Analysis
-
max time kernel
151s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
27-02-2024 17:46
Behavioral task
behavioral1
Sample
846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe
Resource
win10v2004-20240226-en
General
-
Target
846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe
-
Size
333KB
-
MD5
0fc26e931a324948a7d5e5a0008bf3c7
-
SHA1
aa6018a65a0ae90d33451dd8f4fc647179ee93e1
-
SHA256
846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378
-
SHA512
95dd8fd0973ac6166fda194b90e84f57d637ca3e1954733b19446abcd13ee89c09388bddf626cf9ee4aace8d1097e244865c50738accee3adcf03b3321c6d5d3
-
SSDEEP
6144:gq9ezqsEC8dS7CCKUf+9xwL1ZTcDCzyrxQX3hVds+tfCOu3miq/8g7iXq:g4JsE3CKUf+9xwL15cDCzie1ChRnXq
Malware Config
Extracted
\Device\HarddiskVolume1\Boot\bg-BG\how_to_back.html
Signatures
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
description pid Process procid_target PID 5068 created 3240 5068 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe 27 -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
pid Process 3456 bcdedit.exe 3224 bcdedit.exe -
Renames multiple (6995) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
pid Process 3540 wbadmin.exe -
pid Process 2196 wbadmin.exe -
Modifies Installed Components in the registry 2 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Enumerates connected drives 3 TTPs 26 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\L: 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe File opened (read-only) \??\Y: 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe File opened (read-only) \??\R: 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe File opened (read-only) \??\W: 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe File opened (read-only) \??\F: 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe File opened (read-only) \??\A: 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe File opened (read-only) \??\E: 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe File opened (read-only) \??\K: 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe File opened (read-only) \??\M: 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe File opened (read-only) \??\N: 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe File opened (read-only) \??\Z: 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe File opened (read-only) \??\A: cipher.exe File opened (read-only) \??\G: 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe File opened (read-only) \??\H: 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe File opened (read-only) \??\O: 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe File opened (read-only) \??\P: 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe File opened (read-only) \??\T: 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe File opened (read-only) \??\V: 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe File opened (read-only) \??\X: 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe File opened (read-only) \??\B: 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe File opened (read-only) \??\J: 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe File opened (read-only) \??\Q: 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe File opened (read-only) \??\F: cipher.exe File opened (read-only) \??\I: 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe File opened (read-only) \??\U: 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe File opened (read-only) \??\S: 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Videos\Help\how_to_back.html 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\ExchangeLargeTile.scale-400.png 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\InsiderHubStoreLogo.scale-125.png 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\plugins\rhp\how_to_back.html 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\hr-hr\how_to_back.html 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\en-us\how_to_back.html 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\ca-es\ui-strings.js 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\s_close_h.png 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_2019.19071.12548.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\PhotosMedTile.contrast-black_scale-125.png 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteMediumTile.scale-150.png 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AlarmsSplashScreen.contrast-white_scale-100.png 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\AppIcon.targetsize-64_altform-unplated_contrast-white.png 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\Icons\icon_play_nor.png 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\css\main-selector.css 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp3-ul-phn.xrm-ms 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\personaspybridge.js 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\how_to_back.html 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\AppxSignature.p7x 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\sk-sk\ui-strings.js 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteSectionGroupSmallTile.scale-200.png 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\Standard.targetsize-64_contrast-white.png 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\bg3_thumb.png 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\it-it\ui-strings.js 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.contrast-black_targetsize-96.png 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\LTR\contrast-white\SmallTile.scale-200.png 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\new_icons.png 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\Locales\fil.pak.DATA 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\OneNoteVL_MAK-ul-oob.xrm-ms 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\RTL\contrast-black\WideTile.scale-125.png 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-60_altform-unplated_contrast-black.png 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Viewpoints\Dark\IsoRight.png 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Microsoft.People.NativeComponents.winmd 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\ScreenSketchSquare150x150Logo.scale-100_contrast-white.png 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\css\main.css 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\check-mark-2x.png 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClientIsv.man 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Grace-ppd.xrm-ms 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\how_to_back.html 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Collections\contrast-white\LargeTile.scale-125_contrast-white.png 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\find-text.png 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe File opened for modification C:\Program Files\Windows Defender\de-DE\OfflineScannerShell.exe.mui 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\de-DE\View3d\3DViewerProductDescription-universal.xml 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailBadge.scale-200.png 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Microsoft.Membership.MeControl\Assets\Fonts\how_to_back.html 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD_COL.HXC 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Fonts\private\WINGDNG3.TTF 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe File created C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\how_to_back.html 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTrial-ppd.xrm-ms 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-20_altform-unplated_contrast-white.png 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\pt-br\ui-strings.js 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxManifest.xml 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\AppxBlockMap.xml 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\UIThemes\LightTheme.acrotheme 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\it-it\how_to_back.html 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-32_altform-unplated_contrast-white.png 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Microsoft.Xbox.SmartGlass.Controls\TextEntry.xaml 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\edge_feedback\camera_mf_trace.wprp.DATA 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\zh-tw\ui-strings.js 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\ro\msipc.dll.mui 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\RTL\contrast-black\WideTile.scale-100.png 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsSmallTile.scale-200.png 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\back-arrow-focus.svg 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-64_contrast-black.png 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe File opened for modification C:\Program Files\Java\jdk-1.8\lib\deployment.config 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.1.etl wbadmin.exe File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.3.etl wbadmin.exe File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.2.etl wbadmin.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 2584 vssadmin.exe -
Kills process with taskkill 14 IoCs
