Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
23-10-2023 02:53
Behavioral task
behavioral1
Sample
51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe
Resource
win10v2004-20231020-en
General
-
Target
51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe
-
Size
340KB
-
MD5
714870c33ba84e744b84b32e6e114ed9
-
SHA1
840f442d4466713becdf72b88846871330ac38e7
-
SHA256
51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51
-
SHA512
270c584cc9f696de3421429627a07bfbd7829a033cfdc16280e7e233e8ae09e2f1cd0341537a6b050811683d93a14a1465aa3ab96e9577c98ebea521faae65f2
-
SSDEEP
6144:PNs9prB0CnszdPZxMzk1ukSXa9bnuDOeFdGpBP7ENf3zcfUE:y9RaPZxMzk1uBXa9bu2JeAfUE
Malware Config
Extracted
\Device\HarddiskVolume1\Boot\bg-BG\HOW_TO_BACK_FILES.html
Signatures
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
description pid Process procid_target PID 2796 created 3320 2796 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe 71 -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
pid Process 4312 bcdedit.exe 2848 bcdedit.exe -
Renames multiple (6946) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
pid Process 60 wbadmin.exe -
pid Process 5064 wbadmin.exe -
Modifies Installed Components in the registry 2 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-356073083-3299209671-3108880702-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-356073083-3299209671-3108880702-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BabyLockerKZ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe\"" 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe Set value (str) \REGISTRY\USER\S-1-5-21-356073083-3299209671-3108880702-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BabyLockerKZ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe\"" 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\S: 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe File opened (read-only) \??\U: 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe File opened (read-only) \??\L: 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe File opened (read-only) \??\Q: 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe File opened (read-only) \??\H: 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe File opened (read-only) \??\I: 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe File opened (read-only) \??\K: 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe File opened (read-only) \??\M: 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe File opened (read-only) \??\R: 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe File opened (read-only) \??\X: 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe File opened (read-only) \??\F: 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe File opened (read-only) \??\A: 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe File opened (read-only) \??\T: 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe File opened (read-only) \??\W: 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe File opened (read-only) \??\Y: 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe File opened (read-only) \??\B: 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe File opened (read-only) \??\P: 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe File opened (read-only) \??\J: 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe File opened (read-only) \??\N: 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe File opened (read-only) \??\O: 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe File opened (read-only) \??\V: 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe File opened (read-only) \??\Z: 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe File opened (read-only) \??\E: 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe File opened (read-only) \??\G: 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\it-IT\HOW_TO_BACK_FILES.html 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-24_altform-unplated_contrast-white.png 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-256_altform-lightunplated.png 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\pt-br\ui-strings.js 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Fonts\private\GOTHICBI.TTF 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\LTR\contrast-white\SmallTile.scale-125.png 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_2019.19071.19011.0_neutral_~_8wekyb3d8bbwe\AppxSignature.p7x 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\iw_get.svg 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\fr-ma\ui-strings.js 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\HOW_TO_BACK_FILES.html 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\id\msipc.dll.mui 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\BUSINESS.ONE 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\cross.png 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Locales\sv.pak 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-80_contrast-black.png 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\zh-cn\HOW_TO_BACK_FILES.html 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\423x173\30.jpg 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedMedTile.scale-100_contrast-black.png 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\lv-LV\View3d\3DViewerProductDescription-universal.xml 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\ca-es\ui-strings.js 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\sound.properties 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\AppIcon.targetsize-256_contrast-white.png 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\faf_icons_retina.png 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\eu-es\ui-strings.js 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\themes\dark\SearchEmail2x.png 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-80.png 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe File created C:\Program Files\WindowsApps\Microsoft.ScreenSketch_2019.904.1644.0_neutral_~_8wekyb3d8bbwe\HOW_TO_BACK_FILES.html 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe File created C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\de\HOW_TO_BACK_FILES.html 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\AppxMetadata\CodeIntegrity.cat 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxSignature.p7x 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME-JAVAFX.txt 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe File opened for modification C:\Program Files\PopMeasure.001 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Dial\Lighting.png 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-GoogleCloudCache.scale-150.png 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\zh-cn\ui-strings.js 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe File created C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\HOW_TO_BACK_FILES.html 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\AppPackageAppList.targetsize-80_altform-unplated.png 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\StoreLogo.scale-150.png 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe File created C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\HOW_TO_BACK_FILES.html 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.NET.Native.Framework.1.7_1.7.25531.0_x64__8wekyb3d8bbwe\AppxMetadata\CodeIntegrity.cat 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteNotebookMedTile.scale-125.png 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\TXP_BillPay.png 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubWideTile.scale-100_contrast-high.png 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Franklin Gothic.xml 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL109.XML 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\LargeTile.scale-125_contrast-white.png 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Videos\Help\RoundedFreehand3D.mp4 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe File created C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\es-ES\HOW_TO_BACK_FILES.html 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\fi-fi\ui-strings.js 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\1033\HOW_TO_BACK_FILES.html 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe File opened for modification C:\Program Files\Windows Media