xorist | 3fe8fd2dfde21f0b79e0336fce36e5f6d28efc2452851cb5d3e9f3e1d950412c

Analysis

max time kernel
150s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
21-02-2023 11:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
Size

21KB
MD5

dc6aec10c0d6a6aa1111921e8787318b
SHA1

c639d565c2723471a133030b505ab3d6c708e1c4
SHA256

9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd
SHA512

298c5c63144e9f262d04e0188c337a58147239e9d956deb3010defee610ebc6170a399c5e858638c8d24d46bf5d60b13549c0752876b654cee1ef6b9bf150bb2
SSDEEP

384:Uprr1gkDCgSwvXqOBQy608DpyVwP3lGtgAB6Q0Ci6VBi:6rVDCyT2L089ZP3gtFXRti

Score

10^/10

xorist persistence ransomware spyware stealer upx

Malware Config

Extracted

Path

C:\Program Files\7-Zip\Lang\HOW TO DECRYPT FILES.txt

Ransom Note

YOUR SYSTEM IS LOCKED AND ALL YOUR IMPORTANT DATA HAS BEEN ENCRYPTED. DON'T WORRY YOUR FILES ARE SAFE. TO RETURN ALL TO NORMALLY YOU MUST BUY THE CERBER DECRYPTOR PROGRAM. PAYMENTS ARE ACCEPTED ONLY THROUGH THE BITCOIN NETWORK. YOU CAN GET THEM VIA ATM MACHINE OR ONLINE https://coinatmradar.com/ (find a ATM) https://www.localbitcoins.com/ (buy instantly online any country) THE PRICE FOR DECRYPTOR SOFTWARE IS 2000$ BTC ADRESS : 17o2F4pUNiuCkfqN9KWpRWSwn5pj7k7YRj (where you need to make the payment) VERRY IMPORTANT ! DO NOT TRY TO SCAN WITH ANTIVIRUS YOU RISK LOSING YOUR DATA . ANTIVIRUSES ONLY DESTROY THE ENCRYPTED DATA , THEY DO NOT KNOW THE ALGORITH WITH WICH THE ENTIRE SYSTEM WAS ENCRYPTED. THE ONLY WAY TO DECRYPT YOUR SYSTEM AND RETURN TO NORMAL IS TO BUY THE ORIGINAL DECRYPTOR SOFTWARE. For more information : [email protected] (24/7) Subject: SYSTEM-LOCKED-ID: 80012Afr1

Emails

[email protected]

Wallets

17o2F4pUNiuCkfqN9KWpRWSwn5pj7k7YRj

URLs

https://coinatmradar.com/

https://www.localbitcoins.com/

Signatures

Detected Xorist Ransomware 16 IoCs

resource	yara_rule
behavioral2/memory/4924-249-0x0000000000400000-0x0000000000411000-memory.dmp	family_xorist
behavioral2/memory/4924-1768-0x0000000000400000-0x0000000000411000-memory.dmp	family_xorist
behavioral2/memory/4924-1773-0x0000000000400000-0x0000000000411000-memory.dmp	family_xorist
behavioral2/memory/4924-3064-0x0000000000400000-0x0000000000411000-memory.dmp	family_xorist
behavioral2/memory/4924-4298-0x0000000000400000-0x0000000000411000-memory.dmp	family_xorist
behavioral2/memory/4924-5991-0x0000000000400000-0x0000000000411000-memory.dmp	family_xorist
behavioral2/memory/4924-6057-0x0000000000400000-0x0000000000411000-memory.dmp	family_xorist
behavioral2/memory/4924-6058-0x0000000000400000-0x0000000000411000-memory.dmp	family_xorist
behavioral2/memory/4924-7067-0x0000000000400000-0x0000000000411000-memory.dmp	family_xorist
behavioral2/memory/4924-9901-0x0000000000400000-0x0000000000411000-memory.dmp	family_xorist
behavioral2/memory/4924-12301-0x0000000000400000-0x0000000000411000-memory.dmp	family_xorist
behavioral2/memory/4924-13145-0x0000000000400000-0x0000000000411000-memory.dmp	family_xorist
behavioral2/memory/4924-15141-0x0000000000400000-0x0000000000411000-memory.dmp	family_xorist
behavioral2/memory/4924-16209-0x0000000000400000-0x0000000000411000-memory.dmp	family_xorist
behavioral2/memory/4924-17615-0x0000000000400000-0x0000000000411000-memory.dmp	family_xorist
behavioral2/memory/4924-19115-0x0000000000400000-0x0000000000411000-memory.dmp	family_xorist

Xorist Ransomware
Xorist is a ransomware first seen in 2020.
ransomware xorist

Modifies extensions of user files 3 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

description	ioc	Process
File renamed	C:\Users\Admin\Pictures\ExitRequest.png => C:\Users\Admin\Pictures\ExitRequest.png..remember_you_have_only_50_hours_to_make_the_payment_or_we_will_delete_your_decryptor_from_our_base	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File renamed	C:\Users\Admin\Pictures\FormatConvertTo.crw => C:\Users\Admin\Pictures\FormatConvertTo.crw..remember_you_have_only_50_hours_to_make_the_payment_or_we_will_delete_your_decryptor_from_our_base	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File renamed	C:\Users\Admin\Pictures\TraceWatch.crw => C:\Users\Admin\Pictures\TraceWatch.crw..remember_you_have_only_50_hours_to_make_the_payment_or_we_will_delete_your_decryptor_from_our_base	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HOW TO DECRYPT FILES.txt	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

UPX packed file 16 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4924-249-0x0000000000400000-0x0000000000411000-memory.dmp	upx
behavioral2/memory/4924-1768-0x0000000000400000-0x0000000000411000-memory.dmp	upx
behavioral2/memory/4924-1773-0x0000000000400000-0x0000000000411000-memory.dmp	upx
behavioral2/memory/4924-3064-0x0000000000400000-0x0000000000411000-memory.dmp	upx
behavioral2/memory/4924-4298-0x0000000000400000-0x0000000000411000-memory.dmp	upx
behavioral2/memory/4924-5991-0x0000000000400000-0x0000000000411000-memory.dmp	upx
behavioral2/memory/4924-6057-0x0000000000400000-0x0000000000411000-memory.dmp	upx
behavioral2/memory/4924-6058-0x0000000000400000-0x0000000000411000-memory.dmp	upx
behavioral2/memory/4924-7067-0x0000000000400000-0x0000000000411000-memory.dmp	upx
behavioral2/memory/4924-9901-0x0000000000400000-0x0000000000411000-memory.dmp	upx
behavioral2/memory/4924-12301-0x0000000000400000-0x0000000000411000-memory.dmp	upx
behavioral2/memory/4924-13145-0x0000000000400000-0x0000000000411000-memory.dmp	upx
behavioral2/memory/4924-15141-0x0000000000400000-0x0000000000411000-memory.dmp	upx
behavioral2/memory/4924-16209-0x0000000000400000-0x0000000000411000-memory.dmp	upx
behavioral2/memory/4924-17615-0x0000000000400000-0x0000000000411000-memory.dmp	upx
behavioral2/memory/4924-19115-0x0000000000400000-0x0000000000411000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\AW9Uh46T9Q23s9t.exe"	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe

Drops desktop.ini file(s) 64 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Users\Public\desktop.ini	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Windows\Fonts\desktop.ini	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-2805025096-2326403612-4231045514-1000\desktop.ini	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Windows\Media\Desktop.ini	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Users\Admin\3D Objects\desktop.ini	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Users\Public\AccountPictures\desktop.ini	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Windows\Downloaded Program Files\desktop.ini	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Program Files (x86)\desktop.ini	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe

Drops autorun.inf file 1 TTPs 1 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Windows\BitLockerDiscoveryVolumeContents\autorun.inf	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-40_altform-unplated_contrast-black.png	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\js\common.js	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteNotebookWideTile.scale-400.png	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-48_altform-unplated_contrast-black.png	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-white_targetsize-64_altform-unplated.png	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\FetchingMail-Dark.scale-400.png	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.core.expressions_3.4.600.v20140128-0851.jar	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-125_kzf8qxf38zg5c\Assets\Images\SkypeWideTile.scale-125_contrast-black.png	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsSoundRecorder_10.1906.1972.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-black_scale-200.png	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-30_altform-fullcolor.png	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\sv-se\HOW TO DECRYPT FILES.txt	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\RTL\contrast-white\WideTile.scale-200.png	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_neutral_~_8wekyb3d8bbwe\AppxBlockMap.xml	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-40_contrast-white.png	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\MLModels\autofill_labeling.ort.DATA	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Program Files\7-Zip\Lang\io.txt	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-20_altform-unplated.png	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorSplashScreen.contrast-black_scale-200.png	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\bg4.jpg	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\faf_icons.png	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\ReadMe.htm	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\AppPackageSplashScreen.scale-100.png	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNotePageMedTile.scale-200.png	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\RTL\contrast-white\WideTile.scale-100.png	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\images\s_radio_selected_18.svg	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-Generic-Dark.scale-125.png	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\HOW TO DECRYPT FILES.txt	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Send2Fluent.png	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File created	C:\Program Files\VideoLAN\VLC\locale\gd\LC_MESSAGES\HOW TO DECRYPT FILES.txt	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AlarmsSplashScreen.contrast-black_scale-125.png	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsAppList.scale-125.png	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.artifact.repository_1.1.300.v20131211-1531.jar	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\cs.pak.DATA	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\ru_get.svg	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-white_scale-140.png	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Square44x44Logo.targetsize-64_altform-unplated.png	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-Yahoo-Dark.scale-150.png	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\improved-office-to-pdf-2x.png	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Images\fre_background.jpg	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\Background_RoomTracing_Success.jpg	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Trust Protection Lists\Mu\LICENSE.DATA	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteAppList.targetsize-16_altform-unplated.png	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\en-gb\locimages\offsym.ttf	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_listview.svg	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.common_5.5.0.165303.jar	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.console_1.0.300.v20131113-1212.jar	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.garbagecollector.nl_ja_4.4.0.v20140623020002.jar	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ug\LC_MESSAGES\HOW TO DECRYPT FILES.txt	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\email\dummy\adobe-old-logo.jpg	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Office 2007 - 2010.xml	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\GADUGIB.TTF	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteSectionWideTile.scale-200.png	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailAppList.targetsize-40.png	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.contrast-white_scale-100.png	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\MicrosoftDataStreamerforExcel.dll.config	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\SplashScreen.scale-100.png	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\ms-logo-no-text.png	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\StoreLogo.scale-400.png	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\lib\tzdb.dat	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\WorldClockMedTile.contrast-black_scale-125.png	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\HOW TO DECRYPT FILES.txt	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_ca.xml	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Thumbnails\Sticker_Icon_Wood.jpg	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\AboutAdsCoreBackgroundImage.jpg	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.Entity.resources\v4.0_4.0.0.0_fr_b77a5c561934e089\HOW TO DECRYPT FILES.txt	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Windows\BitLockerDiscoveryVolumeContents\ro-RO_BitLockerToGo.exe.mui	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Windows\Fonts\seguisbi.ttf	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Windows\INF\basicdisplay.inf	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File created	C:\Windows\INF\rdyboost\HOW TO DECRYPT FILES.txt	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Windows\Media\Windows Logoff Sound.wav	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.GroupPolicy.Reporting.Resources\v4.0_2.0.0.0_fr_31bf3856ad364e35\HOW TO DECRYPT FILES.txt	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost.resources\v4.0_4.0.0.0_it_b03f5f7f11d50a3a\HOW TO DECRYPT FILES.txt	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices.resources\v4.0_4.0.0.0_it_b03f5f7f11d50a3a\HOW TO DECRYPT FILES.txt	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\AppConfig\EditAppSetting.aspx	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File created	C:\Windows\assembly\GAC_MSIL\System.Data.Services.Resources\3.5.0.0_fr_b77a5c561934e089\HOW TO DECRYPT FILES.txt	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Windows\INF\UGatherer\040C\gsrvctr.ini	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Windows\Installer\112ee.msi	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SecurityAuditPoliciesSnapIn\v4.0_10.0.0.0__31bf3856ad364e35\HOW TO DECRYPT FILES.txt	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Services.resources\v4.0_4.0.0.0_ja_b03f5f7f11d50a3a\HOW TO DECRYPT FILES.txt	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\HOW TO DECRYPT FILES.txt	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Windows\diagnostics\system\WindowsMediaPlayerPlayDVD\ja-JP\DiagPackage.dll.mui	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Windows\Fonts\jvgasys.fon	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Windows\INF\ServiceModelOperation 3.0.0.0\0407\_ServiceModelOperationPerfCounters_D.ini	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Activities.Build.resources\v4.0_4.0.0.0_es_31bf3856ad364e35\HOW TO DECRYPT FILES.txt	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.KeyDistributionService.Cmdlets.Resources\v4.0_10.0.0.0_fr_31bf3856ad364e35\HOW TO DECRYPT FILES.txt	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Utilities.Resources\2.0.0.0_ja_b03f5f7f11d50a3a\HOW TO DECRYPT FILES.txt	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File created	C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.SmartTag\15.0.0.0__71e9bce111e9429c\HOW TO DECRYPT FILES.txt	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Windows\Boot\EFI\ja-JP\bootmgr.efi.mui	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Windows\INF\LSM\0411\lagcounterdef.ini	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Windows\INF\mdmati.inf	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.Wizards.AutomaticRuleGenerationWizard.resources\v4.0_10.0.0.0_fr_31bf3856ad364e35\HOW TO DECRYPT FILES.txt	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\es\HOW TO DECRYPT FILES.txt	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File created	C:\Windows\assembly\GAC_MSIL\System.Web.Routing\3.5.0.0__31bf3856ad364e35\HOW TO DECRYPT FILES.txt	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Windows\Fonts\georgiaz.ttf	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.GroupPolicy.Reporting.Resources\v4.0_2.0.0.0_de_31bf3856ad364e35\HOW TO DECRYPT FILES.txt	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Policy.3.0.Microsoft.BackgroundIntelligentTransfer.Management\v4.0_10.0.0.0__31bf3856ad364e35\HOW TO DECRYPT FILES.txt	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Windows\INF\c_fsinfrastructure.inf	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Windows\INF\mdmbug3.inf	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions.resources\v4.0_4.0.0.0_de_31bf3856ad364e35\HOW TO DECRYPT FILES.txt	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File created	C:\Windows\INF\MSDTC Bridge 4.0.0.0\0410\HOW TO DECRYPT FILES.txt	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management.Resources\1.0.0.0_en_31bf3856ad364e35\HOW TO DECRYPT FILES.txt	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File created	C:\Windows\Boot\EFI\en-GB\HOW TO DECRYPT FILES.txt	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File created	C:\Windows\Boot\Resources\it-IT\HOW TO DECRYPT FILES.txt	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Windows\DiagTrack\GetFileInfoActionAllowedList.dat	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Windows\Fonts\Candaraz.ttf	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Windows\Fonts\ntailu.ttf	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Windows\INF\c_hidclass.inf	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\HOW TO DECRYPT FILES.txt	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Windows\Boot\EFI\pl-PL\memtest.efi.mui	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Activities.Resources\v4.0_3.0.0.0_es_31bf3856ad364e35\HOW TO DECRYPT FILES.txt	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework.Royale\v4.0_4.0.0.0__31bf3856ad364e35\HOW TO DECRYPT FILES.txt	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.DataSetExtensions.resources\v4.0_4.0.0.0_it_b77a5c561934e089\HOW TO DECRYPT FILES.txt	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\SQL\it\Tracking_Logic.sql	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File created	C:\Windows\ImmersiveControlPanel\images\HOW TO DECRYPT FILES.txt	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Windows\INF\.NETFramework\0411\corperfmonsymbols_d.ini	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Windows\INF\sceregvl.inf	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Net.Http.WebRequest.resources\v4.0_4.0.0.0_es_b03f5f7f11d50a3a\HOW TO DECRYPT FILES.txt	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\App_Code\PasswordValueTextBox.cs	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\regasm.exe.config	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v3.0\Windows Workflow Foundation\SQL\de\Tracking_Schema.sql	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File created	C:\Windows\assembly\GAC_MSIL\System.Data.Entity.Design.Resources\3.5.0.0_it_b77a5c561934e089\HOW TO DECRYPT FILES.txt	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File created	C:\Windows\assembly\GAC_MSIL\System.ServiceProcess.Resources\2.0.0.0_it_b03f5f7f11d50a3a\HOW TO DECRYPT FILES.txt	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.S356e1ba0#\1d15088f501797022a5f51a0cde8576d\HOW TO DECRYPT FILES.txt	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Windows\INF\mdmaiwat.inf	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.Services.resources\v4.0_4.0.0.0_es_b77a5c561934e089\HOW TO DECRYPT FILES.txt	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
File opened for modification	C:\Windows\BitLockerDiscoveryVolumeContents\zh-CN_BitLockerToGo.exe.mui	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe

Modifies registry class 10 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\..remember_you_have_only_50_hours_to_make_the_payment_or_we_will_delete_your_decryptor_from_our_base\ = "CSMXBJDRAZQKSDW"	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CSMXBJDRAZQKSDW	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CSMXBJDRAZQKSDW\DefaultIcon	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CSMXBJDRAZQKSDW\shell\open\command	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CSMXBJDRAZQKSDW\shell	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CSMXBJDRAZQKSDW\shell\open	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CSMXBJDRAZQKSDW\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\AW9Uh46T9Q23s9t.exe"	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\..remember_you_have_only_50_hours_to_make_the_payment_or_we_will_delete_your_decryptor_from_our_base	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CSMXBJDRAZQKSDW\ = "CRYPTED!"	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CSMXBJDRAZQKSDW\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\AW9Uh46T9Q23s9t.exe,0"	9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe

C:\Users\Admin\AppData\Local\Temp\9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe
"C:\Users\Admin\AppData\Local\Temp\9bb8d77ac2a18950a244183a82fa3cc4fa47ef6b4ce2a0979552dd1ff46725bd.exe"
1⤵
- Modifies extensions of user files
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
PID:4924

Network

MITRE ATT&CK Enterprise v6

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2805025096-2326403612-4231045514-1000\desktop.ini

Filesize
129B

MD5
a7648d172f60e93ddf4cac4dae61e70b

SHA1
064b1d69528614847036a9382bd927b0a00d3e4e

SHA256
66c3b1b77dd344fdeee21869a25160919e4686a1cba84085fb15aaf33f8ce0e3

SHA512
48c24e661722d08fc3b36c414492cda735203363fe4d824d9718cc50a851957561b83aa1ac65ae8e07b483754385fc5066b108bdd8890ddb9c742de4157489ed

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\aic_file_icons.png

Filesize
50KB

MD5
d78d0149b896088ddbf4c5c15c680608

SHA1
3570c10927261a21808b9c14940982305743c9c8

SHA256
b7698d71813c1f256fa0a6a844302590baced00c3db198ec8223bb485ebec218

SHA512
2d8c44c23bde89ac89324e26897a2b8816ef3191f9700a49397c4075116c99159f43f64c8577464bb0594010c2b1513bbb5aaa157cad9311d91d1127f4b0a133

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_remove_18.svg

Filesize
711B

MD5
33fcc81449f15072ad34c0132842f124

SHA1
3bd11371ba181910b4838947404f6f97d0560bc9

SHA256
6a1a3bb88c3b8332a8d83014f07364239dc8d70bb4186065adb0ba183c545cf0

SHA512
392bc8fd360e2ec6e3f111959a930b0c8c0f5833d1653e8da1739b288c0906d7ea5d4f0eef9eb4110f669dede03741b6388433115ab604a2dcaee544c7ab00cf

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions.png

Filesize
1KB

MD5
ae8eab0d5ab7c662972cee5b2d9b654d

SHA1
8e2f378b6133cdc138bcf1361d7e23131720670f

SHA256
38d3fb33f3bfc59e1f121160eb8547becf2e71f02f90938a83df733b67dd5665

SHA512
c3d387d42b6d80a7881323e94ec188d16a9c5f439b2a664b5211a9f2c4240901411880c559b3e4520879e37baa9bcfed241244dc41e8b62cabcb4a42168f747c

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions2x.png

Filesize
3KB

MD5
5e107f47cdca5b6f775f213e626155f3

SHA1
32524e7708ce9b1d6fd56d3f823d411cd2383eaf

SHA256
a0eca1cbf52b39f90d4c7878a28f161a0f57c42dfcc04b8f5dada09251b454f9

SHA512
042bf3521a3bccb1c89e7ed9c095ba2e49ff11183531dd0913d2728e7bf362b3373823eeaf6e5d2cb91548d5dbff95c8ee3e8ad5b333b0085758b37c5480ebb4

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\duplicate.svg

Filesize
1KB

MD5
5903ed8f98e25b5fae4b0e3fbed7727a

SHA1
1cd1d7dd3c4908d6502c62e4575ccd84f31b3a5d

SHA256
58d73befe78ee05a643a19af3b918d5080ad01bc8b8ef1acb3d0918de1116da0

SHA512
243b12fdf36f3855f6882047ca22d83ef9e053417b8417cd1b64039d47c4ba8c00c447f7d4fdbc991b11e66999396f14c8da793562d920b5b50dac22ecd6dddc

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\remove.svg

Filesize
1KB

MD5
d276dc7abfb987f0b31a359a671e2b92

SHA1
75184d379787c6ad008858b02177f443b2ccb83d

SHA256
15dc5ffa78588812482193e70c770335e4af7b34d3c36bb8683b2b200f17fb1b

SHA512
fa0ff9f3800c87254d022b1e4b5c094e993fff6e4f0c8a43d9632a7c1ae28d820ad01d504fe34a1c02667e0a8af02d66c1ed6adedc757d20f1e70bcc3013db05

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_folder-default_32.svg

Filesize
552B

MD5
4525f7da3eaf0b26229a25a7858d81ca

SHA1
d64351ff15a4922c6094034c610094ae44746122

SHA256
c5636d3ca20eb9c3e925f13c9927d5cad8291aed5c66c43b7fb103cc3e988008

SHA512
311a21b9bdcf47b03139ef00656098bf66a18f44e26ec90553d4885ce35b3935f262b495d45eb35ee99048d4e42d9885967a55bfbf15d0cf0b8f464d6d213142

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_sendforsignature_18.svg

Filesize
2KB

MD5
e65b007eebba7fb4839b584bb0459da6

SHA1
7ef53995c34d131145d37360c0133ccc43fc40ce

SHA256
4dd5f6c3d168907fa902a2a5a1f3b3cf3c6c7b046ebdd7b5ae16670dd013cb9e

SHA512
d0cb877f231fe71aa8b09a68b81989c967bf00a1f705dea6823c97a6f13febcb48018a3f0eaf8773be1643c85a719a3280a8996fc09091d98768d97616c1e84c

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_share_18.svg

Filesize
1KB

MD5
44825f673701e6a5ea37c5a9a7a1b24e

SHA1
97e960269884f90f40aeabb33000ab7a26e4c0bd

SHA256
2e2d37df86aa280b2e6dc4e4da887fec6d6b480920f01daee46fe2cdffb83477

SHA512
29e0e71317b42bfa869b34357781240ae6c3235c5c999f09c6e1b74245150c16075c6177ccf537737f5b3e2f79e3441b5ce876367835b95970c2a20a8396f6a8

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\root\ui-strings.js

Filesize
3KB

MD5
e6f0c47ed850e9ea832c63a4936dd5f3

SHA1
1dfaf080fc935b7dc10b6917d3d7690b02367b1a

SHA256
b65820ffc975f8e17b8c4e65f392297ffe70926dc9455542ed03f55acf0f3893

SHA512
3ddb110b5653fdfe819c81fa5a618713c6845f472d1762797d7bbbdbf233b9404d2a4a0931b4057d2f49786d6554b561e993d9439bec9fe195b3ee63b4f73e74

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\root\ui-strings.js

Filesize
28KB

MD5
131d34a475dd8d16ca1c4c500e772db1

SHA1
3f097afb7f64afec5b2fd14c6217653122217e3a

SHA256
df3219fe73582d36fa2d211666abf1fa432a4c6fa4705758dfc1fed45233f6c2

SHA512
de3c6513bb525a38ba99fd30c12fc6b590e1891c5f5aa710633e3abcce15bd06695f37caf49572f04df7af4e79d840331e3542dfc718a1c2a6e196fde6430099

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\root\ui-strings.js

Filesize
7KB

MD5
1ba79108ea1abc9381beba4d50ccd1a1

SHA1
4aadd1ac15cecb1a607db848690f7e31b5ecb409

SHA256
850a976701fe2c75abf0f167a7dbd334e03b73df1e553a93e1837f448ff10bb2

SHA512
a6c6224dffa43e4e14100dbdf982080e7855c0e762bdf3826a9e6c776c3ba53d52a3cd09fa692cc4bb85c68a6bd74d80ace8b4c23fc0dcfca0fd1867c866fd7f

