Malware Analysis Report

2024-11-16 12:15

Sample ID 230601-l5tsyseb2s
Target svchost.exe
SHA256 736a83eea1a6f524b085cf1647ee5c26dd6749e6546749f951ca268c0e88f0ac
Tags
neshta phobos evasion persistence ransomware spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

736a83eea1a6f524b085cf1647ee5c26dd6749e6546749f951ca268c0e88f0ac

Threat Level: Known bad

The file svchost.exe was found to be: Known bad.

Malicious Activity Summary

neshta phobos evasion persistence ransomware spyware stealer

Neshta

Detect Neshta payload

Neshta family

Phobos

Deletes shadow copies

Modifies boot configuration data using bcdedit

Renames multiple (369) files with added filename extension

Modifies Windows Firewall

Deletes backup catalog

Executes dropped EXE

Reads user/profile data of web browsers

Drops startup file

Checks computer location settings

Modifies system executable filetype association

Drops desktop.ini file(s)

Adds Run key to start application

Drops file in Windows directory

Drops file in Program Files directory

Unsigned PE

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Uses Volume Shadow Copy service COM API

Suspicious use of SetWindowsHookEx

Modifies registry class

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious behavior: EnumeratesProcesses

Interacts with shadow copies

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Modifies data under HKEY_USERS

Opens file in notepad (likely ransom note)

Checks SCSI registry key(s)

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-06-01 10:07

Signatures

Detect Neshta payload

Description Indicator Process Target
N/A N/A N/A N/A

Neshta family

neshta

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-06-01 10:07

Reported

2023-06-01 10:12

Platform

win10v2004-20230221-en

Max time kernel

262s

Max time network

266s

Command Line

"C:\Users\Admin\AppData\Local\Temp\svchost.exe"

Signatures

Detect Neshta payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Neshta

persistence spyware neshta

Phobos

ransomware phobos

Deletes shadow copies

ransomware

Modifies boot configuration data using bcdedit

ransomware evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A

Renames multiple (369) files with added filename extension

ransomware

Deletes backup catalog

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\wbadmin.exe N/A

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\netsh.exe N/A
N/A N/A C:\Windows\system32\netsh.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A

Drops startup file

Description Indicator Process Target
File created \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\svchost.exe C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
N/A N/A C:\Windows\svchost.com N/A

Modifies system executable filetype association

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Local\\svchost.exe" C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Local\\svchost.exe" C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\$Recycle.Bin\S-1-5-21-2805025096-2326403612-4231045514-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
File opened for modification C:\Program Files\desktop.ini C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-72_altform-unplated_contrast-black.png C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Trial-ppd.xrm-ms.id[74C44676-2815].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\SkypeForBusinessBasic2019_eula.txt.id[74C44676-2815].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageLargeTile.scale-125_contrast-black.png C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxSignature.p7x C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNotePageSmallTile.scale-150.png C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\x86\msvpxenc.dll C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.contrast-white_targetsize-64.png C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
File created C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\Microsoft.PackageManagement.CoreProviders.dll.id[74C44676-2815].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\da-dk\ui-strings.js C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Wide310x150Logo.scale-125.png C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\az-Latn-AZ\View3d\3DViewerProductDescription-universal.xml C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\images\FileVisio32x32.png C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\en-us\onenote_whatsnew.xml C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Accessibility.api.id[74C44676-2815].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\da-dk\ui-strings.js.id[74C44676-2815].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailAppList.targetsize-80_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-attach_ja.jar C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\flavormap.properties C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
File opened for modification C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ECHO\THMBNAIL.PNG.id[74C44676-2815].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_2019.19071.12548.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxBlockMap.xml C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\WorldClockLargeTile.contrast-black_scale-125.png C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\AppxMetadata\CodeIntegrity.cat C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\offsymxb.ttf C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\RTL\contrast-white\SmallTile.scale-100.png C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.scale-200_contrast-white.png C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\themes\dark\rhp_world_icon_hover.png.id[74C44676-2815].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\images\example_icons.png C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\root\ui-strings.js.id[74C44676-2815].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\hi.pak.id[74C44676-2815].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\MANIFEST.MF.id[74C44676-2815].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.VisualStudio.OLE.Interop.dll.id[74C44676-2815].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\Fonts\private\ANTQUAB.TTF.id[74C44676-2815].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\Fonts\private\CalibriL.ttf.id[74C44676-2815].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\AppPackageWideTile.scale-100_contrast-black.png C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_empty_state.svg C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\AppxMetadata\CodeIntegrity.cat C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-modules-print.xml.id[74C44676-2815].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_MAK-pl.xrm-ms C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Spatial.NetFX35.dll C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.scale-100.png C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
File created C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\Workflow.Targets.id[74C44676-2815].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\plugins\text_renderer\libfreetype_plugin.dll.id[74C44676-2815].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-256_altform-unplated_contrast-white.png C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019MSDNR_Retail-pl.xrm-ms.id[74C44676-2815].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2018.826.98.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.scale-200.png C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageAppList.targetsize-80_altform-unplated_contrast-white.png C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Sticker_DogNose.png C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-convert-l1-1-0.dll.id[74C44676-2815].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\appletviewer.exe C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\api-ms-win-crt-string-l1-1-0.dll.id[74C44676-2815].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsAppList.scale-125.png C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\main.css C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-localization-l1-2-0.dll.id[74C44676-2815].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\jrunscript.exe C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
File created C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp2-ul-phn.xrm-ms.id[74C44676-2815].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\Fonts\private\GOTHICI.TTF C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\ExchangeWideTile.scale-400.png C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
File created C:\Program Files\Java\jre1.8.0_66\lib\hijrah-config-umalqura.properties.id[74C44676-2815].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Retail-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\BHOINTL.DLL.id[74C44676-2815].[[email protected]].faust C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteNewNoteWideTile.scale-125.png C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\osf\miniinfoblue_16x16x32.png C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\svchost.com C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A
File opened for modification C:\Windows\directx.sys C:\Windows\svchost.com N/A
File opened for modification C:\Windows\svchost.com C:\Windows\svchost.com N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\SysWOW64\taskmgr.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\SysWOW64\taskmgr.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\SysWOW64\taskmgr.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 C:\Windows\System32\vds.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\System32\vds.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 C:\Windows\System32\vds.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName C:\Windows\System32\vds.exe N/A

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\vssadmin.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "241" C:\Windows\system32\LogonUI.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" C:\Windows\system32\LogonUI.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent C:\Windows\system32\LogonUI.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 C:\Windows\system32\LogonUI.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" C:\Windows\system32\LogonUI.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" C:\Windows\system32\LogonUI.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" C:\Users\Admin\AppData\Local\Temp\svchost.exe N/A

Opens file in notepad (likely ransom note)

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\NOTEPAD.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\wbengine.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskmgr.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\taskmgr.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\SysWOW64\taskmgr.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\SysWOW64\taskmgr.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\SysWOW64\taskmgr.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\LogonUI.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4456 wrote to memory of 4640 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe
PID 4456 wrote to memory of 4640 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe
PID 4456 wrote to memory of 4640 N/A C:\Users\Admin\AppData\Local\Temp\svchost.exe C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe
PID 4640 wrote to memory of 100 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe C:\Windows\system32\cmd.exe
PID 4640 wrote to memory of 100 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe C:\Windows\system32\cmd.exe
PID 4640 wrote to memory of 3572 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe C:\Windows\system32\cmd.exe
PID 4640 wrote to memory of 3572 N/A C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe C:\Windows\system32\cmd.exe
PID 3572 wrote to memory of 1620 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 3572 wrote to memory of 1620 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\vssadmin.exe
PID 100 wrote to memory of 1880 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 100 wrote to memory of 1880 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 3572 wrote to memory of 4852 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 3572 wrote to memory of 4852 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 4668 wrote to memory of 1664 N/A C:\Windows\svchost.com C:\Windows\SysWOW64\taskmgr.exe
PID 4668 wrote to memory of 1664 N/A C:\Windows\svchost.com C:\Windows\SysWOW64\taskmgr.exe
PID 4668 wrote to memory of 1664 N/A C:\Windows\svchost.com C:\Windows\SysWOW64\taskmgr.exe
PID 3572 wrote to memory of 4452 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 3572 wrote to memory of 4452 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 100 wrote to memory of 2040 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 100 wrote to memory of 2040 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\netsh.exe
PID 3572 wrote to memory of 2300 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 3572 wrote to memory of 2300 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\bcdedit.exe
PID 3572 wrote to memory of 1436 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe
PID 3572 wrote to memory of 1436 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wbadmin.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\svchost.exe

"C:\Users\Admin\AppData\Local\Temp\svchost.exe"

C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe

"C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe"

C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe

"C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\cmd.exe

"C:\Windows\system32\cmd.exe"

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\system32\netsh.exe

netsh advfirewall set currentprofile state off

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\System32\Wbem\WMIC.exe

wmic shadowcopy delete

C:\Windows\svchost.com

"C:\Windows\svchost.com" "C:\Windows\system32\taskmgr.exe" /4

C:\Windows\SysWOW64\taskmgr.exe

C:\Windows\system32\taskmgr.exe /4

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\netsh.exe

netsh firewall set opmode mode=disable

C:\Windows\system32\bcdedit.exe

bcdedit /set {default} recoveryenabled no

C:\Windows\system32\wbadmin.exe

wbadmin delete catalog -quiet

C:\Windows\system32\wbengine.exe

"C:\Windows\system32\wbengine.exe"

C:\Windows\System32\vds.exe

C:\Windows\System32\vds.exe

C:\Windows\System32\vdsldr.exe

C:\Windows\System32\vdsldr.exe -Embedding

C:\Windows\system32\NOTEPAD.EXE

"C:\Windows\system32\NOTEPAD.EXE" C:\vcredist2013_x64_000_vcRuntimeMinimum_x64.log

C:\Windows\system32\LogonUI.exe

"LogonUI.exe" /flags:0x4 /state0:0xa39be055 /state1:0x41c64e6d

Network

Country Destination Domain Proto
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 123.108.74.40.in-addr.arpa udp
US 8.8.8.8:53 76.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 40.125.122.176:443 tcp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 20.189.173.3:443 tcp
US 209.197.3.8:80 tcp
US 8.8.8.8:53 63.13.109.52.in-addr.arpa udp
US 40.125.122.176:443 tcp
US 209.197.3.8:80 tcp
US 40.125.122.176:443 tcp
NL 173.223.113.164:443 tcp
NL 173.223.113.131:80 tcp
US 204.79.197.203:80 api.msn.com tcp
US 40.125.122.176:443 tcp
US 40.125.122.176:443 tcp
US 40.125.122.176:443 tcp
US 40.125.122.176:443 tcp
US 40.125.122.176:443 tcp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 40.125.122.176:443 tcp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 2.36.159.162.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 131.72.42.20.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe

MD5 1400ba6aa93453aa7baf571b2d5656ac
SHA1 8e4d58740aaaa6d3f6e27a43a73f13bddeb82fca
SHA256 e801f23788dd60882d6851ddaf17dd2539adee36cc4c26bf62896f21a869e942
SHA512 ba016973a1306ca6dabd83a3f78c7864d219a204c7f7bc4a92817393efd271f6c0efc3783236d23270bd83d193294a13a46fc8bdb95e043b8e2a6a9bff0a4145

C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe

MD5 1400ba6aa93453aa7baf571b2d5656ac
SHA1 8e4d58740aaaa6d3f6e27a43a73f13bddeb82fca
SHA256 e801f23788dd60882d6851ddaf17dd2539adee36cc4c26bf62896f21a869e942
SHA512 ba016973a1306ca6dabd83a3f78c7864d219a204c7f7bc4a92817393efd271f6c0efc3783236d23270bd83d193294a13a46fc8bdb95e043b8e2a6a9bff0a4145

C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe

MD5 1400ba6aa93453aa7baf571b2d5656ac
SHA1 8e4d58740aaaa6d3f6e27a43a73f13bddeb82fca
SHA256 e801f23788dd60882d6851ddaf17dd2539adee36cc4c26bf62896f21a869e942
SHA512 ba016973a1306ca6dabd83a3f78c7864d219a204c7f7bc4a92817393efd271f6c0efc3783236d23270bd83d193294a13a46fc8bdb95e043b8e2a6a9bff0a4145

C:\Users\Admin\AppData\Local\Temp\3582-490\svchost.exe

MD5 1400ba6aa93453aa7baf571b2d5656ac
SHA1 8e4d58740aaaa6d3f6e27a43a73f13bddeb82fca
SHA256 e801f23788dd60882d6851ddaf17dd2539adee36cc4c26bf62896f21a869e942
SHA512 ba016973a1306ca6dabd83a3f78c7864d219a204c7f7bc4a92817393efd271f6c0efc3783236d23270bd83d193294a13a46fc8bdb95e043b8e2a6a9bff0a4145

C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe

MD5 8ffc3bdf4a1903d9e28b99d1643fc9c7
SHA1 919ba8594db0ae245a8abd80f9f3698826fc6fe5
SHA256 8268d3fefe8ca96a25a73690d14bacf644170ab5e9e70d2f8eeb350a4c83f9f6
SHA512 0b94ead97374d74eaee87e7614ddd3911d2cf66d4c49abbfd06b02c03e5dd56fd00993b4947e8a4bcd9d891fa39cab18cc6b61efc7d0812e91eb3aea9cd1a427

C:\odt\office2016setup.exe

MD5 1ecd375f342e4f0a149e866ef027ef75
SHA1 89cf299b2424af8d05f4ad8ba9307da99881f9c0
SHA256 03a679ab61a9042500b9dba8847776886910e6c228fed9078eb56a71508848a5
SHA512 c47489ceab9ad46c2c11d1153efc8f6b85a3e0fbea6d0394b4bb6faded449e3b6f339ca7e0bc67b804fb5e5a32272ca1245f01996a0019be08f40b98d6eaeeb8

C:\Program Files\7-Zip\7-zip32.dll

MD5 2f244a56091c9705794e92e6bcc38058
SHA1 3f2b518be764f29c66ba8564d1be8f4309cce747
SHA256 e322feefa8d4c76d8749f88c9b877e3e119418c4ac0b18a8cfb7260638cc588d
SHA512 3ee3835abfec9c2db4ba1f33b5e59db2400e712d5dd7cde82a12889ea1beab8ac85b923ec0447e81b3d2ce3ebd14922882653f5bcdcc81a29f225acfa4872572

C:\Windows\svchost.com

MD5 36fd5e09c417c767a952b4609d73a54b
SHA1 299399c5a2403080a5bf67fb46faec210025b36d
SHA256 980bac6c9afe8efc9c6fe459a5f77213b0d8524eb00de82437288eb96138b9a2
SHA512 1813a6a5b47a9b2cd3958cf4556714ae240f2aa19d0a241b596830f0f2b89a33ec864d00ce6a791d323a58dfbff42a0fded65eefbf980c92685e25c0ec415d92

C:\Windows\svchost.com

MD5 36fd5e09c417c767a952b4609d73a54b
SHA1 299399c5a2403080a5bf67fb46faec210025b36d
SHA256 980bac6c9afe8efc9c6fe459a5f77213b0d8524eb00de82437288eb96138b9a2
SHA512 1813a6a5b47a9b2cd3958cf4556714ae240f2aa19d0a241b596830f0f2b89a33ec864d00ce6a791d323a58dfbff42a0fded65eefbf980c92685e25c0ec415d92

memory/4456-386-0x0000000000400000-0x000000000041B000-memory.dmp

C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\StartUp\svchost.exe

MD5 9a1695e1acd4ae173365e8b740a8481c
SHA1 5e81eca5d5851787a69cb79aebce1dcb7dde441e
SHA256 736a83eea1a6f524b085cf1647ee5c26dd6749e6546749f951ca268c0e88f0ac
SHA512 7446376ea758d6adaa728a9ab282559dcc0f31bb6d50763187ab7461f18da3865fa01a91418b274b0a6b1bf292702b4968a951801c073c1afaaf05dbedde8ec3

C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe

MD5 576410de51e63c3b5442540c8fdacbee
SHA1 8de673b679e0fee6e460cbf4f21ab728e41e0973
SHA256 3f00404dd591c2856e6f71bd78423ed47199902e0b85f228e6c4de72c59ddffe
SHA512 f7761f3878775b30cc3d756fa122e74548dfc0a27e38fa4109e34a59a009df333d074bf14a227549ae347605f271be47984c55148685faac479aeb481f7191db

C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE

MD5 4ddc609ae13a777493f3eeda70a81d40
SHA1 8957c390f9b2c136d37190e32bccae3ae671c80a
SHA256 16d65f2463658a72dba205dcaa18bc3d0bab4453e726233d68bc176e69db0950
SHA512 9d7f90d1529cab20078c2690bf7bffab5a451a41d8993781effe807e619da0e7292f991da2f0c5c131b111d028b3e6084e5648c90816e74dfb664e7f78181bc5

C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE

MD5 176436d406fd1aabebae353963b3ebcf
SHA1 9ffdfdb8cc832a0c6501c4c0e85b23a0f7eff57a
SHA256 2f947e3ca624ce7373080b4a3934e21644fb070a53feeaae442b15b849c2954f
SHA512 a2d1a714e0c1e5463260c64048ba8fd5064cfa06d4a43d02fc04a30748102ff5ba86d20a08e611e200dc778e2b7b3ae808da48132a05a61aa09ac424a182a06a

C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE

MD5 12c29dd57aa69f45ddd2e47620e0a8d9
SHA1 ba297aa3fe237ca916257bc46370b360a2db2223
SHA256 22a585c183e27b3c732028ff193733c2f9d03700a0e95e65c556b0592c43d880
SHA512 255176cd1a88dfa2af3838769cc20dc7ad9d969344801f07b9ebb372c12cee3f47f2dba3559f391deab10650875cad245d9724acfa23a42b336bfa96559a5488

C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE

MD5 92dc0a5b61c98ac6ca3c9e09711e0a5d
SHA1 f809f50cfdfbc469561bced921d0bad343a0d7b4
SHA256 3e9da97a7106122245e77f13f3f3cc96c055d732ab841eb848d03ac25401c1bc
SHA512 d9eefb19f82e0786d9be0dbe5e339d25473fb3a09682f40c6d190d4c320cca5556abb72b5d97c6b0da4f8faefdc6d39ac9d0415fdf94ebcc90ecdf2e513c6a31

C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\StartUp\svchost.exe

MD5 9a1695e1acd4ae173365e8b740a8481c
SHA1 5e81eca5d5851787a69cb79aebce1dcb7dde441e
SHA256 736a83eea1a6f524b085cf1647ee5c26dd6749e6546749f951ca268c0e88f0ac
SHA512 7446376ea758d6adaa728a9ab282559dcc0f31bb6d50763187ab7461f18da3865fa01a91418b274b0a6b1bf292702b4968a951801c073c1afaaf05dbedde8ec3

C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE

MD5 63dc05e27a0b43bf25f151751b481b8c
SHA1 b20321483dac62bce0aa0cef1d193d247747e189
SHA256 7d607fb69c69a72a5bf4305599279f46318312ce1082b6a34ac9100b8c7762ce
SHA512 374d705704d456cc5f9f79b7f465f6ec7c775dc43001c840e9d6efbbdef20926ed1fa97f8a9b1e73161e17f72520b96c05fa58ac86b3945208b405f9166e7ba3

C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe

MD5 05bdfd8a3128ab14d96818f43ebe9c0e
SHA1 495cbbd020391e05d11c52aa23bdae7b89532eb7
SHA256 7b945c7e6b8bfbb489f003ecd1d0dcd4803042003de4646d4206114361a0fbbb
SHA512 8d9b9fc407986bd53fe3b56c96b7371cc782b4bac705253bfb0a2b0b1e6883fdb022f1ac87b8bfd7005291991b6a3dfbaceab54f5d494e0af70f0435a0b8b0da

C:\PROGRA~2\MOZILL~1\UNINST~1.EXE

MD5 7e3b8ddfa6bd68ca8f557254c3188aea
SHA1 bafaaaa987c86048b0cf0153e1147e1bbad39b0c
SHA256 8270ecef6079a21f5ae22f1a473e5eb8abac51628367f4acf6466529ba11d7e2
SHA512 675ca07cdb787b3f624eae9707daf519214f8dc4670c524cef5110c9dba197e833cedb051919c757c58a3687e63cf175d1397d8ce69c5995f4eab3b85f6dafbb

C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE

MD5 15163eb05b0a8f65a5ca3c74a658077d
SHA1 8b116062a5754fa2d73fc4df9f635283ae1ccd02
SHA256 8751c43ee0f3f0e080103a9b77be9e79346004769ed43d4cadd630ea15d26dcf
SHA512 a8299e9a522aa58429847920b999598551c1863f63ba473178f61cde43fb91cab6ef62c9e1a51268e54338e012ccfe6428a7c37bc89007d1604fafa2560258c9

C:\PROGRA~2\MICROS~1\EDGEUP~1\MicrosoftEdgeUpdate.exe

MD5 5d656c152b22ddd4f875306ca928243a
SHA1 177ff847aa898afa1b786077ae87b5ae0c7687c7
SHA256 4d87b0eb331443b473c90650d31b893d00373ff88dcbcb3747f494407799af69
SHA512 d5e50ee909ea06e69fc0d9999c6d142f9154e6f63462312b4e950cf6e26a7d395dbb50c8e2a8c4f4e1cfb7b2c6ae8ad19e3b7c204c20e7557daa1a0deb454160

