojan modifies the following file(s):

• %User Profile%\Templates\excel.xls
• %User Profile%\Templates\powerpnt.ppt
• %User Profile%\Templates\winword.doc
• %Application Data%\IconCache.db
• %Program Files%\Common Files\Microsoft Shared\Stationery\Clear Day Bkgrd.jpg
• %Program Files%\Common Files\Microsoft Shared\Stationery\Fiesta Bkgrd.jpg
• %Program Files%\Common Files\Microsoft Shared\Stationery\Glacier Bkgrd.jpg
• %Program Files%\Common Files\Microsoft Shared\Stationery\Leaves Bkgrd.jpg
• %Program Files%\Common Files\Microsoft Shared\Stationery\Maize Bkgrd.jpg
• %Program Files%\Common Files\Microsoft Shared\Stationery\Nature Bkgrd.jpg
• %Program Files%\Common Files\Microsoft Shared\Stationery\Pie Charts Bkgrd.jpg
• %Program Files%\Common Files\Microsoft Shared\Stationery\Sunflower Bkgrd.jpg
• %Program Files%\Common Files\Services\bigfoot.bmp
• %Program Files%\Common Files\Services\verisign.bmp
• %Program Files%\Common Files\Services\whowhere.bmp
• %Program Files%\Movie Maker\Shared\news.png
• %Program Files%\Movie Maker\Shared\paint.png
• %Program Files%\Movie Maker\Shared\Sample1.jpg
• %Program Files%\Movie Maker\Shared\Sample2.jpg
• %Program Files%\Windows Media Player\npds.zip
• %Program Files%\Windows NT\Pinball\table.bmp
• %Windows%\Coffee Bean.bmp
• %Windows%\FeatherTexture.bmp
• %Windows%\Gone Fishing.bmp
• %Windows%\Greenstone.bmp
• %Windows%\Prairie Wind.bmp
• %Windows%\Rhododendron.bmp
• %Windows%\River Sumida.bmp
• %Windows%\Santa Fe Stucco.bmp
• %Windows%\Soap Bubbles.bmp
• %Windows%\winnt.bmp
• %Windows%\winnt256.bmp
• %Windows%\Zapotec.bmp
• %Windows%\Help\Tours\htmlTour\best_road.jpg
• %Windows%\Help\Tours\htmlTour\best_road_big.jpg
• %Windows%\Help\Tours\htmlTour\best_road_ghost.jpg
• %Windows%\Help\Tours\htmlTour\best_robust.jpg
• %Windows%\Help\Tours\htmlTour\best_robust_big.jpg
• %Windows%\Help\Tours\htmlTour\best_robust_ghost.jpg
• %Windows%\Help\Tours\htmlTour\best_secure.jpg
• %Windows%\Help\Tours\htmlTour\best_secure_big.jpg
• %Windows%\Help\Tours\htmlTour\best_secure_ghost.jpg
• %Windows%\Help\Tours\htmlTour\connected_data.jpg
• %Windows%\Help\Tours\htmlTour\connected_data_big.jpg
• %Windows%\Help\Tours\htmlTour\connected_data_ghost.jpg
• %Windows%\Help\Tours\htmlTour\connected_multiple.jpg
• %Windows%\Help\Tours\htmlTour\connected_multiple_big.jpg
• %Windows%\Help\Tours\htmlTour\connected_multiple_ghost.jpg
• %Windows%\Help\Tours\htmlTour\connected_networks.jpg
• %Windows%\Help\Tours\htmlTour\connected_networks_big.jpg
• %Windows%\Help\Tours\htmlTour\connected_networks_ghost.jpg
• %Windows%\Help\Tours\htmlTour\connected_wizard.jpg
• %Windows%\Help\Tours\htmlTour\connected_wizard_big.jpg
• %Windows%\Help\Tours\htmlTour\connected_wizard_ghost.jpg
• %Windows%\Help\Tours\htmlTour\control_up.jpg
• %Windows%\Help\Tours\htmlTour\desktop_screen_shot.jpg
• %Windows%\Help\Tours\htmlTour\desktop_up.jpg
• %Windows%\Help\Tours\htmlTour\end_up.jpg
• %Windows%\Help\Tours\htmlTour\folder_up.jpg
• %Windows%\Help\Tours\htmlTour\icon_up.jpg
• %Windows%\Help\Tours\htmlTour\img004b.jpg
• %Windows%\Help\Tours\htmlTour\img014.jpg
• %Windows%\Help\Tours\htmlTour\img033.jpg
• %Windows%\Help\Tours\htmlTour\img033a.jpg
• %Windows%\Help\Tours\htmlTour\img034.jpg
• %Windows%\Help\Tours\htmlTour\img040.jpg
• %Windows%\Help\Tours\htmlTour\img046.jpg
• %Windows%\Help\Tours\htmlTour\img060.jpg
• %Windows%\Help\Tours\htmlTour\img068.jpg
• %Windows%\Help\Tours\htmlTour\img072.jpg
• %Windows%\Help\Tours\htmlTour\img074a.jpg
• %Windows%\Help\Tours\htmlTour\img089.jpg
• %Windows%\Help\Tours\htmlTour\img100.jpg
• %Windows%\Help\Tours\htmlTour\img103.jpg
• %Windows%\Help\Tours\htmlTour\img109.jpg
• %Windows%\Help\Tours\htmlTour\img110.jpg