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\he-il\ui-strings.js

Filesize
886B

MD5
b7a5defbaa1c338e3e36bbfcb271564b

SHA1
41fdf2c98f6f7ac5209cf46bce260de54948c33a

SHA256
04eda66be642ed03e0175632866eb83d5f9cf6e7c27b0e9aab86eda2a077821b

SHA512
81dec9587a8277b0e63ba272ee83253d6488b0da3e5e9d02ba1e0ee6d5dd4a8f2517f734f7cf05e3d1c8ed5af423b76f1bf464212b83b40addcf8f73d3620694

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\root\ui-strings.js

Filesize
4KB

MD5
24a45136cebae8f2f7d519291db91c61

SHA1
955a5bfded2c93ab8f564c706bc51b86949b942a

SHA256
9186b3a7d155b760dd598341b35fc6179e476f17a40620db8e004d8573c48a32

SHA512
e9dbb7a0973abe548596be9679946c06bd457ee6054888e0a92446eada6bebbd9c76cc9f8088327f83ad8ed6cc2fbc46805fb303687f8d517c1e253650ffe07e

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\root\ui-strings.js

Filesize
1KB

MD5
88488f3f6373ea6c2641346e34c8a3b7

SHA1
95c231221332da6139eb5298dc3ff8ad4229b9dd

SHA256
93372808d2bf2790b377b71ad643698bda90303e2ec30983ff349cf92136af47

SHA512
2ca69365f8ece72c9d18ef306e5a688e893fea38616ada56eedc1ee54b5530677296caf0ee40aa22e466b591ffe41a00e1e66a809ff92d354730e2908dea4d52

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\root\ui-strings.js

Filesize
2KB

MD5
b14d3cfa4bfbc147247745efd6ac06a8

SHA1
bde7bac365092f592ff2a8cf98e3e221d1638c24

SHA256
f724eb137a47ee181a4149446cefecb3493cc8ca946a95e0c142e842bb11886f

SHA512
3f512a727e241b213666227ced118d0d494aebfe047f2489943a65c55f6bf273654f0c4519be477f3e6f75facb6449d372d1c25dee5875160ef648fc6cd6e80c

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\root\ui-strings.js

Filesize
1KB

MD5
cc9fd1c2d318375c6e9d7ddeb434f8b2

SHA1
0582c8cc732fa78163b59d9414a328cc1d7dc6da

SHA256
3be8441422d385bf6d49baa38459963df3b0e7b97691d6f33e27bfbd0b067c4c

SHA512
43d3d283a4d93873d0590462cb58685c611e65c6431503b8144844c2b2a204a5f73bd6bbbae6b49f0b5650b2d09296e9876971404d696931a3e2657a1f8bfa92

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons.png

Filesize
683B

MD5
212e6ca350871e7860d2890970dd23b2

SHA1
e82cffe92ab8ba94cc318c04a7d7fd644373a7e9

SHA256
a17dae702ee9951e060f3b8da73d8e07769565e0d971a9b457293eabadfcdfef

SHA512
d398b0a66c871f6cdf11c27e368f1474fdc42ea5f667964fc0ca07cd6bc564d987a5a6bda857f9d34b4a60635be88e054d93ebf7812a34374d51ecabe26c9b0c

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons2x.png

Filesize
1KB

MD5
33c332ebc2783c04af7b2ea2011b33df

SHA1
64545e68fa081bebbaa17870468bccabbdd3457f

SHA256
f76172a52b19f1265462d7cad69b14af8a48573f32e6abe6ca21f9ab63923102

SHA512
7a7f5698394b04a2fd25ab98b94e19c3f4fe7163e1b35728fc3ec8e499e51787bbb5b8d2e8bc3a0f529ff48e3f75a1a04d9c73df2b1e8cdd52c1b18f1d5bb535

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon.png

Filesize
445B

MD5
f07d1405dac510b616a891c673684ebd

SHA1
a9c8d78465f4f23c0e67244134322d5881c872fc

SHA256
60c5cf5b7f224033baf2949fae5ae621dcbfc10c7c57cb5faf71212f9c1ae0f0

SHA512
50af92dd98c897eb66ee62d2d7406124e78a0550f020d7666a0ffcc5cef3cc6ef73a9fbf47c26ee80390c53387217d707fc7c59c8187a934f5890e73c1c8cac9

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_2x.png

Filesize
611B

MD5
e49054a61df515cc01e63e036f09a26a

SHA1
2e3a37a25eb5ee8b960a7477d6e032f1d439e440

SHA256
f5e471fb879dbdd95171a53b78de00c2ec3232bf42619e3bc0d55b196df475c2

SHA512
b10daaee16d9bd81db66ead1ba00e88ea07253a5c4411ba7639a53797357704d586c0ce759c18914c79ff9d1c85c3b06f9f450097c2d783c2b5bff68d06a8d8e

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover.png

Filesize
388B

MD5
6233f678bae800ea6f165fae154cd825

SHA1
5455ebe14bc857b884cd0c22fc9085e21f26a0eb

SHA256
5fccd55a13c0d643b16d3093446ed1cea0cc5e592d41bffea8e2b35aeee2f4d2

SHA512
f1e92370d2e64eb3e960bbeb7f5c9552ef703db7126e372bdc85284e7f2ec7ddc43ec81f0b430a9b8b57dd7c9a2dfb36dbd62d66703cfab3c5e1b1d4e86be036

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover_2x.png

Filesize
552B

MD5
df69b388131080830e6c2f45e5899eae

SHA1
08c48389e1882af3ea42a225ebff1f1c8249a90a

SHA256
bbf7f9ba93432fd7a37905f6f9e635e5ca95ad770f6d7c112d75b8075af86f10

SHA512
d662a94d497ce1eb61ed9e2010823aadf44acebe09bd6ba3bee1bf580c0a15ceb6bd882e7a1bebccd31fa544004c0fd8266ad0abf9d90b7c44d2c4e66c068b1a

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon.png

Filesize
388B

MD5
b2457416c7821434fbf3e53bf7f60767

SHA1
7980cf8fb6ff141fade85cde829d3febb20c7efb

SHA256
08cc6d0d473d4f83fc59968a9c2996672f06551b087d450a9b7aff033fd5ff2d

SHA512
c3116d33871a76aa61b3d6c389cf4463bc2207a2515c552786a2f938cc8b75030d2522f64ae47f4e02f11c1062dccc860a7fbb6c1ed84ad12c6ddd911b8803c4

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png

Filesize
552B

MD5
8fb1a10985e91103947bb86bc3bbaf07

SHA1
5f0e41d34d65af65644fe231b449b35e34ed405b

SHA256
6f00271e3af07332121bceef4604a164a855643e6839156c1144e17b6abda800

SHA512
e16806a1041f5c053fbc18d1af9458e8ce46802d1b8c73933f6905632c5d6239619ade2bbc7cd146f5b4103249d1d0cfbe2b7d29fe9ab4adf366005208d7c3fd

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png

Filesize
388B

MD5
eeddec603268c4261719e8977fd49c45

SHA1
dba3d4b21d35178fdd451fc6f0951c89f825e99f

SHA256
9a3af7ef093f8933cac6dd0ee35a50ee28d423e4ff93678ad4c647863b99dd5e

SHA512
260f61ef304922a23a4a2792da17496d5d0e414d5911a7977a83b58df9f67809c1b127f5f0d32a5e992654b13613c1e6282c72f8651d7c19b1c115d84024a2fb

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover_2x.png

Filesize
552B

MD5
6e7292da2614c5068091f059e6b9109f

SHA1
a7da817d1663a21e3fc20e5fb7db5486ebb07992

SHA256
92e71e183e649762f32b9eb8dce15788ec5a3af6400b8e4aa270736a3764fca3

SHA512
2bd30e7a30b0d773432aa862fd30fa56deb0cf7f0864e6ee799e7ca44e1554b51762251bd543bd94e8b03feadf104f120b8f3c1e8a7e24907ba901219c45d483

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fr-ma\ui-strings.js

Filesize
1KB

MD5
83895a5d1c4d2693060dae6178f7ecf8

SHA1
d290b2cae72603c8872949e88e9d5d1be930d3c7

SHA256
e3e870f7cb44caa167483cfb3a0648beb6990640d6108f7f170f20b5fa0bc8d6

SHA512
bf81a11fd40911547e8a11bd426f52b17329d8c9b0417fe2c19914b4a15d3463cf49c87f091eed05aa3eb30391e1be624c1bbefe5c3d5d83e6b0cc6cfda9b45c

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\root\ui-strings.js

Filesize
1KB

MD5
577e07324e0e731f05e8985f94404525

SHA1
5ab4394ea8702db72ad806c512ee843c5f5f011b

SHA256
ed564977cd9f2b24cffdb22191fb60b6f99e7b1e77b043b0de5b1fd2bce37984

SHA512
2bb5f3ca524ae2a5ef86e3c20d5373d8b03b579bf0091ff7262c2d0f3cc57b08764445723b7eddc1036c7b173bef56d3ceef19da2f8978e140114e6746406536

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\images\s_checkbox_unselected_18.svg

Filesize
901B

MD5
b94acc48d0c27d795c4a5e9595c5963c

SHA1
21c87d942732586a13ffcfd62c71f260f9dffb52

SHA256
47cd9b3c3cf44d055d031dc85213f1bade4ce3ff2e9417b2b37c9f2cfb33f882

SHA512
eb3fc6a32589c49bd66187a772807ecd44310662666a0267baddd8b4f9f3b110723f11fe3a4c4ca43cc5c03422d58826949318a65c5648715660cb64f9b38112

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\images\themes\dark\s_checkbox_selected_18.svg

Filesize
1KB

MD5
0e464afad6c532e61b10440eaefed0fc

SHA1
0c54e6bed64e7c1671836ad6e01d115229c98ca1

SHA256
b42a6f3413bd17c4d553850bd2089128f9cdc2cd1922e5290126308d438e1d14

SHA512
bae0903daef95f41c634b6972004c1fcf85cbbe24e6af7b63eabcfc496602151265434498736d3332eff287b5e8c662307ba0ccf7de81b3ae8007b359251068d

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\root\ui-strings.js

Filesize
8KB

MD5
d61e820e1adc4236a94eb3b49d8120b0

SHA1
be05211946316d3683a9657e013f3b972388c0c8

SHA256
bf11739856854802c7cfbbb0e7d0a26ac34ca1821b39be33d928aeb6f38280fd

SHA512
1e8cfc6ff21b8bb7681843da8c4795baee85b580235fbc4a4bf508fcb46276fd92f918b7bac5b5a3888dce36543560e80821f6730567e8dbee5ed50aa076dc25

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\fr-ma\ui-strings.js

Filesize
1KB

MD5
49cd8d450d5ee1aad492950a6db6fdb4

SHA1
6226e14c39244e2ecbe39013e3de98bada8ab84b

SHA256
e474a7560a08435b5d45f1b5b07e553e535a43e28285b82d5311648edc35a8b8

SHA512
bc66445de0b46193a7f17363ee229bc08d4364631071f58d0ffb27b29d57fda028295cf5934b974ddfb5325bfb22ec92fcf4ed3c39658fba40785b69d36906c5

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\fr-ma\ui-strings.js

Filesize
1KB

MD5
fdb8748e40bede55b1c96785afdd03d3

SHA1
a3ee505733405e49044f293035f03e770f6958ca

SHA256
9fcb3d23c585b0d3613ef1c3ec268ff10e4d3fae8a0e2d9cdc679567bd14cb83

SHA512
a1a3c6207e5726c6411322f0e414f5d997549f93bc6c3ddfda6eccfbc467da11587abc14ec115714145e31acdb812d8cc85058f9a756c4d89cc2511831a87149

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons.png

Filesize
7KB

MD5
8d797b0eac210bfc4edc2428bc66f8a4

SHA1
8178a14c7f1a51b77184b83589e436a4e88af66a

SHA256
3de3a6a5fa6e7038fdd587b330c3ffb1a2fb185fe49d69922100eb45660bf71f

SHA512
9b893e030e98090e1638dfd4dfdcbf5629d83263d6ac549fcb08e10d0e11d39991f19492e1b61ccee75e72ab739a88c4206061f81a95068f5c763381d575605e

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_ie8.gif

Filesize
7KB

MD5
0a73f8fca92fd3bb784c5e0b9155bfaf

SHA1
960a33d35585918c29b2375e3c3aa6c2ff8467d6

SHA256
5f0e026cc6d50150dd13cdadb0350d9d28d94cc225ba97f649093e0598b4c5d7

SHA512
40c933cc07e5affa2823c7d6c6d175ed8c56c71335738ff9222353e0bb87f15934d682fff02168b2e768e27515aed20b83967d6658dfe2b62723772b67b28573

