Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
27/02/2024, 17:46
Static task
static1
Behavioral task
behavioral1
Sample
82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe
Resource
win10v2004-20240226-en
General
-
Target
82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe
-
Size
415KB
-
MD5
ff99b9afd11f39f9bbd0acfdf5fc0e16
-
SHA1
291a6b206584602a76eaff6c750bc94962c4b621
-
SHA256
82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b
-
SHA512
11b1a48c1e4ab7f9ca3383438543f04746605b8f389783c794ad3c34a6d62970c422ac9cab0124abd1bc622b9e640e866bbd43c8fe6479640f32212460e60259
-
SSDEEP
6144:7/2pAAzX2K6wh8hymOxxIR3/LAs4RumG/vV4UWFfhai3MbmBYL:j2F19OaxiB/LAGNl43wvKM
Malware Config
Extracted
C:\odt\HOW_TO_BACK_FILES.html
Signatures
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
description pid Process procid_target PID 3528 created 3336 3528 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe 61 -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
pid Process 4212 bcdedit.exe 3968 bcdedit.exe -
Renames multiple (6887) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
pid Process 4024 wbadmin.exe -
pid Process 564 wbadmin.exe -
Modifies Installed Components in the registry 2 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BabyLockerKZ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe\"" 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BabyLockerKZ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe\"" 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\L: 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe File opened (read-only) \??\M: 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe File opened (read-only) \??\K: 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe File opened (read-only) \??\N: 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe File opened (read-only) \??\O: 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe File opened (read-only) \??\R: 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe File opened (read-only) \??\S: 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe File opened (read-only) \??\B: 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe File opened (read-only) \??\G: 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe File opened (read-only) \??\H: 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe File opened (read-only) \??\Z: 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe File opened (read-only) \??\U: 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe File opened (read-only) \??\X: 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe File opened (read-only) \??\Y: 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe File opened (read-only) \??\V: 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe File opened (read-only) \??\I: 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe File opened (read-only) \??\P: 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe File opened (read-only) \??\T: 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe File opened (read-only) \??\J: 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe File opened (read-only) \??\Q: 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe File opened (read-only) \??\W: 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe File opened (read-only) \??\F: 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe File opened (read-only) \??\A: 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe File opened (read-only) \??\E: 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Functions\BreakAndContinue.Tests.ps1 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\ja-JP\HOW_TO_BACK_FILES.html 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_MAK-pl.xrm-ms 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\SplashScreen.scale-400_contrast-black.png 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-80_altform-lightunplated.png 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-40_contrast-white.png 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ca-es\HOW_TO_BACK_FILES.html 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\Locales\da.pak.DATA 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\requests\browse.xml 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\AppxManifest.xml 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\Wide310x150\PaintWideTile.scale-125.png 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteAppList.targetsize-40_altform-unplated.png 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-white_targetsize-24.png 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\Spotlight_WinterGames.gif 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\en-gb\ui-strings.js 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\CP1253.TXT 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe File opened for modification C:\Program Files\7-Zip\descript.ion 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\423x173\46.jpg 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageBadgeLogo.scale-400_contrast-white.png 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\SplashScreen.scale-150.png 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarBadge.scale-125.png 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_OEM_Perp-pl.xrm-ms 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe File created C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_neutral_split.scale-125_8wekyb3d8bbwe\microsoft.system.package.metadata\HOW_TO_BACK_FILES.html 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-white\SplashScreen.scale-200_contrast-white.png 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-Outlook.scale-100.png 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Download_on_the_App_Store_Badge_fr_135x40.svg 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\ro-ro\HOW_TO_BACK_FILES.html 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\uk-ua\HOW_TO_BACK_FILES.html 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_Subscription-ppd.xrm-ms 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\LAYERS\PREVIEW.GIF 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-256_altform-unplated_contrast-black.png 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Store.Purchase\Controls\Xbox360PurchaseControl.xaml 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_checkbox_selected_18.svg 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\MixedRealityPortalStoreLogo.scale-100.png 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-32_altform-unplated_contrast-black.png 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-256_altform-unplated_contrast-black.png 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\kb-locked.png 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\inline-error-2x.png 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Locales\ur.pak.DATA 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.contrast-black_targetsize-96.png 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\OutlookMailMediumTile.scale-200.png 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\bin\HOW_TO_BACK_FILES.html 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\sl-sl\HOW_TO_BACK_FILES.html 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\sk-sk\ui-strings.js 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\FileIcons\FileLogoExtensions.targetsize-64.png 