Malware Analysis Report

2024-09-11 01:45

Sample ID 240227-wjsnwaff26
Target cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.sample
SHA256 cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30
Tags
medusalocker evasion persistence ransomware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30

Threat Level: Known bad

The file cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.sample was found to be: Known bad.

Malicious Activity Summary

medusalocker evasion persistence ransomware

MedusaLocker payload

Suspicious use of NtCreateUserProcessOtherParentProcess

Medusalocker family

Renames multiple (7575) files with added filename extension

Modifies boot configuration data using bcdedit

Renames multiple (6546) files with added filename extension

Deletes shadow copies

Deletes System State backups

Modifies Installed Components in the registry

Deletes system backups

Enumerates connected drives

Adds Run key to start application

Drops file in Program Files directory

Drops file in Windows directory

Enumerates physical storage devices

Program crash

Unsigned PE

Suspicious behavior: EnumeratesProcesses

Runs net.exe

Modifies registry class

Interacts with shadow copies

System policy modification

Suspicious use of WriteProcessMemory

Suspicious use of FindShellTrayWindow

Uses Volume Shadow Copy service COM API

Kills process with taskkill

Suspicious use of AdjustPrivilegeToken

Suspicious use of SendNotifyMessage

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Command and Scripting Interpreter
T1059
Persistence
TA0003
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Privilege Escalation
TA0004
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Defense Evasion
TA0005
Indicator Removal
T1070
File Deletion
T1070.004
Modify Registry
T1112
Credential Access
TA0006
Discovery
TA0007
Query Registry
T1012
Peripheral Device Discovery
T1120
System Information Discovery
T1082
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Inhibit System Recovery
T1490
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-02-27 17:57

Signatures

MedusaLocker payload

Description Indicator Process Target
N/A N/A N/A N/A

Medusalocker family

medusalocker

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-02-27 17:57

Reported

2024-02-27 18:00

Platform

win7-20240221-en

Max time kernel

149s

Max time network

124s

Command Line

C:\Windows\Explorer.EXE

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess

Description Indicator Process Target
PID 1612 created 1224 N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe C:\Windows\Explorer.EXE

Deletes shadow copies

ransomware

Modifies boot configuration data using bcdedit

ransomware evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A

Renames multiple (7575) files with added filename extension

ransomware

Deletes System State backups

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\wbadmin.exe N/A

Deletes system backups

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\wbadmin.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\BabyLockerKZ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe\"" C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\BabyLockerKZ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe\"" C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened (read-only) \??\F: C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened (read-only) \??\F: C:\Windows\SysWOW64\cipher.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened (read-only) \??\A: C:\Windows\SysWOW64\cipher.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\vintage.png C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host-views_ja.jar C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR32F.GIF C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\16_9-frame-background.png C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\How_to_back_files.html C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened for modification C:\Program Files\Windows Media Player\it-IT\mpvis.dll.mui C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14828_.GIF C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\SECRECS.ICO C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ExecutiveMergeLetter.dotx C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE02278_.WMF C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\Xlate_Complete.xsn C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-full_partly-cloudy.png C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\deploy\messages_es.properties C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\js\slideShow.js C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Swirl\HEADER.GIF C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\js\RSSFeeds.js C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\bin\setEmbeddedCP C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.common_3.6.200.v20130402-1505.jar C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\INDUST\INDUST.ELM C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0152590.WMF C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR7F.GIF C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.DE.XML C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\decorative_rule.png C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Anchorage C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18257_.WMF C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR17F.GIF C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\bg_FormsHomePageBlank.gif C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened for modification C:\Program Files (x86)\Windows Defender\de-DE\MpEvMsg.dll.mui C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\button_left_over.gif C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\How_to_back_files.html C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\ECLIPSE_.RSA C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File created C:\Program Files\Microsoft Games\More Games\en-US\How_to_back_files.html C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\javax.el_2.2.0.v201303151357.jar C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\css\localizedSettings.css C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\js\settings.js C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Recife C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\locale\ne\LC_MESSAGES\vlc.mo C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\js\How_to_back_files.html C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\FAX\MedianFax.Dotx C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\gadget.xml C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsHomePageStyle.css C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened for modification C:\Program Files\Common Files\System\Ole DB\fr-FR\msdasqlr.dll.mui C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\How_to_back_files.html C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Dili C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\6.png C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0187815.WMF C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-options-keymap_ja.jar C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\hi\LC_MESSAGES\How_to_back_files.html C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107744.WMF C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File created C:\Program Files (x86)\Windows Defender\en-US\How_to_back_files.html C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\Explorer.zip C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\gadget.xml C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105246.WMF C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PSWAVY.WMF C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\J0143748.GIF C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Grand_Turk C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\AUTHORS.txt C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_gray_snow.png C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\JSByteCodeWin.bin C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\system_s.png C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\tipresx.dll.mui C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\toc.gif C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_hail.png C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\js\clock.js C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Logs\WindowsBackup\Wbadmin.3.etl C:\Windows\system32\wbadmin.exe N/A
File opened for modification C:\Windows\Logs\WindowsBackup\Wbadmin.2.etl C:\Windows\system32\wbadmin.exe N/A
File opened for modification C:\Windows\Logs\WindowsBackup\Wbadmin.1.etl C:\Windows\system32\wbadmin.exe N/A

Enumerates physical storage devices

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\vssadmin.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A

Runs net.exe

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1612 wrote to memory of 836 N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe C:\Windows\SysWOW64\cmd.exe
PID 1612 wrote to memory of 836 N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe C:\Windows\SysWOW64\cmd.exe
PID 1612 wrote to memory of 836 N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe C:\Windows\SysWOW64\cmd.exe
PID 1612 wrote to memory of 836 N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe C:\Windows\SysWOW64\cmd.exe
PID 836 wrote to memory of 2644 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 836 wrote to memory of 2644 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 836 wrote to memory of 2644 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 836 wrote to memory of 2644 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 1612 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe C:\Windows\SysWOW64\cmd.exe
PID 1612 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe C:\Windows\SysWOW64\cmd.exe
PID 1612 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe C:\Windows\SysWOW64\cmd.exe
PID 1612 wrote to memory of 2716 N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe C:\Windows\SysWOW64\cmd.exe
PID 2716 wrote to memory of 2592 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2716 wrote to memory of 2592 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2716 wrote to memory of 2592 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2716 wrote to memory of 2592 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2592 wrote to memory of 2548 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2592 wrote to memory of 2548 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2592 wrote to memory of 2548 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 1612 wrote to memory of 1584 N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe C:\Windows\SysWOW64\cmd.exe
PID 1612 wrote to memory of 1584 N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe C:\Windows\SysWOW64\cmd.exe
PID 1612 wrote to memory of 1584 N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe C:\Windows\SysWOW64\cmd.exe
PID 1612 wrote to memory of 1584 N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe C:\Windows\SysWOW64\cmd.exe
PID 1584 wrote to memory of 2888 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 1584 wrote to memory of 2888 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 1584 wrote to memory of 2888 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 1584 wrote to memory of 2888 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2888 wrote to memory of 2740 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2888 wrote to memory of 2740 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2888 wrote to memory of 2740 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 1612 wrote to memory of 2576 N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe C:\Windows\SysWOW64\cmd.exe
PID 1612 wrote to memory of 2576 N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe C:\Windows\SysWOW64\cmd.exe
PID 1612 wrote to memory of 2576 N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe C:\Windows\SysWOW64\cmd.exe
PID 1612 wrote to memory of 2576 N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe C:\Windows\SysWOW64\cmd.exe
PID 2576 wrote to memory of 2348 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2576 wrote to memory of 2348 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2576 wrote to memory of 2348 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2576 wrote to memory of 2348 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2348 wrote to memory of 2612 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2348 wrote to memory of 2612 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2348 wrote to memory of 2612 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 1612 wrote to memory of 2492 N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe C:\Windows\SysWOW64\cmd.exe
PID 1612 wrote to memory of 2492 N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe C:\Windows\SysWOW64\cmd.exe
PID 1612 wrote to memory of 2492 N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe C:\Windows\SysWOW64\cmd.exe
PID 1612 wrote to memory of 2492 N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe C:\Windows\SysWOW64\cmd.exe
PID 2492 wrote to memory of 2608 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2492 wrote to memory of 2608 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2492 wrote to memory of 2608 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2492 wrote to memory of 2608 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2608 wrote to memory of 2904 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2608 wrote to memory of 2904 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2608 wrote to memory of 2904 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 1612 wrote to memory of 2916 N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe C:\Windows\SysWOW64\cmd.exe
PID 1612 wrote to memory of 2916 N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe C:\Windows\SysWOW64\cmd.exe
PID 1612 wrote to memory of 2916 N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe C:\Windows\SysWOW64\cmd.exe
PID 1612 wrote to memory of 2916 N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe C:\Windows\SysWOW64\cmd.exe
PID 2916 wrote to memory of 1984 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2916 wrote to memory of 1984 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2916 wrote to memory of 1984 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2916 wrote to memory of 1984 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 1984 wrote to memory of 1896 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 1984 wrote to memory of 1896 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 1984 wrote to memory of 1896 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 1612 wrote to memory of 2684 N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe C:\Windows\SysWOW64\cmd.exe