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_retina.png

Filesize
15KB

MD5
115b666b21d9853669a6113b989484d4

SHA1
a9148d5e28c83a176a8904da566ddbd79532a9a4

SHA256
07d70b096d84fbebc63de70bb676afb044dfd44f755e32d889122bba31c06c0b

SHA512
d472f27fbb1094a8119d3b8a441a6ce99fbbb2d7f9547aab3e4ff0700ae047738c18fabb69e00cc2531538b52cce2102166fe231d595981bb1a5772679619c40

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons.png

Filesize
8KB

MD5
c9067af6dcb228fdb7cde501c313b568

SHA1
7f75f54303cbb948aeb0a0b6650ceb2004997f97

SHA256
9b5827be96dfc07e6a5b7847991f66911e1c161d3392bf416d6aa0dec3cb669f

SHA512
c5cda9b31a93b4d3a961adf305cd9984578b4681a6e52e0b59dd0bf8cab0fa49aaaffeb538b8225619c4c4974c611b341c7754f7f1f1bc6a0003015a777d5547

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons_retina.png

Filesize
17KB

MD5
7e8b335b30eece7ee05d766d5cbd1e59

SHA1
1600318a25eda1eb6e60d92fa75ee3f80cc21e93

SHA256
07bee8d857e4fe7835b5864cd89a0357a6018bf98c0841579f70d87c40592665

SHA512
2f478d3ed7b851338532409b9be2c6575745a1087f8f95df40c13a2c51bb228e52069cdb4e1856a8dc894278d910c63af8d6a9ccc4f70ae9714ff9f8eeed4965

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\en-gb\ui-strings.js

Filesize
823B

MD5
967b3ee7bebc74b42c9cdfe3df89b344

SHA1
be6de322ee7422546fd314ad8d60fece3ec7853f

SHA256
2699a2471427f7f0e57548de9db52d438e2672d1a14b1c685aff0aa2bc39a972

SHA512
ef0e2e137d68c595024a0441b470bf547c807988143d36b55a5ee0dd7d8c1f1fccd19eea18965b6703cbe66df52dedc44ea8ffe208be249750a7f0f05be5ddd0

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\root\ui-strings.js

Filesize
850B

MD5
45618bc1ec3c378c8664a2f482921248

SHA1
eb1317b4076a07103e3cb8181c3dd76a85a27bee

SHA256
8f47c930bddc967ce7d980a101892cb98da8d541ea04208475cb5ebaef2d80d2

SHA512
12a1e6abbbe42e1e98bc4245ff5999fb6d408242dec120214387d6c17fae774e0f22b4f8dc5d954c9eeb07f77354732cbc455ea2b8a6bb628028b58731186573

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ui-strings.js

Filesize
1KB

MD5
641781920054ed0306719619ea79eea5

SHA1
105071fe9d81b5fddb8af9fd689ec022ee32aaee

SHA256
f431f61a504784b065f476a83ebe76325bcbdf8c4a3863e291b94295763b894c

SHA512
0d1c2d97509c1f70cc60dda9ee0fe4468c3e8f0dffc6f7081d903e5bf328aa529f28365abc9914e087230ce425ae911d1b474373584fef526c830c8dd72997fb

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_pattern_RHP.png

Filesize
179B

MD5
041f5047d21e02ed8c86b9919eb11a8c

SHA1
243b274744c3e19b3e47e3891b56a2eb6aab77bc

SHA256
7567bc5ade278d266b2d233bacaf9115625050ebcf7fc1437ea68850c634dab3

SHA512
01e542cbad02df742f863735a677c0567709ce46e9072a43181e89cf2b964f761a17d80d6d9128eb1eb3d359ebdc5dc6bc05812276d11bc4d6f8e8debf976c5b

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\bg_patterns_header.png

Filesize
703B

MD5
c5ca9a26c104dd3687cc182b63149e17

SHA1
f17988f2d9ab91fbad75c50e4ffd54a815e5f3cd

SHA256
acda09eb2c1f5446c8876a1aa7e422c39ec21917e78a4dc31a88e7e6266dd1d1

SHA512
c9d41cdfb5d9ed6c34de1ad63c234306061981649894dfdcce312bd0f4797ff3a01ef93bb0db18fdb90758aa31db51b6cae4b6227e1e8a38b3b6c7e63144dafc

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations.png

Filesize
8KB

MD5
57cf0f2e26537b2e6e68a30dbc1e8dee

SHA1
70819592110e90e6426014742ac4f27e05847498

SHA256
1c1b182c24ef7d01b52883a559240f39cfe3db7cf959770edc1237e6d8446d92

SHA512
7bc4f30a6adefb10809b28d6ba224c5d4fea1e894c72a5e5ec433b54c6f7c02f0533e4be2ac754d86530b5bbeb86ab3deac53379983038fda54bfd2b1d5ba759

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\illustrations_retina.png

Filesize
19KB

MD5
9d778d85bb7eab534d17d019f083d8f4

SHA1
993b13df15a532b61de8894aade9d8dcdd34f52e

SHA256
755e3be5873b4b7babc24d66f4408db73ad95b86be3b6c9aaed10020e321e2e4

SHA512
9334ecf6ed8bd7337960179f38d6c638b62e5ec6cb230e57eaa1fb74dca49446c025e8b2ac261a0c6911ff7e805cdf5da14c72b4661b875df8934739a1f3bd3b

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\root\ui-strings.js

Filesize
1KB

MD5
86259dc818a041523fc4cf689a5ac849

SHA1
4cfd5e8c01880ac3673d320d3494247039e2a917

SHA256
da1611c29a9102e1dd6bf73d05a3e93460c007302cb414b4ee32016006bc368f

SHA512
dc2e333c4a89a848ebfd24c78862b706d51c0a814c736ea52c66cd6814df2c8957d394411a92d32143d05732726df01dc8b2a83fc01c6c3e3b59a7a6b90c85a7

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\sl-sl\ui-strings.js

Filesize
1KB

MD5
cba63b8a64e951318a5291503000ad6d

SHA1
067729589803d4c43e1e52433d14eb499858abdd

SHA256
6e830539a6c271e5acbacfe3542eea4bfd9cbbfff085dade8d8b9db0a127fc1b

SHA512
9c2b8d96159b5bf198a164e66c9967bc8df2741f0128b2a0558ae065442910e0b1dc18bcf88ff71ef65a5fdf6de8a0697b298ca8f72d0e31d6aabab281884e68

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\css\main-selector.css

Filesize
802B

MD5
eef4a0acc4b3ab3596fddea87910a943

SHA1
83898c2493073d348fb2e2c07a59542ecf4d5e56

SHA256
d262b7c428d6ec83315046c42d03c070994202751de25db73895f9613ff546fd

SHA512
0daf37cdc01ca8f0ed2112e0e78c3d61991d49b226f6450f4d3d086a2ff9cd1d1d64fdbdb1a3b97800a9b3a7c1a31b44a1357bb70a296b4d3279df333bee6635

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\root\ui-strings.js

Filesize
1KB

MD5
a9c8dfe37ffc549dd2821860fc35c75b

SHA1
dfdad6737382948665ca9a53a86d8e76c1ca2bd6

SHA256
e2400a7c22cd357f39a370c10ca5a5532cf1a37877641a358a4cf7037156d03f

SHA512
ad634e5dd4889f2d50608669ab0af503b922dcf97bcc0606c94f0c7cc38c7fc733e804155722a08cbfd1ce8bd380b44305a3a3f3dd474330e5cb10079a3b7ac7

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ui-strings.js

Filesize
1KB

MD5
bef6d86da1827a4d56ceb7ef8c9b3bb3

SHA1
9f84d739da5924ffdef9cd58e830b4b8cdfbb446

SHA256
121944af68aa859a5b6ee51d3f2d8d18123fe6150dee53a7e3e8a81533538ace

SHA512
311295c43c5698e16f1621a98e0029b8ef3254cee112db6df922bc8d163159428f7c57da84f55107c6a9d37cb4c042b742e088312aec4f22be1793c9e15e13e0

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\root\ui-strings.js

Filesize
1007B

MD5
166cbadf699a98c8464864eef36b69ec

SHA1
ec8b087757bc41481beb6b840f6d29a070c1b950

SHA256
3f8c6d509fff48dd733ec3cffc94f5411c546c7907a942f73c7d807bde06963d

SHA512
992ffc229111ff811511227b127985102c3d72a9c09dce474833197e140ce90810ececa40ca97f607ffe2bb8796b2359cbdfcdaa1f9daf2457d6a3450271c141

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\root\ui-strings.js

Filesize
4KB

MD5
d6d21607954f60488fc981cbac1c9fcb

SHA1
1eae6ef1521f1f70f8b6b78182ea171452227e6f

SHA256
54cc8cb804a7ecc6031eed906b2c20ded9e2e18eaf0d101191ef56e4ba11f6be

SHA512
9a36deb43b09168c77f197274475ae358f0537a507c350bba8c6dab3d8f8146ac19f8a8c8d227df80d5f5263eb8d98781f56ad91bffc321537af360072c7d22a

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\root\ui-strings.js

Filesize
12KB

MD5
f4827f4afb442fd7255248c883eea3f5

SHA1
e930a578fc1413ff679df9a1fb19835e528444fa

SHA256
5dfcd92dae10859509b674db6788d0fc93b3fb334156e5c2b639f424fb651762

SHA512
e83f76af741c451ba31d5926649a040c94119e603c3b00baac141ea3c1daa5fc07970cc7bb20967be15019d6cb645f525447c2fab8841438909b5dc0a27fb731

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\root\ui-strings.js

Filesize
14KB

MD5
a82d2f6b5af6463f8645c37dab2a6486

SHA1
63cb002df973a3e2166cb8e3fe3533514a7df778

SHA256
0923bb1962e96d55dad3d0bec3bb36f9257d5e74011b5e6ba3a58b8bc11e8543

SHA512
02f7b2a7ec4c88bd222f1b69c09bdf21c4c7b6f764f07c7e768aa823b01e4d839e411aef5af6480fa31fd1ad1a0302af1dff90237dbf5d4ccebf76abab054638

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\root\ui-strings.js

Filesize
924B

MD5
b27f6ec90adf51c2120aab428fc54aa2

SHA1
248de60e941be8b2f66486f7095456d47ced4320

SHA256
f2755878447894dab8f058db6bae10aa71c51fa104fabf56c0b21384c951eb82

SHA512
bbf7c0921ba27738a484e04646efb7c97bdcab0c3b233e5d9be1a26feb1a62103ef3b5c4aca9200392a37a7f1c660832c4ab7500c3fd53ae3eea3a2dae21c471

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\css\main-selector.css

Filesize
802B

MD5
705cef71ec51a1c49495b69f7fd4b55f

SHA1
f1fed663d62ad22865e1ed84be1c3b908391b2fe

SHA256
c8971a1f6243e873c885e95d168461cb3be02fcfb08f335bb113a2d858a54cb5

SHA512
2953607f7e15d1ef060c5729126209aaa5173fd5ded7874068934fd92e4f46da7694c64d417095f11a213daff690759c8559fb1d96ac3602288281b5e6c91bcb

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\root\ui-strings.js

Filesize
1KB

MD5
cf36787c7a5ba6c6c9654bd0c9a1296b

SHA1
3866cfc063c71f6050963dc40d613f7111bb8ab7

SHA256
6e390ba6e6102aa28ee711c8749b96a67681bc0f842cc11c63d5e32f3817feaa

SHA512
6159c333bf2bba9f62da91646e9ec24a23d113d403f3af258051d1a8fcd976abce178545b0fdb6fecc50f4d71621a67d8cd9a7752e3a1df6c4c1d541d0711d88

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\ui-strings.js

Filesize
1KB

MD5
a80643a245926a8215ecf2aeb14ebbec

SHA1
d7b7658ab871cdaf97d82954d67c0663667f1bf6

SHA256
fc507051dbcd46f9c29e4b65235e737d5dc9cd10567eb7ce0b99245dabb5ac98

SHA512
c17c32689b0e037c18c16026600d549270e21870cbc35377b8686856d1c124d45ce0fa280aa22a0f774d2685d283e744a9ce1ebde4269197506a753002195d6f