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\Wide310x150Logo.scale-125.png 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Assets\Square44x44Logo.targetsize-48_altform-lightunplated.png 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\LargeTile.scale-100_contrast-black.png 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\de-de\ui-strings.js 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AlarmsSplashScreen.contrast-black_scale-100.png 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\nb-no\HOW_TO_BACK_FILES.html 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\fr-ma\HOW_TO_BACK_FILES.html 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\Trust Protection Lists\Mu\Content 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_MAK-ul-oob.xrm-ms 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Resources\1033\msmdsrvi_xl.rll 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.targetsize-48.png 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\LinkedInboxWideTile.scale-150.png 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\S_IlluDCFilesEmpty_180x180.svg 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe File opened for modification C:\Program Files\7-Zip\Lang\id.txt 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Delete.png 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-256_altform-unplated_devicefamily-colorfulunplated.png 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\VisualElements\LogoCanary.png 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe File opened for modification C:\Program Files\VideoLAN\VLC\hrtfs\dodeca_and_7channel_3DSL_HRTF.sofa 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.1.etl wbadmin.exe File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.3.etl wbadmin.exe File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.2.etl wbadmin.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 4528 vssadmin.exe -
Kills process with taskkill 14 IoCs
pid Process 456 taskkill.exe 1580 taskkill.exe 3404 taskkill.exe 1152 taskkill.exe 3172 taskkill.exe 1152 taskkill.exe 2324 taskkill.exe 1132 taskkill.exe 3520 taskkill.exe 4340 taskkill.exe 4976 taskkill.exe 3356 taskkill.exe 3452 taskkill.exe 1480 taskkill.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3808065738-1666277613-1125846146-1000\{584BAB75-B4C2-4A7B-9886-6AB0D10E936E} explorer.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3528 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe 3528 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe 3528 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe 3528 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe 3528 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe 3528 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe 3528 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe 3528 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe 3528 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe 3528 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe 3528 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe 3528 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe 3528 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe 3528 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe 3528 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe 3528 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe 3528 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe 3528 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe 3528 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe 3528 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe 3528 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe 3528 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe 3528 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe 3528 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe 3528 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe 3528 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe 3528 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe 3528 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe 3528 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe 3528 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe 3528 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe 3528 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe 3528 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe 3528 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe 3528 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe 3528 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe 3528 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe 3528 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe 3528 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe 3528 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe 3528 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe 3528 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe 3528 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe 3528 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe 3528 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe 3528 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe 3528 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe 3528 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe 3528 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe 3528 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe 3528 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe 3528 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe 3528 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe 3528 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe 3528 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe 3528 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe 3528 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe 3528 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe 3528 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe 3528 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe 3528 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe 3528 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe 3528 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe 3528 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe -
Suspicious use of AdjustPrivilegeToken 40 IoCs
description pid Process Token: SeDebugPrivilege 3172 taskkill.exe Token: SeDebugPrivilege 3356 taskkill.exe Token: SeDebugPrivilege 3452 taskkill.exe Token: SeDebugPrivilege 1132 taskkill.exe Token: SeDebugPrivilege 456 taskkill.exe Token: SeDebugPrivilege 1152 taskkill.exe Token: SeDebugPrivilege 2324 taskkill.exe Token: SeDebugPrivilege 1480 taskkill.exe Token: SeDebugPrivilege 1580 taskkill.exe Token: SeDebugPrivilege 3520 taskkill.exe Token: SeDebugPrivilege 3404 taskkill.exe Token: SeDebugPrivilege 4340 cmd.exe Token: SeIncreaseQuotaPrivilege 2340 WMIC.exe Token: SeSecurityPrivilege 2340 WMIC.exe Token: SeTakeOwnershipPrivilege 2340 WMIC.exe Token: SeLoadDriverPrivilege 2340 WMIC.exe Token: SeSystemProfilePrivilege 2340 WMIC.exe Token: SeSystemtimePrivilege 2340 WMIC.exe Token: SeProfSingleProcessPrivilege 2340 WMIC.exe Token: SeIncBasePriorityPrivilege 2340 WMIC.exe Token: SeCreatePagefilePrivilege 2340 WMIC.exe Token: SeBackupPrivilege 2340 WMIC.exe Token: SeRestorePrivilege 2340 WMIC.exe Token: SeShutdownPrivilege 2340 WMIC.exe Token: SeDebugPrivilege 2340 WMIC.exe Token: SeSystemEnvironmentPrivilege 2340 WMIC.exe Token: SeRemoteShutdownPrivilege 2340 WMIC.exe Token: SeUndockPrivilege 2340 WMIC.exe Token: SeManageVolumePrivilege 2340 WMIC.exe Token: 33 2340 WMIC.exe Token: 34 2340 WMIC.exe Token: 35 2340 WMIC.exe Token: 36 2340 WMIC.exe Token: SeBackupPrivilege 3744 vssvc.exe Token: SeRestorePrivilege 3744 vssvc.exe Token: SeAuditPrivilege 3744 vssvc.exe Token: SeShutdownPrivilege 4648 explorer.exe Token: SeCreatePagefilePrivilege 4648 explorer.exe Token: SeShutdownPrivilege 4648 explorer.exe Token: SeCreatePagefilePrivilege 4648 explorer.