• %Windows%\Help\Tours\htmlTour\img116.jpg
• %Windows%\Help\Tours\htmlTour\img121.jpg
• %Windows%\Help\Tours\htmlTour\img123.jpg
• %Windows%\Help\Tours\htmlTour\img126.jpg
• %Windows%\Help\Tours\htmlTour\img136.jpg
• %Windows%\Help\Tours\htmlTour\img149.jpg
• %Windows%\Help\Tours\htmlTour\intro_logo.jpg
• %Windows%\Help\Tours\htmlTour\logo.jpg
• %Windows%\Help\Tours\htmlTour\pen_icon.jpg
• %Windows%\Help\Tours\htmlTour\question_icon.jpg
• %Windows%\Help\Tours\htmlTour\safe_easy_better.jpg
• %Windows%\Help\Tours\htmlTour\safe_easy_better_big.jpg
• %Windows%\Help\Tours\htmlTour\safe_easy_better_ghost.jpg
• %Windows%\Help\Tours\htmlTour\safe_easy_easier.jpg
• %Windows%\Help\Tours\htmlTour\safe_easy_easier_big.jpg
• %Windows%\Help\Tours\htmlTour\safe_easy_easier_ghost.jpg
• %Windows%\Help\Tours\htmlTour\safe_easy_faster.jpg
• %Windows%\Help\Tours\htmlTour\safe_easy_faster_big.jpg
• %Windows%\Help\Tours\htmlTour\safe_easy_faster_ghost.jpg
• %Windows%\Help\Tours\htmlTour\start_up.jpg
• %Windows%\Help\Tours\htmlTour\taskbar_up.jpg
• %Windows%\Help\Tours\htmlTour\ul_logo.jpg
• %Windows%\Help\Tours\htmlTour\unlock_built.jpg
• %Windows%\Help\Tours\htmlTour\unlock_built_big.jpg
• %Windows%\Help\Tours\htmlTour\unlock_built_ghost.jpg
• %Windows%\Help\Tours\htmlTour\unlock_optimized.jpg
• %Windows%\Help\Tours\htmlTour\unlock_optimized_big.jpg
• %Windows%\Help\Tours\htmlTour\unlock_optimized_ghost.jpg
• %Windows%\Help\Tours\htmlTour\unlock_playing.jpg
• %Windows%\Help\Tours\htmlTour\unlock_playing_big.jpg
• %Windows%\Help\Tours\htmlTour\unlock_playing_ghost.jpg
• %Windows%\Help\Tours\htmlTour\window_up.jpg
• %Windows%\pchealth\helpctr\System\blurbs\watermark_300x.bmp
• %Windows%\pchealth\helpctr\System\DVDUpgrd\stripe.jpg
• %Windows%\pchealth\helpctr\System\images\16x16\arrow_blue_normal_shadow.bmp
• %Windows%\pchealth\helpctr\System\images\16x16\arrow_green_normal_shadow.bmp
• %Windows%\pchealth\helpctr\System\images\24x24\arrow_green_mousedown.bmp
• %Windows%\pchealth\helpctr\System\images\24x24\arrow_green_mouseover.bmp
• %Windows%\pchealth\helpctr\System\images\24x24\arrow_green_normal.bmp
• %Windows%\pchealth\helpctr\System\images\32x32\logo.bmp
• %Windows%\pchealth\helpctr\System\images\48x48\desktop_icon_01.bmp
• %Windows%\pchealth\helpctr\System\images\48x48\desktop_icon_02.bmp
• %Windows%\pchealth\helpctr\System\images\48x48\desktop_icon_03.bmp
• %Windows%\pchealth\helpctr\System\images\48x48\desktop_icon_04.bmp
• %Windows%\pchealth\helpctr\System\images\48x48\desktop_icon_generic.bmp
• %Windows%\pchealth\helpctr\System\Remote Assistance\Interaction\Client\TakeControl.bmp
• %Windows%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\HelpCenter.bmp
• %Windows%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\Options.bmp
• %Windows%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\Quit.bmp
• %Windows%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\SendFile.bmp
• %Windows%\pchealth\helpctr\System\Remote Assistance\Interaction\Common\SendVoice.bmp
• %Windows%\pchealth\helpctr\System\Remote Assistance\Interaction\Server\StopControl.bmp
• %Windows%\pchealth\helpctr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\Remote_Assistance_Graphic.png
• %System%\setup.bmp
• %System%\wpa.dbl
• %System%\config\systemprofile\Templates\excel.xls
• %System%\config\systemprofile\Templates\powerpnt.ppt
• %System%\config\systemprofile\Templates\winword.doc
• %System%\DirectX\Dinput\act_rs.png
• %System%\DirectX\Dinput\glmda.png
• %System%\DirectX\Dinput\glmdiggp.png
• %System%\DirectX\Dinput\gr3001.png
• %System%\DirectX\Dinput\gr4001.png
• %System%\DirectX\Dinput\gr4001_g.png
• %System%\DirectX\Dinput\gr4003.png
• %System%\DirectX\Dinput\gr4005.png