Player\ja-JP\wmlaunch.exe.mui 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\RTL\contrast-black\MedTile.scale-125.png 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\en-il\ui-strings.js 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\Square310x310Logo.scale-100.png 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\MixedRealityPortalStoreLogo.scale-100_contrast-white.png 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ar-ae\HOW_TO_BACK_FILES.html 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\zh-cn\ui-strings.js 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ko-kr\ui-strings.js 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Transit\contrast-black\SmallTile.scale-125.png 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\tesselate.x3d 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\cs-cz\ui-strings.js 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe File created C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\HOW_TO_BACK_FILES.html 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\NavigationIcons\nav_icons_trending.targetsize-48.png 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\HOW_TO_BACK_FILES.html 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.3.etl wbadmin.exe File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.2.etl wbadmin.exe File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.1.etl wbadmin.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 3508 vssadmin.exe -
Kills process with taskkill 14 IoCs
pid Process 3624 taskkill.exe 4412 taskkill.exe 1064 taskkill.exe 376 taskkill.exe 624 taskkill.exe 4368 taskkill.exe 3648 taskkill.exe 1764 taskkill.exe 5032 taskkill.exe 368 taskkill.exe 1416 taskkill.exe 2264 taskkill.exe 3088 taskkill.exe 2832 taskkill.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-356073083-3299209671-3108880702-1000\{6739E80D-D186-41EF-B3A3-ED7B8F222DAE} explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ explorer.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2796 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe 2796 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe 2796 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe 2796 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe 2796 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe 2796 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe 2796 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe 2796 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe 2796 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe 2796 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe 2796 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe 2796 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe 2796 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe 2796 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe 2796 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe 2796 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe 2796 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe 2796 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe 2796 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe 2796 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe 2796 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe 2796 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe 2796 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe 2796 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe 2796 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe 2796 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe 2796 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe 2796 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe 2796 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe 2796 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe 2796 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe 2796 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe 2796 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe 2796 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe 2796 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe 2796 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe 2796 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe 2796 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe 2796 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe 2796 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe 2796 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe 2796 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe 2796 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe 2796 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe 2796 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe 2796 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe 2796 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe 2796 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe 2796 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe 2796 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe 2796 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe 2796 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe 2796 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe 2796 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe 2796 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe 2796 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe 2796 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe 2796 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe 2796 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe 2796 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe 2796 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe 2796 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe 2796 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe 2796 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeDebugPrivilege 3648 taskkill.exe Token: SeDebugPrivilege 624 taskkill.exe Token: SeDebugPrivilege 4412 taskkill.exe Token: SeDebugPrivilege 1064 taskkill.exe Token: SeDebugPrivilege 1416 taskkill.exe Token: SeDebugPrivilege 376 taskkill.exe Token: SeDebugPrivilege 1764 taskkill.exe Token: SeDebugPrivilege 5032 taskkill.exe Token: SeDebugPrivilege 2264 taskkill.exe Token: SeDebugPrivilege 3088 taskkill.exe Token: SeDebugPrivilege 368 taskkill.exe Token: SeDebugPrivilege 4368 taskkill.exe Token: SeIncreaseQuotaPrivilege 4040 WMIC.exe Token: SeSecurityPrivilege 4040 WMIC.exe Token: SeTakeOwnershipPrivilege 4040 WMIC.exe Token: SeLoadDriverPrivilege 4040 WMIC.exe Token: SeSystemProfilePrivilege 4040 WMIC.exe Token: SeSystemtimePrivilege 4040 WMIC.exe Token: SeProfSingleProcessPrivilege 4040 WMIC.exe Token: SeIncBasePriorityPrivilege 4040 WMIC.exe Token: SeCreatePagefilePrivilege 4040 WMIC.exe Token: SeBackupPrivilege 4040 WMIC.exe Token: SeRestorePrivilege 4040 WMIC.exe Token: SeShutdownPrivilege 4040 WMIC.exe Token: SeDebugPrivilege 4040 WMIC.exe Token: SeSystemEnvironmentPrivilege 4040 WMIC.exe Token: SeRemoteShutdownPrivilege 4040 WMIC.exe Token: SeUndockPrivilege 4040 WMIC.exe Token: SeManageVolumePrivilege 4040 WMIC.exe Token: 33 4040 WMIC.exe Token: 34 4040 WMIC.exe Token: 35 4040 WMIC.exe Token: 36 4040 WMIC.exe Token: SeBackupPrivilege 1300 vssvc.exe Token: SeRestorePrivilege 1300 vssvc.exe Token: SeAuditPrivilege 1300 vssvc.exe Token: SeShutdownPrivilege 1808 explorer.exe Token: SeCreatePagefilePrivilege 1808 explorer.exe Token: SeShutdownPrivilege 1808 explorer.exe Token: SeCreatePagefilePrivilege 1808 explorer.exe Token: SeShutdownPrivilege 1808 explorer.exe Token: SeCreatePagefilePrivilege 1808 explorer.exe Token: SeShutdownPrivilege 1808 explorer.exe Token: SeCreatePagefilePrivilege 1808 explorer.exe Token: SeShutdownPrivilege 1808 explorer.exe Token: SeCreatePagefilePrivilege 1808 explorer.exe Token: SeShutdownPrivilege 1808 explorer.exe Token: SeCreatePagefilePrivilege 1808 explorer.exe -
Suspicious use of FindShellTrayWindow 6 IoCs
pid Process 1808 explorer.exe 1808 explorer.exe 1808 explorer.exe 1808 explorer.exe 1808 explorer.exe 1808 explorer.exe -
Suspicious use of SendNotifyMessage 8 IoCs