pid Process 2148 taskkill.exe 2276 taskkill.exe 492 taskkill.exe 2100 taskkill.exe 3544 taskkill.exe 4652 taskkill.exe 4532 taskkill.exe 3392 taskkill.exe 704 taskkill.exe 3152 taskkill.exe 2948 taskkill.exe 3256 taskkill.exe 440 taskkill.exe 5032 taskkill.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3808065738-1666277613-1125846146-1000\{097E8315-8C5E-4D4E-84CE-92DF234F4C32} explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ explorer.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5068 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe 5068 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe 5068 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe 5068 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe 5068 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe 5068 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe 5068 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe 5068 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe 5068 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe 5068 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe 5068 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe 5068 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe 5068 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe 5068 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe 5068 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe 5068 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe 5068 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe 5068 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe 5068 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe 5068 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe 5068 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe 5068 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe 5068 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe 5068 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe 5068 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe 5068 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe 5068 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe 5068 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe 5068 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe 5068 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe 5068 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe 5068 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe 5068 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe 5068 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe 5068 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe 5068 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe 5068 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe 5068 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe 5068 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe 5068 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe 5068 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe 5068 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe 5068 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe 5068 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe 5068 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe 5068 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe 5068 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe 5068 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe 5068 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe 5068 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe 5068 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe 5068 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe 5068 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe 5068 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe 5068 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe 5068 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe 5068 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe 5068 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe 5068 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe 5068 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe 5068 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe 5068 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe 5068 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe 5068 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe -
Suspicious use of AdjustPrivilegeToken 50 IoCs
description pid Process Token: SeDebugPrivilege 3544 taskkill.exe Token: SeDebugPrivilege 2948 taskkill.exe Token: SeDebugPrivilege 3256 taskkill.exe Token: SeDebugPrivilege 4532 taskkill.exe Token: SeDebugPrivilege 3392 taskkill.exe Token: SeDebugPrivilege 704 taskkill.exe Token: SeDebugPrivilege 3152 taskkill.exe Token: SeDebugPrivilege 4652 taskkill.exe Token: SeDebugPrivilege 2100 taskkill.exe Token: SeDebugPrivilege 440 taskkill.exe Token: SeDebugPrivilege 492 taskkill.exe Token: SeDebugPrivilege 5032 taskkill.exe Token: SeIncreaseQuotaPrivilege 3620 WMIC.exe Token: SeSecurityPrivilege 3620 WMIC.exe Token: SeTakeOwnershipPrivilege 3620 WMIC.exe Token: SeLoadDriverPrivilege 3620 WMIC.exe Token: SeSystemProfilePrivilege 3620 WMIC.exe Token: SeSystemtimePrivilege 3620 WMIC.exe Token: SeProfSingleProcessPrivilege 3620 WMIC.exe Token: SeIncBasePriorityPrivilege 3620 WMIC.exe Token: SeCreatePagefilePrivilege 3620 WMIC.exe Token: SeBackupPrivilege 3620 WMIC.exe Token: SeRestorePrivilege 3620 WMIC.exe Token: SeShutdownPrivilege 3620 WMIC.exe Token: SeDebugPrivilege 3620 WMIC.exe Token: SeSystemEnvironmentPrivilege 3620 WMIC.exe Token: SeRemoteShutdownPrivilege 3620 WMIC.exe Token: SeUndockPrivilege 3620 WMIC.exe Token: SeManageVolumePrivilege 3620 WMIC.exe Token: 33 3620 WMIC.exe Token: 34 3620 WMIC.exe Token: 35 3620 WMIC.exe Token: 36 3620 WMIC.exe Token: SeBackupPrivilege 116 vssvc.exe Token: SeRestorePrivilege 116 vssvc.exe Token: SeAuditPrivilege 116 vssvc.exe Token: SeShutdownPrivilege 1708 explorer.exe Token: SeCreatePagefilePrivilege 1708 explorer.exe Token: SeShutdownPrivilege 1708 explorer.exe Token: SeCreatePagefilePrivilege 1708 explorer.exe Token: SeShutdownPrivilege 1708 explorer.exe Token: SeCreatePagefilePrivilege 1708 explorer.exe Token: SeShutdownPrivilege 1708 explorer.exe Token: SeCreatePagefilePrivilege 1708 explorer.exe Token: SeShutdownPrivilege 1708 explorer.exe Token: SeCreatePagefilePrivilege 1708 explorer.exe Token: SeShutdownPrivilege 1708 explorer.exe Token: SeCreatePagefilePrivilege 1708 explorer.exe Token: SeShutdownPrivilege 1708 explorer.exe Token: SeCreatePagefilePrivilege 1708 explorer.exe -
Suspicious use of FindShellTrayWindow 6 IoCs
pid Process 1708 explorer.exe 1708 explorer.exe 1708 explorer.exe 1708 explorer.exe 1708 explorer.exe 1708 explorer.exe -
Suspicious use of SendNotifyMessage 8 IoCs
pid Process 1708 explorer.exe 1708 explorer.exe 1708 explorer.exe 1708 explorer.exe 1708 explorer.exe 1708 explorer.exe 1708 explorer.exe 1708 explorer.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5068 wrote to memory of 1892 5068 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe 95 PID 5068 wrote to memory of 1892 5068 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe 95 PID 5068 wrote to memory of 1892 5068 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe 95 PID 1892 wrote to memory of 2216 1892 cmd.exe 97 PID 1892 wrote to memory of 2216 1892 cmd.exe 97 PID 5068 wrote to memory of 4304 5068 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe 98 PID 5068 wrote to memory of 4304 5068 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe 98 PID 5068 wrote to memory of 4304 5068 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe 98 PID 4304 wrote to memory of 1392 4304 cmd.exe 100 PID 4304 wrote to memory of 1392 4304 cmd.exe 100 PID 1392 wrote to memory of 3544 1392 cmd.exe 101 PID 1392 wrote to memory of 3544 1392 cmd.exe 101 PID 5068 wrote to memory of 3444 5068 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe 103 PID 5068 wrote to memory of 3444 5068 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe 103 PID 5068 wrote to memory of 3444 5068 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe 103 PID 3444 wrote to memory of 3260 3444 cmd.exe 105 PID 3444 wrote to memory of 3260 3444 cmd.exe 105 PID 3260 wrote to memory of 2276 3260 cmd.exe 106 PID 3260 wrote to memory of 2276 3260 cmd.exe 106 PID 5068 wrote to memory of 3196 5068 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe 107 PID 5068 wrote to memory of 3196 5068 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe 107 PID 5068 wrote to memory of 3196 5068 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe 107 PID 3196 wrote to memory of 4080 3196 cmd.exe 109 PID 3196 wrote to memory of 4080 3196 cmd.exe 109 PID 4080 wrote to memory of 2948 4080 cmd.exe 110 PID 4080 wrote to memory of 2948 4080 cmd.exe 110 PID 5068 wrote to memory of 4440 5068 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe 111 PID 5068 wrote to memory of 4440 5068 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe 111 PID 5068 wrote to memory of 4440 5068 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe 111 PID 4440 wrote to memory of 492 4440 cmd.exe 113 PID 4440 wrote to memory of 492 4440 cmd.exe 113 PID 492 wrote to memory of 3256 492 cmd.exe 114 PID 492 wrote to memory of 3256 492 cmd.exe 114 PID 5068 wrote to memory of 1528 5068 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe 115 PID 5068 wrote to memory of 1528 5068 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe 115 PID 5068 wrote to memory of 1528 5068 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe 115 PID 1528 wrote to memory of 4968 1528 cmd.exe 117 PID 1528 wrote to memory of 4968 1528 cmd.exe 117 PID 4968 wrote to memory of 4532 4968 cmd.exe 118 PID 4968 wrote to memory of 4532 4968 cmd.exe 118 PID 5068 wrote to memory of 1908 5068 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe 119 PID 5068 wrote to memory of 1908 5068 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe 119 PID 5068 wrote to memory of 1908 5068 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe 119 PID 1908 wrote to memory of 5020 1908 cmd.exe 121 PID 1908 wrote to memory of 5020 1908 cmd.exe 121 PID 5020 wrote to memory of 3392 5020 cmd.exe 122 PID 5020 wrote to memory of 3392 5020 cmd.exe 122 PID 5068 wrote to memory of 1068 5068 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe 123 PID 5068 wrote to memory of 1068 5068 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe 123 PID 5068 wrote to memory of 1068 5068 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe 123 PID 1068 wrote to memory of 4468 1068 cmd.exe 125 PID 1068 wrote to memory of 4468 1068 cmd.exe 125 PID 4468 wrote to memory of 704 4468 cmd.exe 126 PID 4468 wrote to memory of 704 4468 cmd.exe 126 PID 5068 wrote to memory of 4736 5068 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe 127 PID 5068 wrote to memory of 4736 5068 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe 127 PID 5068 wrote to memory of 4736 5068 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe 127 PID 4736 wrote to memory of 3204 4736 cmd.exe 129 PID 4736 wrote to memory of 3204 4736 cmd.exe 129 PID 3204 wrote to memory of 3152 3204 cmd.exe 130 PID 3204 wrote to memory of 3152 3204 cmd.exe 130 PID 5068 wrote to memory of 3008 5068 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe 131 PID 5068 wrote to memory of 3008 5068 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe 131 PID 5068 wrote to memory of 3008 5068 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe 131 -
