Malware Analysis Report

2024-09-23 05:00

Sample ID 230629-tma7wsfa5v
Target 3a2f6e614ff030804aa18cb03.exe
SHA256 3a2f6e614ff030804aa18cb03fcc3bc357f6226786efb4a734cbe2a3a1984b6f
Tags
bianlian_ransomware ransomware spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

3a2f6e614ff030804aa18cb03fcc3bc357f6226786efb4a734cbe2a3a1984b6f

Threat Level: Known bad

The file 3a2f6e614ff030804aa18cb03.exe was found to be: Known bad.

Malicious Activity Summary

bianlian_ransomware ransomware spyware stealer

BianLian Ransomware

Renames multiple (1817) files with added filename extension

Renames multiple (7720) files with added filename extension

Modifies extensions of user files

Drops startup file

Deletes itself

Reads user/profile data of web browsers

Drops desktop.ini file(s)

Enumerates connected drives

Drops file in Program Files directory

Unsigned PE

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix V6

Analysis: static1

Detonation Overview

Reported

2023-06-29 16:09

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-06-29 16:09

Reported

2023-06-29 16:12

Platform

win7-20230621-en

Max time kernel

30s

Max time network

35s

Command Line

"C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe"

Signatures

BianLian Ransomware

ransomware bianlian_ransomware

Renames multiple (7720) files with added filename extension

ransomware

Modifies extensions of user files

ransomware
Description Indicator Process Target
File renamed C:\Users\Admin\Pictures\UninstallMerge.raw => C:\Users\Admin\Pictures\UninstallMerge.raw.bianlian C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File renamed C:\Users\Admin\Pictures\CopyFormat.crw => C:\Users\Admin\Pictures\CopyFormat.crw.bianlian C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File renamed C:\Users\Admin\Pictures\HideNew.raw => C:\Users\Admin\Pictures\HideNew.raw.bianlian C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Users\Admin\Pictures\SyncPush.tiff C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File renamed C:\Users\Admin\Pictures\SyncPush.tiff => C:\Users\Admin\Pictures\SyncPush.tiff.bianlian C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\system32\cmd.exe N/A

Reads user/profile data of web browsers

spyware stealer

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Hearts\desktop.ini C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Users\Admin\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Users\Admin\Saved Games\desktop.ini C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files\desktop.ini C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Users\Admin\Music\desktop.ini C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Users\Admin\Contacts\desktop.ini C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Users\Public\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Chess\desktop.ini C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Users\Admin\Documents\desktop.ini C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Users\Public\desktop.ini C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Users\Public\Videos\desktop.ini C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Users\Public\Documents\desktop.ini C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Mahjong\desktop.ini C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Solitaire\desktop.ini C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Users\Admin\Favorites\desktop.ini C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Users\Public\Music\desktop.ini C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Users\Admin\Videos\desktop.ini C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Users\Public\Recorded TV\desktop.ini C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\$Recycle.Bin\S-1-5-21-1437583205-2177757337-340526699-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Users\Admin\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Users\Admin\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Users\Public\Libraries\desktop.ini C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Users\Public\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files (x86)\desktop.ini C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Users\Admin\Searches\desktop.ini C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Users\Admin\Links\desktop.ini C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Purble Place\desktop.ini C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files\Microsoft Games\FreeCell\desktop.ini C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Users\Public\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened (read-only) \??\F: C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Broken_Hill C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-profiling.xml C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0152722.WMF C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Helsinki C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ECLIPSE\THMBNAIL.PNG C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD01193_.WMF C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\INVITE.DPV C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\SIGN.DPV C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\fr-FR\Look at this instruction.txt C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN04225_.WMF C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Discussion.css C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.text.nl_zh_4.4.0.v20140623020002.jar C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-keyring_zh_CN.jar C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\it-IT\Look at this instruction.txt C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToNotesBackground.wmv C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsScenesBackground.wmv C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00837_.WMF C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\accessibility.properties C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Portal\1033\Look at this instruction.txt C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGMAIN.XML C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02753U.BMP C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00483_.WMF C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBBA\MSPUB10.BDR C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office.en-us\OfficeMUISet.XML C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01744_.GIF C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsHomePageScript.js C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099157.JPG C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0185670.WMF C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\OOFS.ICO C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\LETTHEAD.XML C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CANYON\CANYON.INF C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD10264_.GIF C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\SIGN.XML C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt.hyp C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH00527_.WMF C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_sv.properties C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.syntheticattribute.exsd C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-visual_zh_CN.jar C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\Look at this instruction.txt C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Outlook.en-us\SETUP.XML C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\TTS20\en-US\enu-dsk\M1033DSK.UNT C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Luxembourg C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\org-netbeans-modules-profiler_visualvm.jar C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\browser\Look at this instruction.txt C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGLBL001.XML C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Paper.thmx C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\title_stripe.png C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA01866_.WMF C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\GreenTea.css C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\MANIFEST.MF C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.http.registry_1.1.300.v20130402-1529.jar C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\button-highlight.png C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\THOCR.PSP C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0199469.WMF C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH03012U.BMP C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18231_.WMF C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0186362.WMF C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01140_.WMF C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\WEBEMAIL.POC C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files\VideoLAN\Look at this instruction.txt C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Computers\Look at this instruction.txt C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\JOURNAL\THMBNAIL.PNG C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO02067_.WMF C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SY00132_.WMF C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe

"C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe"

C:\Windows\system32\cmd.exe

cmd /c del C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe

Network

N/A

Files

C:\PerfLogs\Admin\Look at this instruction.txt

MD5 eb2edd7202757cb7b8a8a302be8fd64b
SHA1 c86c459e94a28527d37fa889eeef268c7438accc
SHA256 5a2fe19742cb5066fba0e226dfb06f86f128a6c0314f3f19ad992dc8525069d1
SHA512 cee826b228cc27ac0c0d9e2a1a39146b6309dcce2e79404cc4be0088da1b8a81501ed71ef3f36a328387ab5d0d255d171f7b97e6384c850ea6b95f93339e3ae2

C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\Style\SIST02.XSL

MD5 e1ceefbdcc0387664b4f1c682ff26cb4
SHA1 33fa78530ae6fca17f18db905b21d86d860a5ebe
SHA256 9ac6281034c250064f21ba921a1e69996bbda6ae9a675c4565cdfc0c6c0b7a88
SHA512 33a6c5227e219f5a968137952baeb3cb54f3dd90f296637cef7fa64dbdb58acd45e050eff6ccfb80b66dffe4e8eeb8cc663270a799eeb67f2b5a202f4ea00a07

C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\InfoPathOMV12\Microsoft.Office.InfoPath.xml

MD5 7935c2cd6de21a38cae8abf8d0394ecc
SHA1 2b3cb68384584bb3b6b39bf8de5ba8ec41188cff
SHA256 e1a074b388c372f4211d1b35cf57dad8d9d9d5098ba42ad4bdd0a4c52a8176f1
SHA512 5ed2d98f9535d69eb32ce10113b30a52107b9d53f866702aecb0633cb710ef33e5746cd0e449fc55e3e61f5d7792019d28fd74e4e7583b11a57f19ac1cd058e9

C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office.en-us\BRANDING.XML

MD5 5dda6717e6953febfb70ab8135d52c4d
SHA1 fdb78eb981f5f5d4b4bbe203f378e599ec6c795d
SHA256 fd565e11ff476e281175f04f75d02792f8f47b2a25453b7f7d5d55e73d9082aa
SHA512 c60ebd1c44991103f2eb828a9882c3600dacfba0f463cc8809e486dab060c73a7608ce49cf4e1a1e1e5f60c1c8475c0250c221396233611def123999ba24aa5d

C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\TALK21.COM.XML

MD5 cb0d96cb9b8dabd9cf7f9b60fe02582b
SHA1 fc436792f572bf97e61a3b1d31fe0610ee2dcd20
SHA256 6664430fa082e2cc88253438d9fdece6a1baba8980d3d20851176901022285a2
SHA512 d25d4b9ae0966e9609c2e1d4721fd4e589c196988d80f090323dd9e5e242e5b01317918a1d3504ee44fb798d4c6ac90ccf4629e093ba690f500d3dab413b762e

C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.COM.MX.XML

MD5 b549a4910a0395848f0bcdde322ce828
SHA1 e0bccf0dd7495640ca5d33e0ae01d4ec8520c108
SHA256 e63b6d02b9e6701832c2327b6dac4ff3b3b186465c8568ff491964cd2e4d7e0c
SHA512 256ed53f846cd42f4683a696a6f5ef55a087a2c5b2ae2c68cb471e1a2f88f5f0eb9661f1cd5084560fa3d8cf718e99ce687ddfdb0d181a3b2c4d4c328610d354

C:\$Recycle.Bin\S-1-5-21-1437583205-2177757337-340526699-1000\desktop.ini

MD5 733f0e276869599d8f8fa02e83cef549
SHA1 4cf1e1259b7bf57fb66056c7c42a99c802f2c1f4
SHA256 3422b15799710170487bd6bb8cb6dafe864c17bdff1f855c0de4b4b60b30f86f
SHA512 236c309d4b3484ba0b61ee77c4a76ec9e183b7ff61c0ec7a6a95771463c83d5b32d48e6ac9387a3793c9a9c1df5eb07f562dc0deab9ed4889827f37936f1ceac

C:\ProgramData\Microsoft\MF\Pending.GRL.bianlian

MD5 88be4bbae28749af4a1e2c9cf440da0e
SHA1 b2cd233fb5d6404e9fa4773fb212e0a0da36ca84
SHA256 3707ebec8a9a9693ae65cea0fdbd8a17d4523f7fcf8864f37027fda96082fe1d
SHA512 4782e27d2ad86edbe5bc1cf5a61af81cfa362d08fbfd481b2e455ccf650289e624724245bd919872e5260fdbd4f3322204840c36e7f77229e87c6c3e23d8d160

C:\Program Files\VideoLAN\VLC\locale\lv\LC_MESSAGES\vlc.mo

MD5 4515e969390ddd10b76a308bb167b5b0
SHA1 9935db7cd4487a53e6313309935682040b7ad123
SHA256 f7474efb4ecd6f22415939c070b80679167e5d660ae9ba832b5ec0c1eb70e703
SHA512 1e285207c35849433a24189e497eee1cf419b5b848607fb45950bf7e1dac62feeae09193132735eaefcddfc7ae909565f221203c9f1026bf6970992c507eb0e6

C:\Program Files\VideoLAN\VLC\locale\ks_IN\LC_MESSAGES\vlc.mo

MD5 fc33d0e213d4952a143b68c22f940158
SHA1 10981075fe8a7de0b33a9114427232bf9dbd617f
SHA256 d19bb270e0612d47658b5e26f1962455232d3961ca4471af3f14041492c8fc14
SHA512 c3d47fd793d849bf849ebc598781faa6c9ebe0076a425a0f43db1e7285f9b0818c31077b035a171b7b1de337540caed5e818345eff21099934e83b7f42b841e8

C:\Program Files (x86)\Microsoft Office\Office14\1033\EXCEL_K_COL.HXK

MD5 4c1fb5107ac6da0c9b1ac679bb13a545
SHA1 d93deb539fdd1d60d9e567431206acfda20274b6
SHA256 edd819d6d6c112f443cb0544e3478b609a64af9dd4a94ef9544ee7ca73d8a843
SHA512 bd9320bd5a7d8e58bbee298d5f4f754d40f5e87f2c169f24d997969637360feaacaa157f559da8c86dc0bd4b758960119563cd2dff0f75f2ec7f0bbb32107f3e