System policy modification

evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe

"C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe"

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c rem Kill "SQL"

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c rem Kill "SQL"

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlbrowser.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im sqlbrowser.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im sqlbrowser.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sql writer.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im sql writer.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im sql writer.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlserv.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im sqlserv.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im sqlserv.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im msmdsrv.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im msmdsrv.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im msmdsrv.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im MsDtsSrvr.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im MsDtsSrvr.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im MsDtsSrvr.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlceip.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im sqlceip.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im sqlceip.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im fdlauncher.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im fdlauncher.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im fdlauncher.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im Ssms.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im Ssms.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im Ssms.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im SQLAGENT.EXE

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im SQLAGENT.EXE

C:\Windows\system32\taskkill.exe

taskkill -f -im SQLAGENT.EXE

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im fdhost.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im fdhost.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im fdhost.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im ReportingServicesService.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im ReportingServicesService.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im ReportingServicesService.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im msftesql.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im msftesql.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im msftesql.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im pg_ctl.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im pg_ctl.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im pg_ctl.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -impostgres.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -impostgres.exe

C:\Windows\system32\taskkill.exe

taskkill -f -impostgres.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop MSSQLServerADHelper100

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop MSSQLServerADHelper100

C:\Windows\system32\net.exe

net stop MSSQLServerADHelper100

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop MSSQLServerADHelper100

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop MSSQL$ISARS

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop MSSQL$ISARS

C:\Windows\system32\net.exe

net stop MSSQL$ISARS

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop MSSQL$ISARS

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop MSSQL$MSFW

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop MSSQL$MSFW

C:\Windows\system32\net.exe

net stop MSSQL$MSFW

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop MSSQL$MSFW

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLAgent$ISARS

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop SQLAgent$ISARS

C:\Windows\system32\net.exe

net stop SQLAgent$ISARS

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop SQLAgent$ISARS

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLAgent$MSFW

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop SQLAgent$MSFW

C:\Windows\system32\net.exe

net stop SQLAgent$MSFW

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop SQLAgent$MSFW

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLBrowser

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop SQLBrowser

C:\Windows\system32\net.exe

net stop SQLBrowser

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop SQLBrowser

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop REportServer$ISARS

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop REportServer$ISARS

C:\Windows\system32\net.exe

net stop REportServer$ISARS

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop REportServer$ISARS

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLWriter

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop SQLWriter

C:\Windows\system32\net.exe

net stop SQLWriter

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop SQLWriter

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c vssadmin.exe Delete Shadows /All /Quiet

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wbadmin delete backup -keepVersion:0 -quiet

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTATEBACKUP

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTABACKUP -deleteOldest

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c bcdedit.exe /set {default} recoverynabled No

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wmic.exe SHADOWCOPY /nointeractive

C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe

\\?\C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe -network

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c vssadmin.exe Delete Shadows /All /Quiet

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c wbadmin delete backup -keepVersion:0 -quiet

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c bcdedit.exe /set {default} recoverynabled No

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTABACKUP -deleteOldest

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c wmic.exe SHADOWCOPY /nointeractive

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTATEBACKUP

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\wbadmin.exe

wbadmin DELETE SYSTEMSTATEBACKUP

C:\Windows\system32\vssadmin.exe

vssadmin.exe Delete Shadows /All /Quiet

C:\Windows\system32\wbadmin.exe

wbadmin DELETE SYSTEMSTABACKUP -deleteOldest

C:\Windows\system32\bcdedit.exe

bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\System32\Wbem\WMIC.exe

wmic.exe SHADOWCOPY /nointeractive

C:\Windows\system32\bcdedit.exe

bcdedit.exe /set {default} recoverynabled No

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c pause

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\wbadmin.exe

wbadmin delete backup -keepVersion:0 -quiet

C:\Windows\SysWOW64\cipher.exe

cipher /w:\\?\F:

C:\Windows\SysWOW64\cipher.exe

cipher /w:\\?\C:

C:\Windows\SysWOW64\cipher.exe

cipher /w:\\?\A:

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1612 -s 712

Network

N/A

Files

C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\How_to_back_files.html

MD5 0f0467a6fa89f789b9c7ee1e81ac9407
SHA1 eb8c6829f8d277d1b007b94acbe6469a78326555
SHA256 1b867cce5424049bdd749737b4662a6e382262956298ce0d8117fb4abfd77ea7
SHA512 3ba949af03c81a00a5e079f41bacf9d14b3c4e859ab0cd8197136962d4ce90ff535dcb4664791e1ba16bd750447030681a5d391d000822f9a8b723ff6c870878

C:\Program Files\Java\jdk1.7.0_80\db\bin\NetworkServerControl

MD5 377bb138ace611425fd495537ff8e075
SHA1 8369d30dde2eb6ee2db2eb683113543d17e20983
SHA256 d5d25371ccbbfdde4daecf0cc77abbe42e6ff2dd85ff9120f83a7079570e124b
SHA512 1631d7a33c73c1ab358395bd6062294e163af9b1a97061c0bde4696bd62f17ad161bccd30e2f12eb66342f0152bb129569d7a9ecf040f9cf15920de08ae13099

C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif.busavelock218

MD5 82a438eb90d0b5e49f497d92fa5141f0
SHA1 a7ad3bed05c9f7bd460c61c4e0cdf041ce883dea
SHA256 fd3428355b6a5311455a98762e9138cc212e8f1288a6b410cb7566c8b4bb1bee
SHA512 c7b2fd21181516069a1e6138d9a898c8fc2062b302d8743d2266bb0d3d552eaa0815c6727b452b0bd00dea3a23b5cda5e4dc5065fb2d013a1382dd49137013fc

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\UTC

MD5 03fd84f18a1fb4620000dc67cb63435c
SHA1 7605c1f1e62a46e2e1192b62c8f123b24e233546
SHA256 72a4ffa76acdf95ddcaa7c85a87ffd099fa0ec5e69b722f0c1c91c3ec58b44e7
SHA512 6488e231390e1d9da8a195d85a6b0d9f0fde996efc7b060fe78d8333dc1f5731f11cf9661ff6f0957239e8a8aaf1796c5854a57cc0392f21ab975735738fcf9c

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\HST10

MD5 3ce6e846d7b8f9f16b52c24ed4577b6e
SHA1 213972be47cdd8e2a090cd9d97d4ec19d9ac6449
SHA256 e047bc10dc4bfabf534054241cd54d3623dd68f30d43eaac5dc9edf6a410c303
SHA512 07c7c08c600762949c958c0ac67185eced3d79e6f03e92219635a959db81790960869ac1f90c4c77433659459c7519d55e58e8ac53874e1358c0451218f9f928

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\EST5

MD5 144d04ecbeb7eadbe93463f904e3a923
SHA1 6643e64b3e7a7f96fddf73ee33fe666fcab84396
SHA256 1531026fb348ba48b933b7c6ecaff5dd70758d296492c7bf1061a9534b7ec8ed
SHA512 b71a77a3266e2387764e7355e25f93e55378faca5c86f60c51f686769a7c492dcf60a4d1d016f44f856e7a237fb6b897388be8e9adf3b260a344643525db012b

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\MST7

MD5 f89300e70aea7d3cd7e28520429bfc7d
SHA1 178fc8776fae0ebabf344d72a223a105e3cdb15f
SHA256 dc19e31b1f9a4ec9fa8a8f999294dc72081401790e8350c23828ca00508ea7ae
SHA512 6397c8d2e455dcec055e018095f243425d2d6d14b42ade1945a9e6dc7ede1852f9ff4701b2caf005a88ed22225f9e11c884821d2320b97134fa0d56a0fbddb22