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\css\main.css

Filesize
802B

MD5
fe40fe1784d8df893dc07d11088c6012

SHA1
c0e680ab5d34575e43197118ba0f1395c3a6891f

SHA256
3aa78ca439468b2d1116679f40844b46340c4f705558e3ee9d907367217514e0

SHA512
e72838f3fa4790d4c62444f324bd4d4a2b52ae3089a2375ed6e7a11a4c0449767634c4192e64d96148a88e9ae615aea07154d44d422465ce492994e98eb41dc1

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\he-il\ui-strings.js

Filesize
855B

MD5
3e6852311ca2d17e4090921458e6d0f7

SHA1
44636b64b47efd8a330f40e5fe7f865f31f61a86

SHA256
a9a500acc3c044df6c6d86c6b8413c2ec6f11a0b1c216186bb1c5909086e8c52

SHA512
9f90ef5eec3fe354244601da83dab235d18550272e7e785d074a7f1cb55b071092cb04d8bbb1cada8ae5ad8f58a32dbd4a9b03e7894a36d06074ef3bc8ab6965

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\nb-no\ui-strings.js

Filesize
850B

MD5
abd728b0380188d58a42ffc2e739eb46

SHA1
630abd5183cd1119e46cef1af6966ca1090f6607

SHA256
82e7f3947df48290e5497b9e80f88019c8cd10480bee0ee61304bca1d90c7b7d

SHA512
b04bf6e49f8ba6b86dad4ca694809310f024a1eaa499dc6eca9b4048dde943a0e97518bf936d614002a0913187c406842baf77995c47086d83a9f19c48801481

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\root\ui-strings.js

Filesize
849B

MD5
0ebc0622c7e7fc04e9c960aecd89aa2b

SHA1
6e9de1f32588186afaf633e5ba1bc4ecda8b2a01

SHA256
350e1c7993b8b64a3581de04c47f5e475ccebee836039d7231e2e6c7d663cedc

SHA512
ab6a5ed93471e42e0148ee6b46c12ad88829a201212cbe14291f4d6b7ab3a008134ba70f9bac32cbe61ecc5ef1f956848f5febc17a404733e88582bab7f9ea90

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\css\main-selector.css

Filesize
802B

MD5
0396c8e19b72eca22d8db5599006c367

SHA1
f309f0f2fdd1114325e38a40864c9bc7861cd3bc

SHA256
3a2d3b126c47d3a4c43f540ae121f24598769f7a921abf119fd1d43cdf8a8851

SHA512
f34d6ddfd963f6a526fafa88a741ff000df245eb41964a64e9315f17fbd13512597cd3e2cb53fbc3adf001d92bbdc06a9b65bc48565bdfc2d7587f7b49fd5211

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\faf_icons.png

Filesize
6KB

MD5
d427de0dd13a847f6e3204cded1a5df4

SHA1
a40ca869063f1b8dd6b06c7df10bd7ffac37cb90

SHA256
89e646e0ab8e3a1665d18a52d4f970196f869dec34a160553da54d6e33130286

SHA512
2b4e92c4fcad42089b65e9b7662a715a6814926210dbd8beddad6d24c90843201c5b9bc2eac77613c34f3544cdca9664d9fbc2a32fb70dc15ea0058b55021c95

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\root\ui-strings.js

Filesize
7KB

MD5
2105df30669bc9e6aeee69753372ac99

SHA1
0d9c33c79a1ae6a258df759b17f0da46b8a502df

SHA256
83c89acdcd9338575d18f9496b3a97054cc7b4d06e790c775cd076ead335a49d

SHA512
075c7ecd8f964852029e0b4160ec5fb1a07af2c2ace465ccb5a1a78749bb89c07b377c946ccd6a46ea66a49ea6e27fe79433dd1227740fea21a726af95bf3bad

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\sl-sl\ui-strings.js

Filesize
3KB

MD5
cafce7ba67ddee1688131fee8216eec4

SHA1
4a86d9a793bdec836c0aff00a35228a6141bab56

SHA256
d4733fed3b9d2b21ffedcc52fd2dd74418b989721799e21f66d2b2f90668ce27

SHA512
8fc2cf0ccb486d6627b326f3daec14df524d0bd7ef7b3d7de7a2b3e4f4c8646554994baa870b13ed2634538ecef8de9b000e2a3aeb0a644f582e05c498d38c4e

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\root\ui-strings.js

Filesize
1KB

MD5
cba8a67ab1a252934e93a98c1feb3a97

SHA1
bdedf89159baeee969024782bead3eaddc8324eb

SHA256
37bb056d5449e36db7e6f14fcf845e95f4505fe4ae02f9308d6016c6164f289a

SHA512
a2749e463fd93d89796d1a68dd65e9565cf2d0e217bcdc64b9b15619b70f6fb8afa41194dbc2914b66383e4a96d58ca5a53e253583088f8ab32f9fbd30dbb032

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\bun.png

Filesize
2KB

MD5
fb7bc6d8a5821a222bb527db29c515ca

SHA1
8f34e65890e68d327588d940476848ac9a3b4cbc

SHA256
94926c0b46d518c15e158e7423f617e8730e69c74bcf95a0ff64908a21a2a9de

SHA512
1c3b6ca84fd125c0f4c9558e0d4f02cd4a5938c1a15fea65d79e87be6c2b7113c0af1f6536e6a6fee39a33a3e1b5c616ce88a6308268ada1b1a7a0cf5fe403d6

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview.png

Filesize
2KB

MD5
fc1fe384a473e6ce582764f0ab3d1949

SHA1
dae710b028e0651969cb4ddb8cd61e0462fd2ec3

SHA256
467b208d059ff4e700d5ae7c9907ec485d58d61ee1ad1ba668c5866e7840716f

SHA512
c8d36f29fb654cd1208d881ee42f2f39f54a097ca48d5fe5c91b61ad3b8e8467857921870a8835734a2e1a13137f27eedb24a42b03b14641ba4ed3497db5c7cf

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview2x.png

Filesize
4KB

MD5
18bf94d65b2e8d5a87a4d75f754fd7c2

SHA1
8e047fb4548625a6e1d928f919458713d44002cd

SHA256
468ab4450c3fefe16014809c1e5719fa259b683fca473c149ae28ddb172cfb1d

SHA512
483849b90796c006da25bf94f2393e8694e7a9baee6472b832a19695fd8221ea0e11e472162028275b5d17800c17bdd6b9e392fb1758ce650d8873f82d54c409

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small.png

Filesize
289B

MD5
06b7ce220d0da83e24d69446c3e10502

SHA1
ccb989c0b16c24d56720b884a160c1a8ba271c9d

SHA256
15ded2ea40e1181b77659d7fdd1e6c967723a71cc82ccc21cdb0e8916b31bf01

SHA512
472462779ea2bd317950693098a6fee8fdd87cfece8a2b787b5428819cec48e644023b6e1771b285e9270c47c32da11eb8a471f970c9c7d114f76eed589de17a

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small2x.png

Filesize
385B

MD5
33e1c492d5d7fe77e1467bcfb8df608c

SHA1
289626753929ed21a786205474919339e10ace31

SHA256
3ee481a2204a7963f030b460960fb4c76abdea78c29608be00fe02e69a7c2432

SHA512
a8f0786244497120ab4a7caddfbc8e3fc5ef190ce9f88d878de162c891bdec43b4e8004d804b5a06acd9dc49dbb4b7f97f6b4da40cf0440f49df324d07de5963

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\illustrations.png

Filesize
4KB

MD5
14999f3b188c34cb8463e7f4b6cdcbbd

SHA1
99e73b1a95374248985b57a02096e0074ec9f801

SHA256
2ace08fa86665ba5db3301b1dbe066b3fb99da7cb12d9899a69a7c0079bf54fe

SHA512
6e310844ebf0afa1dcfd408c3beb702937f9d513918aaf536b74772540183fce923a6b8f879316aec4f01301e57724c4b203eb0d6d7525cf6c0c23fb657a9d5b

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\nub.png

Filesize
1003B

MD5
89476f2cb2df0e171e1fec0ebfdc7227

SHA1
1a4244846c6a9fdc43c1192f645e98dc0927b579

SHA256
12e5a87237de1a373813a2202311d2c6c45d480cc036b8c75b563ec575960d00

SHA512
b2497f5368f569043bba37923174f6848bdfcb8a69152a42a3cfb224d8a610a4bc4e9a812efd2630c41a1dad0363e1d45038978eb46f27a5176e227cea6cd3f4

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\s_filter_18.svg

Filesize
804B

MD5
8f3ce7d4de02c283da817da39e4e5440

SHA1
792ab91ed8f89063765fe60ec20c2b2da8bf9345

SHA256
ca7b43f352c7c23eb338c3835fb773541a8483107aaae65baaddfb4c662a0434

SHA512
009300bc9a8d602793ffc5a4d57adf6b040a65f8c2a39db2f13d8d0288da83a3b544ed54036d5478b43ce49fcb2c5339be96c69c53c82e1f80137cffa2316cdd

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\s_listview_18.svg

Filesize
1KB

MD5
72dc6c5304341c49038c4126fba27937

SHA1
779c89619fcab338336cf800db6deb98bf7b43b9

SHA256
83e57935e60a0c0a08b6c3cba99b5577a8f25efa9155c096fc0179403c83408a

SHA512
a36eabfb4fcfb9e92bfd14a4c4b7ef48b6af764cb0035d0ebc5ae19a9bef1edb95e08c3594673e14d0f96377e41a988ab0e293631e86e0d28848888c27d7e7de

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\s_opencarat_18.svg

Filesize
850B

MD5
e57778fea91a95ec4a1e9195517ae2c5

SHA1
aefad6b12cf0adbf223fb1ce4247cb59dfe5e5ba

SHA256
e6c87efcda375481bf6cbf055daa1dd8ce15f8aed0d158aa90c806913255d6d2

SHA512
622fe16d2d028d094d4820c70e8d5da871f89a531bd09f6a198e9e20ae7674daed5c723c95ef638932803da61772cdd2c0ac5a6fcf1c1c29c3e96755defcf412

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\s_thumbnailview_18.svg

Filesize
1KB

MD5
096006617b257207e1383d0f40fcd077

SHA1
9dc4fb80c1bc0eb8ddfa16d2a9d96a97730128a2

SHA256
89915a8039ec37b9979c0fc6ac5378a02ab5578e86ff36f8114ac25830177a78

SHA512
90ce7dc295ad0414943af19576cb2b06ae240d755d4d8ac2a1ac08b15d093b9414ce56cabb0722e19ddce1f9f8a5e574a9523654b9b79e036aaded389b383e10

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons.png

Filesize
1KB

MD5
86c17567a3be9b7a88a5ab01d1d98d92

SHA1
4532f8c45e143c3dcbe71d7a9ba32c8611a70e36

SHA256
cdd263469c4e1cb0cf60619fb793353fc968f2a0147c2c73d2ccf0f2bb0f997b

SHA512
5ff24b5e53cc033dc799fea8a912d69d6f45dd18cb04123bf5a8ff9206ec9e6776c77665c60e0562de9b21d241696c4516d24da314937b59d499f65f25a85c6b

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons2x.png

Filesize
2KB

MD5
331941557fcc264e4bb6784097ef7afe

SHA1
3b5d272a7f56bbe6170545f8c8b62ecc60e92e34

SHA256
5702f0efaeb88067407cf948d2bb07d57ebe5894f0b58998a390884dceed5b03

SHA512
8887d9a8ffbd889108c9171c5cfc805e0640994a68ea76b14c0de6c67474ee03b6244dda56c7b3553938d4c8ee2930704629133a62d1362c966011c7324c27a3

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\root\ui-strings.js

Filesize
13KB

MD5
9bc11e16421de524ec7782951f62159d

SHA1
39091a7787d10398dbaae2872a606d0ad4eef93d

SHA256
ae6907682e0c737b261d9445aabf350df74b599ad1c38cdf7f03af0aa25bcef1

SHA512
b437c870747a57d98493333fd99f60c93800be0762834f1cce01b8be3b6333324b32e930669abfa556ed54e0d49f0188b8f12885fa997a14a40040dfdf9a6ba6

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adc_logo.png

Filesize
3KB

MD5
e0041c339496d8717fea836bbc254ec0

SHA1
b6479d56489fe4ac9d4e649f3f944be0cdcb196d

SHA256
41661ab29510a0a108f9216aba4297282401b58920fe02fdd4a3f25a04803897

SHA512
17439bb2c109fe8b4e49682ad45b32fff7aee3d6d3ac3bcd2f9262fe74291ea91477377d48dfd2e42249fcf8ae8550c74800a5c3094cfca517964e6685b9a785

