Malware Analysis Report

2024-09-11 01:53

Sample ID 231023-ddrwaaff34
Target 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.zip
SHA256 2d06acb71440e4c8f46cf347fffd14f5162542edb3fdcc69b089588e3641723b
Tags
medusalocker evasion persistence ransomware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

2d06acb71440e4c8f46cf347fffd14f5162542edb3fdcc69b089588e3641723b

Threat Level: Known bad

The file 51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.zip was found to be: Known bad.

Malicious Activity Summary

medusalocker evasion persistence ransomware

Suspicious use of NtCreateUserProcessOtherParentProcess

MedusaLocker payload

Medusalocker family

Renames multiple (6946) files with added filename extension

Modifies boot configuration data using bcdedit

Deletes shadow copies

Deletes system backups

Modifies Installed Components in the registry

Deletes System State backups

Adds Run key to start application

Enumerates connected drives

Drops file in Windows directory

Drops file in Program Files directory

Unsigned PE

Enumerates physical storage devices

Suspicious use of FindShellTrayWindow

Runs net.exe

Suspicious use of AdjustPrivilegeToken

System policy modification

Suspicious use of SendNotifyMessage

Modifies registry class

Interacts with shadow copies

Uses Volume Shadow Copy service COM API

Suspicious use of WriteProcessMemory

Kills process with taskkill

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Command and Scripting Interpreter
T1059
Persistence
TA0003
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Privilege Escalation
TA0004
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Defense Evasion
TA0005
Indicator Removal
T1070
File Deletion
T1070.004
Modify Registry
T1112
Credential Access
TA0006
Discovery
TA0007
Query Registry
T1012
Peripheral Device Discovery
T1120
System Information Discovery
T1082
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Inhibit System Recovery
T1490
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2023-10-23 02:53

Signatures

MedusaLocker payload

Description Indicator Process Target
N/A N/A N/A N/A

Medusalocker family

medusalocker

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-10-23 02:53

Reported

2023-10-23 02:56

Platform

win10v2004-20231020-en

Max time kernel

150s

Max time network

156s

Command Line

C:\Windows\Explorer.EXE

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess

Description Indicator Process Target
PID 2796 created 3320 N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe C:\Windows\Explorer.EXE

Deletes shadow copies

ransomware

Modifies boot configuration data using bcdedit

ransomware evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A

Renames multiple (6946) files with added filename extension

ransomware

Deletes System State backups

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\wbadmin.exe N/A

Deletes system backups

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\wbadmin.exe N/A

Modifies Installed Components in the registry

persistence
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-356073083-3299209671-3108880702-1000\Software\Microsoft\Active Setup\Installed Components C:\Windows\explorer.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-356073083-3299209671-3108880702-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BabyLockerKZ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe\"" C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-356073083-3299209671-3108880702-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BabyLockerKZ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe\"" C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened (read-only) \??\F: C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\it-IT\HOW_TO_BACK_FILES.html C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-24_altform-unplated_contrast-white.png C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-256_altform-lightunplated.png C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\pt-br\ui-strings.js C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\Fonts\private\GOTHICBI.TTF C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\LTR\contrast-white\SmallTile.scale-125.png C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_2019.19071.19011.0_neutral_~_8wekyb3d8bbwe\AppxSignature.p7x C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\iw_get.svg C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\fr-ma\ui-strings.js C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File created C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\HOW_TO_BACK_FILES.html C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\id\msipc.dll.mui C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\ONENOTE\16\Stationery\BUSINESS.ONE C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\cross.png C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Locales\sv.pak C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-80_contrast-black.png C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\zh-cn\HOW_TO_BACK_FILES.html C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\423x173\30.jpg C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedMedTile.scale-100_contrast-black.png C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\lv-LV\View3d\3DViewerProductDescription-universal.xml C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\ca-es\ui-strings.js C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\lib\sound.properties C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\AppIcon.targetsize-256_contrast-white.png C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\faf_icons_retina.png C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\eu-es\ui-strings.js C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\themes\dark\SearchEmail2x.png C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-80.png C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.ScreenSketch_2019.904.1644.0_neutral_~_8wekyb3d8bbwe\HOW_TO_BACK_FILES.html C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File created C:\Program Files\WindowsPowerShell\Modules\PSReadline\2.0.0\de\HOW_TO_BACK_FILES.html C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\AppxMetadata\CodeIntegrity.cat C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxSignature.p7x C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME-JAVAFX.txt C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files\PopMeasure.001 C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Dial\Lighting.png C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-GoogleCloudCache.scale-150.png C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\zh-cn\ui-strings.js C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\HOW_TO_BACK_FILES.html C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\AppPackageAppList.targetsize-80_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\StoreLogo.scale-150.png C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\HOW_TO_BACK_FILES.html C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.NET.Native.Framework.1.7_1.7.25531.0_x64__8wekyb3d8bbwe\AppxMetadata\CodeIntegrity.cat C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteNotebookMedTile.scale-125.png C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\TXP_BillPay.png C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubWideTile.scale-100_contrast-high.png C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Franklin Gothic.xml C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL109.XML C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\LargeTile.scale-125_contrast-white.png C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Videos\Help\RoundedFreehand3D.mp4 C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File created C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\es-ES\HOW_TO_BACK_FILES.html C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\fi-fi\ui-strings.js C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\1033\HOW_TO_BACK_FILES.html C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files\Windows Media Player\ja-JP\wmlaunch.exe.mui C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Car\RTL\contrast-black\MedTile.scale-125.png C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\en-il\ui-strings.js C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\Square310x310Logo.scale-100.png C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\MixedRealityPortalStoreLogo.scale-100_contrast-white.png C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ar-ae\HOW_TO_BACK_FILES.html C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\zh-cn\ui-strings.js C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ko-kr\ui-strings.js C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Transit\contrast-black\SmallTile.scale-125.png C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\tesselate.x3d C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\cs-cz\ui-strings.js C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\HOW_TO_BACK_FILES.html C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\NavigationIcons\nav_icons_trending.targetsize-48.png C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\HOW_TO_BACK_FILES.html C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.3.etl C:\Windows\system32\wbadmin.exe N/A
File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.2.etl C:\Windows\system32\wbadmin.exe N/A
File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.1.etl C:\Windows\system32\wbadmin.exe N/A

Enumerates physical storage devices

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\vssadmin.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-356073083-3299209671-3108880702-1000\{6739E80D-D186-41EF-B3A3-ED7B8F222DAE} C:\Windows\explorer.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Windows\explorer.exe N/A