C:\Program Files (x86)\Microsoft Office\Office14\1033\GRAPH_F_COL.HXK

MD5 a41efeb5c16200f993713605c142cc5b
SHA1 640124cea394914ae6bb5109f20b63c7aad62a98
SHA256 f91dac0fb6a49b5585f57090a5d4bdf738f60420544562fa02eeeb20767f9245
SHA512 71a6e8aa915c1e20bfe569b3f014e5b41e5e50e5a7bf667999e8f3b9365c47447991896d6fd7ccb114de8e7f52bdfc09c13d48bbc395109136a404354a461a7a

C:\Program Files\Java\jdk1.7.0_80\jre\COPYRIGHT

MD5 796b6ccc73833355d4420bd56aede607
SHA1 d9627190bc5e9a4e4d1357717d6fcd45282b4441
SHA256 fe08a91e3f412509a6550008e8b7a816c6728bfb7fd4268899cfa0a1ecea9721
SHA512 bbf2e77cd39cab8c6725924e55ec9bac1656d8413cbdf8475665a9ad71423ec5018ee128b1cc14e70b8899a80a899f32476f545bc81b231ca89c38bbf76b5d67

C:\Program Files\Java\jdk1.7.0_80\jre\LICENSE

MD5 629d093032c020360364e47422d02daf
SHA1 0708d01df4a6f2e977e5ae57044037ba1cfa39de
SHA256 fbc2d77c65f6898d2a985bbfe5d2f668655c38edaf6fdb2d4d9094493b77cebf
SHA512 a03b5bcbcb5d471160a0c9f01191febb350f4376d0065d76612536d7e9b20c56ddbd9f15743717561c2a2198a7bfe0e4966aca8b5b6c9ab9238e983121987750

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\MANIFEST-000002

MD5 f5b854f091406db62644930ed9417d0a
SHA1 ae7f69d7941fc44944bb7b2aec10f9079f701845
SHA256 45224139a7d96482fa2342830fc0fec579622b29a173958ee67b4d5bd9918f83
SHA512 187cf47247457e5515e2a78c7db6ac1c9d0eb944265f627c23ccb472189e34c5daba28c2380b5f82a49762f36e7ad7deea4dd1b3dd74ee3ea774f9c1ba505bfa

C:\Program Files\Java\jdk1.7.0_80\db\bin\NetworkServerControl

MD5 7a77ac5b6bcc15bd02f318f2826b1bbf
SHA1 cd520fc8acd13013055ff780d885a7d5fc0cc692
SHA256 6983cb70a5cfa0f8f5ab729bb688edee78e583e3a0ca39cebdefa8d4a98507a6
SHA512 c7c0440b5a933d8eeacbe17efefefc20861c1a5216b7c6724bbab82ca6c321d2eefe97a56fe4767506a2894644ff7d02aeb1db73f6038e21c380f85431684950

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\SoftBlue\TAB_OFF.GIF

MD5 984f2c36c4b95b44fed50235222c7536
SHA1 3dc7dabae8ac9b510601065b066ce58a1ec5b747
SHA256 ac7672bdf11c1bde54223e599672a66f7351f34376536448a53606f0d902a94d
SHA512 b6a781e6ac802908ec3de6fa8f03f46d0820a75febc38569d081ebce0563011fcf20bc782e1eed716b5446df8a2e214f037fb531daa9de304b012b0a9d87cecb

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Swirl\TAB_ON.GIF

MD5 87806198469613684897eb5e42f622d0
SHA1 57c0dd4afc07ead40ae8e1acc1f7ee589ca055ee
SHA256 5279ea99924d9a07ce5764bea785e781734b2c967d6d118ab177ff6dd8f5e978
SHA512 05078c20dbe96c85ef51b8e4b1ab761b0d7af23be96391bc3ff6c2bed024158592a20fa1e8322f2218c8b82799539c1368b0d8c6cd946c6fbbafe9611f5a850e

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\BG_ADOBE.GIF

MD5 4587ece052df9116a45da16b867c0c22
SHA1 f5b3f6303c8e0537ab1c4165f9dbd220f74d8445
SHA256 7efc6a03990097eae9bce64f4b8c8ab0e7e16efbb540a6dd33189f848910576a
SHA512 aeb9c9e15eda2432a0d3cc171a32e6acdb5dabb4c8184a1baf5efdecb03a697c9848bed1953af16e57af8a0f0e8f4347ca681147e5858f3e60aba448ebc359c0

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_Casual.gif

MD5 4bdc81e13fdffd35ac6ee7cfd24cdf1f
SHA1 13661f907fe71f1149b7e4db48d4458481e43745
SHA256 0d96d2febe009d6271bc4e73a6731addef275a5aae993e7c8525a89a690f396f
SHA512 a5c1fb6877e732e0101c2ef79cb42af31d6e55800f3473cc561f5bdce0d5eee6638c57e8ce3971ec5e7f8f038973837ec69dc398d9571d249ace2ddd1ba5a956

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_Country.gif

MD5 917d8eb1be9aaa0731a0efd68685aafb
SHA1 ac7152d1e5d0b78efb6a435bbd5a4be48a5cb72c
SHA256 80d8f66ee632d09f78fe2a955fe09b5311ab33712038499eac14ad2beccad9cb
SHA512 5e033cd27f8d2e718e542ba9aeab18272f20acb38b2451334f30e491b997bffd895cf0e37bfe6d28bebdd00c8b1a8d83680448f24b7345bc524abb3f1abe356d

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_Earthy.gif

MD5 f4dd9a85ce82fa3cb2afe36ffc14aa2d
SHA1 bb43faae2dcc3a52ebf76145e8dd303263a5ad65
SHA256 e9484b93ffb8106c025b64e05e978214bccc8151ae3160daec32698ffbdd3087
SHA512 1d95f63ba9421732f6f3bda2b5a6795c1aa596039d1428244468146b75922dbad8833c09199c5c66852d3cc018bbf5f4e82212a3afa1817f221e391aca5847f1

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_GreenTea.gif

MD5 0a34aeda5c3fd34dfa0418eb9d7eda6c
SHA1 b85fd90307e651b4e4a63e05af725100f39dcab3
SHA256 c234b881a8e66b0e4751f1468ee46c87aa9e2b4a206de3ef55af5e67e9faab73
SHA512 2859b51072509a8be63b888e9b07a97a53562ddb3b0a32c950d6dbe98d86ca563469adee8b7e7cc3c6d830c4afb67b0fe11f675a04ee23564a3d149076fad897

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_Groove.gif

MD5 00193c95cdb13f832a13deb6095bc7fb
SHA1 4fdc92c94104ede94a2a91f6248af20102d51c9a
SHA256 84955c78bd26293789f9a0c8fe075b5ba8277b7190fc19e7c9d89059800114d3
SHA512 5ee43cac68d904247d450c24b5a9a6788ee150c74901dbd23c75a9bbd7152cd413beb4e10809262ca7554aad3dc9bc7fa4fde14062b8e21b83f80cf22976758d

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_OliveGreen.gif

MD5 7a80f5f8ba1423cfec0d222f89c98cef
SHA1 38d8262e4a9347cca9f5641540cb447c128385e0
SHA256 6b14667f1f9a22c3f9f6be8c112bcc57ab667b2328c75f1612f09cc372c75bfe
SHA512 9db4bb9635726c6db92f1d25cd7e0b31af7e0fc4bb2f9c1b483f46985816f7249337fd62b9a444b2f6fe59e9d4042ad3c0aa18a598e41a0b7053ea17d2438356

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_LightSpirit.gif

MD5 efec55f4fb789e98982f264390ea416d
SHA1 6fb85646bfb76a3200b6d1342bd44a2f26912922
SHA256 5c144312459e41c5f2813b95eae95a1aa272bacc7b975c30aabeae2aeebcb13c
SHA512 d4c848a229ea4d1ab287935117af5dfa560f3528583e71e9c2c2c61a4e0ef9550dc133fdd9a0ca5475a6fb25b7aa5dc264cc64af2058b853d2aa0199a6c9284b

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_Premium.gif

MD5 a40595fbff5e4240c374a42af59884b9
SHA1 0d84c854ec90030e8cf88e1be915a7a8da23454e
SHA256 c5edbcfe0f813ff23f7571d56a2dd80a3b577083e0a9fd7866c907a6c0860188
SHA512 740b25804364b70cfd88118c73bbdb20718ea7c16bff6c4962db02a9c70464b7d7915bcbfd0d9c214392de84e68216a29bb2d45174ea8085c3f2d1ec5e4ec712

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_SlateBlue.gif

MD5 6f1718a621ba75ce567d7b2f2eec1c3e
SHA1 97eda255b0e2fc904151305d229361f93f4872a3
SHA256 33ba85684d56bfa5c8152884647503888a6d7373ec0e5eaf7c3018624100a1ed
SHA512 d8b6b6e08b69d68575bd8e1f13076657559291b6a47bb77320a55af682da5798301af7060fd8f099eb0ea5a78b7f896dd9bb3026213504efaf50aaa18992f4ee

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_TexturedBlue.gif

MD5 89611fab4165e043a7fe1d1928f234b0
SHA1 46ecee8762ba8e6614b0e978c9c2e704fc7b021d
SHA256 b3e562104184c21399d8d45ace865c65588e26b1d81aa59e59869f3c5cbb165f
SHA512 aa0bfbc0a1a2fa17dbddc448b5c5d8a4169e5510e9fc050bfe226e1187d93a9dac8dce424daab4426d32fbf48588aa0ec28e69903a740c0a19e53c86c41bbd6e

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_VelvetRose.gif

MD5 529756343cfc661eaca52279e03f9244
SHA1 8468b738d001849e734c96b1c423968e9b2ee14d
SHA256 c6312ef265b47fa55c85cb24d71023601116f47bf957b1ca9e117b078c02d382
SHA512 b913828a8faf25f9a73fab74fe4be2132f233527b83299df9f9484858310b67f3afd09ad42179a2aefd9fbe2f6367266283c5ebcfdad73856e663a196b990748

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\RTF_BOLD.GIF

MD5 ef7efe323aca4da1e9125d1dcba1e6ce
SHA1 ea5059515bb216fa5d6b3df5d4aac6eee8b40dcb
SHA256 7a0747fdba8e637246846e4e0a7a577086aef221817aff3c4a25080442877bd3
SHA512 aa2341a4f1340d4e89f70baa167415c9ac23b62ad6ee413575aae6abd373d14c9b985c6b3d49f49ff45ad46f05ce853e2d0798d833cf734d4d349be04d56c2aa

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_choosefont.gif

MD5 3bc75095ecf71658db63758744ed04af
SHA1 f6fbafc5b04b11e800c65bf6bd5248238f8cad26
SHA256 14c8ac38fb602068c3a6f33d6665e055748132b2eaa0fa41bc2e13479c48cecb
SHA512 fd033d1910dd533ed75e7e1b324b1695f80fc3fb3f467f273b3a179195c027a979d8749650d6394f40cb3bec786a74da6b3b0ab4f65cde59ed805f5b71eac3d5

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_italic.gif

MD5 30f7aff34c1eb6edca4e22f3c625e3cb
SHA1 0ab64c45ea201c3c313f420d1087bee29ccc62f9
SHA256 ee3428178b13686e66be0294bc7410dbfcbc279830150c7a870368c69db88ceb
SHA512 21701f65e20e27f499f04297e3bf49b5a9f4d98988537b33e9fb2cd8bdae74490152e93c7db0cfe9ff7c5bf4ac85239e61ca8c0937c53e4b0a60ed4f8bfbcb94

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_underline.gif

MD5 26e14d9d08c4a5f2d4b54da14a073aab
SHA1 9c868ee957b8f49310089a78d27cdbeb18dd6108
SHA256 b4f53262c86b5cf234ae4dd084a4c2753576664333510ada1b4da79f02354eb4
SHA512 7e10f409e01194e70f0bf2f8af63017bf33cffb118e0f870b3cb6aadae287b6f6a5fdbb2508d20c291107f3a0b1b0578181992d54e6fd5d9abeaf16001d0b312

