Description	Indicator	Process	Target
PID 2924 created 1068	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	C:\Windows\Explorer.EXE

Deletes shadow copies

ransomware

Modifies boot configuration data using bcdedit

ransomware evasion

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\system32\bcdedit.exe	N/A
N/A	N/A	C:\Windows\system32\bcdedit.exe	N/A

Renames multiple (7586) files with added filename extension

ransomware

Deletes System State backups

ransomware

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\system32\wbadmin.exe	N/A

Deletes system backups

ransomware

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\system32\wbadmin.exe	N/A

Adds Run key to start application

persistence

Description	Indicator	Process	Target
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\BabyLockerKZ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe\""	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\BabyLockerKZ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe\""	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A

Enumerates connected drives

Description	Indicator	Process	Target
File opened (read-only)	\??\S:	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened (read-only)	\??\K:	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened (read-only)	\??\V:	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened (read-only)	\??\A:	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened (read-only)	\??\I:	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened (read-only)	\??\N:	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened (read-only)	\??\O:	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened (read-only)	\??\T:	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened (read-only)	\??\X:	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened (read-only)	\??\F:	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened (read-only)	\??\B:	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened (read-only)	\??\E:	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened (read-only)	\??\L:	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened (read-only)	\??\R:	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened (read-only)	\??\U:	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened (read-only)	\??\W:	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened (read-only)	\??\F:	C:\Windows\SysWOW64\cipher.exe	N/A
File opened (read-only)	\??\M:	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened (read-only)	\??\Y:	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened (read-only)	\??\Z:	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened (read-only)	\??\A:	C:\Windows\SysWOW64\cipher.exe	N/A
File opened (read-only)	\??\G:	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened (read-only)	\??\J:	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened (read-only)	\??\Q:	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened (read-only)	\??\H:	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened (read-only)	\??\P:	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A

Drops file in Program Files directory

Description	Indicator	Process	Target
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\alt-rt.jar	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Merida	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened for modification	C:\Program Files\Microsoft Games\SpiderSolitaire\es-ES\SpiderSolitaire.exe.mui	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0285796.WMF	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\RTF_BOLD.GIF	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\BlackTieMergeLetter.dotx	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened for modification	C:\Program Files (x86)\Windows Media Player\ja-JP\setup_wm.exe.mui	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\ja-JP\css\currency.css	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened for modification	C:\Program Files\Common Files\System\msadc\en-US\msdaprsr.dll.mui	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\St_Johns	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File created	C:\Program Files\VideoLAN\VLC\locale\nb\How_to_back_files.html	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\How_to_back_files.html	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Grayscale.xml	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR37F.GIF	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\attention.gif	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGCAL.XML	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\license.html	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-jmx.jar	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Europe\Tallinn	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\lg\LC_MESSAGES\vlc.mo	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\js\weather.js	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EVRGREEN\PREVIEW.GIF	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File created	C:\Program Files (x86)\Microsoft Office\Office14\OneNote\How_to_back_files.html	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\FAX\UrbanFax.Dotx	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\EmptyDatabase.zip	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\css\How_to_back_files.html	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director.app.nl_zh_4.4.0.v20140623020002.jar	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File created	C:\Program Files\VideoLAN\VLC\locale\fr\How_to_back_files.html	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01245_.GIF	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\attention.gif	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Santa_Isabel	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\120DPI\(120DPI)alertIcon.png	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipsjpn.xml	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Indianapolis	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\eclipse.inf	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.eclipse.nl_zh_4.4.0.v20140623020002.jar	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-coredump_zh_CN.jar	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AFTRNOON\AFTRNOON.INF	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH01242_.WMF	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0090089.WMF	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\203x8subpicture.png	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File created	C:\Program Files\Java\jre7\lib\zi\Antarctica\How_to_back_files.html	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0106124.WMF	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SL00298_.WMF	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\SMSS.ICO	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\WANS.NET.XML	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.metadata.repository.nl_zh_4.4.0.v20140623020002.jar	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\fr-FR\msinfo32.exe.mui	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\InkObj.dll.mui	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.commands_5.5.0.165303.jar	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened for modification	C:\Program Files\Java\jre7\lib\amd64\jvm.cfg	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\css\flyout.css	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0152878.WMF	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\Customer Support.fdt	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\weather.html	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-dialogs.xml	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Moncton	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\es-ES\How_to_back_files.html	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File created	C:\Program Files (x86)\Common Files\microsoft shared\Help\1040\How_to_back_files.html	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA00068_.WMF	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.COM.HK.XML	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0215070.WMF	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\zipfs.jar	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File created	C:\Program Files\VideoLAN\VLC\locale\el\LC_MESSAGES\How_to_back_files.html	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A

Drops file in Windows directory

Description	Indicator	Process	Target
File opened for modification	C:\Windows\Logs\WindowsBackup\Wbadmin.3.etl	C:\Windows\system32\wbadmin.exe	N/A
File opened for modification	C:\Windows\Logs\WindowsBackup\Wbadmin.2.etl	C:\Windows\system32\wbadmin.exe	N/A
File opened for modification	C:\Windows\Logs\WindowsBackup\Wbadmin.1.etl	C:\Windows\system32\wbadmin.exe	N/A

Enumerates physical storage devices

Program crash

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\SysWOW64\WerFault.exe	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe

Interacts with shadow copies

ransomware

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\system32\vssadmin.exe	N/A

Kills process with taskkill

evasion

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A

Runs net.exe

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeDebugPrivilege	N/A	C:\Windows\system32\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\system32\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\system32\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\system32\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\system32\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\system32\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\system32\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\system32\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\system32\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\system32\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\system32\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\system32\taskkill.exe	N/A
Token: SeIncreaseQuotaPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeSecurityPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeTakeOwnershipPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeLoadDriverPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeSystemProfilePrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeSystemtimePrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeProfSingleProcessPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeIncBasePriorityPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeBackupPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeSystemEnvironmentPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeRemoteShutdownPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeUndockPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeManageVolumePrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: 33	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: 34	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: 35	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeBackupPrivilege	N/A	C:\Windows\system32\vssvc.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\system32\vssvc.exe	N/A
Token: SeAuditPrivilege	N/A	C:\Windows\system32\vssvc.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 2924 wrote to memory of 2492	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	C:\Windows\SysWOW64\cmd.exe
PID 2924 wrote to memory of 2492	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	C:\Windows\SysWOW64\cmd.exe
PID 2924 wrote to memory of 2492	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	C:\Windows\SysWOW64\cmd.exe
PID 2924 wrote to memory of 2492	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	C:\Windows\SysWOW64\cmd.exe
PID 2492 wrote to memory of 2652	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\system32\cmd.exe
PID 2492 wrote to memory of 2652	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\system32\cmd.exe
PID 2492 wrote to memory of 2652	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\system32\cmd.exe
PID 2492 wrote to memory of 2652	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\system32\cmd.exe
PID 2924 wrote to memory of 2576	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	C:\Windows\SysWOW64\cmd.exe
PID 2924 wrote to memory of 2576	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	C:\Windows\SysWOW64\cmd.exe
PID 2924 wrote to memory of 2576	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	C:\Windows\SysWOW64\cmd.exe
PID 2924 wrote to memory of 2576	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	C:\Windows\SysWOW64\cmd.exe
PID 2576 wrote to memory of 2508	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\system32\cmd.exe
PID 2576 wrote to memory of 2508	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\system32\cmd.exe
PID 2576 wrote to memory of 2508	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\system32\cmd.exe
PID 2576 wrote to memory of 2508	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\system32\cmd.exe
PID 2508 wrote to memory of 2388	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\taskkill.exe
PID 2508 wrote to memory of 2388	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\taskkill.exe
PID 2508 wrote to memory of 2388	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\taskkill.exe
PID 2924 wrote to memory of 2420	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	C:\Windows\SysWOW64\cmd.exe
PID 2924 wrote to memory of 2420	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	C:\Windows\SysWOW64\cmd.exe
PID 2924 wrote to memory of 2420	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	C:\Windows\SysWOW64\cmd.exe
PID 2924 wrote to memory of 2420	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	C:\Windows\SysWOW64\cmd.exe
PID 2420 wrote to memory of 2556	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\system32\cmd.exe
PID 2420 wrote to memory of 2556	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\system32\cmd.exe
PID 2420 wrote to memory of 2556	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\system32\cmd.exe
PID 2420 wrote to memory of 2556	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\system32\cmd.exe
PID 2556 wrote to memory of 2288	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\taskkill.exe
PID 2556 wrote to memory of 2288	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\taskkill.exe
PID 2556 wrote to memory of 2288	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\taskkill.exe
PID 2924 wrote to memory of 2496	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	C:\Windows\SysWOW64\cmd.exe
PID 2924 wrote to memory of 2496	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	C:\Windows\SysWOW64\cmd.exe
PID 2924 wrote to memory of 2496	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	C:\Windows\SysWOW64\cmd.exe
PID 2924 wrote to memory of 2496	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	C:\Windows\SysWOW64\cmd.exe
PID 2496 wrote to memory of 2396	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\system32\cmd.exe
PID 2496 wrote to memory of 2396	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\system32\cmd.exe
PID 2496 wrote to memory of 2396	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\system32\cmd.exe
PID 2496 wrote to memory of 2396	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\system32\cmd.exe
PID 2396 wrote to memory of 2412	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\taskkill.exe
PID 2396 wrote to memory of 2412	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\taskkill.exe
PID 2396 wrote to memory of 2412	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\taskkill.exe
PID 2924 wrote to memory of 1876	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	C:\Windows\SysWOW64\cmd.exe
PID 2924 wrote to memory of 1876	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	C:\Windows\SysWOW64\cmd.exe
PID 2924 wrote to memory of 1876	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	C:\Windows\SysWOW64\cmd.exe
PID 2924 wrote to memory of 1876	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	C:\Windows\SysWOW64\cmd.exe
PID 1876 wrote to memory of 2832	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\system32\cmd.exe
PID 1876 wrote to memory of 2832	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\system32\cmd.exe
PID 1876 wrote to memory of 2832	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\system32\cmd.exe
PID 1876 wrote to memory of 2832	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\system32\cmd.exe
PID 2832 wrote to memory of 3056	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\taskkill.exe
PID 2832 wrote to memory of 3056	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\taskkill.exe
PID 2832 wrote to memory of 3056	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\taskkill.exe
PID 2924 wrote to memory of 1452	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	C:\Windows\SysWOW64\cmd.exe
PID 2924 wrote to memory of 1452	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	C:\Windows\SysWOW64\cmd.exe
PID 2924 wrote to memory of 1452	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	C:\Windows\SysWOW64\cmd.exe
PID 2924 wrote to memory of 1452	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	C:\Windows\SysWOW64\cmd.exe
PID 1452 wrote to memory of 1256	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\system32\cmd.exe
PID 1452 wrote to memory of 1256	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\system32\cmd.exe
PID 1452 wrote to memory of 1256	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\system32\cmd.exe
PID 1452 wrote to memory of 1256	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\system32\cmd.exe
PID 1256 wrote to memory of 1276	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\taskkill.exe
PID 1256 wrote to memory of 1276	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\taskkill.exe
PID 1256 wrote to memory of 1276	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\taskkill.exe
PID 2924 wrote to memory of 2044	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	C:\Windows\SysWOW64\cmd.exe

System policy modification

evasion

Description	Indicator	Process	Target
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe

"C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe"

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c rem Kill "SQL"

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c rem Kill "SQL"

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlbrowser.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im sqlbrowser.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im sqlbrowser.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sql writer.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im sql writer.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im sql writer.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlserv.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im sqlserv.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im sqlserv.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im msmdsrv.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im msmdsrv.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im msmdsrv.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im MsDtsSrvr.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im MsDtsSrvr.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im MsDtsSrvr.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlceip.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im sqlceip.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im sqlceip.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im fdlauncher.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im fdlauncher.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im fdlauncher.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im Ssms.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im Ssms.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im Ssms.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im SQLAGENT.EXE

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im SQLAGENT.EXE

C:\Windows\system32\taskkill.exe

taskkill -f -im SQLAGENT.EXE

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im fdhost.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im fdhost.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im fdhost.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im ReportingServicesService.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im ReportingServicesService.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im ReportingServicesService.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im msftesql.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im msftesql.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im msftesql.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im pg_ctl.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im pg_ctl.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im pg_ctl.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -impostgres.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -impostgres.exe

C:\Windows\system32\taskkill.exe

taskkill -f -impostgres.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop MSSQLServerADHelper100

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop MSSQLServerADHelper100

C:\Windows\system32\net.exe

net stop MSSQLServerADHelper100

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop MSSQLServerADHelper100

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop MSSQL$ISARS

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop MSSQL$ISARS

C:\Windows\system32\net.exe

net stop MSSQL$ISARS

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop MSSQL$ISARS

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop MSSQL$MSFW

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop MSSQL$MSFW

C:\Windows\system32\net.exe

net stop MSSQL$MSFW

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop MSSQL$MSFW

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLAgent$ISARS

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop SQLAgent$ISARS

C:\Windows\system32\net.exe

net stop SQLAgent$ISARS

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop SQLAgent$ISARS

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLAgent$MSFW

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop SQLAgent$MSFW

C:\Windows\system32\net.exe

net stop SQLAgent$MSFW

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop SQLAgent$MSFW

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLBrowser

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop SQLBrowser

C:\Windows\system32\net.exe

net stop SQLBrowser

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop SQLBrowser

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop REportServer$ISARS

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop REportServer$ISARS

C:\Windows\system32\net.exe

net stop REportServer$ISARS

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop REportServer$ISARS

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLWriter

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop SQLWriter

C:\Windows\system32\net.exe

net stop SQLWriter

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop SQLWriter

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c vssadmin.exe Delete Shadows /All /Quiet

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wbadmin delete backup -keepVersion:0 -quiet

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTATEBACKUP

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTABACKUP -deleteOldest

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c bcdedit.exe /set {default} recoverynabled No

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wmic.exe SHADOWCOPY /nointeractive

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c wbadmin delete backup -keepVersion:0 -quiet

C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe

\\?\C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe -network

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c bcdedit.exe /set {default} recoverynabled No

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTABACKUP -deleteOldest

C:\Windows\system32\wbadmin.exe

wbadmin delete backup -keepVersion:0 -quiet

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c wmic.exe SHADOWCOPY /nointeractive

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c pause

C:\Windows\system32\bcdedit.exe

bcdedit.exe /set {default} recoverynabled No

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\wbadmin.exe

wbadmin DELETE SYSTEMSTABACKUP -deleteOldest

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c vssadmin.exe Delete Shadows /All /Quiet

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTATEBACKUP

C:\Windows\System32\Wbem\WMIC.exe

wmic.exe SHADOWCOPY /nointeractive

C:\Windows\system32\bcdedit.exe

bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\vssadmin.exe

vssadmin.exe Delete Shadows /All /Quiet

C:\Windows\system32\wbadmin.exe

wbadmin DELETE SYSTEMSTATEBACKUP

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\SysWOW64\cipher.exe

cipher /w:\\?\A:

C:\Windows\SysWOW64\cipher.exe

cipher /w:\\?\C:

C:\Windows\SysWOW64\cipher.exe

cipher /w:\\?\F:

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2924 -s 788

Network

N/A

Files

C:\MSOCache\All Users\How_to_back_files.html

MD5	40e139987a37aab7d96cac47567e546a
SHA1	d30784a4149cb0800a00b8c53bf86b3de534beae
SHA256	ca92eb4174acb6632602c0e2682a5dfcff5eaa7db59b5453b029a0b6adf7e1f8
SHA512	77508d896e7c8a7dccdcf5bc0593a941b8468fea5364de8c1a0773d63e270360a5a58f61a5f6eecbb1416c7ce84f336c08219b948aaf2c8e1cf60ceb6e4eea04

C:\Program Files\Java\jdk1.7.0_80\db\bin\ij

MD5	d60722e7f6a8b256d3ca00b2586bfb8d
SHA1	4b16c3841a931c0b5ec06f3e8e21d82a94552447
SHA256	574be12f950ee398cacdf10a438d3f1275c7b3c4e7fa036377fa2c65396fa1a6
SHA512	82f73f92743f0ce570105eee29233fa07f44a3c699f63903ebe30d6e33720c13bbf1b828b5d5c908f8201416efd9c3f36bed8e8bec23e7342bf0729f0ff6cb53

C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif

MD5	56b7edce11949fd9c1f187922b0b538d
SHA1	40c5dfa1fdee9c6a8c8000e0b3a1c9d08ae1aa0d
SHA256	e558c94d60b4b7cbfc0b9c806729c9ba8d95da57b5fed506c866ba78275b908c
SHA512	912ca9ca2e6db9b521eca2535563a591cd9fc9d76a73d782a9def95efd67fb0315fe9431806e276ce87191c6605d60f87352622fdcb2144f2fbd5ae5b4e4deaf