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3528 wrote to memory of 1760 3528 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe 97 PID 3528 wrote to memory of 1760 3528 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe 97 PID 3528 wrote to memory of 1760 3528 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe 97 PID 1760 wrote to memory of 4028 1760 cmd.exe 99 PID 1760 wrote to memory of 4028 1760 cmd.exe 99 PID 3528 wrote to memory of 232 3528 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe 100 PID 3528 wrote to memory of 232 3528 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe 100 PID 3528 wrote to memory of 232 3528 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe 100 PID 232 wrote to memory of 3276 232 cmd.exe 102 PID 232 wrote to memory of 3276 232 cmd.exe 102 PID 3276 wrote to memory of 3172 3276 cmd.exe 103 PID 3276 wrote to memory of 3172 3276 cmd.exe 103 PID 3528 wrote to memory of 4172 3528 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe 105 PID 3528 wrote to memory of 4172 3528 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe 105 PID 3528 wrote to memory of 4172 3528 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe 105 PID 4172 wrote to memory of 4756 4172 cmd.exe 107 PID 4172 wrote to memory of 4756 4172 cmd.exe 107 PID 4756 wrote to memory of 4976 4756 cmd.exe 108 PID 4756 wrote to memory of 4976 4756 cmd.exe 108 PID 3528 wrote to memory of 1532 3528 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe 109 PID 3528 wrote to memory of 1532 3528 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe 109 PID 3528 wrote to memory of 1532 3528 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe 109 PID 1532 wrote to memory of 4148 1532 cmd.exe 111 PID 1532 wrote to memory of 4148 1532 cmd.exe 111 PID 4148 wrote to memory of 3356 4148 cmd.exe 112 PID 4148 wrote to memory of 3356 4148 cmd.exe 112 PID 3528 wrote to memory of 2988 3528 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe 113 PID 3528 wrote to memory of 2988 3528 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe 113 PID 3528 wrote to memory of 2988 3528 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe 113 PID 2988 wrote to memory of 3036 2988 cmd.exe 115 PID 2988 wrote to memory of 3036 2988 cmd.exe 115 PID 3036 wrote to memory of 3452 3036 cmd.exe 116 PID 3036 wrote to memory of 3452 3036 cmd.exe 116 PID 3528 wrote to memory of 564 3528 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe 117 PID 3528 wrote to memory of 564 3528 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe 117 PID 3528 wrote to memory of 564 3528 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe 117 PID 564 wrote to memory of 2556 564 cmd.exe 119 PID 564 wrote to memory of 2556 564 cmd.exe 119 PID 2556 wrote to memory of 1132 2556 cmd.exe 120 PID 2556 wrote to memory of 1132 2556 cmd.exe 120 PID 3528 wrote to memory of 4288 3528 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe 121 PID 3528 wrote to memory of 4288 3528 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe 121 PID 3528 wrote to memory of 4288 3528 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe 121 PID 4288 wrote to memory of 4924 4288 cmd.exe 124 PID 4288 wrote to memory of 4924 4288 cmd.exe 124 PID 4924 wrote to memory of 456 4924 cmd.exe 125 PID 4924 wrote to memory of 456 4924 cmd.exe 125 PID 3528 wrote to memory of 3288 3528 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe 126 PID 3528 wrote to memory of 3288 3528 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe 126 PID 3528 wrote to memory of 3288 3528 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe 126 PID 3288 wrote to memory of 4028 3288 cmd.exe 128 PID 3288 wrote to memory of 4028 3288 cmd.exe 128 PID 4028 wrote to memory of 1152 4028 cmd.exe 129 PID 4028 wrote to memory of 1152 4028 cmd.exe 129 PID 3528 wrote to memory of 2156 3528 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe 130 PID 3528 wrote to memory of 2156 3528 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe 130 PID 3528 wrote to memory of 2156 3528 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe 130 PID 2156 wrote to memory of 4104 2156 cmd.exe 132 PID 2156 wrote to memory of 4104 2156 cmd.exe 132 PID 4104 wrote to memory of 2324 4104 cmd.exe 133 PID 4104 wrote to memory of 2324 4104 cmd.exe 133 PID 3528 wrote to memory of 3912 3528 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe 134 PID 3528 wrote to memory of 3912 3528 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe 134 PID 3528 wrote to memory of 3912 3528 82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe 134 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3336
-
C:\Users\Admin\AppData\Local\Temp\82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe"C:\Users\Admin\AppData\Local\Temp\82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3528 -
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c rem Kill \"SQL\"3⤵
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c rem Kill \"SQL\"4⤵PID:4028
-
-
-
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlbrowser.exe3⤵
- Suspicious use of WriteProcessMemory
PID:232 -
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c taskkill -f -im sqlbrowser.exe4⤵
- Suspicious use of WriteProcessMemory
PID:3276 -
C:\Windows\system32\taskkill.exetaskkill -f -im sqlbrowser.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3172
-
-
-
-
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sql writer.exe3⤵
- Suspicious use of WriteProcessMemory
PID:4172 -
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c taskkill -f -im sql writer.exe4⤵
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Windows\system32\taskkill.exetaskkill -f -im sql writer.exe5⤵
- Kills process with taskkill
PID:4976
-
-
-
-
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlserv.exe3⤵
- Suspicious use of WriteProcessMemory
PID:1532 -
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c taskkill -f -im sqlserv.exe4⤵
- Suspicious use of WriteProcessMemory
PID:4148 -
C:\Windows\system32\taskkill.exetaskkill -f -im sqlserv.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3356
-
-
-
-
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im msmdsrv.exe3⤵
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c taskkill -f -im msmdsrv.exe4⤵
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Windows\system32\taskkill.exetaskkill -f -im msmdsrv.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3452
-
-
-
-
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im MsDtsSrvr.exe3⤵
- Suspicious use of WriteProcessMemory
PID:564 -
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c taskkill -f -im MsDtsSrvr.exe4⤵
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Windows\system32\taskkill.exetaskkill -f -im MsDtsSrvr.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1132
-
-
-
-
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlceip.exe3⤵
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c taskkill -f -im sqlceip.exe4⤵
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Windows\system32\taskkill.exetaskkill -f -im sqlceip.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:456
-
-
-
-
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im fdlauncher.exe3⤵
- Suspicious use of WriteProcessMemory
PID:3288 -
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c taskkill -f -im fdlauncher.exe4⤵
- Suspicious use of WriteProcessMemory
PID:4028 -
C:\Windows\system32\taskkill.exetaskkill -f -im fdlauncher.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1152
-
-
-
-
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im Ssms.exe3⤵
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c taskkill -f -im Ssms.exe4⤵
- Suspicious use of WriteProcessMemory
PID:4104 -
C:\Windows\system32\taskkill.exetaskkill -f -im Ssms.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2324
-
-
-
-
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im SQLAGENT.EXE3⤵PID:3912
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c taskkill -f -im SQLAGENT.EXE4⤵PID:2532
-
C:\Windows\system32\taskkill.exetaskkill -f -im SQLAGENT.EXE5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1480
-
-
-
-
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im fdhost.exe3⤵PID:2272
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c taskkill -f -im fdhost.exe4⤵PID:640
-
C:\Windows\system32\taskkill.exetaskkill -f -im fdhost.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1580
-
-
-
-
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im ReportingServicesService.exe3⤵PID:3524
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c taskkill -f -im ReportingServicesService.exe4⤵PID:636
-
C:\Windows\system32\taskkill.exetaskkill -f -im ReportingServicesService.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3520
-
-
-
-
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im msftesql.exe3⤵PID:1976
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c taskkill -f -im msftesql.exe4⤵PID:1224
-
C:\Windows\system32\taskkill.exetaskkill -f -im msftesql.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3404
-
-
-
-
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im pg_ctl.exe3⤵PID:4508
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c taskkill -f -im pg_ctl.exe4⤵PID:1740
-
C:\Windows\system32\taskkill.exetaskkill -f -im pg_ctl.exe5⤵
- Kills process with taskkill
PID:4340
-
-
-
-
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -impostgres.exe3⤵PID:2436
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c taskkill -f -impostgres.exe4⤵PID:4028
-
C:\Windows\system32\taskkill.exetaskkill -f -impostgres.exe5⤵
- Kills process with taskkill
PID:1152
-
-
-
-
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop MSSQLServerADHelper1003⤵PID:3256
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c net stop MSSQLServerADHelper1004⤵PID:4104
-
C:\Windows\system32\net.exenet stop MSSQLServerADHelper1005⤵PID:3744
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSSQLServerADHelper1006⤵PID:2524
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop MSSQL$ISARS3⤵PID:4540
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c net stop MSSQL$ISARS4⤵PID:3176
-
C:\Windows\system32\net.exenet stop MSSQL$ISARS5⤵PID:2208
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSSQL$ISARS6⤵PID:5064
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop MSSQL$MSFW3⤵PID:1532
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c net stop MSSQL$MSFW4⤵PID:1004
-
C:\Windows\system32\net.exenet stop MSSQL$MSFW5⤵PID:3376
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSSQL$MSFW6⤵PID:2728
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLAgent$ISARS3⤵PID:3408
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c net stop SQLAgent$ISARS4⤵PID:4308
-
C:\Windows\system32\net.exenet stop SQLAgent$ISARS5⤵PID:3524
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SQLAgent$ISARS6⤵PID:2284
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLAgent$MSFW3⤵PID:4944
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c net stop SQLAgent$MSFW4⤵PID:4900
-
C:\Windows\system32\net.exenet stop SQLAgent$MSFW5⤵PID:1976
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SQLAgent$MSFW6⤵PID:3328
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLBrowser3⤵PID:2724
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c net stop SQLBrowser4⤵
- Suspicious use of AdjustPrivilegeToken
PID:4340 -
C:\Windows\system32\net.exenet stop SQLBrowser5⤵PID:2340
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SQLBrowser6⤵PID:888
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop REportServer$ISARS3⤵PID:1760
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c net stop REportServer$ISARS4⤵PID:2156
-
C:\Windows\system32\net.exenet stop REportServer$ISARS5⤵PID:2440
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop REportServer$ISARS6⤵PID:3172
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLWriter3⤵PID:3256
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c net stop SQLWriter4⤵PID:3688
-
C:\Windows\system32\net.exenet stop SQLWriter5⤵PID:2208
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SQLWriter6⤵PID:3176
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c vssadmin.exe Delete Shadows /All /Quiet3⤵PID:4456
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c vssadmin.exe Delete Shadows /All /Quiet4⤵PID:3120
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet5⤵
- Interacts with shadow copies
PID:4528
-
-
-
-
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wbadmin delete backup -keepVersion:0 -quiet3⤵PID:5064
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c wbadmin delete backup -keepVersion:0 -quiet4⤵PID:2616
-
C:\Windows\system32\wbadmin.exewbadmin delete backup -keepVersion:0 -quiet5⤵
- Deletes system backups
PID:564
-
-
-
-
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTATEBACKUP3⤵PID:4084
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTATEBACKUP4⤵PID:3524
-
C:\Windows\system32\wbadmin.exewbadmin DELETE SYSTEMSTATEBACKUP5⤵
- Deletes System State backups
- Drops file in Windows directory
PID:4024
-
-
-
-
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTABACKUP -deleteOldest3⤵PID:3416
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTABACKUP -deleteOldest4⤵PID:636
-
C:\Windows\system32\wbadmin.exewbadmin DELETE SYSTEMSTABACKUP -deleteOldest5⤵PID:4324
-
-
-
-
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wmic.exe SHADOWCOPY /nointeractive3⤵PID:1840
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c wmic.exe SHADOWCOPY /nointeractive4⤵PID:3128
-
C:\Windows\System32\Wbem\WMIC.exewmic.exe SHADOWCOPY /nointeractive5⤵
- Suspicious use of AdjustPrivilegeToken
PID:2340
-
-
-
-
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c bcdedit.exe /set {default} recoverynabled No3⤵PID:3268
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c bcdedit.exe /set {default} recoverynabled No4⤵PID:4608
-
C:\Windows\system32\bcdedit.exebcdedit.exe /set {default} recoverynabled No5⤵
- Modifies boot configuration data using bcdedit
PID:4212
-
-
-
-
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures3⤵PID:2272
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures4⤵PID:1460
-
C:\Windows\system32\bcdedit.exebcdedit.exe /set {default} bootstatuspolicy ignoreallfailures5⤵
- Modifies boot configuration data using bcdedit
PID:3968
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe\\?\C:\Users\Admin\AppData\Local\Temp\82fabe7611dff81affd39733a833c5de9994bce8994fa184535c8b62cf72247b.exe -network2⤵
- Adds Run key to start application
PID:972 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:3688
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c pause3⤵PID:4184
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3744
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3852 --field-trial-handle=2280,i,716736634476467098,11449718822158202904,262144 --variations-seed-version /prefetch:81⤵PID:5744
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4648
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5117af2cbabf4ff44a324014081caa0a8
SHA1f91edc8a49e69de2659cd5723ca1133eb7cd7aa1
SHA2565f001c84aefcca6a27b413b51da8691ba18bbbdc84471793aff63ac38f9047c3
SHA512f1cc5d0b52562e9fb2abaa1de8f3fe024400b69099cc76682a4be8d1992430160dc47d4ed62f1dfe66054438a38f4e2f6bf6c3fa78c510971b7a7c3cbef9a60f
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\aic_file_icons_retina_thumb.png
Filesize52KB
MD54ba64b1dcedd7a2ee37bb5d3fe663b5d
SHA1c827c1362570868150b8a4be1b9137feb56d5285
SHA2566a5747548faed5dd1cf468b68d9f881269e3db8ed2119afa0e73332f4eb034b1
SHA512c28d5676ace84b65457f9c1463bd635b28c121d513c4fb390eb31c922e55c8d1d1456a282d688ab87063c5efc51cce6ebe25819f6c8e9c75719dc88c98865ed5
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\selection-actions.png
Filesize3KB
MD58b5e14e7c0dda4bcbf0d3872bff5d364
SHA102ba7fcbde014943e73590364727a3fe99f2e582
SHA256cf100cf720b90c89a1bc23c4b5b2b910558478a03cfea377fad68cbdf6dfe5ab
SHA512d583592f0c71e36f802e89d737c941e764033bd5f76652d5be5cf8549d33966a649690e702c87b4ac3cfe2759e218c1a79a110c32d270fe5be251e32c26f032c
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_remove_18.svg.hazard7
Filesize2KB
MD5373bd23db61e7657b1f0f5b9a897012b
SHA1cca3eff790cd062fda654b9f1101773dca6d4fcc
SHA256be0382545bac884f68e04dc782170fe2ba2e4338088bd708e2399b751148b18c
SHA512cc38fee60926f91cc71d34e1c8cdf334a84e02ff755bb52ddd55c4aa2f63de4e069576df312b924f839d24480ad2e458ac56616c1af0137f54321e00b88a309c
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions2x.png
Filesize5KB
MD56fec01b438cf72cd05eaa207c90556af
SHA148c87524b1eb95f19e46b2295bc4ffea719d4598
SHA256d6af6d1ed824b01bfc62de09c045dd76cafe8a3ee8aec2885db3af34542f6932
SHA512f6528e7f3fe90f1acec4dc2bb572f065740025bfb22983f34302d8c6e16993e19304b3dd29a31ecc19eeef74af01f54503a11abb84011b16aef2c3ec318a39c8
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\en-ae\ui-strings.js
Filesize29KB
MD51623663c4a92e36b64e93a947d8774da
SHA15473876ec17294d4b842c2ab06e16decdd647d72
SHA2569f818697d7bd2c8dba22ff8058c5885f29cda81a67704e3c6187cd9fd7b8fc77
SHA5126ad83235e0ada3c10606b8d099a98b7e6bbc5196fb9ada2aad94932f210884a328d8e965f931ffd6a2899089e8ab931cfa80d2c20697ecc2fcfabe1480e8d0b9
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\root\ui-strings.js
Filesize9KB
MD57537361094551684ee208057fb6cc928
SHA1d836d0b9da99fd2d0f16544bfcca8cc5322fc8d1
SHA2568a841cc4b6c53b799d405e3599a993f1e4dde74d9be7cce72392308be1aa2a54
SHA5129517434e84730c34cb215e4a139f9d44ebb9aa57780ed43e51071a8508f96a8e9a3623ea7ce68972061429ce05d0b336cd7ca1308a962445c27cf842837a99b9
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\he-il\ui-strings.js
Filesize2KB
MD50beffe07a6f6cf6b55fc02f65cf2c8a7
SHA1ed40ac9e26ba1d9b80e1bd5bb017e7714fdf409c
SHA2568d7f5f2c29ab68893bce8252141d709c67390cf1d4e679c9ad39b4f78ecfa428
SHA512bcb900d36aef862f35a982dd27c1a4eb22516183f03b7370d03308db760c6433cbce930dfd9a5e57631493b01eb11bae8175696d7543d0ca86f8376243334ace
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\root\ui-strings.js
Filesize5KB
MD57a2943025227a21a66cc300db80f1846
SHA168e6869b56575403fc68b6c1b18329fd4e75a2b3
SHA256a26a3a6e5dccba1ca519d0b40fa3c23ce5b7be028dc1103d3681300723b773fc
SHA512fd81f97a85524aa78965469b1f9875e3e2555a2f3e11aa479035bb2d7c52ca0401a41e736be2a7a6d41984fe3f85cc90088fc208a735ffb09b1d55d053911845
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\root\ui-strings.js
Filesize3KB
MD5172517d3e848c53ca78ddbcb619b9103
SHA1d08a665c4fee34a76d2a46332199a7b5a13afa43
SHA256b5e5ce539f25cc926802a643d2786e42b0a7fbe4dd852c11c757209c56f4a948
SHA51235cf65519b8d08516f1670d725d5bd4bfe4ac89a52e232edb56149776175cc61f3eec26f0f2c11b518f71108c142c81ffa769b5fa1f29c594f73928153c2f525
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\rhp\convertpdf-rna-selector.js
Filesize176KB
MD58a8bf3868d5628d870a796fcf240ad91
SHA190c89202073422afb30468d1f30da8449328505f
SHA2563b5eea87f8d133952b3fc1a8aaa2ecdbc6efde3b91e570a9c401faa1521c02a4
SHA51268221a31501d19a29e489f1774a806e233fa2b32de218eabee6440cc74f7bdb691e166bc546cc9378672fd8cb95631f66f95c0edf6ba8b8e337096f72cbdafe5
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\rhp\convertpdf-rna-tool-view.js
Filesize377KB
MD5cf5f59b529d298c5021f0f40d343eddd
SHA16c823b93b347462a6c9f475ade597a1384dfdf1c
SHA256d7d8562a84ab549b8c2d1302ac4d114b1f820b672380abbe50746f4830537dcb
SHA5122cb018765d30ced87e9f18e86e7ea7fec68153ff0692ecce24d0364e7955e1408a89d64acec0173d035f0621ebdc28e0209136dd05b39ab1d7eb025ea3ac88a4
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\root\ui-strings.js
Filesize4KB
MD584ac6033350a0b456ccfd2873533530f
SHA1ac9e299c631be0d183119ae8533c8bcacf804849
SHA2567a5ffa455017104e7f18c47ecf00f6876d5a430fc5d8fdd94e7c5c4cb6d6afb8
SHA512d2d82c45eebc1a56522aebfbeaed8c796535afd32ef9a501c34c4861c09568b2d7df76bb841037c991b757dc85a53f246bbc2598ea13de46b40ba10d9f1a1341
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fr-ma\ui-strings.js
Filesize2KB
MD5c985a12ba7718388578780d95aec2ba5
SHA1720e0569cdb3853ac421dd5d6297b039fb824bfa
SHA256fe7751f26e85232d3568546713772a7094b74c56896f37ff0e38febb1028a647
SHA512372e307f89f6b6011c81293e3dba87b9ee54efa4264e2e482a3cfbb72dfec5220185d8f3ce3a717df71b16ea805868747ba1dceb276a3bf26ba1ab55f820f936
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\root\ui-strings.js
Filesize2KB
MD58c10350a899bc9c5067dbbe3f6f69761
SHA172035895b534a002385b7074a7b1f7293ac238ab
SHA2566745c72a2c0e1bd51a61fa5467277e49c7bf7cf39743f8a9d348bba8cc05396c
SHA51231f6d503261b7a12ed2ef06f61ccb984b94807085dd6b05a6eeeef766da002b3d6253feb34ec378b64c20541c81c92f3605e10e3a81096f9aaeb10cb49b103ed
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\en-il\ui-strings.js.hazard7
Filesize10KB
MD584c78deb53e8d153927d2ea4e6f77e06
SHA16b8f90b118698ee9aa873f95d3f956469b235c0e
SHA256af2007b55d929c23d3f7f6cfc2bea9731b9eeade25134ca5934e33c6356ca963
SHA512b3628db936a6d0b21a362d578a95316b730574f1b3ef9955ac5c67fa7e91060f297ab0a86c5415c78493094dd40f6f704112c8574e76f0f649c3d2ee4d55c625
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\fr-ma\ui-strings.js
Filesize2KB
MD57814677569d5ab17a130890d700cca21
SHA19d017d144443a598ea89bcb7ab8007f899b839e3
SHA25668e4cdcc2b04c5f289a05f97523ee97eae3a508e0d4ac2ea8b6bfaea6f1ab796
SHA512b7eb0b5985e0826a7a3ccea2f15aa8afac59a85d8e1ce5cd8c5d735cab2608d514ab98adc8334631d5182f52997098de57f960821729996368a1c6c96d926513
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\example_icons.png
Filesize2KB
MD557e462d501efa3e169c543e4dfee036a
SHA1c10a71df53d10c63c37006bc2989107f630bfb72
SHA256ca65f0392545275db2bd7ad2604ca999af464c31f0566e252510181ba09df98e
SHA512f1238c718341e9604ab7774be4651c48b9076dd20b0a94611dff67da34dc4e664965b71e38af1887b71c4623627f78df7a9ff8329336ce33e4b9e96424df32f8
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\example_icons2x.png
Filesize2KB
MD5b53146f0ee938751bb4188787da88867
SHA116d5da03160dcf06d35b65c8364c63db9c035576
SHA2560c9a84070c8c0051b983fa479ba8d809332853462a9d3136217dba376604d190
SHA512b9b1f0224f794ca663f907a2df9f97f1aa955d0884bb1105ddd91f65899660667858ef9c92c1894e1dfef9c425f6211d4a82f009176c510256c1166fa399a5b4
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\fr-ma\ui-strings.js
Filesize2KB
MD595f2f9479e7fc4556d60cf11a6a9e542
SHA1565a2f017987b94abc6408d6b18ff127dda8216b
SHA256266ce60eaaef59489e64b1cb4344111320cf0c99c5935a4d27869be7c9b074c9
SHA512ccfd67c8d8155c5b16dab66fd9e912ae0e147acd3d160a50b28e834c8e972d77ee19a5b2ff79a137a603f9bd57ca6391ed4637a1122bd3c2de836e1da10efc5f
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\root\ui-strings.js
Filesize2KB
MD5d3e374fb7dd294b1e82b1fb4e06b9746
SHA19be0bca399fdaac9eee190ebb3a327cbd40a5f1d
SHA256eee91c32e8ebfa708955a1e9a0f880add06982c5db50a89f1f1b2d4043ad8cf0
SHA512b4e918ccfa6f8f05a7a43c5f6c95caa8105aa81f128fe7b68f8014266ad7b9e9a56237f452cb9b3a5eecf606faa09559e3263014e99b08c1af78adf4f2dd50ee
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\icons.png
Filesize9KB
MD5b49e6a3665e8c34c157b62e627664e9a
SHA1f9e241319b2d4c26d9da28d6fe6fefec971aeaff
SHA256653bcebdea10d2af495eea11abf9cd765cf88286e9e8680c4b3b49a7387b6384
SHA5127f1ed63708ebd522a4375eb55a3043e433ccfcaa14c58963b2ac757b8f5871aee11fad32143f83284d997a1a2b60bf2f602f0bf867ed33f8aff046e5425ae7ec
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\icons_ie8.gif
Filesize9KB
MD5ad4c89ee206da0e5b6a18ffb765c9948
SHA16e327fa612af5a5f615ae001e974fb3b01b3a6f1
SHA256fcdc687297b7ff17d027d63f7f9043970c0deb56f84dd586a338fa435b5e60fd
SHA5127241ce0d2c7e22638c465c5729c9ef954f5497112082bdb84890e3934c69ff7b5de44ca8551696eb3a4281bf8035d2120e44ce4a9a3ca085273608f1d3e30ce0
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\icons_retina.png
Filesize16KB
MD54039993e95d822db44b21b9e691f37ff
SHA1221e6c49d634c6dc461fab63770fc48f7fb553d9
SHA256666b0b0d38b64efe96e24272d56bd85991eef29248147fde6d6e4e8f05dc917d
SHA512a48e5d6a59c1eef1479a1f66e22ccc655ee6f5ba2c4613c3be417fb882ad2ef4253eb17680030d1303508c99b25028118889696fd225fd961551f075fcba729d
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\new_icons.png
Filesize9KB
MD5280e5b072faf2c6f7bbfdae09595ddef
SHA17f337da7bdb75413ce2c251b5ed65dd4643f6fa2
SHA256cfdb327bf5fbafbe8a2dfe3a6bfa643a531d7f81de1a98c8654fa1cb5d54f1bb
SHA5122de8f63b077ef78d358227ff9059b18fdacfd2b7e3ebc931a21bfd33a04e4164f49bdb6e538add22931b51f67af7277a7cd73531a6636bb2f2e39cf54f37fbe0
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\new_icons_retina.png
Filesize18KB
MD51b70332e9703a0ca5fe8c1a3f3eb8084
SHA1f9519cb1093c3607c947d397f42933da2a44a1f3
SHA256ed37c109ce21c980e7472187cc5375af7cdeed58666b73323d8a0dcd80e2e2f4
SHA51258504cc621b63893f5e6d973c815e0f4e81398605230422392ff5f21d255513b9240b46423c75a977fd2379732798012880acd4f8a0c2c4d4f5d4390204e8cc2
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\root\ui-strings.js
Filesize2KB
MD5c08c1fb924cece3a418b6c1ddbb55eb1
SHA1c9091b8de4017f1927a1ae87e79067bd9eadc24c
SHA256e1de95227ed9f6a72b1ffc94a4ae7511ffa8e89830d4c60f8802885315fd383a
SHA51239f054f83b4ec48d8ca78a3da6fa44bf5f60adb7cc288e7c7bf269fc63de2114af2e7a821c924c7ffd184cf97460f308fbead7f4aa6eece8d6a9b0f44ea304ae
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\sl-sl\ui-strings.js
Filesize2KB
MD567b0698bb7fa633f762344304428c547
SHA1a569545e3ad3a6ae398cf05d01c6e566a5d6b36d
SHA2567cdda70e44c1e1eff81006b23f0e040ffc5134a9cc2d9dbebdad0af3c59bb42a
SHA512be4673cdf69c8c42faba3bb9c01d156fbdb2660045111cffdaad5746b3384be566bac723a499edf2a42f8af1a54c5ea71a4d0d6b69dfdf5ffb90175ddae489cf
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\css\main.css
Filesize2KB
MD588bbca78e58937b857b7421d4ef91f53
SHA121dba962aea283b1b4b0d285284b1f9183616c74
SHA256f09d117b73f8806c26a035ab180b2be0aeeffc741f2a590c5655611f1d70bc71
SHA512ddcd6bf6197ee8f72c41e1b8f509dcecec40fc7cec3d26defcfd04795b3178a5506ad47118fe53799ad0e6a9120109848748965273df8db19f14f401f2fe37aa
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\bg_pattern_RHP.png
Filesize1KB
MD52d17e88fe43ed1d125bf6011308b6ecc
SHA1b835830667925576756ae05997e7a29a1cc054fc
SHA2565eeb40977de60ee807bdb083a09cb4f7dc27469c8ec58846f639a545e30edaad
SHA5125d7b4efa7680dbf1c182397d5da7d1098cf58786d55044ecc682c5591e298135bf693165d195f0d76a0acbb562a433c25af09974c90f935f9a0d6495a5f9a799
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\bg_patterns_header.png
Filesize2KB
MD568de32c70646646217ee40aae6cb7b40
SHA16479ff7a540ab15f70412d8533e4cf73f292e6ad
SHA2564124b5441f80ac0775abbc0625c5f8b80dcce0278a6e2bd3341e78b2a662e1d8
SHA512863aed777e29f461c2637ee140aa30aa5c42f34d3f232bccb98da1303efc7e2aab71bd91c999256f2556e8a1e08d7f6b53e7208a74cf2189d80e7c90445abdaa
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\illustrations.png
Filesize10KB
MD59ede3d46d2fad0c202dcde8636e57f27
SHA11aeb12d73ba8b46c3ccb3133f872a31de558b43d
SHA256a79dd44b39adc8decb4853d61149f41b721231bd3c6632de32636171b0f1bb16
SHA51251ff0877c6dfdcaac48203d0affabff6c5b8d33d513fec27a1cbbebda7d3ce883a04e73408b754e2bf35f5c90ef2d2b4cd86cf6d1874ef316c2fa9f607a9ee24
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\illustrations_retina.png
Filesize20KB
MD5aeac87a65708e78280b8ba29b7767a67
SHA151a2ad6dd8fc725e6ad2499ab6094016f4eb1e9c
SHA256a13be985052e0f4b57caec4e7439e20bff2b0d8e7421c422350a8f84c1e4b00a
SHA512d826054efb70bba42a26b75924f2b2f420496d76f39a304938d7fdd307f3af9ac274f27eec773607c5bd727bf5b73d32941602024e4673fcbe70c8e0f735ec94
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\root\ui-strings.js
Filesize2KB
MD5962b2abc9867728706662c71597f0dab
SHA115cff8abfb82034663284c6595c7809bd4db047e
SHA2566c753b2ab15c8145d7519d50ebf5da9b96d2bfce5725e0b05149e5871d9c37cb
SHA51240e9074c98b67159823dceb220e9a7730bbe17bb9cbd353940aca8185b40475cc89d4480549090eee272ee89cd1d3627bdf3384a96af85632c93f310ad44b211
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\root\ui-strings.js
Filesize2KB
MD59ade646f3a9d9996bd0b2d6a4d167d18
SHA1b04a690040f32f5e50c360df75b944497f453c9e
SHA256b37bb52ad4855f328421f949a87b7603e998d9b17f798128ed4f040b24cd6839
SHA5121f58f966677cdb2b23681e52c144903803bb6e190a1aeaf4af059484fe96b21ea72079eb6503574fff205eb0c9610d903bffa5be8d8ce90331295d13c4429602
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\root\ui-strings.js
Filesize6KB
MD5779fa452d8b49887f5505440452879b0
SHA100da65496a008a494268872a72bf282ce06334dd
SHA256a4606084abd61aaa45239c6213f337e49c1deab8d1d16fab6525bb911dd0202b
SHA5125055e6fcebee054f841b8d261458c727a2c39a132000657679d428c7d0048aa25daae9d7a2e7be7066ae75b04bc377d5c93f3890c651c6e5a3ad7a6fa8633f8f
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\PlayStore_icon.svg
Filesize6KB
MD5b3850c12fff39171be0243df07eae922
SHA1a0927bd2354205df7813d5f650909bb92908ea61
SHA25690cc982cbc9fc4f9cd800508bf49cff3b736b12f24cb7d8d371c439b45d4d158
SHA512a00954500463b627c423918735934dd489db179a9edc97e17dd15d1033146a679c1ab201652726eaa0403f8676993971bdf95e1f357e5a1e720f9514374ed2b5
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\en-gb\ui-strings.js
Filesize2KB
MD5c083758db93737c59fb8ed5398f3a4f1
SHA1decf63f624274da333a1d5a7e372b3c1f96f0de6
SHA256b8e034ba064ea20ccca76eeeb51089daefcbadb65e78caef5180b4919febc73c
SHA512492e023ddeebe6bf81a6b97ba18361344a057e34ac5069c2575042045a687a0f4ae8d74ff00028cad4cbd087b87c0067663283c043c31901faf68c482ad85ab8