pid Process 1808 explorer.exe 1808 explorer.exe 1808 explorer.exe 1808 explorer.exe 1808 explorer.exe 1808 explorer.exe 1808 explorer.exe 1808 explorer.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2796 wrote to memory of 5100 2796 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe 86 PID 2796 wrote to memory of 5100 2796 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe 86 PID 2796 wrote to memory of 5100 2796 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe 86 PID 5100 wrote to memory of 3240 5100 cmd.exe 88 PID 5100 wrote to memory of 3240 5100 cmd.exe 88 PID 2796 wrote to memory of 1348 2796 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe 89 PID 2796 wrote to memory of 1348 2796 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe 89 PID 2796 wrote to memory of 1348 2796 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe 89 PID 1348 wrote to memory of 1352 1348 cmd.exe 91 PID 1348 wrote to memory of 1352 1348 cmd.exe 91 PID 1352 wrote to memory of 3648 1352 cmd.exe 92 PID 1352 wrote to memory of 3648 1352 cmd.exe 92 PID 2796 wrote to memory of 260 2796 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe 94 PID 2796 wrote to memory of 260 2796 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe 94 PID 2796 wrote to memory of 260 2796 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe 94 PID 260 wrote to memory of 4484 260 cmd.exe 96 PID 260 wrote to memory of 4484 260 cmd.exe 96 PID 4484 wrote to memory of 3624 4484 cmd.exe 97 PID 4484 wrote to memory of 3624 4484 cmd.exe 97 PID 2796 wrote to memory of 4736 2796 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe 98 PID 2796 wrote to memory of 4736 2796 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe 98 PID 2796 wrote to memory of 4736 2796 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe 98 PID 4736 wrote to memory of 3868 4736 cmd.exe 100 PID 4736 wrote to memory of 3868 4736 cmd.exe 100 PID 3868 wrote to memory of 624 3868 cmd.exe 101 PID 3868 wrote to memory of 624 3868 cmd.exe 101 PID 2796 wrote to memory of 3100 2796 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe 102 PID 2796 wrote to memory of 3100 2796 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe 102 PID 2796 wrote to memory of 3100 2796 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe 102 PID 3100 wrote to memory of 1808 3100 cmd.exe 104 PID 3100 wrote to memory of 1808 3100 cmd.exe 104 PID 1808 wrote to memory of 4412 1808 cmd.exe 105 PID 1808 wrote to memory of 4412 1808 cmd.exe 105 PID 2796 wrote to memory of 4508 2796 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe 106 PID 2796 wrote to memory of 4508 2796 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe 106 PID 2796 wrote to memory of 4508 2796 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe 106 PID 4508 wrote to memory of 4576 4508 cmd.exe 108 PID 4508 wrote to memory of 4576 4508 cmd.exe 108 PID 4576 wrote to memory of 1064 4576 cmd.exe 109 PID 4576 wrote to memory of 1064 4576 cmd.exe 109 PID 2796 wrote to memory of 4564 2796 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe 110 PID 2796 wrote to memory of 4564 2796 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe 110 PID 2796 wrote to memory of 4564 2796 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe 110 PID 4564 wrote to memory of 536 4564 cmd.exe 112 PID 4564 wrote to memory of 536 4564 cmd.exe 112 PID 536 wrote to memory of 1416 536 cmd.exe 113 PID 536 wrote to memory of 1416 536 cmd.exe 113 PID 2796 wrote to memory of 404 2796 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe 114 PID 2796 wrote to memory of 404 2796 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe 114 PID 2796 wrote to memory of 404 2796 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe 114 PID 404 wrote to memory of 4052 404 cmd.exe 116 PID 404 wrote to memory of 4052 404 cmd.exe 116 PID 4052 wrote to memory of 376 4052 cmd.exe 117 PID 4052 wrote to memory of 376 4052 cmd.exe 117 PID 2796 wrote to memory of 2268 2796 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe 118 PID 2796 wrote to memory of 2268 2796 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe 118 PID 2796 wrote to memory of 2268 2796 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe 118 PID 2268 wrote to memory of 872 2268 cmd.exe 120 PID 2268 wrote to memory of 872 2268 cmd.exe 120 PID 872 wrote to memory of 1764 872 cmd.exe 121 PID 872 wrote to memory of 1764 872 cmd.exe 121 PID 2796 wrote to memory of 3112 2796 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe 122 PID 2796 wrote to memory of 3112 2796 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe 122 PID 2796 wrote to memory of 3112 2796 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe 122 -
System policy modification 1 TTPs 4 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3320
-
C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe"C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2796 -
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c rem Kill \"SQL\"3⤵
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c rem Kill \"SQL\"4⤵PID:3240
-
-
-
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlbrowser.exe3⤵
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c taskkill -f -im sqlbrowser.exe4⤵
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\Windows\system32\taskkill.exetaskkill -f -im sqlbrowser.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3648
-
-
-
-
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sql writer.exe3⤵
- Suspicious use of WriteProcessMemory
PID:260 -
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c taskkill -f -im sql writer.exe4⤵
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Windows\system32\taskkill.exetaskkill -f -im sql writer.exe5⤵
- Kills process with taskkill
PID:3624
-
-
-
-
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlserv.exe3⤵
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c taskkill -f -im sqlserv.exe4⤵
- Suspicious use of WriteProcessMemory
PID:3868 -
C:\Windows\system32\taskkill.exetaskkill -f -im sqlserv.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:624
-
-
-
-
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im msmdsrv.exe3⤵
- Suspicious use of WriteProcessMemory
PID:3100 -
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c taskkill -f -im msmdsrv.exe4⤵
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Windows\system32\taskkill.exetaskkill -f -im msmdsrv.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4412
-
-
-
-
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im MsDtsSrvr.exe3⤵
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c taskkill -f -im MsDtsSrvr.exe4⤵
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Windows\system32\taskkill.exetaskkill -f -im MsDtsSrvr.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1064
-
-
-
-
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlceip.exe3⤵
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c taskkill -f -im sqlceip.exe4⤵
- Suspicious use of WriteProcessMemory
PID:536 -
C:\Windows\system32\taskkill.exetaskkill -f -im sqlceip.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1416
-
-
-
-
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im fdlauncher.exe3⤵
- Suspicious use of WriteProcessMemory
PID:404 -
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c taskkill -f -im fdlauncher.exe4⤵
- Suspicious use of WriteProcessMemory
PID:4052 -
C:\Windows\system32\taskkill.exetaskkill -f -im fdlauncher.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:376
-
-
-
-
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im Ssms.exe3⤵
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c taskkill -f -im Ssms.exe4⤵
- Suspicious use of WriteProcessMemory
PID:872 -
C:\Windows\system32\taskkill.exetaskkill -f -im Ssms.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1764
-
-
-
-
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im SQLAGENT.EXE3⤵PID:3112
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c taskkill -f -im SQLAGENT.EXE4⤵PID:2852
-
C:\Windows\system32\taskkill.exetaskkill -f -im SQLAGENT.EXE5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5032
-
-
-
-
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im fdhost.exe3⤵PID:4944
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c taskkill -f -im fdhost.exe4⤵PID:3108
-
C:\Windows\system32\taskkill.exetaskkill -f -im fdhost.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2264
-
-
-
-
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im ReportingServicesService.exe3⤵PID:3360
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c taskkill -f -im ReportingServicesService.exe4⤵PID:4888