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adobe_spinner.gif

Filesize
556B

MD5
4e036be6ef7712120f76ea86027fdc33

SHA1
250c5fa32b079ea4e75730e555822d5cef187a3f

SHA256
fdd6b9fb6f4c84a3f776fe60a1b81418e07a413834fe2637e3dc758567cd8a0d

SHA512
b86c305f20c77cb3402dbde5cee221b10d1016d794182ec4826524d052ce170bcca70dd3173ffefdbba17c46a0351c09aa540477386f025258f93cbeaed92681

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\logo_retina.png

Filesize
6KB

MD5
96015a8d2f1aed199de2fdfab138d1fb

SHA1
3000aade7df41c78ffa904f35c2c0515b4017fe9

SHA256
f8385c78a0294b1f15acba23add1cecea651be05c1ddbbc0d60ec35408958880

SHA512
fc98ab5010976be9628c4f5e01c63256134928b5f466a81db3ec87acc326918ff25c66d908dee6302d75a25a7be24ac5c01b2212116955fdaca1b1db0a2dffc2

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo.png

Filesize
826B

MD5
ae58625bfb3a9d88709e1e52a912d490

SHA1
8b24c4245c3bab8f47fae38bcb583466ac13189a

SHA256
f83889803012fc13d7c42b5076827f16846386656d7cc345c16e9f60dc8158dd

SHA512
bece4d1ed3ac4e617491e00c518303e13cf7d20cbd100e3a2ec0ce76cfa8db9992582702577a7b6225122a38b66d3c2e1efa4b9d278d9fb4bfbbdcd80d370f71

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\sat_logo_2x.png

Filesize
1KB

MD5
caff3241b3abd40e24552d92282632c0

SHA1
e4026af54ee4c7351e8aacbaf1be5948e7971ce4

SHA256
7b0e3093c5fcecd9e871564b878f0e2ebbb87915a56ee107d220c24e9963246e

SHA512
9e58d33dce14d7ad843667dda7acb946c011e30c4b2830ce58a1515c935745548db107fee888644f9521e6d279b130ef5576cd93f55de9e5593f74d90cc17d1c

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\en-gb\ui-strings.js

Filesize
10KB

MD5
e49d8564149ecb05b2e0e574d8148ca5

SHA1
ff4e02f410baf8a4e4f6c93d862435fc0214c236

SHA256
52ac402e1560cf8130497deddf5ea6c6d77f537965df613376c58ee17f1071dc

SHA512
09a3898a03d7216a5d9558e4281b9868f48bd7e972dc633e9b5b9159d48df81550936f9bb83c4ab1280d4ae949debf77c19f7ab6b6b23b3b2d9e6d2fbce7df9a

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\root\ui-strings.js

Filesize
13KB

MD5
4087c43325e8838a3fe07d1994c406b7

SHA1
9046c1f1a5b86f20ac13f4584b59123d38d6cb1e

SHA256
b54a6e9d5b04084b8a7c3ff03caf9b3fe935001ae3f70c953fc42a90dfb9f4db

SHA512
e691e50cbac92d93907825936bc5765a65328a9681efd730b7256e73b74c531eba631afe100273331995cd09a6dd69a1cbf5907ed7c1dea0c308719ee28d1221

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\es-es\ui-strings.js

Filesize
840B

MD5
60e8216f45928ba2981e0b48b346fa7c

SHA1
f754b0c6dfeb8908dfcc529cd933d155f382f966

SHA256
1d538182ac89d0086c7214332838151582bf96f175aab7125b6e485c5ba381e1

SHA512
9c2821d092617dac20bcbfa254c435d4a30ae9a70fc707ed4b89d50b527fe33ed3f1624bde6f3f94e67f04a86e1ea50a6dd93b16b13fcd74243cf161f849d7a9

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\root\ui-strings.js

Filesize
17KB

MD5
4a949e69c502f30a34ed82a784526e7b

SHA1
df40b88fa2bfeb3c0314c4d1da71437bea37810b

SHA256
16e4910c060eeed30d6ec664e9c264ac5e523d2975dfa614f8433d6dbbfc019b

SHA512
7882c70d209b95d6803ace5e575461b5c486605f12f9fa39ccdddb860e8b707bc881daf96fe7cc3b4a92e2d3a8dd589f58c50eb92221ad5078973de4fe2d82fa

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\ui-strings.js

Filesize
1KB

MD5
5d6a754808ddf20642855009270ab02b

SHA1
4828714de8b43b7373a0a7236d5ffa34cbe5f3dc

SHA256
711c2c1fd1c4d1cb8bdf6a4c481e1149e1bb58af425693c840f7f5f409a2b42e

SHA512
12824582580beb07790697d64e1196d53e8760157f1509ff36f5cb9ab2c7997320c60cc34909f5d7b23b8b9fedcab3fa8f730ae61f80f100fc62be133f006b50

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\he-il\ui-strings.js

Filesize
1KB

MD5
fc83cfe9a15e3a9a3ea3fc7d6bbca693

SHA1
79e26684a5d2107a04490213470a971ad7c165ec

SHA256
28641f9579d8a4f3085f282a803e1b9791a248ac77e9df96c7b56016aacf9f69

SHA512
b915d7b255e98faff78e2380af1ea7a8a0a48dc9559771984ec605402ac45cb22837705e15943413488fe448ebd0150269f801d766f9d807001a52c453812263

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\root\ui-strings.js

Filesize
2KB

MD5
8cc8349dddbd165c5ed14b75784b4c4f

SHA1
c67ae408d104c3d33685b2a9df4e183cfb33926c

SHA256
a792fdb60e5661d7d36bf9923f04796b3ffa0ed7b0b75e20f0c0d4367dba44be

SHA512
1541de599f3ba864a4dd57f4cc90a0e86035f25774727951c9ab03a18da64629535b2ef249bfd64ac0c2d1c6f69ca6154f6581c659a8e80f7cad7f5a38457b79

Download Submit
C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB_EURO.txt

Filesize
32KB

MD5
47b845ae852c87ad3c2e43d1ec2a7780

SHA1
060ad1399f0baddb183bd1010a62fbf36807f9cb

SHA256
023c6f461814fdbb577a129be8773a673a998892d62d9acd902723ffed3f4da1

SHA512
d21d6417eb31d59bfec8d46281e62e190211d7f0cd1dc458415ffda890fb3882c4993c765780b72c6139b63f0988661bd35b0ffdeda5f255bc4da2f870d6af1d

Download Submit
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Extensions\external_extensions.json.DATA

Filesize
99B

MD5
280ff1cdef297d9d33efdcc85e4dbd79

SHA1
44282cad33f1e5ce225372703f62aae5afeb8a6f

SHA256
1b915402ab7dd8d2dd2cac03fbb1cd1f179da81bb8dca721ec58d3aee81b880f

SHA512
58042f527042f1fa59af1e9865e7bc8cfcc2f581687ddf5f461bf113ebc39dc6a2528ce234233ca3ece12977c470da24bc023b0112f62860a890b2916309cb4c

Download Submit
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\vk_swiftshader_icd.json

Filesize
106B

MD5
d086297b43a74af05c359bfa8fe3d451

SHA1
db3c3623252483046f7945e92b1c8da18a85ef2e

SHA256
15f795cce862df425d1e2f3391711918bc65f1e1fc25c81f9ba14ed2f44e2fac

SHA512
6bfb82317251ab026ea8c6b9325f5d3b3a57afcf99f909a0575a7e6fe487bf27a4ca0934c141ee707640bb53fe93f102655b52080217bbcb032a78d26fbe11af

Download Submit
C:\Program Files\7-Zip\Lang\HOW TO DECRYPT FILES.txt

Filesize
912B

MD5
013bec5e46fa89fe1bbf74a07bea6538

SHA1
57a3ef5c078fdde65825804204bf421207792c8b

SHA256
39c2377ed429289e722dbcd80b09bcf1d12c060821e27a9d0af062988c39c31b

SHA512
816f4a36dc40ae3c6aa20fc0df0ab452bb28b46ec4a941ccfd878a28711efd4bc3b928ff77953b4bfe13e6adb99e556a8ede72e5ffbc85d73e5509ade159bcce

Download Submit
C:\Program Files\Java\jdk1.8.0_66\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif

Filesize
153B

MD5
839f40cdc706e0494de424a094da5466

SHA1
c22d93d1fe175a07b7d3e55f4754ffeb8d3bcee0

SHA256
6b58ac8adf36204530d64d2417c7737dea9c4f328c0caa3dfd93c3a7af8b0361

SHA512
8c43a87a848baff2f406e25b227c029d6245cf0299681cfa828e9abf4b84dc74c2110e3a786cf6b660300b6c6346669fe14f01c9ffdaf79b49872331b42329c1

Download Submit
C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html

Filesize
12KB

MD5
a4796466c506dccd40d3e70032a81bd9

SHA1
36c535aaa7f721a975bcbc4bc967f9fc4aeccfc7

SHA256
7620f619e21a011aece02f369fcd292869d135468db2fd39beb48650ed35bddc

SHA512
0ec6f17a822ff9651920cabac80e2f3d092225bd3e1713e9ca14d8fdf91e09634b8b5c0f1d2640c0bfbc356306cbb66436bcb76638cc5ce8b14b6fb6a435fb47

Download Submit
C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html

Filesize
8KB

MD5
0403bd21d8921d37f692ba2b5dee6f37

SHA1
6883a06a43ca2a63227b5fb30cfc18c4b98c4823

SHA256
a2630861db9b38456ad72c5a6885b36a7d1977677263210f12780fd428e88a99

SHA512
912cde21729fb7437d6b028b1e2c311bbccfe456dca7e0e00fa2f8598b7a6bc406c2a0dfea23191124cdac4ae8bc9c14273d4bf57ccadec1f06f14fab7707053

Download Submit
C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt

Filesize
11KB

MD5
7dc1b5bd1eb62b9e7d628b30f3c3606e

SHA1
77416d33887828362602e1b6e82ea3b1dc80af18

SHA256
57c0126d3a0464384d69f5b6379196353247aaf3ce28e9f856a5e151b313ac4d

SHA512
48ff39d207f79dd0a74799dee403385b104748f9a1cd6311ede923260ddd5f4862e98aae5352b3482f67267dae9e2f078d4f6a2e631927542c16116bca6da4de

Download Submit
C:\Program Files\Java\jre1.8.0_66\THIRDPARTYLICENSEREADME-JAVAFX.txt

Filesize
107KB

MD5
e40a42d0a6afbd8e3e598e3d4053cc03

SHA1
1f2187f8f525f93f6888aad9fcf44fd1023aa379

SHA256
5a54baffa95c95965c53b591b3172ffd06e091d076bf82e083e3678911fbd370

SHA512
0115416d05563d8faeaf7973b7ac5eeb46630a731974668e2a185993e1d03e584fc13eb9fd2c22444cac251a9351b8282a73dac0c8ef94c9726f07b5b9eab9d5

Download Submit
C:\Program Files\Java\jre1.8.0_66\THIRDPARTYLICENSEREADME.txt

Filesize
172KB

MD5
bbe53069642a94c0e0fcfd6294ce9daa

SHA1
8f2bae6afdd7ca681db84bbc90a9125c7bea782f

SHA256
0fe67dcf89bab314de9b89336b40f88c5c9880618bfb4cd1bb3857d4cea24316

SHA512
65741bbaf972259610c3343d9de64c6f840304a2ebabf3800b0dee233701c4ee1736225d8b445aecb4a7944bd9a4d61e296a9443f0fecf77db30136efb4e2f31

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Cartridges\msjet.xsl

Filesize
29KB

MD5
f924f7efc398c755a06eb8df8236ab32

SHA1
7f73cfd181d61073862ca624f98dfa62a39c831e

SHA256
9f1f216ec58db28fddf26bef8cce2fdb779d3fa862d24ba541e4fe523b745093

SHA512
c779862659fa80b4f7fc64d5709f0ee660fb0173232ca15e7ba725759a1e239b01e105b307174c4e1afb1136e34cd853bbe36b60e35173084f6fc7f5c5b44ef3

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Cartridges\sql2000.xsl

Filesize
34KB

MD5
5d343bfe62cc69d14d398fc90f733d8d

SHA1
182580b310f08799773951ceaa6be88f2201acc0

SHA256
949b45990238f6af2833344114a202b0b984d4a4c9168f05487da78b180fc0b5

SHA512
f977c1873bd9299ae62c37b293021bda6ff6408a637be04f0de8df600b1eabec5e32fcd307b090b400c638c15143063536f03479f805a1d97ad6f1356f9b8e6a