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FORM.ICO

MD5 859893be44e8db95c4dc5012e1cb4e86
SHA1 fba0ef005163aca91525a35927c04882223c5c71
SHA256 30ed5ab67b10429d680f5e5b1818c36d540edf8e426a972d1d99e8b047d94614
SHA512 14e1dd699daac9ab50b92ba91961d03ebca51ba233a4a001fc112932574d37e92268660b2a664362e702547bd4442f1f46a2f01ddbf87afab2cebfa30dc9d9c6

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormToolImages.jpg

MD5 0b44847ff20c0423e326c1e926216a25
SHA1 32fa0d050862266567d2e7f77b047d48f97f619a
SHA256 216ac5f0508e3f1448a6225547abe63e89c91cc3f17346a9b8e7758d8bc08be1
SHA512 9afc62730ac88c0763db015cb389345017a471c8390f11ba053803da2d6e898612855cb4c98fa17ff04b84fbd3114e2e2be8b0a5a47b794137f81c11e541d203

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\VIEW.ICO

MD5 3871c2f608a0c9e903b50f045ddfdebb
SHA1 bec53b0c8f28c6f391aa4ad5dada8131d5eef5e1
SHA256 1a33a446caf68b8230c367ebd515ac053f02a1dfed2402e0d645658d1fde3afc
SHA512 90be89e1c56f2fa7577cf634baefaed0f33d1079bf88f741c217cba4e1283ef0d78520f04f5a66022aa677bdc92750a95a14ab9be347461747b1b137b3bbb89b

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\ViewHeaderPreview.jpg

MD5 1f774018b28f8931af9b6ebed1578e33
SHA1 0843fbde310f25520f6aaf0426fc13c4b11e1b10
SHA256 60b7b7bd15ea2133c3a9d079e78b31248641b57d427951841f0455f2408e0827
SHA512 44c161732adde3113dd6376956d3402da459fa9030383c365945a5d9958c2d0fa0f2b636d0ab603f505430a94ae4fc41b30dad2d8f79ecee56e7c8387ba54590

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\ADD.GIF

MD5 03471958582dc8ce49710d5342bc9644
SHA1 bc37b12780807ef5fe0032d31d434367c9316183
SHA256 fabb22d957cab00cc65ab6257442d9dcc927d6fc3ac873b85db0f73eeb40e84d
SHA512 09204f80caf1760c9c0c1db8d63d20d049964cd180547d8adf6d3148520b8b07bdd57d597790222e0d73e8b1022d745c823b61fa6aa7caa4413540126e3563fe

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\attention.gif

MD5 880052b7a6d3093552bac2b2a82eb3a6
SHA1 c1a7c68a7931c25d4afe7c24a409e25151f2d176
SHA256 b4f9078c67c71252cae8fd160657523a85d447d9245c2a3d97d47784b63839f3
SHA512 f9a5378790c61675e53802cacbc09f7f768f850820e5f081d5bb1da563ba16ad92cc9488cf79451aa3e4cd113fb86e108cc513d01d3a6816c94e3cecb47c1055

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\CALENDAR.GIF

MD5 94333d687036d72ef934d9504f0023d7
SHA1 4fbdfe1ddd81c5382ea095ef7a55dcb22cfb380a
SHA256 2c4442a2b0938b676f48fcdc725f1d30e41eda37adfdd3ca3109e75612787631
SHA512 8a7284f68982784318b3eb76c711eafcca16a16775d680e83cc827d2569b4485296258267fb6f605f6ce9810e544ce89057905a9ae26f6c240dad7baf3070d8c

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\DELETE.GIF

MD5 7d315387ecdcea8225ca28bc87cb8309
SHA1 d825059c0d6795acd4bf449da5d21ade15598ce2
SHA256 8df1ce206f2cf1d4718c4bd7224514dfc248574e7d9f5306f3d8013289a968dc
SHA512 9a58cbc7b5af9037aa34872cd706be16a3d58abdf76a868f72d783ed417dabd6d1f30c96d5bc6b047fb97800856e6b5cfec7e155df7fa15a81d31c501b6a16c7

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\ERROR.GIF

MD5 fa1a62c3df69d5eed05106fb1a3ed9a9
SHA1 ccf19d4932b974c4231f0675ff70db595c4c342b
SHA256 3a6a7f7891439644a99769c5b3a7d847fd0477c813f2b092361c952592b420fe
SHA512 727aa75b3b8c6ff6d303db1ab407f678950d5fb2a4ff30856dbb160c91493fed90802bdb4640f61143362a142e276daab927bca25a6d4e304669204a6e69fed7

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIcons.jpg

MD5 78dae597aeff0264497331dbb8a8d619
SHA1 d85f0943805ae042ec629086bd07a8e139bdd753
SHA256 7ece9af59b1287cfe8ce000b7be0cff3854ced32fef6a1f4d2c02d47dc30aad0
SHA512 219dbc052da4e3b1c0b3c7a2af357fe4b0782c7a328bfb5dcac7902fbffb0f05c530e86ffe37d594681bcf97667f60cae4487b4f56f2e960b718eb8af54f1c12

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\LAUNCH.GIF

MD5 2314e9d06354828f764395364dde390c
SHA1 529cd7b129cf2e76366cb30f5da59b673a11a794
SHA256 640675ff0430bf33c643baf7f560bb847646e077e465c9767cf33e326e61d462
SHA512 2c539a8e111432728aef9402a18025cc50b2ab14b4e8869a3fb9436fa2aa6f04f7cccf834de69b3db9d071454afb97aaf60729631a186c283651b07a035cfed7

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIconsMask.bmp

MD5 5540cab11a7df8a13ea83aa04e623031
SHA1 b605f3c4ca7659e34f6fa68606e96a792c6917bb
SHA256 a1e457e22cde5b427e325f95346947ea07a15fbdebe5e066b8e981289d1a4179
SHA512 2033467b94250e523f91373f343e47a4e403539c0ac9e4c525b546717f2d397823392d56554860510ba4214c0ad21ace74e23b39f6067f48c60136530e0aab49

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignleft.gif

MD5 c8433fd1722459e171bf391b9d0f80e4
SHA1 2bf9b8eb3660ea45b16c4e6fd9cca1bcfda4d760
SHA256 feb599b99aedbe2dfbc05a9739c548ba11799c6e6f16aa52b9264bdb082ad15f
SHA512 303cf112f0c8e9de7750bc795eac4efdfe46a1e8688cff13802af801d4832bca422873e312962d7a3dfa4022157f3263f4b6caba542fa1dbde687324a3cf6f90

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_bullets.gif

MD5 e2e01bd9d2f7400e00a969ec71a20623
SHA1 77eaf1ef9414d8a8d2b568fe1e53f0a9a573ac45
SHA256 a9468ae4f7f295bed05f4d045526150476f155e456b1a1a17aec86a4aa83c5dc
SHA512 4f74783355884ac7fd192a3e7f0173ea4ce9eef29ff77c2b1f0b37fb5486b696772c83004f10346c4d35d3a39cc08077d78e65b5d4fbffb8e3a5125e8f1f031e

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_center.gif

MD5 24aae7533b8e72cda1225bef461a770d
SHA1 e1e293a9ae5eb03b8a26c19bb7f112f6e5a8e950
SHA256 51cfebdb1cfc484edbb2b6fadd9bd2cf83ebd4317b92e2a10d37a4430baa5cfc
SHA512 7ba4fe36c78371a4228f025516eb03c0ba36bd46e5c6f5f1c45caaf32188e0b11ef95ad62aa609f9b144864f234ad242157b7c56d85efe5e96c94e59d43e8561

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_increaseindent.gif

MD5 540e9d8ffc628b66ee27ba4e32816b94
SHA1 74cefae72b0076acf50da30ce73f15038315bc7b
SHA256 ec144df58c7bc0faa49fdd358a8f582e5718c794525be7a215cd18be6d584518
SHA512 94c3dcf393c30a5f813468cc85f7fa62ee726fe93298ac60f364cde2b29c83af1a09f7ee985c6387995771fb5c031c5c784be3131ef67911cc0d74134c238afe

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_decreaseindent.gif

MD5 22b2d6880d5aca8cf6dee7afe676aad6
SHA1 84f93a4cd39f486f307fcbc88c380a511aef1a18
SHA256 580feb93fcd1ce6e7ef74ea2b9b2736e8826a147d697c5f3df657261970e7309
SHA512 2ee50906568cab48a09c88c812cb2664a768f32cb78cc86f7532a0b9d823730bb4fba3c78e26c27769329e9184c252c9056345e106b6fde2054d41a8b447e1a0

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_justify.gif

MD5 0ed050390a506033f82f9b6089f22801
SHA1 2ee355b8a72d52288857e916d5263839300ec9b6
SHA256 1f9049f45a2dc74ffb35fdde0c33b297d1e885e7d5b3b66ac22a619b1d631a09
SHA512 9244e2c2a9f671ab03aebad9bb56dc7207192a50ead069bc7f3f5f035827cb77f89a715b9ba373bb6d8193d1de1071bdb3dd6a3acbd511c7ac7d6d6e8e5f9a25

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignright.gif

MD5 2eb7d30ff487390d028033509d684e80
SHA1 ddc51fd0e0eab838c527a530e96fa28bbdc56cba
SHA256 50bb0f983d08a59e0ebd7f8ae876b52c57030507febf199bb21bd1c6709a6a50
SHA512 4badad4bef342f1ab38654892eeec2ce42e2dfa3fe33ef60720332285b1607ef6ab4707d56ecb4c47e4915c47075c7e28a1cc4f72f0f9e973138782e5531bc53

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_pressed.gif

MD5 6936969e277f18c902fc1fb916581f6f
SHA1 244421290d67cb3848f0b5569080de17683a0812
SHA256 fed92cbe2a1a2b24d3fd5a47fabe90ee8cd766d5d8817830555976aef295a608
SHA512 bba72342e924fe8780d5eae8bcd01e3ee1b175798dde43c5ec2054fe23e98375f0b5a2f197702f446240a78dda95850f0a7975b1f21f38f6a63ca3b839c718ca

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\bg_FormsHomePageBlank.gif

MD5 30a542569bbb7f04b41cb7ce845a61ec
SHA1 eeeffd089aa82f9a326b97ad83f7d0649ff80633
SHA256 1c45994c85f5e5aff1d88e378a1a4a345652e39132b5b5c8bf05636adcc05510
SHA512 32f0be6a2a218fd623c2cb0e63628d79d08e6452090c1372679dcae628871bab7b32e62fc4f6767bcb039798a65e4cf18a982791d42482130b07ca335c1ac878

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\AddToViewArrow.jpg

MD5 e394fc2ef7cb5be5096e4e332cf1ed98
SHA1 84a11b67b0ddfe3cb83ee83ae291bddf44f3f6e1
SHA256 8e4d32eb2a79e52a3643e3fd38b01659da155f03fc31d8fc424dec1b4b7c9f3f
SHA512 48731a9c11a2da7b07e74c28f435455126f9d6b98e2db7cc538101bc149b1a1de58258d0d761fe4292de9a895ad4fa3752a7bea1f6feb29119fc30a8eff7303d

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\AddToViewArrowMask.bmp

MD5 9d10db020b720c6786eec341a2141d57
SHA1 f47c071dd1aae4f0cedc079e3ce1855993d3a0a0
SHA256 9e1a0985da6644730cb4da7f0b71cc6b5d8284adea402f4ea59d0c66ef179283
SHA512 64376daf842a2597863f4e5a0d5de2da01eef12315264ab15639f4d9d7122e85121e4f33b2fbc79d8190e1211b9c86f401c8438f9a3f3f8528f5096a22656739

C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_zh_HK.properties

MD5 a62ac7c3de031389036b60881ec7a993
SHA1 2c4023ce7ea77a1ce495eec1b1c9c78c9df29dfe
SHA256 a0882f56c0059bfd419aaa085bc497abb905d55c5e44d34729fbb788a5423e4c
SHA512 95a2b5bbc629fad03f40599ddd79a46765775430a0859aa3f07bb81f8c6485434292925bdae9eff303a43b240e7a5cdfbef17d03c0e993c7ade40de17fe81159