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html

MD5 137f9f9df6c5a382a103bd3502d0ecb7
SHA1 485f9b724d8fedff6d8ff3c23af84cdd0f6772ea
SHA256 4778667a2f42fc810e6e5ae2ecdec0395defa2c1923e315e30a2c8edba41e797
SHA512 5dcab595af59df17102de4f0888bc56b3409496ac1a367e71f50ab5bcec3e0a30dd7bf70fabb82cf7dc0685bd5005d0e6379d1017f87fbe25ea619084ca831b7

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html

MD5 8de93e33e10e2b88942a7743b961e973
SHA1 37ff7b0c554617c87953a2117dbc341b743dc658
SHA256 be3a4a7736468fe31f5efc13732075c902da4d127c4f2c94d3c488870f41d77e
SHA512 87b8d13f98cdcac35bb4f668a1aa327ea20607bfff339fd2b66fc860bb7a5b4237612875881b3b1a9fdceefa5f6ad6a4d9ae827da3273135cf0224b6f55fad24

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\eclipse.inf.busavelock218

MD5 e46d92eca9f6a43feb547683349af6a0
SHA1 8f5659d12d8f1a3aca5620f47ecd235c4e28635e
SHA256 40f6a5edcb2e6fa89a1c0d3c33163c44d1d1b65d2fb84e4a3200403dd9ca845e
SHA512 516fd45ce09611e2a2b57ac45bd1b938ad6d3e5a6eb7fa6ce992b04fb0c773ed87092c0cf44489b76728a1809021e6e60c1aa07e89a68f1c18ebe8dafb5b5c8c

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt

MD5 a2e1e70b9a3be7c1d3c4e4ddc5bc5e2b
SHA1 a986bba92dd8db7446948784cbf60df3830f8e81
SHA256 e4d20e783a2c49cf9c2de4bedecc852cf62c1787964df26cb95b3d11e182f832
SHA512 14d6bda3643f08dd9181702e7780e17cb790ae6df9134d763a1e9b601a5f95fe3ed313fe7a7a61401a3c8f73df1375351f8aa39f90216393fdc216760e24eeb1

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.RSA

MD5 81bb3ce17535eeced239d1c5f5c4d9b3
SHA1 56d3d5a8aeab0b09f0904253fd8c8fb84c206cf2
SHA256 45b0d442a6552fb22f82f0602d730484d04cc0d39b6ea894f5df07affda25cd0
SHA512 d7629094bad014f596f1061e4319496f80af266ff6f8cfcb7421cd6b20c61538dd3ce13b558785647911e7cb95cb222ea86f3166b408af68dfdeaf376d191f3e

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\ECLIPSE_.RSA

MD5 a3542771bc8fa76d266bd0f3b93331c2
SHA1 9361f554d67e561a9ba47be8706c112bc811ccdd
SHA256 72cc8fb9901399ac3ca862d6ee53dcff405a11014fba37561f10044f33317bf6
SHA512 1ecc23e1c03a61e9326c6ee0d9905a1121066ba3ca37a01561f4a765ac646df83dc7f14eac413efb497861a38c0e9a877a7a0961d2a62cc6ea420ac7bf023bc4

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\META-INF\MANIFEST.MF

MD5 75f560b27f168752475501b707f60435
SHA1 625447e41919dfe0b892a1368a1f10085aed0c3b
SHA256 3ab7f4409d2744030cabde8f2d3371b0d9f8ad1bc8ccb7ec3ef7a8024b361526
SHA512 57779e66cbf93ded2a9eb486e3de78355d47723a34ce65f2204a88451430f2add1234f0236fac36c0fc980198abce373f8a7cc91285617445fcac81cd8723d67

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-api-visual.xml_hidden

MD5 67e4269cb1c02a3913804d243e5925b4
SHA1 2cbd780b61eab4d7001f18ec8769116e825de82b
SHA256 532953ebaf82feac83c4bda0ffafd1d4f29c99600fd18d53b24f6e4527b66906
SHA512 d4edbd54a004e59cd53cbc1f51291600c2248eb97ab8ef5760c6feb293b60d0943c079332a73503658fbe6579b7c01f2f6a93904db6e8105a3f3760bb6208863

C:\Program Files\Java\jre7\lib\images\cursors\win32_LinkNoDrop32x32.gif

MD5 36b3916c7143f05e8a2e50026a0a55de
SHA1 1f58ab8432bc7543903656902991022289a77602
SHA256 1e9e40870fc29a1b1d438eb48f4414d377c95edd04ce6d4418df20f755b8d938
SHA512 6d7c49b811e8d365529bef04fc31cd62a0c05137589453ceac00183d0959ae1594b27e0a523577551e4d005d4aaaa57c805992aa1f88de386e14b4720680cf97

C:\Program Files\Java\jre7\lib\zi\Etc\UTC

MD5 27882f3f4803ff6585991e5a26769764
SHA1 9c4cc9526d155a2ee9786cfc6e4b674dc4b9dfe1
SHA256 c1dbd4f7412efcce6c3cff12158c3162572acb4bd438ac16a9e3bea8b6d3214f
SHA512 381b3745ca9714fdbe68291b8a545eed6299b8a83f22e818f3d4f17d8fca8caf0c5ac56c55285193b9fcd926668d540c4f4c7b69448b252621e8e0e76abe416a

C:\Program Files\Java\jre7\lib\zi\SystemV\EST5

MD5 9233ab2aaf6a2dd710569560e8f3499d
SHA1 669fbe88c45b1cae1f761752643c598d5d76095f
SHA256 7302bf06455cd3ef74b9d01af0a2ca1558b84184488761cdc2dd07fa62fb2e0c
SHA512 bee4447297333d47b4e9bd0a8f2ad848c898aa687555c8a6c0a0e467c45455e1caaae2335885b131ae0d5c9795281f53d92aa7aae9a3241a0e52075eaae9a059

C:\Program Files\Java\jre7\lib\zi\SystemV\HST10

MD5 d9bee920135c9efdf27f3fd85797d935
SHA1 6b6ea08ae1fa5fae1c06ecef9d053006d69beead
SHA256 719bcadd1604af0a56fae1ee995c56832cc19608165fdd4ee790e1ef36ca5b6b
SHA512 2f471b0e074cfaa422872c5b0bb49915b7e685573e6d23e94db67e23c67f5b59095c787a84b24c01e4b46b806d313d78c73082d03ccbbbde831f93e64db0969e

C:\Program Files\Java\jre7\lib\zi\SystemV\MST7

MD5 eeae65a0fd3bef4c190654ca451dab50
SHA1 5ebda0c2212f6baaf422c6707be399405b037ceb
SHA256 ad326dffd7df5df12d856afb3e9f78cbb853d2af6a0d9f804ee34f96f4c93bb2
SHA512 e075c0bfad3507048dca70ed8f5875eb29a29bc3c8d4eac61592ced149c9a5cdbcaa09d9f87f6a660105c6ee02d78cdf4eb71d362f283660cc6bc0fed82c6c14

C:\Program Files\VideoLAN\VLC\locale\fr\LC_MESSAGES\vlc.mo

MD5 7bd8a11b221408de67239b93dc6bb517
SHA1 c6c1d9ca061724e743e4ff62b9ab2ba9f34a4b78
SHA256 cff19543f1de22fec34462e446639c60eef46ac7cc8471dbcc4963b9555ce6ec
SHA512 028344e4332c8b7c2160b1939e1c7f6df6344dddbeccb6104f438f74262276ccdbd94407beee7397f229faad7dc2f11d26e2a0ecccd158498435ea8f5ccbac36

C:\Program Files\VideoLAN\VLC\locale\mai\LC_MESSAGES\vlc.mo

MD5 5978f28dd8382f78b3507cd11ece69e8
SHA1 76773da2bb9fdc3a31d5bd5ae25567e0304e52c9
SHA256 8c7bc3e8db3536a4b1b9331d70f5896dfbc08f5cf57db0bba17a8dd4f66a3922
SHA512 a35abee431b41a1a237bd8fab4e5ef368f311c237bb66a5e00292e5c4d531dc2119fec60799827c4c4698a57460e624938121142e3e686dc8be0be3b6535f1cd

C:\Program Files\VideoLAN\VLC\locale\tr\LC_MESSAGES\vlc.mo

MD5 4048f90c68d8b5b84f93f2e5acee4752
SHA1 f7d0347d8169beac395a0ccf554277e3520e9d07
SHA256 6c2ec31a76aece006155605917e59571fa29050bc2cb6dc4f604aeb8e0daa2ce
SHA512 9021fa3fe3242ee410224ed03857a5f4d59640722e2268f5719f4cad0aa22460aed1c1a7e684d9401de73c80d0f027f939d47bd888ec1b0c72192e7b7d0d4607