C:\PROGRA~2\MICROS~1\EDGEUP~1\Download\{F3C4F~1\13173~1.45\MICROS~1.EXE

MD5 6f46dbdeebd36491a4298ba2ad64a40e
SHA1 431a0f0e3f070f4f01a3443a10b8b29fa68a2ab6
SHA256 d093bfc63f915f9f7c905babf8eef31b5ef7c9d1ce6c5803c1290f89455db41a
SHA512 ee49e342644302d64925615a03731343f99fc4795983e8893417a702e845d1ef9f647ff1c0356e8387c9ad6bc3260c03769029e382abc94b46a4cdc5c3ed87b3

C:\PROGRA~2\MICROS~1\EDGEUP~1\13173~1.45\MIA062~1.EXE

MD5 6f46dbdeebd36491a4298ba2ad64a40e
SHA1 431a0f0e3f070f4f01a3443a10b8b29fa68a2ab6
SHA256 d093bfc63f915f9f7c905babf8eef31b5ef7c9d1ce6c5803c1290f89455db41a
SHA512 ee49e342644302d64925615a03731343f99fc4795983e8893417a702e845d1ef9f647ff1c0356e8387c9ad6bc3260c03769029e382abc94b46a4cdc5c3ed87b3

C:\PROGRA~2\MICROS~1\EDGEUP~1\13173~1.45\MI9C33~1.EXE

MD5 f6599f07c4d251ee5c5cfc0cc64711ac
SHA1 c055990dc82afde4e6f91aa55d9a23fcaaf3a989
SHA256 463a3d74bfd1bb95bea384474a8c333929c8403669ccc8bf9234ae31371539c7
SHA512 98e49025cad40455b2cd6ad80df17fbd1152b5906fb902e5c6cc2da36452db2472ea990c6448cf039a99092803c41ee5eddbb10f3cfcb0a4a4d265aa86bd3a35

C:\PROGRA~2\MICROS~1\EDGEUP~1\13173~1.45\MICROS~2.EXE

MD5 76f0495cd7be0b4a8fad4cf10c80b88c
SHA1 805e92d43e1da7c4e851bd65ad44211a905ddcb6
SHA256 bb9d225afdfc7fe8fc047d925276c12fc90e9052ade5aa2d8f317e1c21039b4d
SHA512 446eeb8ceb8cf4bd8d44f6da3fe8e09f152eef7dff7bae3a8827f8daf5ec62dc66823b9e7bba7496f59cc5c0b94f894758b5b08bed1767a18305f3aee1cdb17c

C:\PROGRA~2\MICROS~1\EDGEUP~1\13173~1.45\MICROS~3.EXE

MD5 b4d889e25e0d84f0f8a8b0647cc0db56
SHA1 a7b827ce6e9b9a0894d4205d5593aff96687ca2e
SHA256 f24ff2625cdd366dddd437d3f63429aaa11381156ae9c452db6465a917eac9f6
SHA512 dfd3068794f5a5d8cf2076c28f0993796bc9e95d5a18507fc8f2567250d06a4948447b4686657294cfaf44bdec8c3f0d6f73ee6ad7510124b3c7200951cf45d3

C:\PROGRA~2\MICROS~1\EDGEUP~1\13173~1.45\MI391D~1.EXE

MD5 38132ffbbf6df57886b30424f7683937
SHA1 85bbfe11b02ee9279133bf35c6312b219580627c
SHA256 fe6b87bc71c69af3e6b29aa0eb10a995a8c923b6dce5b8890f8794a70fe7d84e
SHA512 e7f663912547a9d67964186834c97ab7298d37df6e750cbf9b2bcd311ff15d008955e4c9012a5037d632d282bbad907a3c24916519d5f28d24f05f6df73c40c3

C:\PROGRA~2\MICROS~1\EDGEUP~1\13173~1.45\MICROS~1.EXE

MD5 8dacbffdd4899eb99ba539e6819a39f6
SHA1 dbf0b9fce74799be3979774652e332329969eb7b
SHA256 a0cfb9b76f119c5d6f929975df737cd8988f50e3a3a0b4ed235b6a50d380798b
SHA512 09ccccccbe124c0ba95f9d97cd758a963795f2c81ff0413cd72b1640b7e63b5cd336c347df73d2a97db2838950242856d99c69574a0f30c35c000241484becda

C:\PROGRA~2\MICROS~1\EDGEUP~1\13173~1.45\MICROS~4.EXE

MD5 e834e906b9ae62a75041c422580c9d1c
SHA1 dbc4f95350c0bd6857059230897cef7a22b32e66
SHA256 c8cc23d3284cfdd7ab857b5cf299eb45d86255713e780d398b5318666fb2e834
SHA512 edd07fd627159831474124c3ccf9ec1e61244a8ea2b75c69732fda3197cc684c74295e937f153e677cd21679d9feb35373fd9878de0e15165b0653eda5ea57c7

memory/1664-605-0x0000000005A50000-0x0000000005A51000-memory.dmp

memory/1664-611-0x0000000005A50000-0x0000000005A51000-memory.dmp

C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE

MD5 5c78384d8eb1f6cb8cb23d515cfe7c98
SHA1 b732ab6c3fbf2ded8a4d6c8962554d119f59082e
SHA256 9abd7f0aa942ee6b263cdc4b32a4110ddb95e43ad411190f0ea48c0064884564
SHA512 99324af5f8fb70a9d01f97d845a4c6999053d6567ba5b80830a843a1634b02eaf3c0c04ced924cf1b1be9b4d1dbbcb95538385f7f85ad84d3eaaa6dcdebcc8a6

C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE

MD5 a5d9eaa7d52bffc494a5f58203c6c1b5
SHA1 97928ba7b61b46a1a77a38445679d040ffca7cc8
SHA256 34b8662d38e7d3d6394fa6c965d943d2c82ea06ba9d7a0af4f8e0571fb5a9c48
SHA512 b6fdc8389bb4d736d608600469be6a4b0452aa3ea082f9a0791022a14c02b8fb7dcd62df133b0518e91283094eaba2be9318316f72d2c4aae6286d3e8686e787

C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe

MD5 5119e350591269f44f732b470024bb7c
SHA1 4ccd48e4c6ba6e162d1520760ee3063e93e2c014
SHA256 2b3aa9642b291932ba7f9f3d85221402a9d27078f56ef0e9c6bca633616e3873
SHA512 599b4ec673169d42a348d1117737b4ad4d7539574153df5a5c7689130c9ac5ff5cd00f3c8ec39adf32ff2b56be074081efcabb6456272c649703c3ea6cdaded4

C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\PWAHEL~1.EXE

MD5 5c78384d8eb1f6cb8cb23d515cfe7c98
SHA1 b732ab6c3fbf2ded8a4d6c8962554d119f59082e
SHA256 9abd7f0aa942ee6b263cdc4b32a4110ddb95e43ad411190f0ea48c0064884564
SHA512 99324af5f8fb70a9d01f97d845a4c6999053d6567ba5b80830a843a1634b02eaf3c0c04ced924cf1b1be9b4d1dbbcb95538385f7f85ad84d3eaaa6dcdebcc8a6

C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\NOTIFI~1.EXE

MD5 27543bab17420af611ccc3029db9465a
SHA1 f0f96fd53f9695737a3fa6145bc5a6ce58227966
SHA256 75530dc732f35cc796d19edd11ae6d6f6ef6499ddcf2e57307582b1c5299554c
SHA512 a62c2dd60e1df309ec1bb48ea85184914962ba83766f29d878569549ca20fca68f304f4494702d9e5f09adedc2166e48ee0bc1f4a5d9e245c5490daf15036bea

C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~2.EXE

MD5 11486d1d22eaacf01580e3e650f1da3f
SHA1 a47a721efec08ade8456a6918c3de413a2f8c7a2
SHA256 5e1b1daa9968ca19a58714617b7e691b6b6f34bfacaf0dcf4792c48888b1a5d3
SHA512 5bd54e1c1308e04a769e089ab37bd9236ab97343b486b85a018f2c8ad060503c97e8bc51f911a63f9b96dd734eb7d21e0a5c447951246d972b05fafeef4633da

C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~1.EXE

MD5 a5d9eaa7d52bffc494a5f58203c6c1b5
SHA1 97928ba7b61b46a1a77a38445679d040ffca7cc8
SHA256 34b8662d38e7d3d6394fa6c965d943d2c82ea06ba9d7a0af4f8e0571fb5a9c48
SHA512 b6fdc8389bb4d736d608600469be6a4b0452aa3ea082f9a0791022a14c02b8fb7dcd62df133b0518e91283094eaba2be9318316f72d2c4aae6286d3e8686e787

C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~3.EXE

MD5 eb008f1890fed6dc7d13a25ff9c35724
SHA1 751d3b944f160b1f77c1c8852af25b65ae9d649c
SHA256 a9b7b9155af49d651b092bb1665447059f7a1d0061f88fa320d4f956b9723090
SHA512 9cfe3480f24bf8970ad5773cb9df51d132ee90ada35cbf8ec1222e09a60ae46b2ff4b96862fea19085b1c32f93c47c69f604589fa3f4af17e5d67bef893b6bf1

C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\msedge.exe

MD5 5119e350591269f44f732b470024bb7c
SHA1 4ccd48e4c6ba6e162d1520760ee3063e93e2c014
SHA256 2b3aa9642b291932ba7f9f3d85221402a9d27078f56ef0e9c6bca633616e3873
SHA512 599b4ec673169d42a348d1117737b4ad4d7539574153df5a5c7689130c9ac5ff5cd00f3c8ec39adf32ff2b56be074081efcabb6456272c649703c3ea6cdaded4

memory/1664-685-0x0000000005A50000-0x0000000005A51000-memory.dmp

C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\INSTAL~1\setup.exe

MD5 6ce350ad38c8f7cbe5dd8fda30d11fa1
SHA1 4f232b8cccd031c25378b4770f85e8038e8655d8
SHA256 06a3bb0bdd2da870bc8dc2c6b760855cea7821273ce59fc0be158149e52915ba
SHA512 4c18a112fec391f443a4ae217ac6d1850e0cfdad4b2d2cbe3f61cb01c0a1400ea6bd5c3ffe0a9978ead50e7f6cfab96ae5090bb9a611f988f1a86ccaa5d4cd4f

C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\IDENTI~1.EXE

MD5 301d7f5daa3b48c83df5f6b35de99982
SHA1 17e68d91f3ec1eabde1451351cc690a1978d2cd4
SHA256 abe398284d90be5e5e78f98654b88664e2e14478f7eb3f55c5fd1c1bcf1bebee
SHA512 4a72a24dec461d116fe8324c651913273ccaa50cb036ccdacb3ae300e417cf4a64aa458869b8d2f3b4c298c59977437d11b241d08b391a481c3226954bba22e4