Runs net.exe

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2796 wrote to memory of 5100 N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe C:\Windows\SysWOW64\cmd.exe
PID 2796 wrote to memory of 5100 N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe C:\Windows\SysWOW64\cmd.exe
PID 2796 wrote to memory of 5100 N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe C:\Windows\SysWOW64\cmd.exe
PID 5100 wrote to memory of 3240 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 5100 wrote to memory of 3240 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2796 wrote to memory of 1348 N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe C:\Windows\SysWOW64\cmd.exe
PID 2796 wrote to memory of 1348 N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe C:\Windows\SysWOW64\cmd.exe
PID 2796 wrote to memory of 1348 N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe C:\Windows\SysWOW64\cmd.exe
PID 1348 wrote to memory of 1352 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 1348 wrote to memory of 1352 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 1352 wrote to memory of 3648 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 1352 wrote to memory of 3648 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2796 wrote to memory of 260 N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe C:\Windows\SysWOW64\cmd.exe
PID 2796 wrote to memory of 260 N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe C:\Windows\SysWOW64\cmd.exe
PID 2796 wrote to memory of 260 N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe C:\Windows\SysWOW64\cmd.exe
PID 260 wrote to memory of 4484 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 260 wrote to memory of 4484 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 4484 wrote to memory of 3624 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 4484 wrote to memory of 3624 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2796 wrote to memory of 4736 N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe C:\Windows\SysWOW64\cmd.exe
PID 2796 wrote to memory of 4736 N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe C:\Windows\SysWOW64\cmd.exe
PID 2796 wrote to memory of 4736 N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe C:\Windows\SysWOW64\cmd.exe
PID 4736 wrote to memory of 3868 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 4736 wrote to memory of 3868 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 3868 wrote to memory of 624 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 3868 wrote to memory of 624 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2796 wrote to memory of 3100 N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe C:\Windows\SysWOW64\cmd.exe
PID 2796 wrote to memory of 3100 N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe C:\Windows\SysWOW64\cmd.exe
PID 2796 wrote to memory of 3100 N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe C:\Windows\SysWOW64\cmd.exe
PID 3100 wrote to memory of 1808 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 3100 wrote to memory of 1808 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 1808 wrote to memory of 4412 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 1808 wrote to memory of 4412 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2796 wrote to memory of 4508 N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe C:\Windows\SysWOW64\cmd.exe
PID 2796 wrote to memory of 4508 N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe C:\Windows\SysWOW64\cmd.exe
PID 2796 wrote to memory of 4508 N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe C:\Windows\SysWOW64\cmd.exe
PID 4508 wrote to memory of 4576 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 4508 wrote to memory of 4576 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 4576 wrote to memory of 1064 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 4576 wrote to memory of 1064 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2796 wrote to memory of 4564 N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe C:\Windows\SysWOW64\cmd.exe
PID 2796 wrote to memory of 4564 N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe C:\Windows\SysWOW64\cmd.exe
PID 2796 wrote to memory of 4564 N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe C:\Windows\SysWOW64\cmd.exe
PID 4564 wrote to memory of 536 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 4564 wrote to memory of 536 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 536 wrote to memory of 1416 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 536 wrote to memory of 1416 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2796 wrote to memory of 404 N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe C:\Windows\SysWOW64\cmd.exe
PID 2796 wrote to memory of 404 N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe C:\Windows\SysWOW64\cmd.exe
PID 2796 wrote to memory of 404 N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe C:\Windows\SysWOW64\cmd.exe
PID 404 wrote to memory of 4052 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 404 wrote to memory of 4052 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 4052 wrote to memory of 376 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 4052 wrote to memory of 376 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2796 wrote to memory of 2268 N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe C:\Windows\SysWOW64\cmd.exe
PID 2796 wrote to memory of 2268 N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe C:\Windows\SysWOW64\cmd.exe
PID 2796 wrote to memory of 2268 N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe C:\Windows\SysWOW64\cmd.exe
PID 2268 wrote to memory of 872 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2268 wrote to memory of 872 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 872 wrote to memory of 1764 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 872 wrote to memory of 1764 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2796 wrote to memory of 3112 N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe C:\Windows\SysWOW64\cmd.exe
PID 2796 wrote to memory of 3112 N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe C:\Windows\SysWOW64\cmd.exe
PID 2796 wrote to memory of 3112 N/A C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe C:\Windows\SysWOW64\cmd.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe N/A

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe

"C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe"

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c rem Kill \"SQL\"

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c rem Kill \"SQL\"

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlbrowser.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im sqlbrowser.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im sqlbrowser.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sql writer.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im sql writer.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im sql writer.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlserv.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im sqlserv.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im sqlserv.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im msmdsrv.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im msmdsrv.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im msmdsrv.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im MsDtsSrvr.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im MsDtsSrvr.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im MsDtsSrvr.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlceip.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im sqlceip.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im sqlceip.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im fdlauncher.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im fdlauncher.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im fdlauncher.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im Ssms.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im Ssms.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im Ssms.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im SQLAGENT.EXE

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im SQLAGENT.EXE

C:\Windows\system32\taskkill.exe

taskkill -f -im SQLAGENT.EXE

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im fdhost.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im fdhost.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im fdhost.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im ReportingServicesService.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im ReportingServicesService.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im ReportingServicesService.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im msftesql.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im msftesql.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im msftesql.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im pg_ctl.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im pg_ctl.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im pg_ctl.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -impostgres.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -impostgres.exe

C:\Windows\system32\taskkill.exe

taskkill -f -impostgres.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop MSSQLServerADHelper100

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop MSSQLServerADHelper100

C:\Windows\system32\net.exe

net stop MSSQLServerADHelper100

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop MSSQLServerADHelper100

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop MSSQL$ISARS

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop MSSQL$ISARS

C:\Windows\system32\net.exe

net stop MSSQL$ISARS

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop MSSQL$ISARS

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop MSSQL$MSFW

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop MSSQL$MSFW

C:\Windows\system32\net.exe

net stop MSSQL$MSFW

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop MSSQL$MSFW

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLAgent$ISARS

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop SQLAgent$ISARS

C:\Windows\system32\net.exe

net stop SQLAgent$ISARS

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop SQLAgent$ISARS

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLAgent$MSFW

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop SQLAgent$MSFW

C:\Windows\system32\net.exe

net stop SQLAgent$MSFW

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop SQLAgent$MSFW

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLBrowser

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop SQLBrowser

C:\Windows\system32\net.exe

net stop SQLBrowser

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop SQLBrowser

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop REportServer$ISARS

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop REportServer$ISARS

C:\Windows\system32\net.exe

net stop REportServer$ISARS

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop REportServer$ISARS

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLWriter

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop SQLWriter

C:\Windows\system32\net.exe

net stop SQLWriter

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop SQLWriter

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c vssadmin.exe Delete Shadows /All /Quiet

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wbadmin delete backup -keepVersion:0 -quiet

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wmic.exe SHADOWCOPY /nointeractive

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTABACKUP -deleteOldest

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c bcdedit.exe /set {default} recoverynabled No

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c vssadmin.exe Delete Shadows /All /Quiet

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTATEBACKUP

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTATEBACKUP

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c wbadmin delete backup -keepVersion:0 -quiet

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c wmic.exe SHADOWCOPY /nointeractive

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTABACKUP -deleteOldest

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c bcdedit.exe /set {default} recoverynabled No

C:\Windows\system32\vssadmin.exe

vssadmin.exe Delete Shadows /All /Quiet

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\System32\Wbem\WMIC.exe

wmic.exe SHADOWCOPY /nointeractive

C:\Windows\system32\wbadmin.exe

wbadmin DELETE SYSTEMSTATEBACKUP

C:\Windows\system32\wbadmin.exe

wbadmin delete backup -keepVersion:0 -quiet

C:\Windows\system32\wbadmin.exe

wbadmin DELETE SYSTEMSTABACKUP -deleteOldest

C:\Windows\system32\bcdedit.exe

bcdedit.exe /set {default} recoverynabled No

C:\Windows\system32\bcdedit.exe

bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe

\\?\C:\Users\Admin\AppData\Local\Temp\51b8a283f87a95edb5e98125e5730bcf843fc7ec8fcdc175c8dc0ba3032e8a51.exe -network

C:\Windows\explorer.exe

explorer.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 72.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 126.24.238.8.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 8.3.197.209.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 24.73.42.20.in-addr.arpa udp

Files

\Device\HarddiskVolume1\Boot\bg-BG\HOW_TO_BACK_FILES.html

MD5 a8514fd9f3a52ab2a00f57494d03b2fe
SHA1 0e204aabbd8b5d6ee1b36d10429d65eb436afd14
SHA256 056ae301d1686bbf2355fd96ef3363e2b18d593f58f912498d87de3569fa9028
SHA512 6250481712b51d19e13bf148e3cb046fbf669398b06f8ce757a8583a0fec36ca22140cb90d4706a731f27d1419795ff37ec079d170e15e9e2985020c1e6a1d5b

C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif

MD5 7371df4f36131cbdefffc9b706d38a6a
SHA1 f308a2fc9a611ab74ff7433badb77e2b91269393
SHA256 f31c09a22577d800a37b50f178c69df8ace3e63b263cb7332bf546ea35475858
SHA512 66fd053738698de36e83dd0d97ccc6013fe0ad55273d101c3ab1d249754e98218a8d9b16bfce0d788673bbe65caaae8e0b391aa845c87ce07e8498b223861f8d

C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_LinkNoDrop32x32.gif

MD5 6b6570607b69f45ec872090cfed4b267
SHA1 9c2f8fa7a6ed7a604a8586183fa4a6705014fc68
SHA256 8d1166dac58c6bb59621afed6c1a04e1a5063e0616e1023b9525a1dfbfa2ec79
SHA512 671fbd0438e99cf4f7411e7ade0fb26dc65f43b3880bfbdf11a82943d13289fc5a924200c2536d1abeab5c05b7ded5866744ab1b55db001b0b7c02a284eb9eb5