System policy modification 1 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" 846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3240
-
C:\Users\Admin\AppData\Local\Temp\846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe"C:\Users\Admin\AppData\Local\Temp\846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:5068 -
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c rem Kill \"SQL\"3⤵
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c rem Kill \"SQL\"4⤵PID:2216
-
-
-
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlbrowser.exe3⤵
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c taskkill -f -im sqlbrowser.exe4⤵
- Suspicious use of WriteProcessMemory
PID:1392 -
C:\Windows\system32\taskkill.exetaskkill -f -im sqlbrowser.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3544
-
-
-
-
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sql writer.exe3⤵
- Suspicious use of WriteProcessMemory
PID:3444 -
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c taskkill -f -im sql writer.exe4⤵
- Suspicious use of WriteProcessMemory
PID:3260 -
C:\Windows\system32\taskkill.exetaskkill -f -im sql writer.exe5⤵
- Kills process with taskkill
PID:2276
-
-
-
-
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlserv.exe3⤵
- Suspicious use of WriteProcessMemory
PID:3196 -
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c taskkill -f -im sqlserv.exe4⤵
- Suspicious use of WriteProcessMemory
PID:4080 -
C:\Windows\system32\taskkill.exetaskkill -f -im sqlserv.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2948
-
-
-
-
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im msmdsrv.exe3⤵
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c taskkill -f -im msmdsrv.exe4⤵
- Suspicious use of WriteProcessMemory
PID:492 -
C:\Windows\system32\taskkill.exetaskkill -f -im msmdsrv.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3256
-
-
-
-
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im MsDtsSrvr.exe3⤵
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c taskkill -f -im MsDtsSrvr.exe4⤵
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Windows\system32\taskkill.exetaskkill -f -im MsDtsSrvr.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4532
-
-
-
-
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlceip.exe3⤵
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c taskkill -f -im sqlceip.exe4⤵
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Windows\system32\taskkill.exetaskkill -f -im sqlceip.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3392
-
-
-
-
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im fdlauncher.exe3⤵
- Suspicious use of WriteProcessMemory
PID:1068 -
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c taskkill -f -im fdlauncher.exe4⤵
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Windows\system32\taskkill.exetaskkill -f -im fdlauncher.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:704
-
-
-
-
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im Ssms.exe3⤵
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c taskkill -f -im Ssms.exe4⤵
- Suspicious use of WriteProcessMemory
PID:3204 -
C:\Windows\system32\taskkill.exetaskkill -f -im Ssms.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3152
-
-
-
-
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im SQLAGENT.EXE3⤵PID:3008
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c taskkill -f -im SQLAGENT.EXE4⤵PID:3800
-
C:\Windows\system32\taskkill.exetaskkill -f -im SQLAGENT.EXE5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4652
-
-
-
-
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im fdhost.exe3⤵PID:4632
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c taskkill -f -im fdhost.exe4⤵PID:2992
-
C:\Windows\system32\taskkill.exetaskkill -f -im fdhost.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2100
-
-
-
-
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im ReportingServicesService.exe3⤵PID:1976
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c taskkill -f -im ReportingServicesService.exe4⤵PID:1508
-
C:\Windows\system32\taskkill.exetaskkill -f -im ReportingServicesService.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:440
-
-
-
-
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im msftesql.exe3⤵PID:404
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c taskkill -f -im msftesql.exe4⤵PID:1088
-
C:\Windows\system32\taskkill.exetaskkill -f -im msftesql.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:492
-
-
-
-
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im pg_ctl.exe3⤵PID:1288
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c taskkill -f -im pg_ctl.exe4⤵PID:3264
-
C:\Windows\system32\taskkill.exetaskkill -f -im pg_ctl.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5032
-
-
-
-
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -impostgres.exe3⤵PID:3084
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c taskkill -f -impostgres.exe4⤵PID:3172
-
C:\Windows\system32\taskkill.exetaskkill -f -impostgres.exe5⤵
- Kills process with taskkill
PID:2148
-
-
-
-
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop MSSQLServerADHelper1003⤵PID:2448
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c net stop MSSQLServerADHelper1004⤵PID:3964
-
C:\Windows\system32\net.exenet stop MSSQLServerADHelper1005⤵PID:1832
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSSQLServerADHelper1006⤵PID:4908
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop MSSQL$ISARS3⤵PID:704
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c net stop MSSQL$ISARS4⤵PID:2196
-
C:\Windows\system32\net.exenet stop MSSQL$ISARS5⤵PID:2924
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSSQL$ISARS6⤵PID:4048
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop MSSQL$MSFW3⤵PID:2648
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c net stop MSSQL$MSFW4⤵PID:4644
-
C:\Windows\system32\net.exenet stop MSSQL$MSFW5⤵PID:3456
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop MSSQL$MSFW6⤵PID:2420
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLAgent$ISARS3⤵PID:3800
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c net stop SQLAgent$ISARS4⤵PID:3416
-
C:\Windows\system32\net.exenet stop SQLAgent$ISARS5⤵PID:3224
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SQLAgent$ISARS6⤵PID:1436
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLAgent$MSFW3⤵PID:4108
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c net stop SQLAgent$MSFW4⤵PID:2800
-
C:\Windows\system32\net.exenet stop SQLAgent$MSFW5⤵PID:3444
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SQLAgent$MSFW6⤵PID:3260
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLBrowser3⤵PID:2100
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c net stop SQLBrowser4⤵PID:2948
-
C:\Windows\system32\net.exenet stop SQLBrowser5⤵PID:2172
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SQLBrowser6⤵PID:1732
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop REportServer$ISARS3⤵PID:1976
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c net stop REportServer$ISARS4⤵PID:1228
-
C:\Windows\system32\net.exenet stop REportServer$ISARS5⤵PID:2952
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop REportServer$ISARS6⤵PID:2720
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLWriter3⤵PID:932
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c net stop SQLWriter4⤵PID:3264
-
C:\Windows\system32\net.exenet stop SQLWriter5⤵PID:4380
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop SQLWriter6⤵PID:3464
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c vssadmin.exe Delete Shadows /All /Quiet3⤵PID:3020
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c vssadmin.exe Delete Shadows /All /Quiet4⤵PID:608
-
C:\Windows\system32\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet5⤵
- Interacts with shadow copies
PID:2584
-
-
-
-
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wbadmin delete backup -keepVersion:0 -quiet3⤵PID:3104
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c wbadmin delete backup -keepVersion:0 -quiet4⤵PID:3968
-
C:\Windows\system32\wbadmin.exewbadmin delete backup -keepVersion:0 -quiet5⤵
- Deletes system backups
PID:2196
-
-
-
-
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTATEBACKUP3⤵PID:5020
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTATEBACKUP4⤵PID:1528
-
C:\Windows\system32\wbadmin.exewbadmin DELETE SYSTEMSTATEBACKUP5⤵
- Deletes System State backups
- Drops file in Windows directory
PID:3540
-
-
-
-
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wmic.exe SHADOWCOPY /nointeractive3⤵PID:1432
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c wmic.exe SHADOWCOPY /nointeractive4⤵PID:3336
-
C:\Windows\System32\Wbem\WMIC.exewmic.exe SHADOWCOPY /nointeractive5⤵
- Suspicious use of AdjustPrivilegeToken
PID:3620
-
-
-
-
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTABACKUP -deleteOldest3⤵PID:3172
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTABACKUP -deleteOldest4⤵PID:1908
-
C:\Windows\system32\wbadmin.exewbadmin DELETE SYSTEMSTABACKUP -deleteOldest5⤵PID:3940
-
-
-
-
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c bcdedit.exe /set {default} recoverynabled No3⤵PID:3360
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c bcdedit.exe /set {default} recoverynabled No4⤵PID:4936
-
C:\Windows\system32\bcdedit.exebcdedit.exe /set {default} recoverynabled No5⤵
- Modifies boot configuration data using bcdedit
PID:3456
-
-
-
-
C:\Windows\SysWOW64\cmd.exe\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures3⤵PID:4520
-
C:\Windows\system32\cmd.exeC:\Windows\sysnative\cmd.exe /c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures4⤵PID:2876
-
C:\Windows\system32\bcdedit.exebcdedit.exe /set {default} bootstatuspolicy ignoreallfailures5⤵
- Modifies boot configuration data using bcdedit
PID:3224
-
-
-
-
C:\Windows\SysWOW64\cipher.execipher /w:\\?\C:3⤵PID:2648
-
-
C:\Windows\SysWOW64\cipher.execipher /w:\\?\F:3⤵
- Enumerates connected drives
PID:4700
-
-
C:\Windows\SysWOW64\cipher.execipher /w:\\?\A:3⤵
- Enumerates connected drives
PID:4812
-
-
-
C:\Users\Admin\AppData\Local\Temp\846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe\\?\C:\Users\Admin\AppData\Local\Temp\846a53042aa2ec1790fec4d1ec40e66b7abe83bab1718f14fefe051744b21378.exe -network2⤵
- System policy modification
PID:3444 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c pause3⤵PID:1092
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:116
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3488 --field-trial-handle=3088,i,14310325015283915034,7660943942870463106,262144 --variations-seed-version /prefetch:81⤵PID:1508
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1708
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD54759aa2574fe2be1238370e00564e2bf
SHA198803e10c4b7f487b4d37ac14f68d546643109b8
SHA256bc563ea89f25f987bc0e4967fbf26ba7d9d31cf10a9a6599d5202f185f36c13c
SHA51224fc302dce568d71ddcc83b3bb977592982d8878ed26244912d9ec155ab8d89abd88181afc6ddaafcb7625efb082e9ce900a495157aa9c2095b0131d60fbc2b1
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\aic_file_icons.png
Filesize52KB
MD5194eb7d84603cf0b0f6a6f61f2f4deec
SHA1b7d3d8f124d07d7ab6e0559d6a2ef4649ac4f24f
SHA256f10a77586df4be9147f3eee1ad403b720df5f9ba4b63bf90f18485ec80d6a78d
SHA5124df91edc35e212bef6c2e20d67e0215ed1871df31c4e669fed1d88956d8f63c0f57f4cb26fd12fae11fa28e690a477ae32289eeebfc053934000eed669cb2e6e
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_remove_18.svg
Filesize2KB
MD515558309a00e3673d05df284151bf08a
SHA1f70fe9f35e735e3a794bf6c603ae89bcbed0d8c7
SHA25691b80b3ea3ede8d84af86d7d6ddd14c1a2660fea96ecfd0b2e992d4f693854d6
SHA51222ba583ea62c5a3b21e5a0593158e6314b605636f9c9b874932529fffcea65a2f23ee46ea20768d71f1a5222fe3456ea6a852b1bdeb116ef31b8664d7994804e
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_folder-default_32.svg.deadfiles3
Filesize2KB
MD5d7a9e0efd318805e1a2ac70c25b515c0
SHA149c87df87e59935d7efa3003e9fdf35eebe8c8c1
SHA256075d0f8a9916b1f099c874a6faee4ea865775c735ab77c18e74f17d170c06927
SHA5129e7cff6fd03e456a5501dd6d7e5469bd485110de2ea3e3c7dbacd4b00416d88af4411aae7a13ba31807c476f938818a150e7a4f22a27e9d3e763ee181412f8bd
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_move_18.svg
Filesize2KB
MD594e2ddb014ac91c37af54e6d5dbc629c
SHA1c3a7c0da0caac702a614579c8f613f67bc3e9b6f
SHA2567db3e93e088a546e2a53b12dd413802ed5b95d9d9f83f76242616fc0aa6e19b4
SHA512aa8169896e6ede9ed4b48f0dcb0937de79a7123cb42c8b0e638de12d1befaae4b58877ed742aca71ee8a549c1f51a05150427f88d8a3b7e63baa41b8c7ea3115
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_nextarrow_default.svg
Filesize2KB
MD576500d23d1fa185c9c1d6380bdf9ada1
SHA12302741a28e403e7c7b0077d7fa44700320498cb
SHA25665645ea77d877c674f790dd30d3a5d136a063e6a7a05799dfda2e5e6a1270a32
SHA512fadfd57f6a1a962aa2a52cb4e5cc2fa260224a108a206683078e484ebac58fbbd6f6af316cfe3807f76c891afa7e0ad5515e15ee37d580e8f2327c39816bdd69
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_organize_18.svg
Filesize3KB
MD5bf5d781c14cb5608bec4de5f06f77881
SHA1b5d10841251d6bf7055a8fedc723ad1582861e9c
SHA2561a121b36c1f2a6d377d1803d56b628d4e2c365f8a712931d756bbdb2ffe42df2
SHA51279d87a59abb297fd20cb4425b6887c2649cf44c8df0783cc6668d4f45aa3f5ca7d7b81ca5dbe02760a732ddb1842d1db5b1550baa5a37842ec3e4a676453a603
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_rename_18.svg
Filesize3KB
MD57056a1da93b58c9a33f14c897e74763a
SHA1c671687cb9c631b377031e4c19c1b29d256bdf46
SHA256302687d2d38593e717ecaaba3d62ef6f31b9d93fef1d8bf32c1d3881244e80a4
SHA51284bfd142219ac70b11c3b7e91cf83edfd54bb376f0db15928d95b257308c8a47ee064ddf5f87db59538ed73afcec19629143affb2709865cbc0ce42c039f8f65
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_sendforsignature_18.svg
Filesize3KB
MD57fc9ca4b2e9bbaa2873c15952b332fb7
SHA1c30bbc2f84803e93147686343b3f8ec0bba3519d
SHA2562eec8786e389cc08664c89d3381611470a321b9b68c2f4b3ec321ebe86db6d6e
SHA512e111ce7bc50bf35de98f1c4408f30350e1fa834b63e800bf8bbc9521080816e27af3ffa21662b126e489a6094a26b688a325263a416596fb75bc9bd1bd0dab0f
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_share_18.svg
Filesize2KB
MD50e51ad9e7b177882050af8be3c8108b0
SHA1e5644bb6de4288750bb1b88adf406bbebbffb02b
SHA2567f5ecc9ce9f81ba30ab29ded875527a754b441a237b94d5c0cabde5d2d42190d
SHA5122c22a07cac8776e0edb940bf78a5fe7284c10f7c05964fc0ecc56e3be2691e90f16f262a2139aabc59bb36e58cebcb0ceeb52a690188004151ba21d7d4107e5c
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\root\ui-strings.js
Filesize5KB
MD57c98f9b768a73be745306e078bb2e00a
SHA1bf43ade00853386006c4bee4f13e9189506c9886
SHA256778d3998d7466a0592999800da5ccef22211f6b661edf717874363cf3fafbc89
SHA512990ee0e833c1747d7de9444bb2bc81d564265d95c5f395d1200a73e25b48ba8bac8761f411d353402de610ba99294478d2d050b23b66380f948493ec7892d69a
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\root\ui-strings.js
Filesize29KB
MD5bd41b26ea3d886762b369e04f788f313
SHA1e2ab08f5adf491c87a20008ba7aad0ae6eb9b1a2
SHA256c87d4b2337f091581bc5a1590954deae873c1f20334224ef3af37a88e7129d95
SHA512217d73d94144df51825bb01c33edd9e44debc086b56cb9121aa977204a3c0b273fc153cd7204cfdae00552a9a98e530745728fded5d07f6c241159f258cd8137
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\root\ui-strings.js
Filesize9KB
MD55c53489e2c87fc5aa9e90ee8e47b21a1
SHA1e5d6b8de10b3652a625cf9150e7730bbebbc3a92
SHA256fbe567ca38d943ba214a97e7682d415200c0d838b09d7c642378f8f5272cc226
SHA512435120c8ce691e65749d81bdb59ace40fdb2926d75d9b3d4ee7bc6299cdd345a86c416bc009466faf158b6c0203b4dc0d125292f8b8e8d2b55292fb13452b725
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\he-il\ui-strings.js
Filesize2KB
MD5146cc3cac4733df032545c6632484f39
SHA10c6b201a173efe684c40ee8b36bf9f525e4246e8
SHA256fa101de7a6aeade7d2638b6f712a158906ae402b595aa525f3dd62384d5d9847
SHA51263a05b3174c9a188453454da08d1496bdeb039c62f18f3ba3dada4ef0687448632c806b08f8154dc6e2e5373d6486035264fdbc7cb314854d50e23ad766b4ab7
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\root\ui-strings.js
Filesize5KB
MD5b9e4dfdaabf1bb7ca16ac5bee181137d
SHA1be42c4a0a417f97d5fcc0c2774f652fc2556361f
SHA256bf5801832e11450f11d5a9f70ed4e7aa0748f8364a124560330e398145099846
SHA512fb66ddc8b6de5b86eb5deff97412202578e2534568513d579a0fb7e015c3c0389005bbb13fd01c319507278da6d9a2cabc5ab42bbae69e9d04072cce6cc69686
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\root\ui-strings.js
Filesize3KB
MD553b6989c131323a0178bec156ec520d5
SHA114c023d5ce40c05d77706f08966c0959d102593f
SHA25637c4f7cde51ad7df87ee7596815ed2b3e607fef4e180864fb1269e58d243d46c
SHA512d3971c642681aef0dc872d0715e8738951376cc0bacf4792de8d307fd42e64ac6f55f6814251bb161c5281f0a6e04269e4ac7d243e0d57ddbc74dd7436da3e16
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\exportpdf-tool-view.js.deadfiles3
Filesize337KB
MD5468432e1c0cba8aded9037236e136d72
SHA1d4d9767b60603add92102f0b83387f97ae0bde2f
SHA2561ec38c4692b03bedd2b34b81c5a3581b97829b1dc98239623ffcbeea0b82617b
SHA5123c708d5e9ec89848905cf747da4f20b67f3f285a25b1dfe41fbfe63c47b9b29d76ce180f451f026ecc433dd8e1f52396d20a953288fc67b5e9efc3c34c4e961e
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\rhp\convertpdf-rna-selector.js
Filesize176KB
MD54ed8f721160c8f110a0afb2bc4d948c2
SHA15ba727ef8e1f814e8f5779f9141f96da0c614ae2
SHA2567e45e3a930eac3da06501e9d8369e9f65f50f133f4173f53f33a00e2a915dcdf
SHA51278e6bc367b378ec106569099ab4245df9e424d916db3dd1c5c1ca91a1b9150837a12c30b952b71152cf6762503d56bf1de1b3487d704a17b82e5f10f62e7597c
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\root\ui-strings.js
Filesize4KB
MD51b2bac3c369c65540b5e3e46fb1360a0
SHA1388369d49b05ad99209fbb72a56c2b682716096e
SHA2563520ac4de4b4692d7681917bf17b8e09feb63fffa58ee401c61da7b13ab9de9f
SHA512875aed088617da3783e4799577b0a7be50924a7dac2d230930abbeb1cfe7f957690e237fd3e61fea83394e5cb87abee6fad165fa09c2694c88d55ae2c93be0d3
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\root\ui-strings.js
Filesize2KB
MD5822fe0a2648b72f648ec1fbd51d84856
SHA1f96f52ae39e915910641456ab4ca985b5635437b
SHA256037c306d7510976218b31e3a8b04ecff3bfefe75f36765f67f4b6c173a2be7a8
SHA512691051fb368fdd85cd97757aed64dca4dd265421ecf8c1c000afa22888db309150f89b4f10024aba5e639119091175cf2bae14500de66e2be85794fb8dd91d46