C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\ELEVAT~1.EXE

MD5 41b1e87b538616c6020369134cbce857
SHA1 a255c7fef7ba2fc1a7c45d992270d5af023c5f67
SHA256 08465cc139ee50a7497f8c842f74730d3a8f1a73c0b7caca95e9e6d37d3beed3
SHA512 3a354d3577b45f6736203d5a35a2d1d543da2d1e268cefeffe6bdb723ff63c720ceb2838701144f5fec611470d77649846e0fb4770d6439f321f6b819f03e4db

C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\COOKIE~1.EXE

MD5 5e08d87c074f0f8e3a8e8c76c5bf92ee
SHA1 f52a554a5029fb4749842b2213d4196c95d48561
SHA256 5d548c2cc25d542f2061ed9c8e38bd5ca72bddb37dd17654346cae8a19645714
SHA512 dd98d6fa7d943604914b2e3b27e1f21a95f1fe1feb942dd6956e864da658f4fbd9d1d0cf775e79ceaae6a025aafd4e633763389c37034134bd5245969bec383e

C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\BHO\IE_TO_~1.EXE

MD5 7c73e01bd682dc67ef2fbb679be99866
SHA1 ad3834bd9f95f8bf64eb5be0a610427940407117
SHA256 da333c92fdfd2e8092f5b56686b94f713f8fa27ef8f333e7222259ad1eb08f5d
SHA512 b2f3398e486cde482cb6bea18f4e5312fa2db7382ca25cea17bcba5ab1ff0e891d59328bc567641a9da05caca4d7c61dc102289d46e7135f947ce6155e295711

C:\PROGRA~2\Google\Update\DISABL~1.EXE

MD5 3b0e91f9bb6c1f38f7b058c91300e582
SHA1 6e2e650941b1a96bb0bb19ff26a5d304bb09df5f
SHA256 57c993cadf4bf84810cea23a7112c6e260624beaab48d0e4332d3462900fec1d
SHA512 a4fbe28a0135f4632e0a5b6bd775f8d010250b0fbfe223db1fe81d18552a6bc166ebce807853ba02e6a476e9829454805e415ca828a5e043bd1e63dc53599d0f

C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE

MD5 f7c714dbf8e08ca2ed1a2bfb8ca97668
SHA1 cc78bf232157f98b68b8d81327f9f826dabb18ab
SHA256 fc379fda348644fef660a3796861c122aa2dd5498e80279d1279a7ddb259e899
SHA512 28bc04c4df3f632865e68e83d045b3ecd2a263e62853c922b260d0734026e8a1541988fcbf4ddc9cf3aba6863214d6c6eb51f8bbb2586122a7cb01a70f08d16c

C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~2.EXE

MD5 25e165d6a9c6c0c77ee1f94c9e58754b
SHA1 9b614c1280c75d058508bba2a468f376444b10c1
SHA256 8bbe59987228dd9ab297f9ea34143ea1e926bfb19f3d81c2904ab877f31e1217
SHA512 7d55c7d86ccabb6e9769ebca44764f4d89e221d5756e5c5d211e52c271e3ce222df90bc9938248e2e210d6695f30f6280d929d19ef41c09d3ea31688ae24d4bf

C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE

MD5 e5589ec1e4edb74cc7facdaac2acabfd
SHA1 9b12220318e848ed87bb7604d6f6f5df5dbc6b3f
SHA256 6ce92587a138ec07dac387a294d0bbe8ab629599d1a2868d2afaccea3b245d67
SHA512 f36ab33894681f51b9cec7ea5a738eb081a56bcd7625bdd2f5ef2c084e4beb7378be8f292af3aeae79d9317ba57cc41df89f00aef52e58987bdb2eac3f48171a

C:\PROGRA~2\Google\Update\1336~1.151\GO664E~1.EXE

MD5 96a14f39834c93363eebf40ae941242c
SHA1 5a3a676403d4e6ad0a51d0f0e2bbdd636ae5d6fc
SHA256 8ee4aa23eb92c4aba9a46b18ac249a5fa11c5abb7e2c1ca82cd5196401db790a
SHA512 fbf307a8053e9478a52cfdf8e8bad3d7c6664c893458786ae6ee4fffc6fe93006e99a2a60c97fb62dad1addd5247621517f4edee5d9545717c4587a272cef9a2

memory/1664-718-0x0000000005A50000-0x0000000005A51000-memory.dmp

C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE

MD5 3b0e91f9bb6c1f38f7b058c91300e582
SHA1 6e2e650941b1a96bb0bb19ff26a5d304bb09df5f
SHA256 57c993cadf4bf84810cea23a7112c6e260624beaab48d0e4332d3462900fec1d
SHA512 a4fbe28a0135f4632e0a5b6bd775f8d010250b0fbfe223db1fe81d18552a6bc166ebce807853ba02e6a476e9829454805e415ca828a5e043bd1e63dc53599d0f

memory/1664-722-0x0000000005A50000-0x0000000005A51000-memory.dmp

memory/1664-725-0x0000000005A50000-0x0000000005A51000-memory.dmp

C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE

MD5 400836f307cf7dbfb469cefd3b0391e7
SHA1 7af3cbb12d3b2d8b5d9553c687c6129d1dd90a10
SHA256 cb5c5abb625a812d47007c75e3855be3f29da527a41cf03730ad5c81f3eb629a
SHA512 aa53cb304478585d6f83b19a6de4a7938ba2570d380a565a56ff5365aed073d5f56b95ad3228eb7d1e7e6110c6172a58b97bd6a5e57e4a8d39e762ed31dc17c8

C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE

MD5 5da33a7b7941c4e76208ee7cddec8e0b
SHA1 cdd2e7b9b0e4be68417d4618e20a8283887c489c
SHA256 531e735e4e8940dfe21e30be0d4179ceaecb57ce431cf63c5044e07048ac1751
SHA512 977aeecfbc693c9d5746fedf08b99e0b0f6fd7b0c7b41ac2b34a832e68a2e6f3c68f38af2e65c87075fcf00c1c6103e34324df45d7da9412cbbeea7e410794b6

C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE

MD5 cbd96ba6abe7564cb5980502eec0b5f6
SHA1 74e1fe1429cec3e91f55364e5cb8385a64bb0006
SHA256 405b8bd647fa703e233b8b609a18999abe465a8458168f1daf23197bd2ea36aa
SHA512 a551001853f6b93dfbc6cf6a681820af31330a19d5411076ff3dbce90937b3d92173085a15f29ebf56f2ef12a4e86860ac6723ebc89c98ea31ea7a6c7e3d7cdc

memory/1664-739-0x0000000005A50000-0x0000000005A51000-memory.dmp

C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jusched.exe

MD5 6e84b6096aaa18cabc30f1122d5af449
SHA1 e6729edd11b52055b5e34d39e5f3b8f071bbac4f
SHA256 c6b7f9119cf867951f007c5468f75eb4dca59c7eedeb0afdd8ad9d5b9606e759
SHA512 af5b33e7e190587bb152adf65fbcd4c1cd521f638863a6d1c7de29599cce6439b6c7b653180661cb0382007aefa0ae5a1b1b841eaaa116ce715f3a5ba0725a42

C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jucheck.exe

MD5 2d3cc5612a414f556f925a3c1cb6a1d6
SHA1 0fee45317280ed326e941cc2d0df848c4e74e894
SHA256 fe46de1265b6fe2e316aca33d7f7f45c6ffdf7c49a044b464fd9dc88ec92091b
SHA512 cc49b200adf92a915da6f9b73417543d4dcc77414e0c4bd2ce3bfdfc5d151e0b28249f8d64f6b7087cf8c3bab6aeeab5b152ac6199cb7cc63e64a66b4f03a9f5

C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe

MD5 d90510a290c2987a2613df8eba3264cf
SHA1 226b619ccd33c2a186aef6cbb759b2d4cf16fff5
SHA256 49577d0c54d9f941d25346dd964f309da452b62bfb09282cabc2fbcb169fdf5d
SHA512 e0554a501009dd67bd1dbd586ad66a90ad2d75aa67782fc5fbb783aeaed7ef8e525e70bd96a6eb8a1f9008f541e2f281061d30b7886aae771f226c5b882d8247

C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE

MD5 bcd0f32f28d3c2ba8f53d1052d05252d
SHA1 c29b4591df930dabc1a4bd0fa2c0ad91500eafb2
SHA256 bb07d817b8b1b6b4c25e62b6120e51dec10118557d7b6b696ad084a5ba5bfdeb
SHA512 79f407735853f82f46870c52058ceee4d91857a89db14868ee1169abd5c0fd2e3fa1ed230ab90b5f479a9581b88998643d69b0df498defea29e73b0d487f3b10

C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe

MD5 d47ed8961782d9e27f359447fa86c266
SHA1 d37d3f962c8d302b18ec468b4abe94f792f72a3b
SHA256 b1ec065f71cc40f400e006586d370997102860504fd643b235e8ed9f5607262a
SHA512 3e33f2cdf35024868b183449019de9278035e7966b342ba320a6c601b5629792cbb98a19850d4ca80b906c85d10e8503b0193794d1f1efa849fa33d26cff0669

memory/1664-750-0x0000000005A50000-0x0000000005A51000-memory.dmp

C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE

MD5 3b35b268659965ab93b6ee42f8193395
SHA1 8faefc346e99c9b2488f2414234c9e4740b96d88
SHA256 750824b5f75c91a6c2eeb8c5e60ae28d7a81e323d3762c8652255bfea5cba0bb
SHA512 035259a7598584ddb770db3da4e066b64dc65638501cdd8ff9f8e2646f23b76e3dfffa1fb5ed57c9bd15bb4efa3f7dd33fdc2e769e5cc195c25de0e340eb89ab

C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE

MD5 8c753d6448183dea5269445738486e01
SHA1 ebbbdc0022ca7487cd6294714cd3fbcb70923af9
SHA256 473eb551101caeaf2d18f811342e21de323c8dd19ed21011997716871defe997
SHA512 4f6fddefc42455540448eac0b693a4847e21b68467486376a4186776bfe137337733d3075b7b87ed7dac532478dc9afc63883607ec8205df3f155fee64c7a9be

C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe

MD5 5791075058b526842f4601c46abd59f5
SHA1 b2748f7542e2eebcd0353c3720d92bbffad8678f
SHA256 5c3ef3ec7594c040146e908014791dd15201ba58b4d70032770bb661b6a0e394
SHA512 83e303971ed64019fde9e4ba6f6e889f8fb105088490dfa7dcf579a12baff20ef491f563d132d60c7b24a4fd3cac29bd9dc974571cd162000fae8fba4e0e54fb

C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE

MD5 9dfcdd1ab508b26917bb2461488d8605
SHA1 4ba6342bcf4942ade05fb12db83da89dc8c56a21
SHA256 ecd5e94da88c653e4c34b6ab325e0aca8824247b290336f75c410caa16381bc5
SHA512 1afc1b95f160333f1ff2fa14b3f22a28ae33850699c6b5498915a8b6bec1cfc40f33cb69583240aa9206bc2ea7ab14e05e071275b836502a92aa8c529fc1b137