-
C:\Windows\system32\taskkill.exetaskkill -f -im ReportingServicesService.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3088
-
-
-
-
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im msftesql.exe3⤵PID:3152
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c taskkill -f -im msftesql.exe4⤵PID:4748
-
C:\Windows\system32\taskkill.exetaskkill -f -im msftesql.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:368
-
-
-
-
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im pg_ctl.exe3⤵PID:2436
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c taskkill -f -im pg_ctl.exe4⤵PID:4780
-
C:\Windows\system32\taskkill.exetaskkill -f -im pg_ctl.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4368
-
-
-
-
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -impostgres.exe3⤵PID:3092
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c taskkill -f -impostgres.exe4⤵PID:4288
-
C:\Windows\system32\taskkill.exetaskkill -f -impostgres.exe5⤵
- Kills process with taskkill
PID:2832
-
-
-
-
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop MSSQLServerADHelper1003⤵PID:4588
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c net stop MSSQLServerADHelper1004⤵PID:4760
-
C:\Windows\system32\net.exenet stop MSSQLServerADHelper1005⤵PID:2004
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSSQLServerADHelper1006⤵PID:1836
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop MSSQL$ISARS3⤵PID:1844
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c net stop MSSQL$ISARS4⤵PID:3948
-
C:\Windows\system32\net.exenet stop MSSQL$ISARS5⤵PID:5068
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSSQL$ISARS6⤵PID:1748
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop MSSQL$MSFW3⤵PID:4912
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c net stop MSSQL$MSFW4⤵PID:260
-
C:\Windows\system32\net.exenet stop MSSQL$MSFW5⤵PID:4108
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSSQL$MSFW6⤵PID:4196
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLAgent$ISARS3⤵PID:3292
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c net stop SQLAgent$ISARS4⤵PID:448
-
C:\Windows\system32\net.exenet stop SQLAgent$ISARS5⤵PID:3256
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SQLAgent$ISARS6⤵PID:2864
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLAgent$MSFW3⤵PID:4896
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c net stop SQLAgent$MSFW4⤵PID:3456
-
C:\Windows\system32\net.exenet stop SQLAgent$MSFW5⤵PID:3528
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SQLAgent$MSFW6⤵PID:3824
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLBrowser3⤵PID:4560
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c net stop SQLBrowser4⤵PID:4012
-
C:\Windows\system32\net.exenet stop SQLBrowser5⤵PID:1648
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SQLBrowser6⤵PID:4180
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop REportServer$ISARS3⤵PID:764
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c net stop REportServer$ISARS4⤵PID:4028
-
C:\Windows\system32\net.exenet stop REportServer$ISARS5⤵PID:4468
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop REportServer$ISARS6⤵PID:1288
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLWriter3⤵PID:2056
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c net stop SQLWriter4⤵PID:456
-
C:\Windows\system32\net.exenet stop SQLWriter5⤵PID:3836
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SQLWriter6⤵PID:3744
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c vssadmin.exe Delete Shadows /All /Quiet3⤵PID:2924
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c vssadmin.exe Delete Shadows /All /Quiet4⤵PID:1784
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet5⤵
- Interacts with shadow copies
PID:3508
-
-
-
-
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wbadmin delete backup -keepVersion:0 -quiet3⤵PID:1668
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c wbadmin delete backup -keepVersion:0 -quiet4⤵PID:4864
-
C:\Windows\system32\wbadmin.exewbadmin delete backup -keepVersion:0 -quiet5⤵
- Deletes system backups
PID:5064
-
-
-
-
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wmic.exe SHADOWCOPY /nointeractive3⤵PID:4408
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c wmic.exe SHADOWCOPY /nointeractive4⤵PID:2288
-
C:\Windows\System32\Wbem\WMIC.exewmic.exe SHADOWCOPY /nointeractive5⤵
- Suspicious use of AdjustPrivilegeToken
PID:4040
-
-
-
-
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTABACKUP -deleteOldest3⤵PID:2536
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTABACKUP -deleteOldest4⤵PID:2264
-
C:\Windows\system32\wbadmin.exewbadmin DELETE SYSTEMSTABACKUP -deleteOldest5⤵PID:3160
-
-
-
-
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c bcdedit.exe /set {default} recoverynabled No3⤵PID:1340
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c bcdedit.exe /set {default} recoverynabled No4⤵PID:4700
-
C:\Windows\system32\bcdedit.exebcdedit.exe /set {default} recoverynabled No5⤵
- Modifies boot configuration data using bcdedit
PID:4312
-
-
-
-
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures3⤵PID:1052
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures4⤵PID:1500
-
C:\Windows\system32\bcdedit.exebcdedit.exe /set {default} bootstatuspolicy ignoreallfailures5⤵
- Modifies boot configuration data using bcdedit
PID:2848
-
-
-
-
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTATEBACKUP3⤵PID:1764
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTATEBACKUP4⤵PID:1932
-
C:\Windows\system32\wbadmin.exewbadmin DELETE SYSTEMSTATEBACKUP5⤵
- Deletes System State backups
- Drops file in Windows directory
PID:60
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe\\?\C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe -network2⤵
- Adds Run key to start application
- System policy modification
PID:4464
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1300
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1808
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5495a7202cc390e06884337327ec04800
SHA1faf823cf5c503893e3f4f340553cd2759be98ddd
SHA256a0babc775275019944143de5e1a3698411555214fa0e97e526f3f610e0f7d9d4
SHA512bd7ffb62a41bdf44a62dd0c38c047e08f00111a5a4f4d5e523006ede90288d24faa54d08456da725a12bc8d749ba135a81b55fb29042e67c0039d9d52dbc1b71
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\aic_file_icons.png
Filesize52KB
MD50b94b98b9f7897227e8d50116febc923
SHA1ecf2e7413df44551290ff20fa2fe89d744cff118
SHA2566d7610287f8bd2e683515e4a24a6060995643ce6f57f4e667150c6e4ebe429f1
SHA51271dddf6d2853527f983c4588e3aac5f5407bb20e4ebf26002fd72e9dbc59703784ed3d794d34c86c64bda5a8763412efcd85c59ba7b71feed360edd3d16010e9
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_remove_18.svg
Filesize2KB
MD59def3f150f527ddfcf46044c84e6d077
SHA1c8342ea260c9afea4be7ae0c14690d9209e100c8
SHA256753ccf7073aa87955e611617d755af33a7c0c3b29454f35d8d6db8568462239b
SHA51274cd21c4bcb23a8f388c328f6bb122bcbd4922efb798e29bdd55d5c199ecf8bde48f0afe1c9f88c632dc6a75286f872cd52ffc93760aa1c8612f2940604c5f0e
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions.png
Filesize3KB
MD51214e13655cc11dcb00525cb19dec1fa
SHA1beab8f98c6dd3c4892ddfd7397beca83c5b8de0c
SHA25663313ac7d7b52945ff58b9ea23de0ab492f7e402890ce84b6864ac81640a7196
SHA512ca5a2205540de3f920e0d5452a9883edf0f5642cd51f1acd96c4e7e2fc4408b7bb55324a1620588276b3c43ea32e09c377af109ae9866369e7b9a33a824738ad
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions2x.png
Filesize5KB
MD52aa8d5531738fd783366568c67684ede
SHA1bb751e102d05a728f1700ae6912de25bb000f045
SHA256c7154f27d518a4b8adede4b93d470a3effc6c87c91df2edad40d1c717cb1eb04
SHA512fd58ec05923dd545e44c602c9a77f501b368f976890779740edb3184875cc122e3f56bed7843b800b2d3f3d0dfdba2a64ef6236f72f8890e03e283cae7ae9dea
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\duplicate.svg
Filesize3KB
MD5eba87ea4833f8d47e1a04815221bf502
SHA1125b78855e2dc21a5ed746820331552995a79545
SHA25672fda28d4c60807678021839210e4c14dac33e20bed62be6cf1cf27c0da93d99
SHA5124897cf08e725907d9862c77d1e921049663954f52f39a96f3ebc7b0dcfdb3d9cd4259ff039c48edd7672d583c4e31b4702b0a73b7d4f571706bb66d02beb726b
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\remove.svg
Filesize2KB
MD5ac9d3ddb53bedb4feeb129c1acf18f6a
SHA177e56939dc1cab72ab5072974cf8a2ee0ed85689
SHA256b9930189fbd6a0915ede177c71fcbfc76ba037d4990c2d09ef43d4f8e9158f0b