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\MET

MD5 1d3ce5947190507eaad8dae8c559f20e
SHA1 a55a480195487c98dfdc8c34a4c6fa71f72af179
SHA256 3e3bd32bcdaaa1402b0990d1c4bdf8603e7f9845fd3ad9e5e9af1cc94574f1ce
SHA512 9a42e750cdd5dca2071ddf5ff9120e95053da2698daa6dc5c42a9c12d4ecbfbc5888a4c855721bb42645cf063d6125e47b70aa09701b5952676d2a97a82aeb58

C:\Program Files\Java\jre7\lib\images\cursors\win32_LinkNoDrop32x32.gif

MD5 d18d20179fd3912d1be349e75c798887
SHA1 08aca6986bf35e275a43a47e953348f5e53fd3b3
SHA256 7b63a7bfe4a75f6de72f4e0c541ec8f25ce81e3cbe9dcd0ef3ff2ffafe041453
SHA512 a6b9fcdbb9e9e9be07c0f89621dfdc70c6980c155f5654965b72eb7d8245d3d0b981122c26202c5208a10805ab31cb10ed87bbc9869410f61641bfea58ed6530

C:\Program Files\Java\jre7\lib\zi\Etc\GMT+10

MD5 a3784c56d359068dcb338a83e4b1a9df
SHA1 a25576e703c77142c2c43c4857de4abf7b7692ee
SHA256 a1afb2ca42c16eadb2ef00ca338420f80a112ee3f55c3173c8cbe06c5441c2b8
SHA512 42ce1145f7625a11c834a5098f7e6eb156fab46b00a4b9c2205c2ae938c6dad90a7ccf143295051235494a07d6d7ce26d626ae1194ad490b51f7b90c82dbe9ec

C:\Program Files\Java\jre7\lib\zi\Etc\GMT

MD5 2f6052214794472ed58b471c279fcfc8
SHA1 36c1da66a7ec72111f440f60ee41fd3856353969
SHA256 adf6fc567aa6933ad62872ec5ac6e709af8062539459f4bfc30455ed8b4fee4b
SHA512 f901e34bad6a7baa5829e12f2a1e565bb4d2dbf759e616639edc8e9f7de768bf98ca01246cc99a421fb012cf8c2a1fa03f108097c8aa963fa368e7b55b4f9673

C:\Program Files\Java\jre7\lib\zi\Etc\GMT+7

MD5 48d42d14c91de6f4b2473c3e6eedce31
SHA1 8a488a39a4455f6e8838ba931e3e6081117a3ee6
SHA256 d011c1e434c987ccdd2e3e14653143ab0b87a404127270a97fc13a9a1f88cb24
SHA512 091a3578f03d91f75db0ed9c7319c2b679e49041a17534bfafcfed43c8cc5e939ce214962eae8223068f95cab00c94889395288a221e261fa75019b93f5a3324

C:\Program Files\Java\jre7\lib\zi\Etc\GMT+5

MD5 4a125be6490d7bebb1b1bcdc6c2fca4d
SHA1 a31de6e04d0f973e159f1bb4650cb7dc80f55441
SHA256 34a97eb363da3b628cbd780071d2cd5719dd372b95fa8a5934f3000e8a25060c
SHA512 fb2b29ab97ec444238c160c836288c8063361eeffb415231f6738fc6ffbc45a4261bc002868472b16579ba7307c705d490cf89d8d37558622197d2c946365d9f

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\South_Georgia

MD5 47f9a6cd1f37c0e813572f22302418cb
SHA1 eca0b375e427d45a6b7df5551d335c1515305fe5
SHA256 da312b408d7240d351f67794728012b5820a31cd93cb7b451b42d572b5fb2993
SHA512 64a29aabe9995961a973bcb85efdbaa0e75676763f61cee392e276844e8bac86ab6d6bc76c20169b18680382ce14d68e3e2db983f4d4ea8bccb7c21ef42923e1

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+4

MD5 7401ba4d1db8874cf8e651c1cc213a29
SHA1 ec22501940b25e6a54fab8adc1cb18d6979646bb
SHA256 d8122d20197f855b14920f6464ba823e9c56b26ac4e0fca2c5702e8541ee52c0
SHA512 15292b0d7295c66129989a4c6f53360b9be0566811a7e3d1ae6da8688bd7efd826671a7ed89acf5a8bb8d8456683d39e4f10b1007c17efb47af2e505ae7c40ef

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+8

MD5 bbbdbccce1a0187b4e6361b5772f6e96
SHA1 cb0d66311502d00585cbe9fa075e5eb5aadfb2c5
SHA256 c62a189a6bf88c05391a45800fb5a99c7b90988ef190568a791d6b156e2520f5
SHA512 18a30afd75ebcee0c30246fad0cd1bf998a4b95e383e5e3298c35279f2b85ff24013b405681609bccb2e4d9ad95896429cdebc82190585534537b41c5f4d02af

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+9

MD5 b5c9e46f023d70c23ef59f7a36f5fe64
SHA1 67a44c9048b23eded937c70e58209860e3b81a16
SHA256 880a0b3c86ff5617258c55f2e582a29ef5da9cdd42a8855d96ff118d617f9761
SHA512 182da81d9385337d5bf8313f2a8e8c22c9bef93382a7ccc5feaf43250fff4907386a1e81cfe56b800f1acf5fc3bf600449525513b1a95a3a10a7b2df817c5add

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+6

MD5 4f275d63906d0ca518fde6a365e0d2e1
SHA1 66fb593dab2344e02c191d7805ce09506406326c
SHA256 b7c881e9a1f8f30056c3fe4cbcab1155244e7c4b60fb13c0255416c06c88a79c
SHA512 b6b6b3ebe5bd026dd008c41a8d3deb00ccb47aa568bcc009c10e12a2764d3d51f1577bf07fd3cbb1d5aef46d8f9c89ce50ae44b64cc73e7fc310dec3efa3348e

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-10

MD5 8dbedd16c13f5946dbccb555c9454181
SHA1 fdc566749107d353e01a78aff97c246e58e6fab4
SHA256 335683b4dc22edf184926c730e128e275abe1f8fa8e74779f3a2dcf0773749af
SHA512 6212159be796067b6d7875fab51cb6ad16a05f82ab58ca07af8ad88c6bb9bfc291da4eb2e26b35e961aed0865cd313faa032a1f4d5a42ea13cdcbc78623f7b48

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-7

MD5 722cf5675da0b11e818a1d0b8dbd6c82
SHA1 fa5a4ae2ad9e843e80dd6f121f4dd1bda6226404
SHA256 5cc0c123e942e35ba6a5c62656a07323729ade38026fac257c989b5093d260a2
SHA512 a3349d6d7a6e6c8fd387495cc42de6fccb4cb321d96cc9cccfe80fbd28c2294f0f58d705627f1055564e6e1afe67e45c3ff883b180f63ddf13b9dae49c1192b6

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BabyBlue\BUTTON.GIF

MD5 5f179c0c1c4f60415180ac7b25e1224c
SHA1 aec2372236c40764966c8f30f804951a229dd472
SHA256 bf19555ae9e4eefd370bfc792baf220978110537e5a40d896092ac68ec9e1cff
SHA512 3ee51d72685c89d68f5e55de05feebb0a05675a557e44acfe478b5ab6e47ccb4c5d1b49622bfdfa49df9f6ee8021610c265f456c7f56487c0d9c0d8aa39b4cc3

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\TAB_ON.GIF

MD5 c21bf37265fe7e0174744b8649dd139f
SHA1 d41f9119f2d42bffcfacdaccbd057a5905e347ff
SHA256 589b1e6be24ebffcd7d46ef5d93a25fd4607ae134be47cd3293450f04cf1c2f2
SHA512 6e02f09615454495ac54723a5b85f0253623ed8eeb7988ec23c246c3c77a32e905c8ccf22d2a3de40b7b8e7f76d16fbc22959389939a0d048ffda71637eb27ba

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\TAB_OFF.GIF

MD5 999e236b9dc155e7fe9090a713b13254
SHA1 8f3ca62145e4d72fcca0000ba335573fbae12704
SHA256 4a469e41be5b5c482453cfc14cb83b67fd2072f4c42c6d910abdd1b2b61371e6
SHA512 e6a2bef9bab3ffc9947360f2d44005a903d45e7effd5d510c848fa16aba42a6bd1549c9d8d7abe64d1d14a0fd8943cf6daab809669fdddf4b996e91a7bf7f86c

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BabyBlue\HEADER.GIF

MD5 f342b73eff09077c3463e22d22f27e58
SHA1 659907a553c0fa025451d336987904143e8049bc
SHA256 52b6d2639ec1bc3e9b5710e7b5d69e30106b1a671b14ff74cd1c9380d98fcf55
SHA512 c3c57db9bfb8ba9eb5ee795889dbfd81ee1f42909ffbedb069d2ed83155fcc9f7bc7f8c5611270ade4c3b8d8a18ba554ae45938865855d5cb9bd07554d79c194

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightOrange\background.gif

MD5 baad1418c2d34c41200f4e7c367842bc
SHA1 40b44842f27cf4fcf7c05ad838923fcc51d2841f
SHA256 8c6dc1a29888a1059ae4c4cc28a941c7b34ef26272dd3113d1cd76d4c8668621
SHA512 2541dda9bc67a4c3f772fc97ab1a0ec8d6e7512b6a5a90ae411caa2ab475237ea33db5706525c6de8b4295f3726d2c84328e9fc5bee4111c47e45c2d007054a0

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Desert\HEADER.GIF

MD5 7800f300264af20f6274cbf934586ad8
SHA1 0259bfb1c600a09a3e6245847b8f319f18524312
SHA256 98d8a1ee9b68623092e8e187097cff99b4794623e2caf3c6065cd2d184da2e6c
SHA512 283a6c237be9a3b1bf4afc8b0c9a98741aa1943755fabb048de9de90404228d2c916dd2e58390cf339e449cf1c3c55f22c64e233fb0677418fedca2816ad6578

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Slate\TAB_OFF.GIF

MD5 167049fb74a65349c1527eabc041f664
SHA1 f196f4308813e13f69d501a47018b91eb90def42
SHA256 294b8de8d9550af46530e7a1ab30b10d71dfc6e56199f844d8321c133bb5b936
SHA512 9fb7fff2932950677bd466981626e7c0c46a99cc6eb221aa8aa6f3f6544be32f899b4efd213a3088935c8a608d1a07ef1bfcf8da8c8aa88c14830d76ba3b9644

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SpringGreen\BUTTON.GIF

MD5 e776c01c0de08e3321e3d5470d7cb47b
SHA1 4b80ada7298c3a54fe77c7b8a7af778447c6a356
SHA256 0bc4eeebcd4a23a006643ae915e25e993cfccd867b7535075660e8d273367e33
SHA512 fb2c936fa10bf91cc9e9a66dcfc5e6f09389d81a7c1dc6546f694f1f502e6815c2706ff163ed12b11c3dfbbd3be23a9fd053d0515a26d1bd24167338622121f6

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl\background.gif

MD5 9c38561ae12ad5d137b8fc9eab45d190
SHA1 0cb9bfa4b03345a8f263765ca2c5c38848f44223
SHA256 72a1a156391bdbab67dc8eda49e54136e09999f0442276b5347a2013d597ef8b
SHA512 09e4d516b98833df423cb192bad1fb1c65c1e35312d6044562e2d821af3f6108ac52ae375a18accb40464c61f3fd55661ac52834bbece499edcce395ea6df32f

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Slate\TAB_ON.GIF

MD5 5efc5e05b1420870c6a560fffb055a37
SHA1 581a4f57c76722b1ab52fcd4b58d6104c8c0995f
SHA256 9f7a5ca7e07a081ddb9f9ba70cf853c98fd62fa21ba3f7abb3421165d03b2811
SHA512 0612a6c1dfd7de886cac67062dbdf89c99e80b37c047f1fae6ac3c90f20247c53740cca087bb59054b8fb05009bef1b313acfca246e196321a4ee3c9e7c230b2

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\GrayCheck\HEADER.GIF

MD5 7b7f57747542d8fe84147ed4d1594600
SHA1 2458b1c67a677836d490e053e995ca66ab31e8c4
SHA256 81d613bb67b5fdb0c3201f3d3149425c3a93889e0d62c82187503dd3ce8cef7e
SHA512 49a15c4c5e5bbb116c5d2032d631ae46071800cab986f11f438186037ba94ab0b51520fe5c537ccdb0ad54067f42fb91203904e7fd7873ef234ca8548306a096

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\header.gif

MD5 7e07dc5d5c2eb85c14a62841ac8e61e6
SHA1 c587f25a5f670f5559d59069340fde8229df3967
SHA256 3269d76436a9cc069dde108c6216b789fa4ccc0b582641ceab26e9b3d0492a09
SHA512 fed4b27252df0d7ab4abbc4b704608b178b2b9853086b4a748e8c4a1a86cc1a36cef06ad1eb6296a81d2d36603d9f86037449a6400f6a2cccc880ed09ae83a2a

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\background.gif

MD5 be137797ce11f8f767e7eafdc3ef98bc
SHA1 ec7ef88aaef1f6bc54f768f2092f9753276054b4
SHA256 303a4c189d8576a8c5d0b76d7c74f2cef12830d02ccefa4e1de7c6a02e0c3315
SHA512 5b60918b0f227096a3313222b3e15020e22a81f99ebd190fc0272a7d460ca65620605ffa6bc802cedcf621361e6efd79c72b928b7d84987e2879e142bc396f9f

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\TAB_OFF.GIF

MD5 6158c13710e15eb6156c66aabfe6668d
SHA1 12f84da6d6116e7265b358e9ce07aee0bc9f5e8f
SHA256 3774610c5e8aab16b08cee2fea981287af26604683621dd8f482a847fa64e9ea
SHA512 2e80960d5c69797de60bb0f486835aec5347543f63529fbc05ba7d2e9f2fe76feb2c142df451ff89a025a3f75b47734e1ce61394bf4cbffe9cf9f5cd4bbc908b

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\HEADER.GIF

MD5 f87ddeb5051690dbfe451b57c72cad2d
SHA1 c663b018e83348a56b41334e3a3ac3668280d640
SHA256 2ec3a66380bc62eca025daf94df1d8e845dfaf9b4eaac0673d3637e3f17660c6
SHA512 46e87c7ffad9b085a0faa06a603f8627be1c5d2992cb60e41fd0f0b8568e110ebe780f94ca1a8245b759e02ebf17cd8e9e79cdd22af33126422ea2139657cea8

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\TAB_ON.GIF

MD5 a7b1bf5f7a9fde463dd288d73cc1c743
SHA1 d27e3a0e6f63fbd3622766487a2e4164aaaa7e07
SHA256 2d6dc0234c2647d43fd15ace296c2eefecbc4c2b76e2ab32e1e5510387678713
SHA512 d19308fcfe070508ac0ee684a8c3265f5e35edd672004dfd2cba9caa92eb93b7399bfb247513f2dfe5f45a8e19863356e3995861d972c5006a501a7bf73dd2db

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\eclipse.inf

MD5 225affc6be841e5c7aa88a18a3c2c58f
SHA1 9ca8788ccf0d3b8bff701282dd8d9d884721d7c9
SHA256 356c12a0235491afa7e1ff3ca67b3a367fe37453663ab918ce36541c9a43c21f
SHA512 20e40328f3c4abe72aa2fa2132a0f1a2d523b41242087b8ac59ed517a42c5225bcd188f8df6445b72b3489155b5707f97b6d317b73758020d243ea32b5080580

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\ECLIPSE_.RSA

MD5 0458a75f1993c21f7150cde7416f0615
SHA1 63e6959c3cc65e0269f153d8333ebd85f97113c5
SHA256 7af5cc5810131255c5bf305ddef02ad473f38782cb29136816e29445e965628c
SHA512 18e430435637540ccdf6a57049832b6bb1fe37b920cea9fe983f372fd8cf5f3aeb62177e3b4ab9cb50e7648e9cd671f9e15f7f0b9542141e627c41f737542fa7

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Lime\TAB_OFF.GIF

MD5 48413ca2254d2a3401a77d5a6fd0b4cd
SHA1 d046842bbb8b65d9a400437a3e918b34db3e9f90
SHA256 8730160dee3256a37d7e5fc2e3ae467d569ebaf41aed892885d344ea5daca8bf
SHA512 25a5e8a459bfd38451b3faa1c6715502184e2c96a68583362ac90d00a257bf7d351b174b9ac5a422932bce098ecb154981a5b8800e17283fdccb94a37b1d0556

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BrightYellow\HEADER.GIF

MD5 7eb6f9e96518cb864e1eb253bc4fe51d
SHA1 230dfea843860aed4201ca76b2c885d29b2104db
SHA256 7d4cc981bd55456ec0989228f8c80e6aca0bdf6126cfbfe52cb1c4386b1771ba
SHA512 7d94c3d6dc169ebd960623a28adeb9baecdfde0bc7d2eb1966188bb1a2231aa513dbb627101691e4729f9db91de5946f3a931af99d0c3858bbfe3979d0d89480

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Lime\TAB_ON.GIF

MD5 cf270664094bdbb18246ffc240a858b6
SHA1 1a404668befcf336e51d74245dbfed0a274bfe13
SHA256 1d1e8aba663fd4eadde1798a5f6ed4e4462bbf332ba2de40546f65de94a0e237
SHA512 722a872584bb43d96756a56b2b65b428613cb6cdc736ca7086a83e98829459beb7cc993b3684710d5c70a14e856dce7cd22277b3e6819f65d536b1a9ceeb260f

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Oasis\HEADER.GIF

MD5 4ef5fcef213a99c6636cd9c6d6429185
SHA1 a769b375a76d247a6ea68c90cc824773ed450382
SHA256 2bac33394cc422dee8d175dab2822166eb4ce2b9f8024f406055645899d2fff4
SHA512 d25a12a6b307469ee0730b821fd061c6480e2d276da45f4bc1f23e5db5015d66bb30d27906586a92f5206d62fa6257a657850b7add99a770b4ddb4973a6664c7

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\SoftBlue\background.gif

MD5 9e6f7179f95ab0232302d2c6d9c6ac5a
SHA1 2e42dd3a396bb9050ec97dee59e5626c0c56701b
SHA256 5d74979ef3e0b8bed73fb37f7e460df54edb40896d7ac3273be2e782676b963d
SHA512 edfb5f7a90a89c9bf5137beb7b2ed97df5b0c04f062260a3b8996513625e6a38c144d7c61f2462bc2f4b1390e64998ac315bdad8cd0362acbbedc08a52435edb

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\ECLIPSE_.RSA

MD5 27d68a73cdba4e2f696e0fea72478e28
SHA1 039a74476d1d0354e434922b318a85948f748fe5
SHA256 16349369903b231432c4357efe991341235cee52f7fc2b013f403e0229f61ea4
SHA512 0c787641d9f2747f935d106e92f3aaba3ff1cf1a09384d633e331f06b3c5c0dca3a4abcf2a6e7266c9678a7c7581ffd2a5d17ba8b801fa906cb453d1b6b7c320

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\META-INF\MANIFEST.MF

MD5 bfaf1b3a80bb2b452e804b916c38d24f
SHA1 d0064a1908116839f9fd5af99916a39ef82a6865
SHA256 387f60e0c7361d72041f5036c35ab7a834a1412f81541fe347061b5b59643056
SHA512 e499d9a6a91040b4565b60964db8678949edb08b888b2f073269ec13188d69d22daaf8cb99571a1186662805d60c7fec65f89b660e7220f6987fdf4ef2024779

Analysis: behavioral2

Detonation Overview

Submitted

2023-06-29 16:09

Reported

2023-06-29 16:12

Platform

win10v2004-20230621-en

Max time kernel

68s

Max time network

141s

Command Line

"C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe"

Signatures

BianLian Ransomware

ransomware bianlian_ransomware

Renames multiple (1817) files with added filename extension

ransomware

Drops startup file

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\Look at this instruction.txt C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A

Reads user/profile data of web browsers

spyware stealer

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\$Recycle.Bin\S-1-5-21-2178924671-3779044592-2825503497-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Users\Public\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Users\Public\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files (x86)\desktop.ini C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification F:\$RECYCLE.BIN\S-1-5-21-2178924671-3779044592-2825503497-1000\desktop.ini C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Users\Public\desktop.ini C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Users\Public\Music\desktop.ini C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Users\Public\Videos\desktop.ini C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Users\Public\AccountPictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Users\Public\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Users\Admin\Videos\desktop.ini C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Users\Public\Documents\desktop.ini C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Users\Public\Libraries\desktop.ini C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files\desktop.ini C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\VideoLAN\VLC\locale\tr\Look at this instruction.txt C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ro-RO\Look at this instruction.txt C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\dev\libs\Look at this instruction.txt C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\rsod\word.x-none.msi.16.x-none.boot.tree.dat C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\Look at this instruction.txt C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\Look at this instruction.txt C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\Bibliography\Look at this instruction.txt C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\sv_get.svg C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-tools.xml C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC.HXS C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\locale\fi\Look at this instruction.txt C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\locale\he\LC_MESSAGES\Look at this instruction.txt C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win-scrollbar\Look at this instruction.txt C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\Look at this instruction.txt C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\eu-es\Look at this instruction.txt C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ro-ro\Look at this instruction.txt C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SLATE\Look at this instruction.txt C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\th\Look at this instruction.txt C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\images\s_radio_unselected_18.svg C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\Look at this instruction.txt C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN011.XML C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\AugLoop\Look at this instruction.txt C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\css\Look at this instruction.txt C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\fonts\LucidaBrightItalic.ttf C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\images\Look at this instruction.txt C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\cs-cz\Look at this instruction.txt C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\cmm\GRAY.pf C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\da-DK\Look at this instruction.txt C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\assets\assets\images\Look at this instruction.txt C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\caution.svg C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\manifest.xml C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000011\Look at this instruction.txt C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\Library\Look at this instruction.txt C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\ru-ru\Look at this instruction.txt C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\config\Modules\org-netbeans-modules-profiler-selector-ui.xml C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\rsod\proofing.msi.16.en-us.boot.tree.dat C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Look at this instruction.txt C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Office Setup Controller\Office.en-us\Look at this instruction.txt C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\fi-fi\Look at this instruction.txt C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\feature.xml C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_cancel_18.svg C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\Look at this instruction.txt C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\fr-fr\Look at this instruction.txt C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\basicsimple.dotx C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\duplicate.svg C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft.NET\ADOMD.NET\130\Look at this instruction.txt C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\Look at this instruction.txt C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\locale\ca\LC_MESSAGES\Look at this instruction.txt C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\ro-ro\Look at this instruction.txt C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\en-ae\Look at this instruction.txt C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\assets\Look at this instruction.txt C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\s_filetype_psd.svg C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\pl-pl\AppStore_icon.svg C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL119.XML C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Look at this instruction.txt C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ko-kr\Look at this instruction.txt C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\tr-tr\Look at this instruction.txt C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\en-ae\Look at this instruction.txt C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\FrameworkList.xml C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\locale\hy\LC_MESSAGES\Look at this instruction.txt C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\Look at this instruction.txt C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\sl-sl\Look at this instruction.txt C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\ko-kr\Look at this instruction.txt C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Help\HxRuntime.HxS C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe

"C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 59.128.231.4.in-addr.arpa udp
US 8.8.8.8:53 23.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 158.240.127.40.in-addr.arpa udp
US 93.184.221.240:80 tcp

Files

C:\$Recycle.Bin\Look at this instruction.txt

MD5 eb2edd7202757cb7b8a8a302be8fd64b
SHA1 c86c459e94a28527d37fa889eeef268c7438accc
SHA256 5a2fe19742cb5066fba0e226dfb06f86f128a6c0314f3f19ad992dc8525069d1
SHA512 cee826b228cc27ac0c0d9e2a1a39146b6309dcce2e79404cc4be0088da1b8a81501ed71ef3f36a328387ab5d0d255d171f7b97e6384c850ea6b95f93339e3ae2

C:\Users\Admin\AppData\Local\Temp\wctF7D8.tmp

MD5 cca50a9d187bf2d97816e7fa44010c40
SHA1 df1790c4d04a9b1c58e04dd5afb6117d5d584fe9
SHA256 239bc32317d2f878d588dbf9496be0ef9f64544121b7722b18a12a0edbcb708c
SHA512 c149f474fb259fc38247d4263c62c72854bd47dd8add005a25d6a5eb704809b96935f90e6ed0c2ae2ae62201cb8a50393c7b85444613e8cbc95c557828350c04

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_closereview_18.svg.bianlian

MD5 0cc0805d1d6ff6fd4442525d414f9044
SHA1 5b69fee29d16aca9e540b7170f89bb90be292b42
SHA256 131e753eb7a429c34dcfa1cee3e0051ecebc794516b7c810b5fee316351db97b
SHA512 63090beda3cdc817950e9d5c824339a5d93da4ec8767e9a7d90df4a44453ba514ab25b6db8af80f86b6ba24cb35658836fd29a293eb8d7cf0f2bc37bbea69608

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_backarrow_default.svg

MD5 8ee3c7590ed0414e2dd2c5981c4d0f21
SHA1 2b98e85532ccffd725bf8ae2e43ffd7c8466d869
SHA256 6611669ba64fab3a98e539eaabc6fa1bc253a37b6e442d7c6a71aa2bd9b3b7fd
SHA512 2d48f1c4ddb693461bdfa0b44746f97988278b1a7650ff5a4a9260303bac457883835aefecafedc1c42691f7c9c2ddb144410a1d51d29bb1d5b897fa1c1e81a2

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_editpdf_18.svg

MD5 2e698af5531d041b79dad12231cd80c9
SHA1 30ed81a9d0b8ac29e28c7513698b92ddb6d81732
SHA256 335ecb018c58cf0b0cebced7a995c0c744fbd328589dc759ba94510ec21a6c3c
SHA512 e29dfd9c6dccf192a3889d2fe624762432bfa5687b1896c2d9392ab8ffa29094a632d163fa1e589fcda65a96f0d6f76d06cb89df3250dbd2beb0ee83cce49677

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_export_18.svg

MD5 a2c1e6324ffa63640593af9522fc79dd
SHA1 27dfb8d42d9ed71eb1b4013847190efd06c382ad
SHA256 b99ceaf5314f0edbc0ae3acdf54f6960c919e39b33465bf140e94396a691e62d
SHA512 98d11bf160e74c92d2277f464e7fa5257b897ab593ba46df4d7f48ba6d321ee338bef2a776f132a491fcae5012e5b291656ee6da9ba7c07ecaee38d318c14fb7

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_folder-default_32.svg

MD5 18d6479df1cd0780dcc2c2ab2ba676c4
SHA1 7b0a6f1905ebc860d094f85f53a7fbee0e6d6e41
SHA256 ff010cb3f922418b1ebed405a0d3688545f491771d8fa060126f75b5f5bf7f25
SHA512 73315a0fa3440da3be718ea24af46d2f810cde4ffcfac20bb4cabfe9be21f804bbc66b12dd9208e280a0e8c9de7981d73160893ecac9c4fea7b85d577b8efa84

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_organize_18.svg

MD5 95ae679dd3f4461ee906b4ec9dbcf550
SHA1 89df57587da1191eed0ec783302c15e2f2f11dcc
SHA256 4d07d4de27427584a87f53fcf73bdaa5134bf661c6e5b98e730e355bbfb96d99
SHA512 848cd6a19823184b43c403db0e0ca1f699c8072af1ebed2a844c953efd114a03a9ee9d8a0ade62f245441b880ce2ca8a199c7b041f906c7573a373938f661bf5

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_share_18.svg

MD5 d261eeae5e8e83ebfc080349b4e14ce4
SHA1 0b7546d985fc2d71129183c298ea8e99b33323d8
SHA256 c9d5ad9eff09be62b34ed9acd7ac95780de5e283e29ca49ae6eda3f498eb828a
SHA512 dc55db3561456857bfbd6a699ac62ee909e8493b33cee36b7ce7548423518523d172126cb3f5b15c0906c2fa693da4b38cc9ddac6d7acd6d78463c47767987cb

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_sendforsignature_18.svg

MD5 b0d024e60afeb02677fe01e316406852
SHA1 196a8232eb37ec7d28f2122e7dfe03ec3cf537e4
SHA256 552ebcb2ec8027888cc126315d0b4ebe77efcbc0b558676cff064928ced1e3cf
SHA512 0df486925d5b2ba2e9d005c6a0adc804d190125c28e50142b09d9bc5bef2e2faf8712675c341cff04d1c94ea288157886edbb753fabbb08450cc439d250ccb78

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_rename_18.svg

MD5 04d3da65d8d57136d3e2da863559c3b8
SHA1 364255671b4eed2ea3cce66b2e4e467979f6937b
SHA256 ee0ada5e0efaa4085e4cbcc6613224100336e26948d163c0c2b093ef24138e88
SHA512 daed0bbbc846d91bca64b253c6a5a0a0651a1d09500d4f663941ba5b04de6b2874fa9361ce7e4d234db05547293efbdb067d13854dc9cac18795df6f36f07714

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\duplicate.svg.bianlian

MD5 a5974680ded961c4bd3b8fc2f202187d
SHA1 d1ada5e3f9f9c1a0462818aa6afcee018d33dfc2
SHA256 fb7461520e0e57b4423495933e7f0a13f1dc0f5f8fff27a4c0e425284a6e33cf
SHA512 43be5609adff4db0f83370fce8f2ef0480f7239bc4d283fd9d937a1699e90063df41b863514ea245e6bba2ab2a28dea3a56659db5d401cb5535f46fb14065513

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Cartridges\Informix.xsl

MD5 8a128cc2d85c2a684ae8d040d4fa48ea
SHA1 623fd116d7bf98ee0ef23b12b92267ac1ba661e0
SHA256 3330ee70f29cb5d41433de372a429b8f0686ab1301faa203e3fa9b1e55b4c2e4
SHA512 0302ec7796c8bd32dda6891c3939281245119266977e285426950aeb4f93a6441a500bfee647a400bae7aafe13bd14d12efec7c6462862773ec7180a3c21fe1d

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Cartridges\msjet.xsl

MD5 e02931e638c1cd16bb64878b279088b8
SHA1 9ca576a6d7235bd880d7ef719dadd0cda491906f
SHA256 c12475b6718ccdad52f6817eb540337aa155164c677fe41323ccdcb34d56b594
SHA512 f32e1aade519d5602dbab28b4329d0560d0cef95a279dc201b8cd497eda811c7ba8383d0143c561e7095976d0b6d81f559caa572350f146d617a9a2c5b36b233

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Cartridges\sql2000.xsl

MD5 cd4e8073a040abefb331b43086dd8df0
SHA1 a9ac9236ce66ae489f33f1c86d7f52e600625c68
SHA256 87d7029559f887317a01c8f9778b3a05c2968739c781b8431e24da90e3c2daeb
SHA512 bc87f0928493b4cb6c7e8510c4caa476852778c97b6b4748b64b613b963d64dcb84156159016f8f6812dad22adaa9aaaa3f1dfa04d0236255d097344974a9ccd

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_fillandsign_18.svg

MD5 5b35768ed90affffef62d6e3c1e89245
SHA1 7582daa77b773aba068e6bb0c06bb7581875a5d0
SHA256 1bf97733331590c63b5d1ec69561e999f9bdd682a198b70e5bf33ac2ad2ec9e7
SHA512 a5d0da589307b6780b8134ed71f58117752cdf3ea251cb428054b596a444e04ee67497cdf2df2de03abafa07e399b06801bde00d337c1fe558f4bc68ce23bc28

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\s_opencarat_18.svg

MD5 273a73752443c2088baacbb3dbaa60da
SHA1 1d2b3b074a20fab048e7f1768b203b2863b196bf
SHA256 739812ddf7fcf0a87c0030308c7b713a56f212d7e6cdcaff727c15bccbe989eb
SHA512 24c531013f585bebd6f4dcafaf33f495f2064018d9da2d80ec0c063645adda2eafc9cff54c85971fb2964e9585ae663cd1b633e03b57d053b0bef8eafa492501

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_nextarrow_default.svg

MD5 1723c46540167f0789569f0b8c8eb745
SHA1 2d2550c5350daf05f2b80dde24e1c6d567073515
SHA256 1261e3d886a619ba0622f26c6fa29bf7cf3acceb58a3cdeae6ffde5f6583261a
SHA512 fd30fadeb5ba04b7ca9b17e1147cf77ac5c7390452915270dba27ddc99886b744a52b12b650deb36d3a5eda808fd641d43e175e8d38103c3828398866d96f46a

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_filter_18.svg

MD5 e524298df97dc06d412da31062508212
SHA1 df249910a713c939dc05ac85bc685c1346d8aa26
SHA256 7b34afe071797d72f199bdf2c3d367b85e60ab523924f5172d23c3c530f8f77c
SHA512 f275cf9f383d6f968dac8f9345afa63637b15ccd26230b367ea2e85a35e30e5b8402a06446d4f6b80f16530d12639ef8efc96a2c14530cd1a9d2ebd748fb6cb2

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\remove.svg

MD5 40a6d771f2b85cde977e9ce3c414d3a5
SHA1 45306939ac74e08cbdfaf8a368fa74d5a18b5a94
SHA256 221efcda13bc2cb59418d6aeb9052254cd2a4bd06391ceee269edc6157a533e5
SHA512 0605cd433840e85add9bc75b2ac691ce0e1cac5cc04eef7bea63843d4be263ec79e73b880753579de986637961da8639125789c8f3ccad87caa08961e9de0ed6

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Cartridges\sql70.xsl

MD5 a271bfcbbaefae9232e1584da56e88aa
SHA1 521b2ae54392bc51040dd555088e1ef68e97bd60
SHA256 fff83a90afb0b7e414021c4e0ec4a068e4ebcc2f4f998de58714537950bd9938
SHA512 44501d787904e31a3528676c49f9d5a0702ff36d04862f129407fcfcbe53d07614ceece9adc9da059e64d6831a75a04e4b64e5a5d592fd9c97e098517b471bbc

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_comment_18.svg

MD5 d8e5dbda58bdac8e6ef4ca228f9d62d3
SHA1 fea2122356634e39f0b8f1d29e6f691095426336
SHA256 dc7b45c255077984197116b690fc87766bc174a698c22cd846715abb88f0814a
SHA512 c0635907d5a048e1f9a453b0458ff5f17b32e0c9bd4df8da7ed21e190173dc9855edce9159a5b22692e82922ee0d0f19b0e674d9b2e65a6b4ba104844f26df58

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_move_18.svg

MD5 c6d7e75f591bf0ce506841005abf4564
SHA1 748ae760fc7bd013ebe99b101a6b82c9523c1ef6
SHA256 61360cc94f09448578fef43aa21d2ce7aab76b8888864f018b2118877694bb07
SHA512 eabd4861e2a324c6c9da57ff9276e18cf034a509b4337e039df343fe849c550453bf10b58433b14545b1a53ad1ce4fe29426bfcc67a8be5dba7f1d9318925b69