C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe

MD5 cce8964848413b49f18a44da9cb0a79b
SHA1 0b7452100d400acebb1c1887542f322a92cbd7ae
SHA256 fe44ca8d5050932851aa54c23133277e66db939501af58e5aeb7b67ec1dde7b5
SHA512 bf8fc270229d46a083ced30da6637f3ca510b0ce44624a9b21ec6aacac81666dffd41855053a936aa9e8ea6e745a09b820b506ec7bf1173b6f1837828a35103d

memory/1664-758-0x0000000005A50000-0x0000000005A51000-memory.dmp

C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE

MD5 09acdc5bbec5a47e8ae47f4a348541e2
SHA1 658f64967b2a9372c1c0bdd59c6fb2a18301d891
SHA256 1b5c715d71384f043843ea1785a6873a9f39d2daae112ccdeffcd88b10a3a403
SHA512 3867bf98e1a0e253114a98b78b047b0d8282b5abf4aaf836f31cc0e26224e2a1b802c65df9d90dc7696a6dbcb9a8e4b900f1d1299e1b11e36f095ebaf8a2e5b8

C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE

MD5 3b73078a714bf61d1c19ebc3afc0e454
SHA1 9abeabd74613a2f533e2244c9ee6f967188e4e7e
SHA256 ded54d1fcca07b6bff2bc3b9a1131eac29ff1f836e5d7a7c5c325ec5abe96e29
SHA512 75959d4e8a7649c3268b551a2a378e6d27c0bfb03d2422ebeeb67b0a3f78c079473214057518930f2d72773ce79b106fd2d78405e8e3d8883459dcbb49c163c4

C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe

MD5 8ffc3bdf4a1903d9e28b99d1643fc9c7
SHA1 919ba8594db0ae245a8abd80f9f3698826fc6fe5
SHA256 8268d3fefe8ca96a25a73690d14bacf644170ab5e9e70d2f8eeb350a4c83f9f6
SHA512 0b94ead97374d74eaee87e7614ddd3911d2cf66d4c49abbfd06b02c03e5dd56fd00993b4947e8a4bcd9d891fa39cab18cc6b61efc7d0812e91eb3aea9cd1a427

C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe

MD5 322302633e36360a24252f6291cdfc91
SHA1 238ed62353776c646957efefc0174c545c2afa3d
SHA256 31da9632f5d25806b77b617d48da52a14afc574bbe1653120f97705284ea566c
SHA512 5a1f7c44ce7f5036bffc18ebac39e2bf70e6f35fa252617d665b26448f4c4473adfa115467b7e2d9b7068823e448f74410cdcdfef1ac1c09021e051921787373

C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE

MD5 39c8a4c2c3984b64b701b85cb724533b
SHA1 c911f4c4070dfe9a35d9adcb7de6e6fb1482ce00
SHA256 888a1dd0033e5d758a4e731e3e55357de866e80d03b1b194375f714e1fd4351d
SHA512 f42ca2962fe60cff1a13dea8b81ff0647b317c785ee4f5159c38487c34d33aecba8478757047d31ab2ee893fbdcb91a21655353456ba6a018fc71b2278db4db2

memory/1664-765-0x0000000005A50000-0x0000000005A51000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_96.db

MD5 1681ffc6e046c7af98c9e6c232a3fe0a
SHA1 d3399b7262fb56cb9ed053d68db9291c410839c4
SHA256 9d908ecfb6b256def8b49a7c504e6c889c4b0e41fe6ce3e01863dd7b61a20aa0
SHA512 11bb994b5d2eab48b18667c7d8943e82c9011cb1d974304b8f2b6247a7e6b7f55ca2f7c62893644c3728d17dafd74ae3ba46271cf6287bb9e751c779a26fefc5

memory/4456-957-0x0000000000400000-0x000000000041B000-memory.dmp

memory/4668-958-0x0000000000400000-0x000000000041B000-memory.dmp

memory/4456-2001-0x0000000000400000-0x000000000041B000-memory.dmp

memory/4668-2005-0x0000000000400000-0x000000000041B000-memory.dmp

C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\eclipse.inf

MD5 ab9d8ef2ffa9145d6c325cefa41d5d4e
SHA1 0f2bf6d5e1a0209d19f8f6e7d08b3e2d9cf4c5ab
SHA256 65a16cb7861335d5ace3c60718b5052e44660726da4cd13bb745381b235a1785
SHA512 904f1892ec5c43c557199325fda79cacaee2e8f1b4a1d41b85c893d967c3209f0c58081c0c9a6083f85fd4866611dfeb490c11f3163c12f4f0579adda2c68100

memory/4668-3782-0x0000000000400000-0x000000000041B000-memory.dmp

memory/4456-4000-0x0000000000400000-0x000000000041B000-memory.dmp

C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPBluTSFrame.png

MD5 a2bb242dc046bacdc58e7fbbe03cce85
SHA1 052ab788f1646b958e0ea2c0ef47d00141fc1004
SHA256 486a8212c0d6860840d883981ca52daaad3bf3b2ab5be56cdc47ed9b42daba22
SHA512 d9bb4c0658f79fbcf22697c24bc32f4ef27ddf934e8f41cf73a2990d18cdb38379f6b61e50edef8ebdf5a2f59a0f8fa40e000b24f1c55a06cfa161db658326ad

C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-openide-util-enumerations.xml

MD5 2c16868331f82ff43059dcb0ea178af3
SHA1 983589535e05c495ffeae4b0b31ddcfafe92a763
SHA256 be9ceb4464b22203feffd3700c5570b7d6d44c5d0d357148e1e6d5be5e694376
SHA512 184653d3e40df84cd0052e5d9477201f276ce0e8cbb5e4b7bfac86fc7da325eef476982910be24c20725a6db6617fffd88998d6053c1b694718bc7ab0bde9ea1

C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-openide-windows.xml

MD5 f7c78514872f9cb5585f8d69532cd2d0
SHA1 ff9dfbb62a3b48c85b6434ee831fb33a8dba9526
SHA256 5f7bcd85900e62abb00ce739eaad53d80170a4a6152d951b6825110d2fc17965
SHA512 50ee6ae916ea0e806b73c2e5bb727f6ee4837a696c5bd8559ede78148b40a5d5cdd135e28c8b5153a8fef568fd21ef0708ca198ace89e7120ffb84fd9bc91c01

C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\config\Modules\org-netbeans-lib-profiler-ui.xml

MD5 d7d2fed9b7c55fe72a6cda66725cb7e8
SHA1 2cb154a1c4a0553658801a088edf87b5816cbbd2
SHA256 a6df5cb2b51fa56609c7daf08d28f0e41801b96f9514a9d179992a63afd516b5
SHA512 0ba4d570d624cc5aa6af629260668ad805285fcedd61002999734fe04cae47016cf52022c327cf22935ded99b30c52d9f041ead60a3425365116bf1bf4cbcf5e

C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\update_tracking\org-netbeans-lib-profiler-ui.xml

MD5 a75d7d422fd00bf31208b013e74d8394
SHA1 3d59f8de55a42cc13fb2ebda6de3a5193f2ee561
SHA256 7a12e561363385e9dfeeab326368731c030ed4b374e7f5897ac819159d2884c5
SHA512 af3a1e15594a0bf08ae34a5948037ef492e71ee33d5d4ac9f24b18adf99a34563ab40ba8f47f2adff5d928f18d8a8cd60fc78e654e4d6cf962292d2f606def66

C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-snaptracer.xml

MD5 ceb1e6764a28b208d51a7801052118d7
SHA1 2719eea8bde44ff35dd7b274df167c103483b895
SHA256 99d48b66d590c07b14f4cd68adac79e92616afcf00503a846b6bf4599bfeabc0
SHA512 f4a2df6229bca6c6ef9ef9f432847683238715eddcb1f89c291da5f5900c9a3461204d8495c3450c8bae1c1a661424089554d316468ba1b039a2c50d6e69bf29

C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-sampler.xml

MD5 437687da72730cf42ce36bd093b78b3e
SHA1 693e31dc362426bc4d7a6b2954f7c80267476d66
SHA256 d0d0b1face19fe4a88c6b51f6ced55ae0e00ac548b75809d88089ad431da5d3a
SHA512 7d05e270926dcb452ce405dac9dab6e9e1a0dd247bc93f0940826eb4abecf827acb6f42ef32d3b6f6ac4b46b28d522e0b25f6b8b679affb9a198db8ba4fe2daa

C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-sa.xml

MD5 48e296d8287ae11c252e4277ee885161
SHA1 8a75b573549c2791d38acb3a4d215fa2153b37eb
SHA256 c94a9a55369ccc4b41a71b9c18b04e1778a0913447ca6b5a630135f7a7ac0c1b
SHA512 b17a5a8a6009bfde681829bd7be3b550d8b8bf6bfee19bdd55567163890550980ac0633fd956f117006892638f408c63449d4520b0716e6866ab0858cc3f743b

C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-api-caching.xml

MD5 9f89b49e6e4b81eb9a3ef6a5d8924461
SHA1 17ee8eae11a1fb327f3344cc549bef305de408c5
SHA256 d739aa103e35aa5efd0fe49dd14d9360b5a83261b164d6d3277a24fed97ff8fc
SHA512 ef2f26b00ee4dccdb28fc1bb6c960cab9ae6f72f126bee21104b865b8e7833b35a64abf464b71cc34e954a8ccdb805544729368caee2a84b8ab97914c30fa761

C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-jvmstat.xml

MD5 bb95a9de280c528c32806d0d5231de6d
SHA1 bbffb8596f1bc68df5603a10a3672a02ebd3ea8b
SHA256 a7ca0125b93e1a5681d5a9c294ec3a4e5680cc58e44fd223d2dac04232b7367c
SHA512 ac4cad4f24495aa6b0d5ed8aa439554f479cc2fdba4d5dd256f1983fa43a4121c8fdf79ad7ec9d9a396a73fd480bf2f5141ab5303d50c8b6d2ce47d158010a80

C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-profiler.xml

MD5 0188bed9647ab3c0f81dc3e4b5589baa
SHA1 05493cad7050ee0cba5255847941736898503dd3
SHA256 f5d3f822a8435f91f7a5d54b720aa637f8b8f8102c7670d1b52d98f2d0123beb
SHA512 20e40619e02c24acd461fe07a7d7e448bdd03f423221ecde05ec206eb7b520d3d500e3b5988122b97a8752fe2cc7b305417692ec73d4568dcf49b2c3c4fb8d0b

memory/4456-6138-0x0000000000400000-0x000000000041B000-memory.dmp

memory/4668-6139-0x0000000000400000-0x000000000041B000-memory.dmp

C:\Program Files\Java\jre1.8.0_66\lib\images\cursors\invalid32x32.gif

MD5 d13b5ffdeb538f15ee1d30f2788601d5
SHA1 8dc4da8e4efca07472b08b618bc059dcbfd03efa
SHA256 f1663cceeb67ba35c5a5cbf58b56050ddbe5ec5680ea9e55837b57524f29b876
SHA512 58e6b66d1e6a9858e3b2ff1c90333d804d80a98dad358bb666b0332013c0c0c7444d9cb7297eff3aeee7de66d01b3b180629f1b5258af19165abd5e013574b46

