Veeam 12.1 & Suspicious files

[mikep@tsbf.com]

The feature is a great concept, just very poorly thought out in initial implementation and deployment. This is a release, not a beta test for future development. Basic functionality for excluding specific files for false positives or paths should have been included on day one of the product design phase. Is Veeam really that naive to believe that EVERY file that shares the same file extension a particular ransomware also chose to use must also then be ransomware? OK. Flag those files as suspicious. I get that. Now let us determine if it legitimate or not. And if it is, let us EXCLUDE that file from future scans without having to turn off the ENTIRE extension that would prevent from picking up an ACTUAL ransomware event for the same extension and known ransomware threat. You're eliminating the product's ability to catch a specific threat for the sake of a legitimate file or two! Poorly thought out. I certainly would expect improvements on the next release that should have been there in the first place.

[Gostev]

I don't necessarily see it the same way as you do though. From my perspective there are only two scenarios:

1. An accidental typo resulted in a weird file extension that also happens to match a known malware extension: this should be corrected by renaming a production file, because ultimately we're talking about an unusable file in production that its corresponding app will not recognize. Notably, this takes the same effort as adding an individual file to exclusions instead, but you're also fixing a real issue by doing so.

2. There's a custom line of business app that generates files with extensions that match a known malware extension: you have to exclude the entire extension from monitoring, otherwise you will have endless false positives every day as the LoB app creates new files.

I really don't see any scenarios where excluding individual files is the right answer to this whole issue in the long run. As by doing this, you're either treating a symptom instead of the root cause (case 1) or just doom yourself to continuous and costly manual process of managing file exclusions individually (case 2).

[mikep@tsbf.com]

Only two scenarios?

First off, there's no typo. Is it a weird file extension? Maybe. But it was a legitimate extension used by a legitimate company for a legitimate purpose long before a ransomware programmer decided to tarnish it.

Second, there is a legitimate scenario. Here it is.

The specifics of this particular case are that a vendor chose a specific file extension (AXI) for specific custom software configuration template files. The result is a small number of STATIC reference files with that extension that need to remain in place. The LOB app is NOT generating new additional files with that extension every day and new ones will not be showing up any time soon. If they do, I would expect to need to exclude them. I totally agree that excluding the entire extension should ALSO be an option for the scenario you mention. But exclusion by specific file should be too. It simply can't and shouldn't be an "all or nothing" based solely on extension. The solution should behave the same way that all mainstream Antivirus/Malware, etc. in allowing exclusions based on file names, extensions, paths, or hashes. I'd add that any malware solution that makes a FINAL determination that a particular file is suspicious or infected based purely on the file extension name vs the contents therein is a pretty poor one.

Lastly, I don't see a software vendor necessarily reprogramming their application to eliminate the use of an extension because a ransomware programmer coincidentally chose the same one. I wouldn't expect Adobe to change their PDF extension or Microsoft to change their extensions if a random hacker also decides to use them. Otherwise, you are proposing yet another form of ransomware and we're all be in trouble!

[galbitz]

there are plenty of file extension examples that might be used for malware now but weren't historically. for example the .bi file extension is being flagged, yet i have microsoft products that contain bi files as part of their installation admin shares. its only 1-2 bi files on a large fileserver, but to the previous comments point it wouldn't make sense to exempt all bi files. The product is fine for testng and being a new feature but it needs to grow. I have a vm that I use infrequently, but the other day I put 2 jpgs on the desktop as part of a export out of autocad I was doing, and deleted them once I moved them to another machine. That vm was flagged the next day as a large amount of file deletions (two files). With no list of files that alert is really unusable in an enterprise that will probably see a couple hundred files get deleted each day. i am only running this feature in my home lab, i can't imagine how people would be coping with those alerts in a business where the fileserver is being used by hundreds+ people amplified by hundreds of vms.

[Gostev]

I do have some complaints on a few extensions being monitored which I think they should not, at least not by default. My own "favorite" is ..txt which is a common typo I myself do on my home PC (as I have a setting to display extensions). So some polish of extensions monitored by default is for sure required, but this is something we can only do with much data from the field. By the way, the current list is already shorter than the initial list proposed by our security researchers, based on testing it on Veeam's own production infrastructure.

So we'll observe how this feature behaves in real-world environment and improve it as we get more data. While I currently hate the idea of manual exclusion of individual files as it's simply unmanageable in any decent size environment, may be support big data will convince me otherwise. Although it is more likely that we will figure out a better, more automated way to achieve the same.

I've also come to realization that it would be a mistake to make sharp moves, such as my own "brilliant" idea on the first page of this topic, which was a classic knee jerk reaction based on too little data. But just a couple of weeks after launch, I started to hate my own idea passionately. Because we started seeing the feature having colossal success objectively: already there are so many early adopters who opened support cases because this functionality detected traces of actual malware attack on some of their systems, attacks they had no idea about - and attacks that would totally fly under their radar if we "assumed environments to be initially clean" and implemented that automatic exclusions for initial backups I came up with.

Truly, haste makes waste

[Gostev]

That vm was flagged the next day as a large amount of file deletions (two files).

Actually, this is totally unexpected since the default threshold of minimal absolute number of files which need to be deleted is much higher: 50 if I'm not mistaken (and that is for any given "useful" extension separately, not total number of files deleted). So we would want to investigate your logs to see why it saw the problem with just 2 files deleted.

And yes, we thought of large file servers too so we made this value easily configurable via a registry value, and of course if our default appears to be too low we will increase it in future patches. Just need to collect more data to understand what value is right.

[mcz]

Guys, I had some false positives too. Now in my case it were only a few files, in total 3 extensions (txt and others), but having a look at the txt-files, I still don't understand why they should be suspicious. One just had a date in the format dd.mm..txt and others had a very long naming, nothing that would be for sure on some suspicious list. So obviously I don't understand the whole concept here.

However, there are basically two options:

- Put the extension on the exclusion list
- Put the file on the esclusion list

In the first case you might pay the price if some malware activities are going on and you don't receive warnings, but I don't like the second case as well. If I was a malware actor, I would love to use files or directories excluded by malware scanners to hide my activities.

So what I really would love was passing a hash to a exclusion list - no matter where that file is and which name it has, we know that it's safe because we have kind of "signed" it by the hash. If a malware or any other process changes one single bit, it will pop up because the hash changes.

Now of course, that means more load on the CPU as it would have to hash all the suspicious files, but in my case it would be ridiculous as it were only some few KBs. Also, if you had an environment with thousands of always changing files, you won't end up putting hashes in some list. But I'd see it as an additional tool in this whole box of tools for the malware engine. You could finally choose: Do I like to exclude the whole extension or do I only exclude by a certain hash?

Did I mention that I don't like file path exclusions?

[Dima P.]

Hello Michael,

but having a look at the txt-files, I still don't understand why they should be suspicious.

It's not actually .txt but ..txt(two dots) which is the extension Xorist ransomware family adds to the file names.

If I was a malware actor, I would love to use files or directories excluded by malware scanners to hide my activities.

Added your vote to exclude well known files / locations from our malware detection engine. Using hash is a good idea, however it will definitely impact the overall backup / indexing performance. We will discuss it with the team, thank you!

[OashaP]

Hello @Dima P
I am encountering the same behavior on out system. "Too many files have changed" and we have no idea what files are affected.
We know that the marked system does a lot of changes during a workday, but we would like to investigate if those files are the expected ones.
Veeam has not created a log file to look up a path, just like in cgsm's case.

Should we also open a case for further investigation, or do you already have enough information collected on this topic?

cgsm,

Unfortunately we have to ask you to raise a support case too as we need debug logs to continue the investigation. Is it possible to raise it and share the case id with us? Thank you!

[Dima P.]

Thank you for the feedback OashaP! We got all the information we need and delivering the dedicated log for this event in the upcoming patch.

[nka]

For myself, I would like to still have a scan for .jse file, but exclude them from one specific folder, like so :

Code: Select all

c:\folder\*.jse

[Dima P.]

Hello nka,

Makes total sense, added your vote to this feature request. Thank you for sharing your feedback!

[stewsie]

Recent backup flagged as malware Bulk File Deletion

I have looked in the Svc.VeeamDataAnalyzer.log file and found

Deleted files: .docx:48, .doc:6, .xls:3, .xlsx:10, .ppt:0, .pptx:3,

This server is a SharePoint server and the backup is indexed. I would have thought there would be a log that shows the files Veeam flagged as deleted so I could investigate in more detail.

What is the threshold for this alert and can it be changed?

[nka]

You can see the exact files detected in the logs located on "[..]\Veeam\Backup\Malware_Detection_Logs\"

[Dima P.]

Hello guys,

The event has been raised because either 50% or at least 25 of files with specific extension were deleted. You can fine tune the metrics via C:\Program Files\Veeam\Backup and Replication\Backup\TrackedFiles.xml

Code: Select all

<FileMaskData>
<FileMask>.docx</FileMask>
<ThresholdPercent>50</ThresholdPercent>
<ThresholdFiles>25</ThresholdFiles>

You can see the exact files detected in the logs located on "[..]\Veeam\Backup\Malware_Detection_Logs\"

Correct, but this improvement requires the latest update which was just released. The log file for deleted files event is unavailable in vanilla 12.1 build. Here is the link to the latest update for 12.1 release. Thank you!

[stewsie]

Correct, but this improvement requires the latest update which was just released. The log file for deleted files event is unavailable in vanilla 12.1 build. Here is the link to the latest update for 12.1 release. Thank you!

Is there also a patch for Veeam One? Usually that needs to be updated first

[stewsie]

I just downloaded the latest Veeam Data Platform Advanced file which contains the latest Veeam B&R iso but Veeam One is the same as the previous version so appears no update needed for that

[mcz]

AFAIK, there is no patch for veeam ONE as there is nothing to be improved in regards to the malware engine...

[Dima P.]

Hello guys. VeeamOne does not have a patch yet, new update for 12.1 is related only to Veeam B&R components. Thank you!

[OashaP]

Hello guys,
I recently updated to 12.1.1 to now be able to review the "Too many files have changed" and "Bulk file deletion" notifications.
These logs are a huge help and thank you providing a quick fix for that!

Nevertheless, I still got a question regarding to that:
While looking through the logs I found a path used by Veeam which I am not certain if this is correct.
Inside the Path: "c:\Windows\VeeamVssSupport\metadata\VSS\WritersData\{GenereicHexNumber1}\{GenereicHexNumber2}" there was a file called "MetadataDoc.xml".
Are those files supposed to be deleted?

I guess that this Veeam Log is just noting down every little deletion if a certain threshold has been reached.
So, I assume, this kind of maintenance file deletion of Veeam itself is also logged down as a consequence, right?

[eider]

Reporting another false positive that hit recently:

Potential malicious activity detected: too many .jpg files have been deleted or renamed since last backup, ensure this activity is legitimate

Log snippet (full log contains about 900 entries):

Code: Select all

C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.61931.13895771279126430.334dfcee-50c2-4010-b0db-f650d9db5460[1].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.20145.13510798887674018.49fa62d1-e511-41e6-ba79-28aac8544939[1].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.59153.13849706481114711.ad41dc7b-24b9-43d1-ab5d-112cd3989338[1].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.43601.13510798886165796.35ca9994-fe08-4740-a9b4-8f2fe5776c2e[1].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.11240.14570619375927069.cfebc241-8141-4793-ae60-a1a63e010c65[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.41371.13757391410654470.a3df272c-5017-4af9-9645-5f2da444dba1[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.17962.14570619375927069.13dfed9e-5e4c-4b80-a047-c788466699d1[1].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.56533.14259259051211743.d43068ed-2fde-4091-83df-65f53ad375d5[1].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.50449.14133138182223814.13644e44-6c8e-4310-9975-56e76b1d3618[1].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\image[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.44829.9007199266246398.fab84bd6-dd10-4a80-9137-0a0428d5234f[1].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.5319.14330106046565284.f8a713f9-7d4f-4891-9dc1-f775c5eb3d19[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.54570.14378100014308772.080e4b4c-8572-40c1-a8fe-e4144e807da6[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.22696.14398308773733109.53eed167-276f-443c-a7a5-c0d635242775[1].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.58178.13740903646068838.6a02c51f-8ab9-47fd-9838-78943efe6cc2[1].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.57350.13849706481114711.ad41dc7b-24b9-43d1-ab5d-112cd3989338[1].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.59620.9007199266246187.2ae64e16-c0fc-480d-a02b-8646477b4190[1].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.35125.9007199266250702.e1adf37d-dff0-4c85-9d43-e179894bde8d[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.5295.13825011251621706.e8a531ea-e643-41b9-8969-8a0182f70030[1].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.56008.13989377567416624.ac1af046-8d84-45ae-bcbe-27f153164f17[1].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.5801.9007199266246188.49767e14-de23-47cf-a245-27d480b37671[1].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.50661.13510798887475206.e86cb887-21a0-4fd7-a53e-5dfaa13e4ccb[1].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.40518.14127333176902609.7be7b901-15fe-4c27-863c-7c0dbfc26c5c[1].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.42486.14106055032135034.107f3197-03b3-4b1d-8806-e3f6b8c92a35[1].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.46958.14474323638833886.4a2816b2-d8f2-49ae-80e4-32141d1d2722[1].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.23697.14027181851903689.819c7487-4021-4451-8868-7f68370666e3[1].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.8232.13926773940052066.8978812d-6c65-429b-835d-2cecd178e2d7[1].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.55662.13561428843663101.db53229a-3063-4dd3-b18e-61ad6b3661d1[1].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.8446.9007199266246190.7d5781be-8887-4229-a335-e66e73b442a7[1].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.26067.14602976482056734.1c62b6b6-4d60-4d27-a3f3-61c3aff6ef97[1].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.38511.14086093697596683.3784f3bc-81ad-4fbd-9972-9758bc777a57[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.65484.14078890142565591.e7fa19e7-e324-4191-99ec-da26c3869d4c[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\RE56CS4[2].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.18490.9007199266248474.459612a3-ac45-4c7b-8912-632c60f790eb[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.4083.14191174512742283.25b58903-5b4d-47c0-959c-c79a5aabf46c[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.17303.14369599701219677.6bb25a0e-579c-4bf7-9ef1-143b9ad63a82[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.38383.9007199267161390.39af3a9d-2b46-4a6d-91fc-f615b6b15d23[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.64156.13926773940052066.16e93a5b-b25f-4aaf-8a38-77375e237879[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.59620.9007199266246187.2ae64e16-c0fc-480d-a02b-8646477b4190[2].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\image[1].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.9729.14405452487353876.a6612b1c-3bfc-46da-ad7e-0dd83b65757d[1].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\image[2].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\image[3].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.29977.14170710832825752.5addfe15-ba9d-4fc8-8332-64849a1e4126[1].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.39892.13679433660235770.2abc8cc7-aaf8-4d3a-a397-7b9ad8b267fe[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\image[4].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.35457.9007199266246190.7d5781be-8887-4229-a335-e66e73b442a7[1].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.36205.9007199266246190.c589f3db-ec2f-4ff1-aa08-fe1534ce5391[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.48395.9007199266246190.c589f3db-ec2f-4ff1-aa08-fe1534ce5391[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.23697.13538845508086461.dd58a2de-736b-4b8b-bf73-c2e82eccad53[1].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.23697.13979303197529799.0153a900-a783-4498-be9e-f845e894b931[1].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.17543.13538845508086461.01b29cf3-9817-41b4-a4d5-74cd1d5b4194[1].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.56008.14189431855827103.c494221c-c639-4dba-b873-c8176038e480[1].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.45904.13538845508086461.335ec3c1-c0fc-4b51-a677-68c6001661ce[1].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.53913.13864528555121207.8adc233d-7538-473e-90dd-e441976a6404[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.41930.13825011251621706.e8a531ea-e643-41b9-8969-8a0182f70030[1].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.5967.13864528555121207.8adc233d-7538-473e-90dd-e441976a6404[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.57830.14300134241685305.975088fb-8de0-4b98-b23a-5ca523bf8640[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.24227.14427308708381960.531b1165-dec6-45ba-acb2-02367f59769b[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.14757.14052963868385356.b9495659-202e-4157-8c48-55863a8dd2bc[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.17543.13561428843663101.908e6472-09ed-4700-ab8d-d182bdb34172[1].