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\root\ui-strings.js
Filesize14KB
MD5b995ba0a277a8836a6ead159ab57f1fb
SHA1664f8ac2ff28ce8f8da2bcfe54c97f6aeb854bb8
SHA256789c9fbb8b3f48f1ccab0161929bb13bc20eb0c0f38e08806ccdfc86ae77f39a
SHA512fc58f8eb2db6cd480001b7e643415f556cad631507048b3477c260459140f84c1deda329eb2c2e9590ad1d74311969e0cbcfaee6534bbe54e3a8c048faabf7c2
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\root\ui-strings.js
Filesize15KB
MD54eb0253d1f424bfcd16e796cd4ed6871
SHA1b56d86a7164124a2abdd0ab3a6e9bf3388b78817
SHA2566b39d4e2448f606ff9c901277cffbe31cda3e0c621259cdbcb301fce04923f66
SHA512110065edfba0e6fc0feebfeb5b7f8871db9f353b6897c9f2639007a1a07b97f0357f24202ffbb6a75d550c713a5f8fb77a783f90b56119e5e05e32f789dbf9b3
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\root\ui-strings.js
Filesize2KB
MD579ed88cba2a0a846cbbddce634bb7cf9
SHA1e4c1b1aecbec592ef7ba3f6433e7def628594f78
SHA2565102bd6e71d97893687a3192710adf48c61bbd1345a3bea6f3583f4d21270854
SHA512e35e513b3bfc8269201bc1cb10824d251f0ccf5a160b208450fe5ebecf414eb0f334af16b583245a1f92cd2aecc00eae7745ab007fb9e3465d79ba2c7da6cedc
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\he-il\ui-strings.js
Filesize2KB
MD53f126cd1b6eb7dcc840f24e575f31f29
SHA1d11e2abc062f418b258fd086f722a9ab369e8f10
SHA256ced824d266317d7b390d200d2d04ee1264fd158dfa448570ae03b65177a64d17
SHA512d677a47cc84e9a4bae64bab9920f621574aa8918854e6e6b630a5aade58422bc91d47e3361f0ed07a8bea739734821f6b9098ee1f22a216aaaff52c1af829bf7
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\nb-no\ui-strings.js
Filesize2KB
MD5d638f07d96eec9b2833647ba6dedbd83
SHA11b70df81ccf9a14685c210d249c92fc42342d893
SHA256f880e699972914b6c64610d1f000398c5611076a4c55869d01d3b191129e7dd0
SHA512be55c15e65a6d2ff9ece778788601d927f39dd26cdcc58a3eee8a73991ffa6939fe8f44d0f08d8476a7caa0b5c164e55117c03e9f5ae1d23f38ac2704d9111a5
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\root\ui-strings.js
Filesize2KB
MD5bd435a8fa8f534523a320f88f15a403f
SHA1adcf8f735ee31757838b587aa9a29966ba51dd35
SHA2561512062f34499e1da583e043371bd2eda76c3920aa7462e021692c28bcb4a21c
SHA512af8738de8162e67e50b91a92843e738a30def0dcd10c87221d95876fa4e5788b8c6c2c39cbcce1c39b3704a3e923defd17aee1f3b1a0c198b7c2b1037516b5b4
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\root\ui-strings.js
Filesize2KB
MD52e0b2a218b47623d634448883a21f1c6
SHA1e826ed65eb90db973eba18014a6408223eafa94d
SHA256f29ab91ca335c046a83758834100a81256ca14d55bfedc425d6474a4190ba1d7
SHA5128f408dbf243baee5bace4592d3e1eaabab2352f06576aca4fcd1af6df50dec05e1d0bc70219596ac3394cea89641137f27acfaf7f0f930ad1ff32af82c41271d
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\root\ui-strings.js
Filesize15KB
MD5c9879b9b1415f5784f4d16bd6a68f6b3
SHA19c8a45a142a74163a3a502daba877da04c1602d8
SHA256cd2456b48ca36c066fccda8bc8a8b74accc21c8cdbc44789285bff8c2043bf1c
SHA5121bbb5e409d6f2d48e0d12c2acd12bd0930e8090238a4cae48b1d085673626f2d7ae258bf9981bdb80cab67a6b392b986a92e6c35d0b110044671174a321cdec9
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\en-gb\ui-strings.js
Filesize2KB
MD513b3bef13d7d9aaca751ed0636ad10a0
SHA1b365a128a307cdddb2f17665d7aa577e0de0f370
SHA2565a371c7a237f5f580a8b64b1b18df5a3450444c1765d88d8b39821220e6694f7
SHA512ed5d5ec762b8b527ccefd7ef31b4c06d8604963f058d59ee123bb3e14549ea4b4ba93f19e06a38d126b8d09d12aa7e6267f3ba3b82aa1ecd329c607077948fd2
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\root\ui-strings.js
Filesize15KB
MD5a8974f1a622d67bca5f71a92fe314c8b
SHA18991f51b60942b51ce9e0bfd8a1783adf9fa5b36
SHA25684beda13f2ba4c2fb90df98f6d53df2d6aa782fc108716d4a48dbabb77dac043
SHA512b0e8c4cfb21a2538d2a9b26626e6e092f51884f0249fbf0e96468426d8547b48df69861b2567c6b5b2581606021d1d7d1dba7aaabd959adcc9520eac544509a1
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\es-es\ui-strings.js
Filesize2KB
MD590518ac563ccd6e61bd53d3966a3202a
SHA127c4287b972b41b2c0af9eaa41924cca7ac9273c
SHA25660635b21b62db4a7af5763d67fe135577992e9e0c067c2fca930a9fc73c589c0
SHA5122cfb8c1415eee1bd9a549e20f91829c0c21e6fd715e06f0eb3dbed18fa564f2249cb3e75011ea94f155fa900140b68c82f641f6b781e60a12f041403e1e8a9ed
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\en-il\ui-strings.js
Filesize19KB
MD5982d75f025aa22ace8b9d1663015f052
SHA11e703040dfb93d0cf7346bfde79f20ea19642bd8
SHA2564c83631748b8b7257a9ca8f691feb2cb03f44b92a2918df5dfce2a7a5bc9b3cd
SHA51291e5efbb0888dd3ca1b71404cd858e535f7b6138222d6a38a274442613bd9474a71a25ee294458c216f0c2505728318dacfa1b73d9a4245ffbd76998d64983b5
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\he-il\ui-strings.js
Filesize2KB
MD571efcf06d8de5c8aa91db7a07468ca08
SHA1dc3a456b9a5e33ec1ff5e40e9fbb75c81fc33c02
SHA256ba47196b39d214b28f80f4c3862272dc74fbda659f25a4a56ef5167752aad0c8
SHA512e4cbe1f13a2ef23f188bc1bdde03ee9ab42cfe9e5aa9b686638cfc3cfc46778d6bb0b24608fc0cd34e45ab836a1edf7d8af1af3f2ae928b9692a9dcad8e43505
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\root\ui-strings.js
Filesize3KB
MD57dda631d3cdcb6b8e49a2233b6ca3b02
SHA16368e81a2fc71b0947a79cdf04af9a4da64a6af0
SHA25624ed370908145ae79b20716e6850d875c3c47fee40f9447711732a436e2bf148
SHA512f9787eaab682a7ed8dec89be2304fd0c6273f3db1140d7e60b193b83ecfaa6c0b9ca39f18a7e6223e70a5478d8d1a07600642e371e322f399b8512acf778bf18
-
C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB.txt.hazard7
Filesize34KB
MD5e451b190e4432374637ab50ff86dff43
SHA1832e6595c49d24f812a20329a016139b6c6c36d7
SHA256606abf1905d3d38fa916e223e8da598ca456328c4071bf8ec68a268adf2c74ba
SHA5122d24275a2ad113b6786a6871002b79f5a8eee31b6b673e4841ab9d700054d144835ef2def01474d5f56f45a16fd1d01ce8e2651c276694f5a0ab5ee85215c923
-
C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\identity_proxy\win11\identity_helper.Sparse.Stable.msix
Filesize58KB
MD595ebed1cb938076a2d868bec9d0eac3c
SHA1b10ca526a7080d35357b93bd62985ddd0c870b28
SHA25605c05064673af5fe921386a695128fd315988c6f6aa4cfd66b73487c8def4912
SHA5122ae31b21f036b287e5ffd253d323a60e79545c0d10516f20c486ff9a92500edd91f78811fdc93bd96bdd8ce5cc3fa7dd0865614b3b2d36c5bcfca974f7329435
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\identity_proxy\win11\identity_helper.Sparse.Internal.msix.DATA
Filesize58KB
MD5b007df8f1ec362dd146464ad2ec98e39
SHA14d3c36f211a97663f0354e0ec567a1df089e0e3e
SHA2564af3849576531ee9605e1a42d172b893c12f74a1673da7095324a95661171c1b
SHA5123f85315adde618cb3302d699554805225fd2f789621d17dced18b18af39c1073bafe86540239de77f76b49b8515bdc7553a4e5cedc3f0f6fe4ee1dd633b19626
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Trust Protection Lists\Mu\Entities.hazard7
Filesize70KB
MD5a1512e8a676fba1782db3af3c1854499
SHA14fccbce4c5462cae0e72c1f5c34f8bfbc367265d
SHA256d6e6e78e683c80ab7f25c55dae019e0984e9a46ccba783c204353960caed2ecf
SHA512f4cb2fa1ee075945f80fadb6110710126d23365bf8961329a11505b7ad24fe94d59adfaf50b2fad10b367211b910056740d65b3d6b9ac0df2196351102ef79e4
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\Trust Protection Lists\Mu\LICENSE.hazard7
Filesize35KB
MD52c3f4051829f90343be5ec63b5675cca
SHA14ff51eec92f3ea4530e86f13aa11eb2c84b3794c
SHA25659d6298bdbcad022ccc3e7bdfc2a5bcf4248173d8a90488ab03e3039ec557211
SHA512e468c85958a71fdc1f906b053bee31f0c1a93f563e453d17c18805b4c5cbdd5b01d791f6a1ffe0f48073cf673328f441ffa934ffe25718f9c07e909f5ec2271a
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\identity_proxy\win11\identity_helper.Sparse.Internal.msix
Filesize58KB
MD53b5fe8b1c0642df093f89ca6bd6c466d
SHA114e8017d33a61ece99649b0b20a8890b45ab305e