SHA512782318be1a960bf94690009ca82181cd944cb49b5335c657ce0b13ee59bad1bb9f624f23fbc834911d0e0364f6e7ed7c252ddea92a51d4c456384d6d81ef8581
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_editpdf_18.svg.infected
Filesize2KB
MD505ab8085d96d8196298f77efd6d5ffdd
SHA14d6511e8525f2d6532a28646a18849c307578716
SHA256875e746981d3984e5fd4ddd4850d395b8f4387ffdba6111250bc4033f50e8ead
SHA51257d620f5f19cf7912752d657f81ba522c4a2bd10d41350a7a37d1e4db68c9eb45c3c1f1b81d8a00fca7b3fc27f883e59d2a57a6b7b59806560cde02d6f6d6299
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_export_18.svg
Filesize9KB
MD5c4ee5ae1f54b4b57771969b0971330ba
SHA1c189010d82c3337c9cd2a4006c2b3bc60f55a34a
SHA2562648d6b7cfca31a1cf3c22e2377b1102c49219d75c48a98d85d93b599591a5d0
SHA5129fc108b49c676496c1ec6a4dceb7350325f8d84c532f895e4411e556575365d5cdbbec4dfca68970100b16607c24efc2aae6081c5880a854b56badf697bdf361
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_fillandsign_18.svg
Filesize3KB
MD53c50727419da781102a23f5d392f5342
SHA1ac1a34db0fa1424857bfafcc3da97221080395a3
SHA256528cda1042ada797fec8793a0eecbde176aa655b318c175a2a1a6189b71cf446
SHA5120e4bf6f3a49df14473d587e1a694548b4d54f2b44d990c969fd5b7c2f5832f7172288bcbf214fc9c5f522d9331793db0f9af33c8534a896e742e69c6d6deb21b
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_folder-default_32.svg
Filesize2KB
MD56cc1e6fb12e440bba6aeedc585f54238
SHA1edd632260e712eb6fea00ee333ec8e37349e6275
SHA256709017d0db45f115484bad59a23e169f75d7dbcb64874b1102ee4381ccdb174f
SHA512a8cc5ed20a90fec513ae98db4908290b7f7edfe76fcd1ccd8b9e5d8c13129293582193522970a896a449c94c12f411c0e1dbdce2630a52ecd852fdf14e5d7885
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_move_18.svg
Filesize2KB
MD5eeb8d24d43cf44c798decdb2dfebc13f
SHA13ec4094d317db6380b0925e11eb18a86539df3fc
SHA2560f190174cd2b7d1767034f003b87e10cdd044489ee487e63ea4be0e8e88b09d4
SHA5126bc53cc49f37e76d8641f931d775cdb6073a32356750813466dc53c3bbd42e3e897a5490074b65bb317bbdd7c7f2ab927e41f75845f91369b7926a3b5d9f39c9
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_nextarrow_default.svg
Filesize2KB
MD56a3cf434e34dbe2399ea4cffe71fd018
SHA1848ee604bbaf4da588d61b41615d7e7cda1e9d63
SHA25681d5f4b3cf808ed0e7862a4c64a6247b3b3d546342494483cac9d12f56ec232c
SHA5126d323520998eb67c15eb351aef9905b20d93ca004b19e123e1c2dc8d58bc0fa832f531f08567bd13ca01e5b382242e3a00a6d3446d101315c4d6002c6ca8637a
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_organize_18.svg
Filesize3KB
MD56e9d316e26407ea36d4482cc65ba1aa7
SHA1e318850bba648b85d70bdeb9c211ec1e7780d29f
SHA256d5b717cea24e141fb76ee8dbb87abcb5384978a0cb2072125982ab31f57e5d1e
SHA51284ebded77ca7685f66c59106e6bd3cfdb0f0ca2b777ffffab871fae2ac68ec3dd59f34d0919cd4c533cdcf7d9700afa3158295a448fd6aa3c9b75637398e124d
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_rename_18.svg
Filesize3KB
MD5d455d25a032b762a062e1ccd58c587bb
SHA1a43f83d0d1c63798811819d7d4277b6af7c5d054
SHA256177439bf94200e4dd0a7448f9c5ac45c23c7824ca344d2956af2994473d4fdd2
SHA512166433291f8ba58c40027c879a249a7fc311a94242d899762dea236ab9d6201d391e8a189f7893ee2bedd46aac32127f561b6bfdaf986a0571bb6ac952a8a3ed
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_sendforsignature_18.svg
Filesize3KB
MD584b57156151eb9b99c537a25851a5130
SHA1cf6eaaf1dcd30412529bc46eb967318d3d5cb4a9
SHA256860ae670c9742c61f3d9e294ad7eefc8abf0ed63953218871d372a1f9876b4c4
SHA5121d966c89fd3f19ce882182a49df05dadbc563b3002cb3837ad757f19dde9ee9ac24659e57ef154865f165f7522ae7c705530b37853a0a5c1349ec06ff0fc8e17
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_share_18.svg
Filesize2KB
MD5b51d9b40459af97bc5c68891634ba321
SHA12145ba09777a1a6b47cf0c8e22c01bc68d8af8bc
SHA256a73c60a49ce104036c12807613f1f8b9098c7aba0a1f10393c4dbbd4c48e4896
SHA512f89a9242df23a1e8e69e7fb6c087cf7823308f79c9fc3d21153fcd83d4060e549ef7bad8d9cb2ea185d355ac37eb6fbf3f81c9a12e477abce61543dad73e5376
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\root\ui-strings.js
Filesize5KB
MD53a19e60694c6d0b0a97b48756907405a
SHA17dc97dd9bcff91a1a9754680f7791c7c21145d23
SHA256ead5a9b35c8e77105bedc9f3436fe4122dca5c27933f4fca5fe85a06c6e5f047
SHA512f40882370ee94a916a8be1f025a793a8ea52e8c3672c36bac37ce7f28e24aaa18faf6caf0b0552edab5adaefe90eb36da2a3fc960c3e988355fa26cf315defe5
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\root\ui-strings.js
Filesize29KB
MD59e50c91874ef170d0e8bee788c9f274b
SHA1a03db38a0e0e53d7ff917c73e77dfd07478bc60d
SHA256027dbda480cf34c059f66821890e4db41fd5a87e5771263789b7da2e5b2a1d8f
SHA5122eeb464eb14a3342bef9997d30ca7ca2f8bdfa35e5aa977cbfbb807ec08cd8f3eb289b4107542c99b3368ecfebd7fd87b577a80d2ffe2062c12bd06d0c8820ad
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\he-il\ui-strings.js
Filesize2KB
MD535e79acc810446216c99cc60dfb9a5ea
SHA11d32a08348a727735975498f5a8064ac8f821936
SHA256961f2a4e22e04ffd669ed4d89a3e2ac9cd0624a340fea244803625933daba55e
SHA512fce1038ef4935c5ec584f2acb7d903aa1090750c469ae3a75fe6fca8ee67f86edc9b0ddf7853ded2a474bfea2a9ea55c71bc0703ffb3ba8435f2de2c15a71e14
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\root\ui-strings.js
Filesize5KB
MD50e330e74767b0418aa545e944d43a3e8
SHA1d6cf73a367466915b59e91a79015dd05a03c9249
SHA256d1b3aed4aab3f145e5607b02989d67a9723f25998794b3f34d46ef449996dac5
SHA512e61819efcae2fc6112d27cbfb55eab6ca830f85c61a96cc93c1db151c5319a006818809147467f6249d4d160447c5d276e2b91a146d2cc81cc7bda33c86236df
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\root\ui-strings.js
Filesize3KB
MD554b338f5fcca30266a6aaed9d8560216
SHA131b440255f2080eeb9bd5e33c3265babb269507f
SHA2561699e46f334b8c97d5af8db23dab200db93651273c07cc1ab645a349462c1ff5
SHA5123b4bfcc06651ec15370f92adf205b415fe2ebba5d2ef94b9aea8c1a6627b690bc87d7f9a09b60e9a1f3c35ffd162f70d51dfcecd041962fb44fdb738d62eb0d6
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\rhp\convertpdf-rna-tool-view.js
Filesize377KB
MD57f9fccc3e8bdf7b3109cb4deca9c5526
SHA151c9d9a20122afcdea2dd848d7405f4d8d3e07a7
SHA25627604c26d0ede00e12805e3bb395ff6e69b7fe5a7f6bc6cf47358d3d534be628
SHA512a077f124c1473feae21130ff1d7f0133913d1f21f43d4fa240aa9d2a9b281d2d38e787444124080f6d56f40f32d141bb81b802652baf42920c344ff549ce9898
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\rhp\exportpdf-rna-selector.js
Filesize176KB
MD5c9a5f73c4562cd3e29bf124e055f0748
SHA11cd4862aaa07cb0939b22dd69bdde0583370b9fd
SHA256bc2d5f9f692bf091173d9be2251764f169d20f23a7730e7fa25922b40b53ca98
SHA512633f02dc524fc24d196aaaba4d484638849758f35565cdd1dbb5cc0e203eea5490af1e1104162a782436707864eef8517f636dbc7427b3867e2c236cd76ff977
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\root\ui-strings.js
Filesize4KB
MD5986b344c438e3a69a76c57c8666670c1
SHA17042cb836ec89ec520fa1c17f9e0cff6a44d4ee8
SHA256bcd66b01d3d88b5d9ba5dc3f159c007364f8dfacef6bc929cab0a9efb19621ee
SHA512c43e217924e0cd2cbd1a19a524b2b40b48227cfaa6ac3366d34f293d8f55775b847bdb698681d973143d59beef1709d76a84d8c3e356ba0ef4e5a93ef75fc619
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\root\ui-strings.js
Filesize2KB
MD5a0d214aae2c40d34d70876852d4309bc
SHA1b62c845a526a5f21b2a9d4f004a05f23ca735e2c
SHA256e6da24074444851f6924de7bd49ed8861693978749669c252d7a1102fd25d155
SHA512ad2e02649315ab01e02a9d3b034342dcc8fea5c362109552874c1d26c243b2b6cb45a82a796428f630cc7f94d68b837b5442939da5fcd1023a9a05b51c54a2fe
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons.png
Filesize2KB
MD5fdbe980842503685c523e52286f9d23c
SHA102cfaa80928ba0b946f542be5ffc9e055176963f
SHA2566bbe2f265f7e0a50f2d56b636351b7d9546d5869df7164488a84e404d39c5d4f
SHA512907930fdd35f4e7a4c4251d81d7863de209ee2ca8c31903adcc4fe8e2a88b7128fc8f8341f4bfd2cb7835b3ca51b134afa9e1e010ba79efbad8af09683a49fe8
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons2x.png
Filesize2KB
MD5b09591e8007c661b1cd8340f559a3286
SHA1121b3ce96b8cd0649751e20d287a9d36180b6c9c
SHA25639979e4a06f652ade5c89bf2a9ca6768c1b414695245e7ae6286897b21d52e2e
SHA51205e7b845e7088c386cdac379274397bb36ab1ccbcaf47b2fcd8eb0d4b3998a69207542754183c343b383dcd64af95ba8829ac1428b70c0b7cac4d8e3150d3001
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fr-ma\ui-strings.js
Filesize2KB
MD59d8f01258279cc1e382e4b9e4827dc51
SHA1a99a09f3ad5d15e32d080eebe841f158294a5f16
SHA256ecd05517fdc6d507dd4d617faf7e6f10b6c9377d9c87ed10f8a4e7c2f3f8d62e
SHA512fac4dcf9d4c240b7924b016f1efe47c8d26cb77bb1263a7783fb9c70cee4adc62ae22e517bf160df0195be0d131df3fe56e2f5985e78cf95bb4901a7625541c8
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\root\ui-strings.js
Filesize2KB
MD5bba734e903c540a66e89f503d02e7844
SHA12368531ce65f59d02dcc978fe1fca7531ff17ff2
SHA256b454d44267d38bbdf58ca71a260e2c1fdf7922d23685d95f38ee81920ba9869a
SHA512738e3b91af9924b2abd39b6ed3a4d8e642437329032eb5ca6e01c9479b565d86f067b7111c9df1774452e04ccc53a5962cd19d1fe8054291f4c2e00971ac1e72
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\root\ui-strings.js
Filesize10KB
MD5053dbb658319434e8b83a135a19d9b7d
SHA1602c17d1e8a9d967ff5467cf17851753754e60c0
SHA256423dd6fffae2aa2d759a8f9617eda5ce17c7aaf9343939c9c5f133c86e52a2a0
SHA5129bb011bde89eb6f6f5f27e95d6d13b0d02bcd2f11dc19822ccb43e9554427f9a4c61684a022d9d4925074288cc733003bcbd38b9c6c2ec3d18af95e686373d6a
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\fr-ma\ui-strings.js
Filesize2KB
MD5f481f1c097f33551cde7fefcb5c67b94
SHA18a8f6da63d97b86256dbaf728c7ffad7ab9fa451
SHA256009f390e30869dfcc181aa04d4443492d2eaa4a4e30bae2e7bf8db5cc14e368c
SHA51227f759936578573a616f84f45e84691f6e80a628e6767c458a6f95017cf018974c0c0545b1e999207ff86a220c99e9ce9b3a1c993c5693a07e98dc9c8b045363
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\example_icons.png
Filesize2KB
MD59556193a9201f86a5a6904e1c50f8558
SHA15c33a653f9df3deee370ce18661979a7c2894388
SHA256b7d8b878469af3a22ae051415859c178e8996824f4eadd48e1d28505f180ce9c
SHA5120bb4db9f0fe5346f1cbebf0fee9d37eacc71e003d78d5af40508b3bf99feec72c2cf70d4c2bbf738d3cccd1df17a2c82d454e50358d4e36009099e18b534e808
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\example_icons2x.png
Filesize2KB
MD58a7eff7e54a0e589a99e8155e7408c5f
SHA1689c23b91cb37fe0e4256f6dafb438d29455bd88
SHA2566e17d62becb9c76be54e0525fb096fe6a5e6245fdaa044766a1d269b7eb45a8a
SHA5122357c03284d972f30e9a703949afb218d991268596b1b3b162cb77290096120afa644f5d9773903190fb4370fea804695ea4335553e69cc26bfd460aa3978176
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\fr-ma\ui-strings.js
Filesize2KB
MD5ae087577d34d9cdf7d43423d2a334607
SHA1c81fcf844a0548d75002db0d8c64b29ec4da4356
SHA256c05bbd9bc22b3ccc7684fa6a32848a9b63320627150a25477e1259694359b805
SHA51256e324dc56c284f8f10475cfa621873a4aacad34fdc6f854da547178f53b5804b01d42b036cf05e3800b74ed6ac823bf06d6c5c75259fab53a28f0d09a3b0f62
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\rhp_world_icon.png
Filesize1KB
MD5d96f0b43b4eddf281d9e5d9ba2fc6727
SHA1850d7d2e9705f2e2676ac2037c226dd1846e038e
SHA2565dc080bc2b4eeeeea6e14313fd30b70ade8e1fc04cd1b4f2d579e12221eee7f2
SHA51223ae8d9a0f5e50723cd2e368be917c942d20555951367c7da8bcd52b25d569f8b7a83dbfa57636ad029f80e788ecbf495d7068fd324708efd6a86d1a7c57ddfc
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\rhp_world_icon_2x.png
Filesize2KB
MD5b3546fc6722f62db74065640add46f1b
SHA18939e04badfa446ef62406c1676755383f037c02
SHA2566b880f4421a90cfe822e19e880a03447ba8aaeda67a4a23c5b104ad9740e635e
SHA5128f296aa7bcfb4d5c5e9f745407f307f147ee5b7c89a3a9b30cfcf072bf596cab21d27cb2b4186284dde0b72fd47b216333cd1315f064d86fba63e4ada4ccc720
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\rhp_world_icon_hover.png
Filesize1KB
MD514f097fe5a7fbcca95a79965d35a7206
SHA1adf391c0fd2d40d296040fa1662fa87ef5d77004
SHA2563ea0b6b9ca8c99062183ceda02abc92d2be68fe64d32d2fe02df765587e41e50
SHA512078d79639bceedd24e01f5dee8fb4da0cd124a961932711bce2bc2f27ad05aa99837d9a06e6fe153de2e23f3973904067438de7d2d40a96233834e41ab8f832a
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\rhp_world_icon_hover_2x.png
Filesize2KB
MD57a12a4bdec64e778039833859701a1b0
SHA1c4b21775e64b152316b1372b741eb70b0a1adc50
SHA25625e03459dcdd8d48b67a16f0a6c0e5f40417f1e19f8102b25b7dd88ac4a57e8e
SHA51291af9e4607332150409114499301966580f501fc74746c28cecf740de2c00601a5fcc5afbb73a466e1d623551e9bc2218c4ee636dcfd405645bbf05dfba40635
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\themes\dark\rhp_world_icon.png
Filesize1KB
MD50475c15cb2587991eb6daf857d79efdc
SHA10fdb3e7009871d4db939ee8f78f5815bdaf60597
SHA2567940c0c74a1d2f01ebda19fdd84cd0fd63fb035e5d9c23262b781d72f7e4186f
SHA5122db8fe2b0b2184b28208050fb18ac6eab2f3d691d2e3b0c10f88db28d8950637955a9c96c22661a1c8ccffdf77af9c0e11706a2aa0aeb11fc97b39b6c5c6a051
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\themes\dark\rhp_world_icon_2x.png
Filesize2KB
MD52261dfd5a1591fe9fe531539cda42b01
SHA1b78c9108f8a546f75794a9fee2fdc76404e772ec
SHA2564b7d7a33bd80f7e9d26e272d75b145a5b4d9960b8d66020ffaf4f26225fdd504
SHA512fc1d98fa2ba9487410ee4aba6bf1804a37119b5164d9e6c20239c7ef1813442eaed20704c3a9a043fdadeb3dd819004d46a1138381ce43fb46a1c67875f582eb
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\themes\dark\rhp_world_icon_hover.png
Filesize1KB
MD5b9979c6c8aded4f8ffec8dd6b8d1267d
SHA163af50304760accb37fa2cc45a9f7f648b03de9d
SHA256584ba53c4cd243d49281920f3189d506e35b1c1753bbc6ca4588d4fc9cc2cc46
SHA51293f934f916fbe84ad46db0a4def9bf8aeebf602fb75143bb56f61d3e0b29eb57a1eab8c0af355456b7dd5368a61e5aceeaf23635ca3227ed66936288a48266a3
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\themes\dark\rhp_world_icon_hover_2x.png
Filesize2KB
MD590a60f4d5f233734055bff1485334e9b
SHA18c2447d32e7962540b19740a053f764cbfea025a
SHA256764e634f5418db8d54404d5e5bf431854a35ec73e762c2335b5f557b84c8c428
SHA512d97613f5965a46b909836a30f62aef9a33085b3ada884fd3dfd917a61b88ff8c52df0656484da1f7c5c9a21abd3a44fe392ad2834e54cc4963bd239217d06ae2
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\root\ui-strings.js
Filesize2KB
MD59a75e95dd889cee18ceca8adacadc69d
SHA145e7b0d0e6dae5c99c6cc996cfe69f951c63d073
SHA2568e29a4a54d26ca31ac41b70ea92165bdb14d5da2c8140b591e3d935bf38da554
SHA512a5fc16586e72eab5e8e43790d3aa98d055b2bf3063efd57a283b317c6a5d684a9adba085b8d11fe2f631b9e57e3d0e752adee9dde3626462335b6b098fdbb3c4
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\icons.png.infected
Filesize9KB
MD5d278329f6a708862519f26ef60b4a69e
SHA182763617484f3f6777249495f1dc31f192bfa51b
SHA2560a928e25fdfa4a46395c8cdcc9094e96c613b1cd67fa8e51475b4d89864a802f
SHA512a98c918ad7eb529ec695bc442af089f3d0ffcd918c30424b19c133c3b86cb80a0d03038a87f05845ab0ce2317d03900eeba41df4ac677f2c433b130b85ae79fd
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\icons_ie8.gif
Filesize9KB
MD5efec1dc2cb75ae643043d77b1863a4d0
SHA134925e3cec7a5bac7253cce459d39f1540c5c045
SHA2564f75211bdead7c10417329394bde3bdff5e3dd9177c8d19f31280ec5c75cb0ba
SHA512dea486b485d385c6e85d5ba4353d1405eba0991641b6f90b58b4f9d61ecd5a84db5e0783f9f8bb072d5f8ce9e79f1a63e884fa8889af859de90766160b6bbda3
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\icons_retina.png
Filesize16KB
MD5adb70f2307bc4f087f2f4ae3e40820d7
SHA14bd74533b685c32f4ae47e178e5dbc8b9dcb9643
SHA256ba9db0dae966996bb6cdf47bd274025192a91bb383f31dbf2f42db49ca86fa4d
SHA5129de58d6a7ee42a03516fbbecb1cffdb71137166859635d526fc300ae39926e7fe8b6b565025c56edd527f30ed212a5565ce3aec80e2ea448aa42da2ec1537745
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\new_icons.png
Filesize9KB
MD5cd16cc22ad870658a1b53890223e0ae7
SHA15bddb07ae92caca4cf4ef04df25317b3188d7e52
SHA256f5af566afffd03c72cb6eb78063f70d1018e85f959b63e3ad1d467b4b334f7f1
SHA51247bb192a6079ac2fc56d1244c76dba11f596539c221834de5574f6f2098ec030bd497397fbb2eddf9c57d656467b3d9408947e18672d776b327677469d79ede6
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\new_icons_retina.png
Filesize18KB
MD5831f9969999375ccda16972167a76ae5
SHA1c1c4cc30464eb49c233d21933d6f2d5af75a9a88
SHA2560285d158278a76539f5b24bdecd5faad847572243ec25b7b09c9aee3cf074d3a
SHA5123dc2a63d6e36c45f205761ef128be761fea7e662ae0ccbfca77b4cb01c1fa7f9aeb86ac8460ed8ad60650adf1ef30591fda899bb014cf910e5353a3d4fdd8b93
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\root\ui-strings.js
Filesize2KB
MD5c093d24462e4dd8e6730fd4d95abd842
SHA13a054304651316e5e6e8545733651e4a54789ba3
SHA2563fbc25892df17f7cb95478fac346072099b5f8586b4abb79909be86f0283cddb
SHA5120661f9afcdc0c05a7dbb30f9a4debc46a428efe6f1084f2333e159a92f37dea2c4cc750cdfa0f89074ed29cc77c6758ff9e5088fbddeed9c92c91fac73ab8cc9
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\sl-sl\ui-strings.js
Filesize2KB
MD55b4b267ddd5ec54f914302ad5cec2a6b
SHA1c5b8bb5ef3d105033380b8b079fe74a188c750ed
SHA2561be43acf2d0288462ce075cfda218145b32273ca4330894a7ae8f48e10e576c8
SHA5128aad94121b3aaabbca01fae401c9c8a734bf5bd00a472122c3ba94613c6c6950b3044dc56cd48751536625305505732010d282de6776b91464bff8992a3e5848
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\css\main-selector.css
Filesize2KB
MD5aa31bd5068b39ef2298d388b0d943fb3
SHA14a2c2a5d3e1e1944e6cee4e30820b467982abcd6