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.50316.13971163265013127.13213869-05e5-4fc9-8920-df4442e14b44[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.993.14559783335643657.b239a2f0-5ae7-442b-8ce1-86594b362f48[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.16840.13728688939883805.0fcf856e-c561-488b-b8e3-facfe6f7de12[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.20465.14608371803662720.900bc010-cf11-48bd-9af4-4bfa4e7a075e[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.5093.14359467175295190.a7266fa2-8cca-4fee-87b9-fd9f2d4861f3[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.26156.13510798887395106.4d9c7397-b1e2-4e33-9e25-0c3aa7ed4fd4[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.51299.14204664140659067.648bcf06-57a8-46bc-b72f-9ccabc518d9d[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.44594.9007199266246197.39e8b939-762c-4a18-b3ef-2115ed56e77a[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.38402.14615777982104992.594788c8-f06c-4754-a367-51ec014b28df[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.17543.14290463157120907.140815b3-0f92-4630-854a-8a65dfed1564[1].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\image[2].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.51282.14442254729118049.c37529cd-4b3a-4930-a4de-01a45324fcf6[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.8101.13852242065924058.a7f3d767-15e0-4eb2-92d1-ca6b2ed32de2[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.41997.14161875019499822.8ab8caef-07dc-4389-a729-54409fa50348[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.1448.13864215575623899.8d14d12b-deee-49f0-b7d9-8111af0d0d45[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.31061.13510798887905001.5b97746c-8ffa-4764-b336-d48b70f8b290[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.6460.13631043950355238.14997171-9a9b-4c1c-9913-fedb29a86bbe[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.8984.13920401164131377.c3258e08-bc28-4ee5-a7f5-6892b619757b[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.2003.13673439778512477.d380e92f-b93e-4cd3-bfd1-df40aa558391[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.34060.9007199266246865.fdd30c53-ef1b-499d-a6c0-27ee100a32c2[1].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.39487.9007199266740465.f136a759-9e6b-4390-b229-6d8774795894[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.53597.14149209451254358.a1411453-49c9-4115-af50-4db67ba71a54[1].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.64552.14189199574729493.572cdb08-3c8b-49c4-82ac-bbeba0973bbe[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.4744.14149209451254358.a1411453-49c9-4115-af50-4db67ba71a54[1].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.37415.9007199266252770.6b141157-fb26-4549-b2bd-3a05f6e14038[1].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.21049.14317187510942559.c3f00800-f627-44d9-822c-4cafcc3bd0a4[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.30252.13581223868996394.55d0cdc7-62a9-49a1-baad-f12edad03432[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.50421.13581223868996394.55d0cdc7-62a9-49a1-baad-f12edad03432[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.16529.13516926463533531.6ac55143-07d9-4f1f-b6ca-b1f2a7718fb1[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.38104.14025941169658879.0c824f35-303f-47a4-a469-ba65fedb46e1[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.47210.14025941169658879.0c824f35-303f-47a4-a469-ba65fedb46e1[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.25582.13619644598889832.643e64c9-8604-4d97-95cd-aa815a4accf3[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.63430.13510798884064729.d3861c7a-7161-4513-b010-daed499dddee[1].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.25611.13790862382302763.d1da2dbd-2f68-43a1-82d4-e91b7e73d297[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.24729.9007199266251806.fb95a083-d5cb-49ce-aa07-2d31e8503d85[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.50127.13860006235403291.b0baac6e-110a-4035-aafb-3afdbd3c05d7[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.55914.13780761998573908.5e75f4cb-10aa-46b8-9813-94bd9a73d880[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.39272.9007199267163071.011f2239-fe2e-4c80-aca2-789f209aac77[1].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.45398.9007199266248149.fc9ab142-2468-4eee-b5bc-264cd858b8f6[1].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.33873.13510798885732234.f7c81fa3-78e2-41a2-983d-6f4cefd94a1c[1].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.59752.14371825410523561.5c9469d8-ac8d-4963-98c3-9fc24e43bdbe[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.6688.13930708587035991.461f9ee3-15a5-4173-92f9-4c72ee1095e6[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.60491.14601167986937378.8143907d-5928-4189-bfe1-7fb68f182220[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.22481.14026671408003552.3646f116-e0f8-4f09-b739-94ae5ceb352d[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.59535.14012602786650760.3343a5f0-d02e-4602-ae02-fd4fee0abb0d[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.54135.14222458110220046.fed2dcb2-47a6-414e-a21e-cbd0636d8d3d[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.61460.13768621950225582.167ba0c8-6eb8-47bb-96fe-278c89bf0dc9[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.56405.14616533255932004.ac5bbe18-8769-4821-8300-18e2d878e106[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.23966.14222458110220046.174e7733-3cdd-40dd-8276-13d37813cffc[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.53820.14502810260109911.f5c61e57-f127-4c71-8703-8cd0d33c35dd[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.33036.14502810260109911.226e7407-f63b-4662-950a-4a6b91f6bf40[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.47931.13592668300764735.55b49f05-a58f-437f-95f4-f51ea7542976[1].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.54530.14355368446062212.8bbd23ed-e9ab-4691-b02a-78fef05d4c17[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.10264.14471503450300874.6169655f-414b-4c09-a050-3d01239856de[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.24186.14503972063913484.f1ee4822-2eae-4747-9f6b-3b31d3128c76[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.63240.13588442905826814.795a5ce2-2721-4e5d-af2f-c7be66360dcd[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.12260.13721640926642911.6721f347-8eeb-4963-b1f3-ccb1c03fda84[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.14044.13694814529444249.6c45f815-586e-4dcf-ae8c-3294747848e1[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.32454.14051294882282643.a589f642-4a63-4b58-ad46-cc9e998422ea[1].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.56189.13721640926642911.ea1c08ab-3281-445f-9286-7d147eea9d98[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.51061.13694814529444249.c6183cbb-7d98-4ca4-a2dd-365f82773858[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.11134.14051294882282643.549d1508-cdc6-4456-9085-82eef90be7bb[1].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.15824.13713077662583092.4ce97e6d-cf78-4ab4-9832-71763c87ed2b[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.28349.14441072069704313.a7479a4d-07ae-421f-98ae-1dd1e2ab6b9e[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\RE5fOvR[1].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.11633.14556939799757056.85ab87f5-8a61-46c3-aa17-8f5903835bb7[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.41647.13883721464006213.e7408f78-281f-4d17-9448-de93c5af760c[1].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.41357.14266966000615936.7d54995a-4c1c-48f4-954a-b9380bb76dc9[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.22696.13521039587628029.8272213e-f667-4aed-8927-130f8c075d83[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.18348.14483755230214605.57092895-466e-46d5-8b90-3f9cc9912393[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.7691.14616532569755394.8ec00f04-1532-4594-a2d9-4db215384393[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.2721.13549709530005202.b3d43105-c76f-486d-b67a-0ca4bb5040b7[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.4593.13776076441956407.ad43bc19-1f0a-4f97-9b17-33d390a4ea3e[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.44872.14542079591473335.d6b0d5ad-d75e-4c2c-9fce-5803596834f6[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.12475.13920035373495275.c8c5398f-9c49-4257-8a5f-bc57fcafd631[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.39706.14174337849891979.191caf08-8fe8-42ad-8398-fcfa32d2f747[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.52411.14545416746577334.b9abf24b-1704-4ace-8506-d2249d125068[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.65287.14367449596838014.298008a3-bdb6-4f2e-a404-77bd5b93340a[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.54974.13967723440271994.6847c31a-9fae-4d31-815c-940c76dad7b8[1].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.27959.13591516717735580.ceb2f0e7-de2f-4707-92f7-b062d85fef9c[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.44243.13967723440271994.899c9cb1-66df-4be7-87b4-076481687f65[1].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.3471.14378384315723962.bec86e35-30cc-458b-9080-a028765bb7e5[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.51290.14168916444291296.21be43d6-c77d-4ca6-98d1-ebfe4463e605[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.55658.13689094653534727.a03c3b96-03a5-49bc-84a9-9100a123b48c[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.5577.13784174038097220.af8ca59d-67ce-446a-9c6f-5705b75b8069[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.35439.13866481919548767.bd74349a-6e94-4f7b-b330-00701ed329ef[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.39112.13525952133103686.18f6f66f-600a-4ecd-a193-515cb7d7abdd[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.3.13802771771628660.fc05459d-2813-4de9-b376-0d8787f41b05[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.21750.13655221276611040.b2813aea-aa4d-4770-baaa-9f3751eb3e04[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.45940.13655221276611040.b2813aea-aa4d-4770-baaa-9f3751eb3e04[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.18412.14141277124340674.dc1c0e4c-f421-4d3b-b2e8-5e420141ca90[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.50392.14594997872812313.9ed31757-7a78-4b33-8300-553242a1d791[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.17209.13515663403140426.e6a8e337-2270-4b7a-a8f2-1ab35a2b5c62[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.29112.14307684860061189.add494a8-3f01-4397-988f-934960b530a3[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.30542.14199082568180996.95449988-d28d-4d23-b25d-c410b1b06caf[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.4168.14199082568180996.953d785b-0656-408c-b755-a4d3076c7d97[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.9954.14307684860061189.add494a8-3f01-4397-988f-934960b530a3[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.1625.14036657014613635.f5199b77-2b6c-40bf-9f4b-301dca775ba9[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.36775.14348656682422850.ee8e67ad-e3c2-4e3a-90b5-b614390b8ce3[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.21867.14150396102942578.dea7eb18-bd02-45f6-9ef1-6628859d749f[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.42437.13600343997426362.79181022-80ee-41b0-8091-5eca76530982[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.54870.14158747917670857.06332add-abc5-4399-94c0-ca2a77aeca95[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.49290.14158747917670857.5b6fc729-7d92-4e86-8c3b-0e089ad3875d[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.14489.13691904460459495.574542d2-81e8-4767-8ecc-623c4bd2f046[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.21328.13666079135464041.262c63a4-3d2e-4fcb-862d-2038cfd9fdf3[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.54932.13608593070486651.878c4330-de54-4636-bc7d-2b312749f568[1].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.48300.13654783898909844.8b1757a3-a8a1-44fb-8076-dbd3f02e11da[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.32459.14433039802010393.57d298a5-62bc-4cfc-87ff-ca31685d1487[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.43077.13557061269355896.7a034469-f9bc-44bc-a5d6-4a9aa3849ea4[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.57444.14000697169355955.9a536422-c0cc-4003-87db-51dafc0d559d[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.52728.13766063483095614.ec79034c-b4e5-472e-90fa-f846bc726599[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.39722.14309757982396439.717bf586-020c-4e5f-9970-26635abeab18[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.53515.13726115565134884.c22525ee-8166-4638-89b5-256890080105[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.17543.14189431855827103.1754bf27-6ca7-4a78-804c-5e8ec04e855a[1].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.21797.14417092962913430.f4baff7c-e1c0-44f9-8b15-ab92d6a5aaec[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.44703.13643173445802635.0238bad3-be3e-4c35-a0d8-d7e5b3186a54[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.23580.14451203199763421.274cfed0-a617-4b2a-8cc3-36c4f9cc4855[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.1469.14417092962913430.fbc10801-cafb-47de-9895-f930e387584d[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.44454.13557096901393555.e5dc5caa-bb89-4abf-9d83-ae0cd5d4b163[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.16477.13726613030761753.78178295-f7a6-4a83-add7-9658a9937895[1].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.43734.13738509071143801.ea962e02-2c6a-4724-9f43-d9126b26ba49[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.7679.14066308247113248.71f37cc8-86b5-4f83-855b-441821570bfe[1].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.49007.14383053519445011.18a1e65a-b8f0-481b-bea8-2a17b67ceae6[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.1199.14481632208894299.65294798-b258-4b40-ad3c-0451200d8fa5[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.26407.13954220614155117.d8d9dbf1-2f5f-4da3-8fa3-31cb6a7b59e9[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.56213.14474337564596307.6c783b22-9460-4205-938c-2969961ed85c[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.61650.14385661025744974.871696db-8f0c-4c74-91b5-124e947bd54a[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.48885.13711315072621172.36f7b32c-917a-4590-b645-99ab53335473[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.7717.13683693341425376.68d7ed84-1ea5-4249-bb03-8c0ae4a38f72[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.36792.14517892247946829.6603132b-3b61-49c2-939a-56415a92d6ba[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.56565.13642632707306758.93a9202b-72e8-4ee7-a639-c5977eb3d663[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.48146.14490565656429827.7006e4aa-7413-496d-a1e6-79c8dbc8a8a9[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.25974.13981488594118600.9ef97f39-c926-4cff-b7b6-78391b8edec3[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.39215.13541406766425460.c9ce4eec-fcdd-49b3-b4cc-dbeffa058069[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.43158.13965336120690994.530e3a89-a770-41e6-9811-247bf754c92d[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.20124.13720315494941606.30534494-2d3a-467c-80a7-555575c0c3f8[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.58277.9007199266252602.a7984cd0-3483-4de0-97c3-5a4b75f54e84[1].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.30450.14550071803374418.c4ccf6cf-9aba-4a28-8c12-1d532bcc60a1[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.54372.14168576633528759.c204cf11-5c1a-44cd-bd94-43db2967729e[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.38163.14168576633528759.a081e4c8-f766-430c-9ab7-e0aa07b0798a[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.19240.14302557696272789.3faade13-3063-4190-a463-be1de4147b13[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.13508.13769667459728032.2d0c6433-c748-4c33-a433-7459b03b5f9d[1].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\VWF72AF2\apps.9712.13718224407789883.808255bb-9e1f-4997-b7a6-e54e2abdd274[1].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\OMAT39AK\apps.27997.13510798887693184.7ec3c9c0-db14-4b13-84e5-11300fb0c2f3[1].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\OMAT39AK\apps.23697.13849706481114711.ad41dc7b-24b9-43d1-ab5d-112cd3989338[1].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\OMAT39AK\apps.59620.9007199266246187.2ae64e16-c0fc-480d-a02b-8646477b4190[1].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\OMAT39AK\image[1].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\OMAT39AK\apps.17543.13849706481114711.ad41dc7b-24b9-43d1-ab5d-112cd3989338[1].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\OMAT39AK\apps.62630.13680352605320375.3e3ce85d-8a18-480d-8a41-92bee4787bba[1].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\OMAT39AK\apps.41900.14404534492004773.4b394539-52a1-460b-9e2a-498c2455490a[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\OMAT39AK\apps.64816.13680352605320375.3e3ce85d-8a18-480d-8a41-92bee4787bba[1].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\OMAT39AK\apps.60461.14404534492004773.4b394539-52a1-460b-9e2a-498c2455490a[1].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\OMAT39AK\apps.33313.13757391410654470.a3df272c-5017-4af9-9645-5f2da444dba1[1].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\OMAT39AK\apps.56632.13929205887942903.ad5328da-9cbd-478b-95e4-849fd02146fe[1].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\OMAT39AK\apps.4211.13634052595610511.c45457c9-b4af-46b0-8e61-8d7c0aec3f56[1].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\OMAT39AK\apps.56161.9007199266246365.1d5a6a53-3c49-4f80-95d7-78d76b0e05d0[1].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\OMAT39AK\apps.8453.13655054093851568.4a371b72-2ce8-4bdb-9d83-be49894d3fa0[1].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\OMAT39AK\apps.10546.13571498826857201.6603a5e2-631f-4f29-9b08-f96589723808[2].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\OMAT39AK\global.4635.image.6f55bab8-d894-46ea-94d9-4ad102009096[1].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\OMAT39AK\apps.442.14492077886571533.b0266c29-bb30-438c-b201-6b7e235b7920[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\OMAT39AK\apps.54354.13510798882606697.7a42c472-75d7-487e-9538-ebb5ce1657e6[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\OMAT39AK\apps.37917.9007199266248474.fed2dcad-f741-47ef-9f1e-307a2d51b9c0[1].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\OMAT39AK\apps.48666.9007199266252789.05ba84d6-f74d-4beb-ba05-12d7e5f76cd0[1].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\OMAT39AK\apps.17543.13849706481114711.ad41dc7b-24b9-43d1-ab5d-112cd3989338[2].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\OMAT39AK\apps.15688.14473651905739879.acc6ed89-3676-47d6-be05-eeb80774ff9d[1].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\OMAT39AK\apps.46484.14318846362781107.472babb5-aec4-4502-a619-ffbe2ee169d0[1].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\OMAT39AK\apps.25815.13561428843663101.db53229a-3063-4dd3-b18e-61ad6b3661d1[1].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\OMAT39AK\apps.36994.9007199266252409.55c8a156-d5a0-4204-88cb-cad97cec8cf5[1].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\OMAT39AK\apps.34124.9007199266740465.7153e958-76ad-445a-be02-d2e4cc26f347[1].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\OMAT39AK\apps.51427.9007199266246188.49767e14-de23-47cf-a245-27d480b37671[1].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\OMAT39AK\apps.39793.13878650002538161.3f27413b-237a-452f-a9d4-28acfb7ff8a3[1].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\OMAT39AK\apps.8037.13569982730391095.0fa3b79f-1620-43d6-bfff-512dea2eeaf9[1].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\OMAT39AK\apps.18893.13798539581762600.da71a5e7-cd92-40a1-a104-ace0550cd636[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\OMAT39AK\apps.20897.9007199266252409.55c8a156-d5a0-4204-88cb-cad97cec8cf5[1].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\OMAT39AK\apps.28261.13798539581762600.abe1643f-1704-4a4d-a61b-47ccc25da012[1].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\OMAT39AK\apps.44386.14078890142565591.e7fa19e7-e324-4191-99ec-da26c3869d4c[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\OMAT39AK\apps.6843.9007199266248474.fed2dcad-f741-47ef-9f1e-307a2d51b9c0[1].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\OMAT39AK\apps.59544.14191174512742283.60e3aeb4-9d54-41ec-acd7-f8b79d2bd5eb[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\OMAT39AK\apps.17247.14268534876664945.75049ee0-da0f-4506-92f2-63bcd798c977[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\OMAT39AK\apps.32990.13672777200662346.8fa944a0-40ec-47ee-859e-d8aaacad60e0[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\OMAT39AK\apps.46673.9007199266246188.49767e14-de23-47cf-a245-27d480b37671[1].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\OMAT39AK\apps.64521.13926773940052066.8978812d-6c65-429b-835d-2cecd178e2d7[1].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\OMAT39AK\image[2].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\OMAT39AK\apps.46958.14474323638833886.4a2816b2-d8f2-49ae-80e4-32141d1d2722[1].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\OMAT39AK\apps.52480.14506576373691712.f142bb8f-4517-4ff3-80c8-442338d9b06c[1].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\OMAT39AK\apps.37564.14374512070697751.00e88e8c-8e09-4824-89c2-88fcee77a234[1].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\OMAT39AK\apps.64500.14170710832825752.0337f199-11f5-4ef1-848d-cfb7a32bb128[1].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\OMAT39AK\image[3].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\OMAT39AK\apps.59475.13878650002538161.3f27413b-237a-452f-a9d4-28acfb7ff8a3[1].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\OMAT39AK\apps.45904.13748617810036542.da613a45-e095-4f0f-89c6-c62a954ef739[1].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\OMAT39AK\global.8057.image.ad972786-1355-416b-9382-b086e7ac1e5a[1].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\OMAT39AK\apps.2801.9007199266246190.7d5781be-8887-4229-a335-e66e73b442a7[1].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\OMAT39AK\apps.60144.9007199266528810.d35c82cb-644c-433a-8559-c4c600c5956d[1].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\OMAT39AK\apps.23190.9007199266246197.1102bb94-3d65-417b-bd4a-5e4abd0fc759[1].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\OMAT39AK\apps.25936.9007199266248474.fed2dcad-f741-47ef-9f1e-307a2d51b9c0[1].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\OMAT39AK\apps.35388.14565325549522547.7c07369c-6f5d-4639-9b37-4241124b0fa0[1].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\OMAT39AK\apps.20607.13825011251621706.592ad705-6651-4135-b83b-88e4e522e1f4[1].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\OMAT39AK\apps.54966.13518989614493838.cccb5466-8c9c-41e7-8b38-36b3419aa488[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\OMAT39AK\apps.52106.9007199266242890.65e04bdd-4345-4361-b587-32a76407d265[1].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\OMAT39AK\apps.6748.13518989614493838.cccb5466-8c9c-41e7-8b38-36b3419aa488[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\OMAT39AK\apps.35118.14059170909397578.29cbe5a1-16fa-4901-9845-6a42125e166f[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\OMAT39AK\apps.2687.14052963868385356.b9495659-202e-4157-8c48-55863a8dd2bc[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\OMAT39AK\apps.18176.14620070209500458.7c31ea3c-cc71-4a78-9637-8cc8e91832c5[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\OMAT39AK\apps.53323.14030800370618913.6383968f-bfa5-4d04-8f87-c8f0ea8b40f5[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\OMAT39AK\apps.20810.14030800370618913.6383968f-bfa5-4d04-8f87-c8f0ea8b40f5[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\OMAT39AK\apps.33624.14004472659985347.aa70caf8-10f2-4768-9646-fba29ed056dd[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\OMAT39AK\apps.54251.9007199266252789.05ba84d6-f74d-4beb-ba05-12d7e5f76cd0[1].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\OMAT39AK\apps.1943.13576480032112951.ca930155-3a90-41dc-849b-8cffc26d6658[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\OMAT39AK\apps.13532.14204664140659067.648bcf06-57a8-46bc-b72f-9ccabc518d9d[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\OMAT39AK\apps.54506.13784521242503072.5ef68c98-4d61-4e11-84e3-ec385c73a46c[1].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\OMAT39AK\apps.38512.14373984023076920.5e9b70d5-179d-4c4c-a317-96cfb25d8abe[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\OMAT39AK\image[4].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\OMAT39AK\apps.45904.14290463157120907.a49fb4a5-9a5a-4a4b-8e2b-1e64f3910a4e[1].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\OMAT39AK\apps.35591.14615777982104992.7e966a47-536b-43af-a231-7526f20b33b8[1].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\OMAT39AK\apps.15167.13844868329507759.07372d86-a484-4a8f-a924-abf609635a3e[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\OMAT39AK\apps.48835.13852242065924058.503f9fa9-a051-4057-8ab6-b11ce8e7f40c[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\OMAT39AK\apps.35552.14161875019499822.1ea49bc7-d934-495d-817f-3e11a04934ee[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\OMAT39AK\apps.28528.9007199266247846.dda5c2bb-0e59-4688-b8c7-8b934b98da19[1].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\OMAT39AK\apps.5496.14562462990742545.f75ad677-b304-4b69-b837-c12e4f56eb06[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\OMAT39AK\apps.58696.13673439778512477.d380e92f-b93e-4cd3-bfd1-df40aa558391[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\OMAT39AK\apps.61786.14131597032361940.38d2a067-3798-455f-934a-f69935156b3d[1].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\OMAT39AK\apps.2455.9007199266246184.7b7dea7e-e480-4008-b420-a807cc23c9cf[1].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\OMAT39AK\apps.57672.13956811863745420.e7a2de9c-8863-4514-88e1-d84f9509f8ea[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\OMAT39AK\apps.50478.9007199266740465.7153e958-76ad-445a-be02-d2e4cc26f347[1].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\OMAT39AK\apps.20353.13956811863745420.fd7b3280-a5c9-47a4-a9de-23391c9ec48f[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\OMAT39AK\apps.8037.13569982730391095.0fa3b79f-1620-43d6-bfff-512dea2eeaf9[2].png
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\OMAT39AK\apps.11609.14393416498587167.4ff70c0a-8987-4d90-8e49-5c3b58d40573[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\OMAT39AK\apps.8592.14632822545299055.10f0677f-06e2-435b-b10b-0351bc665a73[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\OMAT39AK\apps.49000.14632822545299055.10f0677f-06e2-435b-b10b-0351bc665a73[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\OMAT39AK\apps.11645.13511683234768830.4a5f7450-54d8-4caa-80f2-35cafe6964a6[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\OMAT39AK\apps.10223.14487476416123085.d4f4a181-7a4c-4d83-aae6-b7393d78fb77[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\OMAT39AK\apps.5470.14181177710935220.a7baea5e-856d-4ed3-b57f-b4cfabdc702b[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\OMAT39AK\apps.13250.13516926463533531.6ac55143-07d9-4f1f-b6ca-b1f2a7718fb1[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\OMAT39AK\apps.65272.14289639713399493.be8e4981-5a69-4a4b-91f0-9de085813de1[1].jpg
C:\Users\<redacted>\AppData\Local\Packages\Microsoft.WindowsStore_8wekyb3d8bbwe\AC\INetCache\OMAT39AK\apps.33273.9007199266252437.4fde283f-3fad-46ea-815f-a8c6c8778988[1].png