• %System%\DirectX\Dinput\ia3002_1.png
• %System%\DirectX\Dinput\ia3002_2.png
• %System%\DirectX\Dinput\lgc202.png
• %System%\DirectX\Dinput\lgc207.png
• %System%\DirectX\Dinput\lgc209.png
• %System%\DirectX\Dinput\lgc20a.png
• %System%\DirectX\Dinput\lgc291.png
• %System%\DirectX\Dinput\ms1b.png
• %System%\DirectX\Dinput\ms1b_01.png
• %System%\DirectX\Dinput\ms26.png
• %System%\DirectX\Dinput\ms26_01.png
• %System%\DirectX\Dinput\ms27.png
• %System%\DirectX\Dinput\ms27_1.png
• %System%\DirectX\Dinput\ms28.png
• %System%\DirectX\Dinput\ms28_8.png
• %System%\DirectX\Dinput\ms34.png
• %System%\DirectX\Dinput\ms34_01.png
• %System%\DirectX\Dinput\ms34_02.png
• %System%\DirectX\Dinput\ms3b.png
• %System%\DirectX\Dinput\ms3b_1.png
• %System%\DirectX\Dinput\ms3b_2.png
• %System%\DirectX\Dinput\ms3b_3.png
• %System%\DirectX\Dinput\ms3b_4.png
• %System%\DirectX\Dinput\ms3b_a.png
• %System%\DirectX\Dinput\ms3b_c.png
• %System%\DirectX\Dinput\ms3b_m.png
• %System%\DirectX\Dinput\ms3b_t.png
• %System%\DirectX\Dinput\ms56.png
• %System%\DirectX\Dinput\ms56_1.png
• %System%\DirectX\Dinput\ms6.png
• %System%\DirectX\Dinput\ms6_9.png
• %System%\DirectX\Dinput\ms7.png
• %System%\DirectX\Dinput\ms7_1.png
• %System%\DirectX\Dinput\ms8.png
• %System%\DirectX\Dinput\ms8_1.png
• %System%\DirectX\Dinput\mse.png
• %System%\DirectX\Dinput\mse_1.png
• %System%\DirectX\Dinput\msf1f.png
• %System%\DirectX\Dinput\msprw.png
• %System%\DirectX\Dinput\msprw_1.png
• %System%\DirectX\Dinput\msprw_2.png
• %System%\DirectX\Dinput\SV-262e1.png
• %System%\DirectX\Dinput\SV-262e3.png
• %System%\DirectX\Dinput\SV-262e4.png
• %System%\DirectX\Dinput\sv2511.png
• %System%\DirectX\Dinput\sv2512.png
• %System%\ias\dnary.mdb
• %System%\ias\ias.mdb
• %System%\oobe\html\mouse\images\bulzano.jpg
• %System%\oobe\html\mouse\images\bulzanom.jpg
• %System%\oobe\html\mouse\images\heidelb.jpg
• %System%\oobe\html\mouse\images\heidelbm.jpg
• %System%\oobe\html\mouse\images\paris.jpg
• %System%\oobe\html\mouse\images\parism.jpg
• %System%\oobe\html\mouse\images\pisa.jpg
• %System%\oobe\html\mouse\images\pisam.jpg
• %System%\oobe\html\mouse\images\prague.jpg
• %System%\oobe\html\mouse\images\praguem.jpg
• %System%\oobe\html\mouse\images\tyrol.jpg
• %System%\oobe\html\mouse\images\tyrolm.jpg
• %System%\oobe\html\mouse\images\venice.jpg
• %System%\oobe\html\mouse\images\venicem.jpg
• %System%\oobe\html\mouse\images\verona.jpg
• %System%\oobe\html\mouse\images\veronam.jpg
• %System%\oobe\images\backdown.jpg
• %System%\oobe\images\backoff.jpg
• %System%\oobe\images\backover.jpg
• %System%\oobe\images\backup.jpg
• %System%\oobe\images\mslogo.jpg
• %System%\oobe\images\newbtm1.jpg
• %System%\oobe\images\newbtm8.jpg
• %System%\oobe\images\newmark1.jpg
• %System%\oobe\images\newmark8.jpg
• %System%\oobe\images\newtop1.jpg
• %System%\oobe\images\newtop8.jpg
• %System%\oobe\images\nextdown.jpg
• %System%\oobe\images\nextoff.jpg
• %System%\oobe\images\nextover.jpg
• %System%\oobe\images\nextup.jpg
• %System%\oobe\images\oemcoa.jpg
• %System%\oobe\images\skipdown.jpg
• %System%\oobe\images\skipoff.jpg
• %System%\oobe\images\skipover.jpg
• %System%\oobe\images\skipup.jpg
• %System%\oobe\images\thanks10.png
• %System%\oobe\images\thanks8.png
• %System%\oobe\images\wpaback.jpg
• %System%\oobe\images\wpabtm.jpg
• %System%\oobe\images\wpaflag.jpg
• %System%\oobe\images\wpakey.jpg
• %System%\oobe\images\wpatop.jpg
• %Windows%\Web\Wallpaper\Ascent.jpg
• %Windows%\Web\Wallpaper\Autumn.jpg
• %Windows%\Web\Wallpaper\Azul.jpg
• %Windows%\Web\Wallpaper\Bliss.bmp
• %Windows%\Web\Wallpaper\Crystal.jpg
• %Windows%\Web\Wallpaper\Follow.jpg
• %Windows%\Web\Wallpaper\Friend.jpg
• %Windows%\Web\Wallpaper\Home.jpg
• %Windows%\Web\Wallpaper\Moon flower.jpg
• %Windows%\Web\Wallpaper\Peace.jpg
• %Windows%\Web\Wallpaper\Power.jpg
• %Windows%\Web\Wallpaper\Purple flower.jpg
• %Windows%\Web\Wallpaper\Radiance.jpg
• %Windows%\Web\Wallpaper\Red moon desert.jpg
• %Windows%\Web\Wallpaper\Ripple.jpg
• %Windows%\Web\Wallpaper\Stonehenge.jpg
• %Windows%\Web\Wallpaper\Tulips.jpg
• %Windows%\Web\Wallpaper\Vortec space.jpg
• %Windows%\Web\Wallpaper\Wind.jpg
• %Windows%\Web\Wallpaper\Windows XP.jpg

(Note: %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.. %Application Data% is the Application Data folder, where it usually is C:\Documents and Settings\{user name}\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.. %Program Files% is the Program Files folder, where it usually is C:\Program Files on all Windows operating system versions; C:\Program Files (x86) for 32-bit applications running on Windows 64-bit operating systems.. %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.. %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)

Dropping Routine

This Trojan drops the following files:

• %Desktop%\your_key.rsa
• %Desktop%\!!!----ÏÐÎ×ÒÈ ÌÅÍß----!!!.html
• %User Startup%\your_key.rsa
• %User Startup%\!!!----ÏÐÎ×ÒÈ ÌÅÍß----!!!.html
• %User Profile%\My Documents\your_key.rsa
• %User Profile%\My Documents\!!!----ÏÐÎ×ÒÈ ÌÅÍß----!!!.html
• %User Profile%\User Account Pictures\guest.bmp
• %User Profile%\User Account Pictures\Wilbert.bmp
• %User Profile%\Default Pictures\airplane.bmp
• %User Profile%\Default Pictures\astronaut.bmp
• %User Profile%\Default Pictures\ball.bmp
• %User Profile%\Default Pictures\beach.bmp
• %User Profile%\Default Pictures\butterfly.bmp
• %User Profile%\Default Pictures\car.bmp
• %User Profile%\Default Pictures\cat.bmp
• %User Profile%\Default Pictures\chess.bmp
• %User Profile%\Default Pictures\dirt bike.bmp
• %User Profile%\Default Pictures\dog.bmp
• %User Profile%\Default Pictures\drip.bmp
• %User Profile%\Default Pictures\duck.bmp
• %User Profile%\Default Pictures\fish.bmp
• %User Profile%\Default Pictures\frog.bmp
• %User Profile%\Default Pictures\guitar.bmp
• %User Profile%\Default Pictures\horses.bmp
• %User Profile%\Default Pictures\kick.bmp
• %User Profile%\Default Pictures\lift-off.bmp
• %User Profile%\Default Pictures\palm tree.bmp
• %User Profile%\Default Pictures\pink flower.bmp
• %User Profile%\Default Pictures\red flower.bmp
• %User Profile%\Default Pictures\skater.bmp
• %User Profile%\Default Pictures\snowflake.bmp
• %User Profile%\Sample Pictures\Blue hills.jpg
• %User Profile%\Sample Pictures\Sunset.jpg
• %User Profile%\Sample Pictures\Water lilies.jpg
• %User Profile%\Sample Pictures\Winter.jpg
• %Application Data%\Microsoft\Wallpaper1.bmp
• %Temporary Internet Files%\Content.IE5\09RWHJQN\8213D9F75AD098D48F237D6CCC29F8[1].jpg
• %Temporary Internet Files%\Content.IE5\09RWHJQN\836390dd7004a00c9b21db33678d84[1].png
• %Temporary Internet Files%\Content.IE5\09RWHJQN\BA1FA617D2822CCF20CF2239452095[1].jpg
• %Temporary Internet Files%\Content.IE5\09RWHJQN\D2543C851E4AE4B1DB2DE3B1562DB[1].jpg
• %Temporary Internet Files%\Content.IE5\BVLBNMKH\15A727F1384E33C33F18A135D9710[1].jpg
• %Temporary Internet Files%\Content.IE5\BVLBNMKH\923334461022280076d968be269386[1].png
• %Temporary Internet Files%\Content.IE5\BVLBNMKH\9FFCFB0D17D6A8FD7C27416ED0DB[1].jpg
• %Temporary Internet Files%\Content.IE5\BVLBNMKH\BA0EAC3FA44E01BE67D7651C9E60[1].jpg
• %Temporary Internet Files%\Content.IE5\ZDGZNKA5\147[1].jpg
• %Temporary Internet Files%\Content.IE5\ZDGZNKA5\1db850e671ac9a39751a1482909ea6[1].jpg
• %Temporary Internet Files%\Content.IE5\ZDGZNKA5\9E82BCBB661C2665F77225A5DCC867[1].jpg
• %Temporary Internet Files%\Content.IE5\ZDGZNKA5\CDAB2F44A1591D2B308C20C6C15375[1].jpg
• %Temporary Internet Files%\Content.IE5\ZDGZNKA5\FD4957C9FB46179035C1C4F6407F10[1].jpg
• %Temporary Internet Files%\Content.IE5\ZSGKJKO6\300x250_45914_4crocsl[1].jpg
• %Temporary Internet Files%\Content.IE5\ZSGKJKO6\72541472A285479CAB60A1F736581[1].jpg
• %Temporary Internet Files%\Content.IE5\ZSGKJKO6\844DD2D2B4733FAE13849F794A7BD8[1].jpg
• %Temporary Internet Files%\Content.IE5\ZSGKJKO6\A5EE7088EC167F676F626203E7371[1].png
• %Temporary Internet Files%\Content.IE5\ZSGKJKO6\BCEE3611B4F81EDE9240922336F1[1].jpg
• %Temporary Internet Files%\Content.IE5\ZSGKJKO6\BING_websearch_2[1].jpg
• %Temporary Internet Files%\Content.IE5\ZSGKJKO6\D8F68391953F21ECC405DCBA92D39[1].jpg
• %Temporary Internet Files%\Content.IE5\ZSGKJKO6\F7D0CF254A92D3932EDCF252CA5AB4[1].jpg
• %Program Files%\Adobe\Reader 10.0\Reader\PDFSigQFormalRep.pdf
• %Program Files%\Adobe\Reader 10.0\Reader\IDTemplates\ENU\AdobeID.pdf
• %Program Files%\Adobe\Reader 10.0\Reader\IDTemplates\ENU\DefaultID.pdf
• %Program Files%\Adobe\Reader 10.0\Reader\plug_ins\Annotations\Stamps\Words.pdf
• %Program Files%\Adobe\Reader 10.0\Reader\plug_ins\Annotations\Stamps\ENU\Dynamic.pdf
• %Program Files%\Adobe\Reader 10.0\Reader\plug_ins\Annotations\Stamps\ENU\SignHere.pdf
• %Program Files%\Adobe\Reader 10.0\Reader\plug_ins\Annotations\Stamps\ENU\StandardBusiness.pdf
• %Program Files%\Adobe\Reader 10.0\Resource\ENUtxt.pdf
• %Program Files%\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\Workflow.Targets
• %Program Files%\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\Workflow.VisualBasic.Targets
• %Program Files%\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.Targets
• %Program Files%\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.VisualBasic.Targets
• %Windows%\Microsoft.NET\Framework\v2.0.50727\Microsoft.Common.targets
• %Windows%\Microsoft.NET\Framework\v2.0.50727\Microsoft.CSharp.targets
• %Windows%\Microsoft.NET\Framework\v2.0.50727\Microsoft.VisualBasic.targets
• %Windows%\Microsoft.NET\Framework\v2.0.50727\Microsoft.WinFX.targets
• %Windows%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg
• %Windows%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg
• %Windows%\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg
• %Windows%\Microsoft.NET\Framework\v3.5\Microsoft.Common.targets
• %Windows%\Microsoft.NET\Framework\v3.5\Microsoft.CSharp.targets
• %Windows%\Microsoft.NET\Framework\v3.5\Microsoft.VisualBasic.targets
• %Windows%\Microsoft.NET\Framework\v3.5\Microsoft.WinFx.targets
• %Windows%\Microsoft.NET\Framework\v3.5\SqlServer.targets
• %Windows%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5\eula.1025.rtf
• %Windows%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5\eula.1028.rtf
• %Windows%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5\eula.1029.rtf
• %Windows%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5\eula.1030.rtf
• %Windows%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5\eula.1031.rtf
• %Windows%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5\eula.1032.rtf
• %Windows%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5\eula.1033.rtf
• %Windows%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5\eula.1035.rtf
• %Windows%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5\eula.1036.rtf
• %Windows%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5\eula.1037.rtf
• %Windows%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5\eula.1038.rtf
• %Windows%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5\eula.1040.rtf
• %Windows%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5\eula.1041.rtf
• %Windows%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5\eula.1042.rtf