C:\Program Files\Java\jre1.8.0_66\release

MD5 ff9a2d3be0b1b401f5bbae30ab62a24d
SHA1 29d8cda271ced9cf1d430029fa4ab0d6ba5948c0
SHA256 fd13695474bc8227057e56cb7013cea630c9ad3a2a134b7b412293f850c1df43
SHA512 0dd906600b44350136079b23488fd72b0f1a8a4eed594b26a692a725a62a741707b2811005dc11a389e5da89ebfd7040519342813035047bbee906a20beff2e1

C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml

MD5 0b783b2c6d8aa254f3e90187725263aa
SHA1 df2e49e32c8e1d25b17d410addf35badc22ef90f
SHA256 590de671f8b144c3ec28a4e953a91685bb6c2a97c7c25c08d44003445bc2fe3e
SHA512 ef532a7213505f49d95b05cf27d64e1b45ef9ded6b057ba0501fb0b62631784f21f235a0842c58b2b27522e06bb383afefd3220c85064b729b45131692fa2461

C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Slipstream.xml

MD5 809457c05fe696f5d34ac5ac8768cdd4
SHA1 a2c3e4966415100c7d24f7f3dc7e27d2a60d20c9
SHA256 1b66520d471367f736d50c070a2e2bba8ad88ac58743394a764b888e9cb6f6be
SHA512 cf38e01d3e174ff4b8070fb88ead7e787143ce7cf60b91365fafd01cacc1420337654083a14dfb2caa900141a578717f5d24fa3cadd17c1a992d09280fd8dc44

memory/4668-7089-0x0000000000400000-0x000000000041B000-memory.dmp

memory/4456-7228-0x0000000000400000-0x000000000041B000-memory.dmp

memory/4668-8433-0x0000000000400000-0x000000000041B000-memory.dmp

memory/4456-8443-0x0000000000400000-0x000000000041B000-memory.dmp

memory/4456-9488-0x0000000000400000-0x000000000041B000-memory.dmp

memory/4668-9492-0x0000000000400000-0x000000000041B000-memory.dmp

C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt

MD5 c183857770364b05c2011bdebb914ed3
SHA1 040e5ac904de86328cca053a15596e118fc5da24
SHA256 094c4931fdb2f2af417c9e0322a9716006e8211fe9017f671ac6e3251300acca
SHA512 8ac7790c0687f86d2d0ca82cfc9921c8cd6e6f5392594317d5ee6f3661500de58ebd5ef6300a412c23ed1cd2748c5eadeeb9719f32758590bd4168a0259bbd70

memory/4668-10435-0x0000000000400000-0x000000000041B000-memory.dmp

memory/4456-10526-0x0000000000400000-0x000000000041B000-memory.dmp

C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT_F_COL.HXK

MD5 301657e2669b4c76979a15f801cc2adf
SHA1 f7430efc590e79b847ab97b6e429cd07ef886726
SHA256 802bbf1167e97e336bc7e1d1574466db744c7021efe0f0ff01ff7e352c44f56b
SHA512 e94480d20b6665599c4ed1bc3fc6949c9be332fd91a14cef14b3e263ab1000666e706b51869bc93b4f479bb6389351674e707e79562020510c1b6dfe4b90cc51

C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT_K_COL.HXK

MD5 b9205d5c0a413e022f6c36d4bdfa0750
SHA1 f16acd929b52b77b7dad02dbceff25992f4ba95e
SHA256 951b1c95584b91fd8776e1d26b25d745ad5d508f6337686b9f7131d7c2f7096a
SHA512 0e67910bcf0f9ccde5464c63b9c850a12a759227d16b040d98986d54253f9f34322318e56b8feb86c5fb2270ed87f31252f7f68493ee759743909bd75e4bb544

memory/4668-11019-0x0000000000400000-0x000000000041B000-memory.dmp

memory/4456-11075-0x0000000000400000-0x000000000041B000-memory.dmp

memory/4456-11555-0x0000000000400000-0x000000000041B000-memory.dmp

memory/4668-11556-0x0000000000400000-0x000000000041B000-memory.dmp

memory/4456-12383-0x0000000000400000-0x000000000041B000-memory.dmp

memory/4668-12387-0x0000000000400000-0x000000000041B000-memory.dmp

memory/4668-12923-0x0000000000400000-0x000000000041B000-memory.dmp

memory/4456-13026-0x0000000000400000-0x000000000041B000-memory.dmp

memory/4668-13325-0x0000000000400000-0x000000000041B000-memory.dmp

memory/4456-13326-0x0000000000400000-0x000000000041B000-memory.dmp

memory/4456-13722-0x0000000000400000-0x000000000041B000-memory.dmp

memory/4668-13723-0x0000000000400000-0x000000000041B000-memory.dmp

memory/4456-14423-0x0000000000400000-0x000000000041B000-memory.dmp

memory/4668-14424-0x0000000000400000-0x000000000041B000-memory.dmp

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CANYON\CANYON.INF

MD5 a1534d6e98a6b21386456a8f66c55260
SHA1 c7239c0fe3b7a00d812e548f4cb9d8d863e8c251
SHA256 4c555a3d8b83f80c2e0d0b647769e82148ebe7e27811d0a63277d6f61abafbbc
SHA512 af0302203a3ccb765aa4ce1b1ab524ffa500d62e179ffb527b76d2b62f5ba31b037902d8d46278378e7255a91251f06c0779fe4940d47a582415a201b0e401db

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\REFINED\PREVIEW.GIF

MD5 80e4b616b1c7264011924f980d0a1d5e
SHA1 d2811ba0bae94849d9a97e1f8ce89af91da2db9b
SHA256 e8eac758147eeb2b17f4c1e59ab9fc9bd1cb6c764665e0b028700ac7a4744a5b
SHA512 5943d1d5a6c50ca451cfdc46284aebe563bab24646e7ee5854da2f0f617a15a56f2686c766be7eb605e6952fdf9a49e2794ef07e29bac64a59a471ce40066eec

memory/4668-15270-0x0000000000400000-0x000000000041B000-memory.dmp

memory/4456-15366-0x0000000000400000-0x000000000041B000-memory.dmp

memory/4668-15981-0x0000000000400000-0x000000000041B000-memory.dmp

memory/4456-16051-0x0000000000400000-0x000000000041B000-memory.dmp

C:\Program Files\Mozilla Firefox\xul.dll.sig

MD5 69016e6a597d194701476b8e04d4e028
SHA1 71a24ddb0c5bbd321d3f09d7b322c3655fb5e129
SHA256 4740d289d0a31bc1fc00e255845b3d8ba7cec2d6d0ee92177d23aa293f9fca3a
SHA512 a9399ea57f65c6569e2a9e9ebe9fa2da7184ec92a555549f39cbbe9dff15530ad526107a2a2304d822be37580a965c6ea4e88a46adebd8ff3af402d2c25321ae

C:\Program Files\VideoLAN\VLC\locale\tl\LC_MESSAGES\vlc.mo

MD5 cafc2a2dde2f05e2a60677690d2ca245
SHA1 8bd9c447b79435b8497212ef76f5b43dffb030a8
SHA256 db91bef58cfa8c3ad4587f4d737202a2ea4374deb35305e8e56a4e0b57232a7e
SHA512 7f293929a1147163d71c612084c7fb99740a1fdae3a3f9d7782f795c10c1b7b2e49617e9d6746938167a2dd49bc5c53788bd8751c61ad145d2d42700ae1f1575

memory/4456-16936-0x0000000000400000-0x000000000041B000-memory.dmp

memory/4668-16940-0x0000000000400000-0x000000000041B000-memory.dmp

memory/4456-18136-0x0000000000400000-0x000000000041B000-memory.dmp

memory/4668-18137-0x0000000000400000-0x000000000041B000-memory.dmp

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\EPDF_RHP.aapp

MD5 c9580e2bd3527b65bf5b812b477ffe30
SHA1 66e921f302739af54e7a991ce38a1d37ead7c7c2
SHA256 e77bb87374bd3a9b3ccdf932d260091a3ffeb1d1ad9d236b54f0f6797585ebd7
SHA512 e86e61aa09e93395f03b9976d6af4f775be3e017ca371a837e538d440e04b7813d2855c3b7c2444aaa357c9d7a3b5ccca7649c6c557bc3f520b953d96aa93577

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\OptimizePDF_R_RHP.aapp

MD5 9cb5fb90f42219febcadbc6eb57257f6
SHA1 c948b86625804155f9ac9478a07cae11d8021563
SHA256 1093af6901915021573eb2e3bcb49af7f1eb79df351806d325b80f1baedaa185
SHA512 9c9031770c5c67f40b93dc7dac91822f3b5eabe1deb83eceb2a878afc810a810ce0521f966e68fa49aa1973cec342cd3ef6096ebaaa191b885a542e4a178ca5a

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Pages_R_RHP.aapp

MD5 6289d77cc58fd2a1816d396fdc5696c6
SHA1 ac14825f3fa381442f959a459f7d0b153094cdee
SHA256 1c944211b06ef66eeb79aa89cbc24d3d2e5108d4bae17f1877e297341ecdea20
SHA512 abc4bca589e1b6e8404def1793e514a5b35a9a3255b37dc7d25af88a3df0e7969101b42cf9be1402e312e25f30288395cef03ffe5a37845689680c2c9097210d

memory/4668-18856-0x0000000000400000-0x000000000041B000-memory.dmp

memory/4456-18920-0x0000000000400000-0x000000000041B000-memory.dmp

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\selection-actions.png

MD5 eedd2d13e3671d589714446755b78b38
SHA1 2fdd23507187a259f5a7edb01611a37b6b09f4da
SHA256 467082e15a8ddefd51088e12a6189f9923dadfdf363ac1b0448ec43dc483cb3d
SHA512 ef47a62ce6ffb0c5b34b2c6d72f5874dbad4109b98aaa21f56b8b2d83471f5ebf983f6dfd889399abe4fead6296cf2ca3f409a4aa4badad8cc3c48f688323837

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_reminders_18.svg

MD5 3f16cc51cf788a50e6cc1ae60897bbf7
SHA1 e5a8c8f5227ca6da79589192892e81b6a3f43686
SHA256 30f1d12f90b61f22130b22667f722aeca0aadd59ba3e19d866d72a99a3f0ce3d
SHA512 17686bb9e01aa108b9b62b33bb70bb8aa35e4d88199281aaacbc8d8da7d54f1f353bf31a109dc22a4e404780ece4cb3d23f0ec81f80e9553ef060011e568134c

memory/4668-19806-0x0000000000400000-0x000000000041B000-memory.dmp

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_comment_18.svg

MD5 1bf37c0336c12ccaa1c62386acacc858
SHA1 f1e187c79588e4e9fce931997443d7e5cafd1db6
SHA256 a9044f3c6877f4fa6789bd90f11813a22696bda53e0be17bf52229b70fa87673
SHA512 f75100874b1dd43c49f54a9aa4621e8bd1efa84359ce44ece2444b639c7bcbddf6564f6c4be089f5d656550c7293b9f5ec4a4b20880939fbeb5ebc21e30866b1