Looks to be some regular Windows maintenance task that cleaned up unused cached images from Microsoft Store, possibly after the AppX package itself was updated. Definitely should be in excluded paths internally, so it does not cause false alarms.

---

In addition to that, is there a plan to have a way to modify thresholds (or ideally outright exclude specific ones) for specific monitored extensions without editing XML file manually (which will get overwritten on every B&R update)? A good example would be .mdb extension which is under "Database files" category, however they are often created and removed as consequence of running Mono builds (.mdb files are somewhat of a Mono-specific .pdb files).

[MILJW002]

HI ALL,

Last night I upgraded to the most recent version 0f 12.1, and I think I finally know why my Linux boxes keep triggering "Potential malicious activity detected: too many .db files have been deleted or renamed since last backup, ensure this activity is legitimate".

There are heaps of file changes in /var/cache/, which is totally to be expected, it's a cache.

The two main directories are:
/var/cache/man/
/var/cache/dnf

So, the repository/update manager.

These are clearly false positives, and explains why the Linux VMs keep triggering the alerts.

If there w2as a way to exclude specific folders that would help, or alternatively if Veeam was to adjust their logic to ignore known locations. I could see the Windows %TEMP% folders also sometimes triggering this, or the Software Distribution folder as it also changes a bit.

James

[Gostev]

It was also just discovered that the default is set lower than agreed... this alert was not supposed to trigger if less than 50 files have been deleted, but in the shipping version the threshold is set to 25. You can change that according to the instructions from Dima P. above. And I agree, excluding known "active" locations by default is a great idea that we should implement ASAP @Dima P.

[Dima P.]

Hello guys,

To elaborate more on what can be fine tuned in the C:\Program Files\Veeam\Backup and Replication\Backup\TrackedFiles.xml file which controls the thresholds.

You can:

- drop entire node FileMaskData if you do not want specific extinction to be monitored.
- change the ThresholdPercent or ThresholdFiles values for existing extensions. Malware event is raised whenever either ThresholdPercent or ThresholdFiles count for the specific extension is reached.
- design your own rule for your own extension which is not listed in the xml, it supports new nodes and new extensions in the format below:

Code: Select all

<FileMaskData>
<FileMask>.MyExtension</FileMask>
<ThresholdPercent>70</ThresholdPercent>
<ThresholdFiles>100</ThresholdFiles>
</FileMaskData>

[aQuestionmark]

Hi there,
three questions
1) I am not a fan of adding exceptions for any file mask but wanted to ask would there be possible to be able to either accept any single file (or as group) as clean (after having investigated the file) instead of accepting everything clean (option undir Malware detection: Mark as clean)?
2) for same reasons would there be possibility to mark the files for quarantine in same place?
3) I guess that location for logs were "Too many files have changed" and "Bulk file deletion" is shown is under programdata\Veeam\backup\folder where "folder" is the name of the job?

Since I have not seen if it is possible perhaps number one and two would be considered for future additions for Veeam?

best regards,
Oli

[Dima P.]

Hello Oli,

1) I am not a fan of adding exceptions for any file mask but wanted to ask would there be possible to be able to either accept any single file (or as group) as clean (after having investigated the file) instead of accepting everything clean (option undir Malware detection: Mark as clean)?

Currently not possible, but we've already noted this feature request.

2) for same reasons would there be possibility to mark the files for quarantine in same place?

You can add specific extension to guest file index analysis today and it will raise an event. Can you elaborate on marking files for quarantine? How you would expect such functionality to work?

3) I guess that location for logs were "Too many files have changed" and "Bulk file deletion" is shown is under programdata\Veeam\backup\folder where "folder" is the name of the job?

Here: Programdata\Veeam\Backup\Malware_Detection_Logs\

Thank you!

[aQuestionmark]

hello Dima,
thank you for for your answer and sorry for the delay in answering.

I don't know if it is feasable but if files are listed in a windows within Veeam and the option would be either to mark them clean or quarantine.
Quarantine would then be files Veeam flags as questionable and you as admin decide they are questionable and either should not be there (although if they are there I guess you already might have a bigger problem) or warrant a closer view.

I do know this is were Endpoint etc are supposed to working but based on the tests done Veeam is flagging lot more files some of whom warranted a closer look and many of those files were then deleted.

best regards,
Oli

[Dima P.]

Hello Oli,

Thank you for the feedback, sounds like a great request. We will discuss it with RnD folks!

[vmtech123]

Hey guys.
Here are my thoughts as I love this product, but having 10's of millions of files dating back a while causes some issues for me, and 100s of TB's I'm bound to be setting off some alerts
The first time I ran it, I found malware and encrypted files from a ransomware attack 8 years ago before I started that were never fully cleaned. The product and feature DO WORK!!!. This makes me not want to turn it off.

Now the bad, Almost every file server has alerts every day. I have about 600 alerts total. I could get the file types if required but not the names.

Here are options that would really help me.

1) The ability to mark previously marked items as clean and IGNORE would be huge. Essentially take that Malware Detection file, and just ignore all those files in future scans. Many of these files are quite old and some have file types that won't be used again.

2) the ability to disable specific file types per server, or per folder. Servers are hosting files for different reasons. Just because 1 server needs an exclusion, doesn't mean I want it excluded everywhere to stay protected.

3) showing the files in the GUI or "NEW" files in the GUI vs the log file.

Either way this is a great feature.

[HDI92]

Is it possible to see a list with the path and name of the detected files? I can't find it. Thank you