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fr-ma\ui-strings.js
Filesize2KB
MD5b8123efd0115381eeb4a3a3a43906963
SHA1735f663c09e86ea4b52523594b8bae5f3db3fd2c
SHA2568116bb2bf8f393cee03a899aa6cf5f0cff3ae075693bb340c5a6265a9026fe9e
SHA5121bbd5512a83e1ed2b20d4f6739a29f501ab254cb4d921b4ada76bab8e772dd8922d561ef32b102d4ea55c52b33b394486a0a8682a9922424217bd4cd7fa76eb3
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\root\ui-strings.js
Filesize2KB
MD592b6f6204557d16d59e3be7d94260e44
SHA1a669d63179509bad5f2604d5b48a6864771ae22f
SHA256d7ef73f4bb7f7b42e2ab657741081a132cdea95381543fb8e174eacffbcab308
SHA512c157864603aee270ba770355d5b295007f682300570dd8b2f454fc6f3217c612af42a889c38341554279eba0380da0c2d1dbc14e872d4d3a3258c46cbaec256f
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\root\ui-strings.js
Filesize10KB
MD5221d628cd18c5c665f5bb3c75c5578b3
SHA14494ea5297a726cda3a41ae9f17510af997c4314
SHA256f6a2112b4158e06c0563e68deed8bf2bd419a7b7b8168026b19a5f14c377497e
SHA5121def3bac967a40f7e506ec461109e89a34aabfd14cb9d9bc003b0bcd1f48d3a81c53d236fec2e9fec0fc3033e55d577b5b4de06f9ecc9aa188c89afde1f925bf
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\example_icons.png
Filesize2KB
MD5ca29ba910e16cbeb30e7780871c381b3
SHA1b3a95e257a6096889bea0655410acf5c96d78b7c
SHA2563c6ecf0d193a2a5b9ff6bb3d4f7a7784bf9b7b293d16c4284d36f92f1b01b23d
SHA512db20cc1f9ac996f02d38ce8bb197b3ceba54ae59fca3815bd7f980e9436b09131a8bfbbeb4af867d46b849babdbedfe4b9fa2c12ffa9a2ba918e4915a75b3133
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\example_icons2x.png
Filesize2KB
MD5664af2a0f50c6bce4cbae4c7dadfd96c
SHA1a3078eb23b5c90c2cdc58d9aeb4740893149b0ef
SHA256cc6aa22da3e8cd116acea00706f9f66af48236b245667e0cc613d1f34e97bc6c
SHA5124215eba765b361f1af2806bacba12ffbf70dc534195af278d9ba646aee632b0c360f23a1ca7b00931f390869afae89c1e4f0eb73c003199299fdcae72a13f36a
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\fr-ma\ui-strings.js
Filesize2KB
MD5461db22f016235eed2f55b4b00fec80b
SHA11e6ec671c6c2d71104845188b4b38b9ded8a0f6f
SHA2567cfb6e4f6c784bde06009ec0588575bb7e50e2fc69b53721ff0b0c7618311e55
SHA512e99087ae6dcbe62cf902c057188f4a9ccc2976e77cfcbb323bef4fea5ea2318c150d60aa366ba178a9c2068cfe8b864faf09826573b63963be4692965c045506
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\fr-ma\ui-strings.js
Filesize2KB
MD57d6fe175156ba7d53092fa40c3effd54
SHA131c003416565c76f54f21cb3cf5c147f3d63d749
SHA256086c95abaf529ffb683de9de50febcb088b89d73fd0f3a8acac95986c946e2d0
SHA512a8133715cd138e7882e64e5324298ab341da212ea1fdd29238212616a86abc51b5a7269699777e4431b4823c8ab77c8c4b951e187303a51311f6dae251773b91
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\example_icons.png
Filesize2KB
MD5aa1d954244505cebaf260910dec37918
SHA179f1fea9dd91477f1a169ae3eca488cf7b223e04
SHA25678c3c09330ac4401e09f20ee29921a4e0a6d03cf82831d0cae91be6a2cb17181
SHA5120f0308ad4b01d42694f1b5ca9ee49e39e3f3e36b612703a153298bd237db3c7289a82775a6f10108bf522ba571eb9d773eabea6d52261efde7430e370b0132f5
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\example_icons2x.png
Filesize2KB
MD5b2d142f8e730e26a29bcfda2332013f8
SHA1bc6a815e9e35b4f94606d53046df1daabf6f9a34
SHA2562e5bbc6c07632f099f24100cd18ca30a5b632739334e88a1d2dc32b6ab77aeab
SHA51228c4ea54fc84ab255e060748a0d1712cf15f82c40521a76e4fb068f68eb2b57ba4987f8cb14180c1217611261e177742ce149a3581f6127fe21b74bb1a640ca6
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\root\ui-strings.js
Filesize2KB
MD5907f8b53a0d53c854e7ccc25a9823d4a
SHA1136777bb4aaf2002517a673006ad966e4b813ac8
SHA256a562b6ce428fc92c6212d3a9e60470e7b626f45d884e9093a880826ee20cc60d
SHA512b189cc67d362c33260f11360031d8da79965b397e16f3e3bfa0b0435932718d7306eb77fdfe069f2b212405617e9d51e5940fa3c967fea9a2a2c3bb085ebf9b8
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\icons.png
Filesize9KB
MD5a2986503b89efbb7fa144c4edf89ab5d
SHA11e44eefacaaace62a8c54a8f6ca41fe67307316a
SHA256f67af1474f76197a1ca88a6bcceee8beb1f5f27201c92ea9a72cc6d11bbab1a1
SHA5120fee60e3fcd555318d753a2480bb4b116959caa0b400ce1b6b43b6337a522289f13a39772fa1b9f5238653338e8457495c3e4c38e02855a41e9ca23c18b9f49b
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\icons_ie8.gif
Filesize9KB
MD559bf8aec56fbb485e6fe62ef8687bf49
SHA18632fb0a06d879d9981537d61851e20c110bbf9a
SHA2566fbe577b0239476c5d3f759e1e45db00c5f9b5c47d04c203c8105bbea724d7ab
SHA51265b1f8303421f05acee8e11e796996772f0ec5251603ebd981b1df2631b1c123c8a96e1eceb3c2bcaf5295b12d3e3064cafff1dedd91b06fd0fd0668a64e9b5f
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\icons_retina.png
Filesize16KB
MD536d8501fd03f5d1486125cf0e2f1cacc
SHA155acf10c36876013b851b6ed07f13752c2e3a00b
SHA256ca327b4871cdf27dc5a0bb9d5b100d0e520e8fbc6e3c3fb9b5d52f5a4337b93b
SHA512dc796a5c6bfedd419775faf992cf0369a6c07c31c6c2d111450abebde882af48bfea6c2cbd94e5c53f75cb2daf0cd52e9944d35f6317c34b9e97085b2b539bbb
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\new_icons.png.deadfiles3
Filesize9KB
MD5eb8d1a461da241fadf146d3f6863a2cd
SHA14fa46b1ce5e40ec2c1259e516d4bed1aa3be02e5
SHA2568c7b57b7489260c99dd06d43c78936656b599455e62b6b249be82832e2f1f8a3
SHA512669cbca6eb16146b1605d843f8843593e111b24ca10dc40c2ac6b572e3eb9c4ad372c46bad61c4a690a5be251ea63748b0b0e262d0326fa77993017123ed99e1
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\new_icons_retina.png
Filesize18KB
MD58ffc5b0946cef06576710dddf2235610
SHA11236349a5c8f072e4d7c9ecc790072821bfda9aa
SHA2566da0266b7e888cfb38c81a301d04447e122b2ebd559e68426c352f2d9ab8021f
SHA512e2d6909a807021bb503c6e77679d34012ca7270e9a2ebc033c016453ad1ee0805cdf196fef5a935c099625b2a2597a39fe4898bfe57041aaed184d00819f4094
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\root\ui-strings.js
Filesize2KB
MD5315de9650928fe53d28c5eec65ea5b18
SHA1439104f4d2a4018e9fb8e5034757dc6cf333d071
SHA25611c44a845511413d32e6b321f25bb7997222ddfd17edb3744f38667e83a94115
SHA5121b85ebff6581414cf92ac35c9e92530b58fd89dd094e060406f64f4298b056df120413d1686f20d8e73edae3a60b2b8473e8907780892cdbbe40d968ac3e4219
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\sl-sl\ui-strings.js
Filesize2KB
MD5685352f5f461309475b5453b06de41a4
SHA105944807e5ae384a93e716037fedb72692e9fb2c
SHA25657a9b6f1a7c3ff8127c538f2543b88b7d8c7242911c42894b6bd5402320c0ada
SHA5125714d7a769769fa7f8884ae4c9c6e52f90fc13e5cc0c66c40cdad4ddadfe4a8414401605cbbb7e7c7f8457e2657fed0c83205a5d5a5ff35aaf857add3a5d73fd
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\css\main-selector.css
Filesize2KB
MD5b6bf02f21e54907e789cfac42ffcbf4a
SHA10532b8881d3906a77befead4b169c72252de34d0
SHA256eb9769f77a3c063a98ce715d71e3a2e34b71df3ef988bd6bad253b914e71c641
SHA5125ae27a0b1e353c08f79f58710a5c9051e4290e158b2cf90697ebfaca92d6c7a110d281a2c67387c3dca652aa66f1e2216fffb419acd8a08d3e3c6f60087760cd
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\bg_pattern_RHP.png
Filesize1KB
MD5b8eaa41c3b4e0f9154c119e3f5f6db77
SHA18adec0eca967d7ca998b848f7eff2e6531ba2bda
SHA256df336efcc1e445af2e020832ace562c314354cb20d8b2cdfbcbddfd0459a508d
SHA51291349c042c9553be8789c27e8dde190d614a8056a6e122912423a379234c79cd9ec6a24b5a9705a67c0b55ea748b7d95abb9af19a9b0a6d3139dc111a0d029b5
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\bg_patterns_header.png
Filesize2KB
MD583b2db9bb9654d123929f0bb1f12a615
SHA19726e36f54014a681d843ae47a74d84aaed7520e
SHA25601a5fa6f92f1ad4e022d9ca59d5bc609f2413708c156ff389efc84ad8954dc03
SHA512cf4ca50ba06af185cce957ea70686ffe3d9cf46ca224746c68aa565d7a9f76546cb8f91d460a3af7c7caec7b1b3505935c32df27ca248027dccf55e7beaf8c39
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\illustrations.png
Filesize10KB
MD5c168ec89ece90a43e54fc8931a8a80e8
SHA19817179115b9cf8d730cf7998bff9f9facef3754
SHA256d98546f680b738d6784ed8c0972d95f47ae1a295f588213b14809abcf75fc7eb
SHA512a25b595a8c74f06281ab2bfd0afe1e23d13518e3883923529a8de099720ebdda42f22d4805b0303b3585c37419bef2cfac25d0c9d031ab79d9ae1b3d73ee8043
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\illustrations_retina.png
Filesize20KB
MD569cefb98958466dc3f929d2553a528df
SHA1307c766213d922ebe483594027654a1038f57482
SHA256af1fc4564814cdda6303f1c73e67694bcc09cfd382a20ad1a3b4c8c60f99a9e2
SHA512f1f7a5c932e5b62304abfe5804e669023208dd9c3040a88b141158ada563374eb0b56e935c85ba5f524036b5d93a2b1c2302a48eb695c5e3aaf5e150cf09cd4e
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\root\ui-strings.js
Filesize2KB
MD58a49e5158d4521a98903d7ffca152386
SHA132e9aaefbd6b9ee083dec7d98a6647dcb61f9ed2
SHA256640a17789361b3110287f12b4d37e3499896c28ebbf99a511f6482e833b931df
SHA5120cd5a88777981e4de88871fba653fe3767fd9095aaaf03c88bc89cd065db089fc85f72a16fcafb562de3f2136ab7d0036296a4ad56e53c49d51713f11fa132c5
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\root\ui-strings.js
Filesize2KB
MD5bdab2bf4e917706e29c7a7ed827590ce
SHA1a284842e60ae48703049cfea20f92714f6cbf81a
SHA256aeca0c91c65402d2676ddeb60148d87d39363f97bfc34c7353668c1b2271e9fd
SHA5120f68240d6e9eaa9fddeee2d536e2a34877d0b707d0addf53b3cac016cd779e59030a4114bf8b26cb4c31e19f206499105b78d5311731fa3a400f0be858399cf9
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\ui-strings.js
Filesize2KB
MD50be77601c0957e1fa36e5147a2bdbbff
SHA14586e213c3db1857aeb554dd0b8bf422b8e9ed96
SHA2567cb61726b3b61bcb72cacb0012ec31b7e1330dd3e137546482ea54491ea6ece0
SHA51233663da6c4a0b62225848460f3c1f3d25e8be3f377d8452d73c67f8f91f39c2cf7ba8ac8c336119ac91128c82b19bebf15bfb3f803020acc65a0ac4dc1ebe87e
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\en-gb\ui-strings.js
Filesize2KB
MD5c457d6db08175b212c8a515de6b13829
SHA1a90653f844a1961f671a8bef5c3a5d5586e059fa
SHA256d51fa7b183aeb5153ee7a711c2e8e95e13342f4e92dd16c1f148f95a1e024801
SHA5128c420500a980eba24737b1bbe8e4773a715d82b53748a0ac999b83f9362c264eeeb8b874a196176a70c1d56160bbe88f0de7299dbbe86156860d3325efb34710
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\root\ui-strings.js
Filesize6KB