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Cartridges\Sybase.xsl

MD5 8a93d5eaa937a19c3da533b4fad19cf3
SHA1 538a24bbc9e5b02db5cab2e6aaef84040658bcdb
SHA256 887c97297c31c99e8b07ba73e2c0e3c1f015805e515294d2aa3c9e578565c74d
SHA512 587a8ef0f34db176380499a4a86d42ee88e26658a9fd3ab6ab12952bc29da3ffa0a22c2379565f1d4f0ab1fb11ffdf8b0449b22c666d3890de3b62a3d45b373e

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\images\s_checkbox_unselected_18.svg.bianlian

MD5 89352f50142b42004380219482c9260d
SHA1 530f252de9465c1ef83fcdb6a5c0c050d3c8f6be
SHA256 471ee3d3ccd8ea99cf1de1fa2e08a68a1973048725ca5bb0ce7750615d951394
SHA512 57fba380defc9dd671ec162ddc9aae875879c730dbc7dd3c4b5f3fcaa85daf0652519bd8d0f04d2f4bdbbb33c7ab23ca368f0b839499b71330190cbbb94217fb

C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\ISO690.XSL.bianlian

MD5 475aac9bf33cbc0bec85fc3d22d909dd
SHA1 75b8e8d7ea298c3be00fbe970e13562553293c3b
SHA256 89dd64ef5bdb8fcfa5eaf77147740530b1a8f5f8d3df3516e8b9970bf4eaa45e
SHA512 5646767a985f4c75349050b260ac9877a0351039230717119cdc0586a70b8dbb01e9bd9866520624e0c3eefe433187ce57b78c9e7196344d20833460392d0d31

C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\hive.xsl

MD5 f990f2ee70fdf09f991d189bc708264a
SHA1 123137b3cd87220b9ebcca1249b3e1069ce2625e
SHA256 0f6e2f99b9ecd6ba9d59a495410c1e38b78da209f6c9986943c62bb5d544875d
SHA512 2f75b84c5bd465d550a88a2faf9bd0243b13b6d92e61ad1a461eeebe75defdc1a8d70c72dd43be433565347fc871162a420483874984b5250c6d1e0449f2bce1

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\images\themes\dark\s_checkbox_selected_18.svg

MD5 560f5377bb28b33f5cf05603ffc6ffe5
SHA1 d74bc21222f37cb40ab0c6b400561f8fda6a31ab
SHA256 6cb4b5724ffbfff7779d84a6e954e92f620d1b8edeb3f165231c2df8a7f1ac3c
SHA512 accc31761b4c865472319345beaa5639834e7c267354e23b412bddb973a6b6dfd4b54224eb22a0b68b1790badd1b1976af77a9ae5a8dfbb952721cba8739525a

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\s_listview_18.svg

MD5 2e9ddda38132afa8d18ebbcf948fed85
SHA1 39183ca50d2a82cfe38f4b4964cca7c75ef05d05
SHA256 a3f5f1709e4e6a7004415eaa5f5b34fcfdc08e7838cabe4e2aad8d303a9c2c6c
SHA512 599ead549e71f1145ca94b6e30b7fc3f4eb287a8ea2ec4bdc0217e72f8bbcaeb9a035a0a923a2250efdb58253d5c1efe54a185168821ba8bde74965bff54d8e1

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\s_thumbnailview_18.svg

MD5 279add1913f7fbf2dd50d39e0b602b9d
SHA1 e09880241247c267dc61a6b35918727833e317bb
SHA256 fc8ce2ef608a8e5903b369d57497c9d792fbfdacf746818ae147fd53c577275f
SHA512 bd616010070aa98272560d70c6d9aa446457a5d3f33060404ca6c97fea66d3b650e110dd4538ccfc490c2b1e23a9d2813a7575c6b766a851350be0f26fa34090

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\PlayStore_icon.svg.bianlian

MD5 3de0864e663f495575968763c0ab2aa0
SHA1 dc37f6b85f17c55ed5f23a3058b85b65f43d21b0
SHA256 b73aecbabb86c0bda8f838a40a5d4f5cc6dfb69a3ac4816d87e73b643e407357
SHA512 069f43522413e346d8b70a9909b412dd679b43d49e38793f31345a06c00d9bcbc19152560cd9bc2e98d89c0adba335316cf2ce5d1a2a1e2351e5f865e3e14ad7

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\ko-kr\AppStore_icon.svg.bianlian

MD5 3a289653bb493a4841472d80e3ddb6fa
SHA1 6914db8fc06c17eb73406f9cb0a5096e3b59e9dc
SHA256 fc216dac7e15985b76fa3f01e7b206ee9e8c4c099ebb1e2c4d7240a36f2a2b9a
SHA512 e2506bf0aae926447bc295a1c3a048554c8b7fe2c52334d12894c96c9ccc85654f25723649d58e24a7e3faa44ea9d6e4b9451d68a4d6467a23990fe12954b122

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\ko-kr\PlayStore_icon.svg.bianlian

MD5 55c8411be91326af992b3517da9d1fc7
SHA1 d55c9ccb739f301f4750c1e481f818a45c7ea6d5
SHA256 4e1d29a93a1c2cb23c5d05022651e4e63545f5b07c6f68c262e21f11d1f26099
SHA512 d6882acd0f7c7443e8e599e62f3bc27a004e9f8446be80f27de313a2abf072629f6a2716be1c32eac1dde3a2708c011015642c99b41bc0851dbc27ff26274f57

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\es-es\AppStore_icon.svg

MD5 ffb89c43b5d8a7bad9c2db5e4bb36858
SHA1 572f76af57d9baf155fac292bc15e2f4f9500198
SHA256 29e0e8897cd12b459eced9671b76108744109b7f0a9db907e007b24b873c0af8
SHA512 11795656109450550455c7abcbb694a8ca68b43f734433faf588de4972261484e8a1fba44b399d0c5fd5fd5ee49264281a3ad7aa2938adb2b647c5e5584bc135

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\nb-no\PlayStore_icon.svg.bianlian

MD5 0ccfdc102dc8b5c4dbbdbba4222595e1
SHA1 8ed0da8402b48a63edc976d197b14351f98965d0
SHA256 3c1ce4a99ef9125425974ad5dbebe24749c671982085d181afb20f30222d11cc
SHA512 3246f1e331c90ddca4920a0f6330571a961ad04ccaf800497c01ef97b8040f5ab65d8a98e9074ce29f8632accb0a73da269f88941292f8cdaddf2825d1072b23

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\ja-jp\AppStore_icon.svg

MD5 ccd4790d8602a0ad00e07d2eb1ce269c
SHA1 bd03f9b0a7e2f44db39aa5f190ca605bb06b70ea
SHA256 862e61d038805acfba512b15874768b8c1cc9bfb0d132ab8ebf52f06e5388d63
SHA512 c72311cc64e351bbe08237fa50d46b943199fe71ff17641b527fd96258f45c0ee923e74314c1b6ea6568ab775772dc347a1691e7b664b60393519e37b3b4eb8e

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\cs-cz\PlayStore_icon.svg.bianlian

MD5 57244ea93109bb7c1b0bd831505c10d4
SHA1 f7b15678aecd8e0f1344513c771dc285f80c47fd
SHA256 0c8b14885473333ad6787c7712dabd075d69d823b64f1d83361e414fbb499a5b
SHA512 242efe1fbf59fc9c7ed7409c32c03b95365135415bf4c593763ea103da5688b9d2812bee921087b9e8e85148d29401cfc8739a22d04461cc74a6b1425531d035

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\ru-ru\PlayStore_icon.svg.bianlian

MD5 02de367726bff29124cfb1dc183db636
SHA1 4bd03a24c19a22b505f37fb0df470072444dac36
SHA256 80fea6a38b6b930ac37f34546c01b48cd7531ce67a627bab7f5dbeacdf680b0a
SHA512 674dd0b15c097ff0b678f11f64a8b10747f72aacadf5dc73f07874e51d5b1406d778755274b9518cf33a1f82f3bf47a2426ede107ed318de6c03ce94dc071e27

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\pt-br\PlayStore_icon.svg.bianlian

MD5 d2fd2206518b67f977cb06a22f1e7173
SHA1 96d8e5fc96d520a54423a7b2c23592c9b70ff680
SHA256 0d669ea77440465ccb3f973cca2beb42251306c0f755cf5f361affdd24d7fdc8
SHA512 9c5bf049ffdd9ec04580453b170b5bd598e4944875d7f847ac1d908ee60b719b8bc59293a59f10f9d6d686b72c79d21cbddd4451e066221a9c93797af18d4f00

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\da-dk\PlayStore_icon.svg

MD5 1569fda6d4619d70b7a28dfda6396e1a
SHA1 0a2cab9bacbcdc7a8ab105fde426bb643d9e8521
SHA256 9d558c1b5866cb577362cea17c2cf049b866cea209f3692c2eea9ffc7405ddcc
SHA512 51d34bbda8112f0ba3cd00d6f0aae7d3e53e5e3adc64d52c26f443e4920df6190c282a8a66fb310a85ab7eb951eb3e6aec66ab00b5cc9d4fdd4defbfe574425c

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\fr-fr\PlayStore_icon.svg

MD5 40432c5a801e59d491da984df065e3a0
SHA1 544d71f694597a59c520054cece592e747444e21
SHA256 8eb919a71b61362de74c3d3d213c983a90bb419a32468d00757dfcd842718b2c
SHA512 16c1abb4445b1d283b04d4235201b969ac24837a1452b9a0c1f01c0bbcfdc74a1865d39862f01dc28fc0ce76f435ee35aef90cb45b04a2bf6c430ec6cc537a6b

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\sv-se\PlayStore_icon.svg.bianlian

MD5 9ad92c638750dd3bc09420636d476d50
SHA1 06cebf33a36482394137333ea7f6f882155e8d40
SHA256 d2a08ae60c5c7a2f198b06a89055ed449cdd30d44436dcc16593c33f7f978ff9
SHA512 354eafcc3eb10515c58c560728b554dc243d38ea2e5e176f320c3d2a25a858ff4f64dd7aeb87ce70a0fbdaab2d8bcca2c2945030a8caf45eb73ae297a8bd4d68

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\es-419_get.svg.bianlian

MD5 be4a9d2703137ee036e31f45fe2324c4
SHA1 1f3bc048641e2e0a9941b93a1425263bf8fa302b
SHA256 60b8aa7562aae04d91dac36571cdeec39b10584f107f3663421c360164012345
SHA512 3c5e8e345c6ffa6b944e10c78d194322a6a09f3ba93fe3d39dedb25066cf80b6f4fab7feda6ffe53c3faac3b72284f9cc5c1308f431fc4299faf34404210d954

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\de-de\PlayStore_icon.svg

MD5 dedfecd88ded87d50360d0b912a384ae
SHA1 1bc36dd41d77abb53a60fa7faaab657f88a524a4
SHA256 295ad0406aad8f3f57c2c6f640255ada06f8fc86029367d6e62d7681dde1c95b
SHA512 0e57411ee1336656906d37e490f288d1d9f34121ea1675eb29869a5e856343793da0bb50d509900da5c8b3da01de668edb53d4ceec329a51e7cc695217ea1b57

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\fi-fi\AppStore_icon.svg

MD5 2db26a091d599341ef33963c44fff94c
SHA1 7153c7b4200214ade55de2ea1cb0a10e4a2d8c61
SHA256 55bcefb028bb43e55e621fc406c5929f0819f95440a436cd8f1ca6b3ea294b77
SHA512 0ee54c0ddcfd6502e57648e5f238e8cc90857ab05b2e71005cf2d0ac7a8d43d389f8258867afd810ff187db944f493301343dd9111f51a0673038d1087d75924

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\tr-tr\PlayStore_icon.svg.bianlian

MD5 5fcffb38b8821207a9ac0c6c2e56e6a6
SHA1 c8d748bd1eaa187bcbfd206f71e59bc8c5ad99e9
SHA256 1801f3ef59ebdfd977e825413749332138d66c7fd1882e89885560f437cff7c1
SHA512 a1fb1594f0dda5ee3c8eeed0ed2bb6b78ff270e7f5458f5521c73da358acf54704fc7385027ad175c132a5a0f9dbe94fa506d64b16032ba5457b0781f822d6f7

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\nb-no\AppStore_icon.svg

MD5 27c0f19aa80d10049503015f30e931ef
SHA1 8aaabf3e340fbd8d6f21b5a8c2a5420b1982ef67
SHA256 cd745b4da540836e7915b7e8dfbb9a040194941a12634528151d7a686f471248
SHA512 40ed4dab1d2f56a9734471014cc5f6b309e882472530b927a8588b8292c7ef4350de57609094aae6a9699f170518806ee7a8acc69337f9434d54df4624baaef1

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\da-dk\AppStore_icon.svg

MD5 730962955515f2ca993e2d3b44332a2a
SHA1 c172df89b843f0b7eb7d9106bca25908201d212c
SHA256 1b46ab660b7ce914a3734ee6ecd0d06a83d984658f69cc86d63d1584f1fcd88a
SHA512 55461c82db63648cd3d51952c7785ac13dc4e0d63b0ef63e8b5de6b2f5145071d4e775136d27cb56b1a3fa4b4fc1eb7c4b65a7600799192a0e303f929487436e

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\pl-pl\AppStore_icon.svg

MD5 477faf64379878ffa705f36eef6d7fda
SHA1 55dd89f660e4bc9c235d2a47f5ef589ebd36e926
SHA256 82f7f7e5e80cb64e59223fd11cc75fe9493a7ab8a0ca68c79892882d421082c5
SHA512 924d81a4abcff8f402b17e6b032aa8e91665b0a3447f58205fa0619dac467e6c70a2a4b0201cdec609289818421f223ccd716305c98661822fd3003e4c1ceae4

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\ru-ru\AppStore_icon.svg.bianlian

MD5 3070a63fb0f657d5f3a93a03581da4b5
SHA1 fd6d3f1edf29ad9a04262f32bc6a373a56fd3034
SHA256 d95b1f4ce43b5471e045e14b18aec652290cf9e6ecf775875a3f66a9a8534cf4
SHA512 b4f1955ea101c3d24ab102452777f0626de4e42573f2ae5b982b354510490046e2b32070e7c27643c4d6df8a515535f893bbdbdba992fb7c1c468c7ebd1bc783

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\sv-se\AppStore_icon.svg

MD5 cb208f7a7b05018eedbd3a56cd6c7bb7
SHA1 87ecd93bc32700d5573ea109830d3711e56e6575
SHA256 a18eb7fb32cd2c804613c34a5528746e95cb9bdbc5f8bb1f3d0e67f59bbc4fb3
SHA512 fd1ff545f2801fd6dd55792ead19ce96e08e071e29e9c7755cff07f1ff5c65dfce200c15a3fbe167a2b7c2fe5c2eb2fbb26a58418c97a03847e26ecbd04be069

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\pl-pl\PlayStore_icon.svg.bianlian

MD5 96e7d192b2a547a857b35f4fa52f3dd7
SHA1 6b4131e54099f55dbd6c090b845874fe70de19bd
SHA256 509511e6861d55b1fb8b3465cc60edf6797f3f2bbd63e85e7c2760e2a2890d28
SHA512 e38c5e59303ed4995ec790dbef7da76dee510b1f22f13768db6a596d19e591a237c561841f3f339c0e28dec5430d4bd879bc0cab369432f68aff8f6426298b56

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\de-de\AppStore_icon.svg.bianlian

MD5 914e465f33561a8814a262df149d094c
SHA1 833d97799686674f985297721497fffbba9d7612
SHA256 218c03ffe345236b8c2542411cc3c79cdac0e1d70e5db1427c735d0b97ee94be
SHA512 62d2f5b8992c96a49b0e05c9801453d45a667c048acc569362a8dc3746a2b6f88f162842fc939170db847d603de2506b2abe14bd866ce7a1aa2d8b62e3f16f26

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\it-it\PlayStore_icon.svg.bianlian

MD5 a1227e5908c248e7b3d680e767488a65
SHA1 05b7398e227968033624436f0cb299b050f5e5e0
SHA256 b65ed2fe0f687034dd264702d9fda9808a30c5748abe7a6a6fded99459982adf
SHA512 89ba1e102973971afee7fe37affb2d475bce4114358887c1e2b20ff68b523d301453682e9971363d78661929372b16d3bf834d95f8d603bdb0b4b220f0134d6e

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\fr-fr\AppStore_icon.svg

MD5 6015458cba8da2cac80b3b72926ec573
SHA1 4a8bc0bd9c3a7144e976cd429fe156aa976455eb
SHA256 68c355283224ec3214ab6233cae83decf0741aa6cec79b6448ddc3fbd29e3336
SHA512 828e04bb82b8f9de266c3422b017684a68faf26aa08220b621571d9d44c6c4f8d19c7cd542663d72524f2163019f8c864b068366ed87397a302cb621cb1b32b9

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\pt-br\AppStore_icon.svg

MD5 ca690aacf0d2a12fd3cacac07e3b65aa
SHA1 3073afa13a09f2d794f1cfdb97a23914db931168
SHA256 54ef1d8460cb489fbc6d1d859523de7650bd5ba7440e6c7f67406c3fb661c04b
SHA512 c2c036a1a507e609a9218841b511e869e1789ba48983a719a067384d17a899a62fc7c4d9a4bfd84e77e17034df2dd585a372aa1d56afe69e610c3ead959c3fee

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\zh-cn\PlayStore_icon.svg

MD5 9d9c4e37474589c97592f68d573949e1
SHA1 cfb98502155c31f149ae78b6ea4e6f93f36c86b4
SHA256 cf7cfc0e932021f157383f9586a23076b7bf6b0be2de4f083dbd26c5615adff7
SHA512 9f8b2f82f9b94c7f4c85572d9f493a46404b8edfee8843d1869863e2b310a225db01facedfb7320cec62768528b55a3a10488c9873d6505bd551f1732975581d

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\it-it\AppStore_icon.svg

MD5 ba91c23a6d10851209d8225e6ea35a2b
SHA1 1f0407403e23dd826f4de7273accddaea692eabc
SHA256 b513be6110c4370ef9f8eb720e3a3ee863f228b3691969a991aa34f215fb4920
SHA512 9023e23ec39225e4a28eb6c9a3b5458ac94ae2c194cf1a27f70b68159ed6070614cb3e4b2243dfc7003cfe5347e7e43351d6b4ce2bfc769348737151b8a28a73

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\fi-fi\PlayStore_icon.svg.bianlian

MD5 6fce99abc650ff13b97ccc742ad9ab02
SHA1 d27d45e2442e5f637285aedc03083ed735eb6826
SHA256 4399af66680c5b30f847040dc31231cf05d15de72567e01d16ff42cbf2930b56
SHA512 18c0430962b2f1ce82a0c8345dabbb7e6de201eef57219b56ead10b8ba27b73122420aaf8afc49db09f085fce66411cf4df5ea7bc810cf977bb1435628cf6f79

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\tr-tr\AppStore_icon.svg.bianlian

MD5 71af97a192a8da1d1d8d358dc8a2d7e2
SHA1 176be1e21e51c683d747e3dcad9568b053e363dd
SHA256 ca6bc82956d1bd0916ca815c701d8a4d96ca9c6dad3e10f3d3ef149b37be344f
SHA512 3bca1f7ba199be374c3cd200e0c719e7c4cb208fbb4d8a23d14edff7a3f11dc2f215ee13bed83e41aeedf1f0937b9da8e82ec56595c4095b92fef226fa305d5c

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\zh-tw\AppStore_icon.svg.bianlian

MD5 3e69fe715d5057615c96521db4d6e0ae
SHA1 2e73bb721b98838475175e856832f2f13a1bf7fa
SHA256 820604fa0d9cdb650b4379069bfd405d8e3563adaf4c4e1884e932a6a7730848
SHA512 e04df37776c7c308d5ab600a7ac2951d12f4f86c5221796e9b556cbd03dcf3b8d010c72b004cc76e6840667503dd84ad1c454f9c89082135e6a4c698951a5eab

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\cs-cz\AppStore_icon.svg

MD5 d62c268565810aeb5cd812c79ca9a37a
SHA1 445b4ecfc51202410cd32a46b6ba46eb7211160b
SHA256 6b9ecb8cfd3754b49cd449ccf0bbf3b82d8d75ed81085fb30e673bfac1ec637d
SHA512 d9041e0578f0a9813937c4241a6c2e5f64675b140c8f3e0873c3f2fabc238d9ed1edbe2e3e6351fbf1c5073d10a0647c8cbf97633d5ea70e71898571c2da178c

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\zh-tw\PlayStore_icon.svg

MD5 ec3cd4c6c714e4d833d178fa5274c0c9
SHA1 2adf486f869cf56857322f2a482d513d8d7f96c3
SHA256 a04e533c875916cac88579e065a6e6393180beb7a1284c90f28b68e5edd826f8
SHA512 a45777ef0d14ef2770aebdcdae800340158bef7f41db994c594bae0c4daa17e94552baa7e73ddf7cea9284b3c00d824199da38b833ab4b284c5b9753f6bf83df

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\zh-cn\AppStore_icon.svg

MD5 8d0db1032b9bd83d6b37a9cf8792f6c6
SHA1 36a1d4ee2c70dcd5e25dc9bd1f2baa8dfdf22daf
SHA256 7babf2e6c4e6d31204af8a3294406112129bad4ec652c03451737a5e492ca21c
SHA512 c34d2ea076d8362f533f532ed6cea47d0f8decaa40fb5f4cc271eb4634449d4362b5753930f011f5d0b3f713c312648e9e291f33e92d9bc018ebd1ca1096ff84

C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.OneNote.OneNote.x-none.msi.16.x-none.xml.bianlian

MD5 89a71e94d5d45ea34a306d5ecfed6c07
SHA1 24db3b14f2e50ee514d2ffaee390dd5347621bfa
SHA256 196200077281a920a7106bcec9c2d04415eb075c5d5bb10a6293d30afbdf774b
SHA512 8414979b1aaa6539a83ef49192ea7da42482bc5ddad2e1a9ca717fca27b75c0147edaec269808f5d260ce215a7c23ec4ae31a0894c3b47af9ae5e6f725826c8c

C:\$Recycle.Bin\S-1-5-21-2178924671-3779044592-2825503497-1000\desktop.ini

MD5 733f0e276869599d8f8fa02e83cef549
SHA1 4cf1e1259b7bf57fb66056c7c42a99c802f2c1f4
SHA256 3422b15799710170487bd6bb8cb6dafe864c17bdff1f855c0de4b4b60b30f86f
SHA512 236c309d4b3484ba0b61ee77c4a76ec9e183b7ff61c0ec7a6a95771463c83d5b32d48e6ac9387a3793c9a9c1df5eb07f562dc0deab9ed4889827f37936f1ceac

C:\Program Files\Java\jdk1.8.0_66\db\bin\startNetworkServer

MD5 aa34c87c8ca671da8f386d8dc341bf77
SHA1 9ca98635379a3b6dd3fff3375f5f628215e5d022
SHA256 1076aca2e0239d81c83b00300d7e82f20a3b60588122a22b8d9610c8a68fff06
SHA512 f4d77c90e91199bd103f0852c116e742217829dc71d9ef1c3a55df83d4284a1d0d5bf271424b99b5f234b4faba68c8496bda68ead35c88c021d56efeb3017bbc