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_filter-default_32.svg

MD5 81cfb9735fea15ca8791a3c34a78d992
SHA1 9b4962166a47f5edc62e5fe3c4f8772446db9296
SHA256 3d89171c24a889bce28f04adb60f08a141584b7c345b158536a72a8070c252b8
SHA512 f6ac853f4012ddcb29e5079ec00bf058343af1a6d6cedbc9613056db0575c77e964b0864c9693a6e02a525d5e13ccc54e0e7fd938ea39c3d2c6005db959b346a

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_filterselected-dark-hover_32.svg

MD5 55215e8f92d35f26cca06fa9d5d221e9
SHA1 994838c8df5921e3828749a7703ebfa8383e43b6
SHA256 e94ac27227c8a25c3f8ede219fd80ace01e7176a12111125b31ae1dcddd487ae
SHA512 7972d3fb8c305a1b41f3ec4a618c9904c1e655fc757f1dc83f9d9041433f3c30e6708ed3d4fb3166cc41d9773df3f159aa44333f76fdde28f317676046bc9c67

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_folder-disabled_32.svg

MD5 6ed14467c19d47e477a56f007e28f076
SHA1 87f18f0e27d3ab7f1ba99aed3a9e0a21e026a8e2
SHA256 f4b6949da1382fe465cf0c37332dcd8289edd0324d595f715cf258d63d363c3c
SHA512 56aa02cda87956a7179780fdbee280bcde12e17fce70e6c52e54b04cf8e32c3f38e67726be64e5e5ce5cd7645355b758b5a5ec611167704ac79b042a4abfb4aa

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_newfolder-default.svg

MD5 2807924fc18c958c38a7004a5dbd4091
SHA1 85534040543c3306284e6a475999c46249a35e4b
SHA256 0345bffb28f80f4d0ded1a2af09a337b18ab3a80c68205bc8321a6ad4d409500
SHA512 264d29c6b920b3005ebda1fdb0e0ee6e17059c69d63969c61ea4b5c5464022166ccc04b2c1f69b91052c3e3dd551a087e8e5379d2a62c452184a12b278a8ac3a

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_remove_18.svg

MD5 cd5d2472a2bf9ac7eb4e15146b30bd2f
SHA1 bca600423f99b87df44fde9d96ff874017037afe
SHA256 038589c0f8f0b9fbed7fe7835de0237de4a28ea404078955a78c0b8145fa323c
SHA512 dde83047b85cf0afd4ac77c9f4e850ebba48a1e1d581ed78c30733f58a9d5e2e22d34a2b2e57e4527f3c314f84922c3aecd6366052d46e0d6157990ed888a27e

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_selectlist_checkmark_18.svg

MD5 bb80d204c09023de9181edf43dbda1b8
SHA1 9e3b9dd99a34d35de68b3d1a4476e6ccfbd9ba85
SHA256 d5bcc5fc57c056779e8adfaae57d4162825ab3d879f5aaf11ca5404c3df0ad16
SHA512 7fc8dffcfe7c5c2e7e02be42f17e7294ed98ec1403b9287bc4db569a8471864151014ee7b91652612c0d6aed0542a73f341f3c7dacdd7a0beff34fe186777c80

memory/4456-20020-0x0000000000400000-0x000000000041B000-memory.dmp

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_sortedby_hover_18.svg

MD5 0498cfb8aae1383c049e8ccdd85f3abf
SHA1 c5fbfcc70b441e91a5ecd23295c745aaf076aa4d
SHA256 ad125b854735c81b5782a65b5b006c7c991e28688b6dd8e5998f432976b9223c
SHA512 113f19bf726f79473ae2b4406a76676ec0bc4709a26f374aaa3bbd9d0b5790ee4fdd8ebe1a3ab68995973923ae33df7c1c6798e93bf060643c14acfabd4e9302

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_sortedby_up_selected_18.svg

MD5 30c9bd1aee3794fd46bc99fc2a359212
SHA1 9817640da0b98babc461d277a39b323dc9a76cd3
SHA256 4b10fc416763ad7b65a6d6fb3c0016505ec5aaa7a117021a26e4dd6d11fe7d1d
SHA512 bae367b7555f5f7f677abbad1dd548225c2580ffe21bcae5022f8eecf8c97cfe8f7813fd86c31a7f9052c174610ae9d2ae21ac22b381701975492e2386f67f94

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\dark\arrow-right-pressed.gif

MD5 e3c4dd21a9171fd39d208efa09bf7883
SHA1 9438e360f578e12c0e0e8ed28e2c125c1cefee16
SHA256 d4817aa5497628e7c77e6b606107042bbba3130888c5f47a375e6179be789fbb
SHA512 2146aa8ab60c48acff43ae8c33c5da4c2586f20a39f8f1308aefb6f833b758ad7158bd5e9a386e45feba446f33855d393857b557fe8ba6fe52364e7a7af3be9b

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\hu-hu\ui-strings.js

MD5 0d3a12fd3f68decc694da04b57e61d8c
SHA1 f73d4d591f6ef0b2b04fc90d2e840329f7590743
SHA256 ee0352f75df1009fa6f5eaf323a1ed55c127cc679ac6b9de70b1b3f8dc9ece76
SHA512 2c58a879d4022b441056c85c301ce26401da5f7bc9619debd35fa3bd98b5f1cab8f21e2ae5a177865c64e741dae18f39f99fac1cf00c468ba0e281037d5e883c

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ui-strings.js

MD5 68b6f0644d50595a97c9fd60b8d8e697
SHA1 a4d0edf9264ce1922dc419c7f3b3cedb2814bea7
SHA256 bf9b3f1f9a3a163d41b1b20a2c410355e6ee72ae97725a7bad97ad23993b0b5f
SHA512 d1a26cc27c302f06419abf97507c0a4d06729aeadab615acaaac0c3fcec6d7715e10642121a4d773ad3d5f613030728e49fb3d07303fad05f7a342352ebad003

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\rhp_world_icon_hover.png

MD5 65c9f3fb24b80d8c470d518f901b9c60
SHA1 b9521c39944357d4b55b91f9f3739575d1f3bef1
SHA256 8de76ee7eb6b32c307d4a46a43ac55bc15b917e2a24d36c3d001878a97fd39d6
SHA512 6572d65abd587055a69980558b2568266ff76555faadf3ddc93fa65bdd7a009a2fbca10f37f44c27ae889d3de99a3673c2b9ba6e6456242e951703fa32d9c636

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fr-fr\ui-strings.js

MD5 dd24e91615f1963a5c64bc9878a0a8d5
SHA1 407ece3322d57d16a448b5522d4f29229f80b8b1
SHA256 4cf9816ed1062189ff0c8d427fba5e912cc68fc9af76cf7f08fd255977de3b33
SHA512 a88d5e6fcfd998b0abe79b5b314f3f83f424be9447dca01e1a64a3e7313eb247baa894c10c5758c6788cad27582c09207d00d2e7bc41515e7f1751e05aa812ba

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\nl-nl\ui-strings.js

MD5 1ea3b76135bb4a589027d6243075a936
SHA1 2951fdafcb862ef53fcf213572368bd5e08094ad
SHA256 c960c819e997c1c9d080235a5e24e65059b63cf66b95ff3da9a44773ebf81c1b
SHA512 3c10075e71d2e44535e19c8660bee7071a110d07dbef67ccc4cc94c45f93afd72f8ce6b24be31e6193549823b7db204e20950e5c1a075ae159c39682db295d27

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sk-sk\ui-strings.js

MD5 b651e9101be833e87337050028831efd
SHA1 ee594ba38a6324369ffc7b4dc89407d3436e34d9
SHA256 4717e5fb82c0ee85a7c97d022f410990a62efa2492070e42385cfeab67afd619
SHA512 3552858c2a688c95a76c0bb8a6a76b119b744b2e8ae7e7f30135ccd8a145318762faa52c1783a639fb179056317caeaed20c15f211db1d45bc957bc3ce591aef

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons.png

MD5 3f7323acc829bc8b3799148d439b3d47
SHA1 3d3c540c4080462a8013d6db9383ad69606779e8
SHA256 d9de646d51650572b66a6cf8a52ad1efd46b7a47830fa7972da0bc05baa2fad0
SHA512 09e2a175dd874ac369331fbfd863be20c9ecc005bfd6c7eeadac071804653265e4f7195d70058f2f73951a6a6e202fc96930f2ce71c2d815b228edf01729b559

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fr-ma\ui-strings.js

MD5 fb4aa89fb89bf94d0590a3174d1193ff
SHA1 c3812f2105099071c24141a994a9d5087199dbf7
SHA256 655a3ef0465a9f30fddf25f4dde0c19a05c6f9069b83961800c1944165955273
SHA512 a494c0d9faf3defa9ff320421d0c00e4e39845f7e998c6a06c50b5e7edbb1ed7a948dda23ace06a3433843615553d2357f1cb04acb4ad1155ec43f1d07511524

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\uk-ua\ui-strings.js

MD5 a90f5732d4e24d85316da98b11850db2
SHA1 0bd5f84ab9190941d435d3137a9f228a28ec841e
SHA256 761b731ef9b5cc0ba757b25a9d7deb3e19aaf36577e7cb30099b7497c042e76c
SHA512 c1909e15d003f3990dc0bb5c2675608998734d726001e491089003d9e64630250c677209586b774c654ce6b8d669ea4a2683fa0312418355a6b949cd490fbd70

memory/4456-21404-0x0000000000400000-0x000000000041B000-memory.dmp

memory/4668-21420-0x0000000000400000-0x000000000041B000-memory.dmp

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\example_icons2x.png

MD5 7ab2ac51d33778dac850c5dd8b4ba45d
SHA1 b3f47f20c438aa488fe835e0145c014853ee48aa
SHA256 ca17d6cc1f7ab317c34a7cb767ad017163e71726ac648518679c6b1c59fa86dc
SHA512 c14ac0ad209625e0acb2ca9e0afc5f6c98901b01f92b675d073b72929455f47ccf29cbfdaa248c602b02fc2bce484c56753b1a54e66f6ce9df2ea57bed88962b

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\rhp_world_icon.png

MD5 2a78f84427d1d591409740722e60d793
SHA1 304f17d9c56e79b95f6c337dab88709d4f9b61f0
SHA256 4eae979bb805992739f77e351706e745076ed932d3ef54dd47ba119c4c2fb5c6
SHA512 d687c646bba8b801511a17b756f61a1209ea94938940fbe46d9e4893f14606f9e1e5ff468ba4a77474603f5cdbe0cb9df3d24767e5c9ac81a0b373dcf4a4f3ac