SHA256fb7c8153a69062507e6266dca6ad1acc8ef952e16a86dc98fdc8c5e6375dcbfa
SHA512d67d49beeb9958560d45b35f70e6f4b66fed48cd91211180628ea6ec7d887738ebef03ca71e38c8ce74a6bb8f71b1c0e61cb15172c313206376015ddd34616a3
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\bg_pattern_RHP.png
Filesize1KB
MD565d3015fdcc8e13449a0d8953270409c
SHA1b810532c93bee3911ac21ac857ffc0321ea249a9
SHA256bf1153ca452a2069947634ef33ca74512921d733864769ee69c0076905eb6fb1
SHA512cc92ae2c7ee00bbd41e411105ad2d2454406cd7a39009d7077e60896ffa993b4ce150cb73860be69ab84b3fb644cb104bdbede72f02f4bedcf7c5ee082851db1
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\bg_patterns_header.png
Filesize2KB
MD520a27f93f9bd747e1c15a235a9fecc15
SHA1643aacc89023c692d13ce31b1a845804df61608d
SHA256e79dfceec945b42315bb4c50e75c895338ba7e2d04f688feed4aff05a437f159
SHA5121ccbcd4ac033bbb7f33d9312eeec6b177289054875212aa7943068aa1113627329f0a853fd291d57dd0c28b517a0d4210307a518c1fc6c8f996486a9b7c77c54
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\illustrations.png
Filesize10KB
MD59ecb7b7151fa6d784d1bf85b12b70224
SHA149a99b076727799b12c4e2f6af1430755ddfcfd7
SHA256765de8376273b1ab5df148846c00e95164efd7377dab0072e6d5b94668b6c462
SHA5120496141cc699ca83004e2dc91a4992dec08ba8823541ba1f87f23f551853977564cb587492a0b097582a309a2bdbcc8544a384190579e55ac02e6dbee7aa5d05
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\illustrations_retina.png
Filesize20KB
MD515da4dd46c8bac8f7476956a3f45b23d
SHA160040f25f0679c684e20fed0042de067c8322471
SHA256837b9dc4b4194d4374b52226fcdc41a83552859c3a7926806f0737743be1aacc
SHA512ce268b3beff2829036f762a0ead3f1e5d8b1b32a96a6017fa3e4949a11486d807f17f03ccd32ee71cd65e8d5d673e61a82098a3085f0d34bd52d3a5511195651
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\root\ui-strings.js
Filesize2KB
MD5f7cd18e767914fbbe536330847474587
SHA129a84eacfba7975e17a6581986606dbcbf1f9a88
SHA2561b2f42cdc6338de4a61682ea3fe673f23ae306ce05b8e54da96ffd2faae78af5
SHA5126fdc32a1e1e13e9ac160010675daaee0a650c75fe655bb564b3ca2f72528fb297b95ad655a97e874bed4b4bceab5c8e595cddc5a4a46796a37aacf7e7db8e68c
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\root\ui-strings.js
Filesize2KB
MD59c845108e484d390907d1d5dc3dbb34c
SHA1dc34f57dc2505e02650a51e84b9c4da3436d7b8e
SHA25674f466975fefdb35445199f4df6c0ff9655259fa66fb6d6f0f6bbc6e2c8529d2
SHA51292fa57b468a6e53b2e9ead016d8f2814d8cb4c0f3983762995ff37cefea0370fec33cd171e9db877e84c3587fd894ef91cb7e4795e1c087b19924f4da5a087ab
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\ui-strings.js
Filesize2KB
MD5f49b1be8524302fd656edd19e4fcbc3f
SHA1dadd4553e125516f1fd79c80e48b47e0d1f1a970
SHA2560568a77bb6116e0f9442ba78e24d4eb22cb8cc1c5696e95cbf9a001eca0b1320
SHA512c64807248ac636b6c3010ee7fbf8f03b039586f38c61815a73ebb0c21d60817a47e542517420a61608636e6d8427bc0f25f74e7a65634d6c9c42a52b4a92d8a4
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\root\ui-strings.js
Filesize6KB
MD546a095cbcf0b85c6e91f2582efdd0a59
SHA114423d5f24cde49a4b6cb76ec9fc299c1e7c9675
SHA256ac9ab129e2b0b73f8dddcde2375f4e900560edb509860be31aafd3c1396f0cd8
SHA51257523fd069ffea987addc92a754d32b530132a84422940537dbbf84531a9f60e0c1e99fb6e7c5fcdfcd26c30e05e251544897774c2ff3aac30b53d9c197b9662
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\PlayStore_icon.svg
Filesize6KB
MD5ca4315ee9f6f1311bbff40ef03b5f033
SHA1a4a8732cc6d6e8c5848ebd03f844772c0c4263e1
SHA2564b368214430cad6068a2da1c775d30835440addf04cf39e2846e428040652bc2
SHA512abd5af0c561abe95d9bcf9446a4a422498b60568f7e75eca53d31e18c7d7f8fee568da0cffe2923218ceafc81939de5300c1ed7dabd5004ce0c9d4203e6c8daa
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\root\ui-strings.js
Filesize14KB
MD50594c14ae1f8fece383903f72c5addf8
SHA1cc9336777c748ee569884db457520c43905d23f8
SHA2568f1871e4cf66ea193ffbc5ba57b527247c11d3c55139d058d79bbf9d235c9d19
SHA5124b54f64f225c4ce2de68e924319a62d236441f8913aaa481aa96e5b197fe90a0fe13b23dd32109d4cda07650f0e0c7ce4dbdda70574cf35c71ac597d551b05bf
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\root\ui-strings.js
Filesize15KB
MD5ca87034e4bf350e430eb59690f11d38b
SHA134278719bbf5efcd678d9e86cd87fa194b02f355
SHA2562326cc53c0fa9b28afcaea3553cee2f172d1fe68614f237e7dcb5fc558cd1e6f
SHA5120fff2bd96eff907bdbf173f09759ed46538cae64e130120d58bbfe1f398e58c370af7f1f3f84eae87feaf8dca1d18733e7277fa3e93b25b92d4fe240e16e33c8
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\root\ui-strings.js
Filesize2KB
MD5bd0f1b5f753f1715020ce2fdccce5856
SHA14ed7e6dbe15f2dc0e05482c607422e909e87c8f4
SHA256b006985ec2d56650539e68bc1e182481d155839965443760b5abbb687fcfa9ca
SHA51248f47aed6c9ef88d9dd466e3bc9dfc5e76ad19de1d23c0c3d97955f1fce0ceac3a357b1efc01a4cb41d3f3c720fc9b54041793e17bfe70dc37f01e449d0cb5ae
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\he-il\ui-strings.js
Filesize2KB
MD53464f134a4903840b40e788e41836da5
SHA11557850152ced88df45b87ab36ca0d536d751677
SHA256e82f06fd05855edbea826aa296e5cb79ee879c2cab54255c42d3bfa18b59e983
SHA512b3bc93297723a4f7073aa76398bf7f0393e6614cbbb00a930b04a13718b3323a1611c1dcc8668f7cc5c7c5564d2a4cfe4e7af645a962d5df8bef26daa91c9499
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\nb-no\ui-strings.js
Filesize2KB
MD5491c33a2bee3d2ec1696672dcad91523
SHA12ffb587ea563278d59d4ed1404c309b75d010c70
SHA256b43b86100ca32394483ae6a8c03546f884fed79e787d8e039267b95ba5396c71
SHA512710caf41b100cfadb18080cda34dbf113a2a05002b2f5508b8d0003ace865944d409ac47545032b8c263c9404bd9c82d1583dbc99db073f8652e0e71dec8a3e6
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\root\ui-strings.js
Filesize2KB
MD53146febb659443723451125383dcd3be
SHA1ed0fcdcee1c7d1003aa21cb7c99065a332a6bcf3
SHA256b7ce452915b905844506e6a8888085ccdb8d89b22647da6adcd36f3a57455b8f
SHA51234761503dcf0f9438fe81cf1c6d3be7f5ad4f376aa2e65c58f53826c132a9e76c3db88be5fd2f0ca7d79e6626becb32cd5f8c74131c2af7f68e53beac5eeddd6
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\root\ui-strings.js
Filesize9KB
MD5517915fc5b7c89b8c01b163d5436cb82
SHA1e2d3859ee2b77e9485c4a03a3b675a640492e44d
SHA25661925af683d9e70a4a2f81b5b8c191a5ce2d0d02045047c7e9da74dc0a54e0df
SHA512c75b14733fba49abb199f55da8d1e76dd5be1c96a7c85cbfa7b238b9e3d36b6abd77045df9916d8c6aea54e314175c23cbd8073cfd84f32a2aa04b783c3d2055
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\sl-sl\ui-strings.js
Filesize5KB
MD5bd3e6689dd45efcfa4b289d3c69ca7a5
SHA162067159e68852dc1b2100eae6cdd3fcdf514dab
SHA256a95682fdcba3d3d31582e3f97bf5bc30f7c94c0e638926eac5052be2ccdd7abd
SHA512fd5a8f388dc32ae4baf6483c0312d018ff0215493772ffda032451924603734f07314bb1b6e6e0b6e6483148553e0dde361c7fb9185a3d5357b9bcb7eda4b9db
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\root\ui-strings.js
Filesize2KB
MD52f667ae0b4a4de7f977a07e17adf79a1
SHA12330a76575cf4de58844cdfcb379e83277bf5f2e
SHA2569cd7755b6a94a1938ccc338a0ba17f65c942efcbbd0d01114848d1fad1337975
SHA512126daedbb279648cd14c67aa7ff7585d27f538b7d54dcaaa951921e8ad111355bdf494da0ce70d077945a86b73425abdd923ef21822a1da11968021d6179d792
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\root\ui-strings.js
Filesize15KB
MD5081728305afd3939a3813af05df2711e
SHA184531ed932e4b0e1408ee51498c99111326293c3
SHA2568ed00e43b3947b1e02151386d7ee62fe56b826f02e902abc1044bc7943e8f872
SHA512ba42310c09466ffa166570c7346fdaa668456b3b2ce76efae10f6338386876a811a386f9dbe0c4e06a8a5a26a3fec22935739105b88b5babdee872a5b4722673
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\en-gb\ui-strings.js
Filesize2KB
MD58700cc9c940580f7c263ac5a184bd814
SHA1f54199e1e5466af56b6ff985ed5763f7ce12ab2c
SHA256757c51b8b5d6d927c20196582e7f08c9975da726436cb6b56d58cea755ac02e4
SHA51274f8026bfb2b343f5b2409c451dd0476dc1cb7e1e08f02c0a872a5f2c196fa31785a5b62adcb8b13e04fdf7fdc5ec93ce7a499a6b1a6094d026e4c6ecf2a51b0
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\root\ui-strings.js
Filesize15KB
MD53401df9eabf89b1477e164c603319998
SHA18aea32ad12b8222f26f5d19023346f3ceeead0db
SHA256d9f7b9e08d1f2edc32c627fee64af8d2f3a61b89c10a1cbbe74ba9efce9d8746
SHA5122379055c90fef3935062a7dae8edbffdf4a391255457f8aa6d58f1fb8e539ef3c7ab0baf144f4ceb2a8070e5dc697bae0a6c0c081bee67981c2db99ff2030bb5
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\es-es\ui-strings.js
Filesize2KB
MD5d38e12b5108df07c9a8bb512fff05bbd
SHA16a3d272ea8c3bfa3e9fc1986951a0ebd6e4a741c
SHA256868dd7c66023db147879d71d1ca0d288bee1781f8b32674d21a17fc241c9f92d
SHA512553dd6e81721ef1fc75cb85abac69d898546c52c85a346b529338235bdbfc31970e92610c6a0ca586fc9c0f2014c7cb50285d7c44db54699cf67a5b16f0f7117