• %Windows%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5\eula.1043.rtf
• %Windows%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5\eula.1044.rtf
• %Windows%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5\eula.1045.rtf
• %Windows%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5\eula.1046.rtf
• %Windows%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5\eula.1049.rtf
• %Windows%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5\eula.1053.rtf
• %Windows%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5\eula.1055.rtf
• %Windows%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5\eula.2052.rtf
• %Windows%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5\eula.2070.rtf
• %Windows%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5\eula.3082.rtf
• %Windows%\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5\logo.bmp
• %Windows%\Microsoft.NET\Framework\v4.0.30319\Microsoft.Common.targets
• %Windows%\Microsoft.NET\Framework\v4.0.30319\Microsoft.CSharp.targets
• %Windows%\Microsoft.NET\Framework\v4.0.30319\Microsoft.Data.Entity.targets
• %Windows%\Microsoft.NET\Framework\v4.0.30319\Microsoft.NETFramework.targets
• %Windows%\Microsoft.NET\Framework\v4.0.30319\Microsoft.VisualBasic.targets
• %Windows%\Microsoft.NET\Framework\v4.0.30319\Microsoft.WinFx.targets
• %Windows%\Microsoft.NET\Framework\v4.0.30319\Microsoft.Xaml.targets
• %Windows%\Microsoft.NET\Framework\v4.0.30319\Workflow.Targets
• %Windows%\Microsoft.NET\Framework\v4.0.30319\Workflow.VisualBasic.Targets
• %Windows%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg
• %Windows%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg
• %Windows%\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\header.bmp
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\SplashScreen.bmp
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\watermark.bmp
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1025\eula.rtf
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1028\eula.rtf
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1029\eula.rtf
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1030\eula.rtf
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1031\eula.rtf
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1032\eula.rtf
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1033\eula.rtf
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1035\eula.rtf
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1036\eula.rtf
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1037\eula.rtf
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1038\eula.rtf
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1040\eula.rtf
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1041\eula.rtf
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1042\eula.rtf
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1043\eula.rtf
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1044\eula.rtf
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1045\eula.rtf
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1046\eula.rtf
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1049\eula.rtf
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1053\eula.rtf
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\1055\eula.rtf
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\2052\eula.rtf
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\2070\eula.rtf
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\3076\eula.rtf
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Client\3082\eula.rtf
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\header.bmp
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\SplashScreen.bmp