MD57e13d6f4109f57665407d1ce834a6bc9
SHA13ff70d5e6c472028df87dc9f7b8967b18a1c1bd0
SHA2569d7614b4d63b3b7e37612fefc5a2cf735faf88e4a35c6eceb6134346cb0ea973
SHA5123104c3ab04fb21ae448de5f5420833e20b6cefbbfceecc9cd3bde93335831a11ee72e989fe03c5cebe28945c842481be460aaa5177b991716388247ff782c4a4
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\PlayStore_icon.svg
Filesize6KB
MD504ae6aafad559d088da87a6a8b91968d
SHA154e063a3043c5389d15eedee60cd07790d2e725a
SHA2568589226a82b6bb6e6170600760c55572c302dfdcdfb4d2108714c4437e1271e2
SHA51268f7906b1a48696d53e8e8ea1dfa1d0c79307ee831b8cff2333b8f911f3bf90cd4806b6116224366ee776218255d5d1fa4eee7ca744c56d0f876431ecfa7b10c
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\root\ui-strings.js
Filesize14KB
MD5f614e16816ded53dfca13ae7ff81ee48
SHA15cdee8ebb4b1897398b251826586cb3c6d9a6663
SHA256f6f0bd04c57d36ea6c100acf17bce0e6316984e7caf7996413d5fe56f3cf345a
SHA512264f9201056abfc5ac4a949ea867ffb694a7ef2ca058635ffed497b467076407c3757aff2471c22971b61d13c8371bf6d4a82c549add2ae047dc3ae177597703
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\root\ui-strings.js
Filesize15KB
MD58262270df88bf52d029c254f28cb988c
SHA1651ea0d5b79c3ca391dd7f273b5cb85ffb9b58e9
SHA256a2e4fbe9b0445b7b662f21eee95ef3b377bf033b987fff73284cb513e09ccf0b
SHA5125cd9dae002f7d5ce0fc73d098809838ed5f38a915a4b66845ade3982ea16da00a35f57810c6bb6f3d864641dffc4ea8c6f701c31010203932995237cf45043ba
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\root\ui-strings.js
Filesize2KB
MD5b6df22f60c69bfc4a811c88b9a598ea3
SHA1ccf5567a9ae148a6c2d394a10e65f8389a14bf18
SHA2563b2824204fe20e559aeb121f126319f1ca2066bad317a792b70605f2be130544
SHA51211c4fff051054e0e11aa520dd335303acc92a3a8dd4a9305e39a49cef9bd5392699b2c045c1eaff1b1391fd6a26b9daaa0b5b32ad42e5ede045e12b6328b63eb
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_cs_135x40.svg
Filesize20KB
MD5cac4edeecf67d0a27c383caf35634403
SHA19498f7f3af34d232bfebe09c5f92df7cdcf87330
SHA25693b9b9584d9a14bd6223e3c7ff071b2988b262c259afe7f697e5fc7d284654b9
SHA512c68708f310dfcd3eb0e220be5141cc2ce57bc026d719130b47e89bf09ccbde68e3e22dd5f6138acc267ce9def75141d1bb3ed0ec0e430f18487f94be4ab5ebfc
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_da_135x40.svg
Filesize16KB
MD513b445c0ba9d32e0104947a16c584dc2
SHA103f75478adef50714374406fbde219ad5d6b0cab
SHA2563e24bf7a451a91a2b93749b6c66654aaf63cae7f52c0076e468a555b7b488f8e
SHA512c478345572b7195cb5c5766ddd4796a3d467d0e810b854c115a4a56debb95f5534177be36233ea3e22d8ee6ae37a58173d38e57c43600ba2cecbddbb10e15d7e
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_de_135x40.svg
Filesize19KB
MD5fecfda1032f0d2584bc3249a4519401f
SHA16ae3a2881ba0758d1bb8267ba0fe1e47e838e11d
SHA256d7b9e9b135246deb5dd4cecba797108ca72f4c13b2565cf27013716e83cba204
SHA512e08d4ab995ab76d24aa5ebe559beb59fac2aef52cc0e3129c9d19c11bd3eb842c272089fd604baf5b7bb0a5c1a7ffadf1df61b920d82aaf553e34cb35059c991
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_es_135x40.svg
Filesize24KB
MD5c7a7aa97cd5e795578e2faaf308e627f
SHA1d4eb94441ab4a252732abc93ee83a77466dac430
SHA256a11fb7cae177419983b3882e6148331b2ce92a535cb7ad1003d75aa6d71ff018
SHA512f73950310cdbd96e712de25d944347ba8c58e95b489a70af7b8cd81c1f1a1d0c6a2a9974321e8a73df82447c549a5b20cb96d42c1353a4ad7ff5aeb41ca164d9
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_fi_135x40.svg
Filesize19KB
MD5720392271c65f16f56ef054b9dcdb899
SHA1a1a8ea09d184cbda33f6c1b48c61f1dea52f607c
SHA256c62974bd02bf627a2b07656e88b788c00102fe8c33aa0d95af3a1e97d9dc574d
SHA512b9c6a264087e2d9f70ce895ef6dbf183607717ae4d5fd88468bf05d948b45ac8d4a320acf8f848f458ad876d91f33f614a1b172c63d2b9247d7ffd0a021535e3
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_fr_135x40.svg
Filesize27KB
MD5285f6fa9a6486cd07c2cdc77fca32e83
SHA1ac6526e7c6091a57b510e83f65a9edc7e2d5e3dc
SHA2561dbb7844aa968212f324a06909cd6938a841f888582666f16efec93a9764a249
SHA512891487ece290ccd2fe637b138e48b057b82c9e0f4287e3b19c3ddade1ff3ff27fcfaa982a08cc3ff0f13c63bc12df97d48597b6eff399ec26c98baf7a892969a
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_it_135x40.svg
Filesize21KB
MD5987bf1ca8ab2df096c316f11451dbcd5
SHA1915e80ca9332d24caca718240006f4269d97752b
SHA2561819bd43a924dae63c5f27d5015f42defffcea26bdee629fbf0299e088b50317
SHA5124e7c864959d56023229ae29e40e86786724763a47153aa5019cd249e500d630149597e2da80a954af8bb01ae50e6291a66950242ecbc918e13cdebb4700520b5
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_ja_135x40.svg
Filesize18KB
MD546b13608453923054d172db1414ecf5e
SHA1b1e04333c9ed322f7296aaad9712877eb1d02af1
SHA256b63a11c28e43d96b65a64947570626cd98746c111c0d434eefdcccc47e8adc6b
SHA512e8b5e4961b2362f598901d62a47118c27b30bdd05c3ca518c8d1c5868ae23b69fb31c3e54487895850b5f1a9c725d1bf6f855bd534c4d79d8a6efa0013568c3d
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_ko_135x40.svg
Filesize18KB
MD5e5112edf5a3bf7eba20388ed4056dfef
SHA14158bf2ce005c8207f52aa9aa23f047f7c2f7a5b
SHA256507f3c04f436d3b5640c1b04547313df2e630a691df7e283a11057b3f0c30b33
SHA512803e22c02e0258247cb77a72af39c33da2b768c065dac16cef846aa92b5a61baac4c639926a98c9b8430707a31dfaa25fa6ab0bc1807a65b9b1ff7d660f411dd
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_nb_135x40.svg
Filesize21KB
MD57d8ab4c9de9c026958abbd8956259f48
SHA1670dd879c662c18e3497cec7b5d68df4b5b4bd33
SHA256f4b3525580e5aaf8e6476ea08529598a0461c9b1fc7f3bff2ce3f70e127a52e9
SHA5124e33031c4cf5944f9fb831cfa1f0a12bea8a343a9fc20dcf811abe1630c659b09e9f59d0278b592cf3a8bde60c1f412701e6ba1368684aa9b190e10d04cceb8b
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_pl_135x40.svg
Filesize19KB
MD5ec369aa0ca0c5e364720381818a28a5f
SHA1ac2a7ec9dec0f10b5177e9b3eef1db8bdf4fa152
SHA25657f508c8b47355d80b5501cdb28ecd81f8bb40144e5447463fa11097e32afcbc
SHA512e9793cfd2d6fbbb5706c38982b2feefffdda144cc90282d866b8826cca57df24a19aa7a4d55af7c1aacf8f7bb14653eaf8f7d9c051dba9fea27519eaebeb26b4
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_pt_135x40.svg
Filesize20KB
MD521e18efaf39c61cd6f84ce9025e287b8
SHA15356e21021a6cff2c96c21f511617178b5a3c1a0
SHA25631d39e9844b444febd820f14cbbc1c51bb50e180ce98d67dca6fd2526f735e6d
SHA51203f4e3d593b559c5b9556fc35cc6b7cec3d4e35bae7c8ef10dc3aa4ea9c48f4421263e95638b3bed416fceb7d7a2a63ee92fb6a6d9b0e97822dc2593b66ef53e
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_ru_135x40.svg
Filesize24KB
MD5d4553309e115194260921b565f453831
SHA1ed86ce0ed71ca6e8b00e80d1f4bbde4e5a49bc68
SHA256165ccee19f9b1513c93f8b8136ca712c896f114e102410e545986b296ed71a1f
SHA512a209688bee8a2bfd4c152c4fbab0dd7577fe98f8e7ed6b35eb27fbd04a7576d251f6bdaaf2363e8e3ff86f0d7fb1016358cd3410a7301fcd30c84850a1f4754b
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_sv_135x40.svg
Filesize18KB
MD524f3aeed302ace25521ed1001bc72255
SHA1eb778ddf01138e0de46cd838c31297cb0055d2b9
SHA2561751a6a6bb41bdf78296480e224a7c394194f8c2e3ccc4f6c7416fb80f311f0a
SHA5128181736a0c067d8157a8a24aafdeffec216e393f95436b461fd66c7ef2a6701d6ddff93798163477fc8e5590eee639d9b1a3a7ff65fe0f221bb40bc414774b05
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_tr_135x40.svg
Filesize22KB
MD571799443df48a349b6627df7099d61e0
SHA17ead92fb2285a9e8199de79decdc17258bc5ab61
SHA256f77aa0c0958ebbd24e00a0d41bed54e8b34db7fb69ec7bbf462e810b185cf6ec
SHA5127bfb9aeb511f39cd6fbe25ed150820fcae1b83918fb6e40056f80a862df0fd2704b3928e55825bd0433430c93b86d8264e0cfcf7f95769f7a4f2716899ce461e
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_zh_cn_135x40.svg
Filesize15KB
MD59ffc5fd7fbc885c6d909b04601672d5c
SHA15fc77e0c3d6cb0f8ed449b6291117fbf886aa210
SHA2563bfcdd481ac07d303dd5a80db213ad7306d365f8d668e9836d80562fa41e0407
SHA51268f67114da5b2445315794f440ff2dfb4f030ca9a1e611027f8da1800daa3743437bf3be69e0ed0e49f86ffae401de30783da2298611f885e7651749918fcb3d
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_zh_tw_135x40.svg
Filesize16KB
MD5215b28c6ffe581f5b3a12f9e00b8673f
SHA1b9190d96ca4723b8696d9992c6b1adce60863fa4
SHA2566267252329e46482f329814d9fe105831fd37830f7ea3912bb42bb7f772efd76
SHA51203fcbbe2d29f73a44ce443fc1a541c28844c99f196a0e371e1e48e09283efe4718b44585ef2f9fc4c9f4cf0f722394d226349e4fa97e08b3179e47cfc94c2ebd
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\cs_get.svg
Filesize6KB
MD58173e9454db1b2bfdbe56fdee243d8ae
SHA1b14ac9566b9ef0f49d6fff1177cf231ac9aa782c
SHA2560bfa1e9f6d72f051ded646ac1cc39feaf4b7fc3a1cc72efacdacd12063481b5c
SHA512ff3dc696a73d67dd2171a10507798060ba024ef7841b5731cfcf538588eb8c770bd510256b744a5a0fa6d8f3a3cd40f009db95f9c3e640e361853be238789015
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\da_get.svg
Filesize6KB
MD515fc5f0da2a04afe68e8f133a1855dc9
SHA109921add48692636ec35df1ceb34f4e6ad6a2431
SHA2565c47975486a2536462b0b5e89089c8a2b5448fda6a3d62220734cedc1855f46c
SHA5126907f92f942c5ec381e627d177527653fa351a5f63248bc96187c0bed79d09e473d866e273aa97557d35f09f677e510c56c84b6d1fe9542119faefcb09c7765d
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\de_get.svg
Filesize7KB
MD5da7ad71f9cf1234b8448f4a06c4a3a8d
SHA1552582c73a6323399acc086e852ab4c43b19e5c2
SHA25657998073758403acab31387ad95dd6fc0090a623e21609d7eb8697539abebcab
SHA5121db918739add62df0eb504cd78668c7e3e8ba44f78275aee8b65d1b5a642b68ced4f9df8e46365f618b2f58ad524e3f4b5deaabeb272355f786681b84e35b54f
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\es-419_get.svg
Filesize8KB
MD50e1f8a7582ba19dd82f5f998c356c215
SHA1dcdf581bd139ab6fdc2349fbb6c5bc357dc4de15
SHA2569667771a313d2e806573c7a8d8c4a658006adb0ab5f2e59b86a5d871c7b2070f
SHA512d44aca17c780dba86cc2760facaad8ff374449fee847a04487e72a533547d84dde3d3f8f654ca1586cdf78a152f6079d1b3555a3d1e8d85ec99175d3fc0ebe2f
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\fi_get.svg
Filesize6KB
MD5e5d24d4b6b3e2a2e781f4a63b778c379
SHA1f65e87ecd8990b11f17019d1bf255da879165a1a
SHA256bb169e2c796a26b2984db68ee5ebe849a22e72e96710bda8caa9247f6abbc0b8