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\root\ui-strings.js
Filesize19KB
MD5bb3555deb9b56e0b40e2125f0678d8ff
SHA1c7d3ecf5b03cbe3eeef3dd410a6bfa316d91bffb
SHA25613d8c7eccd4650c75035624b5721098a069da9b8b3dc63284656cf5c980a8c2e
SHA5127b5ddb05e15a772b593fe8a7be01b734a1836b96be7ae07754570114a4a6ff907154861a6bc871f38fa8c6050063b083ed9d72a26450c6927bafbd20a7ca6456
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\he-il\ui-strings.js
Filesize2KB
MD5624fca32fc1b18259dfe0075512f3e0c
SHA1e2f57c1fe7e4c6408edbbe8e890bd95a59dfe8ec
SHA2566211d2820c673623ee6925b891428acbd3532f6dd573116b166d860934cde5e3
SHA51234631dd2427283dacf21a5706d1f1b0ca5197d652e23a1a8ebe2a00dfc357b8f505f6884d62b743886b09f6ae301b6c15d6d410f0b9acecba46ca8b118e70b39
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\root\ui-strings.js
Filesize3KB
MD539902d6c4feeb98b6eae0f9280d23a02
SHA19381831b107cd1028b8ce9bf7b9e48be30f6af83
SHA25631c58892bc82e453bbe42283a298986629ef97fa6feaaf3725254d587d4c2df9
SHA51284a61e45b30fb532fcb940a8fc9b7c40608dec2566981a7c02f8dac5c2d20fb5fd4d31a2f3033968470f2b43b01892d492d344990cd98cad0970938de2fb652b
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\css\main-selector.css
Filesize2KB
MD5ef44f8fd5e1f3b27432b80fc1f472a9b
SHA13a8469d9393c68dfeeec826c9654758fae9a2531
SHA256c4fc6b4b93aa7647b95123b69a4eb0141f5d78774db598cb16abb37c734c20a4
SHA512d0b9089c3388aeb961e80bc732fa5bfdf5ed45c3762ab1f9a4758ffbb6c23b0c6dce0dbde3817f4fd3b2a28388407b6414e17f5eff17b0ddd7954233fd952391
-
C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB_EURO.txt
Filesize34KB
MD578f67c9f57b164885ec52e04d3a98615
SHA1cb877491de3f39edb0ab4b346f3d239e3df7c0be
SHA256104cc6a0b44e21aa8761bdece994528985b04aeca695d869f41eec26f0536b67
SHA512c46ff3be92859a3d87c4a73351e166c1ac5e92082f9ab19eb35195c406a7f49ef0aeb4b1c0bb24aac8bfcfd72d17199619f160fcb29908dd8ad6821f01a46bac
-
C:\Program Files (x86)\Microsoft\EdgeCore\118.0.2088.57\identity_proxy\win11\identity_helper.Sparse.Internal.msix
Filesize58KB
MD560fd2ff62878f9cceef1cb9a5d15b5a3
SHA199a64097caf0a8f0c6d9a1fa67727c2aac3b0530
SHA256cf7448c788b0ea83b010ffeff317780bb3398d9da01e54d0536b71bc0c008a9f
SHA512976f307a4a481bc45bbada6b9f7f1f961a8b3ac4b1dd02a6afe6866d622d83839467c3a4371dda8de80c73b79e4785fe793c064d5a646feb87b07a43d43691df
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\118.0.2088.57\ResiliencyLinks\identity_proxy\win11\identity_helper.Sparse.Internal.msix.DATA
Filesize58KB
MD53dcc06d6cec6327ae5535f00be19b3f9
SHA1f01c0a94b9ad6306eb293463f817b5f7956d8966
SHA256d4527ba26908076af17e329e81a2c0dbb442d8ab1ea9534e0a29ca9f1073548f
SHA5129e503bd2f70c81e66ddc43b195f8114b402dc8d4a678beb780efdaf1c98362d29d4afcb04e3d87af56c4fd2955fa3e407f6968d4baf90645c554cb2fd1a9a216
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\118.0.2088.57\identity_proxy\win10\identity_helper.Sparse.Stable.msix.infected
Filesize58KB
MD5fdfe56f0bfa1d1d2e1e16f4fdecd73a7
SHA1f1f7ccc862db5d46eea9a95aa1bcd8d2d9d87b85
SHA2568d828074b1c66aaf0ea69fe64a6bbc14ea0947ce4b07d06e91e0f7d4ad622cd3
SHA5120e8539a4bf77ed56831cc171345ce10b288fb75f2c633326d4ae094b56b0862fc25d05ac9dc4f9086943fb0792479564eb251c0831c67755bc28536944e4223d
-
Filesize
1KB
MD57371df4f36131cbdefffc9b706d38a6a
SHA1f308a2fc9a611ab74ff7433badb77e2b91269393
SHA256f31c09a22577d800a37b50f178c69df8ace3e63b263cb7332bf546ea35475858
SHA51266fd053738698de36e83dd0d97ccc6013fe0ad55273d101c3ab1d249754e98218a8d9b16bfce0d788673bbe65caaae8e0b391aa845c87ce07e8498b223861f8d
-
Filesize
1KB
MD56b6570607b69f45ec872090cfed4b267
SHA19c2f8fa7a6ed7a604a8586183fa4a6705014fc68
SHA2568d1166dac58c6bb59621afed6c1a04e1a5063e0616e1023b9525a1dfbfa2ec79
SHA512671fbd0438e99cf4f7411e7ade0fb26dc65f43b3880bfbdf11a82943d13289fc5a924200c2536d1abeab5c05b7ded5866744ab1b55db001b0b7c02a284eb9eb5
-
Filesize
1KB
MD5978f3b241bbaf415da631ba3b941a056
SHA134a62704d51c784990c96824e7f5b8a1553c5729
SHA256e73f5eee5e3619add60d68306d32b4d6ea52a2c464222402d2bc25f460b39292
SHA5126f1195953ad1de1dc74ab405e54f95264b82b2b87d370327ff4bcd74e661aad4d9c58eb0fe915e42cdd37d18ab23a33e179aecee4220e00ab22aebb58b17e567
-
Filesize
1KB
MD549c144ea09c52fae7763a4558438c8dd
SHA19c19a4b008c93864584d094ae9381d53133a2601
SHA256ff88c90f3f415e07b6ffd8ff459260a08e42f7e91baffbbe4e9c33f7f227fb9e
SHA5129d4c66789ae2a1fc9c20f5b39feb2f8d967d12f50bc183c74055d6b888ae9bc1049be7cb079d7a4631d305f03502147e7c4f1e071348e7fb5a8c450c57245e03
-
C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe.config
Filesize1KB
MD57711f1bd216bb3be228537f38bfeb7f0
SHA1a9dfffc921d97007c550241fc58c53d3abb27a6e
SHA25641924c7014b0f43205b5f1d8f3f0ff4997e288354100690ebdb27088d7f9cf7a
SHA512979c54ac317ed273f1670dd8499a79c159d6eb51a9cdd91fa64d38f8ba809638297c455c37ad26aa9a3e4d97a6fa0b595f22dbccb22604fd6a7c98685f295252
-
Filesize
246KB
MD5f15263e75dd788354581306e77efdfcb
SHA11153f0eb4cfb76449df4ea154f4c284c0e40acd3
SHA25634211d3c1eef823dc26800bad10bb35714866fc90d6f0253cf0da3da3de95275
SHA512a51c3f13293087d4b39bfffd639e1dd1e714b329257a371a9e13f4b90c5a5aa0439558f78a2cc572b31d3567b4613beeb44398708ca2ba908965328b870f087b
-
Filesize
1KB
MD5f959bc15987f4c6d0a6be7262b88b5fb
SHA14407ec6a809ebc97f03244edc4d967aa0eb9eee3
SHA2561e6a0d1085b30d4338f2562277562ea4b60a5a497d6ce29f688fc2e242b26423
SHA51268c14f9f5116c893fad64ed374da096cdbe89a053edb2b78eb6af0ee1dc353a4fe1182b7c98df9d275ec490ed110c8a150b3948be85f96bf57d26ac2bc05e9c9
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\osmia32.msi
Filesize3.0MB
MD515bcf8a61b1915822c48c10485925b91
SHA1674ab6bb30805812e143b86167b89ecdd1af89cd
SHA2562ec0c1b93f8ffa6633c1d5061ce490e2479866f5676db97f537cb07c9e28ad9d
SHA5122852a0d160805108adcc63109d846483b941727d65ac84d4d97128fbcff373774073b1a70c1655aa7692b216a52753dceda222328a155306ca24bb5b98dc1a2f
-
Filesize
604KB
MD53b599e221bd16f3ae4da926762662239
SHA1965372786c73ee332f1937a5a95e4d30dd893b17
SHA25693c95f23aabf893f2ee129c1b1713b9bee888f98fc93e61c582d3c3c6c1fec34
SHA51229cc71752d58b4fbf0b5e8b77749e9a69f9a29c30d1d5112fb2932d2e4760224deedc61f8736b83b78e686d1f18cbec96bd6dc2a13e9ee31d728bb7b93188ccc
-
Filesize
785KB
MD5bc0f91ea00bc91a3d45c055ab032e0ac
SHA1c5b63bfc186b30c71afa86269a852536e09321c3
SHA256e26f991c7c048eb8e1cc33174b8eebec2afaf23f6d244ca9ece4b84008a95cab
SHA512ebe7d7cbd4bf9a798909be460558acbe2389afbe5e11aa5bf466d984824ff6124214b782cb6a7ed4d8694a3bd134110ea34c5ff484a91f5a4a86ba37ea16e162
-
Filesize
1.3MB
MD557399620ec293fc30b892cd1a77bf15b
SHA1f493ef455d6266c5a3b670169c91c76536d6d72f
SHA256bab7393b117719f278e875bb7335fd1f10c50b0d3748e1a0e45f2a341acc0dfc
SHA51213ae63bd6d61eea53b99d9d9d8d807c3564bb21558b6b6a05b9e64ef100a55bcdc908f9c722dc39403740075fd22c58c9fe49d9da44a4a620894f6bd40c784de
-
Filesize
1KB
MD5be8af3d625ada16bc04306dfcfc45eb8
SHA15093ef1b24e4e5bb60032c2c44cbba8782741ec0
SHA256c5f8f331949c246d7dac8c73416bf20636dbae724826d7756029e46a4682ccb0
SHA5122d3d56f224938614bc5aff1eddde9ae64ee39087861d036af15e52f72e75480c575fb03d979fa39ae03ce29a48f37ab8bd20cbe6e73a836a0b78123b767ae0a2
-
C:\ProgramData\Microsoft\Windows\Caches\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db.infected
Filesize624KB
MD5811c166b28aeec33c4b718b1991672fd
SHA12d31f4c8d9e0daf40933987906abfa4be0c3f7a5
SHA25699d0bc27e06c41e979de01441453d2ceb407a3eee832ca26e41d259d77f6654d
SHA512411e04e7e9984ac771fcb3283785f6f168d8edc81fa7b8d613c2048c4034876455570fb8d8ee0aa9384ca0bbb47eb96dd0e2c0823af56ac402d9b277ca252828
-
C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\packages\vcRuntimeAdditional_amd64\vc_runtimeAdditional_x64.msi
Filesize181KB
MD5ab222acf687cf465d641b01e262d33fb
SHA1c4d2caf7d7663e1094b47e2a62088a581ec530cd
SHA256815541d5bc5004b0bfce77969cb7f23e712cb43669718c3c8226749c1664b0f8
SHA5128d3493708b59b4b8541e7b015997ea3b8eb795002b29655305d9b4af16cb5bb2b98434890ccf2ac29353005c3ebb380c522b33127d8880b110e04ee29eb441fc
-
Filesize
1KB
MD531b0ef4290d59e252acd0c7e5210d6f5
SHA1b2be711ae7881aa784833a652fc20bfe8f36663f
SHA25604da3ff0d61f69b830e8a5af884a843ac444da844a1fbcf00ba9d419eac02392
SHA5127000b1d3540caa299ed822083ee1e4fbc7365cfcb5bb649a7503ce64564752942725ef89b86f0778668791e9d06cdabd95b95e95a739584d4dbc82a83d5869c8
-
Filesize
3KB
MD5a8514fd9f3a52ab2a00f57494d03b2fe
SHA10e204aabbd8b5d6ee1b36d10429d65eb436afd14
SHA256056ae301d1686bbf2355fd96ef3363e2b18d593f58f912498d87de3569fa9028
SHA5126250481712b51d19e13bf148e3cb046fbf669398b06f8ce757a8583a0fec36ca22140cb90d4706a731f27d1419795ff37ec079d170e15e9e2985020c1e6a1d5b