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Cartridges\sql70.xsl

Filesize
32KB

MD5
8a2c9a4936859095778caff1501bd536

SHA1
d03d6aeb440e39843aa164b536e69d9917c7e28c

SHA256
e014bd81e4c005dad7d1607d97619c9a3aee166ee9c31baa2673b37425d81f9b

SHA512
1fea5458e49696ed8c92354bd00828c88eb3d26998b4e1465950b03fcb14f094e4bdaac24e676bb94f6c0c9b4b9faa9aa54cbd1ebb5d72be80b475eac63de555

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Cartridges\Informix.xsl

Filesize
31KB

MD5
643df0eb5d1fa9cb83026526af3c299b

SHA1
3b4a9a170431875aaf586e69c4b195275fa3d121

SHA256
8b9adf14cf5e09789243caafed15de856c71f0602f59425f4f150805adf5fa7e

SHA512
a09d8d93e1dbd30e779e2bd7b17d98e5105e1adf4e096998fc88b5a6c08bf11358115f9323a9787e15fc0524693ef519a37ad37baa67ff22715c0bb8c036a872

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Cartridges\Sybase.xsl

Filesize
30KB

MD5
7c52cfb9f8e15d981ac1126eaad74b4f

SHA1
9a3aab5013cff045e3a3c3d114ca68524d488ba2

SHA256
c77f4a08c19c3975796f8d9828aff1a2c4af40be09e83f8717a75ba6c49654c3

SHA512
82c39a6d424f890b56bbb44be4684a02b81f827c78c17693bc90433e6a5f95d28110ee442946c5de36282a1e060a1f296788b6e9d96157f6dd0e26fb28eb2dc0

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Cartridges\hive.xsl

Filesize
79KB

MD5
b8b3e29b821657c7f257149a1af124f1

SHA1
bbaaac054130c53b48b8baedb925badeb4083450

SHA256
7a7d0fc1334b65ba0c7801b03465495d838967e0007a8be5f43e40475ae296e8

SHA512
050a77022be578cf4a003c8d3ce2f9561f7d1c5a72596ffaf250a9e81b25ffcb9be1b063630a629310c9b640bb00374b0c4099e4ff16ed2724db64d510432148

Download Submit
C:\ProgramData\Microsoft\Network\Downloader\edbtmp.log

Filesize
1.2MB

MD5
d0fef49c9d1e77131f227a29f9a83254

SHA1
e1ee10d4c63dda27d7e655ff0df996345f685420

SHA256
fd8c645805a4cc2e15e01735247b26f7fcb0c144393ef6545b24f40d024f582c

SHA512
c02f59ca55524a3a0b9b4049613c8a358af734eb460eb88e275ca008a2cf88f136ebad16881a2a39715a6da95aa0fb3f3cdafb9406c3cce441f6363f2e33a839

Download Submit
C:\ProgramData\Package Cache\{662A0088-6FCD-45DD-9EA7-68674058AED5}v14.30.30704\packages\vcRuntimeMinimum_amd64\vc_runtimeMinimum_x64.msi

Filesize
180KB

MD5
6f1a616efbc9b5370d3a7ee82befeab1

SHA1
c3c263667db275b364bd4c456d79da730fec0a83

SHA256
d602d8c64733bb72c269e03e1baef06f321ec09196cd0a4b2790f680c6db3caf

SHA512
4d56ad3f03b0814fdb1c8a7ff333cc4dbab094c1cb2c6ce455140e33a49052a07c19cf70ec4d0e4828b4e743ccf2490683dc71f76b9c71e099947981eb3606e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini

Filesize
174B

MD5
de8febbcd745abbb80522af4d09bc0a8

SHA1
5d02ea9f56cff9704d242b6c828d96f3bd574bd8

SHA256
ff024d348b2ebc65ba5bbbad8d059967eb13e8ed5a88b649b26714037c179af3

SHA512
ff80fc7d581870fda4b50489270989311eb8c8365f66b7c32e2c1b65b0c86d67c27b38f4bbd68cf8ac15e9a99235a47eb8dfa20a967b8d2174953c1a4604debe

Download Submit
C:\Users\Admin\AppData\Local\Packages\E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy\Settings\settings.dat

Filesize
8KB

MD5
a914a2b5d27083a073867c4b8a45a7fe

SHA1
3c07abaa992b288251a9d2f5f860dcc991102d72

SHA256
0172b5340763e42ebcef06ef0500bc932180d4a29a66821fa1c079893df5acd5

SHA512
eba8a74e9d3431f0a05b8a0d720b7ebd1e2f7938c8952cf2bfe2d05f6157b8a7be4af9119debe25bb67ada7b67abf5c8b5498f05e1c7238846543a99a686c068

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133214215653092147.txt

Filesize
77KB

MD5
fb5b88c924513c84994a2aa51785aa15

SHA1
6b159ec8deb1f3b8c07f2342193a476a6d51b5cd

SHA256
890ecd88aadb4afaab05779994ae8740ed1b26f2aa2bfa6f96a1df8e579b941c

SHA512
15b76520562536aede433e58f735a003277a40679e2c9bc5ab5754b284408f5f61c671068ecc34498dedbd9be693108e4df9b265b38df5699191458a42507acb

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133214216040892883.txt

Filesize
48KB

MD5
854aee85bcded0eae87c664d9f0d6189

SHA1
991108cdc226e8ac82d79d29d1e5de7b39712edd

SHA256
32e5da28e377538487cb47180d24c82a37a5500a5d0f1f61dd6132d34801d758

SHA512
097cfc9d0a34728ed5b6d96fffb0dd50fc960860a2a5583d1481edda25af52ff424a7fae1bf7b0d20c7d56ab30ea9ad98572392e221ffa799862b59eaf7f4021

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133214223386940456.txt

Filesize
64KB

MD5
103033afc2c398770e7fb71b10ee96db

SHA1
c249723af32002a5e19e0f43592edda02c0d318c

SHA256
e5eb7284ee0b3f85d918860ca34b14d31b5e52203e06d517ea5020c1f0712fff

SHA512
d5eb701e0bac439b29b24c1cc214dab46504dc042f97783316f68161481bcac8943321d102d9e59140ce2ad66e08e87d675aee3ff1556515efcb19f45152fbac

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133214227220684585.txt

Filesize
75KB

MD5
7ace2f457d9eb1b48af21fa1a4b56341

SHA1
4e489d3e3c5269edb687c91b3e6b653997e941dd

SHA256
1744739e0678d4626d0fa8d55651cbba1f9cd79dddae2ae39f664a63d1c1d01d

SHA512
b500b8f3bd48557aa78d42eb617350f053d3483469d5f152bd474b8d3679ebcf40d7559fa952f74c24777fe049fee4eacfed8bd292ba78e92cc7248a421dbe61

Download Submit
C:\Users\Admin\AppData\Local\Temp\wct75FC.tmp

Filesize
63KB

MD5
29e9e5e25587df938addb45894543d0a

SHA1
4968029b7cdab3a08177927fdc11281be4f92c07

SHA256
c24270e3085c9f0f058f3d1cc5c6f49887e6665a32dcf4e1e3ceaf3c3d530654

SHA512
f8a198c4e6b4b29c57dc4c34058808fede5eed4527d541816f5a07a8acaf4e6b00c1fe05377abb39c0202f85b9ba32d1849af69639b81755ecc51474283687b7

Download Submit
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini

Filesize
170B

MD5
d8eb7493e87afd6851fa97898d62eba2

SHA1
62a16aef8b04c440e2f050a68f86b657e01ac5d9

SHA256
8633dd2dbcf19853a7bc7e7c49adbdbdd0cf383543a8a8561490bd2fc9f3a502

SHA512
7de2e1786e2c94a46f1360d23c95785ad1ed0dfa0e9156c660cb4f68f0dc724363f24e294e8fe73a6446f1911b6bded6721f489136a23291031f3fc961017b8d

Download Submit
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\File Explorer.lnk

Filesize
407B

MD5
748370f64c7c99b5cdb6dc985a8e95b0

SHA1
3f4d3620152475be0d9dc55b25a123b6edc3c1de

SHA256
dbba115fbd5e0282484d666de665582bc6b7b656361dfb37b1adfc7ea9c89320

SHA512
a48ffefd8032534d7b3b585e53a90dc553670fef48eed8d0d0289919dab25629acb15bdf666ffae3d175cad61104cbe39530ec1e50f71abb143de2c9d2b88c98

Download Submit
C:\Windows\INF\PERFLIB\0409\perfc.dat

Filesize
32KB

MD5
bda0379e03948acf8f9146b61ca252cd

SHA1
a004570ac79981dc85eba072e22e97f4cfcdefc5

SHA256
03cdf108ce04c7435c60dcfb7e19d1cd2822711cb0be51ccb04e1e12360c3c85

SHA512
fbd76e44e44c415bab81d97601a648e2c5d1609ffcf12279d270e6aee25f062f80a577892a05298bc90e47f88209fe21da8d1ee465e2abd3934622d099772653

Download Submit
C:\Windows\INF\PERFLIB\0409\perfh.dat

Filesize
290KB

MD5
7a17a0aeb9ba73d51ea58c68aade0eab

SHA1
cede908c7c4bd870bc29f27672610782fdba7418

SHA256
a7783b26e31d59e68a4165c700bb4828658f38f690ed828f57bfe1af3458ee01

SHA512
a836d2f976a9e073877e9816023814cc6b5bed64d98a30f175e591972430faaf333c2120b6ff9fe038e47aca684b3b79fcd8862553c95124be8e8cdd40b59691

Download Submit
C:\Windows\Installer\6879.msi

Filesize
180KB

MD5
c4628406868fbbed58639c19a7bdc577

SHA1
1a6113e34d230af7e8dee91c986aae345592858b

SHA256
1e3cc022ed297f39bb553ee0b9023d0c36aa4731e616ec5c3ccb4c88c6f4b97c

SHA512
ce2f159e8acafd4025039030bace6972f742b449be2ae49ac887e53114e359dc8777abc4bc8fcadf368df51e1d3777ff583f6d9bdf6a1b93fab1167351cba1e5

Download Submit
C:\Windows\Installer\e247.msi

Filesize
748KB

MD5
1a8625a9f3f50bfc5840422b596d2a10

SHA1
a064879ece74acbbb7ab5d4cac76734f07d30cb4

SHA256
31c2125ce4c08b6cd81112f0262b3471bc74613be3150afa71db2c6b3973efe1

SHA512
943258cf48e685643848ba40330891aae6a6a0c47468b721e9964274a94f386d016a4ea5f64a318784cf766eaebc0a20ad6eb71319dd826e4e6f8f9e757f3e6a

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\AppConfig\CreateAppSetting.aspx

Filesize
3KB

MD5
85f8a48019e73ed0984f6706271fc3a6

SHA1
0f2f04defeae86994a0510e8bcbcf43e83ff64e8

SHA256
38398e93fa8b5c5bda1df47af72a09a71b1522631d3c3d62ce59a01c7d106a19

SHA512
0e30e6912b7a539fdc083dd01726429c86cea7098908f2134b78101577245e1226fec5ca1415a6ebc5664aebe82efb1afad1f8541433f8595d18684f0bafbb6a

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\AppConfig\EditAppSetting.aspx

Filesize
2KB

MD5
faba70f49c00909b646121c765f56156

SHA1
f8500a715fbbcab2d0c3ed779a7ffc3bf4a421c6

SHA256
0b4a25791ff7ffecd3edcccccab8969c32ccc1b3a60ac51db6c7dad8bb1fa64d

SHA512
84d8224b16256f77fa2378713b5c9b4907d8b5746cb2806e310b4de5c6fc866de48a85f235c39febcf8206c3d4a8ba21fb782e46a8cc9d6832828b03000f4254

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\AppConfig\ManageAppSettings.aspx

Filesize
14KB

MD5
970f44796040528c75d8794ef9f5bbc4

SHA1
3ec14aa2f3b553c02098a640eb049f48c7bbd629

SHA256
0eee3e3dd3b70251d09c9d4bd14d28fba05774ca66f5fd223bc6e2cb294b417c

SHA512
bd7b73fb5e70aa7e97371c1d8f0f09ab3cc5c4f6d158a26a16727f29b3bd0cfe90a9db10c96a0e0feefbd5aad2a1861ed3c22473aa944b7e0cb4661ddc83ba30

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\App_Data\GroupedProviders.xml