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\UTC

MD5	579c9801643298c9cc8b13b717fe5458
SHA1	85758c704d80ae864006ac8e6e1bf614ce644da2
SHA256	9d7dcd12e0b2abf3f88ebc35b6955c16a5a5dadad36df0e835a22d7ee34d1d9f
SHA512	c29efe28d898bdda65317e5c86b3740ecb31dbfbf313d1e1d7e0ea5c0a32e1312065573c6a848dda11dace91e5e6e26d1d4bde10bdda6e7ec46619671d976cc5

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\MST7

MD5	30c67c3fed14a53ca53e68f0871b46c1
SHA1	32c01ed5e8673b2bc1d7be7b7f8c90556be84094
SHA256	0779c5a828cb7d361fbfacf5a912124a04592f36de519f0fee5c8df45b64e18e
SHA512	a7d87b3467c50361a00392d33e3464e343481f9c966e7d080b7b130f72b3736cabfdfbc89445d835b6fdd4b978327e60aa9e80a27c675908da27de0b0bfd6fa2

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\EST5

MD5	223ee2a3361caf05d88c0d73b2d2052e
SHA1	7c33de6299475956f06556d6a986cb8f5ae52a74
SHA256	65d3e4493163a76f135026d08ed6596da129106919a1fa9a4ab54e1520a56f75
SHA512	ff545b88bc0f70c94512bf4e9dc696f7d8edffbb8fd2decb1deeae8a7c5a37ff5c5c0d7a7d431c6b44d25ae64b4d6a2dc1ae2d727fa862bd14f4a60cf8a812b8

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\HST10

MD5	02e3bef1680978b602c57b7896b34b2a
SHA1	cea6db66298d2ec89b7c7ab6228f4af92bc22760
SHA256	d6f54ada700061c31f6d2dfc8422f14c9d19a18046baf9ef721fe10da688b6d8
SHA512	5d8d5fd89e12b6661914a0af6e18315762e140098914de08b8ea4ad88e31789ebcc32ddff09127ae41ab3655f637298d1b4275371323b49bd6f7ba743396807a

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html

MD5	3481a9ffc4302e0d59906e1c12e65331
SHA1	4c057314ef54fe0610a1f9117d94bfe349d46f11
SHA256	3b469a44e3d4a06410855443943f2f28534ef9b96deb0241f20576240419102d
SHA512	027faf6931f33c3bcae4f0a0b6b80332712c20c25844d799e0665496c9bb9c404a8c884fcf22fb8ca2e168b0b5822c1528040d33792bf21b2925bdcffea61e74

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html

MD5	46076380311425e42de8dd4677d39766
SHA1	4166d2f88a75e54ba4b3220ed6d97cac126a2ffc
SHA256	f5c09d598cbc1f492c489f54a75fe4fe2bb31cca4340a8d83b64568697abadd0
SHA512	b04a3513dba627656613f475b29e07759ddfb853154f23bb7154342167fcb52f56488a3a9d28ac85b41aff1e3b1e1ff54741b2db51c0c4c50d2b47a050b61122

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\eclipse.inf

MD5	6b321a56e5fefef3cb68e8ea800e9329
SHA1	cc7da1687f7d5eae030d70d3c3a3846d599fb0fe
SHA256	135888aef95df3bcafef4b59a5a134578402d6b90298219a04d097e9f4300afb
SHA512	2aef39b98e39b15415c2f5751b11cc8a741fda56febc84c65459187b5070e06782e54501bb0496c75348592f780594ad215d9d53d8f9836ddb85a395c7c29854

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt

MD5	d0606de97d438b18f4b5b1feb720d9f7
SHA1	bf7477843399ddeb405a81b74604dd039cf4a4a6
SHA256	9d0990f1a4db6a6293144cf6b022d7192a9c713bfa6a591f2a00ea4dd76f193b
SHA512	f89c11a707f001e94531a3ecd88e950c5670dd32ec4ae33f6b5f7a8bddc6735625fb92aaa61c073782765bf2a8fefd1b5c242e00ddd313285c144ebced471a65

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.RSA

MD5	e1d7007bbf06573cf4012d78b27a9ca1
SHA1	322de97a2a640864617099c25d237047ce340b1d
SHA256	2837758afde4e4e5714f56fd18d66982c213eeb9b37b640310fca2cc12cf766a
SHA512	80aaa696c5440f8529ebf2b0cb321f4d0713705bdc2523c30feb82ba016d2e2f0be90bb4ebb426690e77f0218242cf4136a6f4e1ef209b4baf8c8b39fc7e695a

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\ECLIPSE_.RSA

MD5	77d54446bc5dc67a68dd79f2567445cc
SHA1	8c6aa013e49c8d461b366ed23f0988be2ca2be45
SHA256	aa06ee94cde0f22ae474b7504fe6f6ce19d2f6ac7057aee25385c755317f48af
SHA512	cf50111519573629b27c3840c385ed6977ae86b0214110858d0e879afb539a65921bc8a725832b5ec93efc6c57416565f5105bdf127dbbfae5b67e1a12d70a1e

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\META-INF\MANIFEST.MF

MD5	c8143235e21fee9e08049306c41a73f5
SHA1	a4a6c2f3bb480abf1ff4cbc22e6038f0eeef7727
SHA256	370f4f19f5683f09569b1e6a8e690f45bdd8be2a018f8394351febc2c6335dc3
SHA512	d1ead51403fa074df38323169a93aec1c4edd3a8cac9b4b4298c6edec75819261b2db4f18441acacf6c505fb6ee48b9cb5b501fffd24420291e86bbbd79d2f09

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-lib-uihandler.xml_hidden

MD5	55f39ad863a613e9747ff36765a25eea
SHA1	dda21bc722a3e62d002348aa37be0182d0420338
SHA256	9ddf0af9b0852e72eb842297f4c549c07d95d10c8a546098281bb4fe1e4a2601
SHA512	c0912e79daad5b5fe1ef16e1bb0389ea72e0e3ac06e02262af403ec85b68ecbed8a370b725e4a112f9729e0258a18dd59387ab1319cd6614f1534adcd51af5f9

C:\Program Files\Java\jre7\lib\images\cursors\win32_LinkNoDrop32x32.gif

MD5	abde29eb0b55636aa146e16437632dab
SHA1	d0019df366f6e120eba0fb99ed51fd0bf07ffe91
SHA256	cd9a4dda1b07b8cd154cd088c68aeec1f6554963fc8706b1285e5f812141b711
SHA512	90e2f171b18a6278b66a15ea827f4c8e5ce9b78e6c8151ff6724ebedb04e3024170885a743946c604ac2443b23c9d088df56fb05c69eea0032bab5f1fb73f40f

C:\Program Files\Java\jre7\lib\zi\Etc\UTC

MD5	01f489aaa3855e3b0eda665b9aec7163
SHA1	2d198ab23b81a939be928430399a749cd6215ec4
SHA256	f6e4ddbe226b267db076f57b4e9925a30bd9b4c60d227f69753091298b998d61
SHA512	3c2debd390bf392a1ba65b474a5d6e22d2a97f4d56497926f2abb0a7c8045e25f371f89d214fecc2179d89fb0a02be3e05d2456a318b9ba0a23fc0b2cbed160e

C:\Program Files\VideoLAN\VLC\locale\eu\LC_MESSAGES\vlc.mo

MD5	9931374e43013823e08a0d4c9d06af42
SHA1	fed94749ce18feecbf11b8d7a794877dd5353a6c
SHA256	f93768bece1c6b903fcb6a063950c2ab5ec057acbf6e2830205ab1e3782aaed5
SHA512	0acb03da61daf95cb98055ff6962c9ffb1305930720e5010503a6c819b3f9c6bd2d880d35ef74c353c1b8ed34c934ad638b7395060a776d016fcce30e4fe7a2a

C:\Program Files\VideoLAN\VLC\locale\mai\LC_MESSAGES\vlc.mo

MD5	f60dffb87c8999105cd8f6e5e22f9d5b
SHA1	a2005a69082c8eb7cf4bec571d79df253714ff76
SHA256	6a90d0e61dbbb290a5b892d6ec74dd559aa3b10c34443fb75ceb45b31d5f54ca
SHA512	bd0e31cbc62512ff7b71c80aab0c9069cb267f728e40a903a5b4381b623eebf629334e47f1bfbcfe2d23a7531a9cb86fcbc52a30e18d2ac1f80d30903ef34529

C:\Program Files\VideoLAN\VLC\locale\tr\LC_MESSAGES\vlc.mo

MD5	4ee5481a65d331da1e95afef96108eec
SHA1	5c186fee8e8b525ff14b5c162cb293e228411f60
SHA256	6d105c24e1a7ff2cccd9b47dcdd790c66b6470689315292f717d9d2f7dc239cc
SHA512	bc3fa4201b5b65382e58e35dfba7e55562132f4e72dcbf43a73358e936da36830ea10c8270440dcfd7854e267c41fee89852fb7318df51aa0fb6805f2f48c774

C:\Program Files (x86)\Microsoft Office\Office14\1033\EXCEL.DEV_F_COL.HXK

MD5	a4a46155481bef74fca324c1cd0c02ab
SHA1	5896dcc6a53f8797ea730d8251cd26308832ed92
SHA256	f57e948b4a19f5736eae81a6a8ae8213df5aab89dd9dce65237ffa0c8c35a836
SHA512	efda36a3db7d764595a2b396da13525f9da75a1d4e4ce27117af484e2162852e25378e42762e413963ea1008756890ae5322b657ae2135a8718bd9e8d5e327da

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Americana\TAB_OFF.GIF

MD5	a3052dd2c9609f11e297ca7e5c3e69dd
SHA1	54bdea997abafd2d5264928203deec694264e371
SHA256	fe59410e2541ced881b9a3d5e54b989f94ce4b9345865b169e79eb4106ad9a0c
SHA512	996d16bd2e77de925e1134b435dca5ef8dc5c282fe3885cc1c372ac3714c896930eab50c9ad04bd617a6a87ba2b9457e7f5869e4c0157cb81fded74394b46c6d

C:\Program Files (x86)\Microsoft Office\Office14\1033\GRAPH_K_COL.HXK

MD5	b9c74c2e93e1299ccd0d5e0dedd5fcf2
SHA1	b86e49de42dcfa1ffb2e65a6f65e1df5c12cf401
SHA256	cb8fb1b6f1879398b46a2f17723cc680243fa2307a3d37ec38d1740f855f00ad
SHA512	1705e3196f9fc03db862901d849a713c67ef3f0d42ff72e9fba6cfd6a81d4df4879e8e4091af16ec8009377cf7cc816638f22ceb6e80a112e06a56d4ab50904a

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_ON.GIF

MD5	b741872a8625a4a8d1129a027dbb9ad0
SHA1	50a52710b45c3b6dd67035bdb9ed5343694b1e1c
SHA256	5e35af864c4966f96e4b56037103e492db0a2182f0cfa42526f64b378636a555
SHA512	6623711855ff0ae30ab70e11b4b12c526f045960bbcedf70098837db4153c4656a4fa2c920845b21eba82ede2491b0d7dbda0bde9136b91770a5dcf75c18cb23

C:\Program Files (x86)\Microsoft Office\Office14\1033\WINWORD.DEV_K_COL.HXK

MD5	b49c479565686925369206697cda1a91
SHA1	74b4074ee9ee80c7497eda904ac08be5b6a31193
SHA256	adaf582728f5f53e6217243678b68f9a87457a8581b52d83834d639a6c94ac90
SHA512	d4e6ecfe02b7a0bb38d9b219dd81fddf46047e2773d6b6b89b4b7f5908b88bdfc71254b4d4593141769ca50435cf1f7381261fd265cdca3f63a3b0476a9f7114

C:\Program Files (x86)\Microsoft Office\Office14\1033\WINWORD.DEV_F_COL.HXK

MD5	cbaa7f790ecab48b7a0d47696e6f192a
SHA1	8609e8bbe2d5d1912c9b8a4e42c671d8ac70c9dc
SHA256	f453b180370f83973552b4b9d9bafbd67e2c71092e8b097fd96f333f3ce030e4
SHA512	98ebf7669fecef145d18ec44da005e6c62d9a44a44020a7c50c97bf40ea72db7880ccba241d4b10de1999495d821f13238c8c32218f5cd0843d35a1d31f23785

C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\Style\ISO690.XSL

MD5	4803cd64014065a105a824ec94d04055
SHA1	3429ee7e228c0e7aa0d50d2fe92671ebf49d6bce
SHA256	ec7b78859742dc6461b9bb1571d0b0f3ad0d779491e7cae289622e5067553104
SHA512	ce149b5da50fe8a792dbd193d804f717f99a43e69bc0357531bb5dd781c71b790efdb6ea52169c2d3eabbb9b1b939a597cae110b9da68a7a887ed659a4bbd46e

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Biscay\TAB_OFF.GIF

MD5	565eaae039ba117584748bfde5a4eeb3
SHA1	7406b8e8c3459b143c23d0a7f8aa78adad689d8c
SHA256	c819975c6bec8380709c83f28ec6253e2af67edfecde7b85aa844080dbbc4af1
SHA512	831f2717b4b4db47a23593799ac05fe4d4ec9d97683ffc9e226eab4185b298a5d345e63dd31efec47eeedbb61317945f22b2e9da0326f400bb85d000154a8b55

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Biscay\TAB_ON.GIF

MD5	3c420b5062131cb02380a9693c2b6af5
SHA1	5d65c3c446db475bba0f568b56341ba530a83a2f
SHA256	26181166ed2705e8bb7a3ad742f0e3cac47351edc5e806e0ad7e7a9e4014f4a6
SHA512	e9e69310ed12c8d89c19e1a955f3565c44f6a981046f2a76c9b0b560484b72a3534a1f61c7908e489f9998d1371c0ede6a2e7d67c9b8d5124715c6e0ae4fe6c2

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\BG_ADOBE.GIF

MD5	430c8fbb32b0a5ff5ce49592f1589472
SHA1	b479375be6751e073fc13d0ba92ca397fcf3038b
SHA256	c7022d66e7ffda84b01d3a0e80779a1f5d5e0e735c9c76319ae1a7d87db2c07f
SHA512	6525fa7dbb1acedf22c7f4351cf9061d5cff75028b57556367dda5e34fb0d5c5a4562ef70efc61d048625ef2d9e121801576e6e4b00c3dfb7997346cb65131f6

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_Country.gif

MD5	5c5746e8c2a4ac6fa695b2be978a34bb
SHA1	7785bb856f0563d9cbbdb9c2effcdb5b7b232e25
SHA256	d127785229aaa84b1d5feed3134ce8e6be7c517a92adfcbbca6cc540173664d1
SHA512	386b8570c92e01baab54c7f0c33e2a64fd5e3159e313fa47997e435b20d2b1dae1dfeea47be1cb5e6ef19f9540710df1fb94f2b9731c550ba36984833dfb4ca9

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_Casual.gif

MD5	7973fafd034f75da62876945bd0e5696
SHA1	83f4744656fea021861d169d8a0b8a50e9fad939
SHA256	31add430eb4f29dd0d0d0e53b635607b88ab33c3351f0f6d4e32cb58b92320d4
SHA512	07d4c6e6af7ca7450e69b2cab3ebd6b3059ec272ca9e8e9a549e2834936922ca44192b4c7e2ad49bdd178ac231ac76760144d99b01adbc4410feaf0dc74c41d8

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\attention.gif

MD5	6a5147a463d9bacc0bfae1ff387ae813
SHA1	facd416911e0619109917c23c38330839250ca9b
SHA256	6e79e8628e4418c65946af5417f30c2133d5d4d0287731d45671b73d29f3ff1d
SHA512	b464926397db442c753a6fd1b1649c43976ca63d393ea46deaad979dd2be5e66a03aee5f3eeed816cf75fe81d7e6c1bc80cc73dbc456bd0346723e3891b4de71

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrow.jpg

MD5	6e8c464886ac33d175fdbc0056c62cfb
SHA1	db5009283e341f462c58f2a7982e197801c1f77c
SHA256	0287dae47033c0732d3290b9b3693cdf98956eac712768a97889f15145bdbf75
SHA512	cbc521e2f3112aa361a2b9031593c37b982b07a37362d04521f336b1518013bfbec05469ad37a84014d5b31c6d61ebcee0d0c7a5ce1a8c0b4976e4d2502270e5

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_FormsHomePageBlank.gif

MD5	58c58137a52dccbf92944d40535e74d5
SHA1	a1acf49c28525369cc7f30e6d927087c10176a61
SHA256	e16287d59cdbe994209a37b724995a5ee44e2206678225b4977f3be9fa550c80
SHA512	69a5351dc912f8fc94b234f9966e238b77bea2ee8cd765ad9336137461364b832ed8584e347f060ba4a539daa159dbe42972da2aa5259e217bf1bdf77c174fe0

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_Groove.gif

MD5	f116b722fa8267090211824c133d9336
SHA1	f5c66862cbe8dcdef8223fd65ff3d6615ed5e0f9
SHA256	b4a4f02eb55881a0c2d38a720245c08595e1111ae70efd3b2b34c5e74ccde370
SHA512	74119a1d8236d0f9f540a8485ff0ac582cf218bebf227a1756cfbee6f9ff2a71446f106dd43d6c4639bd3e957f8a832c42b5eaf9c547428370a618eb73ab2d9a

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_Earthy.gif

MD5	e42d2946c2b044dd8d12ed39cb3d0c15
SHA1	b9dff085d0c33fadb0eb99a458d07a943ac28864
SHA256	a12fb8dc15ca06adbc5db0c391a5cebe14d9ccc693af74e4ebb0ca1d9d8d0a69
SHA512	636f9f3f127004baf0cd0472886f628cd1c8296a921c936fbf12d1701883c64abfc13a929fda442755f38193060469ce6befc70827994502950fb4df45234fd1

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_LightSpirit.gif

MD5	afc10a2e0aaf68cd616d3e616ce62c51
SHA1	d6c64ddf8e0158202120623a2b532fe99600d820
SHA256	ff1c8a20400e8d8acdbc471a06ab708c67782433a64f14269a6e004bc09a5538
SHA512	ecb0e34174b2f261bf252ebd5140cdfb6c4f10ab5bf2f115871236d3fcd3869da2ea6507a64f2a76ec08291376fb3672d4539baf5646d72c5743ded20949316d

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_GreenTea.gif

MD5	ea3f41c869e1d713b7433ed149915cce
SHA1	fc3a1519a8da17a47737e905b4286c59b76f71cf
SHA256	c52d0c96bc21773b14e1f82691e676b5a2f69a4ad11a8596fcd6314660bed7cd
SHA512	eba6611787b9c89e7bcb58fe1aec9d3954cd2d340380a292cad9f8262af5e1c209b47aff15d59c2b4e89e0cad85467f590dea9980244bd5f1fd31f9a881afce9

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_Premium.gif

MD5	e68fad9775be44a8b6ed390a6e543697
SHA1	bc897b4f85c2293c28e7d4419b4db11164ef03bd
SHA256	7feb8a460abb623f9d88acfb59dbca4f915a333ec20a1eab4055b52765c25b87
SHA512	adb99a09cb01d07eb18b90b01bd58af931cbfa05ba896f4014850ee8a7780cc3fe22a7aae67e769d863f416f9eec4cee66dc27283cbcf18c18ab9b16045138cd

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_OliveGreen.gif

MD5	9f937aeeee3fd145eea68158d25b8da1
SHA1	cd55c639a41f2be48762ef4a0987cdf3a957d465
SHA256	10f3869a75b6aae94fbe85f30d94dd2ea4aa25642ad66d42be33841ab5fccb2d
SHA512	543b4ebacd29b476b766216079082bff4170a3034466a55cb9c737a36df12da2741ae094ca41c87f7543bc639700399d23bef604414ab8d3b73d9d70a8cbef06

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_SlateBlue.gif

MD5	91f5844b0628fd3e1d0e5eb256ef7090
SHA1	e9fc69b6321af3684e5d6bd7f7c5170f3d6becf2
SHA256	eb4d4c2313d2730b831a230c4ad09280d93689c17132fe425bc8f857dbcd84e2
SHA512	9215bb39062de9bc68e747b77e17c4685930967b4247fb09f320e1d9c5f027a61e38996a4876d35205b834a86f5092f53794ea055867c3d14f0d4f1b71fe8be0

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_TexturedBlue.gif

MD5	ac1a85e3a55d7f9561b397c214a7de45
SHA1	9a83163431be1d3936cd310160e101fc6b88a670
SHA256	0122511eb4d6fa8aaf1a503cf21887155280d826fe6b094ad188c7f5fba93e20
SHA512	998941ae472ad3795f6695724baed33ce5db2aef9612a05885dbf36fec65d7e755bcadb3bfcb82daebc6eeb7c4a2bb3c22464bdd95433fcb34e6338698183ea5

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_VelvetRose.gif

MD5	bf766ef4314acc48cddca73b35c6775b
SHA1	4154d46f338c77b3d08761a39f09ff7c9e826fdd
SHA256	708856b2fc97ef1e6da912ac2a65290ea604f546b502c48a96b28e2f3e54d4a0
SHA512	132d9639e64b21b6d91f91bfbc42e9e739e398c5f01dac6485093ca658a9e86dfc80da3cdae8bb32607185d69d76bdbc95f11e3d4ec7fdad0acf393e144eea2e

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FORM.ICO

MD5	da7fe6465854bc86a28804e09a9a62d9
SHA1	87a3dc30e0c89c245c85d5a9c536ff383747c4cc
SHA256	6e02f798c06baefcaf81c5804690387c6be55873069f5ccc30e9bcd22c0d8dcb
SHA512	dc7061eb71d6a2ddf6ad93fe58950975905baee5b5aaa990768f9fd846a377bde8a2977b06f37c4981221b2cfd05b6aab3205e5872a5d72e5b4c34426fe0476a

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Biscay\TAB_ON.GIF

MD5	4a45aac565747fa5c398f22ae161f8fc
SHA1	b1749e664997abe5b19589020efba08a4ab087eb
SHA256	ab5e49e3bd78979010cf4d2180ecf452512852578f225154086b11b8128fe743
SHA512	5877695c88be65a6d3dbec7d58e52c7f0b128d76e93efcd19fe210a10b628bf8a3eeacf5d968daa426c83fb5786a43616b49c5ca886b2872c40a1eb01c2796a0

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Biscay\TAB_OFF.GIF

MD5	5b81ca2e8df01c20138b8fa028ba2802
SHA1	e7ffb234ce14c687e38d9bf0dca1794ab788d6d1
SHA256	f9bad65840b61f5e361355054a2e79acd89fd591b743b37968e24695f1d90734
SHA512	2880af1c3d70c4faf31cb09f9840963efbab023e1f6c264dad0bce0417fe42da12cca5d1235ff1462e9d827a0c7c085c0080659028aa1f0275eca8b494997ff0

C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\InfoPathOMV12\Microsoft.Office.InfoPath.xml

MD5	e8e886dc1f39136178d74845c1b43f05
SHA1	9a4fe34a0dcc61392117d681d1f5f8f6f2a99c67
SHA256	e81ec221ca81226e9f02ce432c7e908b4e1718bfb9ca6784732f4df150ebaa02
SHA512	41e599e1e3b17276f0fb60b57caab806c763849198af692343ca084a224dfe6e840d832740fd7e858776d0702edcdc7f9e054ebb45892d708b80b227ac795cc1

C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\BTOPENWORLD.COM.XML

MD5	369cc9e98080f66d9bd3015318c32b8f
SHA1	b5b68722889921a59b2c507157eb0650e1bbc998
SHA256	3c08ec36868de9546afb6123ec599a2ee56a7a296812a4ac8b52f2fe2de42d8a
SHA512	dc35f26c1cbc0f3d79aa05b19a9bad77978decf0f65e09d2624960653e2ff57da9c8dee137efc7607e528822cb6fb0c1d163aeb88703e7b44cf8cbee022e261d

C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.NO.XML

MD5	d2cb3a5e97213f4684c30525c722e1b9
SHA1	8e4ae9363e525142339443802e74acd8f7b229a0
SHA256	808d792c864fa5db675660cfb25f71a40600015d38cb00b76044f36ff578bdc0
SHA512	246af9468b26578f2b147b8a7d37d3b140a54762df745565e79bc6ede1b1c7a64a6283c04e0b6235e69634edec49c9c693834ae30e638dadd03f8ce66dee5d9b

C:\ProgramData\Microsoft\Assistance\Client\1.0\es-ES\Help_MValidator.Lck

MD5	5933f674ee213e51e520acff8dea31da
SHA1	fa21f12e61c3838cc6b4b9e89a79bf3b41f9925c
SHA256	023b515d069514b34598de8b9eddb3bb991135f754368f740767081054ec9541
SHA512	723ed17462a49f2486debb64611f67ccda868c41de0748bed40ae763a2bf117832382aed69f95d25a0685c2224b7f3a3c764c28088e823e4a42de9d4939c8b01

C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\CiAB0002.001

MD5	acef32ebf89580b6c4f03e5ef06cee55
SHA1	1b0a87f12f145b0e83ee230bd0fbb326f9796244
SHA256	34997c5dd1ae647cf90f284b11059821482784591d841bfebb24fde76d4279d4
SHA512	f73619da28e49e6b96dd2dd4d8b99537b0b2bfe9b0212ea47857102fb7e346a894d831769fbf9fe261b273c038745243a16154db2b04f28ee5f4576c21a85349

C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\CiAD0001.000

MD5	8171728e9af454a63cbcd9500bf088bf
SHA1	a9027913d9cbae6cf89ba1da56321077e49223c3
SHA256	741f1eafb5b46c4be378c754b2495167a04757a0eb19835846a0d80f4215b1f7
SHA512	530824e9c81541002b654539a1e761bef7f87b17dbe0fd0cef880efaddb83448f4f833d4a711ceaf3e383ff259ef4bfb8e3305e0e4fdf509f1ebbba33577e50b

C:\ProgramData\Package Cache\{662A0088-6FCD-45DD-9EA7-68674058AED5}v14.30.30704\packages\vcRuntimeMinimum_amd64\vc_runtimeMinimum_x64.msi

MD5	e05eb2617cb43b11467194fac09c7d82
SHA1	dc50a9dc8ef5a4e912ddb14d3ae844bc184ad73f
SHA256	db4d65882d48c5ae6331c4098c82200a40c86d0f84915514f5feca6133f0dc6f
SHA512	e1bf952cc647c6ab7772d3ffd01bf1a32204688621be8db759e098b87a906f2d8fe96d55c6c738b960255beef7f206e62bdcfbc6adcc65757d2ba1b650e60e4a

C:\ProgramData\Package Cache\{BF08E976-B92E-4336-B56F-2171179476C4}v14.30.30704\packages\vcRuntimeAdditional_x86\vc_runtimeAdditional_x86.msi

MD5	7998385d6982a399302f631be768fd29
SHA1	a79e4605bfb35ff8915197ff93f2d182465522a9
SHA256	e85282461ee57fdad4ee669a3fee14e4f3f6697c29f7bc31f401a2b02fdc3ee6
SHA512	06ebd1fa76866e2fec2c73f3d94a47d8b017b74e6257c465468d338bff3f63d5ca4ae01b22c30d95a0fa443a78308bc32951c85095f00ccfb4dd52c4c2b99c46

Analysis: behavioral2

Detonation Overview

Submitted

2024-02-27 17:54

Reported

2024-02-27 17:57

Platform

win10v2004-20240226-en

Max time kernel

149s

Max time network

181s

Command Line

C:\Windows\Explorer.EXE

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess

Description	Indicator	Process	Target
PID 4780 created 3532	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	C:\Windows\Explorer.EXE

Deletes shadow copies

ransomware

Modifies boot configuration data using bcdedit

ransomware evasion

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\system32\bcdedit.exe	N/A
N/A	N/A	C:\Windows\system32\bcdedit.exe	N/A

Renames multiple (6539) files with added filename extension

ransomware

Deletes System State backups

ransomware

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\system32\wbadmin.exe	N/A

Deletes system backups

ransomware

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\system32\wbadmin.exe	N/A

Modifies Installed Components in the registry

persistence

Description	Indicator	Process	Target
Key created	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Software\Microsoft\Active Setup\Installed Components	C:\Windows\explorer.exe	N/A

Adds Run key to start application

persistence

Description	Indicator	Process	Target
Set value (str)	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BabyLockerKZ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe\""	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
Set value (str)	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BabyLockerKZ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe\""	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A

Enumerates connected drives

Description	Indicator	Process	Target
File opened (read-only)	\??\H:	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened (read-only)	\??\J:	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened (read-only)	\??\Y:	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened (read-only)	\??\A:	C:\Windows\SysWOW64\cipher.exe	N/A
File opened (read-only)	\??\E:	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened (read-only)	\??\M:	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened (read-only)	\??\V:	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened (read-only)	\??\W:	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened (read-only)	\??\F:	C:\Windows\SysWOW64\cipher.exe	N/A
File opened (read-only)	\??\G:	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened (read-only)	\??\K:	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened (read-only)	\??\N:	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened (read-only)	\??\O:	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened (read-only)	\??\S:	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened (read-only)	\??\I:	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened (read-only)	\??\X:	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened (read-only)	\??\Z:	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened (read-only)	\??\R:	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened (read-only)	\??\F:	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened (read-only)	\??\A:	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened (read-only)	\??\L:	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened (read-only)	\??\Q:	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened (read-only)	\??\B:	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened (read-only)	\??\P:	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened (read-only)	\??\T:	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened (read-only)	\??\U:	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A

Drops file in Program Files directory

Description	Indicator	Process	Target
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\Client2019_eula.txt	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\word2013.dotx	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\1033\SFMESSAGES.XML	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File created	C:\Program Files\VideoLAN\VLC\locale\cy\How_to_back_files.html	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\en-GB\View3d\3DViewerProductDescription-universal.xml	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\WinMetadata\How_to_back_files.html	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened for modification	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PeopleAppList.targetsize-20.png	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\StandardShader.vs.cso	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\apple-touch-icon-144x144-precomposed.png	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\assets\assets\images\How_to_back_files.html	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-black_scale-80.png	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-72_contrast-white.png	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailBadge.scale-100.png	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\SuggestionsService\How_to_back_files.html	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\es-ES\tipresx.dll.mui	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ne\LC_MESSAGES\vlc.mo	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageSmallTile.scale-125_contrast-black.png	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\SmallTile.scale-200.png	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\plugin.X.manifest	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened for modification	C:\Program Files\Microsoft Office\root\fre\StartMenu_Win7_RTL.wmv	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL095.XML	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteMediumTile.scale-125.png	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-64_altform-unplated_contrast-black.png	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-64_contrast-white.png	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\KnownGameListRS3.bin	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\en-US\PSGet.Resource.psd1	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Adobe Cloud Services.pdf	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\it-it\ui-strings.js	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened for modification	C:\Program Files (x86)\Common Files\System\Ole DB\ja-JP\sqlxmlx.rll.mui	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\am\LC_MESSAGES\vlc.mo	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-36.png	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\NavigationIcons\nav_icons_gameDVR.targetsize-48.png	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File created	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-125_8wekyb3d8bbwe\How_to_back_files.html	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\AppIcon.targetsize-48_contrast-black.png	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\pt-br\How_to_back_files.html	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened for modification	C:\Program Files\Microsoft Office\root\Templates\1033\EssentialReport.dotx	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\lt-LT\View3d\3DViewerProductDescription-universal.xml	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened for modification	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PeopleAppList.targetsize-36_altform-lightunplated.png	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\EmptyShare.scale-200.png	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\HoloAssets\HoloLens_SurfaceReconstruction.png	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_MAKC2R-ul-phn.xrm-ms	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\TimerWideTile.contrast-white_scale-125.png	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-GoogleCloudCache.scale-200.png	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\da-dk\ui-strings.js	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\kn-IN\View3d\How_to_back_files.html	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\WideTile.scale-200_contrast-black.png	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-72.png	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\AppIcon.targetsize-72_altform-lightunplated.png	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\nb-no\ui-strings.js	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Assertions\BeGreaterThan.Tests.ps1	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_Subscription-ppd.xrm-ms	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\TellMeExcel.nrr	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened for modification	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\Assets\SplashWideTile.scale-200_contrast-black.png	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-32_altform-unplated.png	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\en-gb\locimages\offsymk.ttf	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened for modification	C:\Program Files\Mozilla Firefox\precomplete	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\SplashScreen.scale-125_contrast-black.png	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\cs-cz\How_to_back_files.html	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\dom.md	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File created	C:\Program Files\Microsoft Office\root\Office16\FPA_f3\How_to_back_files.html	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened for modification	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\LTR\contrast-black\MedTile.scale-125.png	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Square310x310Logo.scale-200.png	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File created	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactNative\Tracing\How_to_back_files.html	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_F_COL.HXK	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A

Drops file in Windows directory

Description	Indicator	Process	Target
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.2.etl	C:\Windows\system32\wbadmin.exe	N/A
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.1.etl	C:\Windows\system32\wbadmin.exe	N/A
File opened for modification	C:\Windows\Logs\WindowsBackup\WBEngine.3.etl	C:\Windows\system32\wbadmin.exe	N/A

Enumerates physical storage devices

Interacts with shadow copies

ransomware

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\system32\vssadmin.exe	N/A

Kills process with taskkill

evasion

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A
N/A	N/A	C:\Windows\system32\taskkill.exe	N/A

Modifies registry class

Description	Indicator	Process	Target
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-566096764-1992588923-1249862864-1000\{9C36BE47-DBC0-4B82-A72C-DFE61E471E69}	C:\Windows\explorer.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	C:\Windows\explorer.exe	N/A

Runs net.exe

Suspicious behavior: EnumeratesProcesses

Description	Indicator	Process	Target
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
N/A	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A

Suspicious use of AdjustPrivilegeToken

Description	Indicator	Process	Target
Token: SeDebugPrivilege	N/A	C:\Windows\system32\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\system32\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\system32\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\system32\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\system32\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\system32\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\system32\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\system32\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\system32\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\system32\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\system32\taskkill.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\system32\taskkill.exe	N/A
Token: SeIncreaseQuotaPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeSecurityPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeTakeOwnershipPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeLoadDriverPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeSystemProfilePrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeSystemtimePrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeProfSingleProcessPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeIncBasePriorityPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeBackupPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeDebugPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeSystemEnvironmentPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeRemoteShutdownPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeUndockPrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeManageVolumePrivilege	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: 33	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: 34	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: 35	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: 36	N/A	C:\Windows\System32\Wbem\WMIC.exe	N/A
Token: SeBackupPrivilege	N/A	C:\Windows\system32\vssvc.exe	N/A
Token: SeRestorePrivilege	N/A	C:\Windows\system32\vssvc.exe	N/A
Token: SeAuditPrivilege	N/A	C:\Windows\system32\vssvc.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Windows\explorer.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Windows\explorer.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Windows\explorer.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Windows\explorer.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Windows\explorer.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Windows\explorer.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Windows\explorer.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Windows\explorer.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Windows\explorer.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Windows\explorer.exe	N/A
Token: SeShutdownPrivilege	N/A	C:\Windows\explorer.exe	N/A
Token: SeCreatePagefilePrivilege	N/A	C:\Windows\explorer.exe	N/A

Suspicious use of FindShellTrayWindow

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\explorer.exe	N/A
N/A	N/A	C:\Windows\explorer.exe	N/A
N/A	N/A	C:\Windows\explorer.exe	N/A
N/A	N/A	C:\Windows\explorer.exe	N/A
N/A	N/A	C:\Windows\explorer.exe	N/A
N/A	N/A	C:\Windows\explorer.exe	N/A

Suspicious use of SendNotifyMessage

Description	Indicator	Process	Target
N/A	N/A	C:\Windows\explorer.exe	N/A
N/A	N/A	C:\Windows\explorer.exe	N/A
N/A	N/A	C:\Windows\explorer.exe	N/A
N/A	N/A	C:\Windows\explorer.exe	N/A
N/A	N/A	C:\Windows\explorer.exe	N/A
N/A	N/A	C:\Windows\explorer.exe	N/A
N/A	N/A	C:\Windows\explorer.exe	N/A
N/A	N/A	C:\Windows\explorer.exe	N/A

Suspicious use of WriteProcessMemory

Description	Indicator	Process	Target
PID 4780 wrote to memory of 4596	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	C:\Windows\SysWOW64\cmd.exe
PID 4780 wrote to memory of 4596	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	C:\Windows\SysWOW64\cmd.exe
PID 4780 wrote to memory of 4596	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	C:\Windows\SysWOW64\cmd.exe
PID 4596 wrote to memory of 1804	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\system32\cmd.exe
PID 4596 wrote to memory of 1804	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\system32\cmd.exe
PID 4780 wrote to memory of 3824	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	C:\Windows\SysWOW64\cmd.exe
PID 4780 wrote to memory of 3824	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	C:\Windows\SysWOW64\cmd.exe
PID 4780 wrote to memory of 3824	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	C:\Windows\SysWOW64\cmd.exe
PID 3824 wrote to memory of 4216	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\system32\cmd.exe
PID 3824 wrote to memory of 4216	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\system32\cmd.exe
PID 4216 wrote to memory of 4656	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\taskkill.exe
PID 4216 wrote to memory of 4656	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\taskkill.exe
PID 4780 wrote to memory of 3636	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	C:\Windows\SysWOW64\cmd.exe
PID 4780 wrote to memory of 3636	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	C:\Windows\SysWOW64\cmd.exe
PID 4780 wrote to memory of 3636	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	C:\Windows\SysWOW64\cmd.exe
PID 3636 wrote to memory of 3644	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\system32\cmd.exe
PID 3636 wrote to memory of 3644	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\system32\cmd.exe
PID 3644 wrote to memory of 4856	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\taskkill.exe
PID 3644 wrote to memory of 4856	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\taskkill.exe
PID 4780 wrote to memory of 4928	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	C:\Windows\SysWOW64\cmd.exe
PID 4780 wrote to memory of 4928	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	C:\Windows\SysWOW64\cmd.exe
PID 4780 wrote to memory of 4928	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	C:\Windows\SysWOW64\cmd.exe
PID 4928 wrote to memory of 4260	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\system32\cmd.exe
PID 4928 wrote to memory of 4260	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\system32\cmd.exe
PID 4260 wrote to memory of 2112	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\taskkill.exe
PID 4260 wrote to memory of 2112	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\taskkill.exe
PID 4780 wrote to memory of 4252	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	C:\Windows\SysWOW64\cmd.exe
PID 4780 wrote to memory of 4252	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	C:\Windows\SysWOW64\cmd.exe
PID 4780 wrote to memory of 4252	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	C:\Windows\SysWOW64\cmd.exe
PID 4252 wrote to memory of 4872	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\system32\cmd.exe
PID 4252 wrote to memory of 4872	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\system32\cmd.exe
PID 4872 wrote to memory of 4860	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\taskkill.exe
PID 4872 wrote to memory of 4860	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\taskkill.exe
PID 4780 wrote to memory of 5072	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	C:\Windows\SysWOW64\cmd.exe
PID 4780 wrote to memory of 5072	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	C:\Windows\SysWOW64\cmd.exe
PID 4780 wrote to memory of 5072	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	C:\Windows\SysWOW64\cmd.exe
PID 5072 wrote to memory of 2096	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\system32\cmd.exe
PID 5072 wrote to memory of 2096	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\system32\cmd.exe
PID 2096 wrote to memory of 3748	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\taskkill.exe
PID 2096 wrote to memory of 3748	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\taskkill.exe
PID 4780 wrote to memory of 1584	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	C:\Windows\SysWOW64\cmd.exe
PID 4780 wrote to memory of 1584	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	C:\Windows\SysWOW64\cmd.exe
PID 4780 wrote to memory of 1584	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	C:\Windows\SysWOW64\cmd.exe
PID 1584 wrote to memory of 2456	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\system32\cmd.exe
PID 1584 wrote to memory of 2456	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\system32\cmd.exe
PID 2456 wrote to memory of 1364	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\taskkill.exe
PID 2456 wrote to memory of 1364	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\taskkill.exe
PID 4780 wrote to memory of 2728	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	C:\Windows\SysWOW64\cmd.exe
PID 4780 wrote to memory of 2728	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	C:\Windows\SysWOW64\cmd.exe
PID 4780 wrote to memory of 2728	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	C:\Windows\SysWOW64\cmd.exe
PID 2728 wrote to memory of 2300	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\system32\cmd.exe
PID 2728 wrote to memory of 2300	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\system32\cmd.exe
PID 2300 wrote to memory of 2620	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\taskkill.exe
PID 2300 wrote to memory of 2620	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\taskkill.exe
PID 4780 wrote to memory of 2188	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	C:\Windows\SysWOW64\cmd.exe
PID 4780 wrote to memory of 2188	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	C:\Windows\SysWOW64\cmd.exe
PID 4780 wrote to memory of 2188	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	C:\Windows\SysWOW64\cmd.exe
PID 2188 wrote to memory of 2460	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\system32\cmd.exe
PID 2188 wrote to memory of 2460	N/A	C:\Windows\SysWOW64\cmd.exe	C:\Windows\system32\cmd.exe
PID 2460 wrote to memory of 2016	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\taskkill.exe
PID 2460 wrote to memory of 2016	N/A	C:\Windows\system32\cmd.exe	C:\Windows\system32\taskkill.exe
PID 4780 wrote to memory of 1116	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	C:\Windows\SysWOW64\cmd.exe
PID 4780 wrote to memory of 1116	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	C:\Windows\SysWOW64\cmd.exe
PID 4780 wrote to memory of 1116	N/A	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	C:\Windows\SysWOW64\cmd.exe

System policy modification

evasion

Description	Indicator	Process	Target
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe	N/A

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe

"C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe"

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c rem Kill "SQL"

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c rem Kill "SQL"

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlbrowser.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im sqlbrowser.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im sqlbrowser.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sql writer.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im sql writer.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im sql writer.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlserv.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im sqlserv.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im sqlserv.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im msmdsrv.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im msmdsrv.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im msmdsrv.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im MsDtsSrvr.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im MsDtsSrvr.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im MsDtsSrvr.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlceip.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im sqlceip.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im sqlceip.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im fdlauncher.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im fdlauncher.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im fdlauncher.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im Ssms.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im Ssms.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im Ssms.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im SQLAGENT.EXE

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im SQLAGENT.EXE

C:\Windows\system32\taskkill.exe

taskkill -f -im SQLAGENT.EXE

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im fdhost.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im fdhost.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im fdhost.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im ReportingServicesService.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im ReportingServicesService.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im ReportingServicesService.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im msftesql.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im msftesql.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im msftesql.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im pg_ctl.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im pg_ctl.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im pg_ctl.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -impostgres.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -impostgres.exe

C:\Windows\system32\taskkill.exe

taskkill -f -impostgres.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop MSSQLServerADHelper100

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop MSSQLServerADHelper100

C:\Windows\system32\net.exe

net stop MSSQLServerADHelper100

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop MSSQLServerADHelper100

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop MSSQL$ISARS

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop MSSQL$ISARS

C:\Windows\system32\net.exe

net stop MSSQL$ISARS

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop MSSQL$ISARS

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop MSSQL$MSFW

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop MSSQL$MSFW

C:\Windows\system32\net.exe

net stop MSSQL$MSFW

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop MSSQL$MSFW

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLAgent$ISARS

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop SQLAgent$ISARS

C:\Windows\system32\net.exe

net stop SQLAgent$ISARS

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop SQLAgent$ISARS

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLAgent$MSFW

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop SQLAgent$MSFW

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop SQLAgent$MSFW

C:\Windows\system32\net.exe

net stop SQLAgent$MSFW

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLBrowser

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop SQLBrowser

C:\Windows\system32\net.exe

net stop SQLBrowser

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop SQLBrowser

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop REportServer$ISARS

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop REportServer$ISARS

C:\Windows\system32\net.exe

net stop REportServer$ISARS

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop REportServer$ISARS

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLWriter

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop SQLWriter

C:\Windows\system32\net.exe

net stop SQLWriter

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop SQLWriter

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c vssadmin.exe Delete Shadows /All /Quiet

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wbadmin delete backup -keepVersion:0 -quiet

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTATEBACKUP

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c vssadmin.exe Delete Shadows /All /Quiet

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c bcdedit.exe /set {default} recoverynabled No

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wmic.exe SHADOWCOPY /nointeractive

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTABACKUP -deleteOldest

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTABACKUP -deleteOldest

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTATEBACKUP

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c wbadmin delete backup -keepVersion:0 -quiet

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c bcdedit.exe /set {default} recoverynabled No

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c wmic.exe SHADOWCOPY /nointeractive

C:\Windows\System32\Wbem\WMIC.exe

wmic.exe SHADOWCOPY /nointeractive

C:\Windows\system32\wbadmin.exe

wbadmin DELETE SYSTEMSTATEBACKUP

C:\Windows\system32\wbadmin.exe

wbadmin DELETE SYSTEMSTABACKUP -deleteOldest

C:\Windows\system32\vssadmin.exe

vssadmin.exe Delete Shadows /All /Quiet

C:\Windows\system32\wbadmin.exe

wbadmin delete backup -keepVersion:0 -quiet

C:\Windows\system32\bcdedit.exe

bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit.exe /set {default} recoverynabled No

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe

\\?\C:\Users\Admin\AppData\Local\Temp\c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.exe -network

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c pause

C:\Windows\explorer.exe

explorer.exe

C:\Windows\SysWOW64\cipher.exe

cipher /w:\\?\C:

C:\Windows\SysWOW64\cipher.exe

cipher /w:\\?\F:

C:\Windows\SysWOW64\cipher.exe

cipher /w:\\?\A:

Network

Country	Destination	Domain	Proto
US	8.8.8.8:53	9.228.82.20.in-addr.arpa	udp
US	8.8.8.8:53	138.32.126.40.in-addr.arpa	udp
US	8.8.8.8:53	g.bing.com	udp
US	204.79.197.200:443	g.bing.com	tcp
US	8.8.8.8:53	167.109.18.2.in-addr.arpa	udp
US	8.8.8.8:53	138.201.86.20.in-addr.arpa	udp
US	8.8.8.8:53	200.197.79.204.in-addr.arpa	udp
US	8.8.8.8:53	57.110.18.2.in-addr.arpa	udp
US	8.8.8.8:53	103.169.127.40.in-addr.arpa	udp
US	8.8.8.8:53	206.23.85.13.in-addr.arpa	udp
US	8.8.8.8:53	217.135.221.88.in-addr.arpa	udp
US	8.8.8.8:53	200.178.17.96.in-addr.arpa	udp
US	8.8.8.8:53	30.243.111.52.in-addr.arpa	udp
US	8.8.8.8:53	187.178.17.96.in-addr.arpa	udp

Files

C:\Program Files\How_to_back_files.html

MD5	7c8e838529bfa524a01fcd097e319ba7
SHA1	f50761e5a1cfa4d599fcbdb6931117e8dd93657f
SHA256	5540751214323512f142da4f1ac3720972c6ec845565f53916e21cc5d2c9717e
SHA512	d3a96611ce61d1dff8eae75df6017df38ed70c3e25258ab094eb4328f7a43be06f0d16efb39adac228fd7cac96f52007bff3314015d8eaff0de22094b9f2df45

C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\invalid32x32.gif

MD5	e89083805e5fbd6a6cae783b016ce5a1
SHA1	8a265234b654b7576746e93bd06b8e88e2271129
SHA256	7a3174eea2c9232f3b901c6b8dd03b1c733014f766ebd9aaba2c806e6c841bf0
SHA512	b3df0f278a3c0c23776ca4989be78ab115365447609b79ddb9694ea4ff73034342984b49d500ebe086c9fd6c3fa2da7f1cb277990079a419d5990e59337bc5a5

C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_LinkNoDrop32x32.gif

MD5	ac2424b0b8bbfb422746de9c82383958
SHA1	89404256d14be004a0c932fbe635da4282d6871e
SHA256	0030350c049f5914cbc01a16421477711737d29d8216ccc3e3a6e3d4a510f64e
SHA512	360c79f2bc67e411767676c03801b0582386f32f4ea14f9023dd9bc28d90b8dc60c2c3618e34f54c2961287cb808618ef240153406f1688f8c537f22af291a6f

C:\Program Files\Microsoft Office\root\Office16\1033\ClientARMRefer2019_eula.txt

MD5	132bfe522da7275e4e9fd31100eacae3
SHA1	93dce07b4da340984baa28da3fc67a7c5a285e09
SHA256	913c1fcaec284a67038044a61fd1779790f22aa2a4673f20a2eefe9b02bc9020
SHA512	8612a3665e4050ac796e24be17897af993778273dd5630cb29df8b6820fe334f182fef2595e18875c0966ccee00ff934fbbe85c0dbf4bb15d234156592c17108

C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC_K_COL.HXK.meduza24

MD5	1784cdae1f50d5e2481dc838452227ad
SHA1	383a39e738b32bee49c4eb73de3e6e316abe1ed8
SHA256	41f2b43f8ea5a3f84d480e25b5159745a38c8eedcbb747c97ca251d9906db605
SHA512	db3d9e08c688fdc62c922d9796e00dca2a2d59511676a23a79d1ac4533db1ce4eb786b5f7fe8607fa76c758bbd0047b2d7a1040f4b042f2d458e29478d49d160

C:\Program Files\Microsoft Office\root\Office16\1033\EXCEL_F_COL.HXK

MD5	61a1bb7c50d6f9db3fcebad49cf3fdd5
SHA1	0150e6297893ad32f28a0c3183e5148e5d144e30
SHA256	ced363756e6ef621a40dcd0db725b1db7fc55512397f6e63c3dcc8ce72b365d7
SHA512	6a57aebdb49e5b2adf30d3330302c9ac27a5abc3d6a0b9406813b640d1705a9eb152a6d3fdbb2fe67c2b83b95687e523d698ba72ba6f1a2339ee81922916447e

C:\Program Files\Microsoft Office\root\Office16\1033\SETLANG_K_COL.HXK

MD5	15912516be480f328c6b7b77ea6cfcbe
SHA1	b197b8ad408685f9be3fae188590d0f30d21f6be
SHA256	2c1c9f38cffd05883f7a3d5ac597f9802a643e292efdaed5673c4423397a287e
SHA512	dda84de6928f359abdb6ff582da3f9cde5cb8b814f47746a4a334bb22f5f6682dd1b0ec2f38166738c8c2acd4d1f6f2686073af81057c5738b0d5602944ddaf0

C:\Program Files\Microsoft Office\root\Office16\1033\SETLANG_F_COL.HXK

MD5	4cef531caa47fa5accfd525b43d2edda
SHA1	d3ff4668328e1e1c2d42eeec1d8dc8bef6066b7e
SHA256	6a3632c99ab84234bd2e4ec7bf9b476bf5271237c433965071a7fbfd5ab6792f
SHA512	b9e46637246f5eb8225ceb0c3f69ee7aa41191c5e9200b17330f8cb4d0eb0ab6928db437a10f17aa4f4081e71b8caa81f07bc327459a55c18b4c7a00f0c819da

C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe.config

MD5	8d3d44179fba5d4a84fcb2021f8fc7c3
SHA1	2d3b76c75d9ccb55efd8144fab61662b55a81dcf
SHA256	97bb1d08b61920719c7f0a7c5def9e2ce4a8ca78bf4e45c4b37f89885930918b
SHA512	20770e63ef04d8991602c69aa07df096e61cf51719bb9766f92faaa24d6f42272dc6374c38cce96f1cb142ab24f68e2b71271f942c3a050d54073e9efa92ca3f

C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\SIST02.XSL

MD5	42e19e9a83476ac7f3e4de177b94120c
SHA1	b37c91cc764e172b9c59cc66afed3f8151d1691f
SHA256	892bf86620111040c7655fffa48e013c8b48a02eef926027ebfe39d091490377
SHA512	2f964ed23ba584c9aa2634c83ca4052db4a27521f3d37d1a5faeef1812d81249824305240497fef80954f999883782b6874e7218acfba25a91c74f8a3ca67d76

C:\Program Files\Microsoft Office\root\Office16\PROOF\msgr8en.dub

MD5	d2f89463b6096b2aa0a88dabb3390ad2
SHA1	08eecbe16beedff47bf4e24031f9f75f7c1fdaf5
SHA256	50190ff3e7eef80978549e5b27f7373ec75c1207b64115143765be1deb940ffe
SHA512	a19a64cbd33b6a65f3b10c5be3d71319bb79c9a87a906382097fa1e94c5bba888f85456493ba1787abac631f6e9a2bb914fbaf0f05948d411f033bbe8cf6ef6b

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\osmia64.msi

MD5	51fa1336ea01775570189dceb8a2ef53
SHA1	78aa7998a7cec73efc82826932f89e0b5d921805
SHA256	a7240cb822634c7442c399805028c87620121bc9353958598ea442ee0bfae720
SHA512	e4a223c1cdfe067021c203a669673cc7e742cad1cbc77e06ead4da40e4c38c414c8b4b0e0f6b5ec09fc43ac694d25f6d5dfe51b39822489ab1c8cb67809e2305

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Cartridges\Sybase.xsl

MD5	a9b46f9878f9a3c871a54d091c9028e1
SHA1	ded7189ab11cd9e1a491b20d5e4b9ab1d1d52086
SHA256	6f41e77bb93feb37a74022e9a268a7a508d522ace5848f50fa7180dc4fff4dda
SHA512	d6250909b0fc589eea46d5a4432f1125017d07ed4dc0813061026edc9436184736bfce2e6303107357357b1c05f9ec9c4ffc50d34b309f411be3a448d60581ee

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Cartridges\sql2000.xsl

MD5	f93e50904a46c75bb01a111a08889ffc
SHA1	f19a36cb29cb5615a811ec8e45f4e7b13f511986
SHA256	f75c305086dc1aab812728175cf0408449bdd09b84ddc2c1d935346fbb77b932
SHA512	3fa6535f4054a455bb84705acb76eccd7e19ca662cdb08918f3c821bf09e52b6dc114432503c934aa32916d0a11e7d258a1de3b6e380344bafe3b2cabb1c0c65

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Cartridges\msjet.xsl

MD5	e2774a48ac183c36a70d268dd2232dfe
SHA1	1496eed415272da1d5a969f12ceb64a0260b208c
SHA256	4c99eda17651d8bdd2c9270e75371a8bd93cd50ff7fc23b4e475807558b0be3e
SHA512	3514bd36f5817971445d903edbb7f5173521d3fadff46150e076772cf806bd4e39f088bbb863d849b978894293ec02d89d9b9c8f384e5f4bdf378bc3ae0e183b

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Cartridges\Informix.xsl

MD5	12ca25d621cddb82f8d5e8bc725a1f53
SHA1	d5675a35bf253776637701754b49436e0e3d32c1
SHA256	f1a5688407d983cc585e05a1093fbefee4bcb83cf3aa07ad09aec968bcb75a76
SHA512	7347a9937d0edd727bb23de905b12adb177d49d4d08bf44250da24bfea0d8460a80bd55970b030d5f85c644bb6bc89446c966eb4b77c67adf3ebd8f1064b9023

C:\Program Files\VideoLAN\VLC\locale\fr\LC_MESSAGES\vlc.mo

MD5	d75056a8d913a901d719bf1421933c2b
SHA1	1e4d5e4136dc604037a79206dfa300598fe966f0
SHA256	759cf95bda67c167538703e4ca2c89a68e76fee045b251d6c6f7c6e3f2694cce
SHA512	109ab8559e3e107c976a82dc848e836d8570f9f897e9646bae2a92a8002616e8c551808b35b1a6ae319d7f297bd96236755d26feb5f300c71a91b5e793285392

C:\Program Files\VideoLAN\VLC\locale\mai\LC_MESSAGES\vlc.mo

MD5	e1d83d7dfbc5a8de7dbf962d98655562
SHA1	0a393c712e56680cc91136c1cb39fbc95b355938
SHA256	ef681ba6ffbe9837cf06fca04279529295425f90abae6c0adee47bafa5bcdab8
SHA512	bd5565b983f8051bdc0ef4cccf0fe3e42c938223f5b142111a424141e344f42e850068eb72230319d1ff0736982c64fee4c0965c4482b5f15b5472de99f0455d

C:\Program Files\VideoLAN\VLC\locale\sk\LC_MESSAGES\vlc.mo.meduza24

MD5	82dc8fa9a9ef34757531cf19ec3db217
SHA1	1d528d72f0a129d8603ff1550a7ff56a7d455c37
SHA256	04da29144048a6cfa1c43e4d64cd5a7043702317397e2f02e1131147f71555bc
SHA512	77b9a7cacadd16e356038f2295a6d1cc8d3a27596226bdfd41a567fdad509820a0e95ee4d378ead0f9f6eb2e0e721e092f9061c14d14968deb65dcc1e333cf0c

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\natives_blob.bin.meduza24

MD5	b60b872484a50e5533abe6c795e579ca
SHA1	3b85700dde94c6bd013d26c120a3b20565d8601f
SHA256	0077aff0e52aedc77b2ae31047b668f3803a34fcb43faa45c70b6350c129095c
SHA512	92f36465bcc6de0aa2239123da0f0546a37e06a0d48f830605282927f8027a5333363b26079a2d7a5009474e98289dd1f4dc8365b2c5a87661c78e8eea516d03

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\aic_file_icons.png

MD5	63f47f6fec976795ef9dc433257e6b59
SHA1	01e190928469669c9fe44203e58a540ca19a7a3b
SHA256	33a2b67ac895fe0f78559dd058a54d1be05b8dd416d5becebe0d0f42132981f3
SHA512	90446b15eb35eff5e88d3ab6e8f96005b12c20915ee35a60881dd4a95a84d8fe6cb8b3d9e866dbaf5ed3f27a872f976fd1af69056aad795dc360f679ed2bd08e

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions.png

MD5	9f21384d950bdad396577a292fb71948
SHA1	69fc5c49d79c046b85d1ab70de239ad985e1a92a
SHA256	c3c015d4d05fa17a43913155052b2c3e8fccf34206d2a80d12e9e92e15569302
SHA512	1789a1cecada7ce832502be607c278da5a4ad0aafca08f60c45578f1d7968be19b9d73a4af6d0dbc7d4a0a158831aaf79eabf52ea74b7ad504719feaa004fabd

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions2x.png

MD5	5e0561ac1c69a056d1fd07b41467e228
SHA1	031599295ecab4ee93816dee6c32e3f1ebe4adb5
SHA256	caa2d67e5cd698afab46b7b45d721397a058df4d4f4d043218a07f23671ffb1f
SHA512	5ef0d0bc9cb22e86e05da7f054ccd99d63aa6a374b0ed8706c533a7c330cdf13597dad397e1113ec57c9c1f42add07cd4f3294d0f3368eea442dbdb46f00a1b0

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_remove_18.svg.meduza24

MD5	96962234d7f67b4b2aac6937ff338422
SHA1	a2c8a83f8926464809adcfeb2a7b32b713e5e3e8
SHA256	e09fa0a33a7670d66e84a65ffc1a80bf398761b715688ece9951142e04c3f054
SHA512	c67ab8385c9cd4fcfb78f9fe07eef63e3a72dd3c44c64d4be4c856704e7804177758fe1d1ba7106bb76cfb117baa5d335376b27ea6e501b08d7a8025cb196e95

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\root\ui-strings.js

MD5	6ec0d5bbbc441e189fac62f9780913f1
SHA1	4953edac6d49db97b8e294329931efe33da43613
SHA256	305799a7673750c7bfdef0c3ce57eccceec29fec823e08798b449384874464b4
SHA512	9c9e310acb7e963f031170797ccf2483a67dc5fed4a89e21b8b20fd16ac900b90fefcda7a29c13386b3e427d8d992b2a7b3a1ad613cd60f819271e2b458567cb

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\root\ui-strings.js

MD5	d857757e2706cc415723d65e0683dcac
SHA1	530358b425f7e056967ccbaa13bdd72f6ca061dc
SHA256	377f52dd63e7e8317fa7cbf695c5c6959b2547fde9ccca58d8adeefe8a3479a7
SHA512	fdec9db28c08a615529c94c349e7ffd482b92867cccbbc1c9974d5a8a16f381e1dadf2f2095724b0518bd4c9eb9b768800322ebb2b86aa863e91e7f3c494ff22

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\root\ui-strings.js

MD5	312816f5c4b3aeb25058115d584b6b2b
SHA1	628ac8bca4f85b0548620113e4fda5703dfae2b4
SHA256	9911c75f123182b83cbf872bf94e939bbd0eb385c066936ebfb96c018942aeb9
SHA512	3b90cfda5075a14d45db2e646a7ab1316e57a28e7a23f32618a18e8cd7e515fe29f72463d603e68560291c4ad9785aba45272a9fcb859690e41dd3d0037faf0b

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\he-il\ui-strings.js

MD5	ef50bc1881d59579505eb8348786a7c7
SHA1	98a09c4ea64e59a1087db5fce78c65dd0fffadd0
SHA256	c20151087f3f38cab42fa9efa7a190d59711a788066ad898ce2ebcffa87f547a
SHA512	0c8ee744374434c12e1a0b60a476e305dd0c019d4a164b594b82e06b4d969deec6615585c4bda2a64185c67624322a07a9ea0c5220102241fc431585199b8109

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\root\ui-strings.js

MD5	4161664182525b7a79729519c7eaf396
SHA1	358ba0eb4362caa2b1392b3b488c94c28e4cfb54
SHA256	f8657c8ad4e8dbcd57ce9438a3911c773fb87d9ba6be7af2a586d17bdcc8fb2f
SHA512	8f5cd13d5adce0336369f188fc4c348c38bcc73e10054b377cf45d381d0638724781ec56050d65c8b5954040347fe1e9ed6118fc27eeff85f4d11feba2a23330

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\root\ui-strings.js

MD5	c3fde2a15ad18686eba0f3f5a78d9d59
SHA1	3da2f259e2202c5c2147099bfe7342c770cc1fc0
SHA256	5ce173362eb8f31412e1b02e2d52fe26f38af3a25d877ce7b38d8a3e04fa95d5
SHA512	6844d75f68587d4215a4e6fe240e465b3c1879791749f3ae083a537531d7166c0959080d518c926fa870bb49913fb9690b499b93edd03951bd77897482e881cd

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\rhp\convertpdf-rna-selector.js

MD5	ed183606fd749ed4c6e114a94c6d9f62
SHA1	e98f97fe88105c09d377121ebf1a2cf5c36d2633
SHA256	4e413d1e30b2e25ae46b570952343484189e15587dfc69dda7a4f3696c2600a8
SHA512	e4c3e9ec20d96a9319b27d8e65d283fe687dee50846e044507972747d6d7904296974d9d9791f710ca6daf771e9597f7affe565bc8c7410111606c39eeb2e2b9

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\rhp\convertpdf-rna-tool-view.js

MD5	03cf290d3048dbc18d1da245fe3d2a99
SHA1	a66970c1986018c9bafcea06985ef91322cb7b56
SHA256	921d3f3e15dfee34df5404b96a3135b9fdbf4621c576abb76fccb6cbb635ba35
SHA512	185c34cd8481f8c6c0198316fa223b48a0d192befc22674ac2da3ed577e84d898e22544698e3af6b03ae37260e669cda137218bc4d0f3df09db3e3b374e5fda4

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\root\ui-strings.js

MD5	454d6b0bd0282114b2843272b442f987
SHA1	9d748c7f78f125d8ab11e12afa39b9988278c1b4
SHA256	00a1098f0719122655c0993fed3306fd352e8d2c1acfb75acbf130c49d0b7e0a
SHA512	ee47e9d1f781020bd19d59cdb9dad63555f51414763ad510de079dcf84c6e9ad5b0da6337b97cfd50a8948b63afdfbd372c89ab3f2ce51fb89147ca5b31ee40a

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\root\ui-strings.js

MD5	12dc795f53a957d1f31f646a8e5868ab
SHA1	473150093deda17af4f3e21dbece899a08e3d433
SHA256	c9a41b34995e52f39c5346587add9d63a410182199a295b9bf24fe8720212d69
SHA512	a488f1ba9ad493f92995f14eee83c962f46b38a644a48f883423995dfb01befab896f02c3199b3a9348263a34a2e74ca3693906396883a0b55b114c982907c42

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons2x.png

MD5	5110ba20df5322d8f045a508e7101405
SHA1	ab4c8ae4f7b90d4f7782e6c275e59a093cbda91d
SHA256	e0da6b29ed51a4bc779dd0f7d437434f50f142e938f4dba27e4e15d345e7ccf9
SHA512	8a0cfac9ac9b1fca12bdb1ede8531fea6b1d7a8e4e9e268f0dcde3117607b3f1ce4e5ecb8fcb9d2282f23aa7bb90691ac3db0c0358002202c631c4b23904df9c

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_2x.png

MD5	8073322fcbdd14a080a39deb63437fa1
SHA1	f474d6bc5f836ba781ec355135bc6d4bcd3d7742
SHA256	a239b5a4aed1be1eda06a5701390636c87741a1d4cd2f151332d4a26bc8a3dc8
SHA512	799349c935e2325743e59f3b8bbf4d3fa0dfe514b46814e620f740c51fa4580b70cda8ab7e8d402eee6cdf9871b330de292a51e145755ffa87e026ef3db525f6

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon.png

MD5	91841749f8559434135b87d00e583ce7
SHA1	bb8ac9e028da6501e75b8ed93fb09b8a60cb32eb
SHA256	0fbf1334cbcbd95dba84efb7abd23ae02304c90194b861a5ff42357449b67c04
SHA512	5f9fbe23eb9013ab084695cd46e8cba6d063b56d63b63e92ae4971e713d7769d693c8862c2a85b1d3bee96783c8ceb826fd9c91e880c467d29f72168bb4db246

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon.png

MD5	b40dfa5e52688b963a9a40f744136dbc
SHA1	161fd2e64da440b59f06115a7a2e715763d81a30
SHA256	7c425517b410fde1558220dedc4b28cd589af005eee4eabdc9c031c09aebda56
SHA512	a12dee67a704d0c7a0721b0c7601cd0c352bb7a2715042e8b0e3d64c550043ba4dfa317ef40d55e62db7f7f729d0678b523b163f339bfd0d4461bc9607cb91a4

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png

MD5	bc71033160bec0871549a6a23af389f9
SHA1	520124e6a19a73302bf66a32b0871e5d0f400783
SHA256	36857f68c37780bbd3f7af06997072949ebc8b19df2301f007b65bc6200672bc
SHA512	6bfcc0c37e609abacf0cf4581ee81b0974ee5440a8400a90c1a4be833ab80af27c17f732c60633ab03673edab1368f9fdc6c6c535daea6d761c6ca7e2bc99805

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover_2x.png

MD5	697d2455ad808bbc100102343517be4d
SHA1	50cf4680f02e0d8b8465c6eaa7cc8893cb3fad27
SHA256	661ed5d139ac9391d26b40d92a89c1ec92dc8d0e38901ea6162805fcb4e9c332
SHA512	83f693476ec2fa25f94f310a3a7855e316ececa6488b516c737246e1d6af94bf81fd3f7e37289124d94f1a4a80f22000e9b08a83eacc5eafcbe14e1926c077ba

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover.png

MD5	4093698e47347bf376ffdb0c17a2cfb8
SHA1	222f59e0abbe7c2fb9c6ea7ea3bbf280438477ae
SHA256	f756abb30668ceac60e1302165b75bac4daa4c0d5ceae536ff9004010c2a0da0
SHA512	44e758d24a94a66b5b1d083ce2eea02e72ed38ade12fc1ac5a5467ebc181abeb4230ec0cda4ea7f60922d84370f8b31bb3f1be25e84d0fcdfbc8534b5f1505d3

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons.png

MD5	48d629d09248bcc3092b21df4c97455e
SHA1	a31e56994e2025aa6f7340afbdecb891995f571a
SHA256	9c8190120552a1e8a5c70fe5b836b28276b16925de829d6a7a0a93025fe61482
SHA512	04bb5a81994a016e9629ee01bf6b5b0caf49aa7db2c4d06e811b060b1cf045a2245fdd938a4e8c7571df66addfea6cf2a2b3c6484b71e2db4f86720b28685543

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover_2x.png

MD5	e85909923993f08a4b2f57501c05d490
SHA1	dfa298c96768077ac58a7ced2453ac2b0f70c327
SHA256	e53d3acecf29adbcad005f7b7187e1ba7ae4cb058f3663133cf199eb40e08c47
SHA512	64a4918790dac11cefdacafd87b28fd51ff075256f9b588f29e64cddda31544ca2041e0d844418fa6fa9937d893e1c204ad840666f05c237a89d1b2d09b831a3

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png

MD5	d2789062590853c142216a0459fd822c
SHA1	c43cbbab164ef93e557a215922daee3d128dfeba
SHA256	179f63dcc0654de1c25610de290b6ba38205e82b53de410ddd845cff5bdec3c4
SHA512	9ddc039a9962b6121b8865650ecc7c46b537fcf16a386f4233760c8ffabd9ec249d7cc9911ec99a4188ecf24b82bc66a337213e505eb74555404b4497010e5c5

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fr-ma\ui-strings.js

MD5	c3c82f0536e2f2842060d2e418df261a
SHA1	e659c1df17e90e81136f0beb640213b71493f5f4
SHA256	0c3f5fe06b991e19279db241b0da9286c1b5cca0f4e85731a2fb453fb6c4cb3c
SHA512	93d1230421ba6f2acaf701dc19f1fd5fd382e2059271290236457442e7ada8afbc10a44f87220594973fcce646dd49bc3476008a0f2ac6149d68c061bcd278f3

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\root\ui-strings.js

MD5	224f8aa1a24224f427dcb697efa9784f
SHA1	cf90cb49455bba4cb341d2569340a8d3563ddb4d
SHA256	8364dd175c30597864bd7fe7d7dac243c6ff8f83bd6597b14d6590b2b115818f
SHA512	374dff376a036d7f0650e1c15b768ea3e629c5625150a3c5aeae2beeba122a801df0b301094958da12de38abe0214ca69b676031332fd53ba924afac282c538e

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\root\ui-strings.js

MD5	23a4e378f77594cc03282d8ef41d8698
SHA1	568a71e835ade7f14fe059f96aac0e04288ab9c2
SHA256	a45b6802b5efb8539e067b94c2017fec37c5a39dc3fd8af16685c7d84e3032c9
SHA512	4c550cf7fe9a06f97cf3b0794182b67377a905633ab1c1a5dcbf6ba803f7d5434f3e98b4f52748da93dac0a144363188a5d779db062f549c2bd4eada81de77a5

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\fr-ma\ui-strings.js

MD5	63b3046def3a9de23f61a576d64d515a
SHA1	b037f5ec13ba4017294a8731128c5290844e08b5
SHA256	2408d0e332243cba2b698b37aab4e82317723181af226a2e96cc2283b228d769
SHA512	0c777875af2e9cd38adf3c947b9374d3bbe2b1407fad81a009b598c11bd718635b46ac647297c30b01dd0753173ce6049154559a94efa53b7782a839240a3905

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\fr-ma\ui-strings.js

MD5	e27d83d19eab609d570ca463d2d54136
SHA1	a41fcd4960d0cae8e17332736cc8d1b1db63f428
SHA256	73b42af98c75594c5464e37d594cbd4eb4ba640ffec4fe156f6af4a73727ba06
SHA512	4eed76ef8100e3a29540bf6c7d701b0df6e73977dd1315876bb4fb171d50b3906bb69e65d332c178e30bae75d8f8eb46c29575903bd1c08951daca1b856381c6

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\example_icons.png

MD5	18c7a0bbe7f06bf99cc07c81a64cb73a
SHA1	08083870fe73da0b29308eb1b40facddbfc584ea
SHA256	0eba7654546e5b0e94724620a826eb86d9bc3010de6d96b7f8cf54994cd89684
SHA512	d791d9492ce008b1fbdd069c2d30e08fd7ccc90c7afa2fb443a2e04cc6e27f9b1e3a79bf31d443a48bfef07541b7631af4aebbab8dbe9091aede72642d21ffc4

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\example_icons2x.png

MD5	8d32f31da77acdfb0976c0fef14a98b7
SHA1	988102b7262371f78c2b613af4863c2517478cbe
SHA256	95257157eddc62645244900d1cafee0f0c2a06fe27ab162c6f50e8389ee88dcc
SHA512	f133029e306d93433b0790359f00997d837e7ff25401b9682e6f70128e3aa496278f5f2e6c356b17a6578625663ffc96a22263c9776d49da85c02ca19aee8acd

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\icons.png

MD5	b73e2ef70d75c73d5739e396462666e8
SHA1	697485c5ac4d3f14e020d3180a4e0591754f1a86
SHA256	4e8a0d95293e25221ecfcb4aff96f6be973ddda140057f81bb9919b5befee845
SHA512	925747ea2f64123cb3dae84d12b62bd01224a1150627c563ec96ceffb2384dfdfaae149b95a1cef7c15317fd4b8d63ef385f27ee927ed190ebbdaeb1c93b10e1

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\new_icons_retina.png

MD5	80db2f4eda723bd8795dcff6617141ff
SHA1	2b1e4f2d0ac68f9d9fcfd5a09c981e497e593b71
SHA256	3b241af8384273df615e5d16f1167249630716e1254e1ca0ea4fbdfa6b49f46a
SHA512	e1eb7c1c53684e84f2778f564082cb64d119898d953726391c0c0fc599a78b33b1da4da499047809bfbc3dbf5eaac1d17acbd633c4cda02d6b16e69971b7b152

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\new_icons.png.meduza24

MD5	4086ebc307c44eacf21a3a049a84c161
SHA1	7bf2f7ede916be47e672d56595d0a9f3b8f90db9
SHA256	9acb9fe877dc81da524257be20694da4f5a69061e3575bbbeae76e38f4301abd
SHA512	b0a2ad6823a8d198224ab0babe03d7dd33b816c0a033b60d2b5a7ad76c7ccfbb20e65493ed6a8ea36277c6f5f876d312e0706f8e8630fd6fb6bfab890bc6dd7f

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\icons_retina.png

MD5	86e26dd8853acd2ba0b25a70a15d9c41
SHA1	fecbb87dfa763c81ae5fcac3e277e4bb22c250b7
SHA256	20065beadb9c4b9628a1cc86d88b8168cad71043f5d6b19e9d586bec604c727e
SHA512	7c8c6390a9095253f507ad273445396274381d689c70810f78048c00f07c123ceda5ae52ce14fe668516adbd3eb89e88c55de336bf32472cfdf766b32386eb35

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\icons_ie8.gif

MD5	1e088bca3a6b2837cae0f714acbbc4ce
SHA1	ffcd166de2eefbc44b80705b4a2a27f56b5d329c
SHA256	94a5b7b617524c16d2130f883cc3eb21f4f21b87ab90b178d1605f3d0f764ff8
SHA512	4d8bc8f2dcfed446b5b55b8683f7242880462d2b9e455a217d242ed4fc969ff93b9a38722062a24de4ecb43460c5069013e83828b51cdd9009f2968c0dc4133c

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\root\ui-strings.js

MD5	5bb46004db1ef2158d2df6fe1188e626
SHA1	a2088924e9354a7078437b19b7f99cc117f6741f
SHA256	f8ce5145f2ff459a318a75196128d5249be1a9caba75899526d40a9f0ff6f60d
SHA512	6b132168026c25d5c6b440a0b8875130049c755d4b44cdae8f3f9f57b0e0387cba5807ca68e4a5d02ae4187108f14d714a504baf844e60982c858ecc4e31cb0f

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\sl-sl\ui-strings.js

MD5	d5e763197527a9f3468676cc3ac9826b
SHA1	60b1796ddff0a10c725c2cd36623c96c8eab9d4f
SHA256	238dbbf7bbe615b43160c31870e828bfcac16c7688dfa2483a44b8d10f7e2963
SHA512	d797d54ecd7277451363c26aeb659bf120312655f63f3b44624fcc5ad904e1db3ba2bc107ffba30d92234090491993198fffdb3af992c4e104d0d120d82baa43

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\root\ui-strings.js

MD5	25f5d777506a077e6270879415cbe7fb
SHA1	34a783f411d0e824226eeb1cce15f6130d67034c
SHA256	59f53c9de6e9f19a6e26273f4af4502d09491bde0c848346a9be45abc64f4b97
SHA512	016123340c6221215c5cbe6aa2c1930a7bec68a4d61d40cfa9bdfab9f290f080cf5c103b51dd7473363869fe7813274fc4d6ba9784fcbb2d353bd3f224898078

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\css\main-selector.css

MD5	da3039f68cb011175efbb4e68d939dd5
SHA1	4ae24689de31b017ca54dd8751262ad1ee88488b
SHA256	5b65de22e30275ecb2f3ad7b7fe7da3d07de09ab6b1795fe61062b1aef0a7f3d
SHA512	2d315d2333bfdeaa81902305cfb252f7ce59abfdbb3524ec371bdf969f238163bae674e5b7e44dfb69b14d717a29c76ea3c4d1e05ee0da804d78cf582755b9f6

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\illustrations_retina.png

MD5	c190fc2131166761da32adf1890dd30a
SHA1	c1f4666253b573ad3952439093808231f8d03216
SHA256	830a665857874419ccf324b0166346ca89c96e708b44e80375a3f7a520977b1c
SHA512	f2f7cae1ab1bfa67d3a0b3127a2185e4ce6a29161730d80fc4dcc3475462f1212b934e5233dc5d8b72227e2e4c074de182fc8c28ddb4a192978a5c354b879612

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\illustrations.png

MD5	653a95d2c2f6c74d29c76ac1be26abc8
SHA1	b14a6fb9c6994d493dd3a21700a6b972093d63ac
SHA256	9f7ea529147bcd596b98d01cda9f8490fa1f58e079fc26fde0cc91b9bc43dfed
SHA512	8768923968438aa582c70d4b3cc7e10aaf2d3211515a0de92e5bf6352190e89a377020b3fb2b89fa549cd4d2c73d5412ec3468370a928f43f4f44b8e95522231

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\bg_pattern_RHP.png

MD5	25062e8a7222361b277f96bda88b6ac3
SHA1	af20fc8a9bf1d21b23bd1724ee5a9e818401fb74
SHA256	b7ce79f05f7996145b0f5faef53de02567428c8f0ad3cbfbca06acdbee80fc11
SHA512	607215e5cfa8196b8423bd6dc7faf03a4868f721c0274fb282c6e4a910c514dd06c884690fd5181031094ab9fc4300c7a49810edcce5345c4bca53afc4eb1d53

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\bg_patterns_header.png

MD5	9e5dd215ef90b6f956fb49059b37e8a1
SHA1	a8b5d3f4cb2a58156e1b9187ffc5a58e71de9433
SHA256	0f43ac240b0f8b183c169faa3b7bf5962223fc06b12b37817134ca3b41030d20
SHA512	888cd0069995cf6ee2d2b6315d240190a93e6c9b97808694a86e6594bc11f96889c263ac84ee33f5457b7f74da22d144b0f7675e697d650e9616191a815bf61e

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\root\ui-strings.js

MD5	34e7a0b171b760ec6bd0000144fbaaee
SHA1	549f55f0455bb1ec2679842282e80e9c30b12f6d
SHA256	8b451e95b249959c73874b2a4fa3e38480e93793715998db89875c5592feefa8
SHA512	109aa1c1ccb3e09b6b12a07c4992e80b0eafcd559be8257e23224db44006db65d97a34bdccd223a4116e16434a26490c6b9d5c4c1354bd9688dd18102d5177f2

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\root\ui-strings.js

MD5	8c25da1e273287b6da63ec1100faa15e
SHA1	23b3d28a732c403afb5261c6ad1c2bac79f96c8a
SHA256	a33ee089c2d96c8dee1dcf6fc929f24abcd99e96fb62a6d7ac3354da6ddc3e2f
SHA512	106f46687615363d99c8a25bbd4529212867b7a8dcde9e42023350a92600658b19d565c12f2002ebe76f9b4040cec2fc88aac8c4c87f182a3350df9211d418c5

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\root\ui-strings.js

MD5	225d31e1cfa043470cfe0d4a90009a5d
SHA1	f8c8598af6c8e4c45e449e34b182dc9ae12224ab
SHA256	b879e68061bd0eb4bbe418fb69c484307d8d77eb9197c69ece46ff8df58dc939
SHA512	26bc58a2bdf4b2978cfbb3ece6de2666cad3e2d79b87a9db394d86bb08ddb76d5c2ee2adb9e09c3757d67bedb7f66e07c34fc9d2024614ce76d0e70928de23ae

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\en-us\PlayStore_icon.svg.meduza24

MD5	3b8d1d86a7421f118a02676d2fb02ef3
SHA1	a6810005e2db151822b67507a4b5eb7e66f48e87
SHA256	fe26d98dc24460de3b6ceb7a2fe35cb0e3c9ba947ad68719f6074567b724e293
SHA512	92cabc35a0086ea0e155886471b46a337268e47d66d102fd7b81677791ad2e28054b7be6a50110977313024e04f695e9b52445385fa977b6cfebf16ddcaab9b9

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\root\ui-strings.js

MD5	5ad714f1aa230adebf46eed287535ce3
SHA1	4f0af7a5d09b7029dc5b3f1ce5b7ceca2454e836
SHA256	233082bf7811209dabec0fc0cc99cec87aad41331bf2d3265f6db33626ea64ff
SHA512	e221c46e5a578cefee083c0d03dcb19f6f8d5f4ff3f087a5c1b99bc3900437cc574d4e2499ce4a9d8f484a0ed7a46ec8b83c7a72be245ea54354d85633a4f2a0

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\en-gb\ui-strings.js

MD5	c6acafd24741a5160adf1c3f864a4456
SHA1	fe82e72d89e71c3e4d39b77d9c261d9064f9d23b
SHA256	8c121b60dab47f5fd0b911215ae928fa17f352603388cedd642637a5909e4643
SHA512	80c03283a8e35e0906d5027be145f5548a94e963a37280978d1a6a410c07e94edcc231224a30d34c4290061fb65a915b710e0c7a542aa0511d5ddb469d4c0beb

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\root\ui-strings.js

MD5	f736529e168ac6fa0b1a91a2e161c081
SHA1	1ea1d7d38e3f315bdd373f9b1e2118fd3f3d6a01
SHA256	29eb8c980b122672df060effafbadae5252a10c30e1bf99ecc07c0685279b38b
SHA512	dfe81958b3981880ee038dac20d1158ddf1174a959afe174d05dedd423f0175c74aa171b282640cc39a9d672844d131ae78de5e957e2ac221e0f0c88bc7ec328

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\root\ui-strings.js

MD5	4c513bbafbd9c21904cb939821ccd743
SHA1	999df7622f519e9f1674cb2b31d7fc1c196181b5
SHA256	b868824f7c028b6f2bf377c20ea4bf54879b364eb9819adaef09c88665992e99
SHA512	96b3c7ff58f04a0b6a46a5d027e2b2086d1d05da91f77591da31949767a44a728f3e7caecde725914378d53a4920d6feba97c2a3c0ddfdb1dd0aeee6b98ed7c1

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_it_135x40.svg

MD5	5e74d6699549cf0eadd7ad921b8852bb
SHA1	c692d6065203cbfc4e1739d484967dd2e0fb77d0
SHA256	1b4e65ef5e0d9ab409564e8979c60d201e6e5024b15152307b88ecb2e6c57af4
SHA512	7563f55e647b82f497cc9f4565ff556d4c06b10e16fe726e4fa1b48a3aee422b589099b3b30d0c66e453efd830e44a37c21a03e1b56a7e7bac5772749582a9c5

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_da_135x40.svg

MD5	a3d93573ae66ab17404b9d94b02213ec
SHA1	6b73cd17706ad2e7d6eb85e1070c913b74c8eec4
SHA256	4df0499e025a0cc5388f0b1f4533300ef9bb540822e699d112a2901bab91b7d6
SHA512	98d7b81a13a202bb87538bca57f3ef09cea6abb99dc99a68c364eeeb1c49e6835db917b93b6d0d0ae14edfa478f5955954efa947ed781bca92ca000e2b3c81c1

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_cs_135x40.svg

MD5	31af592e7eaaeaf0928c4a5eb4580ef6
SHA1	863f8284aa1fa57cea5ee22899f78bfe74b8de23
SHA256	b5c8b0ca3e6edd67222460df62c53162a6145711160f38bcb22a05b45c5bde30
SHA512	8df8e5e1caa7e135711975da42e2cca63a275bfd2d3d39177ed8b1b1fa343f5679b7af8a8bc216c17a752b6015f8baea478b461c1ee88ba157f90cc5fd2be939

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\sv_get.svg

MD5	e8d4ff7e861bca9ad9d0500661d59d57
SHA1	3169f7fe370fdd677ebe787d5fad33e96ff6c885
SHA256	5618c2c2770d34ca4ab72cf704a593ced11be9244c3c2146272ba9bffbabddeb
SHA512	6fe4879818a091365295723e1261cd49fc6fa893a088f4f70df951194ed9d2ecff9b2dd33912176b2d8536fa5957c7ec1562d5cb0bf4272e36658d25b5c2d263

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\tr_get.svg

MD5	6c57de456b57862eba544f2eefcb70d2
SHA1	088a6871583db99d6cec5e5e2a5221939fd89262
SHA256	82ca2d96e76456e28b20ee608e49f57784b5aa677f225f862dae48f61c24239a
SHA512	7e7b03475c2cc7cffaf2c852dad74c6f3fef7fec43dc8b7877842f7eb4b0672f71c874816e277a665bfe24425ed3298635fe6223fc37186a4acfbda865970db1

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_tr_135x40.svg

MD5	2e6690431d1c307b8227e0091fe2672f
SHA1	6f12f7c28678b95b387f24ef10b8e6149d425a51
SHA256	6491c1c20a28e15c2aaf00633a33bc4dc52121a6e232b88821753ec725a2915b
SHA512	c26e06c2f7a21cf5849559efb26208a7d6761742e0cd4b01e27c1cee219abb1587a0e9afaa721a4af5209ae4390f522db08aa1b313643d758ec17ca425199ba2

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\pl_get.svg

MD5	e0830fd21477b698f62d6d66cbadb0d4
SHA1	e01ff745c8b30ed2d92ec9fd4d44af29f5be6eb8
SHA256	a598fe94d579ceee38142d6e2399c7f4ca60fde448f8d6ae69a808963070f129
SHA512	8f2f3154da2e440be6501fbf1c4c63c7fe9f3a3d5698bd6a20edc2455d92f82ba2b8d28620dd11b6c5babadab597b72e8ca83a92c9d01ea12fd3b8d7444d517b

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\no_get.svg

MD5	fe564b6f3c09cbd6a6e4f5fee253f3d6
SHA1	256bed7be9abb6a6ab7c09a1969db849faf2e5e5
SHA256	fdd7a4174a8e59c61cafaa824a74a42ce7e37c194156c1490dfe72d307bc48bf
SHA512	9b5914a99fca19ba38156b227f06ae398d3c38d4c095ac969172dcac56e55b273632743643db89782e7170caa6a95c710c548a9553bbe5d03afb7deb16a5e393

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\cs_get.svg

MD5	c716334249775d6020887cee05043d10
SHA1	3bb090e2faefd48c7e5aa2139033d984fe08e1aa
SHA256	2e13cf4ea73332775880d5f51630c313978044b2786a13e299a8d56156d44a59
SHA512	437011277bbca69e65678e42c144705b321bd74d6c5ec75851a1c6171eba30edee117ddf57116bdf7faf4d1454d48762dbdca4b8d7c330c75d233376871e9ff7

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_pt_135x40.svg

MD5	cb1dd0ff78c9da7ef9f5f15bcde02201
SHA1	13091f03c9ec4f41acf8ae394ff25d8445715912
SHA256	4f2ded12b1cd7d5944564c7de83a9a621d34fc74a25e5a577185e72cdf7bc367
SHA512	bfc20198163d2a8300ae053c0b3f96f9455f3884038c011e1921be1e77529c3d482ab832e3c9851b869d4cde8458bb5938711cdce280d978f9b254baa34a9a75

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_fi_135x40.svg

MD5	63219e0efb323428492cf242805cfcb7
SHA1	bbe59ba0b9ff2deff0ef644db51a3bda9fc0fc37
SHA256	aea83d4bafca409d6fd62acb5b303ccc28375195b77301aba1cc659b49ef0ae9
SHA512	856de6628dda93698e43af7d10a400613d33af7dd3e63ff662c19bed37d0dca4e417893ef253d19a3c31d30eb4ac905f220a966ccdfe00f2c533974aa0e506f2

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_zh_cn_135x40.svg

MD5	d99d25541ea848140eb86cc56e23a6ea
SHA1	2febaa631d0ae900dd99ac318a653552c47e80c6
SHA256	e2b187457cb0952ad3203e5bea5ec0d1fa5ff8e2dd8fac7b95108a083405c325
SHA512	7fea9197ed79589116646e2fe857614d40e7e87cfcce455ab33c198d81ee338213ec3502b7717ff66b0e56a972cba37b8838f1449a98626a0ee5072adfc2eac2

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\it_get.svg

MD5	61f3b8ffa0ec476012d74db49978bc6b
SHA1	6e757b319109a51076a3ce476564d6928a910cf8
SHA256	1e62005e5578e6b0f2d563d25769fc9c4c095656bb0be9037551e8c28df16898
SHA512	72352459814c2fc43c16decbc56b5a1e339a52cedde5b509061d474e1748e2b5ec51f8d24eacae4329823bcabaffded838463ab1f93a0240f5a56c2a22d7f71d

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\fr_get.svg

MD5	7d7f0bb85e769cb87167aff0f99eb312
SHA1	06d1f470770e35d973c0445f34d764ee8ac1f1f3
SHA256	a38ccdc0001dba6237de70ab2966e79aadd9c32d729d1a39da897601713deffb
SHA512	207fe148e1699cff967963dd402d0e8688c96ae0dde7d540011bb88806bf0cb395ed5d4b351a2a06b803f033dca204b7eac944a92a5595cb08b4d2ecd200a23e

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\es-419_get.svg

MD5	c437f4ed604fa2152e779ecc1360f481
SHA1	e64a17dff27f239e780a0bbb850265bde103516c
SHA256	dac6987ea13bd50478ba30a2f5b9c1df62d8b6708dec565d47b7cbe413be8cca
SHA512	fbd398fbfcdbd362d264a7a4c48807ca7b80f89d56fb949711c9eab81b8bd673a5107c56550cf7c90671741551b3112ec2a6c204deb70152143ea64430f664bb

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\de_get.svg

MD5	a554373633576209121c2c48ec091e2d
SHA1	cc53d0fe9745acda5e484ad7f9a7bc5dc8a8d086
SHA256	3dbedb2f75defe66a2cf74baed5a77522825a740e23556a1c11fc7cb38679ee2
SHA512	beeca3f63f168b80f7e9ba6385277b6c55b269ca7bd4e1fee0ceddbad309eedb9f1ddfd5b60484d8605cb9eb3541babe9c4d26b72ee8ab3af816f17f0452dc20

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_ru_135x40.svg

MD5	5d584206b707eae6805b1cdf56f9e435
SHA1	9b0730ead9f2d9c0322d12fe64b85f6fc090a347
SHA256	26850093093557f12e73b4712df6e9238ca1434b7684dc8dc4a72c1194ab6b6b
SHA512	f0a9bef6fed4dd40fa975ffd6fdca154e96f4a6edfb206c5da1b14df7cbca060ab41310d5fcdd5da96c4e7b81dcce2429af9f6d1e79028a778272ec76f0f3eb2

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_ko_135x40.svg

MD5	c54438234b7558cc6fb8b98331ffa54a
SHA1	4dae93365bf6d59648bde5edd4c120ded31e97b4
SHA256	d0ca0ade44f27ba701899b76b32b23664ff53673eae44346a214b2da2f0658eb
SHA512	f2ad1ff0f89abdc68bffbd137f0ba8f077a8e914c9fdb9baf9162efe73b1b4f74ea88c9722fe33b32504b0c5b7d3c32861802bed4a25c1ccc5d77eb62e6b13cf

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_nb_135x40.svg

MD5	99c6a0974d832dc49b058aa29ad682a5
SHA1	53239ed5b123a0698d916c904849131dac49d68d
SHA256	da4d198328d986054831bae1276ed9276fb03819ed1f1f535e682636b08fad86
SHA512	57dec23919e7e16c61961d641afa5b1ad394efa7a71e3eccebd2287252b1de377800c209db4a4281813f0285b1a04f73bd1d82a20d8676cf4cd997af7deee665

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_pl_135x40.svg

MD5	2c297db93d53cd228a2109d61cccf5cb
SHA1	969615af75abbc393d8379592dfd0f39f9f1f15b
SHA256	778b711f64ac9f6928d490b910b888db0186286baed3aac9514d8b23f5340f51
SHA512	303e5d719c2c3b27851a49a02548cc23453096b771f4241dba4cae4af750fcb935b98ecd1b0fd9c09d749711c16a3484270bf8e07d8c37ae6ed922834aeff4ac

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_es_135x40.svg

MD5	1f252cb7b0426b00d35afb5034d99c63
SHA1	3e5b6af3dd630fc24b95746d21a17be3b34ef195
SHA256	3be5e1b22e44ccecf19ae5ac00061f045bde5851ac9caa31c6d9c0318a8569f0
SHA512	092f3e3896f48de6fd81f41eaf78ed8580b7029af9ded0d6a934e078c6a5be36d4e45d4a6249059785f47887e7cf0dcedec197c2f44b17d932e03f150f5e108f

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_sv_135x40.svg

MD5	1fba45cce3025422cfc31d34788f37e3
SHA1	31d0204e4763a8a1769e5d1f721285d821f89e0a
SHA256	b2156c6db9084f3123822471d0f9f4132024eff5d33d5a28ef257fb5381c0484
SHA512	beb8ae0f6f912fe4b156d9faa22cc6b8d5bab005d3526d867a7837e33357ee06b57a2dea2456be4896981bd181577d947efb6303f2febaf5ee3d79bd7b06dd97

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_fr_135x40.svg

MD5	f3f8b91f01ce6ce199e1abfa7629533a
SHA1	a980fa2d0cc1051348a4c8c2578c3217c17f1466
SHA256	5aa01a67dac3009e234551ac3751ab64500f6c999bdf004e3211a4459257e8bd
SHA512	04528f13658a951b14b82784dc28da075ab40679cf1150358bc326d9cbadc9088e118bd1293ed8ee701521461ed5743cd5c8d37f07cefc04547b59dbcc926fe8

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\fi_get.svg

MD5	7c7cd8f03d823ca47807b9daecf4fcaa
SHA1	9dfb6aa9955a3e587d01a4dde0d323efb68b1c04
SHA256	1f5d86ba5e1c3979a83ce8993446ab8668e31e8e28b3a7522eac002ec666e977
SHA512	afe737936e499f1e47d54a622d0b4c8ca53157fd9df983a2225431c24249d676d8bb9b58948ef7a2236c8d5525454ce2b83f68a32f2cbae67d33296245b4d818

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\root\ui-strings.js

MD5	172c32a8641bdaafb6e35fc231452c32
SHA1	03e846bf9fd6c3627f426063ef359a1d31595f38
SHA256	a53c69380c332fe8c4364a69b00b5004858ebe3db25e99a70dde7818a6c4e098
SHA512	a6afadf4e43b0a1c31fd49a606610a05f93a9ce615fe94b3d16312de91e821b2663e17994785e2ef917c175529613fc93b87ccc7fe464d76a525f81d389e8f0e

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_de_135x40.svg

MD5	002e9879e4f39fd6a435e725ba9b3741
SHA1	990dd0af466e9c1ac4e1c388255e411dc775736c
SHA256	486e91ee1d52b6db7bc02638b0832b00a3aa6231e80c3b1b818e60815efd832d
SHA512	b2bb1800762247e0b6df9ead440ca3684dc54932a16869a5823de5502eeaf6e5f5ade67feb781bdd18519f33e3020ac5dfb19769113a57acb8375005fd1fc084

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_ja_135x40.svg

MD5	9628693c2e4c7436c45cc6f694df645d
SHA1	7735cb34c4479da44e25cf5a1bc64aeb7ec47771
SHA256	c6b035384b2895acc5af74b3c64a102c554f12a47c591e64cf7a831d25345a4e
SHA512	95e6909c881439135b91a0208d301b2074580e3cec81e2b67d17235a2d787975fab9000b250e4a17e4546d4ea501cbb1765592e1babb30276ae209b51ef3b567

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_zh_tw_135x40.svg

MD5	e844b9408fc9b5f763ed47b07553371e
SHA1	6dfb3dc2d6e264915af7f9c9568684215233e8ef
SHA256	bcf56571c4e13b8fc7ecd2a96e983690f9e04975b22d43407d671fa4a0f916a2
SHA512	f24f17a0b0ac8d26982c04e88cb01b261b2ffd3c952268a1d0089c6e3d1bcea2578b6f8c67f5b149fd163db166bd2416850172766d22bc3fd0cdcfaee4b62508

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\zh-tw_get.svg

MD5	e56bdbdc2e3e32cb66e1d4b6627e96f8
SHA1	89789fec87996d6f1ed963c5bed5d4581f2bd345
SHA256	97babcd123ddb7c0c79e0b95f3ef9948376bbdbaecb2bd039d0f02b0229c3681
SHA512	a8852e603f765489a668585a822de135b7ade40a8b1829cdb6002fb48b8c8c91e0fc5835e86456c1a7ca2a031b010008c5b21637b7bcd76cd9fc913d6638edea

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\zh-cn_get.svg

MD5	e41f173081dd9c9328d9b43c989e0e0e
SHA1	9f840f097c0177efd6338c821c76ba8d57f472cd
SHA256	3ca48e4bf1a944d3cb368543fb32b9200370f7e4548b0dc241fc302879f9d804
SHA512	6e0816dfecf710fa1e2aaf846385dc5159fdef94244665d411cc4ae0bb7d48c7efed1fb17efcdc6750fa55fd7ac6efad4314adf8a387708b469c8711adf1fee9

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\ko_get.svg

MD5	8e7a513dd863763d330b3020579c60ab
SHA1	b30b4d10d5dfc31e199f55ac7c65bd4c0959de88
SHA256	12b4c20eee287ebb573f21d9a1097d1c7312417222a7c3c035e75116eaf4c199
SHA512	002278da5ce8f736ed03ae50e1996e6692d50acc96cf8377eb8110d927ec6d7faa0c6567cb5180d80abf04b265c537402385c46daa8e9039b72ea786e983838f

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\da_get.svg

MD5	9467321bd82cd1ce48a4800184359fe2
SHA1	04455d710cfe3ca77fa92bd901cb21bbc8c97e78
SHA256	959be56d7b64d3a4026a78e5673fdf1b6b279426231ab6ce0d31d52e8cf0443f
SHA512	ba1acc54a54d48c699fec8055768cbd29c809d99604b2fd13fcda65286238b74e21b8cfd9e8fb17ca7f492fc9d050aadfafa569b65bf7aee00d1e2109706dc20

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\ru_get.svg

MD5	086300c86a24a0368fa76580edee6cb8
SHA1	8990c732e5e5cc52b76315c9ba737009914bc7a3
SHA256	be98155e624877297860751267a1ed2218fc989f50a2f843679c5fb9b26b5687
SHA512	8752ca32dadd572c1b73ab71371b45155d8ac5d90bbcffea9121bc9420679a97d0621eb4b9a6d1cb1095ab78a49cbd04341d9301aaef7c5ed0305f1e17a8d8cc

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\pt-br_get.svg

MD5	15afae958385e6280b7333b5cadf675f
SHA1	e51914827ff95e4098e5edb177e18fc9ec9bf86b
SHA256	91e18cddf63ca918906c2e258b8a69e0b373c52defa48c6698cf91cbd018b4f7
SHA512	3b5846a1a50785ffa55c0aaaa48a490bc81293c5bad3d6aa92cb014000f667b0bb0954266cbb4c7a2d3d325c444b4d003f34e74ddf3d3d6b3f12e410d3cb2eb7

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\he-il\ui-strings.js

MD5	5ca19b59f7c96e1b088a86a6f1e0f4b9
SHA1	d84af069a8f5cff6e437b2815ab8bcef5e4980f1
SHA256	24993a6e0e3df35470e40cd89a8b7163f5ebffa0467b63f7fc7a0173a4043be9
SHA512	8edf78f372696720b06a92dadd0de6b33c6a25d92ac44635ccb0f960ea2b7df29a08c34399a5adbfb6a35158b8a716e85c8b34fd2d689e907ee6b9cc6943b0c1

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\nb-no\ui-strings.js

MD5	b8de8a3fbe705c4416aeaec0dc697d62
SHA1	17790a79746f3447e039729826b1c60414f19b5f
SHA256	1d3381e3ba9bc73d8b9d8764de27084c02add619a1bc2880a14ee8f31c2f3793
SHA512	c8d1c35c39f4ff7d7e240f9d6da596cba56a97c04e10fd2b2e899042095086f57649016da938634d8a24f54539d20c6ce88ac4a0ebc79596e31ae388fe7091bc

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\root\ui-strings.js

MD5	e19fa2819aeba07292e76b23f1d424c1
SHA1	532f5579a1588b330f52cbb4be4e0382bce3a8ab
SHA256	892f598cf326c77a24c51b3f744324ecb93364e15f4b99aa74c6367866757a58
SHA512	8bdaa37c8797a4bf3d2fd367db1dec7518f29db5fce405183e3f95f5c1bb528d2e96d77e28979bda93767648995cf0e8cec0863bcef924dc613621f01aa31c53

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\root\ui-strings.js

MD5	1235d3cdcb5756f3ef7a4ab745dad884
SHA1	bab1b243ce770ffbc4c55e4cb3a3668849aed8ca
SHA256	c6fc7be565fc1bb0623ac6c2fa5d8f1efb4a4876b00e6fdfced888f345ad0daf
SHA512	1afe9d8e93e6e480dca297309fff95f91f879e03700dc1650de1c6b69237c46b8a2dffe6de005e6ab32d5740f4e0f4912420bc092ae8e5dc839d9da0944e4b85

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\root\ui-strings.js

MD5	d8533ac7a2813ef181e3b76f5a122150
SHA1	f045e5af1225ec3d773d070a21658d6076154bd6
SHA256	d0f475b76338e048c2b92039d73ff53f7a85d16597badd20f65e04c361e2735e
SHA512	6dcb588f8825e57a95a2a2c09b6409d92fe7ffffd286f3cb0d116e52da2e47e7fbbb97a05402bd18f957e3d631cfe31b472007aa3249834c3704fe38e098fee4

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\en-gb\ui-strings.js

MD5	3c9350387e7c8e17b6d1dd11c603a245
SHA1	0e9cda9f86cfd6d687c1b5089ad36173fb45c822
SHA256	d86f05920f248ab04140bcd63b7a609da00f8b98f5d5e4b69e45f7d661526aa0
SHA512	e762ec7dadc3014f172d7449880e91949a0ea506601dcf2173ad800ce133bfc30925d8fab4131bbbbdaee7ec795866acad839a083853ea157d8e45dfb6552863

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\bun.png

MD5	8f39e617aa70dde1f6b8eefd1418786d
SHA1	23533987503febdbabd757837d684b59666ca1b4
SHA256	a177b7d0f804f6ba64d0f4975658bb8de4d8e1c5cdf4357744405c9f3ab26e71
SHA512	2ecb88a0d37530316f974f135292397610cda5d26b431491e72830f0d85223067739ad9c3260b155bc02c8a9ec785838ccd7a2f986ef34a47f60b9f34ecffaca

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\dd_arrow_small2x.png

MD5	47a1fefcdcf91e968657b89e1e7ec6b6
SHA1	effabc1bc43939bb5d53124e7b7dee1d60aef146
SHA256	31e64b1889e7172e06c8afed07e8a4b4b29937cfda7a20fc4fa84945801bd9ba
SHA512	802dd3e69f452cae17e40ea64576aaf051d487e1af64d83761028f2e958bb43c92c4d8b7db7393ae4ba7e12c18c14b2367b2f02ad2c87103723babcd66338cd9

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\dd_arrow_small.png

MD5	6a18f9b8e7158ed82bc34f17e3fff43c
SHA1	a0b2ab754863f91cbeecf93eaf42d3510803de5e
SHA256	90d6779bfa6ec869fa6eb6e63c595d4a42be680efe1a57fd710d3e42b4467f49
SHA512	fe273076336c243677822457b6d13e9578b4677ee99b5c050a0e2517db45fa0c5c01639aca3daa9c2d67301ec9679f25574c94abcb22864e662409222401b3e6

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\en-il\ui-strings.js

MD5	eaab472cc1ea7c40140d91bd0deee78c
SHA1	a5853c4916ff46aeb225ed10a113853b15ffeb58
SHA256	60fe77a4930ac8c4fe85f827dcaca3bd7ac8d1811db8c7b522dd2cb9bab1e331
SHA512	6e6d51ebddba7bec9274b9d606e490c3ea5bfa867a79794f985402baa41aa032b5a417846c94c89083931b948131b4392f46b1c4327f0f8d1e90c778301e3356

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\dark\share_icons.png

MD5	e3b447765a2751025c9ec73e741e2a86
SHA1	2efaf0c4fdba1bd43b42d3d0b1b9ee43b5a1a522
SHA256	05d048a7bad5bd9427969bd64cca0d7698210655cdfcb923d29f5c16648742d5
SHA512	0660674a8b4b891da9749d8c5248e106030fac65a73da9aa0cc4c4389854c98a3f17befa13b0bab750b9381e102534660a4a8f541d4e37264848392008e56a82

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\dark\nub.png

MD5	6418641a9c404f35582d8f2408e9776a
SHA1	427a8a97847dd38bdf1bf67a35e84dce99a1ea95
SHA256	41f174224778b74958e58a7edd1d685c20f686cea8b7acc4441788ed16ac8fcb
SHA512	4915dbbe78c38cf202ea86f7d09d2ed907ac88b8ff0cdbd4eb358447e500f12f48fbc6f54bd6504ea79a95e0154eed16d282abc491dc7be992989a0c3909eae0

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\dark\share_icons2x.png

MD5	3412bf9f039c194f82d54dad9cd5e136
SHA1	5ce18986f09fc4d0d133777ed1d1892a3c2201fb
SHA256	fee7421584b06db79f6da0ddbacbdb76fed5d3a043a2ed1326bdd37db3a95a17
SHA512	f86ef76964e38a6235a8142eb630d81da56ac74353908d500c38b160aa57e00a01b1da453e2e8a455cecf2bcfaaa01a3b75a8dfea2f381ef8042165c5327faff

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\cstm_brand_preview.png

MD5	74ae02cb0012cf5bf4f4c54948d1a674
SHA1	0a7ae7738d8acdfc109c1e99a6c7116f918b8d3c
SHA256	0c51ee12022130833d1a5eef9eaf47b9c3515ab3113721ee62554a7aa4f20085
SHA512	4cd81942c7ead1b352ebebe779ce3fb479a0b5ebbba11680414ac0512052c32e48fd1d771b53b301f99c8c7ce07b58978130f48ccad1222eab54d283823554a1

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\cstm_brand_preview2x.png

MD5	ccfeeb16c513efda7f62570f68bd6f12
SHA1	d588f8105a4a59ac5e064130ca02886e84066885
SHA256	d20d638d1231f306d6dfa58d1cd494b2b555500fdad220f19501b1fcaf954616
SHA512	fd157ddc07a3b4686a28631f237998e473c1d1ecc97fba896f27ac42dae6ec870cca177d6bbacaa76df921a61d569fde39e3eff33591deba8b84430be93fe371

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\en-gb\ui-strings.js.meduza24

MD5	50d0e29aab2e1657a467510989b1a1fb
SHA1	5c44425e5360d5f57fc7c60ebce40461bcd1ea1b
SHA256	5c3d1a3d046be0e1ff7b82978ffc583cb85befb2b5f0af1de12d439117a18aa3
SHA512	8022896edf9526d055deee80b762b44ae2aceedb7fb31f5b6a4b207c7a5592766c1b888ae19a98403ab9f81fb720e1af5256366674af8f51df372467b1d88027

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\root\ui-strings.js

MD5	c69b4166dbc06db0a08573fcf96d72fb
SHA1	2b7c6a83f543878b6bcae27f1ad0521f00705feb
SHA256	39103e2494f297e03dc386e003175d8529fd60e81d0f7e8e4f86115fa08bd5de
SHA512	6dca3ff26faec9144add41f8703b2ae3a9897ebb8a3b904ef47d39307c21d9102368d022cdf268d846598c1fc258407cc8e42944b0235cc36a6ae58ce30cd529

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\he-il\ui-strings.js.meduza24

MD5	8541e2f2e81863fe5133245a7285dca6
SHA1	4d0ad78e612267ea5b1ca8ec988c7fb00264b5e5
SHA256	d0087f4c87af98958f2cc65ca3cf86e924334f0d436dec96cbb016a3b4f2b854
SHA512	7b0917f15f2963998889a0471119eede86c1c362225baaecfeb18c2609b555f586ab5a5cf207a7acaec6712353744cad9b00986a13e410b00ebee2247f48711f

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\root\ui-strings.js

MD5	97ce9ff981c9c458127a6c6a2fa5e353
SHA1	21b99b172628af3bb6a0f70048a634f00ffe78d5
SHA256	b8c0307df2e666bbee7190a48dddd059e65b728fbd7a5fd21cc5a91fd36d9763
SHA512	3412367fb5e53a9255c444c507e05f7184757965683cb83e6b5ac9363213b124f9f90081eaabba1a2f3cf8c0463b9759b0d253326a5ce1b975bab2d99d8e685f

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\css\main-selector.css

MD5	f9700f9e90fbe5b201f7320108a80c9c
SHA1	d7e76178c6b790ad3c6b03170d9b1dbbe721a8b3
SHA256	2f758d9a6e62748df188082a81ec46aa64cded8c9249861092a4fcd979ab06eb
SHA512	33be57bb1fb08dd46c7016a7609c576397f3da29253e22cf7eadd0e1d5b3117614260b1b5e74a04ab47260f2e20a08ec4a3531f3c002c403cb9ada602eb7753a

C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_US.txt

MD5	efaf544147eadee07a8f81e4862c3fcd
SHA1	6ff338e86c1984b06ce9e059ed9236f3d9fe376b
SHA256	3defa4563479298e1922d6b93d20785e17714b0e05974a0f3a3c2ba981d766ce
SHA512	98ae6aea795721dcfb9f3f1c132f400fafd97794bb18c29f2c467981a3542d299fcf7c6dd184cab0c888d38af565204103bb227bb1d26b6afdfd2b74acac81d4

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\identity_proxy\identity_helper.Sparse.Stable.msix.DATA

MD5	a26f6d2e89335d7b89dba5f6c18478fc
SHA1	f428e7f186eb71937779bc3be721305eeaaf2de2
SHA256	c14af59d028a63b24b8fcddc925c567b2ffc633d6d3d48e73afea338cf95a631
SHA512	498edaeed11a7147e68b4ebb77dafa5d2ff91ea9aa2dba687fe0ecf34eaab691cf7e3555faf0348ecf9a7a2297358d3d2d1cf786e75a020839d9782e04f9cc2c

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\notification_helper.exe.manifest

MD5	60081fd7054c9603a3698b067779828f
SHA1	fffdb3bb5739842c33d0cdbf5aa67218f4ae24ad
SHA256	e43f02cfd1b242cb5143c83960a5c9c8a516131d2fd6111317a9bcb0dc5ee197
SHA512	ec33b304325e5fd4dfe3badf9ece6581b4dee798ffbc9b506558938084bb6af1f6525f119ade87cb92b42e2eeeec9b28806c4b6e1b8c6a14c0a8f5da6160e090

C:\Users\Admin\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\000003.log

MD5	55255ccb9fc7d1ce63beca4228d2cca5
SHA1	32ea6522cc60f80ad343b52d6533a915bd694171
SHA256	909221bb56f752b90c3f6e84c60209cf88c1e620ba038ca73b1414526ea1df97
SHA512	b5ff6673f84897947d572be6ce5867dbfa6e52128b5eeaa8b625d9a37d6c3656593567c601af289b4ee6825ede2214bb11bc0dbd3777adfe822cf580330a1b28

C:\ProgramData\Microsoft\Network\Downloader\edbtmp.log

MD5	e6de952ce7130b46dc13d78eb5689708
SHA1	46894385cff81be12c3c640bdbb3ad956067c1ce
SHA256	fe7750de1d30f2aeb22eb2bed0c3c2d0185d737f004eaff837a0599ca7273d72
SHA512	a4b847887d55b0ebf47dab4dfde142341dc2e1c812f0cda0c96fc22ae8a277fe2ba34e8763780422341f21b7e399b1ce46b4c54fa63299a154731f90e4574e50

C:\ProgramData\Package Cache\{C7141A99-592B-4226-A4E9-B767C1D0FBAF}v48.100.4028\dotnet-host-6.0.25-win-x64.msi

MD5	42bbb3653d50c6b69a97b4296779804f
SHA1	4ed0121311ebb06f88f92848b7c45d62a2de81e9
SHA256	8bd1c39a88f39da2ade155804954df738dde7b563ef9b361063bd79646a82de8
SHA512	04a921e82f058e161416ec6d3c24e201c5a6f9283473209657a09fd7a87c51a4b3e7dacdf1c8131a965bb42f3d806550ada434c672ea42233c5e580c008c519c

C:\ProgramData\Package Cache\{662A0088-6FCD-45DD-9EA7-68674058AED5}v14.30.30704\packages\vcRuntimeMinimum_amd64\vc_runtimeMinimum_x64.msi

MD5	783237aae066abd9de29289c4d4d274d
SHA1	d86bc54d8d6251c95c5726963b1869d1ad29a007
SHA256	b5fcaac43d5e04b2a5f1716ef0b8f27807af2657ece122daae20c4b745afd4f4
SHA512	51acb12de5c30ce7a1cfd7097b90996c523259e0ccba5b5e492b162c46b872fef84eb99ec4c0010025d52e97d4e3dbb4059e5a30a43916c3c6bd7187e4c73c7e

C:\ProgramData\Microsoft\Windows\Caches\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db.meduza24

MD5	2a938395a71e547b1f6f894bbe4fd058
SHA1	9ab85bbf5b18141feb3c94573312805bed1c2e1f
SHA256	a7936eea79c21e3ee9aae8ea23d2331afd4d0c5d25c753264d282b60e9f318f4
SHA512	b8967ff4e798cbae399e5389adbb908bfac30a1383a0441ba8b5efe5644c5c026fec5e5242a01f83b7ec27da31e4e007384ca928130d162bd44a3c77fc39a67d

Sample ID	240227-wg8mbafe79
Target	c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60.sample
SHA256	c1d4014e65a8d79e555378dbf8e5db5786e3b6e4c841f7f64a3f40318bb59e60
Tags	medusalocker evasion persistence ransomware

Malware Analysis Report

2024-09-11 02:17

Table of Contents

Analysis Overview

Threat Level: Known bad

Malicious Activity Summary

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files