C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC_F_COL.HXK

MD5 978f3b241bbaf415da631ba3b941a056
SHA1 34a62704d51c784990c96824e7f5b8a1553c5729
SHA256 e73f5eee5e3619add60d68306d32b4d6ea52a2c464222402d2bc25f460b39292
SHA512 6f1195953ad1de1dc74ab405e54f95264b82b2b87d370327ff4bcd74e661aad4d9c58eb0fe915e42cdd37d18ab23a33e179aecee4220e00ab22aebb58b17e567

C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC_K_COL.HXK

MD5 49c144ea09c52fae7763a4558438c8dd
SHA1 9c19a4b008c93864584d094ae9381d53133a2601
SHA256 ff88c90f3f415e07b6ffd8ff459260a08e42f7e91baffbbe4e9c33f7f227fb9e
SHA512 9d4c66789ae2a1fc9c20f5b39feb2f8d967d12f50bc183c74055d6b888ae9bc1049be7cb079d7a4631d305f03502147e7c4f1e071348e7fb5a8c450c57245e03

C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe.config

MD5 7711f1bd216bb3be228537f38bfeb7f0
SHA1 a9dfffc921d97007c550241fc58c53d3abb27a6e
SHA256 41924c7014b0f43205b5f1d8f3f0ff4997e288354100690ebdb27088d7f9cf7a
SHA512 979c54ac317ed273f1670dd8499a79c159d6eb51a9cdd91fa64d38f8ba809638297c455c37ad26aa9a3e4d97a6fa0b595f22dbccb22604fd6a7c98685f295252

C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\SIST02.XSL

MD5 f15263e75dd788354581306e77efdfcb
SHA1 1153f0eb4cfb76449df4ea154f4c284c0e40acd3
SHA256 34211d3c1eef823dc26800bad10bb35714866fc90d6f0253cf0da3da3de95275
SHA512 a51c3f13293087d4b39bfffd639e1dd1e714b329257a371a9e13f4b90c5a5aa0439558f78a2cc572b31d3567b4613beeb44398708ca2ba908965328b870f087b

C:\Program Files\Microsoft Office\root\Office16\PROOF\msgr8fr.dub

MD5 f959bc15987f4c6d0a6be7262b88b5fb
SHA1 4407ec6a809ebc97f03244edc4d967aa0eb9eee3
SHA256 1e6a0d1085b30d4338f2562277562ea4b60a5a497d6ce29f688fc2e242b26423
SHA512 68c14f9f5116c893fad64ed374da096cdbe89a053edb2b78eb6af0ee1dc353a4fe1182b7c98df9d275ec490ed110c8a150b3948be85f96bf57d26ac2bc05e9c9

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\osmia32.msi

MD5 15bcf8a61b1915822c48c10485925b91
SHA1 674ab6bb30805812e143b86167b89ecdd1af89cd
SHA256 2ec0c1b93f8ffa6633c1d5061ce490e2479866f5676db97f537cb07c9e28ad9d
SHA512 2852a0d160805108adcc63109d846483b941727d65ac84d4d97128fbcff373774073b1a70c1655aa7692b216a52753dceda222328a155306ca24bb5b98dc1a2f

C:\Program Files\VideoLAN\VLC\locale\es\LC_MESSAGES\vlc.mo

MD5 3b599e221bd16f3ae4da926762662239
SHA1 965372786c73ee332f1937a5a95e4d30dd893b17
SHA256 93c95f23aabf893f2ee129c1b1713b9bee888f98fc93e61c582d3c3c6c1fec34
SHA512 29cc71752d58b4fbf0b5e8b77749e9a69f9a29c30d1d5112fb2932d2e4760224deedc61f8736b83b78e686d1f18cbec96bd6dc2a13e9ee31d728bb7b93188ccc

C:\Program Files\VideoLAN\VLC\locale\mai\LC_MESSAGES\vlc.mo

MD5 bc0f91ea00bc91a3d45c055ab032e0ac
SHA1 c5b63bfc186b30c71afa86269a852536e09321c3
SHA256 e26f991c7c048eb8e1cc33174b8eebec2afaf23f6d244ca9ece4b84008a95cab
SHA512 ebe7d7cbd4bf9a798909be460558acbe2389afbe5e11aa5bf466d984824ff6124214b782cb6a7ed4d8694a3bd134110ea34c5ff484a91f5a4a86ba37ea16e162

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\cef_200_percent.pak

MD5 495a7202cc390e06884337327ec04800
SHA1 faf823cf5c503893e3f4f340553cd2759be98ddd
SHA256 a0babc775275019944143de5e1a3698411555214fa0e97e526f3f610e0f7d9d4
SHA512 bd7ffb62a41bdf44a62dd0c38c047e08f00111a5a4f4d5e523006ede90288d24faa54d08456da725a12bc8d749ba135a81b55fb29042e67c0039d9d52dbc1b71

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\aic_file_icons.png

MD5 0b94b98b9f7897227e8d50116febc923
SHA1 ecf2e7413df44551290ff20fa2fe89d744cff118
SHA256 6d7610287f8bd2e683515e4a24a6060995643ce6f57f4e667150c6e4ebe429f1
SHA512 71dddf6d2853527f983c4588e3aac5f5407bb20e4ebf26002fd72e9dbc59703784ed3d794d34c86c64bda5a8763412efcd85c59ba7b71feed360edd3d16010e9

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions.png

MD5 1214e13655cc11dcb00525cb19dec1fa
SHA1 beab8f98c6dd3c4892ddfd7397beca83c5b8de0c
SHA256 63313ac7d7b52945ff58b9ea23de0ab492f7e402890ce84b6864ac81640a7196
SHA512 ca5a2205540de3f920e0d5452a9883edf0f5642cd51f1acd96c4e7e2fc4408b7bb55324a1620588276b3c43ea32e09c377af109ae9866369e7b9a33a824738ad

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions2x.png

MD5 2aa8d5531738fd783366568c67684ede
SHA1 bb751e102d05a728f1700ae6912de25bb000f045
SHA256 c7154f27d518a4b8adede4b93d470a3effc6c87c91df2edad40d1c717cb1eb04
SHA512 fd58ec05923dd545e44c602c9a77f501b368f976890779740edb3184875cc122e3f56bed7843b800b2d3f3d0dfdba2a64ef6236f72f8890e03e283cae7ae9dea

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_remove_18.svg

MD5 9def3f150f527ddfcf46044c84e6d077
SHA1 c8342ea260c9afea4be7ae0c14690d9209e100c8
SHA256 753ccf7073aa87955e611617d755af33a7c0c3b29454f35d8d6db8568462239b
SHA512 74cd21c4bcb23a8f388c328f6bb122bcbd4922efb798e29bdd55d5c199ecf8bde48f0afe1c9f88c632dc6a75286f872cd52ffc93760aa1c8612f2940604c5f0e

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\duplicate.svg

MD5 eba87ea4833f8d47e1a04815221bf502
SHA1 125b78855e2dc21a5ed746820331552995a79545
SHA256 72fda28d4c60807678021839210e4c14dac33e20bed62be6cf1cf27c0da93d99
SHA512 4897cf08e725907d9862c77d1e921049663954f52f39a96f3ebc7b0dcfdb3d9cd4259ff039c48edd7672d583c4e31b4702b0a73b7d4f571706bb66d02beb726b

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\remove.svg

MD5 ac9d3ddb53bedb4feeb129c1acf18f6a
SHA1 77e56939dc1cab72ab5072974cf8a2ee0ed85689
SHA256 b9930189fbd6a0915ede177c71fcbfc76ba037d4990c2d09ef43d4f8e9158f0b
SHA512 782318be1a960bf94690009ca82181cd944cb49b5335c657ce0b13ee59bad1bb9f624f23fbc834911d0e0364f6e7ed7c252ddea92a51d4c456384d6d81ef8581

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_export_18.svg

MD5 c4ee5ae1f54b4b57771969b0971330ba
SHA1 c189010d82c3337c9cd2a4006c2b3bc60f55a34a
SHA256 2648d6b7cfca31a1cf3c22e2377b1102c49219d75c48a98d85d93b599591a5d0
SHA512 9fc108b49c676496c1ec6a4dceb7350325f8d84c532f895e4411e556575365d5cdbbec4dfca68970100b16607c24efc2aae6081c5880a854b56badf697bdf361