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\hr-hr\ui-strings.js

MD5 07bcf4e882ae521ec6ddfd0bb2a608db
SHA1 88e2ab25dec6ba9fedced9bbd21da03639da9409
SHA256 bc9df2774317cdca8e5a702f249a6994fa3b63852e7749124e82ef1f37b89aa6
SHA512 ceafee63fb03e94b418bd87c6af91a53c9bef53b86eddb51a7aee77d8ad5e6654045da12c3c28f3ab4486d2f6f135f7f834790991037708b0301085f62e22fa7

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\root\ui-strings.js

MD5 0ec670fd70f5e89c3d2727df9f2a5398
SHA1 d19c88c8e11361d4f29719518b8543e0ecf5ff09
SHA256 8267479623714339b61159b2f8235b15a38ccc1199eff859e5dc13359f8711c3
SHA512 a429234afdc29df1276238d3e329299a6fb5b1ef6044429c1acd8abb95c0b76a14836b47805c5d464cfc95978f5e3b10eceae6c26a2964e2c352fafe1d7dd6f8

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon_2x.png

MD5 c7fc95def1d53bd3e747248ecbd3cd5e
SHA1 1b251f02465f9c7dce91aac5aa0679a3c34318e8
SHA256 4049b739e6322c7d7caa241ac41c8e0b1f2893957204a910c9708c7731a7a8b5
SHA512 f4b90435a3b250c1d3dc8df9bb4d331dfe9b1c0212eeb1768073afb81b3915fe61a7c4af151c8090565f778dbdf1f4fad7b5f545c9a21b7782cd7671be2ac96e

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\dark\line_2x.png

MD5 b513ae819f7d8d10fa4f6cbfdf055b22
SHA1 b4228971cceadd4a698f3c206d8f4bc24a37f991
SHA256 25778f162c4243167f8eaa876f1b0619e67afc158de7805600471a563ec5e8b7
SHA512 c11266406d79494f7d74f8f8a5f955e2bad14b8924877e882fb3e7cc7442998cf6e7a9be3aa7f1a945af8bb2add9dfcdec0ef54239f6ee80748d77444dafe6fe

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\ui-strings.js

MD5 b17a6a8826832fc2e1098d0286242861
SHA1 8ce2bb5944d61be2b628fc80ebabc769768e0b48
SHA256 82a1cc52037ccd1ee4a73cc41b86ef4c9b45db28025d56105566bbc9f06bc41f
SHA512 688757cebb6aaf1a9948ce1dd30318ac2b7afb7a47938e6eecf1bbbc1be058ba78744c208d71a9747ae514242b09322489ad314119cf612a7e4a717907521962

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\themes\dark\files_icons.png

MD5 80802b088528adf260a52f1563f68b85
SHA1 ef4f8b7ed9c912df3b77387702d7e773b205009a
SHA256 2e9d958387b90088b65dd5d7fcd08a7b1d78c6476ae4c66537c2aebd9aa65ebf
SHA512 75fc10147c223366eb266249f4854e0537599d0c66825c02a26d20bcd6a3257b0a2d8baafe9b376115f7cbfbbf530b523528ac86417ad316b13ec7bec9d9b500

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\css\main-selector.css

MD5 651bcf535ed50ffa7724c8751bec1a66
SHA1 5758c4862740517ba28026c298d1b3a61f43716d
SHA256 359f38eef400e2fa3924a3258652e74ee19cd46cb92e47bce91f1194fce25e9e
SHA512 492b73f1622e8a1a064141a2edbac9fb29e5f604b629b063fc7251289d237e50721e1295b4f3450322fe72f01b57561a79f0ad4b3a20290cf3214ccf0204d372

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\bg_pattern_RHP.png

MD5 bec4473fc43b77e28e60f89da4e29c00
SHA1 d5dbc7c6642a8a23da14f952a0f64fe874e8191b
SHA256 5e06bfa9ebccfa3d8759270620b6860f0b92be9d69ef7d7802b78ee5b5f07f96
SHA512 ff2c101c1172e64481be5e98b2216d5eba93b81210a1a67adecfe05bcf37c3d965c06b368ddc1ffb7e4187cda0373720f6a27476f036a41517762d5cb3729aea

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\en-ae\ui-strings.js

MD5 d3e4c2fefeea6e6c467df305f7a8f3af
SHA1 a4468bf4d5abcb4d720b0fefb396dce5864e4717
SHA256 e9288289beec2fe3b6ac24c1311451c8d079786a09515b95cbf2eda7f87f0b22
SHA512 b81a9d38a4a6cd54c2081289192ce7aee3e34d71f834c9b94eac8cd79a5cb90a0dbd3ee0da89be68e4fb69a82903c658addc272a9d70d8f8f8f8cff5c2c18f10

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\pt-br\ui-strings.js

MD5 a3f07671642038caece41ff2a52d8673
SHA1 53442624b01b79a3729a23d4f12efc8dae4b1002
SHA256 088d391d696ec15140e7b4dbe6fe17e95296af9d09c7eeff17a0a9c241925b89
SHA512 5d1ab4b072eec924d13d760da6aa958cc81fa58cfec3de8ff239d131d37b31cdd547eac0fa5ab34c060f0f28a2295e071a1a9573815541c5b92cf0c63f11bdb7

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\tr-tr\ui-strings.js

MD5 74ca2c01b07af0dda4bb39ac330fc49c
SHA1 7cc7781cca7798ce0940fe9be999e85f8b5064e1
SHA256 ab9ac8d62fd064748c921e6bd4c123f5cc8910a384d1804bec33ffe27da27c4c
SHA512 cd71201d364c7cfc9d317f091a9dc318d77bdc7340ec4abceee2fa23e3f58cfb1a8f45b5216f5ebb40b3738fef28eeb37717b2508aa1369316da6b7c82c510fa

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ui-strings.js

MD5 df3b4d35decc08d05ef8ee0644ab7274
SHA1 6b0381b9ee40dc8470a63218e5cc5feb579f7334
SHA256 e27e5eb93a24a2d866e30bf027e4f0c3da9fae8968cf5eb69446e7f668356164
SHA512 257c770416a94f5b79ed837fa0f5e7926cede3ce06c1a9b819c1ca77c645f37bd366564cb028b0ba6afc5444aa5ac774c3af36cd7c108164d1000254cf85c94a

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\bg_patterns_header.png

MD5 39e7048d412b94bb2dad145a2daa5875
SHA1 08778bbd84d9411f2e531867dffe45fee5d60d24
SHA256 4985216f1f370fff03c45d4a711c18b3f49165f8278e6cfc231bb38b920095a7
SHA512 65803d69def3517f0021a291748b55cb5bb2e8437732e6cb9b99b1f778f766fbff2c484b664d16ccbedcd51c14f89e99cd5f977cf97d680eca78a9d4f8b87fb0

memory/4456-22615-0x0000000000400000-0x000000000041B000-memory.dmp

memory/4668-22616-0x0000000000400000-0x000000000041B000-memory.dmp

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\en-gb\ui-strings.js

MD5 92f1f77de0ce17e9486d53787f69618e
SHA1 41198fdd6a18321c15c3d4647962e687fc036af6
SHA256 4ecb5e390829b5b11dd02db2f22ac1349e32a24e5bd3a8489f6fb5fb0f07eeb6
SHA512 b389c8364936fbb96a407fb1a848254fd8b7bcbde05637ac1acfb48ba0b30e887dd44b2447e1e3eb75a902241d67571584a819927cc8d0a91d325f5df79f12ce

memory/4668-23407-0x0000000000400000-0x000000000041B000-memory.dmp

memory/4456-23406-0x0000000000400000-0x000000000041B000-memory.dmp

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\ui-strings.js

MD5 72542b122d453927f3d6c59552165606
SHA1 6e2b7f049b60f10edcdec06f357114448c0896f8
SHA256 3b17f8b83bec3e72acd0d014f58e7de206106a7644bf3293f93c7456ced47419
SHA512 25eade5c88cc35325978ba2e103050608fed4330a1677280eb2e0445946a3367d26796ca1233aa6d7ec4c87f04faf7706d82c72b3f3485d80c18e088813f7a1f

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\themes\dark\dd_arrow_small.png

MD5 3d55e1e012d3824e53e84d404a6e2f2e
SHA1 9983296698d4e2736faf1c529e8d27f8071d7939
SHA256 6559f403524ea6ef9bf2e1d0bb66d1af8152920fb002ec2c4ced993083124a88
SHA512 ec75d4dea30bf7567b2f6e30ffed408815c57680a38659f6055d770c85393d8a5678d38a066ceb7fd0ff9c5ef49cf9fd73d7e8eae5a9a83360a41ca74343f576

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\themes\dark\dd_arrow_small2x.png

MD5 4eefd60f439096ed98b6d8a585da12ef
SHA1 75cb70498807b0c823cac760e00652842c1a63c3
SHA256 e743d6195ff2f42282e101f9471874e8df79dc05a69ca20abf22015d48d28c6c
SHA512 78241e2336f4ee826719d5adc70543db0f0767a1660f723ddfce72c170322a13c0f3c547eaea6b6cfc47cdf6d8e5edcaff4bd003cbf3eb9d3435bec5158fb8d2

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\themes\dark\s_thumbnailview_18.svg

MD5 9b4c8a5e36d3be7e2c4b1d75ded8c8a1
SHA1 1f884298931bc1126e693e30955855f19447d508
SHA256 ad47fd9e87159d651a53b3dfba3ef200684a9ed88c2528b62e18f3881fe203b0
SHA512 e1acc0b10c92c2895fc916fc8feead869e04315e5e6e279f8e61b344545103b4c9ff808c9ca2121d1b013879071364f677da128caeba89bf918ec2791e5ed094

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\root\ui-strings.js

MD5 421cd12b43e660f10da31bee36e85f4b
SHA1 b568bb931d5bf4b5805d20fc339b06f9b3763c9d
SHA256 ce7c16adff608d624a412164fdc692305fb461f4b14f9167e6efa78dbbad12ba
SHA512 f56bf5a7a713cbf018203c24a7f9dd426a2cf018cb3ddf9e27f3a7765be3571339421fa5a2cc68f677eb4929a2a2835238a723db4de07bb0634e3f151878ac86

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\tr-tr\ui-strings.js

MD5 7d8302df4582de342a31d0335e979ae7
SHA1 7a3e918e23dc8002dfbe1695f8e8fd52db995d1f
SHA256 899ad5e0b3501d7e00d2f3bd3c7729b4223839e8629c61328db0f818ba0870c9
SHA512 cbc23b3285f6d8d72221d0fc05ff59336402005e7d3f50d66249ef6076648ec2e22d33ed64f5436767c123f59d37dae45270a259153ed98b885f9c43ec9bc2aa