SHA256309e986b9f00559cb998d475127551c9b89e7fba814bb2e551fecca27bdec518
SHA512b312c4d6e802f708965e170332ec2ba7b6f1820b4b26e63b20ffb9e0868332b333db5f643675a7ceec3419590e0351bd912fc43fe5e1851fd9587b3615162195
-
Filesize
1KB
MD5c3859067495f1c34ac8424a6d2e6fbfc
SHA162bded3234b6001903a3a06a68446bed71930f60
SHA256176a68214422340188b1b393cb7aab67c6b07e7a6e128a03c4a2806887a1b360
SHA5122287b0b27dcc8c70650a705b4f8215d1572861ff63cfd39745ee719bccbb9d090f689ddb9a6dd3c6964b73bf26ab8bf4a0799f9a7014ec8311ea1bc5136adb15
-
Filesize
1.1MB
MD5bc1747678868112e0fb57342a513e475
SHA16a761b19b29ab42b32e385faa51347fc3ec5054d
SHA256d07e6c531c2f12ba584a9c1c13cc2aee836eb3be83628a9be4ea399be817b124
SHA5125888eb8d33f65bfa321cee9309c1bd861e6b4e7502ce47257b7c1cf289b8a16cb6422ab07e7696ab676f4064d5a92e5622cbc42218bb9dfdbf6eebb3f58920be
-
C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\Locales\sr-Cyrl-BA.pak.DATA
Filesize1.6MB
MD58b7567d808cd19bbd91497ad0973d04c
SHA1823ae1cb1ddb6cd7eab21322fe82d8d8d03eff89
SHA2565f921ddfb9d11011eea361fff3dbb4fc034c85b2062f2009f7eb85ead2962bcf
SHA512d82145c58c247ee6a4ed4eca740f5d0037348d765c7cc955419fae9b2fea907fa8b1281bd7307c0384ca5624b1d26b4b8288b2f1431c2cf4dfcc1d7108bdf82f
-
C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\Locales\sr-Latn-RS.pak.DATA
Filesize1.0MB
MD57d5c006a1851db09bb4f828163e843c3
SHA19431f90d9e31c8bec7c090786c38e443f0893654
SHA256d9da2deba191378de2780c8c36af962df2b600f29e25b7c942f8fe28845be9a4
SHA512e948282ec1288559d1a5fa3cc880ac1fe750318a2bc5c59ee557d423b75a7891abc933828a2c02922921b08a9ffab0af7e29ab4c1d63a1ad3c5f6a1ff93b8b8d
-
Filesize
2.5MB
MD5a1629f53bbcd1965dfec9524699dd56f
SHA13f3bef48b6a831a7086740574ba3e97f72587361
SHA256d8c1499bd19ca80432b6978c44314d49741e90cad4e160d906cf100684bf1196
SHA5125029ff3fb24fbe063cba6695b984d226597b505ec6fdfb87a678b8d8932fe1ae22136b7fba4f042a39fabb5e6c16650743f2970e25b6790194a3e08bbc9127f4
-
C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\identity_proxy\win11\identity_helper.Sparse.Internal.msix.DATA
Filesize58KB
MD581d871ce7f01a77d9c4f59111aac2093
SHA1a9010d94a5c4a1eaac83c24445fc62fa0839ccdd
SHA256ba10799c24f951e40ac4134164e2fb1f9ba8192523c8548d205b30a1dbd7d10d
SHA512ee6e5c878da6c01eddb6399f424d44eb185f57dce8d537fa17ac9ef1ef02a86ad059fad0c25b2811118ef57f0dd15e98bb3c7535bd4660d6b2a7a61032f4b2dc
-
C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_proxy\win10\identity_helper.Sparse.Internal.msix
Filesize58KB
MD5efe94fa15454abaeb8dc9015f4650ac3
SHA12391ef3e90aca97c37d572e9463dea80bc31327f
SHA2566336e56f5c904333391ead86daad09000bfb6b77448b5a3edded0ac0e3096390
SHA5126d29e4b175906b876e1f4812c522ee997bf4586ae6d57db792deeca88769ec29bc48ecd695dc0096622904edfb1de480643f67e291be261b05304ab96917e896
-
Filesize
1KB
MD5957278becb3cc93482795fd89e26a4f0
SHA18e3552d0aa925db55caa8d2fa4e399491749c8bc
SHA2568dfca81a2315a95b804a852411a2397c464f5394580a0fa3921c873080b61782
SHA512946565e6a070c3844830fca52094cbefabc96e05cd85ec6a7c5819695fba944eb67fe2c39dc9f9359995b021bd80b393d2b3e062d447543d9139539490f13915
-
Filesize
1KB
MD584b5c7270c2c8c754d1ff87c9063f6ff
SHA13492f616ee6064d2607b0eeac80fd77c79f96080
SHA25628e0c51c774ad7d32d06aa0aef74dcf5090bd6cddf0298cd47256fde75cc61b1
SHA5125c786a1a225e8f58d7d03c1f656ed5e39bd43e850dd52f07e0db8a77dffa21854533698a8f8d64005b9c006d0f39902a8c42010cf51e235e60a3f4124d94b3fd
-
Filesize
1KB
MD56d37371a3d4c346c41d963e13f77ce53
SHA11d0e07f5dd6379dc8e71332cda7da2b43a4e34f9
SHA256c5f33f6feac401f6d8a9376bfd50c7a48dbba7cd99b49f6715a24d9765d61376
SHA51254cda4dd158d3b8050db6f8d77c537144dec4a3b4b33c28fb30a13e5809b175d2b70025e43857768e4f83cd8df27062a425acb7b0cd30745c0e811a553649fef
-
Filesize
1KB
MD522e51af394ccd303aceffb319d4603a7
SHA12aed7136b5c8e00ca77c53b10224e6e8e590a5e7
SHA25697009662066e26a0dc5e413ffb532cd3a6c07bc49ff764097fca5cc34f7f58fe
SHA5120427883d0f053840f9f0f857896c4614d14a7acfe75fcae37ba2d37d6d559a2fa5f9f996524e01b8afb00326ff476bb468316b787f05d45b897aa620e0bdfa1b
-
C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe.config
Filesize1KB
MD50196deb6d36d9591855c82c57559afb1
SHA10bb6eb12bfa358ed12e070139ecb1ceb6231bd53
SHA2569642702df3685d98bdd419f6d67baf7cea50bc3807b69fa2883616e5d81f5edc
SHA512212cf4183dd3ad983b2d37b89ae5a260e45fa1318cd8fa6ebdcbaf65503ae550003a2f4008e1bdc84e0c869c07fc91a030abf42d4d0cb2a1fab98432faf60486
-
Filesize
246KB
MD5ccedc42153db3177cac95f4a81a40e43
SHA1cd9a88bd2edb1853fa8fc08367ab71912a1ce915
SHA2561ae66d816eefc8137fba8c5825f8df735221e76aa0c7ba6a64a6df4b5fc53ff4
SHA51287acaacf804ff675e9f6788126ba97abd776f44109adde76904762a82af462c58072a5a4e7b1a43d6cae9d1dc7df98d6665ea6da75812a451809eed56a3b284f
-
Filesize
1KB
MD55e1662e9647763562e627c69a817c6db
SHA14dd7d5dbbb60ebf5c578a17d99cf743402685532
SHA256513be1bf6b083a729bace36a76bb3dc9df2e913d9d8d01284d37893cf867b0b6
SHA512928e0a5918204605b743b351a102d36d9bd03751447e102a0d4538f8fc70645ace32da95fc3810297c2b534d56b05f1916f37ca4f7043cceb86442b077688323
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\osmia64.msi
Filesize2.2MB
MD55009183b1047c7eb26fa64b649e26354
SHA1198eb518be253932fbe77fb150e362bfe2011656
SHA256f37cdf35943e0ce0ad57b67269ad328bad847e1da184d4791aaca5dfec44a467
SHA5128f05bc0a5e591d6df76fd6817c069f9ffec288c2beca34928f71005c0f01caf6c921c0da49d6db82b51d2ebc0e946a8a9a43b88de3e4b86350fe21872edfbd9b
-
Filesize
666KB
MD5cf283d30b9540d549d953c69ae2d66dc
SHA18e44752b56f00cb013e710e18923c788a7e4ccba
SHA256f1d3076725ccaf8d75834455c3fe80c674dc919146a79dbe4bf4c5b19b49080b
SHA5128fcf2791424004316680dc9a7a4a5e01cacfe6db8af5d129a729a9bb630ad4bbf5e5824798689c8cf20a4df31b9d7b5cf0e4428b8ce603a2c607b25b994029f9
-
Filesize
1.0MB
MD50f67fc1d82967921d6c25e3e282c4b2a
SHA12f1681eebc42fbc80c543cf53d49e7e706c766f1
SHA25646bea36d90bcb313f498ef1978a47b0832b82063d76ba1e12f1b9bdb5b7da399
SHA51283fb749b82dd87cd07671e6fa55d7d14e4b5eb3e4be5a822ada43bba9a61542f16f310a2ca79fb758bbb9d484d01dfa9ca9d27ca16fe1238d83778b4bc82a1e9
-
C:\ProgramData\Microsoft\Windows\Caches\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db.hazard7
Filesize624KB
MD502cc40bdfd95b768231a6d951c625ace
SHA1c68450c52315a87e11f657830dbfdf86f7c52e3a
SHA2567b46ff6335f8c2782a7e1ae02009398ca405b256151c4b5725acab15195cfa6d
SHA5122a901962683377de0a9d3c50e7e131549caf17be9f56e34d078ba2df2a8ca98936f86b38fc6417a29dc9d787723872bfd510685a0fc0ba0ba553a7f164e2c579
-
C:\ProgramData\Package Cache\{662A0088-6FCD-45DD-9EA7-68674058AED5}v14.30.30704\packages\vcRuntimeMinimum_amd64\vc_runtimeMinimum_x64.msi.hazard7
Filesize181KB
MD59abde94dec5e3104f03f50960172604a
SHA1c14049186e6214b04920c613f40446f745868f3f
SHA256490d2a0d55b8e8f73ed6a568e10fbe7a8cd3b2cfe51b1c3c4b0625b355c3127f
SHA512885993e762727e801464f534c24de7e9ae693ee3a21b11967456009c23d009377bae51769607c4d102f117237a39478996ae9b084183504c9ad0de1342c283aa
-
C:\ProgramData\Package Cache\{C7141A99-592B-4226-A4E9-B767C1D0FBAF}v48.100.4028\dotnet-host-6.0.25-win-x64.msi
Filesize737KB
MD5a8948465d13f143b02214150f891b98d
SHA1e88f74e51466bebdac1ad6ad87cb37b5aa4e72b2
SHA256ac328b0f278609b843771b7fe36b58c37bd6d0e9ad57de368ea64aad9ec943bf
SHA512dff05400ee892b85bad5fa5eb4e6d0f7fe967a6c448bccc38f37eda1b6d4ccc48acd8170d636b4cd6a44f7309c993636e9b9ec6d63e5029bba3939c500f592ae
-
Filesize
5KB
MD5dd8b07a3cf88282e7c7a93666a7bd96b
SHA1b82a5d0b2446ac0169aefc2e99651039cb97a5ee
SHA2566a3bda68b0db4cfe4a42e9d3e845a705285c90331bccb13510ff157f8cb6368d
SHA51284eedc66c598734b7d718e781b24f88ca1cc95da243b70c0ceff60a1484cfdd8ca220719f38f88172125f3d9177ab2c61f583fd269bd1bad20feb2ee9a889026