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_folder-default_32.svg

MD5 6cc1e6fb12e440bba6aeedc585f54238
SHA1 edd632260e712eb6fea00ee333ec8e37349e6275
SHA256 709017d0db45f115484bad59a23e169f75d7dbcb64874b1102ee4381ccdb174f
SHA512 a8cc5ed20a90fec513ae98db4908290b7f7edfe76fcd1ccd8b9e5d8c13129293582193522970a896a449c94c12f411c0e1dbdce2630a52ecd852fdf14e5d7885

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_fillandsign_18.svg

MD5 3c50727419da781102a23f5d392f5342
SHA1 ac1a34db0fa1424857bfafcc3da97221080395a3
SHA256 528cda1042ada797fec8793a0eecbde176aa655b318c175a2a1a6189b71cf446
SHA512 0e4bf6f3a49df14473d587e1a694548b4d54f2b44d990c969fd5b7c2f5832f7172288bcbf214fc9c5f522d9331793db0f9af33c8534a896e742e69c6d6deb21b

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_editpdf_18.svg.infected

MD5 05ab8085d96d8196298f77efd6d5ffdd
SHA1 4d6511e8525f2d6532a28646a18849c307578716
SHA256 875e746981d3984e5fd4ddd4850d395b8f4387ffdba6111250bc4033f50e8ead
SHA512 57d620f5f19cf7912752d657f81ba522c4a2bd10d41350a7a37d1e4db68c9eb45c3c1f1b81d8a00fca7b3fc27f883e59d2a57a6b7b59806560cde02d6f6d6299

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_organize_18.svg

MD5 6e9d316e26407ea36d4482cc65ba1aa7
SHA1 e318850bba648b85d70bdeb9c211ec1e7780d29f
SHA256 d5b717cea24e141fb76ee8dbb87abcb5384978a0cb2072125982ab31f57e5d1e
SHA512 84ebded77ca7685f66c59106e6bd3cfdb0f0ca2b777ffffab871fae2ac68ec3dd59f34d0919cd4c533cdcf7d9700afa3158295a448fd6aa3c9b75637398e124d

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_nextarrow_default.svg

MD5 6a3cf434e34dbe2399ea4cffe71fd018
SHA1 848ee604bbaf4da588d61b41615d7e7cda1e9d63
SHA256 81d5f4b3cf808ed0e7862a4c64a6247b3b3d546342494483cac9d12f56ec232c
SHA512 6d323520998eb67c15eb351aef9905b20d93ca004b19e123e1c2dc8d58bc0fa832f531f08567bd13ca01e5b382242e3a00a6d3446d101315c4d6002c6ca8637a

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_share_18.svg

MD5 b51d9b40459af97bc5c68891634ba321
SHA1 2145ba09777a1a6b47cf0c8e22c01bc68d8af8bc
SHA256 a73c60a49ce104036c12807613f1f8b9098c7aba0a1f10393c4dbbd4c48e4896
SHA512 f89a9242df23a1e8e69e7fb6c087cf7823308f79c9fc3d21153fcd83d4060e549ef7bad8d9cb2ea185d355ac37eb6fbf3f81c9a12e477abce61543dad73e5376

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_sendforsignature_18.svg

MD5 84b57156151eb9b99c537a25851a5130
SHA1 cf6eaaf1dcd30412529bc46eb967318d3d5cb4a9
SHA256 860ae670c9742c61f3d9e294ad7eefc8abf0ed63953218871d372a1f9876b4c4
SHA512 1d966c89fd3f19ce882182a49df05dadbc563b3002cb3837ad757f19dde9ee9ac24659e57ef154865f165f7522ae7c705530b37853a0a5c1349ec06ff0fc8e17

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_rename_18.svg

MD5 d455d25a032b762a062e1ccd58c587bb
SHA1 a43f83d0d1c63798811819d7d4277b6af7c5d054
SHA256 177439bf94200e4dd0a7448f9c5ac45c23c7824ca344d2956af2994473d4fdd2
SHA512 166433291f8ba58c40027c879a249a7fc311a94242d899762dea236ab9d6201d391e8a189f7893ee2bedd46aac32127f561b6bfdaf986a0571bb6ac952a8a3ed

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_move_18.svg

MD5 eeb8d24d43cf44c798decdb2dfebc13f
SHA1 3ec4094d317db6380b0925e11eb18a86539df3fc
SHA256 0f190174cd2b7d1767034f003b87e10cdd044489ee487e63ea4be0e8e88b09d4
SHA512 6bc53cc49f37e76d8641f931d775cdb6073a32356750813466dc53c3bbd42e3e897a5490074b65bb317bbdd7c7f2ab927e41f75845f91369b7926a3b5d9f39c9

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\root\ui-strings.js

MD5 3a19e60694c6d0b0a97b48756907405a
SHA1 7dc97dd9bcff91a1a9754680f7791c7c21145d23
SHA256 ead5a9b35c8e77105bedc9f3436fe4122dca5c27933f4fca5fe85a06c6e5f047
SHA512 f40882370ee94a916a8be1f025a793a8ea52e8c3672c36bac37ce7f28e24aaa18faf6caf0b0552edab5adaefe90eb36da2a3fc960c3e988355fa26cf315defe5

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\root\ui-strings.js

MD5 9e50c91874ef170d0e8bee788c9f274b
SHA1 a03db38a0e0e53d7ff917c73e77dfd07478bc60d
SHA256 027dbda480cf34c059f66821890e4db41fd5a87e5771263789b7da2e5b2a1d8f
SHA512 2eeb464eb14a3342bef9997d30ca7ca2f8bdfa35e5aa977cbfbb807ec08cd8f3eb289b4107542c99b3368ecfebd7fd87b577a80d2ffe2062c12bd06d0c8820ad

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\he-il\ui-strings.js

MD5 35e79acc810446216c99cc60dfb9a5ea
SHA1 1d32a08348a727735975498f5a8064ac8f821936
SHA256 961f2a4e22e04ffd669ed4d89a3e2ac9cd0624a340fea244803625933daba55e
SHA512 fce1038ef4935c5ec584f2acb7d903aa1090750c469ae3a75fe6fca8ee67f86edc9b0ddf7853ded2a474bfea2a9ea55c71bc0703ffb3ba8435f2de2c15a71e14

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\root\ui-strings.js

MD5 0e330e74767b0418aa545e944d43a3e8
SHA1 d6cf73a367466915b59e91a79015dd05a03c9249
SHA256 d1b3aed4aab3f145e5607b02989d67a9723f25998794b3f34d46ef449996dac5
SHA512 e61819efcae2fc6112d27cbfb55eab6ca830f85c61a96cc93c1db151c5319a006818809147467f6249d4d160447c5d276e2b91a146d2cc81cc7bda33c86236df

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\root\ui-strings.js

MD5 54b338f5fcca30266a6aaed9d8560216
SHA1 31b440255f2080eeb9bd5e33c3265babb269507f
SHA256 1699e46f334b8c97d5af8db23dab200db93651273c07cc1ab645a349462c1ff5
SHA512 3b4bfcc06651ec15370f92adf205b415fe2ebba5d2ef94b9aea8c1a6627b690bc87d7f9a09b60e9a1f3c35ffd162f70d51dfcecd041962fb44fdb738d62eb0d6

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\rhp\convertpdf-rna-tool-view.js

MD5 7f9fccc3e8bdf7b3109cb4deca9c5526
SHA1 51c9d9a20122afcdea2dd848d7405f4d8d3e07a7
SHA256 27604c26d0ede00e12805e3bb395ff6e69b7fe5a7f6bc6cf47358d3d534be628
SHA512 a077f124c1473feae21130ff1d7f0133913d1f21f43d4fa240aa9d2a9b281d2d38e787444124080f6d56f40f32d141bb81b802652baf42920c344ff549ce9898

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\rhp\exportpdf-rna-selector.js

MD5 c9a5f73c4562cd3e29bf124e055f0748
SHA1 1cd4862aaa07cb0939b22dd69bdde0583370b9fd
SHA256 bc2d5f9f692bf091173d9be2251764f169d20f23a7730e7fa25922b40b53ca98
SHA512 633f02dc524fc24d196aaaba4d484638849758f35565cdd1dbb5cc0e203eea5490af1e1104162a782436707864eef8517f636dbc7427b3867e2c236cd76ff977

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\root\ui-strings.js

MD5 986b344c438e3a69a76c57c8666670c1
SHA1 7042cb836ec89ec520fa1c17f9e0cff6a44d4ee8
SHA256 bcd66b01d3d88b5d9ba5dc3f159c007364f8dfacef6bc929cab0a9efb19621ee
SHA512 c43e217924e0cd2cbd1a19a524b2b40b48227cfaa6ac3366d34f293d8f55775b847bdb698681d973143d59beef1709d76a84d8c3e356ba0ef4e5a93ef75fc619

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\root\ui-strings.js

MD5 a0d214aae2c40d34d70876852d4309bc
SHA1 b62c845a526a5f21b2a9d4f004a05f23ca735e2c
SHA256 e6da24074444851f6924de7bd49ed8861693978749669c252d7a1102fd25d155
SHA512 ad2e02649315ab01e02a9d3b034342dcc8fea5c362109552874c1d26c243b2b6cb45a82a796428f630cc7f94d68b837b5442939da5fcd1023a9a05b51c54a2fe

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons2x.png

MD5 b09591e8007c661b1cd8340f559a3286
SHA1 121b3ce96b8cd0649751e20d287a9d36180b6c9c
SHA256 39979e4a06f652ade5c89bf2a9ca6768c1b414695245e7ae6286897b21d52e2e
SHA512 05e7b845e7088c386cdac379274397bb36ab1ccbcaf47b2fcd8eb0d4b3998a69207542754183c343b383dcd64af95ba8829ac1428b70c0b7cac4d8e3150d3001

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons.png

MD5 fdbe980842503685c523e52286f9d23c
SHA1 02cfaa80928ba0b946f542be5ffc9e055176963f
SHA256 6bbe2f265f7e0a50f2d56b636351b7d9546d5869df7164488a84e404d39c5d4f
SHA512 907930fdd35f4e7a4c4251d81d7863de209ee2ca8c31903adcc4fe8e2a88b7128fc8f8341f4bfd2cb7835b3ca51b134afa9e1e010ba79efbad8af09683a49fe8

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fr-ma\ui-strings.js

MD5 9d8f01258279cc1e382e4b9e4827dc51
SHA1 a99a09f3ad5d15e32d080eebe841f158294a5f16
SHA256 ecd05517fdc6d507dd4d617faf7e6f10b6c9377d9c87ed10f8a4e7c2f3f8d62e
SHA512 fac4dcf9d4c240b7924b016f1efe47c8d26cb77bb1263a7783fb9c70cee4adc62ae22e517bf160df0195be0d131df3fe56e2f5985e78cf95bb4901a7625541c8

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\root\ui-strings.js

MD5 bba734e903c540a66e89f503d02e7844
SHA1 2368531ce65f59d02dcc978fe1fca7531ff17ff2
SHA256 b454d44267d38bbdf58ca71a260e2c1fdf7922d23685d95f38ee81920ba9869a
SHA512 738e3b91af9924b2abd39b6ed3a4d8e642437329032eb5ca6e01c9479b565d86f067b7111c9df1774452e04ccc53a5962cd19d1fe8054291f4c2e00971ac1e72

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\root\ui-strings.js

MD5 053dbb658319434e8b83a135a19d9b7d
SHA1 602c17d1e8a9d967ff5467cf17851753754e60c0
SHA256 423dd6fffae2aa2d759a8f9617eda5ce17c7aaf9343939c9c5f133c86e52a2a0
SHA512 9bb011bde89eb6f6f5f27e95d6d13b0d02bcd2f11dc19822ccb43e9554427f9a4c61684a022d9d4925074288cc733003bcbd38b9c6c2ec3d18af95e686373d6a

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\fr-ma\ui-strings.js

MD5 f481f1c097f33551cde7fefcb5c67b94
SHA1 8a8f6da63d97b86256dbaf728c7ffad7ab9fa451
SHA256 009f390e30869dfcc181aa04d4443492d2eaa4a4e30bae2e7bf8db5cc14e368c
SHA512 27f759936578573a616f84f45e84691f6e80a628e6767c458a6f95017cf018974c0c0545b1e999207ff86a220c99e9ce9b3a1c993c5693a07e98dc9c8b045363

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\example_icons2x.png

MD5 8a7eff7e54a0e589a99e8155e7408c5f
SHA1 689c23b91cb37fe0e4256f6dafb438d29455bd88
SHA256 6e17d62becb9c76be54e0525fb096fe6a5e6245fdaa044766a1d269b7eb45a8a
SHA512 2357c03284d972f30e9a703949afb218d991268596b1b3b162cb77290096120afa644f5d9773903190fb4370fea804695ea4335553e69cc26bfd460aa3978176

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\example_icons.png

MD5 9556193a9201f86a5a6904e1c50f8558
SHA1 5c33a653f9df3deee370ce18661979a7c2894388
SHA256 b7d8b878469af3a22ae051415859c178e8996824f4eadd48e1d28505f180ce9c
SHA512 0bb4db9f0fe5346f1cbebf0fee9d37eacc71e003d78d5af40508b3bf99feec72c2cf70d4c2bbf738d3cccd1df17a2c82d454e50358d4e36009099e18b534e808

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\fr-ma\ui-strings.js

MD5 ae087577d34d9cdf7d43423d2a334607
SHA1 c81fcf844a0548d75002db0d8c64b29ec4da4356
SHA256 c05bbd9bc22b3ccc7684fa6a32848a9b63320627150a25477e1259694359b805
SHA512 56e324dc56c284f8f10475cfa621873a4aacad34fdc6f854da547178f53b5804b01d42b036cf05e3800b74ed6ac823bf06d6c5c75259fab53a28f0d09a3b0f62

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\rhp_world_icon.png

MD5 d96f0b43b4eddf281d9e5d9ba2fc6727
SHA1 850d7d2e9705f2e2676ac2037c226dd1846e038e
SHA256 5dc080bc2b4eeeeea6e14313fd30b70ade8e1fc04cd1b4f2d579e12221eee7f2
SHA512 23ae8d9a0f5e50723cd2e368be917c942d20555951367c7da8bcd52b25d569f8b7a83dbfa57636ad029f80e788ecbf495d7068fd324708efd6a86d1a7c57ddfc

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\themes\dark\rhp_world_icon_2x.png

MD5 2261dfd5a1591fe9fe531539cda42b01
SHA1 b78c9108f8a546f75794a9fee2fdc76404e772ec
SHA256 4b7d7a33bd80f7e9d26e272d75b145a5b4d9960b8d66020ffaf4f26225fdd504
SHA512 fc1d98fa2ba9487410ee4aba6bf1804a37119b5164d9e6c20239c7ef1813442eaed20704c3a9a043fdadeb3dd819004d46a1138381ce43fb46a1c67875f582eb

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\themes\dark\rhp_world_icon.png

MD5 0475c15cb2587991eb6daf857d79efdc
SHA1 0fdb3e7009871d4db939ee8f78f5815bdaf60597
SHA256 7940c0c74a1d2f01ebda19fdd84cd0fd63fb035e5d9c23262b781d72f7e4186f
SHA512 2db8fe2b0b2184b28208050fb18ac6eab2f3d691d2e3b0c10f88db28d8950637955a9c96c22661a1c8ccffdf77af9c0e11706a2aa0aeb11fc97b39b6c5c6a051

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\themes\dark\rhp_world_icon_hover.png

MD5 b9979c6c8aded4f8ffec8dd6b8d1267d
SHA1 63af50304760accb37fa2cc45a9f7f648b03de9d
SHA256 584ba53c4cd243d49281920f3189d506e35b1c1753bbc6ca4588d4fc9cc2cc46
SHA512 93f934f916fbe84ad46db0a4def9bf8aeebf602fb75143bb56f61d3e0b29eb57a1eab8c0af355456b7dd5368a61e5aceeaf23635ca3227ed66936288a48266a3

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\themes\dark\rhp_world_icon_hover_2x.png

MD5 90a60f4d5f233734055bff1485334e9b
SHA1 8c2447d32e7962540b19740a053f764cbfea025a
SHA256 764e634f5418db8d54404d5e5bf431854a35ec73e762c2335b5f557b84c8c428
SHA512 d97613f5965a46b909836a30f62aef9a33085b3ada884fd3dfd917a61b88ff8c52df0656484da1f7c5c9a21abd3a44fe392ad2834e54cc4963bd239217d06ae2

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\rhp_world_icon_hover.png

MD5 14f097fe5a7fbcca95a79965d35a7206
SHA1 adf391c0fd2d40d296040fa1662fa87ef5d77004
SHA256 3ea0b6b9ca8c99062183ceda02abc92d2be68fe64d32d2fe02df765587e41e50
SHA512 078d79639bceedd24e01f5dee8fb4da0cd124a961932711bce2bc2f27ad05aa99837d9a06e6fe153de2e23f3973904067438de7d2d40a96233834e41ab8f832a

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\rhp_world_icon_2x.png

MD5 b3546fc6722f62db74065640add46f1b
SHA1 8939e04badfa446ef62406c1676755383f037c02
SHA256 6b880f4421a90cfe822e19e880a03447ba8aaeda67a4a23c5b104ad9740e635e
SHA512 8f296aa7bcfb4d5c5e9f745407f307f147ee5b7c89a3a9b30cfcf072bf596cab21d27cb2b4186284dde0b72fd47b216333cd1315f064d86fba63e4ada4ccc720

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\rhp_world_icon_hover_2x.png

MD5 7a12a4bdec64e778039833859701a1b0
SHA1 c4b21775e64b152316b1372b741eb70b0a1adc50
SHA256 25e03459dcdd8d48b67a16f0a6c0e5f40417f1e19f8102b25b7dd88ac4a57e8e
SHA512 91af9e4607332150409114499301966580f501fc74746c28cecf740de2c00601a5fcc5afbb73a466e1d623551e9bc2218c4ee636dcfd405645bbf05dfba40635

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\icons_retina.png

MD5 adb70f2307bc4f087f2f4ae3e40820d7
SHA1 4bd74533b685c32f4ae47e178e5dbc8b9dcb9643
SHA256 ba9db0dae966996bb6cdf47bd274025192a91bb383f31dbf2f42db49ca86fa4d
SHA512 9de58d6a7ee42a03516fbbecb1cffdb71137166859635d526fc300ae39926e7fe8b6b565025c56edd527f30ed212a5565ce3aec80e2ea448aa42da2ec1537745

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\icons_ie8.gif

MD5 efec1dc2cb75ae643043d77b1863a4d0
SHA1 34925e3cec7a5bac7253cce459d39f1540c5c045
SHA256 4f75211bdead7c10417329394bde3bdff5e3dd9177c8d19f31280ec5c75cb0ba
SHA512 dea486b485d385c6e85d5ba4353d1405eba0991641b6f90b58b4f9d61ecd5a84db5e0783f9f8bb072d5f8ce9e79f1a63e884fa8889af859de90766160b6bbda3

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\new_icons_retina.png

MD5 831f9969999375ccda16972167a76ae5
SHA1 c1c4cc30464eb49c233d21933d6f2d5af75a9a88
SHA256 0285d158278a76539f5b24bdecd5faad847572243ec25b7b09c9aee3cf074d3a
SHA512 3dc2a63d6e36c45f205761ef128be761fea7e662ae0ccbfca77b4cb01c1fa7f9aeb86ac8460ed8ad60650adf1ef30591fda899bb014cf910e5353a3d4fdd8b93

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\new_icons.png

MD5 cd16cc22ad870658a1b53890223e0ae7
SHA1 5bddb07ae92caca4cf4ef04df25317b3188d7e52
SHA256 f5af566afffd03c72cb6eb78063f70d1018e85f959b63e3ad1d467b4b334f7f1
SHA512 47bb192a6079ac2fc56d1244c76dba11f596539c221834de5574f6f2098ec030bd497397fbb2eddf9c57d656467b3d9408947e18672d776b327677469d79ede6

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\icons.png.infected

MD5 d278329f6a708862519f26ef60b4a69e
SHA1 82763617484f3f6777249495f1dc31f192bfa51b
SHA256 0a928e25fdfa4a46395c8cdcc9094e96c613b1cd67fa8e51475b4d89864a802f
SHA512 a98c918ad7eb529ec695bc442af089f3d0ffcd918c30424b19c133c3b86cb80a0d03038a87f05845ab0ce2317d03900eeba41df4ac677f2c433b130b85ae79fd

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\sl-sl\ui-strings.js

MD5 5b4b267ddd5ec54f914302ad5cec2a6b
SHA1 c5b8bb5ef3d105033380b8b079fe74a188c750ed
SHA256 1be43acf2d0288462ce075cfda218145b32273ca4330894a7ae8f48e10e576c8
SHA512 8aad94121b3aaabbca01fae401c9c8a734bf5bd00a472122c3ba94613c6c6950b3044dc56cd48751536625305505732010d282de6776b91464bff8992a3e5848

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\root\ui-strings.js

MD5 c093d24462e4dd8e6730fd4d95abd842
SHA1 3a054304651316e5e6e8545733651e4a54789ba3
SHA256 3fbc25892df17f7cb95478fac346072099b5f8586b4abb79909be86f0283cddb
SHA512 0661f9afcdc0c05a7dbb30f9a4debc46a428efe6f1084f2333e159a92f37dea2c4cc750cdfa0f89074ed29cc77c6758ff9e5088fbddeed9c92c91fac73ab8cc9

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\root\ui-strings.js

MD5 9a75e95dd889cee18ceca8adacadc69d
SHA1 45e7b0d0e6dae5c99c6cc996cfe69f951c63d073
SHA256 8e29a4a54d26ca31ac41b70ea92165bdb14d5da2c8140b591e3d935bf38da554
SHA512 a5fc16586e72eab5e8e43790d3aa98d055b2bf3063efd57a283b317c6a5d684a9adba085b8d11fe2f631b9e57e3d0e752adee9dde3626462335b6b098fdbb3c4

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\illustrations.png

MD5 9ecb7b7151fa6d784d1bf85b12b70224
SHA1 49a99b076727799b12c4e2f6af1430755ddfcfd7
SHA256 765de8376273b1ab5df148846c00e95164efd7377dab0072e6d5b94668b6c462
SHA512 0496141cc699ca83004e2dc91a4992dec08ba8823541ba1f87f23f551853977564cb587492a0b097582a309a2bdbcc8544a384190579e55ac02e6dbee7aa5d05

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\illustrations_retina.png

MD5 15da4dd46c8bac8f7476956a3f45b23d
SHA1 60040f25f0679c684e20fed0042de067c8322471
SHA256 837b9dc4b4194d4374b52226fcdc41a83552859c3a7926806f0737743be1aacc
SHA512 ce268b3beff2829036f762a0ead3f1e5d8b1b32a96a6017fa3e4949a11486d807f17f03ccd32ee71cd65e8d5d673e61a82098a3085f0d34bd52d3a5511195651

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\bg_patterns_header.png

MD5 20a27f93f9bd747e1c15a235a9fecc15
SHA1 643aacc89023c692d13ce31b1a845804df61608d
SHA256 e79dfceec945b42315bb4c50e75c895338ba7e2d04f688feed4aff05a437f159
SHA512 1ccbcd4ac033bbb7f33d9312eeec6b177289054875212aa7943068aa1113627329f0a853fd291d57dd0c28b517a0d4210307a518c1fc6c8f996486a9b7c77c54

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\bg_pattern_RHP.png

MD5 65d3015fdcc8e13449a0d8953270409c
SHA1 b810532c93bee3911ac21ac857ffc0321ea249a9
SHA256 bf1153ca452a2069947634ef33ca74512921d733864769ee69c0076905eb6fb1
SHA512 cc92ae2c7ee00bbd41e411105ad2d2454406cd7a39009d7077e60896ffa993b4ce150cb73860be69ab84b3fb644cb104bdbede72f02f4bedcf7c5ee082851db1

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\css\main-selector.css

MD5 aa31bd5068b39ef2298d388b0d943fb3
SHA1 4a2c2a5d3e1e1944e6cee4e30820b467982abcd6
SHA256 fb7c8153a69062507e6266dca6ad1acc8ef952e16a86dc98fdc8c5e6375dcbfa
SHA512 d67d49beeb9958560d45b35f70e6f4b66fed48cd91211180628ea6ec7d887738ebef03ca71e38c8ce74a6bb8f71b1c0e61cb15172c313206376015ddd34616a3

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\root\ui-strings.js

MD5 f7cd18e767914fbbe536330847474587
SHA1 29a84eacfba7975e17a6581986606dbcbf1f9a88
SHA256 1b2f42cdc6338de4a61682ea3fe673f23ae306ce05b8e54da96ffd2faae78af5
SHA512 6fdc32a1e1e13e9ac160010675daaee0a650c75fe655bb564b3ca2f72528fb297b95ad655a97e874bed4b4bceab5c8e595cddc5a4a46796a37aacf7e7db8e68c

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\root\ui-strings.js

MD5 9c845108e484d390907d1d5dc3dbb34c
SHA1 dc34f57dc2505e02650a51e84b9c4da3436d7b8e
SHA256 74f466975fefdb35445199f4df6c0ff9655259fa66fb6d6f0f6bbc6e2c8529d2
SHA512 92fa57b468a6e53b2e9ead016d8f2814d8cb4c0f3983762995ff37cefea0370fec33cd171e9db877e84c3587fd894ef91cb7e4795e1c087b19924f4da5a087ab

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\ui-strings.js

MD5 f49b1be8524302fd656edd19e4fcbc3f
SHA1 dadd4553e125516f1fd79c80e48b47e0d1f1a970
SHA256 0568a77bb6116e0f9442ba78e24d4eb22cb8cc1c5696e95cbf9a001eca0b1320
SHA512 c64807248ac636b6c3010ee7fbf8f03b039586f38c61815a73ebb0c21d60817a47e542517420a61608636e6d8427bc0f25f74e7a65634d6c9c42a52b4a92d8a4

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\root\ui-strings.js

MD5 46a095cbcf0b85c6e91f2582efdd0a59
SHA1 14423d5f24cde49a4b6cb76ec9fc299c1e7c9675
SHA256 ac9ab129e2b0b73f8dddcde2375f4e900560edb509860be31aafd3c1396f0cd8
SHA512 57523fd069ffea987addc92a754d32b530132a84422940537dbbf84531a9f60e0c1e99fb6e7c5fcdfcd26c30e05e251544897774c2ff3aac30b53d9c197b9662

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\PlayStore_icon.svg

MD5 ca4315ee9f6f1311bbff40ef03b5f033
SHA1 a4a8732cc6d6e8c5848ebd03f844772c0c4263e1
SHA256 4b368214430cad6068a2da1c775d30835440addf04cf39e2846e428040652bc2
SHA512 abd5af0c561abe95d9bcf9446a4a422498b60568f7e75eca53d31e18c7d7f8fee568da0cffe2923218ceafc81939de5300c1ed7dabd5004ce0c9d4203e6c8daa

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\root\ui-strings.js

MD5 0594c14ae1f8fece383903f72c5addf8
SHA1 cc9336777c748ee569884db457520c43905d23f8
SHA256 8f1871e4cf66ea193ffbc5ba57b527247c11d3c55139d058d79bbf9d235c9d19
SHA512 4b54f64f225c4ce2de68e924319a62d236441f8913aaa481aa96e5b197fe90a0fe13b23dd32109d4cda07650f0e0c7ce4dbdda70574cf35c71ac597d551b05bf

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\root\ui-strings.js

MD5 ca87034e4bf350e430eb59690f11d38b
SHA1 34278719bbf5efcd678d9e86cd87fa194b02f355
SHA256 2326cc53c0fa9b28afcaea3553cee2f172d1fe68614f237e7dcb5fc558cd1e6f
SHA512 0fff2bd96eff907bdbf173f09759ed46538cae64e130120d58bbfe1f398e58c370af7f1f3f84eae87feaf8dca1d18733e7277fa3e93b25b92d4fe240e16e33c8

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\root\ui-strings.js

MD5 bd0f1b5f753f1715020ce2fdccce5856
SHA1 4ed7e6dbe15f2dc0e05482c607422e909e87c8f4
SHA256 b006985ec2d56650539e68bc1e182481d155839965443760b5abbb687fcfa9ca
SHA512 48f47aed6c9ef88d9dd466e3bc9dfc5e76ad19de1d23c0c3d97955f1fce0ceac3a357b1efc01a4cb41d3f3c720fc9b54041793e17bfe70dc37f01e449d0cb5ae

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\he-il\ui-strings.js

MD5 3464f134a4903840b40e788e41836da5
SHA1 1557850152ced88df45b87ab36ca0d536d751677
SHA256 e82f06fd05855edbea826aa296e5cb79ee879c2cab54255c42d3bfa18b59e983
SHA512 b3bc93297723a4f7073aa76398bf7f0393e6614cbbb00a930b04a13718b3323a1611c1dcc8668f7cc5c7c5564d2a4cfe4e7af645a962d5df8bef26daa91c9499

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\nb-no\ui-strings.js

MD5 491c33a2bee3d2ec1696672dcad91523
SHA1 2ffb587ea563278d59d4ed1404c309b75d010c70
SHA256 b43b86100ca32394483ae6a8c03546f884fed79e787d8e039267b95ba5396c71
SHA512 710caf41b100cfadb18080cda34dbf113a2a05002b2f5508b8d0003ace865944d409ac47545032b8c263c9404bd9c82d1583dbc99db073f8652e0e71dec8a3e6

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\root\ui-strings.js

MD5 3146febb659443723451125383dcd3be
SHA1 ed0fcdcee1c7d1003aa21cb7c99065a332a6bcf3
SHA256 b7ce452915b905844506e6a8888085ccdb8d89b22647da6adcd36f3a57455b8f
SHA512 34761503dcf0f9438fe81cf1c6d3be7f5ad4f376aa2e65c58f53826c132a9e76c3db88be5fd2f0ca7d79e6626becb32cd5f8c74131c2af7f68e53beac5eeddd6

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\root\ui-strings.js

MD5 517915fc5b7c89b8c01b163d5436cb82
SHA1 e2d3859ee2b77e9485c4a03a3b675a640492e44d
SHA256 61925af683d9e70a4a2f81b5b8c191a5ce2d0d02045047c7e9da74dc0a54e0df
SHA512 c75b14733fba49abb199f55da8d1e76dd5be1c96a7c85cbfa7b238b9e3d36b6abd77045df9916d8c6aea54e314175c23cbd8073cfd84f32a2aa04b783c3d2055

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\sl-sl\ui-strings.js

MD5 bd3e6689dd45efcfa4b289d3c69ca7a5
SHA1 62067159e68852dc1b2100eae6cdd3fcdf514dab
SHA256 a95682fdcba3d3d31582e3f97bf5bc30f7c94c0e638926eac5052be2ccdd7abd
SHA512 fd5a8f388dc32ae4baf6483c0312d018ff0215493772ffda032451924603734f07314bb1b6e6e0b6e6483148553e0dde361c7fb9185a3d5357b9bcb7eda4b9db

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\root\ui-strings.js

MD5 2f667ae0b4a4de7f977a07e17adf79a1
SHA1 2330a76575cf4de58844cdfcb379e83277bf5f2e
SHA256 9cd7755b6a94a1938ccc338a0ba17f65c942efcbbd0d01114848d1fad1337975
SHA512 126daedbb279648cd14c67aa7ff7585d27f538b7d54dcaaa951921e8ad111355bdf494da0ce70d077945a86b73425abdd923ef21822a1da11968021d6179d792

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\root\ui-strings.js

MD5 081728305afd3939a3813af05df2711e
SHA1 84531ed932e4b0e1408ee51498c99111326293c3
SHA256 8ed00e43b3947b1e02151386d7ee62fe56b826f02e902abc1044bc7943e8f872
SHA512 ba42310c09466ffa166570c7346fdaa668456b3b2ce76efae10f6338386876a811a386f9dbe0c4e06a8a5a26a3fec22935739105b88b5babdee872a5b4722673

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\en-gb\ui-strings.js

MD5 8700cc9c940580f7c263ac5a184bd814
SHA1 f54199e1e5466af56b6ff985ed5763f7ce12ab2c
SHA256 757c51b8b5d6d927c20196582e7f08c9975da726436cb6b56d58cea755ac02e4
SHA512 74f8026bfb2b343f5b2409c451dd0476dc1cb7e1e08f02c0a872a5f2c196fa31785a5b62adcb8b13e04fdf7fdc5ec93ce7a499a6b1a6094d026e4c6ecf2a51b0

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\root\ui-strings.js

MD5 3401df9eabf89b1477e164c603319998
SHA1 8aea32ad12b8222f26f5d19023346f3ceeead0db
SHA256 d9f7b9e08d1f2edc32c627fee64af8d2f3a61b89c10a1cbbe74ba9efce9d8746
SHA512 2379055c90fef3935062a7dae8edbffdf4a391255457f8aa6d58f1fb8e539ef3c7ab0baf144f4ceb2a8070e5dc697bae0a6c0c081bee67981c2db99ff2030bb5

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\es-es\ui-strings.js

MD5 d38e12b5108df07c9a8bb512fff05bbd
SHA1 6a3d272ea8c3bfa3e9fc1986951a0ebd6e4a741c
SHA256 868dd7c66023db147879d71d1ca0d288bee1781f8b32674d21a17fc241c9f92d
SHA512 553dd6e81721ef1fc75cb85abac69d898546c52c85a346b529338235bdbfc31970e92610c6a0ca586fc9c0f2014c7cb50285d7c44db54699cf67a5b16f0f7117

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\root\ui-strings.js

MD5 bb3555deb9b56e0b40e2125f0678d8ff
SHA1 c7d3ecf5b03cbe3eeef3dd410a6bfa316d91bffb
SHA256 13d8c7eccd4650c75035624b5721098a069da9b8b3dc63284656cf5c980a8c2e
SHA512 7b5ddb05e15a772b593fe8a7be01b734a1836b96be7ae07754570114a4a6ff907154861a6bc871f38fa8c6050063b083ed9d72a26450c6927bafbd20a7ca6456

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\he-il\ui-strings.js

MD5 624fca32fc1b18259dfe0075512f3e0c
SHA1 e2f57c1fe7e4c6408edbbe8e890bd95a59dfe8ec
SHA256 6211d2820c673623ee6925b891428acbd3532f6dd573116b166d860934cde5e3
SHA512 34631dd2427283dacf21a5706d1f1b0ca5197d652e23a1a8ebe2a00dfc357b8f505f6884d62b743886b09f6ae301b6c15d6d410f0b9acecba46ca8b118e70b39

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\root\ui-strings.js

MD5 39902d6c4feeb98b6eae0f9280d23a02
SHA1 9381831b107cd1028b8ce9bf7b9e48be30f6af83
SHA256 31c58892bc82e453bbe42283a298986629ef97fa6feaaf3725254d587d4c2df9
SHA512 84a61e45b30fb532fcb940a8fc9b7c40608dec2566981a7c02f8dac5c2d20fb5fd4d31a2f3033968470f2b43b01892d492d344990cd98cad0970938de2fb652b

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\css\main-selector.css

MD5 ef44f8fd5e1f3b27432b80fc1f472a9b
SHA1 3a8469d9393c68dfeeec826c9654758fae9a2531
SHA256 c4fc6b4b93aa7647b95123b69a4eb0141f5d78774db598cb16abb37c734c20a4
SHA512 d0b9089c3388aeb961e80bc732fa5bfdf5ed45c3762ab1f9a4758ffbb6c23b0c6dce0dbde3817f4fd3b2a28388407b6414e17f5eff17b0ddd7954233fd952391

C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB_EURO.txt

MD5 78f67c9f57b164885ec52e04d3a98615
SHA1 cb877491de3f39edb0ab4b346f3d239e3df7c0be
SHA256 104cc6a0b44e21aa8761bdece994528985b04aeca695d869f41eec26f0536b67
SHA512 c46ff3be92859a3d87c4a73351e166c1ac5e92082f9ab19eb35195c406a7f49ef0aeb4b1c0bb24aac8bfcfd72d17199619f160fcb29908dd8ad6821f01a46bac

C:\Program Files (x86)\Microsoft\EdgeCore\118.0.2088.57\identity_proxy\win11\identity_helper.Sparse.Internal.msix

MD5 60fd2ff62878f9cceef1cb9a5d15b5a3
SHA1 99a64097caf0a8f0c6d9a1fa67727c2aac3b0530
SHA256 cf7448c788b0ea83b010ffeff317780bb3398d9da01e54d0536b71bc0c008a9f
SHA512 976f307a4a481bc45bbada6b9f7f1f961a8b3ac4b1dd02a6afe6866d622d83839467c3a4371dda8de80c73b79e4785fe793c064d5a646feb87b07a43d43691df

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\118.0.2088.57\identity_proxy\win10\identity_helper.Sparse.Stable.msix.infected

MD5 fdfe56f0bfa1d1d2e1e16f4fdecd73a7
SHA1 f1f7ccc862db5d46eea9a95aa1bcd8d2d9d87b85
SHA256 8d828074b1c66aaf0ea69fe64a6bbc14ea0947ce4b07d06e91e0f7d4ad622cd3
SHA512 0e8539a4bf77ed56831cc171345ce10b288fb75f2c633326d4ae094b56b0862fc25d05ac9dc4f9086943fb0792479564eb251c0831c67755bc28536944e4223d

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\118.0.2088.57\ResiliencyLinks\identity_proxy\win11\identity_helper.Sparse.Internal.msix.DATA

MD5 3dcc06d6cec6327ae5535f00be19b3f9
SHA1 f01c0a94b9ad6306eb293463f817b5f7956d8966
SHA256 d4527ba26908076af17e329e81a2c0dbb442d8ab1ea9534e0a29ca9f1073548f
SHA512 9e503bd2f70c81e66ddc43b195f8114b402dc8d4a678beb780efdaf1c98362d29d4afcb04e3d87af56c4fd2955fa3e407f6968d4baf90645c554cb2fd1a9a216

C:\Users\Admin\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOCK

MD5 31b0ef4290d59e252acd0c7e5210d6f5
SHA1 b2be711ae7881aa784833a652fc20bfe8f36663f
SHA256 04da3ff0d61f69b830e8a5af884a843ac444da844a1fbcf00ba9d419eac02392
SHA512 7000b1d3540caa299ed822083ee1e4fbc7365cfcb5bb649a7503ce64564752942725ef89b86f0778668791e9d06cdabd95b95e95a739584d4dbc82a83d5869c8

C:\ProgramData\Microsoft\Network\Downloader\edbtmp.log

MD5 57399620ec293fc30b892cd1a77bf15b
SHA1 f493ef455d6266c5a3b670169c91c76536d6d72f
SHA256 bab7393b117719f278e875bb7335fd1f10c50b0d3748e1a0e45f2a341acc0dfc
SHA512 13ae63bd6d61eea53b99d9d9d8d807c3564bb21558b6b6a05b9e64ef100a55bcdc908f9c722dc39403740075fd22c58c9fe49d9da44a4a620894f6bd40c784de

C:\ProgramData\Microsoft\User Account Pictures\Admin.dat

MD5 be8af3d625ada16bc04306dfcfc45eb8
SHA1 5093ef1b24e4e5bb60032c2c44cbba8782741ec0
SHA256 c5f8f331949c246d7dac8c73416bf20636dbae724826d7756029e46a4682ccb0
SHA512 2d3d56f224938614bc5aff1eddde9ae64ee39087861d036af15e52f72e75480c575fb03d979fa39ae03ce29a48f37ab8bd20cbe6e73a836a0b78123b767ae0a2

C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\packages\vcRuntimeAdditional_amd64\vc_runtimeAdditional_x64.msi

MD5 ab222acf687cf465d641b01e262d33fb
SHA1 c4d2caf7d7663e1094b47e2a62088a581ec530cd
SHA256 815541d5bc5004b0bfce77969cb7f23e712cb43669718c3c8226749c1664b0f8
SHA512 8d3493708b59b4b8541e7b015997ea3b8eb795002b29655305d9b4af16cb5bb2b98434890ccf2ac29353005c3ebb380c522b33127d8880b110e04ee29eb441fc

C:\ProgramData\Microsoft\Windows\Caches\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db.infected

MD5 811c166b28aeec33c4b718b1991672fd
SHA1 2d31f4c8d9e0daf40933987906abfa4be0c3f7a5
SHA256 99d0bc27e06c41e979de01441453d2ceb407a3eee832ca26e41d259d77f6654d
SHA512 411e04e7e9984ac771fcb3283785f6f168d8edc81fa7b8d613c2048c4034876455570fb8d8ee0aa9384ca0bbb47eb96dd0e2c0823af56ac402d9b277ca252828