Filesize
317B

MD5
014b9c633de76d98ef18f9803a31935a

SHA1
f1fb426d48c820a3b3d21c3b222a95e35cd0b96b

SHA256
445b9849655a69586c0f7ae557ab5cb4cd0f11fff904b05d19e9074415ba80c9

SHA512
a558152b48ec285f2662661a544ec524ec1a1fe3a0a6be696aac36c6caf9e1586564574f9f82732a82af2f2b90e3a10e070a8d9fc993870c4438f0d528e0bdf5

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg

Filesize
21KB

MD5
1119ca5a5add416c6312fcee2a9f239b

SHA1
4f7ae46382863ca1b65b7bd1f8af8911c27e362c

SHA256
2421b7126fe133d4fe20569e56c3f8b0bc1202e31566cbd74a9449138660e37b

SHA512
423288283fa5b7ac55e67c56335d9a0e0a0a9b504957dc97942b7183927ced38989211318b505c5c12ef6bc198a8b74e9fb218e1af938ff832f6e054ad5fca71

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\HelpIcon_solid.gif

Filesize
1KB

MD5
34dc724a155610e53a814c9d1084e3be

SHA1
8c127179d52c540a3fbf02dd84654d59faaaa0f3

SHA256
77c8a9f2acb3496d93f0a1850c11fa2295b3d7e6b696b63665d19792514cd943

SHA512
d3870f55f2352dfc417d1a570c9f562e7ee7929e6af0a700fc8f96ce3d312550e35edf8863b4f206fe56dd382d4e47fa885b630827f207bdc77675c9b63bd6ed

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\alert_lrg.gif

Filesize
952B

MD5
826557e0859fbf551484f1b8c43308a9

SHA1
d953e4f659e2a6d1526f74df8dc88fddb6b6844d

SHA256
79ab316c57709367d6440677175aedde935c6cd1913766c10df85c04f561a8f4

SHA512
01fdb92df39f68cf784308d35bad0905cb4d74e316be9310ddb93cba13fcd2d167176392c98497b7d4f4414565168771fe77202929abcf001e2abe38770e6dae

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\aspx_file.gif

Filesize
121B

MD5
e944be4de9a1aae443e84f1b1a0919ec

SHA1
2099759abc0cea6642242da85ea610c3b3f9c636

SHA256
c4fe15b95fd047660abf36d4edd91a4d356589e32d055b9ba290e414aeefe40c

SHA512
dff411b474f3745511130b12c2deb8f84b9bf7b5712c6fcc912a61fb9e2d3573ef28b550fcc71f65f8d255320a44a60ff187ac08cc339bfdffd07f6fce436a9e

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\branding_Full2.gif

Filesize
1KB

MD5
551d27ae0b8b44220e7dd44d91215c3d

SHA1
5342312789866f82d4c9b31926f3267e47b0d332

SHA256
89ccb1424c474fabc33313c0d6e884fed64be6693c5effc626416e487d9cfd26

SHA512
446808a60bfb415a9368bc80473a040bd4362ec87a98264c69ded454c16ef3ea97293bd8ab4ce20dd48e9ed994cdfd04ff1bd4f5c4ad4741bad56e332bb1a658

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg

Filesize
8KB

MD5
735132ae250d3eccfd592b44d75649dd

SHA1
8462824c29f0e52794bfd973a87725ee01bcc2b6

SHA256
4b757bc81108fe24e5d6ad7514b1dd4a6cc45446fd01879f139f4771705450bc

SHA512
e2cf2859d6935a17e60a9646625ddf67e99303ac996c0cf25281b6a7d49fbfcb3e1b514de293ce1c9e516f0645f8d0e86491b562b66b2fb15d7a99404608be3e

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\folder.gif

Filesize
914B

MD5
89b7257928a330a602b6bed0c54b4611

SHA1
d551bcb7ed0cbd3b209bc570ff74a5d128905942

SHA256
23e6fe264c318a2fa8c952264f89e36c20bb868b3205dcc9653af47528ddc2cc

SHA512
e73ea9ba3810ff5874a133ca67420a4bfb1ded9dd65d687015a3ccc3803d248bdec7bed385cc4d110d2fb4ed86b313c9d928ad9c9d752eef80878e38be9edc44

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\gradient_onBlue.gif

Filesize
90B

MD5
e8a5e7301c1d14b416649a3c962e0d1b

SHA1
57e3ca017c3f42fc95353fe55e38eb4d55eb706c

SHA256
c976229f2884354e2776b9277b71327c3b6a82714cc7e72c5a027fed83ee1181

SHA512
b90568fccf1dbecdc2cee5caeb0c643833b69ea596832ae0bdc70edaec87a8c59bfd6d147eb110b7530f904c29aae8ab1558947e1af4bf786c0cd24ccb255364

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\gradient_onWhite.gif

Filesize
90B

MD5
db936aa0b343e6e9f8a815b65af76b32

SHA1
02be7fbfc37f6b62cf7013bb0e90dc36f5dcc3f2

SHA256
216d8058a53dca8532d1b747e66787e8b684d7acbcdb4106f0dd13f697c1709b

SHA512
d1e5b92fddfa5842d8ec4b0504ed088e7f61afc15d80dc4f4d969056c6d76a0629c4e8eeeb3e036c389334144d42d511208e485ec5a4745be0c181cbe0901501

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\headerGRADIENT_Tall.gif

Filesize
328B

MD5
10666cd0e1b62c3734bac9c5f602e8f6

SHA1
d0a8ad65c3718d8b0cd4c699b8ca090072a747ad

SHA256
34170c0ebeafa4161697f9dc824eeff85693c7f976d342e3525e23e3896f3247

SHA512
86a435db00ce285943239cb6449f6960311f256da422679ebcc10d14d0393b3c0f17961fcc8e1ddb5f4ec996a469840c306b55a3d60e1aec70412b8d04dbb004

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\help.jpg

Filesize
1KB

MD5
cab6d38117ba271d6b8d3cdc52d7536c

SHA1
9ffb889a0ee5e0f6425be7e136407c228cd55ebc

SHA256
2a3f8ed5d56ac50940cdb34aeaf36443ef1bd00dbb58f7f4c17412cd90659343

SHA512
9cc9e82ed722e15617f9a67b21d341b26a7b16bb45be6cc20018aa3a6aeac0f161e0253d9e6586e3f5cb1218ec907dbe20b86ef001cf100ad88d8a09ddab32bd

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\image1.gif

Filesize
162B

MD5
abc773a7aab41d6707d00a7c6b204bd7

SHA1
0e183125bd51ce71c5a04e029a52cf2a9fcb3cb9

SHA256
6221cddcbad96189b9dbf64fa677ff199f344efd4bd79bb66664d12e08c373b5

SHA512
f86e5002fc2d88ef8659000c94b377adc088162b61d0e46aa0dcb7903198cc43214b276fca7a5cb97542a146bca4a2c7adaf65fa727abbc4b6e2ed4542cb07fc

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\image2.gif

Filesize
586B

MD5
90f0c1264c05c5ca140912c90fbd1ba7

SHA1
811c98781d50caee118e3b243607a1736c6e855d

SHA256
2f5b60e8a62fcb2ebb219272a188447994408b4296fa84aa7976b1b1b355735b

SHA512
13d6e43bba72eb41c9dbe6e9f115b9f56607b139baf52c597c4fc340da4cd0d95d907c161419d66ad0b88e9746953c1cf1e9e7ebcdd8b3a20a73671151bbef5e

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\requiredBang.gif

Filesize
124B

MD5
c39b597b7965ca5adde28e4e2ea74621

SHA1
ed08e44f644bacbf4bf1559212f76583c4bdb7f1

SHA256
c41bf691353a1cbe376f360e46d6d47b29d8e0832c393fe2b34db6aa66905807

SHA512
5be4f138fe62d43db1bb508e7072068feec585e0aab62b9b926576a51ac37a8b5424ca635cddbc27554b1b9fd31648400cb94c49ebba9ab419d6dab54d997d0c

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg

Filesize
8KB

MD5
7426bf82cb5db04e2ed2a872da4c2429

SHA1
1317935e5bd9258e60615b337a81cacf00f42a10

SHA256
a14cd5cabdd358949bb097b1ccefdbe1df8b425170c9e85c04ad6479b4501ee2

SHA512
19d915485ca84f459c1c15aafd873c2972aa2cf616d99cc57c218af91e65eb48c5c2068bffcddd7f32abbb8ea1cfedf68e46589e1b862fce49eb968c3bc28c3b

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\default.aspx

Filesize
4KB

MD5
bc304329f014f4597c6765a5b1e50761

SHA1
cc32aca4a49c7f3ec91bca2a2d2ccf1636dcb82f

SHA256
f608162505903651b366579eba5f8fa39f185b19993bfb870c2ab104ebeb13da

SHA512
86c9a4549410eb13490d00ad6e917d0cca60ea9d9dbe837de96e8729e5c9a81715c7c59a1ea20b40f13f0c7d1e405755f95c33e74e7fd54dd6223244cf80f081

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\error.aspx

Filesize
6KB

MD5
f8ae2d54dc4e85e96f138de4339948c4

SHA1
b98951d72224d717e606e8272830dbaeb0cbee19

SHA256
257c18be3327d29d7156bfecf700489e96d6d865720cc273b165b4fb39183b19

SHA512
e46afa6a9d343f9e26a4faf33497c159d84162432a1faba3beed5f29849c4c150cc02badd89269b63eb6d04e417ea6756d9c76388e1324fe5606de2fa9c4403e

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\home0.aspx

Filesize
1KB

MD5
177f3151c32a04dac1aa4714b025cb6c

SHA1
be697d388c3b15992f48266cffd43896e948812e

SHA256
0cc1a63b8a33a1f0834a2c5264cf1135bfd7b809e8d569d378c1f37fc3fd9b81

SHA512
bd2fc910e61ddc65a123c892c929c68b6ae3306c4ec92ef273126db10be32b6d3db922d25f53ed961cec8146e73849824764c95c4670a3cd0d42408353965668

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\home1.aspx

Filesize
740B

MD5
b5bad5747cf8fc42f97563523aae12a2

SHA1
b0a511a83ef13bc1563a7db157eaadcfd78ab86a

SHA256
fd06c51a14d924496e7f27a6a8abbf47fd12819560258daf0f50a410b08d02b1

SHA512
7e9f7fe4092535ec70c3a1120067f6692f8444544481822f15e6e142a3528e0d8df006b6b978b0d851dd0d9313a82b2d8fc007d2e9053e635e76fd0d6171d20c

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\home2.aspx

Filesize
1KB

MD5
6d2e7d502b81d2083d8a5d13ada8eab3

SHA1
fb6554a71c3e8248bd638a7196663b1778aa0242

SHA256
6312f292e2b16db0b9895203fd0056909d1d26af003d7f54c9f80a97227eb729

SHA512
52ff9a6b473740ce15b1b493b9ca3e1ef231d33b495de83fb591e3e198f832a3026e755da53ff89d407dc217e68bd36bde5d299b616e78abe4e297b3fd79b812

Download Submit
C:\Windows\Microsoft.NET\Framework\v3.5\SQL\fr\DropSqlPersistenceProviderLogic.sql

Filesize
2KB

MD5
4f541b95e9c89528b8cbb6a5fe4ea299

SHA1
1a8893f1172b304d24c4f479c414d850fd6db57a

SHA256
302a0b8f76b191e28cd89b164b9edc90d4bd7a120f546a2c05bad7097a8f23fb

SHA512
d65bf298585974bbba8e312cdff03624d052c8e0baac9b4a46f0bc2a81885b80531e1725b3921169c530ec6370611585ff6f1f0bb5660b5cb483ff9e448f016c

Download Submit
C:\Windows\Microsoft.NET\Framework\v3.5\SQL\fr\SqlPersistenceProviderLogic.sql

Filesize
13KB

MD5
1ef66e3351377483e4531b86bfd608da

SHA1
5c29bca05af5ceb0d6d1b855a5efdb3be6f35455

SHA256
3f2ba65c279e946a72fe8f7150023af4fb8f7c02ed0fb365c7b81d0d53af0f34

SHA512
146e5a05b466836c500e8dd7d85fcdb356f6cc3ec7d772d6bac64fdf3986ba299157358e3edad7a20e0829f124127da5581a0308e90b4dd4efa999672f685ef5

Download Submit
memory/4924-12301-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/4924-6058-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/4924-16209-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/4924-15141-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/4924-13145-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/4924-19115-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/4924-7067-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/4924-17615-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/4924-6057-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/4924-5991-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/4924-4298-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/4924-3064-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/4924-9901-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/4924-1773-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/4924-1768-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/4924-249-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads