Malware Analysis Report

2024-09-11 01:45

Sample ID 240227-wjk9ssfh7w
Target ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.sample
SHA256 ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106
Tags
medusalocker evasion persistence ransomware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106

Threat Level: Known bad

The file ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.sample was found to be: Known bad.

Malicious Activity Summary

medusalocker evasion persistence ransomware

MedusaLocker payload

Medusalocker family

Suspicious use of NtCreateUserProcessOtherParentProcess

Deletes shadow copies

Modifies boot configuration data using bcdedit

Renames multiple (6530) files with added filename extension

Renames multiple (3887) files with added filename extension

Modifies Installed Components in the registry

Deletes System State backups

Deletes system backups

Enumerates connected drives

Adds Run key to start application

Drops file in Program Files directory

Drops file in Windows directory

Enumerates physical storage devices

Unsigned PE

Kills process with taskkill

Uses Volume Shadow Copy service COM API

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

System policy modification

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Runs net.exe

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Interacts with shadow copies

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Command and Scripting Interpreter
T1059
Persistence
TA0003
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Privilege Escalation
TA0004
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Defense Evasion
TA0005
Indicator Removal
T1070
File Deletion
T1070.004
Modify Registry
T1112
Credential Access
TA0006
Discovery
TA0007
Query Registry
T1012
Peripheral Device Discovery
T1120
System Information Discovery
T1082
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Inhibit System Recovery
T1490
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-02-27 17:57

Signatures

MedusaLocker payload

Description Indicator Process Target
N/A N/A N/A N/A

Medusalocker family

medusalocker

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-02-27 17:57

Reported

2024-02-27 18:00

Platform

win7-20240221-en

Max time kernel

152s

Max time network

137s

Command Line

C:\Windows\Explorer.EXE

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess

Description Indicator Process Target
PID 2996 created 1396 N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe C:\Windows\Explorer.EXE

Deletes shadow copies

ransomware

Modifies boot configuration data using bcdedit

ransomware evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A

Renames multiple (3887) files with added filename extension

ransomware

Deletes System State backups

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\wbadmin.exe N/A

Deletes system backups

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\wbadmin.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Windows\CurrentVersion\Run\BabyLockerKZ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe\"" C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Windows\CurrentVersion\Run\BabyLockerKZ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe\"" C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened (read-only) \??\F: C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0145895.JPG C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Monterrey C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0146142.JPG C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\mip.exe.mui C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened for modification C:\Program Files\Windows Journal\de-DE\jnwdui.dll.mui C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\css\How_to_back_files.html C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0145168.JPG C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\IPSEventLogMsg.dll.mui C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\PreviousMenuButtonIconSubpi.png C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Edmonton C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\feature.properties C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0152594.WMF C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Seyes.emf C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\Words.pdf C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ECLIPSE\How_to_back_files.html C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\VGX\How_to_back_files.html C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0103812.WMF C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened for modification C:\Program Files\Internet Explorer\en-US\networkinspection.dll.mui C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-progress-ui_ja.jar C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-snaptracer_zh_CN.jar C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\lua\playlist\jamendo.luac C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\IpsMigrationPlugin.dll.mui C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-explorer.xml C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0106208.WMF C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened for modification C:\Program Files\Common Files\System\ado\it-IT\msader15.dll.mui C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Copenhagen C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Bangkok C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened for modification C:\Program Files\Common Files\System\msadc\de-DE\msdaprsr.dll.mui C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\th.pak C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File created C:\Program Files (x86)\Common Files\Adobe\Updater6\How_to_back_files.html C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-masterfs.jar C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\view.html C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File created C:\Program Files\Common Files\System\ado\it-IT\How_to_back_files.html C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File created C:\Program Files\VideoLAN\VLC\plugins\codec\How_to_back_files.html C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened for modification C:\Program Files\Windows Media Player\de-DE\WMPMediaSharing.dll.mui C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BREEZE\PREVIEW.GIF C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\4to3Squareframe_VideoInset.png C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Jayapura C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.commands.nl_zh_4.4.0.v20140623020002.jar C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf_3.4.0.v20140827-1444.jar C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proofing.en-us\SETUP.XML C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened for modification C:\Program Files (x86)\Internet Explorer\SIGNUP\install.ins C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\README.txt C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Brussels C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\gd\How_to_back_files.html C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\tile_drop_shadow.png C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File created C:\Program Files (x86)\Internet Explorer\SIGNUP\How_to_back_files.html C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File created C:\Program Files\Microsoft Games\SpiderSolitaire\How_to_back_files.html C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened for modification C:\Program Files\Windows Media Player\es-ES\WMPDMCCore.dll.mui C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\js\How_to_back_files.html C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\js\settings.js C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SceneButtonInset_Alpha2.png C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\How_to_back_files.html C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened for modification C:\Program Files\Windows Defender\en-US\MpAsDesc.dll.mui C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\js\calendar.js C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\en-US\css\currency.css C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN04235_.WMF C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BD19988_.WMF C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\js\How_to_back_files.html C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105410.WMF C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\How_to_back_files.html C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BL00194_.WMF C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD00297_.WMF C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Logs\WindowsBackup\Wbadmin.1.etl C:\Windows\system32\wbadmin.exe N/A
File opened for modification C:\Windows\Logs\WindowsBackup\Wbadmin.3.etl C:\Windows\system32\wbadmin.exe N/A
File opened for modification C:\Windows\Logs\WindowsBackup\Wbadmin.2.etl C:\Windows\system32\wbadmin.exe N/A

Enumerates physical storage devices

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\vssadmin.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A

Runs net.exe

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2996 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe C:\Windows\SysWOW64\cmd.exe
PID 2996 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe C:\Windows\SysWOW64\cmd.exe
PID 2996 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe C:\Windows\SysWOW64\cmd.exe
PID 2996 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe C:\Windows\SysWOW64\cmd.exe
PID 2632 wrote to memory of 2524 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2632 wrote to memory of 2524 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2632 wrote to memory of 2524 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2632 wrote to memory of 2524 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2996 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe C:\Windows\SysWOW64\cmd.exe
PID 2996 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe C:\Windows\SysWOW64\cmd.exe
PID 2996 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe C:\Windows\SysWOW64\cmd.exe
PID 2996 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe C:\Windows\SysWOW64\cmd.exe
PID 2608 wrote to memory of 2576 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2608 wrote to memory of 2576 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2608 wrote to memory of 2576 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2608 wrote to memory of 2576 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2576 wrote to memory of 2936 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2576 wrote to memory of 2936 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2576 wrote to memory of 2936 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2996 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe C:\Windows\SysWOW64\cmd.exe
PID 2996 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe C:\Windows\SysWOW64\cmd.exe
PID 2996 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe C:\Windows\SysWOW64\cmd.exe
PID 2996 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe C:\Windows\SysWOW64\cmd.exe
PID 2584 wrote to memory of 2656 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2584 wrote to memory of 2656 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2584 wrote to memory of 2656 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2584 wrote to memory of 2656 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2656 wrote to memory of 2400 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2656 wrote to memory of 2400 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2656 wrote to memory of 2400 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2996 wrote to memory of 2416 N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe C:\Windows\SysWOW64\cmd.exe
PID 2996 wrote to memory of 2416 N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe C:\Windows\SysWOW64\cmd.exe
PID 2996 wrote to memory of 2416 N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe C:\Windows\SysWOW64\cmd.exe
PID 2996 wrote to memory of 2416 N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe C:\Windows\SysWOW64\cmd.exe
PID 2416 wrote to memory of 2476 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2416 wrote to memory of 2476 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2416 wrote to memory of 2476 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2416 wrote to memory of 2476 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2476 wrote to memory of 1720 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2476 wrote to memory of 1720 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2476 wrote to memory of 1720 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2996 wrote to memory of 268 N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe C:\Windows\SysWOW64\cmd.exe
PID 2996 wrote to memory of 268 N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe C:\Windows\SysWOW64\cmd.exe
PID 2996 wrote to memory of 268 N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe C:\Windows\SysWOW64\cmd.exe
PID 2996 wrote to memory of 268 N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe C:\Windows\SysWOW64\cmd.exe
PID 268 wrote to memory of 2700 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 268 wrote to memory of 2700 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 268 wrote to memory of 2700 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 268 wrote to memory of 2700 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2700 wrote to memory of 2708 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2700 wrote to memory of 2708 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2700 wrote to memory of 2708 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2996 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe C:\Windows\SysWOW64\cmd.exe
PID 2996 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe C:\Windows\SysWOW64\cmd.exe
PID 2996 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe C:\Windows\SysWOW64\cmd.exe
PID 2996 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe C:\Windows\SysWOW64\cmd.exe
PID 2720 wrote to memory of 2748 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2720 wrote to memory of 2748 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2720 wrote to memory of 2748 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2720 wrote to memory of 2748 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2748 wrote to memory of 2744 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2748 wrote to memory of 2744 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2748 wrote to memory of 2744 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2996 wrote to memory of 920 N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe C:\Windows\SysWOW64\cmd.exe

System policy modification

evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe

"C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe"

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c rem Kill "SQL"

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c rem Kill "SQL"

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlbrowser.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im sqlbrowser.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im sqlbrowser.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sql writer.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im sql writer.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im sql writer.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlserv.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im sqlserv.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im sqlserv.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im msmdsrv.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im msmdsrv.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im msmdsrv.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im MsDtsSrvr.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im MsDtsSrvr.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im MsDtsSrvr.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlceip.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im sqlceip.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im sqlceip.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im fdlauncher.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im fdlauncher.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im fdlauncher.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im Ssms.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im Ssms.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im Ssms.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im SQLAGENT.EXE

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im SQLAGENT.EXE

C:\Windows\system32\taskkill.exe

taskkill -f -im SQLAGENT.EXE

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im fdhost.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im fdhost.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im fdhost.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im ReportingServicesService.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im ReportingServicesService.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im ReportingServicesService.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im msftesql.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im msftesql.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im msftesql.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im pg_ctl.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im pg_ctl.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im pg_ctl.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -impostgres.exe

C:\Windows\system32\taskkill.exe

taskkill -f -impostgres.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -impostgres.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop MSSQLServerADHelper100

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop MSSQLServerADHelper100

C:\Windows\system32\net.exe

net stop MSSQLServerADHelper100

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop MSSQLServerADHelper100

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop MSSQL$ISARS

C:\Windows\system32\net.exe

net stop MSSQL$ISARS

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop MSSQL$ISARS

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop MSSQL$ISARS

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop MSSQL$MSFW

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop MSSQL$MSFW

C:\Windows\system32\net.exe

net stop MSSQL$MSFW

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop MSSQL$MSFW

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLAgent$ISARS

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop SQLAgent$ISARS

C:\Windows\system32\net.exe

net stop SQLAgent$ISARS

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop SQLAgent$ISARS

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLAgent$MSFW

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop SQLAgent$MSFW

C:\Windows\system32\net.exe

net stop SQLAgent$MSFW

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop SQLAgent$MSFW

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLBrowser

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop SQLBrowser

C:\Windows\system32\net.exe

net stop SQLBrowser

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop SQLBrowser

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop REportServer$ISARS

C:\Windows\system32\net.exe

net stop REportServer$ISARS

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop REportServer$ISARS

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop REportServer$ISARS

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLWriter

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop SQLWriter

C:\Windows\system32\net.exe

net stop SQLWriter

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop SQLWriter

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c bcdedit.exe /set {default} recoverynabled No

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wmic.exe SHADOWCOPY /nointeractive

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTABACKUP -deleteOldest

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTABACKUP -deleteOldest

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c bcdedit.exe /set {default} recoverynabled No

C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe

\\?\C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe -network

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c vssadmin.exe Delete Shadows /All /Quiet

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c wbadmin delete backup -keepVersion:0 -quiet

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTATEBACKUP

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wbadmin delete backup -keepVersion:0 -quiet

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c vssadmin.exe Delete Shadows /All /Quiet

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTATEBACKUP

C:\Windows\system32\vssadmin.exe

vssadmin.exe Delete Shadows /All /Quiet

C:\Windows\system32\wbadmin.exe

wbadmin DELETE SYSTEMSTABACKUP -deleteOldest

C:\Windows\system32\wbadmin.exe

wbadmin DELETE SYSTEMSTATEBACKUP

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c wmic.exe SHADOWCOPY /nointeractive

C:\Windows\system32\bcdedit.exe

bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\bcdedit.exe

bcdedit.exe /set {default} recoverynabled No

C:\Windows\System32\Wbem\WMIC.exe

wmic.exe SHADOWCOPY /nointeractive

C:\Windows\system32\wbadmin.exe

wbadmin delete backup -keepVersion:0 -quiet

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c pause

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

Network

N/A

Files

C:\MSOCache\All Users\How_to_back_files.html

MD5 1476d3f97ee42b0cb4eaf7a8313458e0
SHA1 0802384026418c0b503578d052bc7d990cb3263a
SHA256 19bab4fcf5a5d5109eb1c15e3fb4127ce8499fc71ad7d15951cbb5689a3f8645
SHA512 33a53c7a82b40f0f1e204f79eff4e1b04c60f05489931cd370ae6e0d0a7ba9656160f87f7ad020ee5a9c1272be966bc2cf1087ccae3db1bd1c6645df6ff5efc4

C:\Program Files\Java\jdk1.7.0_80\db\bin\NetworkServerControl

MD5 fa72bbd1c0c3b014f936a9cf40962d4a
SHA1 f77495f95f6b122a3b0ba048e074c60a9c9f9b85
SHA256 4fceb7f9ec9f4c788741576d9826019d801a6b44af329ecae321b6e1536c2d4b
SHA512 79fda5a6b3ecb0c2663ed48de3e17c74808dd751bae2dd3724a42cafc7aec633032323be1b84e3b43b7b6a45f6790ed29cfe802fe77964de6589e3d0df70f556

C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif

MD5 9e00d867e40efb691fa13fbebb5c95dc
SHA1 cd971d35032b172eb326decd05dd89562baf6189
SHA256 3b93aaa4ccaef849b6f5eae1dd2b7629785d4d9d5217b9a7dcb766a274b52d28
SHA512 3ce3ab745c2ac05ac6d61588e7618cca501f738c88668eca79a9447a747fd13d30d6f9cfae8f1f5144362a34685033cdf3e78ec91d0af6bbdb6a5e3a809be67a

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\UTC

MD5 8d6043786f54b00e3753165ebb0d2961
SHA1 0d22f95f0d80a60db58648c27a89312efafa606b
SHA256 0b4892f542c8175ba7368d1875fd87773ea0a56089c9f63414b6f5af88abca76
SHA512 4c2b58cb12cca498a057b87ea3a8a8c615878d02972dbeb14771ba67bc695c6e5822e123bb6c650c00a228acd4476e7e984f4c6e39f4b5531637c1347e60a829

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\EST5

MD5 6523f6785672d90bd9073c8a9ee95c6b
SHA1 85b69cb5e5923ae35f0c97136790d3c347343f99
SHA256 8c0c3535fd8bc6f518093afefaeb86618ee6704324c96140e9e06116a6ea6c8e
SHA512 1f2531953b08621056b94897dd9811929454d5d6e675a25d9e4201cd42496f4dfc0c117ac82b47a64d8dd77c643131314202f65b49c26fefff25d423a409127f

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\HST10

MD5 e7b59b2166344ef55f362235cdb6bcee
SHA1 903abb6e02496a4b04a6432e53abefc8bd928e3a
SHA256 44c127911ae5e817272a656179b753233096971ac9f31e2adca125ae751dd990
SHA512 14d8bb0ab478eaf21db32d67b1e866806033b124e5699d8a85a54a7f325eaa6043e6f4439efa6e433ce95baad7ef91d9c20b3313918e2c94216650bf61d25bed

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\MST7

MD5 55710d9e150ae05bbfb330c6efed075f
SHA1 13f0c81abc4b256171633431eb50d631f3b4da12
SHA256 86d561eaf6aa39d1eefc69222848e6977cd9ff6bf25fb2e276a4487dc26707d6
SHA512 9550c4e79884758850753c8f12daf1f5bffaf3da2e3307d8fa2cda9e8842bf98d15db2a143761f7fe42312b8d505f1955491a3e3c7d62c26484ffbb83f0c920f

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html

MD5 f45615241ba09d726e0b6d83342b6517
SHA1 be964772372a4dc56712f3c0851e5ece47d1fbfc
SHA256 671630785b585367577dfa8b3a92d49d723827f572aa5d4fae9fdcff309a80ab
SHA512 065033759406aeaa0d2a33f9cce4160245dc4fc9136a3fa383056b75ffee4a20404c15b953126c444546af1acc85556aaedac39d512464da8b44bf13f0074149

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html.protect143

MD5 1eb52482de03f6543102861673a379f4
SHA1 3adf819ac891b672ea90658f175a4cb907ba8c6c
SHA256 a3d1d9f5125550b6d8ca602f7988c008cf01493b2d60c16ece4e90adafde5734
SHA512 1455027a088da46d68770b2278b070d156f1a5ca3f9fa5695c5a0e64e168c0cab3f41a31f80a83f611e1a5b9bfa8a82b1cf9d4738d343ac7f2448935ccd02112

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\eclipse.inf

MD5 3ea2d9646b03a4483721b8a1f13459eb
SHA1 8c939e9f06eee5feb7f4d88f60feabe355b4137b
SHA256 d1461add95977de60c383a6892c3786565ba05e7d728729c37cb7d9719602f9b
SHA512 bd478704a154a1714906bf14b50cf1e570e7e7a3309443f572ba0a0c6da06b0f438bca71d6a2b972066272b77c14b254b807daa6253efb60ebea9cab85ab3351

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt

MD5 ccd505e7857910655e6a3f26df4b8b51
SHA1 9e9c310107e1ebddb13c2ec54807004df0c709cb
SHA256 6414d402092a0cf95549674d35ec04ef39a695c783ac08b02d606a7a3df4d422
SHA512 3a9084d911f734c22e05aa6f86e32a059991be38ed505a305031953905a0cf6a1950a5834413f251e7f76649afe3cc048692cca59803cdc01423ce29847264e3

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.RSA

MD5 e72e2c77f733a799204af621a37ee89a
SHA1 a07f475e6000f23bfbf6795c244b635c055ee28a
SHA256 533a230ec59c35c0ee58bd1a6eaf46d30b04fd5eb765bfc1f21c9ab90e49c226
SHA512 79a4671cc1640f537c5cdfd1de88b1d64c1de85ec2ced583855dc5718ffc7c84ace2a1893b36d7a466732f403171c074787557c301775380be7c9bee1818e7c5

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\ECLIPSE_.RSA

MD5 35d90c8791ea4269ca332f3546d9a127
SHA1 6798a6d9293493a12bde634d320cc65bbcc99bf4
SHA256 a093aecf893195399f9fc928617962b909452df3f6fa388e9a301797b873d772
SHA512 9e62a6ec7d42e7584e070fb92eae770e554ecaee3f1aa82d9910ec8c6dd77efe2308d763a05c4da908b6a839d1d3bf978e217fa87e26ca6bbd085295adacceb5

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\META-INF\MANIFEST.MF

MD5 84f202dffa0959171b0471ce09436400
SHA1 b5d9911afaed45cbd02ad5c9e452ae08861d3e0a
SHA256 65a0da95de9e82edc9dcb28a01d80d5c2448e28bc559ab8f89e1184afa901870
SHA512 acab47837852db899f6bb9544bc81bb3091855b97b1ac95b6a92670d9409c6b139ec2c238ad70b72612efcde79ba46f383198fd656d7778aad0ce92d936796a1

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-core-execution.xml_hidden

MD5 a035ccf69fa2dbb74d42f1f03df177d4
SHA1 586d733d09912af1e7112383430693efd2357e5f
SHA256 7c9c3341b8c2e6b19f1562edaf41c7544309607c42c44ed0cad2003fc6b6ceae
SHA512 758fa7612263026daee2e652123ddbc80b8deb639b23058750990fab5ea37bffecbb72625b87a576bc38f155ef62ae930a108d3ad4b597f02a752582a4db0265

C:\Program Files\Java\jre7\lib\images\cursors\win32_LinkNoDrop32x32.gif

MD5 2f8d6b6499855675cee3cb7a9214b87f
SHA1 5b88611de76f4a6ab3d20a410994d6b0927a3041
SHA256 0cbea585040a5fe0a1f58702b7a0f921575862ddfbd2446190e26ec146d1b518
SHA512 8d5896de6d3a4b807d73700d3cb62339f47a702edd4809587563d065593888e157595f4af98854d5236a903301cca08ca8870eeff4f88b5750a425ce1c8b0d11

C:\Program Files\Java\jre7\lib\zi\Etc\UTC

MD5 3d501cd7cea3183cd4c43fb341b69882
SHA1 386e2b962a2c56a299e9cd9774081894e980e362
SHA256 5a10ebe88571235562debf3399bfbccedfe78c595f95de14a72d31aacafb357d
SHA512 883be68e6c59517805752325eddef268195b55fff3b23831ffa455db5b8e38de5661b21f1e733163a2ce3b8fdb9b6e3e6554e335c05841814f6f281f064812cb

C:\Program Files\VideoLAN\VLC\locale\eu\LC_MESSAGES\vlc.mo

MD5 711f0f3304bb8e7b5042f22e91848603
SHA1 e4858a42835f69095a5578ccd58a554dec0a193a
SHA256 91643a7117b5f2592f97131d1040649959862222227284efdae45c7c2bc18aae
SHA512 703804209787ef8906915bd8f0b1a098006f0bc1299ca54137ea1443fe6b784b3c673da8d87708ed64d50c26bc0d28b250de10469790ae2617fb8ce205644706

C:\Program Files\VideoLAN\VLC\locale\lv\LC_MESSAGES\vlc.mo.protect143

MD5 e537f725bd9dad0a7f74b2d00e5a2787
SHA1 813530be9b82b2ed16756f63b0fdcd902abaec41
SHA256 4eee29af67deccfa7b70502ca3c04dcf82d2a329efacea2cc36ab89311da8e53
SHA512 7908c5bb9352ab81e40846e9feeb9ac7a07441a9b5a6078ea8b04e67eccfbe5efa523d795524ecaaf6cdbffe5045bef4488f214c3938bcfc372eb4f596a19e92

C:\Program Files\VideoLAN\VLC\locale\tr\LC_MESSAGES\vlc.mo

MD5 befcd01bdde5496c25e66fcff4e43495
SHA1 6616d7a1c8a55c3568998f530e94f104d930ae2e
SHA256 1e2531147cdc02fffff1327727c4a4a71208f1cd0c5053e57d3a503a0f17398b
SHA512 3b4f37f873d8c67d1aa4d50aa916a9384c802208a46b6402a3f04b02d0ea12dddc4c107e7c69489cb5924d68b8099def7c9130f0b9a0a254a55888ec3e02bc48

Analysis: behavioral2

Detonation Overview

Submitted

2024-02-27 17:57

Reported

2024-02-27 17:59

Platform

win10v2004-20240226-en

Max time kernel

149s

Max time network

151s

Command Line

C:\Windows\Explorer.EXE

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess

Description Indicator Process Target
PID 3320 created 3552 N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe C:\Windows\Explorer.EXE

Deletes shadow copies

ransomware

Modifies boot configuration data using bcdedit

ransomware evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A

Renames multiple (6530) files with added filename extension

ransomware

Deletes System State backups

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\wbadmin.exe N/A

Deletes system backups

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\wbadmin.exe N/A

Modifies Installed Components in the registry

persistence
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Software\Microsoft\Active Setup\Installed Components C:\Windows\explorer.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BabyLockerKZ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe\"" C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BabyLockerKZ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe\"" C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened (read-only) \??\F: C:\Windows\SysWOW64\cipher.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened (read-only) \??\A: C:\Windows\SysWOW64\cipher.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened (read-only) \??\F: C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\How_to_back_files.html C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ko-kr\ui-strings.js C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\jdk\relaxngdatatype.md C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\How_to_back_files.html C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-20_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Microsoft.VCLibs.x86.14.00.appx C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\jquery.ui.touch-punch\How_to_back_files.html C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\de-de\How_to_back_files.html C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\home-view\plugin.js C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Trial-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\Fonts\private\DUBAI-REGULAR.TTF C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe\resources.pri C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PeopleAppList.targetsize-40_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\ExchangeLargeTile.scale-200.png C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_neutral_~_8wekyb3d8bbwe\AppxSignature.p7x C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_split.scale-125_8wekyb3d8bbwe\How_to_back_files.html C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SmallTile.scale-125.png C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\da-dk\How_to_back_files.html C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\unlimited\How_to_back_files.html C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub_M365_eula.txt C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\LICENSE.txt C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\pl\How_to_back_files.html C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\es-MX\View3d\How_to_back_files.html C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-white\StoreLogo.scale-400_contrast-white.png C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened for modification C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Assertions\MatchExactly.ps1 C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\fi-fi\ui-strings.js C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\themes\dark\sat_logo_2x.png C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_MAK-ppd.xrm-ms C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\ug\LC_MESSAGES\How_to_back_files.html C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\How_to_back_files.html C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription1-ppd.xrm-ms C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\Bibliography\Author2String.XSL C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailAppList.targetsize-64_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\MicrosoftAccount.scale-140.png C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\cs-cz\How_to_back_files.html C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\resources.pri C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\WelcomeDialogContent.json C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\How_to_back_files.html C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened for modification C:\Program Files (x86)\Windows Media Player\it-IT\wmpnssci.dll.mui C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\lib\ext\sunmscapi.jar C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\locale\ml\LC_MESSAGES\vlc.mo C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteSectionSmallTile.scale-100.png C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\ExchangeLargeTile.scale-400.png C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\GlassVertexShader.cso C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\tr.pak.DATA C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PeopleAppList.targetsize-40.png C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Microsoft.Membership.MeControl\Assets\OfflinePages\Scripts\Me\MeControl\offline\webviewBoot.min.js C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\ExchangeMediumTile.scale-400.png C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\RTL\contrast-black\MedTile.scale-125.png C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTrial-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File created C:\Program Files\VideoLAN\VLC\lua\http\How_to_back_files.html C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\LTR\contrast-black\SmallTile.scale-200.png C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\rename.svg C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened for modification C:\Program Files\Common Files\System\msadc\de-DE\msadcer.dll.mui C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SLATE\SLATE.ELM C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\How_to_back_files.html C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-256_altform-colorize.png C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\he-il\How_to_back_files.html C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File created C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\en-US\How_to_back_files.html C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.NET.Native.Framework.2.2_2.2.27405.0_x64__8wekyb3d8bbwe\AppxMetadata\CodeIntegrity.cat C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\sv-se\ui-strings.js C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\locale\bn_IN\LC_MESSAGES\vlc.mo C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxManifest.xml C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarAppList.targetsize-16.png C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.3.etl C:\Windows\system32\wbadmin.exe N/A
File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.2.etl C:\Windows\system32\wbadmin.exe N/A
File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.1.etl C:\Windows\system32\wbadmin.exe N/A

Enumerates physical storage devices

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\vssadmin.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-275798769-4264537674-1142822080-1000\{1A035450-FA64-487A-8FF8-7972F51016FE} C:\Windows\explorer.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Windows\explorer.exe N/A

Runs net.exe

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3320 wrote to memory of 1232 N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe C:\Windows\SysWOW64\cmd.exe
PID 3320 wrote to memory of 1232 N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe C:\Windows\SysWOW64\cmd.exe
PID 3320 wrote to memory of 1232 N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe C:\Windows\SysWOW64\cmd.exe
PID 1232 wrote to memory of 3472 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 1232 wrote to memory of 3472 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 3320 wrote to memory of 4056 N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe C:\Windows\SysWOW64\cmd.exe
PID 3320 wrote to memory of 4056 N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe C:\Windows\SysWOW64\cmd.exe
PID 3320 wrote to memory of 4056 N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe C:\Windows\SysWOW64\cmd.exe
PID 4056 wrote to memory of 4504 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 4056 wrote to memory of 4504 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 4504 wrote to memory of 1672 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 4504 wrote to memory of 1672 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 3320 wrote to memory of 1476 N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe C:\Windows\SysWOW64\cmd.exe
PID 3320 wrote to memory of 1476 N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe C:\Windows\SysWOW64\cmd.exe
PID 3320 wrote to memory of 1476 N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe C:\Windows\SysWOW64\cmd.exe
PID 1476 wrote to memory of 3548 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 1476 wrote to memory of 3548 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 3548 wrote to memory of 1896 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 3548 wrote to memory of 1896 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 3320 wrote to memory of 4200 N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe C:\Windows\SysWOW64\cmd.exe
PID 3320 wrote to memory of 4200 N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe C:\Windows\SysWOW64\cmd.exe
PID 3320 wrote to memory of 4200 N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe C:\Windows\SysWOW64\cmd.exe
PID 4200 wrote to memory of 1540 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 4200 wrote to memory of 1540 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 1540 wrote to memory of 3448 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 1540 wrote to memory of 3448 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 3320 wrote to memory of 1088 N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe C:\Windows\SysWOW64\cmd.exe
PID 3320 wrote to memory of 1088 N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe C:\Windows\SysWOW64\cmd.exe
PID 3320 wrote to memory of 1088 N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe C:\Windows\SysWOW64\cmd.exe
PID 1088 wrote to memory of 1268 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 1088 wrote to memory of 1268 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 1268 wrote to memory of 3784 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 1268 wrote to memory of 3784 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 3320 wrote to memory of 1344 N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe C:\Windows\SysWOW64\cmd.exe
PID 3320 wrote to memory of 1344 N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe C:\Windows\SysWOW64\cmd.exe
PID 3320 wrote to memory of 1344 N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe C:\Windows\SysWOW64\cmd.exe
PID 1344 wrote to memory of 4808 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 1344 wrote to memory of 4808 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 4808 wrote to memory of 548 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 4808 wrote to memory of 548 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 3320 wrote to memory of 1528 N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe C:\Windows\SysWOW64\cmd.exe
PID 3320 wrote to memory of 1528 N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe C:\Windows\SysWOW64\cmd.exe
PID 3320 wrote to memory of 1528 N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe C:\Windows\SysWOW64\cmd.exe
PID 1528 wrote to memory of 1988 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 1528 wrote to memory of 1988 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 1988 wrote to memory of 1188 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 1988 wrote to memory of 1188 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 3320 wrote to memory of 3460 N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe C:\Windows\SysWOW64\cmd.exe
PID 3320 wrote to memory of 3460 N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe C:\Windows\SysWOW64\cmd.exe
PID 3320 wrote to memory of 3460 N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe C:\Windows\SysWOW64\cmd.exe
PID 3460 wrote to memory of 1756 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 3460 wrote to memory of 1756 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 1756 wrote to memory of 4188 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 1756 wrote to memory of 4188 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 3320 wrote to memory of 2392 N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe C:\Windows\SysWOW64\cmd.exe
PID 3320 wrote to memory of 2392 N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe C:\Windows\SysWOW64\cmd.exe
PID 3320 wrote to memory of 2392 N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe C:\Windows\SysWOW64\cmd.exe
PID 2392 wrote to memory of 3124 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2392 wrote to memory of 3124 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 3124 wrote to memory of 2920 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 3124 wrote to memory of 2920 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 3320 wrote to memory of 2980 N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe C:\Windows\SysWOW64\cmd.exe
PID 3320 wrote to memory of 2980 N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe C:\Windows\SysWOW64\cmd.exe
PID 3320 wrote to memory of 2980 N/A C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe C:\Windows\SysWOW64\cmd.exe

System policy modification

evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe N/A

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe

"C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe"

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c rem Kill "SQL"

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c rem Kill "SQL"

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlbrowser.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im sqlbrowser.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im sqlbrowser.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sql writer.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im sql writer.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im sql writer.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlserv.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im sqlserv.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im sqlserv.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im msmdsrv.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im msmdsrv.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im msmdsrv.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im MsDtsSrvr.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im MsDtsSrvr.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im MsDtsSrvr.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlceip.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im sqlceip.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im sqlceip.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im fdlauncher.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im fdlauncher.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im fdlauncher.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im Ssms.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im Ssms.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im Ssms.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im SQLAGENT.EXE

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im SQLAGENT.EXE

C:\Windows\system32\taskkill.exe

taskkill -f -im SQLAGENT.EXE

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im fdhost.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im fdhost.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im fdhost.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im ReportingServicesService.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im ReportingServicesService.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im ReportingServicesService.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im msftesql.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im msftesql.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im msftesql.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im pg_ctl.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im pg_ctl.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im pg_ctl.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -impostgres.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -impostgres.exe

C:\Windows\system32\taskkill.exe

taskkill -f -impostgres.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop MSSQLServerADHelper100

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop MSSQLServerADHelper100

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop MSSQLServerADHelper100

C:\Windows\system32\net.exe

net stop MSSQLServerADHelper100

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop MSSQL$ISARS

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop MSSQL$ISARS

C:\Windows\system32\net.exe

net stop MSSQL$ISARS

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop MSSQL$ISARS

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop MSSQL$MSFW

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop MSSQL$MSFW

C:\Windows\system32\net.exe

net stop MSSQL$MSFW

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop MSSQL$MSFW

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLAgent$ISARS

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop SQLAgent$ISARS

C:\Windows\system32\net.exe

net stop SQLAgent$ISARS

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop SQLAgent$ISARS

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLAgent$MSFW

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop SQLAgent$MSFW

C:\Windows\system32\net.exe

net stop SQLAgent$MSFW

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop SQLAgent$MSFW

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLBrowser

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop SQLBrowser

C:\Windows\system32\net.exe

net stop SQLBrowser

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop SQLBrowser

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop REportServer$ISARS

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop REportServer$ISARS

C:\Windows\system32\net.exe

net stop REportServer$ISARS

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop REportServer$ISARS

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLWriter

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop SQLWriter

C:\Windows\system32\net.exe

net stop SQLWriter

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop SQLWriter

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wbadmin delete backup -keepVersion:0 -quiet

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c vssadmin.exe Delete Shadows /All /Quiet

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTATEBACKUP

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTABACKUP -deleteOldest

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wmic.exe SHADOWCOPY /nointeractive

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c bcdedit.exe /set {default} recoverynabled No

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c bcdedit.exe /set {default} recoverynabled No

C:\Windows\system32\bcdedit.exe

bcdedit.exe /set {default} recoverynabled No

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c vssadmin.exe Delete Shadows /All /Quiet

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c wbadmin delete backup -keepVersion:0 -quiet

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c wmic.exe SHADOWCOPY /nointeractive

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTATEBACKUP

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTABACKUP -deleteOldest

C:\Windows\system32\bcdedit.exe

bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\wbadmin.exe

wbadmin DELETE SYSTEMSTATEBACKUP

C:\Windows\System32\Wbem\WMIC.exe

wmic.exe SHADOWCOPY /nointeractive

C:\Windows\system32\wbadmin.exe

wbadmin delete backup -keepVersion:0 -quiet

C:\Windows\system32\wbadmin.exe

wbadmin DELETE SYSTEMSTABACKUP -deleteOldest

C:\Windows\system32\vssadmin.exe

vssadmin.exe Delete Shadows /All /Quiet

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe

\\?\C:\Users\Admin\AppData\Local\Temp\ca4bed0330558829a5b642a63ea28bceb62def74b6a3e309460eea4e185da106.exe -network

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c pause

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k WerSvcGroup

C:\Windows\explorer.exe

explorer.exe

C:\Windows\SysWOW64\cipher.exe

cipher /w:\\?\A:

C:\Windows\SysWOW64\cipher.exe

cipher /w:\\?\F:

C:\Windows\SysWOW64\cipher.exe

cipher /w:\\?\C:

Network

Country Destination Domain Proto
US 8.8.8.8:53 136.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 205.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 167.109.18.2.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 178.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 35.197.79.40.in-addr.arpa udp

Files

C:\Program Files\How_to_back_files.html

MD5 61d1e7a8f8efbdb358c29273b50149bc
SHA1 ba4fcccd886bd3cc5b8d8d2d9910c7a014b361b2
SHA256 46bb7b11caaa99f45fb8b322379f67cf25484451c3a2784b04b31895eab804a4
SHA512 b3b43ff62ba59d9aeda4a0b5a5b17820a2a4e4cb6d2103e8d800dfb3a3f1093d8eec60adf7bd8a07dc6a19001b78e0a621cf47d6f4f00fe4fed489572f52213f

C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\invalid32x32.gif

MD5 42863c9cfe69ee9b8edea0dab95acef1
SHA1 ff82399049525a395ec034477693a7c625eb8212
SHA256 330afc7c019ab0e0481072c8e97d5302fd3f5e90b45b59513bee93c63d85c465
SHA512 e03d44b85b86ecc5bc4c8ef844c3bcac743eab7fb366eef8ad06005201f4aad755a765332d24e95b9532206f704840f809a64b54d6ab38552bef5b53b4e118db

C:\Program Files\Microsoft Office\root\Office16\1033\GRAPH_K_COL.HXK

MD5 a47839c94045943643943a73384af21c
SHA1 7c1388385500705697c21b7b56f43fa7ebc29560
SHA256 06863a68efcd642cc65d0385d76a750fc0b2b43b4574fcf5334dc362d2ca7172
SHA512 93b379cc6dc5f1bf155b198f7b956e494e7a5a0ea279efa01ecfe0312e5ef35879989267b3034bcb6801cdfde74f53daff192f712cf87933a954e84bf009924c

C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC_F_COL.HXK

MD5 3bda80fb629bffa83a5d753552233ac6
SHA1 e1381fb12bf0e23386c71855afcfebfc450905a7
SHA256 43b9dd2005564c853ecab8ff8d4e3efd49bccc2547a183d2dc0e7f8d4fe376f7
SHA512 ea188fe60ee7b045ace999f034e05d38ff125cc2aeb311fae628bb584f43c44d9cfced9a6c976cec9872d1c0d59f6507739afe5c89ce91c3513b42236f5a7eb4

C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe.config

MD5 6a45ec06acee4c7bc3bb93f17ff4f9f6
SHA1 df136f292b40d82e94fe6454d70b0a72ecadba61
SHA256 8634b39d3a8877d134f5f58bff903cbea5058e1dd3c1afd444876bf557d01e6f
SHA512 7ef52d53dc85d495e5ceb873928eac52adfde6297214f8f8e8cada04ba629feaf63ef26f63b8107105cae0dfc87a5e02dc3c091abfb079403170da47db82e020

C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\SIST02.XSL

MD5 97b36e1d486a033bc1d8bc4ca5c01f13
SHA1 f0711b1f154f4e6601a4e9ddd7d4ca26a124a26d
SHA256 b3f2b583ab23355ee8be9d7a8a3df44fd8270c8892ad4037ae58794bb7d475dd
SHA512 623188fc0052dd318d05ab09ea91c6edf4bd0d6cdf9dc68c31218ffbea94d689b4568b4b7cce8647418f658fcfbf803059fdc5cb8b06e5bcc34fb9021bf3db7a

C:\Program Files\Microsoft Office\root\Office16\PROOF\msgr8fr.dub

MD5 481c568c1c3e09a0ac48ddb61203037d
SHA1 d8f6d497319d667299ffbab0605a9f267e5461b6
SHA256 e5c7fbaa9fc9b85f7d94c9e228a25f9ce7f310ee5baa716d37b42a734e6c3013
SHA512 8265a0257ec343ac1385891795ddd9565418c8128ed2cd7c9516d553f01a0daa31a98144e4a6f2d0fb435944f495b04470ac1c75ce51d57f3f535391fcdb10ff

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\osmia32.msi

MD5 84e560a93d2f12357e6732685e93cc17
SHA1 ba487c0736d595e5e1fab43e020337bfef192224
SHA256 8b390afaf3b1263844156361071e1fcae420f8ed45cc61024820156be81215db
SHA512 f5f2f8fee98fccf3b2b872666a15e05a35191f1833b8f5b2952a90b27a5d982b3d4c52a95466f9ec2b03c935a4d68721e9f4e33cbc7b30ee72b53db1885bc376

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Cartridges\Sybase.xsl

MD5 c6a6d6bdccb881eab5f9b97b780cf650
SHA1 8b3a834877914b1f0ab0f83b96e804597bc1c54a
SHA256 0ecc3bbe6d1eda9eeb6a4cb314ea2fdc4e43a19bad3efc0fca1946b3018a8da3
SHA512 29ceb803154dd8f716859af11cb73f1155e90365e96217b1c23abacee9ccc50369505134a8d036d40611942401c72b78869b13aa9841e9e84f6dfb71a8d9ceab

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Cartridges\sql70.xsl

MD5 c668b2f70e224a3da2d684e70be206ca
SHA1 721b44f726b32a550def6f8cf319f4f86bfbd608
SHA256 44d92b2dcaae1b49a4714d857307cd9145ee67d85c37340656859e9ae7a3a2d7
SHA512 77dbe9896f1da0037ffbbd7a047f7af016d3861fb52bd3249682c5f8b55ccbdf456ffd0f9acf1bf67b9140f350d8599756e2a9d2683532d7b77a56f49f5fb38e

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Cartridges\sql2000.xsl

MD5 f2678414063ad06c7ca032df3a511a0f
SHA1 07de3db05f385585b978ef1d3a41646b6a0307d7
SHA256 291964486d95288df318cae991b50a96bcbc4238656b13c42695936751b2e2c4
SHA512 ee8cad19843bb167b6f6e70968e7e2402f2d7942c17820eedb748698c6d4a81d79178c39ed0db117b0b6c97339ec1dc68504356f99d5841849cab4487c14b502

C:\Program Files\VideoLAN\VLC\locale\de\LC_MESSAGES\vlc.mo

MD5 bba349fe185bd9d3e0700158d8dbaf1f
SHA1 ba07b435c5a695c61459da0da92c70268f312441
SHA256 168c059b52f28995c3f0271cc2ad879a2712d674fad06280072be8da25e3dab0
SHA512 c6f2b20a764bb6230b8cd451dd5ccd7a24f8cfba8a5e9725361bfeeec7e9e8bdba375469fcdaf8741d565d8544a085ba7191f01a691e8086f8122e0884242ef5

C:\Program Files\VideoLAN\VLC\locale\ks_IN\LC_MESSAGES\vlc.mo

MD5 967fc7d40d942f93a9c329d59d1393d2
SHA1 7a2426f9aa487218d6cff1e4bd80341537d3c040
SHA256 c4fe7d72f06acc8f1ae657b43a4a2fe08982aef664f936914d3e6c333c5ad3b0
SHA512 a14c3a8dd5f6a0adb744dfcf64dd988fd9f7ee790dde807676c782b57c063a52601d21e097ca22ef5c1f8ccc7854d0db85a8465daa583c196e8ddc1615ec6e2a

C:\Program Files\VideoLAN\VLC\locale\sk\LC_MESSAGES\vlc.mo.protect143

MD5 43245bdd3080b1facd79da2af5bdc4a5
SHA1 cb221ddeded9a8720f780448045e46ea09ddf7d5
SHA256 5d97554e6278a22d04d4e56276e1539ef3f0a53d448016354782bd4c60021437
SHA512 69a717cdef76cad3243472f5530b6f4fe4537700520b85d316c3f8efb54a1da5ea47b0ec23aaaf6be0ea56f6eb9142269233353b0de319fd06848ce8f4c1db28

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\cef_100_percent.pak

MD5 4a4a5ed59b4813bcdab0a39c1ff45ed5
SHA1 14066a12c856e8a177486cb9859b04eb3352bc84
SHA256 ce5da406a21c0ab024db7eafdb62cb30672dc3c640e35c9aa7957b69a6dfd13c
SHA512 be22afe7f85238ac5bde874259b3ffbf915cda301004ce2123094f95178f5d701b8089949771b31c854d5576f8ebdb0102721a21cc55b8eacae9d1ad6790e572

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\aic_file_icons.png

MD5 2a21e4e7985120e300022f60ca30aa80
SHA1 16054bef15957b2c82ea2d8fdd26ead16ed15dd0
SHA256 607c6277038dda3a4c35dbdf3191374bc1fca6cebbe4b181a2f4fc87237185f8
SHA512 2c1dc1a1b8fe380d6bfcb808040d1f3cc8b2bde9982c45f1e134c26e84043643cb41b5af84d8c964dc36cb6bc0c2d09419d2d98f50f88721421307e52640d786

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions.png

MD5 050a43bd778d0dc1fb21c73e5960d2ad
SHA1 c7a57498ef9147dadef9640285bdbcc55bf72b9e
SHA256 17fcace6115ca231ee752b0325e844ff196ed8c69dfd7fc1035f1bed5f5f76fa
SHA512 61b3d7d1ddb2b894a7fe66eb033cbc7fdf5628d9b3cc80532ea79d1303ba2a0ada34833057aeb459614bea4c3949ce33653dd96d00e777e204c8570dbfcbcf7f

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions2x.png

MD5 fa176a1c9e980d2848243bb3a39bd36d
SHA1 aa306dc8cb2b97d715f9a050eec8ead689c20af4
SHA256 12fb20b0f03e8545b16489490a87cdaca1d14b9a989a6e90cd47a92f6935187b
SHA512 016532d70ff6cefa983534e0078dbdce4157309d1c4f5cbba0aba5f6c9896906f4f5c5afabf7b527596e25f3af80f99daa0b007e60cb6f3995b7481942eee79d

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_remove_18.svg

MD5 3a6ac24973d07887f74fe25a11b98cc5
SHA1 7d7ec8339250b45a745309dd53f4ed1c46b73c28
SHA256 f03a19cfb3213bbdc4f84562997aedea8135933d759ad015b48de197b937f808
SHA512 aeadbc4436cedbc95c77bf7528e621bc32440c1fc718735c89cfc9b42d24280b5b628096da90a05ce7e9140418354b2dbfbaa650cca53fba6cc2fb7a7a0123da

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_comment_18.svg

MD5 fc030ef2139c6add8aecacea6d6a21ce
SHA1 30ff400259fe937625c7e291eac4c724e38cf693
SHA256 a270295d6a6b8128dca262622aebf865d2d96ec77c06a0da45d32e8efbd6cb1c
SHA512 d4e765d660f9a2c8d9d1348e1ab4c7cc71550d3c3193c1e557e4f8904a7333adf2edd04bd13f516ad6f69c6f067069e5e39d1c59084810cfa2a29bee5534cd01

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_backarrow_default.svg

MD5 8200e85ed166fcd7ad7438c65b1e25e4
SHA1 7fa0543c33e2e68cbabd635ee137eb81874f8f4e
SHA256 a7df11c8c8a5969572b804f0adefb68531de19d100d1c92132837524075e13cc
SHA512 ed09d9ceeb3866afa85904e7055a086212fae87aab050e83e1fc9511a6a81af3b6cf2e81f0581e523f7fc9aca920629d02a6a08524a20c0256ec7f7e75cdafd0

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\remove.svg

MD5 225cf1ce85a5f9b76fde7ad08451cf30
SHA1 ac6de7027ecae107a51e561d04300c39518bd597
SHA256 dc06b1766c05e0d49d373e66726a35047e09e2f02f2b54448ecaddd2124be6ec
SHA512 dfc7824de6a8709406e6b8bac2de18549c1beebc42b5c0ff5960dc0638a67f202d89f62ce6eb3268cd5087ed097c4db433596a76625a8f4ba6730fa59c7e43ec

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\duplicate.svg

MD5 46044ae27e7f7a61284643220514fcb7
SHA1 fe774903c77907ef3b632920f39bf20dd167857c
SHA256 912fb487d4c396a74b0e73e10232308fc8f526bd08af0a598192f2b7d02f775d
SHA512 e7998df5b32f38d35f26d4076c31548e4c1aeb5e1f54886ac9e731308034201557074cc1b6b3b8a8800c1e0885c9ed37d33d478df5cac5a95260cc82dad8dbe1

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_export_18.svg

MD5 2eae77725efb37ca29e09b49a632654b
SHA1 d1e1669fc898ccdd9785e53e98a012dd3decede5
SHA256 7a4c80d2e6882c3fa11643920c9487cfbb071c73a6d2105ddac0e0a7383d3945
SHA512 a6ad9baee48675080e038fe168c094f7790c575de288fb7daac9c6759df8ae1bd68d03260ea8bbbff12cd1d1967b2575d68b9a6c1bcd5e2421ac63604c94298e

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_fillandsign_18.svg

MD5 5da9eecfc3ed7e0029a2f79e4b30b63e
SHA1 563abbcafb1f55bc697e3fef481b5f9c73f8cead
SHA256 c95975a30b12537dd08d052ffa9118876307055094c42b3f7752cd6c93fd9919
SHA512 5c2f67153331f954de24e860aa02b0ef08d02dbf96b35cda715d1f19b2d96e398e793c46a0a5d525b4f4d7f2a1e50b6299220f6339b92cca089ec5d3de6bb344

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_editpdf_18.svg

MD5 011350d109ef5369bc4a6659d47aebc7
SHA1 451f90b1971e2f2445a7b91c0491bc05fba1372f
SHA256 7e4e4fccad7758a659f8afd0e4290d245af2c22d0d1dcba4fe1bd60e7a806ce6
SHA512 928576fbd7ded1af36235fe9c09fc6351502ada151a16e7abb27b3e0453b9267dde8e34126d8ed6fe4c28741649e1f00c3c877067db222d206cfb9c9ba91c3eb

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\root\ui-strings.js.protect143

MD5 0d3c294829cce057acea9bbd27ee827f
SHA1 6b3e294a774e1a06026adcb9c09e3689586ac546
SHA256 5e9f17cfa3eb47a21fcdee71abd4d9f0fbd1eba23bf3c076070ffeafb063ae88
SHA512 5f2511a6e4fa252a959a38517fe5cc4c6c94432ebfbbbb3fd3d5edd41e08188afd3ffd44b3fc7550c298482e15532a1884cb7c6066f5e926f09edddcf51bcfe2

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\root\ui-strings.js.protect143

MD5 f76e87b3334c5cff3711cd32308de8e4
SHA1 e24798dc4dedf2978184e2437796ef428638c80e
SHA256 426b5c2f8ec505ea0b81f9d8e6f3aeddb3993caddff2d88d99e03985035331d4
SHA512 fee070c529939b31c459190f49ae073191cc607b2451f05c62795a0dc45a9d88911152cdd4853d937c2e50a2345ee852a34094899cc7171fa6315484212a7103

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\en-ae\ui-strings.js

MD5 db9204b15ed5796cef26e7a10490d8f3
SHA1 89b83efd61cc12e4691bff32da38d7a45a3069ec
SHA256 f97c094cdcf96d4259a1c68c38661516d61af06609474b37bef8176682d66802
SHA512 b012c92a76b75ab66e2c541a6b51dfba148560d6f214ac7a17ab18725a86a7d37def0ccb8366976b346103d56a481074635f2373cbc376e4896516f46749c2be

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\he-il\ui-strings.js

MD5 5aafff9ed28e29dfbc8b71558cfc3108
SHA1 6369b5d00300f6bff61ffc3ff01788d1fe29aa84
SHA256 47c79384f1c28afe5bde0c906d79f97eb9ec05da6494ee1f4f1a3fa2d710e18f
SHA512 20acb8658cb60e05b1f2496263819d0b15b5c7bc99ec165ff3081cf910386c09f1c9f4d92cc3ec643265edce27fee30aed8c42b49949108e4980c03babf44f7e

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\root\ui-strings.js

MD5 0feccf7479e7761e3916af6da2505f0d
SHA1 45cdd6b909c8b2d534ca6d1974c1055e93505a22
SHA256 7da1343cd42c1286b42ab7dbcc121c9cea01fdce8dcfef2a23a68a095021b884
SHA512 29ab6f949f91bf52df7ad2bdc12d8aec15cf004f43449e6d96a0bc00b02d22096caeaa6befd94916a5f7017af16cca2e5c197729516aaa97c836b107977441e1

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\root\ui-strings.js

MD5 3411395216cf30e60c72cf4f1432c1a4
SHA1 73e197600453a29add78891495be5caf5be87cbd
SHA256 748f9e6d69fdaec66614165c5fcae61eb42d1d58636fcb905f01ed464ded6328
SHA512 0f5f49a19b0b8fc08159458d2ee3c9af8f143a15a271d1c8526225fe84bfe4781001ea42d85f820ef2a0c7b36d124d4836b49e8c7a6ec76ea16f51bb5c2f6cde

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\rhp\convertpdf-rna-tool-view.js

MD5 db6fac9ca928c21ad32f51db1c1c6681
SHA1 211f822e498dce3545a74459b955efbb730e5ef7
SHA256 34318fc930a86bad0bcb55e8a0e6ab24381f032386f0c901e0037999f21f5db5
SHA512 7e9ab3633ea61d2703b07c9c138b510bdc8cab7aac83f105d0912fcbc4cd2187e7285984a284ac3f0f67be71fdc66c3675675f08aad4e5bea9ac3c0c1cf911f7

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\rhp\convertpdf-rna-selector.js

MD5 49be4ccc2f7faf141f9608c8653dda22
SHA1 c1b59e89c7bff3c3d6cc0a99d41913cc00055fd9
SHA256 55f62c83445cdf8a55f24c903a2aaf276887dafb231dd7a7601a685f37f7d55a
SHA512 fc75fd60ef5410ef8fe65443e02c18a9c6b0181be8de10f355f841119b8d280f46be70e21a6c9044bcee4aefdfd93cba6a7a927bf2207d55d63698c32ca87198

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\root\ui-strings.js

MD5 a9082284dae217124d0ce52a18d9f3a6
SHA1 97102623b78ce03bac6b772ff46a0c05f87a9db2
SHA256 0298d9975a3c755241a058468752e382c5b0e5a42bf48c9ddc925c657a646523
SHA512 06227631946dab923b3d328098b53c96da04e906470269b1c3252c1a1f0efc1f6c15b4a5a568486281ac20b61532d993923ddeac6bbdb4e7d81cabcad4e8598f

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\root\ui-strings.js

MD5 db57152bb6cdc23d8550b8c29402e43f
SHA1 1e07942ca966dbea0b3677f47764d31ef957e6e8
SHA256 f56bc5473a94b149e48424a747b90b025d6e5d18e2cc8b77f599f6f4b47b1e00
SHA512 a033b6b90462be7ec0be1f80f646ac680ed54de148a1fa1338de35fc3649954623fcd466474a37fa3b92c42f40d40ead3c809361aabd4763267bef4970b09fdc

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons.png

MD5 4e0ffff4bee2d1aec09b181b06984f36
SHA1 cce2c3ca48d98b491cdc057429b1cc6e1a324bb3
SHA256 900b7ba9180799587495b07e6d0266fab800fc717fb612b7880846a1d242c4c5
SHA512 4d9b8fc89cd33b29db77b2d7e24bec854f491ddbc965884661826ffe9bb4206be946a16b83e9adb39e96c1c491aea84503e123a6dacb2dc7949f95a091a9a970

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png

MD5 682d76f26c625c312224e53993395b89
SHA1 b023ac47ff2d5600cdbca177aafc392f09b6cf8a
SHA256 757470ecc5cba5247cbad0834a8dafd96b2b008628891f8725d4924e3890e043
SHA512 272394e6a9ae8f88bf3c914f502943eb25e8b421e23cae454e8dcdd7841e5b746c0b01c5db8adbce59073f5bbce346de7d8aefacb76ad32e35b05d0355dcc18b

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover_2x.png

MD5 5b1b87bbda1827996232998f44eb5c50
SHA1 cb2d199a1a515db4213e08842883bc6bf3a54491
SHA256 972d1ac6c4c0974c3f76f92d7f287d05fb7815c1bc16d17c0742525bcc044e5d
SHA512 f93e9dfc0f05dcff8fe2e3766d1713922e572772fa45758b8399537d54575f52578aa5541d926b6801a805dfddf1bbcd48a35aaf8106a1c68787fd5268434d9c

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png

MD5 93d4e170b1e8a37f02c9ad5b40544da5
SHA1 cc49909f0dd1398785642bebcb1c903aa6b0ff0a
SHA256 02e764f60af8978a05cbd018d780a09da28e6addadb90b40f58a9c1bce4835fa
SHA512 b54226bb8b75f81c590c6769034251d5fd89af8e1c48f3d612a7d92e044bac34856fb2ea5771cd8137e90f95c5647c2dbb8c7db97b8737e146b21814031cc368

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon.png.protect143

MD5 5237bb7fcb6e52b1173adce559ee09a3
SHA1 5b6993ea3a645582bec642b6c104933754c5719b
SHA256 497a4977de68d5d21bb98214de98859fcadfcbe04a97439628bfefe1993de08e
SHA512 5962a456d8c841485944a5d2217694bb96a7e9eb57457e23c0a1ca8aea6ce5b28b9dba61f22d56878f71b3b2e1e217ef3d626cd6d665f923379331fe3a07964f

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover_2x.png

MD5 9929b5972e88e61d22e6d12eb314737b
SHA1 8d89156a8c48b70acf37ee804a585612daddb01d
SHA256 c0c09a3cd01277f063b8b5ec57a2b39da71be3350312cd3ae05a5e0d3ab542da
SHA512 2a447124a122470f4fedcbc7a64596d65d73ba292d0a0e201a17290992d5ad666bdb31fe9dfb252e0f9c21eec4ee28bbc73ca97e8351407002bd284879378a1d

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_2x.png

MD5 3157f3c57329130ed20affe3016304d5
SHA1 f2426d3810d5a69ace0578626cbdece1513e2e68
SHA256 92496c63c99d9f51689ac78c254aaef48a7fa77fc8d776b754750b155d2e7cb7
SHA512 9501773730ae50696fc259758b5bbf93dcc084ab6cf99b316aa2cfb15669185392138a74e80bd205b5a8f372d5f1e127c08ac4d446e27b86ee5d383d594d0ef2

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover.png

MD5 548195c20653655bec4ccde9a8f791e0
SHA1 1a356580fcfd5a1a312f3389bdaf2a1a7eaec5b8
SHA256 eb6b810887147aa378cc73d686d5d15a703bac5e0adb301d9ffe3b70b319d851
SHA512 f5b8b4aa446bc68a2c4ffa880d0bc9c42f3a8bdb04df891d71d9bae220b38d09518d3ac066e9e4e25f7e0a343291927dd5aee12ef1c9580f1cf3e510acdbaf0c

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon.png

MD5 f76c51fbe50eed0b7bf5dc343d6099e9
SHA1 df053fea91ccb9bfc9162f80018608eb7bb91cad
SHA256 92922ec230c834894e4a764e1c5de5e3029e38d5c7c88eb5e9259acb8bb7e8a4
SHA512 a61ba3c75112055cb5948e331206c1ecb8cda2d67fb84d55d8ae52e27ce4894e5e235d9942817d3a404e400ed8c67772cec5ca5a45189815e463ede83a788fb9

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons2x.png

MD5 30ce3a50793fbb846579e7870e21a35a
SHA1 b1115d503a3e9f705dc083627482ccc8fb67393c
SHA256 a9739bad8e196c3c94d1b8cf096dfe7e6d0922a7cc008b105060711bca295fbe
SHA512 8c882e12f022cfa86f9654b286f56b5b52fe52bd45edb71c4e5d36c59cd90c8c04bcec32d5acfcff8aae2b411afd009babaa2c107fee8561ef4903103db8d4ef

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fr-ma\ui-strings.js

MD5 c2ca7cdc9fe54b75c424229800d8ff3d
SHA1 4af031c0891c4fe8601245df53f6c4078239ea35
SHA256 32e0bea7899cf7289b4c68e3704afdbdd3d2c22fefa448f0980e4406d8c9d5cb
SHA512 3daac183ca71614d27896e93ec228d9bde67361300148b27570a1e52908bad032632a487a66d6f4c4f6084cb27fa4bce5e6f034e6726b07b0408a650109a61f0

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\root\ui-strings.js

MD5 fd6a8fd6df17cfb57fdbe3f739844285
SHA1 fc7a305687709149f046eec90f1e51ace328c847
SHA256 7bdbbe4d94866e68c6f2c9c6866b3f5a1ddf7c5c467f31027d7c24813a86fd24
SHA512 2374c7d42a5d0f5c77f15d3f34f7df6edb2f1a7505c9ef1a7d37545bae1d204b4fbc1336c3480c19f416850b08348e5649a482c1f6079ffae65485fe45a522e4

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\root\ui-strings.js

MD5 f8ed24972bc9e2a4af0592843029aeae
SHA1 c0b531215ecfa6cc9969d629d2c649aa31f92893
SHA256 dd1d46b6977fbda4c37e3a3e32e7244424f128a0d97bbe83ce9f2001d524e04f
SHA512 b9a94af75068780f4a3bff3879cda241b99ff5eea262937c807cad34218a13f17f09c13f08941c561d63441cc9c359480ecbb3381a8240a4137b5d5e654c4b0e

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\fr-ma\ui-strings.js

MD5 807977dbad3e708e8c138bd7beb5aece
SHA1 4d1d91bd9538ed1709a421e0f338c90f2eb22a30
SHA256 6cd63dc74b0e71b2e9307fbda81fe76e8f4c1e9165c0f0a8f8869565288562c7
SHA512 48cc03e2d3fdc5c8e3f924fc9083f7780b53e1c1d37a21d849a8fe8a301b7adc35c4c254e4d5486f182b1c09c1a07a819ae2c4ba0f25f36d3bd005b42349c302

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\example_icons2x.png

MD5 78e579997e176c7d1e10982b7fedcedc
SHA1 8bf2c30e6cc1f1c57e37763f4f1bb4afb21a8ec3
SHA256 c3446a5414c3a9d368e74bddc82af5cc85b4a78035781b7ac55975f871b616fb
SHA512 33e192c45fbd980a30e83237c5ccdebfdb468cb1842f9135ca3ea93e00289b3e29464b83b6e43b6d2bd05e548f9f619680f618eb611c0f0c7d42b27d5bd60861

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\example_icons.png

MD5 7c2505175dce4c5e69c8a4cbf2806c40
SHA1 569f889835b4d5c7bf039d210833c3c7d7f78bb1
SHA256 9d33b698cd8850f89f58cf3b8857027ce1fcfcb61751d87721dc548caf30bf3c
SHA512 bc566c316ee841d8064aa3d786c3f8780538fcace85001ea90f2b737d034f102323348b79f787eceb52cf29e793027c15d9dada222c0bfe65aeb9cf29af5f7ad

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\fr-ma\ui-strings.js

MD5 b32082123cb2e6685f75e737fcca5d59
SHA1 90f22f02076914480a2f1328f727083b894d58bf
SHA256 a95d7530ac3df10dcbc0a4847f14fe111f0018dc2f87797a706a601af6acaeed
SHA512 8e6fd014efc0dcfcd66baa1b8ee559ee092d7673dfd601f868a9c5c128dc5f5dbf32f16d3abf35feb79872e7d8111dabe3a93ec4833899e05fefec19e5c8c776

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\themes\dark\rhp_world_icon.png

MD5 9503b6ece4f74107bcfd2236ddc9e831
SHA1 f42ea55eaef0a42c177ac557822842bb5dae475d
SHA256 86f97d2e1ea452e3b4af6a13a6204c39824f0d1cd3b1479048ddb236ae12f3cd
SHA512 130086040b0eda7d4fcb7af12517117fec9bf80c1b69849cc5c83e80fb6dcacb11356f0bbb1c24bbaf2278de65cd63550bb48f85afff8092da4db5b5d4df5448

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\themes\dark\rhp_world_icon_hover_2x.png

MD5 74076bb71526ea0fae14f0afa3473548
SHA1 9bf821d4d435514c45dcb8201f422316461a7c18
SHA256 6baecc42f172192d6854ebb882ea55d4b15f00da4b6fc9278d7808ce3f0a518f
SHA512 a2696fb7edfe72f751bd1ed4bb4685f2d59517045a7cde352015dda9dad4184b904a6e76e9ba9ca1e20c8cb256776665a752d8bfa91bb5858e8307d86d63b0ab

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\themes\dark\rhp_world_icon_hover.png

MD5 b5c1d04260ac5d2362ef3cfcac6f887f
SHA1 f4ccd46e1d76ad9d702dde0f07f848c9d008a556
SHA256 cc3804dd98e4514cebc77d5a8aa0f336fe5d0e9054d0be436a7a1a81c957a09a
SHA512 f16fe0f65762566988a2373fcf361af8ceebc1d95a993099a6d1b536e9dd07d3bbb58d705efd2675b579f2e168df5b5f254fbd015cafae33f1e4d836cbf8de9c

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\themes\dark\rhp_world_icon_2x.png

MD5 75155960cbc1519c6d519af22a2c4c7e
SHA1 edfe8a84b33a3fa825a212030b9bbcb20a0f38fe
SHA256 da40c23703f748878041d862e67985e2c4bb70a06d0df799fa35ee9b2afa0732
SHA512 658fa223b7fc962fd279228091cd433ca28a0ac396ab043fde7ef284abc1f88cc59f1744afc3553f1d796404134e2642851be6d3798d58ae1f8aca6c4a2e9daf

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\rhp_world_icon_hover_2x.png

MD5 160e802f35fe3103e500de3451bdb335
SHA1 76e79d71e10e44985c3d42cfd0148e2ff8e6b374
SHA256 4863076e1941ae21bb970195a08d3dadc2a195ba5eee8fe38f96022909eb5721
SHA512 7878dae07a6eededc019589212fd52c7481fb78a8466a1aec55e7a80cb99c82282ef44104565bc143f5bd65622f56dccc70070bc509e0882d4fecb1b3437f291

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\icons_ie8.gif

MD5 32aa95a779d0aaf1fc0b391f744b7f89
SHA1 0c75d27caeff91447a5d1f6a520d02a6921b1924
SHA256 a973bf0ad7b1ab6875945768d7e3578368ed76300ad74526eeb0fdd78d1ced13
SHA512 d7219831d1c96239228c66be5bf42b885ba9c5ef0a1358e556d2375e913d0bfe80dad7136756bc07b3933184dc5d48ee977666e599e1fa35902fdc61d5ea0dd7

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\icons_retina.png

MD5 9134cbbe71472fdd31056c7ad72e2a13
SHA1 daf936e1dec55656727aeb2a61ff1e3e205000f1
SHA256 f4b3470dd7c988dde6edef9109d2e97ff37e59769ec6c9fefd77333ad86f7ccb
SHA512 a56345a7537af0fa1fa303f487e1dba2681bf37df002591b2c15674b3d80c777d673c03e600ccb99bdbea05acf040d7f0ca97297f7f05b7917bf0686e833f02c

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\new_icons_retina.png

MD5 6ac6f1f306df7ee39f871dc07af82c04
SHA1 801e6b1b6aa7f2f7bc86a6d42067942e90ada80c
SHA256 0719cafe691f041c8d638447d7434a3f67cedea5e946f921b0ea623223c1a57a
SHA512 4f5f8b98a0c4bfb25ddc88fd874f51acf49fa2aab099edb1a56d1439c37b8456d8ed29a181d50595cd1a71e1d91f48e4996d1bffe6ce7312da7c8ea6fbca0b10

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\new_icons.png

MD5 d62465834e104d7aa87bbdae2eda2e16
SHA1 d310e1f4db541c6ad74ee2430b3f48fa663daced
SHA256 02eb0340c99ad89d41b57cbda6728b5c41879b53107b60e6bbdcf91a9e8714d9
SHA512 74ca32119e5cf5bf43b4c1745daa357099433fa775f661c6c40f2a32138d7854c42ed4bca852a5ce03c6afca3198866b336d21fa3485c99bbebfc2219ecebc86

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\icons.png

MD5 5fcba14360af538593273e31f93b89e3
SHA1 9364a92e789e3d0ca3bb2a17f77918e96a63ee98
SHA256 f6afcce91d1663472da02196fd09de9dcb81b3932d17ba70227a63a61b289fbf
SHA512 2833ef13209f7385f9792111f898e767fe36b548fb2fc9b5846ab740418c1ec88022b13ecdeb9e9d2ac64689f4ca7d5380b58b22772edd114209ec00954d82bb

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\root\ui-strings.js

MD5 b33b64d47de6bc3b6e4b22ba292ca964
SHA1 adbeaad8397ed61f2bbfeed70d030eaee19cb140
SHA256 2f76a745c20b3dc3297a46ba15097f1205f35e6072c3517f00f16e255b123dc5
SHA512 cb604e4616af0d75643f5f5bef0740903b4106f1b5d8a72e523b907800cd0ff16515f01717ccdb2a76c84e4c12e93ae0ab3c5f89bd1bb3a65bd53f2098824323

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\sl-sl\ui-strings.js

MD5 51ce6d18a2cafa0a962cef7ab21c5828
SHA1 b8317ef4d5b11a760528bc997cdfa9be88dd5200
SHA256 78fe7f4f625163d84e79bedd7b68f2507592acd1e67b8f5ce2dddccbbc98ad15
SHA512 9af681768f1c532fa2c6e89950b0d8f54c24c9b14b36d84e34e06f5bc83da0b79b49476277a3abb8184b88967883b01ff895e8fa8672bce07ee7c7ad1c44683f

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\root\ui-strings.js

MD5 f28ae8dd8eed63730954403da486c1f6
SHA1 401ad692dbd6806a81d34d95b543179e29ec7f7e
SHA256 e5423a9ed01f0670d59138827e77827e835425d3129966ff4186329fadc2f868
SHA512 7b56fac06c52949e1f52ba81a67f8ae46922c896b19712f0978d12fe50b1bd71b3954eaf59f7f31ae6fb10ded15697376b49e1a5654f151eb8848fac8f911350

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\css\main-selector.css

MD5 ebbe7d82c4787ad39704689b10c34677
SHA1 dc5b3c32f0ac74b18205684130e8db5823dad424
SHA256 0f3d132fb79df26f57a8a3388a3703dc687f8f1b0a3692687f9aa8d89df2bda3
SHA512 a74dea5cd77884bfd64e690f2c90189b9b4c265235cbcccce3f47064b5fb61b52da86fa6d7823cb998f6d83d50bc607ea933369df4cbf088e0280d393c2e0cf1

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\illustrations_retina.png

MD5 f541b63b194bfc2c31ed73e8022f163b
SHA1 6ed622ad00870f31cc6b04ea2b64a8a51a083d8d
SHA256 1ef04dd99160ead42f726b042ded883863b0308ceb51e36be39233662b022ccc
SHA512 e0017afe1c6098d662bf87f6e992e3c517ee042013d7095fa94f319fdbad83cdf1dd2fd03ceeace328ac7ce97a9baca2be54fbcbee0af1b3ad26b2dc134ba8e8

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\bg_pattern_RHP.png.protect143

MD5 592bb41bd26d4cc510a53531e027c474
SHA1 154884b3f3c0d7b535cb20e7fc895a68cd32c34a
SHA256 6648bf6a1a5bb60e1006fc8472f16d92eff838afe1c29d08f9ff72896d44e24b
SHA512 430e7f0a97e1b98431b35d2d9eb093a6bbed73bde1bcc2a5952b77f5894faa134e01bf7266cb265d8e66a867ec9477fbb09c96bd7daf875749e46a578a23164a

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\illustrations.png

MD5 35417b7fa173c443c8fe6cf669c83267
SHA1 0117da23e7e9536b4f30e8f5da98863bfd1a3b3b
SHA256 69a2c6259ce7aee6e4f0c0918f494fa78f9cd4c8a6c2122c4c78a1775b6196f3
SHA512 92a257979a5e7bae825eed170ba48e2cdcdfffeb748ae760fd5488890fc2c50e596728ca72d07f725d51bc53abc76089c3415227f652cb8cc808555c616dcd69

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\bg_patterns_header.png

MD5 005b8470f2db7b2e7dae8c291490deb3
SHA1 54778f064d2dbcae5e71b99c0200ce9dab1f71a9
SHA256 babb149e814f0d73bb1bec406996f18f21bbc1401db7f5b16555e02eadd760c4
SHA512 c9e65587be3932dd782d6e4d59b8eb05fce58a93091e772a5e4d1dcb18530097acca7927eb95485805b2be58dbcb185dc26a6d36c6e0df172938ce450e2fb493

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\root\ui-strings.js

MD5 fa32404b9a518f30ae61adcd20e4c0ac
SHA1 ba2ea9546199c9d953de5c3bc78d06fb5ec7b5f6
SHA256 3e718881da3227ab31ef7ecac6dcbaf3ca9a45c0265e54f6adc6184c4d1c28bf
SHA512 886732a31044977226037143aaf4b7e83a27ddfbe7cdcc10237a1baac87bb27b557bb58759ab4da7cddcfdc29c16b9cd302b19a600175a74030520bbc1969330

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\en-gb\ui-strings.js

MD5 012724b224a668aedeaa74ef47cf459e
SHA1 4a3db49e5978f00bc509a3e1f064ff9d71a1797e
SHA256 186d9012632abd7c767f4c56ea7a2b7c0fd53f27f325f2c4b070054a47cbb1c1
SHA512 fb351cd6831b114728355107681f298f46374ef6c40a73618e23fd29dad35438697595f0c1d97297d4a109f49a0111bcb074080b3c75ee2e3c308d03b197f795

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\root\ui-strings.js

MD5 8975957d7105b26350cfed261b34aa02
SHA1 1822f2143b1a4efcb7f855efcec83dadf1bbedfb
SHA256 bace48f663ff88ab0a147e5b93a709f310d7251f95affd8f85151fcea3e4f615
SHA512 f3c42e70483490e350841a55972474d80b2e7a2dc925a18bcb63397bc115d30260eceed4562bdfb2ded0a0ea723948f8ffef14d92a962568c1d8bd944ded69e0

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\ui-strings.js

MD5 4774d062b0df2877e22767cca2b10414
SHA1 84e23fd392b13f5ddb13f3b4e18454201fdd95c1
SHA256 7cd2ec9d426d694703a3a54183d3caf2cf49d93d5a92b275041ed4dae1251ec8
SHA512 ee79a5307664ae4703d8900115b59e7d77ec5146bef91c1bb42933c47cfa4b9697e12fd884b67b50f7de4625ce0a78d782a92cfc713ba61e20fd28c72d67ca86

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\PlayStore_icon.svg

MD5 be8f47abdb0276293c44281d8ff9df48
SHA1 61664a2c451ff9ca2448287a5774df2446946106
SHA256 5cb6e17965a2c8e226e939473e5c033f4344597f9394115fbc393aa6c0dd79e2
SHA512 7d29317323011b629eda0f9e7d546a4e045137790952aa9864da4b657622d0bf49d3d7ec7d21a982a43f0f94050d3773f9a1ef05c0c4c58263e2850df938a731

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\root\ui-strings.js

MD5 c534f64f27857392e8f2e4f0559029d3
SHA1 b6c055848ae9256ee9f39313762fa9602cd52dde
SHA256 c7c9311ff2ce2b5f8d7e3aeca6786d8edb588169d362676636fd2235d4b1cefe
SHA512 bb5ec83ddf6c5432ba3bbf21c8bf79405da09271ed1e8f05536ed0167157a49361b3667cc0d1de92124edfb7ef8f7f44b5e2f9210bf6ffe638fb00af1d8ac0a6

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\root\ui-strings.js

MD5 8b8795aba342ab61f56e4632dd3752e7
SHA1 5c3a1ac896df7cd855e4ea5d349ee90a70c31dcc
SHA256 3125229e56076ea21be657a91cbf1cb8b1eac6c2c077d008e1dfab0087ce210c
SHA512 7eefa6d1ec37ed7cf6522c5b65fabd7b9748a92cd1794ce1c662ac9d5340873304e7c43dfee3d41eb25471d6939617e4f1172ec19e9aab67296cd8eba528f8fc

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\root\ui-strings.js

MD5 2e23c81106981bff6882b0f2046d5593
SHA1 35d5ac18d8a82574b91acc9fa487f1f7a5d61830
SHA256 4ac8bb56d32a80fe3aa5f217507a2c72ec35e80e5297769de7b18044d04e67a3
SHA512 0a9a26d1d8516016c9208d98e733bc4762e86bdc98a3cc95fe768f7a7dc19aa999226b2ed1b7454da4b406191a49b3f860963e53daa553b0d6b517472f282ce8

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_ja_135x40.svg

MD5 ca94354a0d88359cae915ff1b3c32725
SHA1 e1cf383153067fed47d222ed0c597661d862458e
SHA256 02cbfe4f53f21ce0370a5393bbc902fa4c879defa912823b11b23fcd67a5d072
SHA512 6609fb9b008d423f80cc866927721c1d7143024c69727f2828732abbc519d6d0577d42f3d09bdf1e08062cc59577b59d0076a8a8a8ab58a7d7850eff44486f98

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_pl_135x40.svg

MD5 22032e0c8530d8a545522b7cadc0e5c4
SHA1 86c703712b87536d8ffac5bba275f00225d326df
SHA256 07367682846a919111ac5182266f8d79be23927af87c4e68e2d207430fc9f630
SHA512 77bf1b0cf598d0d274a2a725dd10f97b49102013962ef66521666042fd71b821e980f7fe7490c1caba7698e49fb017290169507913d569b8323780bd7d5212c7

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_ko_135x40.svg

MD5 081b45065c275bbba003414a83868480
SHA1 3304c7e86cf45de83401d3f521fb66500ebac98c
SHA256 078f2cd877e317cdcdc18bfeae7566a6764876c3d570bb11c1980cdb9f9c8950
SHA512 7f18079d2db608c84d3d21c147d8d6a5f43b8c213ff338062485eea068c5ee4c821f3761454a0167344d646386696ff2102bb89d0b0d91b6894832aa98668cc5

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_ru_135x40.svg

MD5 08dbeba84b5f4a8a5c32a41da5313510
SHA1 0eddc07da05dadca61ab31212ddb1930fb28fc4a
SHA256 ad51374416d13f7b0723a0a32f48a755b24c2468caff048eb7820d7213d79160
SHA512 45c529ec73e820ede636cc7192bdfd8a3218b3f0d2bbfd47ef9832bb49f2a22d4f7131621a9a2e7d8b84650bcb27eb4cf75b76813cbd0b6beac3341e4b995274

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_it_135x40.svg

MD5 4fc6626be01e4dbb731e14702c6df12e
SHA1 1da7b6760f623e582ac85e5358cb85ed103fe76b
SHA256 05e4226c56d19e0c94def82a057b34d2909ca089125aa73e0b2b64ad66ada4d5
SHA512 5c96dbf452d63f830693ff98fb806235b631f8997df740dc3f83f2214d9021cff58ba290ddca7f65e76e55bce13743fe93bf89da1d40771ff74e4d546fa01747

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_nb_135x40.svg

MD5 58e97366667e6be17e705ed7d4677a0f
SHA1 f010ec53941fc0679293f56b2b30ccfa28137a32
SHA256 ba845a92eda3e1b628bbf9ce804dfd6bbc27088df45a2b0460b60302037b9b26
SHA512 22b42ab097aa6f6bdccb880a5b83d2d7edc6853dafd1452e949bd70b0cb935452566d226d278f0c0a636831fb349d428895933464944f82d189cd9e6e2129f33

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_da_135x40.svg

MD5 e4b7caa41a0012391f7ad63182e6302b
SHA1 b04a47436e500198691bb014ad8caab877769307
SHA256 da00592cc65ca5203fa16309fcb2b6b8777c291bb22310d894e470503ad82e5f
SHA512 7725fc21f9015222e1bf1f4968cca6a11e23ec1ae5ef4bdd31fbe2b973bf08794970f4d3684b439f9e4f0fc4bec6229b90b9262b7feceef69a640af1fd53c344

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_es_135x40.svg

MD5 aca29c5f09f6d4cda9b59d301ffec575
SHA1 a68216f1c01b9f3226bb2c9c42da602cb7c5cfc2
SHA256 6bd3c8dea837b260e8f068822bc6a5356c5c4624db89ab1615732045fe0b5fb8
SHA512 74319d13c62bc271047870a82e31fd0d9e17b6dc29c3dd78cf743314a5c0068ff6de837170d92373c31a190d87f6cec119c5947ea01f52416b6448877f0310d5

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_fi_135x40.svg

MD5 3a551e0498d372ad8d2438642cf8b912
SHA1 a8d19f67d19d231e2f4127018f53c42ab2e1ad85
SHA256 24368eeede18a8b00939d9cb6300cea0657dcc5d11f131075217b97e6433d105
SHA512 b7d02811e88419a14da89458e8c089bb82e7d3df989c7af05e270d5efa49d6cb5cdd1fffaf38cb87a369c1505c40381648b341195d5ad1324307a6644288df00

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_fr_135x40.svg

MD5 2e8e41bddf4fae7fec1150f26a50a863
SHA1 589cc7453785378c759bb5a28f007fd8ff6c2a99
SHA256 de20ef9a8a0e7033b42c1a491e94940148a3d02fd2c628f019b8d2bc57325971
SHA512 9eb161f94b6f8a010d68c5fe488abbdf039c141a09b407f38bdd2b51a1da63a51640db69cac5c85d54738a51b874f31cca54eb52787a3300becf02be1e9cccf5

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_cs_135x40.svg

MD5 4e07890dd854e1e47ba389f5aa68252d
SHA1 053a54d4e5ee918cbb4583b6f0c33bd7089cd76a
SHA256 5ffb53a042a6e18175836fe16a9da8220938940edd0cc8d42aaa9147d1189ff7
SHA512 182f492dab82d2cca8b2a39d3486000cc031e8c07c693eb854d57b92cfcf749101620c8e1e6e6c547d22252baf2d57fbef8193ef0dbe2c00b48889e463415630

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_de_135x40.svg

MD5 14e52e30b5697d8acfaabbb6dabfc0c8
SHA1 ffcbd716ce2a2f69cecb4046ac2e774f54171cae
SHA256 6ce35ac3bc3ce9d10e610541164505bcbd978e90cb520df370b1db4730d804e3
SHA512 26453959a8226d18b6ea30ce46fcb477883093db58771b2af4e46d8a9d58b345d3c656a95149b2cec1a6f3c16b80f945b6cb397d884f527ae42bc1b3c3a26ba4

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_pt_135x40.svg

MD5 6ed391f8243f69adddec86b607154d57
SHA1 f046a2c1e215723de05bba4a16ad821880a64026
SHA256 b9abab32d2890d30ce23ee66951ffd79aab5aa67cf6b112c973a0f726f116219
SHA512 9db6ad245270e090030d29ee63163ed6a488d3d177b126ee8b375a2ab312114ca98f1847d372a500513eb51e48a144dab58385b49a322a73a7a3681fd0019dfd

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_tr_135x40.svg

MD5 e8cb6911b5a8a660f43a876e5dce8f22
SHA1 1ff9dfc0801ee3d52738ab6fede458fe10e600d4
SHA256 b9b07fe809adcec381148fc69bde157d1804c1f81be4bece284fb5312a2aad49
SHA512 2fb31928f63c8005c17081f8891fcff101ab1d82c37c700b73cbe7fc04572c51b6503f0656ced98a5aad2eab68d02b376041e80d649bcdc872ae2688b5ecc51a

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_zh_tw_135x40.svg

MD5 235783264c14eb65a7964d56ba7f17b4
SHA1 1d8d8964b5d75bc7fa3ca5ec10585afe76be49ec
SHA256 f99c33b3052c26ed0d1f5ca7910de733a29c2e526205de8f0d0aaeaf6571d90d
SHA512 a815748c48582d3ff03f016a5217954d96e1332ae958ad53e94890ea8643232dab13e97e2fefe6cd28cbe52fd644904723e8dc7cd0d8c7df875ff41611606381

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\cs_get.svg

MD5 51e0afc0d1631fc50ef2088ea4845e60
SHA1 c71ce84dcfd5f89dece44ea9204dd6508877c925
SHA256 cb8a6c98ff2a68e7136ef84945db41a81fd5094ec35d0c53c0ef119587c1296f
SHA512 ce2d49cefc015a67a5ab7ce155f7a1d18c132380e885d110bb4b7ed97191cc4db4fa16c6e690be8eb33dc94c8253ab54769be7326c4586b5bf2550b2416daef4

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_sv_135x40.svg

MD5 d63e5d642e39a07a00c4920ce094e8ff
SHA1 9b3790f32565333d04e6ac6fe72234fef75ab0c0
SHA256 ba4e49aa9a7686a2f15015786199b3911a78a543353b1b22b1725310c940fa6a
SHA512 9c30074092f041187ea6ae939a4ac929191f5a10efa3ad72aee68771e3b0453e9d8f5439be128be8a11a3072cad6baa53f661c76920cdaeb0afcda54232a8c10

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\da_get.svg

MD5 8e6565db433c0f521892366be76a615d
SHA1 b60aedf373649ade451557882d23aba18c1eb990
SHA256 bba32ab985acdd96f14c1d32cffc324e270475ef7b2310d390b6373a53c536e2
SHA512 40c992e3235dd80be78055d365f5fe2788aee35f13b98879dcba5d4320ddaaeb0f02eb55cf3952719e29d5d831aeb3ffb39bf8a42c93f057ae4f3ef209987db2

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\de_get.svg

MD5 0508b9dc660d02e9e00cf5dd21fde4c0
SHA1 1f0aa89366f1db5e3c46896b509d162cd9a32e30
SHA256 dff58f31668cc2014a0dc76ac87b1eaddf67120d0277ac30ea5494692d7c0e21
SHA512 4f2faf759a8eaabf51e83e320d9dbabe56ae9d1e006668e3ab8acadc5e537aa224ee92cbfccaf949a2dda444392da1d0f7a15cd911fe524fa8fc3f1ebefb18bd

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\ru_get.svg

MD5 be90a0eb2b8919224623ed0bab224507
SHA1 1c9bef96fc8c3a79adf941342740b4b26199e7b9
SHA256 11005bf57c0bd08396562b06185335b7b2c2d9bffcacdde41b3fb57735843801
SHA512 01386abd283d146b435bd437364b917c42b0fc4bcea8354c9d9b132468d1219efbcc878d412a3ec9a4e3143c8d177608f87eb29e789ef662532bf4f1dc2f5993

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\it_get.svg

MD5 55e4d4d5dd2398afe86b9c43cc38330f
SHA1 dda9af1448dbf88335fa69e3f246fb88dbe93b67
SHA256 5b5ad0083ef78072bfa676a549711a8a8f99582fc87a2cace0c4e635c2ef20d9
SHA512 7f215dd99de0c5440b26a3834d7728deb8f8474a291353ccbb4a61278475045a7bd32d62460bd6aef544b1967ee2a1416fa1ec243fab2dcbea3aca03c4e59da7

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\fr_get.svg

MD5 a0ef1675e8c16b8e82f3bfb15f3bc7cf
SHA1 b147d4734b99b7c2121d2f5fd8c015cc4683376e
SHA256 92c779c476cc745d825449926cdd36d65a33eca2902f9fc036fa5aba7c77f437
SHA512 0d76b72c1187a7121baa8c4d41710c7df0c2be082bbcd38bc72f36bd9a41c089b94480ff12778f19f28aef9e4ad5694c58c79901d588b0a42b201755a8de7099

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\zh-tw_get.svg

MD5 5321dd50ff515d5ca24af18a08aeeec8
SHA1 6ffa8622562d69fdb5b622a291b8207b896bb7a0
SHA256 e677d0836ffb064f68fae98179a12ec1603fcbb07a34608d9c7f63a424580749
SHA512 4325cb586e4b7b746d214904e735d2e55555c14da1919510764b62f90cd3f28a4b4f4c6193936bfbb1e318152e37712e58affd5499f13ec750642dbc16dcaea8

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\sv_get.svg

MD5 556f5cab21733647ef298ec3b9ec8572
SHA1 94d2f48611b9a1b72a9084f33fa5302bc1f2a71a
SHA256 b690bf7c4bbb691a0bb967a7f8f295e6a2ef5666572466f04f4f0e594dac2fba
SHA512 1a90e78fd2a7075f113102bb5702952d34e192194222c6a1f168254bbd5d43cf24d3f9fb7e41cd1007fb010e1766b1248d21af05c853696168747c126c921ab0

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\zh-cn_get.svg

MD5 daf529da450fbf922f58fa5c6de35779
SHA1 25c240002a298053ec4835b4985711972641f197
SHA256 efe98f5079ad68e766f9be40a2f67d559a775832fd45ade40a4a471c96794f44
SHA512 5a25186ec0ab3ad92650469844fa01900a6329d7d299ec05f706f1bc3b670ffc0dd62a83694f9cba8db83f353e034a8da53dc51276686e41416ef796e1172e4e

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\tr_get.svg

MD5 0408568dc7254fff1f021c83bc49efd9
SHA1 6bd9c89efc90e19228a11d93c6963333ba9b189c
SHA256 a4cc6b3b245af7a9c1bb809998d37d2e16525e9c21856ec6491cb185bfa115fa
SHA512 a53774a61ce544e99c62068328a41c9ba531e2dc9950c208720153a7a15229e5703c549b9f6eadf3d64766d86ac2b7e224490a7c792b530663564f86a79bfc57

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\pt-br_get.svg

MD5 5e2fc8b05a24687cbc10ee16e73bbdc5
SHA1 0054d3429dd15c8c284446b68cf6c38ceb087950
SHA256 76f1fb9bd804c79a8040dc6f614d8202296f12ec1f199e5f9bbdeb5269ae290e
SHA512 dde06b87b59a9e2ec13464f5c8a63987d8daf97eebc8e00c7dee9a74f2f598489bdffa620d0e02da5b6fd2c9a87b8b596eda2b2e33484744ba6129fbc5d525ac

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\ko_get.svg

MD5 42c623eed5d57831c1cddbe60f59bd8b
SHA1 5fd2879162aa776b7c1d2f586850a3e4cf7c7ad2
SHA256 473a53d57031648045e0192254b593f80a722148282cf0f18df9821ae537699b
SHA512 21c9cf97c8241b75a0202c90d5bb140a5ab1ee6ea7f5a0236d0569df50145c5bcf6d576c26835637e2c8cf21c39cce9ee616ef84db38a1ede612259ea3a3561e

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\pl_get.svg

MD5 867190ebe10ea1b83056efb99613dbee
SHA1 9dc501e8d3c538dc223c37d0d40cdf93ac69f55d
SHA256 9c948f7c6fbdf651c15c2e7e51b9b22180a6e6fe0162edb22dfe14c3b775eb42
SHA512 efecc3792fc3635a09dccce8e9e39f3c7f6b5bdddb934f4cb37af7ac34adb6fe29b7ae4801b3d3df91ea0f54c576e8df4ae0d533606fedae32344c24d3ecc02d

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\es-419_get.svg

MD5 35a4290cd56244e19cf59a0ffa0a7291
SHA1 ab790e13fc73af601ddf97cddfbbb0a9cf0a628f
SHA256 bf4ba3bd7a7be13e4674e65b98123bd29cb5b0b22e3fe8fd04e850a00abf15ee
SHA512 6bf9b064919d4b0ddac9260377cd9c858ca477d797fa6b33c06de92eb96f1160f0b2a6bea903a2016dbc5b22ea699700f57b8450fda6fc268c08a839690ee68c

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\fi_get.svg

MD5 c76e85a1cf4276e66cb961d534c7a101
SHA1 b05aec5dc7d7a8ac31c8c434360ef85bc10453b8
SHA256 9971e18152fb0c20ad52cb4bb6db6b38ad39e7829819387fb605dc7896b37050
SHA512 55401d7161703feaf8d7417e624d1a67f61f00b0eb8d50e213d4d777c2a569f7516a7386c43ec724eaf32b6ed0d17150f982633d0ced075dc9eb70d616053c57

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\no_get.svg

MD5 9175349acafabf80b1ee7daa192d0212
SHA1 9b21dc2f20c7162356ba419e7ac02f86a4b897db
SHA256 621439763989523fba77515bc6e74c89cb3927286bd44549446e6311d63f3172
SHA512 6abb4f457447745f5ea30855612de6ec050cbf85224d02af2ad2160e53cd535dec6e3088e7243adea03daeb7be1b7c64a9a45436d3a2bb6a1ef51af637f26f5a

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_zh_cn_135x40.svg

MD5 2b55c38e52e11fe0dc02114d9ec844c0
SHA1 b6be58bfd72621fb766eddc7f9c862b751a8ddbf
SHA256 f87c3872e9a17da849527d81e36b72dfc00a41c381fbaecb85f1a432e26ab162
SHA512 f84d8de4099d6b9c2e455ee84c64484bc19b4c3e88e5cc6588d31fbd5d324b357d6b7ed170ab4275818e9588c529845b954b0969c7c4fe31e532d163dcd68da5

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\root\ui-strings.js

MD5 601e7175593fa3e24779566693c444b9
SHA1 8f502c2a217e15e5a849c7113133da51051536dd
SHA256 803f64424638e7e096c1df47086b74d454c097f47d2e78fa54c6c7555ce4a334
SHA512 a596c4340502577e72411ccca9034fe18abe095167b25094e448b34a88b6b983c3337a30575b2a2577e50548796c83e853f6497205c60066b60270b61b50834f

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\he-il\ui-strings.js

MD5 c094a73eef09d443daa082ce05cd4570
SHA1 c616949b34f65fbf4e3cb722996d4042ae5eb3c6
SHA256 c804fa3a5386c011f1cd088cf1427889ced5aaef6532a198a4001509c2cf5cda
SHA512 5877ff5b81ca70537b12e17def282347a00fefa8aff43a0846ef139a28ad50e8f047f04fdb0333f9dfb12c6fec99544e276c1a41fcc16550cef017d8535e42d2

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\nb-no\ui-strings.js

MD5 284c706905976f508b1cbc449081af51
SHA1 73e5feef65b96cd670826b8225fad8214218ef1f
SHA256 8ca6b65a2389fec42942463d954a1834d8264ad48f84341cd370976c780a19be
SHA512 a9955534be094ae6b14fa809cf030159544974e7d4e515e7a7563e209043c2aa810b6151f55ff65200bb6793f3519bac6c0726b79955886aacc121ba34c67fbf

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\root\ui-strings.js

MD5 a54681e175a17bc207c748b09857e5db
SHA1 a68aefdb4939a5ed2ca2b11f227c6ae32df81c52
SHA256 c238df503746d932e995fc8e4012fea2a1203f59cda1e1c5ca1d10aba2489fed
SHA512 07b242bd2e4ca235cece2fdac60200f36e1bb0d355fb9945aa9cb670156f0faefa4398b6c9aebdeb2d0b422a8f050bed0d76616a2ff845d5f6f60e59341b879e

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\root\ui-strings.js

MD5 24700265fa8b2e9e8d4ff636e8650ab5
SHA1 bba66799f2cd8d0ef2047e582191164a0b1d87f8
SHA256 0cff8291d161c6c0ea8f863645890099ad496f35bf3728d60bb694c84ab52902
SHA512 89d40bf8497ce6505b131984036ed489c58bc51c5bff33f1c331c5efba25e9f44de1827b24eb2c17021e36ecdf5dc4013faf8b0345de7b2abb63197854ad6871

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\sl-sl\ui-strings.js

MD5 2b82c9e089d94a9da72a85e3ace34f28
SHA1 a63b20bbe62517af41025dcdec70c599e425abdb
SHA256 261481eabc22cb1df90e455fe90324bba104521cbb415753e978ada0648e7c53
SHA512 2e7a421484cbe87d90aff377c89487944b820e6d03fcc284aa5586ed48df4b735a1eca330c8b028498f13a4e4e05577a82143564d1f05d3399fff5ea934ff27a

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\css\main-selector.css

MD5 31c06bd67a29ee11c7cbf86d87e63db5
SHA1 2ae64154400359f81311ac81fa3f48a93e53111d
SHA256 11076046821094bbd7d953ec7bea8cf254a7b444bd0da571c4bc955ab582b097
SHA512 26210cf598d30791fb33895f459f00ae6632f6255d39c5a5ce800f06fab32c999ce87028ac7e3cc2192b7644d142feedbb07b9a596a0388ef718ebd99137b873

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\root\ui-strings.js

MD5 2e49aa265578189247a7f96db99429f3
SHA1 2dff7087d7e88006128a8bcf9e38684096f7be3f
SHA256 4a8dc07aad38a1641a8f93c2f2beba093d9b50008221de9199deb6090c73cc9e
SHA512 8e98c6bfc405f400c0ed595a3604f222b67c2d5176e5fda236d99911d298c8fef296cdbce4e5c6e8612e967cfbe385c1f7318aade2254d8f54f6ce6bb305fbf3

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview.png

MD5 51d7c102f64e07d1319baa8f8024d453
SHA1 34f6082283744c2ef2820a6f0a8a13429abd371b
SHA256 464950f907a560bfa5f8db501df4310b3dee20d79884546d4862cfd55a4d3fd1
SHA512 0ef010b2fc10ed78123b075dab9bfca311f293af6e90cb132b1b00e429614dbb803364ae0e2fa78ced7dc63acaad8b217bee54a5409eba0e3a8a5a10d9cfe7d6

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview2x.png

MD5 656c235f57dc1eed40f8bdf6185164eb
SHA1 af780b3defc38f9bcdc547e4a5b492a7ffe26c51
SHA256 441ff0eadf0e67d86878d2cf916adf50ede3152b13b3d5ed6932f2d927c98692
SHA512 664102900826d44691c387919be9bdd8a6cebaedb2f00948e69811e57e12552a5550fd5fe3a4683a22d935790dceb08331f8523c321d77de1229c4843c9cfff1

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\bun.png

MD5 6ed39bf432e1f5da3a040dbea9ba1f39
SHA1 d908cb52a876fb57ceae35fd6a4f5c95a26e0bef
SHA256 7429e270926cc6c490c9874355978d113de33c7b7beb5ea94631ba5214f7c4a7
SHA512 c22a3dd50b13ef4183d0b9c00c50bb650884748645e5ca24af3fdce17a17e7b144c9bf53a3aabc9d67947fb44804fd3b99d943042b772c7f663c00ccf1249433

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\s_thumbnailview_18.svg

MD5 d95d9fe454291750f3b49f250f8257f6
SHA1 fe7c2fe1e011ec810e48d820ad329bd2c9de60c9
SHA256 f2ab3b14e3e58ffca9c0c4b3296ac8059fc08e6395bc279e8beb35629b446fa3
SHA512 d8610468b1e24eaa2a14ec4c20f0b087693299506cf29f1d43fae5a63fe5f71b1d49459f2c82b65f5b36f7d24122d8328bd7473995ae15f80d182873c19d6002

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\s_listview_18.svg

MD5 b09be673f084d1773921defedefe873a
SHA1 55e62d5d334b0d346ca77fc5b24215981a1e2a5c
SHA256 2dc29ddded445d7d85b93ccd42c9380b68169e5e67dbc779b2456bfc8732bb95
SHA512 ec3be697f318a7fc06c125258ab5dfe0d42c2ae5eeca0a56e7f60b38659b553ddd2bc574e0fb55d65b0e4be3ab094bb246af528ff62a0edc05d2507db1a01cd7

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\nub.png

MD5 5eba04c080e9bfbb31c3668e1204ccf9
SHA1 68964774f188f49ebe72d3ab90f5254410facf2f
SHA256 4f4080f4e1152773c08183e09ecb368aeb21164756a1bd3fb369d67e1bcab8ae
SHA512 a6d9263f9ee0cd7f23fc74791e70c4bd9797a131be17f4f41589375b80602bbd8b5a2335441d1977c97911e4e455fd9d2825ed9810e621396e754974ef46afb2

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons2x.png

MD5 9e7790322ec44e98dd393e8336c671dc
SHA1 a7c872dfad48115addcf83a9112265b447003114
SHA256 7eba3058eafcbaedb28bb55da3afbe540efb6e282aa23c49a3cd114581d20eab
SHA512 76b8e6f5caf1cdb9146235264ff189373207dbdb5e62675ada61f5a03375a070633adbab119138f58a1c4af2d5e252620fc7015461ea6f174d38aed220810541

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small2x.png

MD5 abc1bb271d5dccaff521f829a1684f6a
SHA1 6483f32fbe4fbd2505fa5289884bb37720295a56
SHA256 6f247f7aedef3e1fc8e4b37b2dd5cd13a4adad091d57ff82ecbbc7127517797b
SHA512 4583049ae1afc25314f7cfe0625ae8b83ca0322be9ac55b892655201f24758bc3232add33ff52b0bfb18a679d81304d1f176ca317c4a61e1b8007002e9ecce7e

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small.png

MD5 fd0f8e4ac49ece232922c341ff2ae768
SHA1 59d97b0973cddfd2d0804f0bee8715078b258568
SHA256 1b66a2488388594af8e97d8a6fa14620b16e3b928ae8d1fd5d8a5b953b7f9a9f
SHA512 ca2695c549b70b32385c3a9d8dad7c2dcc63d1beb44a4640c1b592814c64f25770ba02dc4aa12656d337a9889481a19573728274c252ae677a23049190a4dbdf

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons.png

MD5 cb0800cbe9baa30fcd119e4eb722a53f
SHA1 264a5d3e9f4d26f9d6fa4181daed3c4c22b5f147
SHA256 ed8e2ba59647da5b1334d87bf5681c00cdb7cba23e2b010885f27fffec0a404f
SHA512 75cb611522c30c847019430c3ad90980ded20bf76366e5d7a304f92c9ea1ddfd5ddb69562d69bce33742b0365e42ac372321d9312a4f563f92535dc75c3b4563

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\root\ui-strings.js

MD5 d5e66f4487336865ae4cd28011f213b4
SHA1 d3566820e6909400bb69ee9d4e688a33b5f3ac73
SHA256 3f2063467742014f5defefe04b074d6d87e5349ada7b51b16df3fdb7cfce18d0
SHA512 eaca9b0061451353002aff5c966f664ae3982520811a8546594c30196f59b2b602b13e4b320640827ffd8545f72eea419cccc6cf64a45a5aea116612a5e14f92

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\da-dk\ui-strings.js

MD5 1dd1e982f072ad768e527f678224a661
SHA1 4a6b97457fc48a7fad34f69e1f5a68d7443fdd2a
SHA256 eb081b4dc9eb3476d9ead9cee72deace7f66cd1a3fac7a7e865864c824cd9bb3
SHA512 977b53c47eb17da515db361b84ba68f228149ac3b47fb216ad603fd2cd4f3a79d7d1478dee6f124315c9ae698982fe34b6e6350ac80381c0a2f43eefdfb8fc9f

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\root\ui-strings.js

MD5 627eb15c17cf436ed04c007bff8b0f7a
SHA1 0e5c46d6073d72b9c58b11b332e28aa24f8411e7
SHA256 170a296d3d8b0d31c75504c311924d9393ed328ac780257359d6db59de29bbc1
SHA512 feabeeca1e7c7e614dae0328c9f4daacac50de7042b23873b0363287dd256b8f057664f84b6e671c33e3e86af620d3485facbc4f3525f6449e3e886d66614f97

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\es-es\ui-strings.js

MD5 2b0e62a7d428ac3bd787fd814a4f293b
SHA1 8993dbfc983d1ae54efe461c971ef4f24977b071
SHA256 77765534f89aa248be6f21d0585dad289a707b6a99978b3212ddf2fa69a54040
SHA512 d219ecff3ab642696ca35b7fe2fb1efe5d3d492f34c081981922e55f54f134acf4a6d4af7de5ddeead2676f299f110e23d35f050a6ded8b4bd57a50a4828fadd

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\root\ui-strings.js

MD5 cc27471ca4cc5b1eada0921eb91778f2
SHA1 b99a7b880fb7b60eedda95ba3cc5d672fedc603b
SHA256 a3b85eb862c3cf4a997b0a741a198f0033c1c356ad33543c825b43e57ac18d27
SHA512 006034949658e2ac7e6fa4e5cddf05b5869779338435edd81d0725d722503bca93d32aa7b687b910cf5b0b1acff7ff248025ef510ff2979f79e23da36ce6ea21

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\he-il\ui-strings.js

MD5 6d47039098201e1d3fe315a01e1d96a6
SHA1 829ebf720e3a628d7f52acbc99674a10a2344d44
SHA256 284c7f99d1de8c89cb366f152f6e5dfa800b52018d1a487a83d3462ae3ca520f
SHA512 adcc27e55c3de109ca63dac3637f4e13b03034fdf7367681bca86da3107957ec9006e8f058b245f95d2dc58908b85ca90067f44163bfbfceb12076140fa021ed

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\root\ui-strings.js

MD5 bd3b0f1012e2f87a5e54417205b6a520
SHA1 b39107221a4d973b08e44fe88f8c1e0885d83cfa
SHA256 69ead4102bbf7b71e395e920089bcc2aebe1b68c11e27f8a212cfd3a7444db60
SHA512 df4d8638b2e4358996381668a9c45869a562d7c6ab82bbc67f00d6eca3f8e2811e019297ea43c12e9773b098b18a29a099041a1cbdda46a2abec6e92afb827be

C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB_EURO.txt.protect143

MD5 546e1ba03a4f7db79a10b7432f9dfa27
SHA1 35e1d5bdddf1c934ceeda8afa9e61ca3353f113e
SHA256 475f22939c4a203082dc7d006a80d3bee6a502fdacbe60d11b831e2ecb838a4b
SHA512 4de8a1ebee96c945bcdfcf19e143dd0d70e53083a0e6bcab82052e099ff5d315d543e8fb6e14f1fe8a17707788aa9485e3736507718130ac13349ee7d5c0b323

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\identity_proxy\identity_helper.Sparse.Stable.msix.DATA

MD5 c6e51639f14e8fade80b81fe81ca7e86
SHA1 475a91d3f8a9636a0eda6e56adb35c69a3736007
SHA256 c3c016363fdc214f57ec8e06ba79840415b0b322ce73ceabe75c69a3b9688d94
SHA512 7b76aa3cfb8d61dcca504cd896ee8a2c3802a8c6653922ec84fe310d5a2a9840fff14cf6be890ef09ba29ab9c6cd70a4c8917e4be171ddafb43135ee98181ffc

C:\Users\Admin\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\000003.log

MD5 50a96e45e1a2684e032899cdbc62c665
SHA1 66aad85faa3d5951edfefb83db18554baa3954ae
SHA256 92848d9a928099ad27c46659cc95c6c37b98e396e635f5fe83216e51b22d393a
SHA512 b613f0e0ca00e502df43d8dcfd16d6e996055030d8e9b18b3c431bbc5e7899e9982d1d1a1e177c74327e527ddbca3f11cc59310bc6ce2f973929379f5af0005e

C:\ProgramData\Microsoft\Network\Downloader\edbtmp.log

MD5 5762741f159d7f8f1cc8434c9154ec52
SHA1 ab3dcd84cb657b1c70261d5fbbc2a1f7798f3d6f
SHA256 bc707d4fb142c9cdedc957a398a45b048b0760671c167fd690b298cd4e1fdeb5
SHA512 99c1195a2fc765b3193a891fed9e9fd76e7fe4a7f3607b50a1ebb4c575687aaaae5e3c90a91ca502caed4b179ebcad29c236dcb1b0ac40cf6312a45c376beee5

C:\ProgramData\Microsoft\User Account Pictures\Admin.dat

MD5 77c601cb876fb0c782508474d2fc4ba3
SHA1 992a3562fcd4655b04ae455ba1a530ff7d09d37d
SHA256 6111bd6d83c8623636cf1c1bdbce08789e0bfc0731118b6b4a778dbe8f99c4f4
SHA512 2e34fc6dde442e3f59d5141f12c41d2426841b7ffa1bdf28a9f36967dc4e107769a32b6967b08fa4168dee92db57ccf80691d3ec4d3daf35c4a43190d54dbf59

C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\packages\vcRuntimeAdditional_amd64\vc_runtimeAdditional_x64.msi.protect143

MD5 9c0e00bca9ad75b5a66256da26981bae
SHA1 f75ca8772c98458157f991334c5f5bd493d607c7
SHA256 acea1f7ddc468331a06a18b8ff7fb2d11567b43a63d37597eb8c180f746a2ebc
SHA512 518390cb4c049e8980a0d18df2618277ad5d9c1dbf61ebeecaee34711e08493e0bf26b8941f938c00882bb15a71fc666aab57afd878c06eb030cb2e8d33e56f9

C:\ProgramData\Package Cache\{D44822A8-FC28-42FC-8B1D-21A78579FC79}v64.0.4211\dotnet-host-8.0.0-win-x64.msi

MD5 f9288b051b60d0a62ca5f6aef1cea0d5
SHA1 3f80b10cd324f21b3f135d279624001d6fba1439
SHA256 c150ca4b7e02689dee56e8dee346fdd73e14043d5a8a939ca26ec0eafca93f36
SHA512 61ec7ebfd72dabc5dba736f54ce3d11ac0ea673158f7eff9833866d73b573b6e46e42f6d69fa293bf06c4e46ce76e502d63943ad11cae5e3977228614f85c5db

C:\ProgramData\Microsoft\Windows\Caches\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db.protect143

MD5 7c1d5801d5e35e5abbc63caedfe7b309
SHA1 dcd2786cc2b2d21f9d3b3623dda42092eca8fed5
SHA256 cef094c099425ae5dae519d51a13cf0ee2c67165e0059dd1d8ee3dfcf818f7bb
SHA512 cd0390397525309b0bce9789a5ce08161c54c972454dadc83cabe48f8841662f8d107af1d937c0725f55c90e3ec1acc7e3f1d129a8c7027fb1321be8d682c573