SHA5123ee48723e0eca5bacdc6233cb8b0f097252ce055bdc4547f929f299045d0dfa52ffd1a3f38fcb60ab74f90bc9fea580f5b5c52206bfb4296cc4d0479b18234b0
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\fr_get.svg
Filesize9KB
MD51bac3a1f1e606707c031b99270597ea3
SHA1862454fbe9ef421293ed2486aa170442ba231e98
SHA256c82753549011692ee7ed33f601f9b95c3f79467a4bd332e863d8abe387593c8a
SHA51265c4af37e360095381e15774a5e4386865b9b94a9581f17800d894f92a011ce80aba9636dc82f0d1d2a1a0fc8aa2e697ccca7e786055a92080c51e59d975ba53
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\it_get.svg
Filesize8KB
MD5abd5e5b9c1afda447cbf833c0de9d15d
SHA18cef74bf0c554691bd01d217aeca2513683d3f9a
SHA25601c8a79873a32834d9331b6e4fdc6bbd7acc8b503ab1d4570e6930f2bc557b93
SHA512dcf47cf4824347407d1c08d36d62197fc65668529b8a031f442ab58989a11ae099a0cec10ac77e1d596d4df011ab9a7b4a1ed4fb6a6f0de16818ff273c59933b
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\ko_get.svg
Filesize7KB
MD511c03328bbe2a780b6620a31744f4734
SHA1af1f233fe5879f7cdc69389897fe5304f27b0ec2
SHA2568724d594f97372a6fc473901cf27cae559ef9698cd00fdace68f20a2492bf0ba
SHA5129a00aa5fb44aa6c072037ffc246be992dc8009c79057b98eb66178fde07ca6d5ecc7c5870e5b8ae9d35a8d7954e72a8417c715dce88a090600c89bbd4a995001
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\no_get.svg
Filesize8KB
MD577e6a30813b32b18ad8f3361a1887ac6
SHA14748475dd49947e674a64d89a4fc4e44e9542ffb
SHA2568201729fed378214c37f229f08072bc7ec2c94cc636bff385b83caba5316ea83
SHA512ba03d5aba7833af90f1e2beb0a4aaec8ff172fa9597f19df6056cb497acbe8ce2ef11e9a75c215d2b62bee24ea3aef698996022cf4182289abd7a554b09b7e08
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\pl_get.svg
Filesize7KB
MD56bc3f9f6585f83e50bbd6edf47c46ab3
SHA1b749bbeacda04e2851912f09e1ce2698c26c3e1a
SHA2567e19abfd8118f75dd75373a20c246428575ba8cf2b91de2a5397a626d10d3324
SHA512ba67fecadb46275f8fbef5644f32280f9b6f1dd8ace289fc47475cfc7ddd9fd54cde11841b2124d4afb820212d350bb76a2f38b226e0ef5315efd817b50dd162
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\pt-br_get.svg
Filesize8KB
MD5d2288b25ef5ecdbef8d8b3463d7292c8
SHA1054e6e3ff3e1df568d8066b1aaf2b91b06e3ce6c
SHA25622a4bc00188293d3627bde83ed5e738fe3722c9f350787722b111008dd651154
SHA5125dea29d117fd42508a123c39ef780fda9717ab881845c965bd37d3ae8e676b068910d09acc355e8c2506f8b065f6db160cb4007147626f49b2f134c0269413ab
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\ru_get.svg
Filesize7KB
MD5c40c734c3dc92f99689e09884c65291c
SHA1a319edfa8c073de8b000addfec6fe9d9811183ba
SHA25604174de271dc7f084c1266e4f0774731c0420b955036871dfd2288da924cce71
SHA51295d115ede283308a306aeedc825b45068f86160bc37b54e6b388a3be07d749889e35b91d6e26d2bfd7931fffeaf103ffbafe48a79b58e52b87d8a15b70b305ef
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\root\ui-strings.js
Filesize2KB
MD541314dc120fca6a6a3c7ce42b9dc07d3
SHA1441fba238c58ff164d718627c77493db84e28892
SHA25695f1df2f9ca4d1a10ea9201b932cb3ce57d2b960bab1ab90edd1542c83c3713e
SHA5129010b2565cfe03e5bf1baeb3dd402f58f758d55c657775d1c1f5fa4e4a47aa20f76b3bb885d40afce6be1740fcd0cee1a87c9e7239f6a8bbbe957e6a74d45cd0
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\he-il\ui-strings.js
Filesize2KB
MD5888b216d752f4efeaab6ef3c6dd51b1d
SHA1ac0501818cd76d33a1d668110ec23a61d9576126
SHA25697ca541489688608bd02c813113e7b98fc2376d30d92b8f68a74fe824f969438
SHA5127e1d2b7d5b6913e8ae5445fd625ac963ef7d5efbd52da3d8caf9d1c2611663a0ddf9c414c83fe56c8c8790c4286275522a186228fdfc51b37a20dfd6a65b39bf
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\nb-no\ui-strings.js
Filesize2KB
MD5f2b6fb9c3e6f0cf40329702b530e2a67
SHA14260ca386fb637eff5ad4237e0cf5215232a7244
SHA256c75b0522ce27d73e6d3d41c38a90b8e93a7aea33c7757a8c9600df064b78cb94
SHA51281ea675265b12c9468b79fa82ac34aeac1ccc6c0bf7c121ffd1b5eecc63ce89af78352953f19c9e0211798bbadc81b3752f67e42e264f568e23607dad5803903
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\root\ui-strings.js
Filesize2KB
MD51eef2bd5e22dc04a96dbb471357b67c9
SHA155f36ca4aa955da53eca07e750a03c6320e7ee0a
SHA256d88d43c5cf4573c6f78a4961dcc8be866e4772972a7446ea4f09995172f8f623
SHA5124c27a718677cba20bb9184c4d82983ca3e934283c2ec31c092f4a0151f6af4239a4dfedb3ec7c21720734435bbc165033f76349b46a4ea11f0cca5d884b8732d
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\root\ui-strings.js
Filesize9KB
MD51d5047958a05520b471086ac5a50eb86
SHA157a322efd1a3b03e4e64879638c757f34e62cac4
SHA25674ba26ca6a79f80f068494479b4bf5226b58eb0bdbb4da04a6ab8f05c45a4e6f
SHA512b486ce18a777ce8025034731333d56f9cebca39e8ed0d351adaa554f105ccff1a86811158dd0fcfa43694505fa0df51db487257ca5ddb20c4b096fa9a797d02a
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\sl-sl\ui-strings.js
Filesize5KB
MD5bfaf7a839075bce06a18795cd2cacaaa
SHA1777bed8a63264c78d641f1becee04bb5479136c0
SHA256c724980d0b2614f8461984e463d6135ed78c3a9ee91f2a0ce0fe18c03ca17f17
SHA5120074e87a18dba7b97c6dd7812e4b0b262f0182ae827c6d6bfa6bf5e392831d32460e6318d9aeb551e5f54e37145b71bb68e4a672e7a7c32565a7f10693b4193c
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\root\ui-strings.js
Filesize2KB
MD540a60b3433a61531dc7eb46a8fd0cd5e
SHA1fb009f4f94fecd0f075be595f099501ea82b1815
SHA256726f464cb110f575dc7a7420bb6ebe42de1f3292417ee6d5f11119becf0f0b0e
SHA5129a58574f3b4122cce259d521db704ff4367e07366c5a162fe05aef5fbaa9bdf12640ae36bd3314f002a7f082a0c2b18227944643607f5442183f31ffeb77fae6
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\root\ui-strings.js
Filesize15KB
MD5e975b77307a6d93793d3b3b23ffc4d12
SHA19c8999cc19e99ecf4715fad30fb1b99a8a06b57c
SHA256ffc508954f615ea16d6d94f26099e71af4462d1921bcba823693af17da8346d6
SHA51288f7e9e518f168995bd222f9301a8e002ff397cb5dcf23dd3893a05613e6db7b660bf4d0ee0cc869eaa93d72fc51712304dabba22857f3bbeaae3209725440ee
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\de-de\ui-strings.js
Filesize2KB
MD571a85a0b200da79586ec9ba52382f1b4
SHA131599504372404604cff0821548d8b25a9fe7ce6
SHA2562b0d814d103236db36a3c9fc5d94bee3f833a92d54419e95f57fa48ff78f2d09
SHA5126ed647daf3cc3937482b35aaf0eefb26faea6c016e270d50f397962bf672c50249ed60a45bffc4affd76f1f1edba50385cd5e1993ef9590fa342eaeb6424276a
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\bun.png
Filesize4KB
MD5ebfaf58ce2b72728425abcacb1bbc2cb
SHA16970ec0126ddc0f6f70b805b935fd93004da3812
SHA2564bddc1d9136bc8834dad154609efb390b379e377a6965c204b96fb1203255119
SHA512baee2aedd74c98e901a6495c4d4a5d014e36240f9851431a4f7651aa134da8f4d08a59bbb3df96607e2c56bd98af730780de9415a6eb89e7baf070ff0f530234
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\cstm_brand_preview.png
Filesize3KB
MD5e291a87f0b90c0b08c6e1c74b38ed9a5
SHA11f373b8c0cd2ce83da6685cfe41064c9eae3acf7
SHA25634c2a71323f22a75786e98959c602ee42dfdd0ce63686e1aa1d784bad0579863
SHA51236c639168fd9783981646f60f43c0a43a7ad0193381596f1aed39f287d23cbca3938341fe710a84bcc1f1c4f7553e20dbe9b560ff399119310bde5e274983993
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\cstm_brand_preview2x.png
Filesize6KB
MD5a1700ecd4716872ace983e224115e9bd
SHA18a63f98725d2fb0ad6bf1d37d94b2305b5a4ed5a
SHA2568cb9517dd949cc5821231221804022777e2b1db7190e8827b0873d1389a9953b
SHA512967f3729f24325c16afafd76d546c7143aa4ce976ebbd1c91eb8f9eb347cdfa2bc798cb3ff2fa132841208d5c18231e0c69cee4081def80a2c61a827c0911c6c
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\dd_arrow_small.png
Filesize1KB
MD5282ff469985199bc207e9f6a5e0f1b15
SHA12c271c894ecf3fa46566a5e749446535f7dfced4
SHA256f94bf8750623491398d4eff8fa90d480725f0bb89de5aacb986df0c8fb83cfb1
SHA512352544b0498fb29d3ef83ada22e150e184b910520638e8890e12ea0b654ca3a4fc8affc92b280237dde90c36b903bd93236221614c2a6ba4c19e54d792941b9d
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\dd_arrow_small2x.png
Filesize1KB
MD5ea32dd503460225d46ed229b1acf76aa
SHA1c217b5fdb5ba5ed407fc657da700671929a78633
SHA2567e9c71529f30ee9833dc8a9be625d64efb072de892e22e2561b230c3bcec9f86
SHA51279481cdb34b3d85722fe73a5954b38c0d361f01e95efbfa474ef718fc734129d116a0486ef9e60005806087d558b0ee98bbc4d660b2b1b949a739a7ccc2621e1
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\nub.png
Filesize2KB
MD5d404f1c98b9eb48614dba04bbb0a0857
SHA18a67d84cbc321e22b4c039825d7dae0c0979b871
SHA256c5525a781c6f37ef049774620d570917351cb1d8fe7f7e91c864176e2f557059
SHA51201bb621b43bacdab57f89d6ae4629ea1257bba7bc24d9b8ee8af5f298fe90d6f86bbcf6cf87878a1315329ee0467284f3782729ed86f52fefaa565dd90c28c74
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\share_icons.png
Filesize2KB
MD5e9115f0525d692930735b3ae0feb3c8b
SHA1949d2a7fc2d149811b929911c1bcbff5ff16fedf
SHA256c6f78295ceac065d6a1bd58d353b836514a204dfa4c7741e15da5e9a3c42f987
SHA5129b84615ce7690c212561c2af5e162aa0081789b024704a73d9163faf450149923446b7e5ed0a0470503f043d64562e97af632e8fb2e76914354a756662f58572
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\share_icons2x.png
Filesize4KB
MD5c0875833306958ae2e9ffa6e669c644a
SHA167abf309e1b8f27409099c57a0731a31a57372ea
SHA256cb0a23a07fa405c12a45f52a930618ce4bb10c2720409064012910b4ff7cc0e2
SHA512416cee04a5fbc26b59f37d88bd783941cc6cac07e7ebfa027d82300f1dddf8542f701936f7ad3c990d8a367d0f01ccb97a7485a0456d8ac4479966629e43ac38
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\root\ui-strings.js
Filesize15KB
MD5d0d1abe9651af12cc1d24544d0f5a44c
SHA1dffea897eb722aff05810dc99f0e16bbc5ed477d
SHA25619650870765accd78a6abf168ceeed30dc89f035d4e854d46c5febca73677044
SHA5123212293af630b2b2bd1fe16f0c47f2f3b1eced5146ffedd5ddbc5207a3d5699294807a250c32dccf3bfe4aeebfbc8eaa6f9877b4653b298d0f8156112ecd847c
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\es-es\ui-strings.js
Filesize2KB
MD5170f0985dd405ef53e27e30e842ad629
SHA120b80e0545402b3e2bf01bbc2e1e167e321c45b2
SHA2565259d0d094cf2d3ecb905b5bd1b22ed1c04d332f13d485e0378aefca73355782
SHA5127568d3f9c9db0ca1ca9f6b15a22c50a4fdd405987a52b637bb18322c2042fc08e3be691f73741e0e7a93d843befae41eb58ec6087d368d13c34e1c42cfd9d23f
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\root\ui-strings.js