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\watermark.bmp
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1025\eula.rtf
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1028\eula.rtf
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1029\eula.rtf
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1030\eula.rtf
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1031\eula.rtf
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1032\eula.rtf
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1033\eula.rtf
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1035\eula.rtf
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1036\eula.rtf
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1037\eula.rtf
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1038\eula.rtf
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1040\eula.rtf
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1041\eula.rtf
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1042\eula.rtf
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1043\eula.rtf
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1044\eula.rtf
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1045\eula.rtf
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1046\eula.rtf
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1049\eula.rtf
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1053\eula.rtf
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\1055\eula.rtf
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\2052\eula.rtf
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\2070\eula.rtf
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\3076\eula.rtf
• %Windows%\Microsoft.NET\Framework\v4.0.30319\SetupCache\Extended\3082\eula.rtf

(Note: %Desktop% is the desktop folder, where it usually is C:\Documents and Settings\{user name}\Desktop in Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\Desktop in Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.. %User Startup% is the current user's Startup folder, which is usually C:\Documents and Settings\{user}\Start Menu\Programs\Startup on Windows 2000 and XP, and C:\Documents and Settings\{User name}\Start Menu\Programs\Startup on Windows Vista, 7, and 8.. %User Profile% is the current user's profile folder, which is usually C:\Documents and Settings\{user name} on Windows 2000, XP, and Server 2003, or C:\Users\{user name} on Windows Vista and 7.. %Application Data% is the Application Data folder, where it usually is C:\Documents and Settings\{user name}\Application Data on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Roaming on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), Windows Server 2008, and Windows Server 2012.. %Temporary Internet Files% is the Temporary Internet Files folder, where it usually is C:\Documents and Settings\{user name}\Local Settings\Temporary Internet Files on Windows 2000, Windows Server 2003, and Windows XP (32- and 64-bit); C:\Users\{user name}\AppData\Local\Microsoft\Windows\Temporary Internet Files on Windows Vista (32- and 64-bit), Windows 7 (32- and 64-bit), and Windows Server 2008; C:\Users\{user name}\AppData\Local\Microsoft\Windows\INetCache on Windows 8 (32- and 64-bit), Windows 8.1 (32- and 64-bit), and Windows Server 2012.. %Program Files% is the Program Files folder, where it usually is C:\Program Files on all Windows operating system versions; C:\Program Files (x86) for 32-bit applications running on Windows 64-bit operating systems.. %Windows% is the Windows folder, where it usually is C:\Windows on all Windows operating system versions.)

This report is generated via an automated analysis system.