Filesize19KB
MD5ff387119dfc6c54987ead73a2b3cecd7
SHA146cad8f44f5fc37b98634dbd5d8025d423726a33
SHA256d2babac3ab185355cec7a3d9cbd8a2c3b37a670332197e0cf9082131feab9896
SHA5125d032494aac997ff56e7536ee5582c3e13a4717e7e7e530a3a224ef83637d99332b3fd498c0a6ce31da4ecf43676d1ef041515e5f8573d980c3bb1a07b37c70a
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\he-il\ui-strings.js
Filesize2KB
MD5675d1bd88dd509465cfbc14738ff3a05
SHA199e84cccef50074a5707134d57fca54bdf59cb4b
SHA25609d11342e1aa02959a369e6fb7996d3a5501a2fad1dce6a2c14fd10e3abc0459
SHA512de10b179446d8b56d6e77752af6a65fc82bd3e0dc481f21491757cde998449f201ac24aa8028d5f77446323484ecb9d86b4e8df0a9cdcd8889abae565f2cbaaa
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\root\ui-strings.js
Filesize3KB
MD520173eee797955f73899c97211a88684
SHA1990732e881d7e3b752a65adfa78ce12ff5e47a68
SHA25666a119b6006d41d21658da4304164202e898f9d790de4ce90dcb6023cc495f56
SHA512c369e24997ba5ccfad1f6f77a784920c8263c0c412ea2c6138bf5f22eba7220cf3874349a712b7eb7ca33dfc613266457f4ecefd03a25733ea8ebd5ecf5a16e3
-
C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB_EURO.txt
Filesize34KB
MD5f590a5b6da6991cf1137a89174a4cc21
SHA15da674c95719e65874d97c9bdec5fa7d47932044
SHA256fda3beb8feffeae19b18d17221bcbfa56299fd5be160537fee08d29256a28cf1
SHA5123af4a1567e89210db88efdf65047c23319daa43b573cf6accd3b412906cc2a9fac23014ed4163db278eeb8c1c1066467a78373f2f36fa2a926531e8a5b618d9c
-
C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.52\identity_proxy\win11\identity_helper.Sparse.Internal.msix
Filesize58KB
MD5880024859c76c0c76abc29fd955f0889
SHA1b97870b5f0e4921a548743264e04b293c27be2ae
SHA256ca6644602acfa814f188ad0413ad7488b447c6f403c483d6bb4921e0c8358117
SHA51214daa1649d75ca15ba58205eaaaf5b1ff0aaa3afe02dd37ae584a92bb88f0450f7214059f8b1b1ab4337cd9d476f2cf723b23293be40782836b74d2b76f6e46b
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\ResiliencyLinks\identity_proxy\win11\identity_helper.Sparse.Internal.msix.DATA
Filesize58KB
MD5f47e1f70fe30e055205ef709dfa48dcd
SHA1b03f1844cd5dc68cbce5327de6acc979106c2b03
SHA256ddc23cf2ad82aa0ef65a0e4420f754b96f77a66c2b751c934e8fa015d9dc0021
SHA512c00b71b6e6a3d05491f3eebacb92dc4cb2c6f91ef44b41ed53258e398ecd1f367c62abae1e795f11ccd206b965358c0ccdff745245ec056207b53607aad33871
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.52\identity_proxy\win11\identity_helper.Sparse.Internal.msix
Filesize58KB
MD5e0466eae696e51d3be5ddf46d8b1dddc
SHA1282e66b6fe615f3f833a295fefd1efcfe77de697
SHA2562fcdc54f67d3c694d096a2be6a836c0652b3314d0d7246c0217eb6fe2891a79d
SHA5120241cee1eb8bad915403d58abd8881b32cca5c227d376e218e8ffd2762317f4b272057a354472998d68b7111c3a7019cfc2e7bf1a8557171bb098f03f252347c
-
C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\ResiliencyLinks\identity_proxy\win11\identity_helper.Sparse.Internal.msix.DATA
Filesize58KB
MD5a71b4f7e6214568346a607972c26c3cf
SHA1a7327ea9a7df6cb117f3aa02c805e1579632862b
SHA256d397286a9d51560ca70ba909fc3d83edda428454e445b2002888ddf140f97805
SHA5124b2eae589543e6bdf47ad54162ceab373abdf9a9db6f33c5bf91715489ce3a39b512406dc2c89c146f7edc1775e059fbe5f16066fd76354291813a4c3853803e
-
C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_proxy\win11\identity_helper.Sparse.Internal.msix
Filesize58KB
MD5f4a7e03a977a827e110e338d6c3b5d36
SHA1fd79ce21e38d37710acf15411627300b953a0521
SHA256be5345bd3158c4112a7dd1ace0341dab2f35b31b4d256d85ee17c6e72c7ec811
SHA5128d9b453096f122e3505b4c8afc81dbf1525b858fb2cda3ba00d0663b1df8fc89d7f4d87f507d3becbba204fc7d544846219d7e19d0ad8df399e2adaac5c722ab
-
Filesize
1KB
MD5f9ea8901a16e079af589aa120f18b776
SHA19bb31f80c8cc08cebaf4f1dfe64aed28ca3a626f
SHA256f68623dd169f982f1ae45a9ee760564a4accd0ec475186e68f0484dac94d7f2e
SHA512d3707430370be68f48a1a3681dc6864974822b072c3588d762ad927d14c258369d93d9fa692168f24441a1a25c5f20ae9e70c2dde73c9602ff0dc4fdcad4b8f2
-
Filesize
1KB
MD5c3b2b47315344c06d2216001e69e2ee8
SHA16be469cea60be1b2f37f77fd21b5920882ba5585
SHA256a8da2b0a42180e202fabfb9ac812b16cabf2caf07f06870642fab1578493049f
SHA512e0ba0facca803fbe882b99da8fbc5fd695438049ad13b6af20b7f816abdee482e911cdabcd78dc9b263c19935f3ec7fa96ef098e4ec89adb96875257eb2ae081
-
Filesize
1KB
MD59c5e59e2b631d9689bd88a0948266033
SHA1eabb595217cbe01bc11e6a43a88910b98e49e642
SHA25611b893fb6fab7ba3351e1ef8133250ef9594d33029e5096d2445783c0a9f2d28
SHA512f1367a7f08a1bd28483046380368b378f4715330e5750d70a350729c309f64ea26776b54efb570ab21413098ee89bfde83e2bcf46850c20373bab720749e4890
-
Filesize
1KB
MD520b8b797eee6c9aad71d00650b9c0776
SHA1495cec269dc7250fffcc289e8e02716da7e3ff6d
SHA25646f5d9dea224114a459da743e93d02048d8df912af7a6c27a58053032d695199
SHA512da6697b664b15cce88a19293d4607c280445e1a0a199ae8b78c6ccf1c9aced4976f7ab47b42e4c932044b240a2778d29e90a89223ef1fca0fe505f91212acc3e
-
Filesize
1KB
MD5f0b1c951e4cd9d77612dfad00d396efd
SHA1384f275aa0fb98dfc9c4e2d48ec3caa4a588da77
SHA25675c0967dd064cfec60618ee9e5eff6ddbea246ca9b030477c07ff39486c3bce7
SHA51221146896eb8a9f385847132ebdf22b5536f2959c528f7219f0c2eabe0fd8d18e2859cee8607afde0cc77e3401bb004766ffd45296236d8ce40cba3b0812be7cf
-
C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe.config
Filesize1KB
MD5a506b4df88f63fe8635c64529ae8a8e5
SHA1ec8ca6a9dfc1e37f374ef871e57ec2bdc3f6f0e7
SHA2565b4a6d18bf1001e756a09c7b8290dce17ef525ad5cc0ccd1b2b78ba3ec043c83
SHA51296e72e26c47d17e7e22f659f078ad53e56c74b4a7ffdcbe1b3ad0937ef6a59e6c8037b5f30aa2bb9bd45ccb78e0b031b25043f5c57b18816488fb8ca646132f9
-
Filesize
246KB
MD5dbde74dd2b3dc9209f06d113a09f1d24
SHA1df0b8852b6121e181290274877846631959d8143
SHA25653ff45a0a86abbd7be99fee23c21a7a23b4b9b1bd881a2705afe87a1ee900502
SHA51211bbb6f69e8b7b54937368b8900cc1d05af62db3a314f7e50bb5a6e00d0693bc87fd4470edc7e39c24917ed37dc30548bce39fd5018f51463112994d3126a2ec
-
Filesize
1KB
MD5011bf3f68a8685aedeedfbd47b0435e2
SHA1e5e99066e23b6233cba021c97a4c4b6184e9eac2
SHA256cb263d8b9470e4c7f29525c6aced11b036d6f83524adb7cb694f60d6b771c0d4
SHA512e1b588ea7ff037f8941aa98c81ed71205cf5ca8a100296253378cd5584eafe9dd86bb5c3c9a3ef5b97e398a13c642851fb9c7aa24a167c5301c8957c6bb4fedf
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\osmia32.msi
Filesize3.0MB
MD5bf833c6364de613e0e8cf9e8dfef2c3e
SHA137a675e55b00a1e91fc9d37f49ce02875f798a06
SHA256efdd3f31a2d4bb47b97fcb60e3256d27394f992edcf300ad2c6ad35a5d34b0fe
SHA5123079a027422b3a56d86cf8552d3182c43c82f5ee98f449f7e91c05eeea193b700ca06f9f4dbf241ed1ba91c20cf3ed4683def3e24d631ca536af663d06555b8f
-
Filesize
605KB
MD5363b68a62ff7856fa1a13ba53ed43780
SHA125dabe1109375a4a517c291d74fe773b5d4e5411
SHA256a506a847c26062ac008ac3805dff079b368477bdff14bc4cace273669488dbcd
SHA5124eff2130728c7ff1e677221577d1f61a408c8aad30caaa1576ff982111aa6f202aa0a6bbdb5b12c7c08d8e52526d268fc90aad67636dcf1f4c102d09ea61448c
-
Filesize
785KB
MD5c44a6bc8d8dc542a38883f8a85b97e4d
SHA1a5749d322c90f4b3636cac0908a3bc7c5e7a5041
SHA2561b3c3038363f0024204a97fd8727e7898ef3f7c30c2f5cffe0e0d818d9ee7670
SHA51223f81183b9bf91c63765802ef7ba320f3ba7735533fa4d8ad0c03ba41b210d1bb2b4bf5f578215b48703d7228e198a9232b1596140594df04c7702b3691ec48c
-
Filesize
599KB
MD5bce8242ee0b0952b5bf13bbfc9edc9c6
SHA1fc2147e9457d55683cbbebedf1fb65a1880f800b
SHA25616680dc8f03401eed6cb3f2a4844c4d3c8c58cbf53ac0cd9be2bdbbbc1aae6c6
SHA512ee2c61aa09664b0b8cb4d2f5a6938f9d64b77dea6bfbbc48c339e1eee1a8690f66421cfdd94f2a4c2fbe4242d4015e6b123d73a370e8e7f619f8d6fbb1d81bb5
-
Filesize
1.3MB
MD5217bfb0ee7912d5db9497401a1ee3434
SHA11a87a41743e9eab72d2ab00a6199c2e01bec07a2
SHA2566425191a90217c69010b7de2c7e9f9a461fee5180ab0a48f71362762a82a7dbf
SHA512c692d5fdff909da6417b15a2bf32c8fdb3c605d99ce78fb7fcec5de3cfb14214a384a843172d266c676e567adc7b4293847f62419f0a1a474414c455d0d041a7
-
Filesize
1KB
MD51ae0208537f6b76acf47e12003c928a5
SHA1844f99037fafb29b9530ce827a20c08dee3291df
SHA256bb2dd7cf91eccba0d03d0e02913f612af00552c8c68dec5295da34714dfe1643
SHA51288894e0493c74c953493e52e5f168fff9cb58ca7cf6cffeae0594e1f9b9dee3eff9eb8be8dd9305a518a55cb6e03a86dae5af0a5b43ae546f569e8273242de3e
-
C:\ProgramData\Microsoft\Windows\Caches\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db.deadfiles3
Filesize624KB
MD5d07630f87147ece243816ecf4de842fc
SHA1776f6a1aedd805f2f7e2ce75da9da9ebf0ca6900
SHA256cf61be5f3e52222e25888661cdc0006037351a548b3f4ec52c6843458fe318a7
SHA512f18726079122b1c2934b7c155fa92a056b70ab033d5da95cfab4c23ee9297631df27ac76f8e29fbd6c8223391e77fb05b3172dd287a1511dc2106c2cbbd6f18b
-
C:\ProgramData\Package Cache\{662A0088-6FCD-45DD-9EA7-68674058AED5}v14.30.30704\packages\vcRuntimeMinimum_amd64\vc_runtimeMinimum_x64.msi
Filesize181KB
MD558e596438a04881b597c96013460d030
SHA1e3a93e7f1d37e0793c79d9596000c48b2bab2405
SHA256c5e1b0d233809d4453e8690fa67f1465a1c064fd83065d1da2a27c10d6b63d82
SHA5127bc4f39d0f0cb53ad6034f2a1e2707d0f1e6b39e281b6fe2570fd493e4371747381fe3155a08c6935139d8095ff9f89bda22347b12d3f2b316461306c8580e00
-
C:\ProgramData\Package Cache\{C7141A99-592B-4226-A4E9-B767C1D0FBAF}v48.100.4028\dotnet-host-6.0.25-win-x64.msi
Filesize737KB
MD5c958a5f7b4cee3919fbfb1d59c0ae941
SHA1b540c2cfd23093136fda66efb3eed1cc7408fe6c
SHA256b30c895f4e478c7ce26282aed7bfbed2a6333fc64424276b9ab0241042e236fe
SHA512b3dd815e11566c4e3cd30053e475285666bf2a63c21017150751991d60c8532a6369401b9f286dea35f11b119f92beadb1f2735dd9cf9f0425b434fd57deb66f
-
Filesize
1KB
MD59e05454721cfcd1d7eee10841779d673
SHA1010632b62fa73e020fdc9a763f9bb670dbe3b764
SHA2568b214b647b8e42ef219c253e089b6ddc0c21bb3b2743c701c64536d5db327557
SHA512530059310f5bc69686fe976dd2a565dc489503dd1e4da3f5fdd7398d5025aa886bba52d748b3e70e838cb2a0a51f2a4ab1aaef16a4e13a5f2a4c51b83a7b34e1
-
Filesize
5KB
MD5c9a7d60dee2c82eede6446b3bf941c21
SHA130731dfca6ac1865646171569bb9062c7d646469
SHA25644d33e1dc11c53cf634973e85804866becc729e7a818645ad9d4ec1ba5f30044
SHA512ecbd21827fdacfdbb30e6958ae2f6f911c3ee37d19cb8e0cc399659f8fd17b40c45926423dbc7758ab820599eaafc3a1747442a8a1151c968da8324d8d60c865