C:\Program Files (x86)\Microsoft Office\Office14\1033\GRAPH_F_COL.HXK

MD5 f897b0341ec8265e3fb131e14b69add4
SHA1 e42d73276077abe0363115dda558fd504c32a3ee
SHA256 27c258a240d65100ca79cff8ab90de346198b9fe26c5daa4bf2f0a2a1b35c8c7
SHA512 085f040a32923e5ffe724f11e6cfe1f5c8eef76f1e7793cc50b59afe4fb603c906a53670cf6a6737a7d74afdd2caebe2d2f7d3450064dbf2aaf01bef13bfb25b

C:\Program Files (x86)\Microsoft Office\Office14\1033\GRAPH_K_COL.HXK

MD5 c9e37623ca75d7b4bc7e18b0ad47a909
SHA1 55129112076c5a9e5b290d45d82fb229f9019a0f
SHA256 fbe06004f91180c1885a934a1841160abb0a60f6b41130965f3af4c55261e686
SHA512 9bf2cbb89b5013891b90edecfc59deedd6b6356c78f4b43792e5005b6a07e674bfb283af40820102162504cbc37af9613a8a8d35d18f327a039e0bfe2904642a

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_OFF.GIF

MD5 a17b573bc31128b9c8f80299e19693b9
SHA1 0c515d38071535b13639c38501310c9ca6bb52cc
SHA256 ec8f5f11641a23a6994e7b58c9e1468200189ef5f353a9e8ce3020cbb4e241f8
SHA512 e89920fd3e0b98d92f53badb52c1750eb4fd882369bce7508666dfe17ecb7a029c558e4eafbd6530510971d2d1331d83ab8549d3922945944fd2272042f3bb54

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_ON.GIF

MD5 96184a479124e9d63a58b2324b60e010
SHA1 25a0a454f5f44c458b7054c7a7fd68fc0f381271
SHA256 bf51157f918c0ffee7d504a3c0ec29e7b510790631e97856447f8b456a3adb7f
SHA512 79340a8aebe2dcebf2912f7975c8cddb76f41e132059a0c25aceb56925de6f5ac3e22a7c2be2d68db6882d44d1bba59354b6dc150535d701ceca94d1d75076d4

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Swirl\TAB_ON.GIF

MD5 22b63a53764601821e4bbff84beb9eed
SHA1 2d65da48d87391ad3188e2e4e5e80090801b8e2e
SHA256 652e5473e58fcf0321451497a3ba2a4ce0a14299f63d380d9afe478b72a1e275
SHA512 6d83097aecddc8096da603e488116c8c1caa3661654e7e8725a98a1b5ffd6658b84a0b671ad1efbb308e347ecf2163638a0ff18debdb1ac52ac62a0c6bbcc121

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Swirl\TAB_OFF.GIF

MD5 c03d18c09cf215fcc6c052279af7dbdb
SHA1 919275d91831d921c8d35f807d27ab3bf25daa71
SHA256 d76c220692c31a6005c42153e662d7da016b622f94e9810a465b02fd3b7d8e0d
SHA512 88f2ba82ee2133eb4f4b628202d06712f1ab188ea12b946630deda59307937788cc617ab1b1e30e8d06cbadc8e7c9ff5db35ae9fd9e73b2d8b6ac82aa5fe3367

C:\Program Files (x86)\Microsoft Office\Office14\1033\MSACCESS.DEV_K_COL.HXK

MD5 f412079c7e547ac5be1afa52f684e2d0
SHA1 dc46cdcb7eb7a7ddab6a1d129832b24e53f81a78
SHA256 7d313b26b8bdc2eb1996874e1aaaa5d51c25ffe88d258b680f72e5f4bf8d8eb7
SHA512 ffff362018007db1e55e864c060f9d042279e66f00a12142976631de1257488c4582636a8c191f5421983dbaa2a86233adfb571815d36bed537537958a4f7a67

C:\Program Files (x86)\Microsoft Office\Office14\1033\MSACCESS.DEV_F_COL.HXK

MD5 8449295242ec51a4ca780a7d07660b97
SHA1 7c4999b4cdc3682d8434d7ff522bc16ff7993de3
SHA256 b136257b0acf400c5b991b9367f67769bb91a7e05cfed5252f57d6b8f20d5586
SHA512 a10b1be881703f23758b0e0e2f11c5773561492d1f930fc82064c5516711336b0f782890f5320cfa020977781cad0c06cfc0a0b0cf7d9bc33bfcf4fc6a432cb1

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BrightOrange\tab_off.gif

MD5 c9e04be0daea918dbffffc8274ed9015
SHA1 36afd28e86b7dc0e458aa50a5a79edcc97166ff7
SHA256 fbd7bd22cdd828e5b3f6d6b9659e13cd6e0170c5be7e65a5bcc8e1823c6ce407
SHA512 ccbe16408c2fc92b9ce739c6e4b9e1736a70733555ddc64d3ae6bab694f4ab9f4dfd3550930e0a48ce86a3a9663e26f47d61b75940abae4876d12a5a5f1a77f4

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BabyBlue\TAB_ON.GIF

MD5 a9b0076c0f813ec35b487a9ad16e71f6
SHA1 790777bd0c9c402663f48a340c8287970f2244ef
SHA256 a524ff527cc53eb7a96683831c01a1cc73f2a7d22ef9e199da0ec380dae590db
SHA512 881e46adc22cd336e514e2165f4ee1ec46698538a31848208a77e345e3218f45e173bb587b684b83978f0778a3945289074418a9bd51f4552f1eb41429d22d22

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\attention.gif

MD5 bad82d1a14de90e7a59d0a6bda88b5e2
SHA1 3fb7611123fe9c2ee365718e20a718f0d109bb18
SHA256 6e7b67aadee79022808288e5f318dbee645a5a51ae414a754f98e6000a97b32a
SHA512 9235189681c2f6e2496d587e1c2412403c92f252f8a1218be89bc368beb7aac91ee3a9460f27e631fd6fe5010ec10fef8b1ee2af421475f42a5b0278e4495c68

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\BG_ADOBE.GIF

MD5 d09f5f9b2f914a6621339326615625c7
SHA1 43dae61717889ebffdd6e2805f46c429b4db2674
SHA256 dafe3f5cdee481109b4a2ac521192703975f0ccb40c99526696002d2abb4e809
SHA512 4b3e61fd418721e19a786506162a859b0dc35ffdc46f9105f76a6ad0833eabf729bf7fc8d466fb7d52413b64e8350ef364d45c442908d515680a755a23d5eeb8

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrow.jpg

MD5 9dd073e8fdefb839568a0e9fa7a9f47a
SHA1 d10adecd9122a5f893d06b09023fe27586d92c9a
SHA256 78b1797da2f904279d80ea8f480af4f64bbc2837c40aa68cfd0f08aca4c1a682
SHA512 1e4a3ecd085ef9fc7e1ad5c8f67ead0f43597d991f40fb8e1f483a0973fdeb1a2b4e54adce99182734fc52bf8142e94ea3de6ea90c1e28aa42ba9ea68bd5e13e

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_Casual.gif

MD5 4c882ee09dc6e7bebdf072c19a3261d7
SHA1 7e69cbd0175b294f9e96deeeac92c79e075a94fb
SHA256 d0d6b777c3dcef5abea90f4422660e0972def7e89f7a81c5159c23d633be95d9
SHA512 864368adb8b63cd1185594158d87ebf4c29b8296fcbd1c4c24f8b50ccb9a3a3ecb3eca3f1814a593468e2eadb285944c02130dc98fb4a743e1353d15c650a75a

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_Country.gif

MD5 5ac75db8074a7bf81f1335e448425f18
SHA1 db827139998477602bcdfee4f242cd13d40d3833
SHA256 22eed99e4f3b9886daaea0ed1df3d9b5cf80eea794da94e77de638473b7373a3
SHA512 49da47de9bcacc94325f880214a9f728707b489797f56518ae13ad5edcbfb5b9cbac34e0d60fa817efda5f7a04eca0f381f8d1eeb5715ed42ccb39d8a8dcd9ac

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_Earthy.gif

MD5 93df8f055f347bdfc606819eb0d4aa78
SHA1 3fa4417ad5442579c8389673ed797664e198ef64
SHA256 7c41b1ca48dec8395d558586f429a72278b22ea32869672ffa8d294cc7ac3a1e
SHA512 edcce68e39fdb0aa4ed59ca1863df030223f8711e54d28d823bf921be4710f641204532b9c381b582fdb28995085c8dbd4f10303ed7a05a2c2f867509917020b

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_GreenTea.gif

MD5 4430af420471900f9b49dc7b254b34bc
SHA1 5424ffda25e864d9b0a3b72144d2f35ab7e03d8b
SHA256 23d8db321ac3bdcce18344e3cae4f7adb4e05452a6c1ccd1e05576064413eaa2
SHA512 9c8aa2758502ee91148b1084701821fcfaba6d4e25386a94ee3a4ea931a9e3e537ff67881b6a304d83a51f7dd19e337225b9cb44bf3c1a75c434058fabfc86a0

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_Groove.gif

MD5 ce75c93021068d0f2cbb7dccfc27122c
SHA1 3f788cd26653dc9f9d0063fbcaddc862d22f8a95
SHA256 c624d765e225f6063c467ca102b81d91e3d1e0ca2b90d35f3fb0fddb65f2cc51
SHA512 e959a3a79bfa17f99411d1dd48934963f3ab26ff8c91a4ce0b308769808466dfe7a88a9820c75c9aaf14347a09c8969ab71f3fc39fc309a2e064f06af9e2d577

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_FormsHomePageBlank.gif

MD5 e940a6cb427fee332ce12d6a8caf3e67
SHA1 26c0200d6e937fd542fda5379da4c58750421d9b
SHA256 9594318fb916d7b3a14619a38b35961d51ac1c9fbb84d93fc4ace4cb4bc795be
SHA512 2ee0762be1a5db223cef573417eabe5c5a727931d646d2d549b846f7629b46d6fc5222295b5e985e0466d7feee9c7e74431a2506f7f0a73bc725d519257d945b

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_OliveGreen.gif

MD5 7aeb07694ee0e9f0b62d6688ee54cf42
SHA1 065dc03026c5c46a9736fb013d49229d4e04e027
SHA256 a48c0d5812c4faa853042253083869312d7bbc23f40f1f809a0b2dcf854bd2fb
SHA512 14bc9c5be50a6a0352e46b45f38e2e542c26bf8fa48978acb401f66b2401c2234d1eefa61eae3c3c1540e328845ad3b4832a42cd411265d704d4556f9b3c5757

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_TexturedBlue.gif

MD5 14cae39c3630dcc386fec6bea0655b23
SHA1 265cd9c1ba03748b82351b2b18375ec265d7930c
SHA256 8159ee2da32d1a013bb0a15f86766fea506773a3a2a63a36d1e7508951ad7570
SHA512 12d18ca07d08596928e30d1e32519b4d46d5fa932d7104d73f57ae79860f607a7868ed4cdf4f509460045a97d37e830209c4d3b4a0426fd8a241bbf5d70d3f1f

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_Premium.gif

MD5 3aebc69d76a729f939271d936e7380be
SHA1 296cc6d194c8e03e8a0eeb28cddb133a2c32d66b
SHA256 284f7322e76063a7725ad72462cae337185a6cbda0033be36e236d562b7ee102
SHA512 01986f89e151913f7c4f2bff383c3a21041b1a2b0cd1fe9281d349f103490ad554332597cc3ef3919f2a8189cf2c0ccd2bc56e0d02557a686cf5d53242848a94

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_VelvetRose.gif

MD5 adf4a65858f6a79029e0236314012568
SHA1 5c3ce40e3c8ebb0cec3a1a83f277ca924bca80e4
SHA256 f7d2599201cb382890a9bcde82af3d722a7f4f959158759163d0f73bef385bfe
SHA512 b7f91d295139f5261a9deb2a5e787bc100191d75415bb000b930bb3acc8365ea23357ecf37f3bb11df782360f6ad24336f36ec27bb52b09adb2e8c740bf25d90

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_LightSpirit.gif

MD5 c6f1651296708dd472176dbd1a24e389
SHA1 c71b94e2c744df5bb95a48546a915a83ed5a5dda
SHA256 14b5f67681a4979b82d6fc351a15072ca7eae2bd1fd1766fa9cc49c5c4ed78fb
SHA512 91ae16f2ee63063daf92a4081ac14bc4b7a9a9ed9501f953a494cbec005600839223998b6947777efebbd32715b8cb00704aa893ced2bd474d8618fe0aef9166

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_SlateBlue.gif

MD5 7d6a7216dc0185e34df6bee9b694bcf9
SHA1 c55b4ff1a76d6b52f8aea4f0ae4df553d0a88df4
SHA256 8284e73d1dd3e022ff9343c657f13b7783daf02373598c85fd8fd96ddd6bd0f8
SHA512 4148188ddc95e99323d6a51df9be9afc9420589c97af4d877d5baa3aa6f0d4dd00d5648c99a28b9ed1e16881351ac74b50e37fb47f9172ea8e8999f583452d61

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FORM.ICO

MD5 aa64565e9338422a47238b943a61c833
SHA1 0b1179f9e7c79d86c288769dca34f2497fd37274
SHA256 76e8ec88771b7da63abf8cd372357e4eb3c96af5ac05eb76609820f51ed3e561
SHA512 9af27f61e355b7b19f00083f691aa7a73b81bb6ad013043eb04c2025152cc4d4def5dfdb06e680f1bd6867be125991ededff94e28a14a25452541c290f10325a

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightOrange\TAB_OFF.GIF

MD5 566da7fee15df1426cd9f951476521d2
SHA1 0e426d96e80fa9b0dbecd4a794bbbba1c8fc3a48
SHA256 148057cac6fa642f4b8a21a7ea7d02f69545699dcf5959a946c3fb336a509592
SHA512 711dd72fd7f36c0ff1ef9491025f9427ac053250200eb4e44b3eec8b51962c2b19fef62f1cae1a65e116a8ca2f56b1f0fedb513c853a2db7b6a28e3b908e4709

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Biscay\TAB_ON.GIF

MD5 f017d424563f77a3f3bad84a2b65b022
SHA1 99763fce6b9e04d1462b1fb6c7b993c811bdf0c5
SHA256 8d85cdf6dd08bc0a444b7bcce60490e802f1639f8712855ce13470b0e1bce613
SHA512 43ceaa37132c43d03b45591b290bbbec2d8429194af639be6654c37220b985dd3c3260862ccb5eb6e0c1d38f6b7d68dac080792633b9dc4da1a95011d4fe813a

C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\InfoPathOMV12\Microsoft.Office.InfoPath.xml

MD5 a1c01bd629bd095513011b6dc97ecbe2
SHA1 c59172022d3a62392afba5b75ca04edbb13ecaf7
SHA256 3af3ea744150d3ccf5e595ba2943cdb6a98a10a5f419bde854dc2b044881bd58
SHA512 d634148f156057645fe10c0ef5e59f9485f29a1391e0d7ed5931f8268fab97864d75cd1f2d3d61f8881deb6626820558c3a84d5cc8f924c814401a4d76bf43f4

C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\TALK21.COM.XML

MD5 650bf8ceab56eea475801ca409942254
SHA1 4e9ebba59d06299dd119743ee28337225a5e1f4f
SHA256 a4bdd0d776c71395f5ea3692c409941256183e559617bcfd46f9dde34511cca5
SHA512 4d4a09f2d001b5b2f716766c32c7e10d3d02976baea5de1de04e87c94740fc3e56c43d8549dfe40e9c73eb5532a8538e565c2cfabf383a27f9dcbbdae9c3c511

C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.COM.XML

MD5 5d581b95b446baa6229db2e61e1c23ce
SHA1 ce924fa605c0da0c2c486e8bd7071109620354db
SHA256 a73a08551b3f35d2fdef20a04df35c729647f839e4accd01edf1cf9959db071c
SHA512 bcf747eea18f28df1edf0328934daf4b908059e5f2709f720a8c377b2d345ae9a90b778648177cabf824ddac8066706638c2daf9135c53e0f731c373596d7bcd

C:\ProgramData\Microsoft\Assistance\Client\1.0\fr-FR\Help_MValidator.Lck

MD5 e22f2a85184e6c843e2b7117dded66f7
SHA1 0890f41fb10a23761dbf92adb62c51c68922a00c
SHA256 15005b099e7d47a997cabcc8a6a7f62431dfe301cfd594681e2a2127ad89f5c2
SHA512 d538fb016bc0e1149ce71f70466627fd8d79fdf3b359c1adaa994c733b7247043411ff9ffff77af5606d46add2b4d4d53da0ab7e36e33c524486713963898c82

C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\CiAB0002.001

MD5 db52d1b2d9089ed367cbfed40e6ad247
SHA1 dc45a234d7a0e7d489b60b03fec6366c00039f39
SHA256 384484d380246a8021b050874b4d4910de7153336f2b3f49c1eef476c5f2b9c4
SHA512 50619f23368d5ca86f498ab674c30fc24c3dbb032818f842561af70605b242fe652b7f7eb2941b68fd2d23fcf383d5e560fcc5e16d748f4c8a4146672b5253e7

C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\CiAD0001.000

MD5 3529b4f3af5c794021f1707206bcd9fa
SHA1 ef8eb739670c74b172a86b941ecaa5884619caa8
SHA256 8524144b83fe2b5e915a8ad786edfe2bc86943719b6433ba6b695005714cba6f
SHA512 c6f5392f32084c21098c3b4c9bd13eb7edfe5ddf3fff58d7736550e33c7a86f9783dcf373d445377e75a218be0694aa399a73e3f6ca589d68ce576ff2f68a505

C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\packages\vcRuntimeAdditional_amd64\vc_runtimeAdditional_x64.msi

MD5 8570c9d5a1a7e714af449cd8d52eaa1f
SHA1 02e071cd15f7a0a8ed2a47aeb334a762f11e00d1
SHA256 017d5fb1e0a8860b0534ff235f9d2f96ab2fb6198ab5219e8299e8aaf8191e60
SHA512 4af6e058bdccd29754faf766f211c773f2fd8e1df817b1177986efa747758712871fbb332f9488b3e490ac233c7e8fac0096715f59b64696e9f738a9a276846e

Analysis: behavioral2

Detonation Overview

Submitted

2024-02-27 17:57

Reported

2024-02-27 18:00

Platform

win10v2004-20240226-en

Max time kernel

150s

Max time network

152s

Command Line

C:\Windows\Explorer.EXE

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess

Description Indicator Process Target
PID 3024 created 3296 N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe C:\Windows\Explorer.EXE

Deletes shadow copies

ransomware

Modifies boot configuration data using bcdedit

ransomware evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A

Renames multiple (6546) files with added filename extension

ransomware

Deletes System State backups

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\wbadmin.exe N/A

Deletes system backups

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\wbadmin.exe N/A

Modifies Installed Components in the registry

persistence
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Software\Microsoft\Active Setup\Installed Components C:\Windows\explorer.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BabyLockerKZ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe\"" C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BabyLockerKZ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe\"" C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened (read-only) \??\F: C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened (read-only) \??\A: C:\Windows\SysWOW64\cipher.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened (read-only) \??\F: C:\Windows\SysWOW64\cipher.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\7-Zip\Lang\sk.txt C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_2019.19071.12548.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\PhotosMedTile.contrast-black_scale-125.png C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Assets\Images\SkypeAppList.targetsize-24_altform-unplated_contrast-white.png C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarAppList.targetsize-64_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\hu-hu\ui-strings.js C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\no_get.svg C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\ClientARMRefer2019_eula.txt C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened for modification C:\Program Files\Windows Media Player\ja-JP\wmpnscfg.exe.mui C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\Images\Ratings\Yelp9.scale-125.png C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GetStartedLargeTile.scale-200_contrast-black.png C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\af-ZA\View3d\3DViewerProductDescription-universal.xml C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Voices\en-GB\en-GB_female_TTS\common.lua C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\da-dk\ui-strings.js C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\CompleteCheckmark.png C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogoSmall.contrast-black_scale-100.png C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\Square44x44\PaintAppList.targetsize-32_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\en-gb\locimages\offsymb.ttf C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-white_targetsize-24.png C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-48_altform-unplated_devicefamily-colorfulunplated.png C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\ms\How_to_back_files.html C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProVL_MAK-ppd.xrm-ms C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_2019.807.41.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\AppxBundleManifest.xml C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\OutlookMailWideTile.scale-100.png C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\ar-ae\How_to_back_files.html C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\contrast-black\MicrosoftLogo.scale-200.png C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\co\LC_MESSAGES\How_to_back_files.html C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Trial-pl.xrm-ms C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Work\contrast-black\MedTile.scale-200.png C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Work\contrast-black\WideTile.scale-200.png C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\GenericMailWideTile.scale-125.png C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\ru-ru\How_to_back_files.html C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-72_altform-lightunplated.png C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\dark\sat_logo.png C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File created C:\Program Files\Internet Explorer\en-US\How_to_back_files.html C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\images\Folder-48.png C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00.UWPDesktop_14.0.27629.0_x64__8wekyb3d8bbwe\AppxManifest.xml C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarBadge.scale-400.png C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_2019.1111.2029.0_neutral_~_8wekyb3d8bbwe\AppxBlockMap.xml C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\sk-sk\ui-strings.js C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\How_to_back_files.html C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageAppList.targetsize-24_altform-unplated_contrast-white.png C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\reviews_joined.gif C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\images\digsig_icons_2x.png C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\ScreenSketchSquare150x150Logo.scale-100_contrast-white.png C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\LargeTile.scale-100_contrast-black.png C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\RTL\contrast-white\MedTile.scale-100.png C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\de-de\How_to_back_files.html C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\it-IT\mshwLatin.dll.mui C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-125_8wekyb3d8bbwe\microsoft.system.package.metadata\How_to_back_files.html C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\Wide310x150Logo.scale-125.png C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\fonts\symbol.ttf C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PeopleAppList.targetsize-32_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Outlook.scale-400.png C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\root\ui-strings.js C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsSoundRecorder_10.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\How_to_back_files.html C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.UI.Xaml.2.0_2.1810.18004.0_x64__8wekyb3d8bbwe\AppxMetadata\CodeIntegrity.cat C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\How_to_back_files.html C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened for modification C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\MSFT_PackageManagement.schema.mof C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\zh-TW\tipresx.dll.mui C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_FA000000006\FA000000006 C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-72_altform-unplated_contrast-black.png C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-GoogleCloudCache.scale-150.png C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\dc-annotations\js\plugin.js C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\fr-ma\How_to_back_files.html C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.2.etl C:\Windows\system32\wbadmin.exe N/A
File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.1.etl C:\Windows\system32\wbadmin.exe N/A
File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.3.etl C:\Windows\system32\wbadmin.exe N/A

Enumerates physical storage devices

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\vssadmin.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-557049126-2506969350-2798870634-1000\{3D198223-0E3C-4FB3-9F06-27F86096FB7F} C:\Windows\explorer.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Windows\explorer.exe N/A

Runs net.exe

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3024 wrote to memory of 1020 N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe C:\Windows\SysWOW64\cmd.exe
PID 3024 wrote to memory of 1020 N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe C:\Windows\SysWOW64\cmd.exe
PID 3024 wrote to memory of 1020 N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe C:\Windows\SysWOW64\cmd.exe
PID 1020 wrote to memory of 2084 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 1020 wrote to memory of 2084 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 3024 wrote to memory of 3360 N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe C:\Windows\SysWOW64\cmd.exe
PID 3024 wrote to memory of 3360 N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe C:\Windows\SysWOW64\cmd.exe
PID 3024 wrote to memory of 3360 N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe C:\Windows\SysWOW64\cmd.exe
PID 3360 wrote to memory of 3412 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 3360 wrote to memory of 3412 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 3412 wrote to memory of 1012 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 3412 wrote to memory of 1012 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 3024 wrote to memory of 4356 N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe C:\Windows\SysWOW64\cmd.exe
PID 3024 wrote to memory of 4356 N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe C:\Windows\SysWOW64\cmd.exe
PID 3024 wrote to memory of 4356 N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe C:\Windows\SysWOW64\cmd.exe
PID 4356 wrote to memory of 3436 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 4356 wrote to memory of 3436 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 3436 wrote to memory of 1996 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 3436 wrote to memory of 1996 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 3024 wrote to memory of 3980 N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe C:\Windows\SysWOW64\cmd.exe
PID 3024 wrote to memory of 3980 N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe C:\Windows\SysWOW64\cmd.exe
PID 3024 wrote to memory of 3980 N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe C:\Windows\SysWOW64\cmd.exe
PID 3980 wrote to memory of 4884 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 3980 wrote to memory of 4884 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 4884 wrote to memory of 1480 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 4884 wrote to memory of 1480 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 3024 wrote to memory of 1324 N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe C:\Windows\SysWOW64\cmd.exe
PID 3024 wrote to memory of 1324 N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe C:\Windows\SysWOW64\cmd.exe
PID 3024 wrote to memory of 1324 N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe C:\Windows\SysWOW64\cmd.exe
PID 1324 wrote to memory of 4512 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 1324 wrote to memory of 4512 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 4512 wrote to memory of 1992 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 4512 wrote to memory of 1992 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 3024 wrote to memory of 2000 N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe C:\Windows\SysWOW64\cmd.exe
PID 3024 wrote to memory of 2000 N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe C:\Windows\SysWOW64\cmd.exe
PID 3024 wrote to memory of 2000 N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe C:\Windows\SysWOW64\cmd.exe
PID 2000 wrote to memory of 4988 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2000 wrote to memory of 4988 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 4988 wrote to memory of 4000 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 4988 wrote to memory of 4000 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 3024 wrote to memory of 2992 N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe C:\Windows\SysWOW64\cmd.exe
PID 3024 wrote to memory of 2992 N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe C:\Windows\SysWOW64\cmd.exe
PID 3024 wrote to memory of 2992 N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe C:\Windows\SysWOW64\cmd.exe
PID 2992 wrote to memory of 4052 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2992 wrote to memory of 4052 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 4052 wrote to memory of 1648 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 4052 wrote to memory of 1648 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 3024 wrote to memory of 1364 N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe C:\Windows\SysWOW64\cmd.exe
PID 3024 wrote to memory of 1364 N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe C:\Windows\SysWOW64\cmd.exe
PID 3024 wrote to memory of 1364 N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe C:\Windows\SysWOW64\cmd.exe
PID 1364 wrote to memory of 1988 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 1364 wrote to memory of 1988 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 1988 wrote to memory of 4640 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 1988 wrote to memory of 4640 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 3024 wrote to memory of 4200 N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe C:\Windows\SysWOW64\cmd.exe
PID 3024 wrote to memory of 4200 N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe C:\Windows\SysWOW64\cmd.exe
PID 3024 wrote to memory of 4200 N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe C:\Windows\SysWOW64\cmd.exe
PID 4200 wrote to memory of 3480 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 4200 wrote to memory of 3480 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 3480 wrote to memory of 716 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 3480 wrote to memory of 716 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 3024 wrote to memory of 932 N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe C:\Windows\SysWOW64\cmd.exe
PID 3024 wrote to memory of 932 N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe C:\Windows\SysWOW64\cmd.exe
PID 3024 wrote to memory of 932 N/A C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe C:\Windows\SysWOW64\cmd.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe N/A

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe

"C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe"

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c rem Kill "SQL"

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c rem Kill "SQL"

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlbrowser.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im sqlbrowser.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im sqlbrowser.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sql writer.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im sql writer.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im sql writer.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlserv.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im sqlserv.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im sqlserv.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im msmdsrv.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im msmdsrv.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im msmdsrv.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im MsDtsSrvr.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im MsDtsSrvr.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im MsDtsSrvr.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlceip.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im sqlceip.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im sqlceip.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im fdlauncher.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im fdlauncher.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im fdlauncher.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im Ssms.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im Ssms.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im Ssms.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im SQLAGENT.EXE

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im SQLAGENT.EXE

C:\Windows\system32\taskkill.exe

taskkill -f -im SQLAGENT.EXE

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im fdhost.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im fdhost.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im fdhost.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im ReportingServicesService.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im ReportingServicesService.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im ReportingServicesService.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im msftesql.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im msftesql.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im msftesql.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im pg_ctl.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im pg_ctl.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im pg_ctl.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -impostgres.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -impostgres.exe

C:\Windows\system32\taskkill.exe

taskkill -f -impostgres.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop MSSQLServerADHelper100

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop MSSQLServerADHelper100

C:\Windows\system32\net.exe

net stop MSSQLServerADHelper100

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop MSSQLServerADHelper100

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop MSSQL$ISARS

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop MSSQL$ISARS

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop MSSQL$ISARS

C:\Windows\system32\net.exe

net stop MSSQL$ISARS

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop MSSQL$MSFW

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop MSSQL$MSFW

C:\Windows\system32\net.exe

net stop MSSQL$MSFW

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop MSSQL$MSFW

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLAgent$ISARS

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop SQLAgent$ISARS

C:\Windows\system32\net.exe

net stop SQLAgent$ISARS

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop SQLAgent$ISARS

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLAgent$MSFW

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop SQLAgent$MSFW

C:\Windows\system32\net.exe

net stop SQLAgent$MSFW

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop SQLAgent$MSFW

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLBrowser

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop SQLBrowser

C:\Windows\system32\net.exe

net stop SQLBrowser

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop SQLBrowser

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop REportServer$ISARS

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop REportServer$ISARS

C:\Windows\system32\net.exe

net stop REportServer$ISARS

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop REportServer$ISARS

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLWriter

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop SQLWriter

C:\Windows\system32\net.exe

net stop SQLWriter

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop SQLWriter

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c vssadmin.exe Delete Shadows /All /Quiet

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wbadmin delete backup -keepVersion:0 -quiet

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTABACKUP -deleteOldest

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c bcdedit.exe /set {default} recoverynabled No

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wmic.exe SHADOWCOPY /nointeractive

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTATEBACKUP

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c vssadmin.exe Delete Shadows /All /Quiet

C:\Windows\system32\vssadmin.exe

vssadmin.exe Delete Shadows /All /Quiet

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c bcdedit.exe /set {default} recoverynabled No

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c wbadmin delete backup -keepVersion:0 -quiet

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTATEBACKUP

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTABACKUP -deleteOldest

C:\Windows\system32\bcdedit.exe

bcdedit.exe /set {default} recoverynabled No

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c wmic.exe SHADOWCOPY /nointeractive

C:\Windows\system32\bcdedit.exe

bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\wbadmin.exe

wbadmin delete backup -keepVersion:0 -quiet

C:\Windows\system32\wbadmin.exe

wbadmin DELETE SYSTEMSTATEBACKUP

C:\Windows\system32\wbadmin.exe

wbadmin DELETE SYSTEMSTABACKUP -deleteOldest

C:\Windows\System32\Wbem\WMIC.exe

wmic.exe SHADOWCOPY /nointeractive

C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe

\\?\C:\Users\Admin\AppData\Local\Temp\cbb697f31d96253054120b5dfa8af4460f2f2a474a94f54835d2b3a39ea69f30.exe -network

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c pause

C:\Windows\explorer.exe

explorer.exe

C:\Windows\SysWOW64\cipher.exe

cipher /w:\\?\F:

C:\Windows\SysWOW64\cipher.exe

cipher /w:\\?\C:

C:\Windows\SysWOW64\cipher.exe

cipher /w:\\?\A:

Network

Country Destination Domain Proto
US 8.8.8.8:53 138.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 209.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 172.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 105.193.132.51.in-addr.arpa udp

Files

\Device\HarddiskVolume1\Boot\bg-BG\How_to_back_files.html

MD5 688c6116365c83583c83e3ab676fc1c7
SHA1 a9803c44737e09dc9842bdda83ad8ef5e252266a
SHA256 1c7e7510e0699073545139a0aa5f2c85d04aa0d3357fe00ec7245b3bc3152caf
SHA512 40bb7bb7268c1ad6b0429bdf832bea560a7dec43a60aff3828a093006e709deb4a9c114b4432ebd8038c614a16e5d4901707d09022ea8daa41b559babe149acd

C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_CopyNoDrop32x32.gif

MD5 7acf8e1b304eb18c4900cf0ba2522cc2
SHA1 d56f5cae853d4e5ee76b0e2a99994581300ef5e1
SHA256 61d1e2173c4b6339f4a1547ab4749562655e21b476adcf62d905283b0fafe31b
SHA512 e1ba994b97f37c1d9223a5583993ade624b8b762cb74e8c78a6bb4cb142d52e33f3ef6308e9c3a49d99d8ec6c738417420cabf8004985f169c77a02d3b0c95fc

C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md

MD5 43c6b4bd41efbe9aa88f551f4ecaccf8
SHA1 d47f07ab4894f55960d82f21a33d7b837eb26fda
SHA256 14a41c60a686693fdde9b1767b7238804fe5809e822367228b3944d6f4be7373
SHA512 7b66f8b3bc497bc408eb433e8afddc87c1731ecbe00e0de499690bf918c550315ae011396ae911eefcf54d48a1445a0e258bccbaec65db3b5cbce55d06eac9bc

C:\Program Files\Java\jre-1.8\legal\jdk\dom.md

MD5 350fc0c1976daca3e5ba34f5c55a1e75
SHA1 d6e5ec89d40b941f39b175fdf144385bdcc978e0
SHA256 96499d8e8031b30d7c9805f5dda8c14f3123d64a8805a02531058993b65d05ac
SHA512 8bfc4ea042bb9064d06a18395277414a5267ad83e21e47c70b66c1433981d0e05b9f521ac319bad881edd321388bb68c9e77f07455317c3e6d9fb3a5d5d7353f

C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md

MD5 823f093255184157f9c36f3ab8f13b8f
SHA1 ec7d7d4d75551faccc9511b44eaa2f1d462ef45e
SHA256 61f53b384e37f01e5a96d48eb7e4355c3c396d5ab4dff9c536092853a292c603
SHA512 3620813bf8838d0c5a598c0871d179c919da04a3d603ecebb38da08330c24dc8d8f1750025b804f161ed81ccb69c861a4e4486c196daf433530df5ee2795c277

C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md

MD5 2b35b732c2ae2fd919fce64348639c5b
SHA1 e6417a9ddc07e50745b3d9d8b9aaf85130fa902b
SHA256 408a9b8aaafdece9186bfef32d6d29c4e1745f01add1bbaff1f1bf1ef4751953
SHA512 cad60fb75563b892df6cdd3e5687cef96c07a29266ad781b833a8c573a710b42b835966e9efeb38ecbbe06321045010f53af4dc36faf65a1fd09757eea79cc63

C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md

MD5 ff68bf4849fca677b6a7a0926dc7ea28
SHA1 5f0bd59cbd7412b60619d3db2915cac202b981c1
SHA256 edcb4e02a08894c67a2f7679869af63418af06c781885ecc64069bd879f27001
SHA512 6e950ddcf11636c4f7b87356d661a096bf9414a55202a5a051d041501d800fbcf87646cd81ff3376bc399c593396eb80196b96b4dd93ed6059d8f2adad27ede3

C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md

MD5 460f61257e40b1f2ad9a8c867339b097
SHA1 553acab77089bc7003ab4ffedf9ede6a86dd16be
SHA256 b24de942f4a276c9a6014b95dfbc8f3a78aa6fcef693c3fc0809631736f1849b
SHA512 717a56887b30b8f4de095f8ce3aaa75bdc2a64b39a3d5f39e325cf91fbc9948bb5430a3ae9b9a8879da0e3ab61fd3011bbfb6d1709b6c396d84af09c04f439d7

C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md

MD5 60d2ab3d57d9fbd084c6d6729844b54c
SHA1 b1f2ffcaeb4ea13a726424461ef9c6add132d55d
SHA256 511f44554395d0d9a2c1d9b9399039c50965120fc2173cb27862f83bd3f4a2e3
SHA512 68c53cab2febd9b198fc09d2af860b9fd938b420506669ebe869b46d18122b54633f0cff1bf47c68fe025693145d647bd613c5f06977f24d6c64933fe358c0ad

C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md

MD5 d9b6f063ab6087331ab8d66d10d3db72
SHA1 bcd9ca86ca272c86ec1695da0ccc2cee9c258732
SHA256 a0cf26700371801acf0cfeaec1aab10f2f68bc3ee0be50fa758e84d346625073
SHA512 78e6b7b85284b58f07b6b3cf2aa638ce69fdec293db347d2299a96a6c1e1dd98ec54919026cc4853b912a8d0bcc1b12d2f0174439ae6ea4ed00cc5bfed10f487

C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md

MD5 a7c6a0127f95edde7d93386fc150ecf8
SHA1 90c06ead4e773ced9d95438322149ad73cf8c55a
SHA256 0966df042b6bac099d82d123049cf54ddd6f5a832dca37ba018c507b7ceb8fe3
SHA512 00333800c21c62ed7d7a3553bc2b18d82f98b5447d1deb8461a5894803466269f326e7cf26b9f7f05b035595e16c3d68a2ee1f7ddfaeeb8b05cc117fa5e614ac

C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md

MD5 4eee243d531fa44779b52c6d64ab0cfa
SHA1 42aec3a541b1d7fbe2f2b64a6176d92f6ac0f696
SHA256 cbc36c691b74aa4dabd36e20035ad184ba6f3816c67691de7d688376cdd9f7b3
SHA512 5856c768dc63092052247f194cb94df21dfb2bc955031a5c5be744782d9ca0cf7b825308b77cc6304e734bca3afdda559bb584e112a43ef4a73bdc20879dd53f

C:\Program Files\Java\jre-1.8\legal\jdk\joni.md

MD5 4a1402b986dfbaea1046ada11e9820e6
SHA1 6461a87e20564b013e9b6ffc38d936592f902f7b
SHA256 ef1d71f22aeee20a7614f01df6e800dc2ab08c2f877b18ee4960f34dbf4dd095
SHA512 0302b5acd771bbf6894c99f4618acb11629d8bdaa87867d8e2ce1780494f1691ea7e0724ef0dc3790bb6e94de72a00d0c6d7ed55bef6688e879d30ca7308077c

C:\Program Files\Java\jre-1.8\legal\jdk\icu.md

MD5 30a47aaf445c5b294ea21dee859bdf1a
SHA1 476b28fa0d41a8831c1445c93c997c59b3871710
SHA256 a9f25c561133c2dfdf27d2b46801ea9600810cfa2a16c7e15cf55fea41a1d261
SHA512 55d1da49f462ee7bc9f16dfe38aebfa7a2929cb4049d780ec90555b8c4c49b159e1da99c15011d7094500c6ee4f9d05f31bb4d5708403a9de38a69178a70b3aa

C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md

MD5 966d3cc815b186d8d57978ce63bcdace
SHA1 a0d1fae39dba78e2db91631f2968eba271bb048a
SHA256 80b5fe81b8b0fa98b658a61146061c3f31ac05757b29ce81ba03bf5194108706
SHA512 4c2d3263065657a923059f1ef2885c101efe2ae1458e6199c58727518f8d25a2e1a550f9b5f2a75d85584edbc6b37875c768f7f9e0d0dcf6adcb36355d874b9f

C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md

MD5 09a200f07dfc60a2bf65a862304ef58c
SHA1 6ee265204f3fff2775b12520e36b773dbfb17573
SHA256 c10cf0733fbb1aca81d0d8483c2f873923c627add59f54e9e53f9c91d826a837
SHA512 8a5a3f3b886e8edc1b43948cb06c2fdb2943c3da191a4cfed30812586413500dd9e38fc067632f4d70d46f0ac5a7649e4bb1b813dc06dcb7855f22c10c010486

C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md

MD5 7b095e576e74249e4ab3747ccee3ec86
SHA1 2e5acab6691339151bd1eb018658eeda2a02748c
SHA256 80cc9ffdea39820d51a88301138ce222deee930b7cc53138d1eb90991f721511
SHA512 c4e2db2cec07bca915086439b5959d4b50ad9db4596599b93c500bce734c5ae113b1d237b57c9999ca4277dad3f30de72fe606ac939dbd999702c6155fc5f27a

C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md

MD5 45cc8493bc2c5c03c18bcc23410ce209
SHA1 cf93006d19632bdd0b6ca411e5ce21cd8c57a79f
SHA256 2c1230c6f0bcc6f95cbf49513a9a13584b9d32b3759a4e707a890ad8e0b4abb0
SHA512 48cd957313811d837db29862f76c08b4f37c249540338763b3533e8c23afa7d87ee5b4344b260bd861a2a94adbbeb351f162d3e50c59f308cf4b9c906bec26dc

C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md

MD5 ac7d5af1a1c9c2910aedcc2964488692
SHA1 38079363816707e9a251853c9900dfa67ad59129
SHA256 6d8b6b8cda090013f95236410e84bfaa92dd7bd7d17f3fa36a817969235b3a35
SHA512 d40e91fda7e2a4c1b7f33ee3847dfd424d8550db29be8f8a70550f041b395df6a98c196cfa8364db36c89bf1396cffa69225985d81e6c52ced4df3f2e9c59f3a

C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md

MD5 e6b1d1cfb3ab889ec648afe99abbcd37
SHA1 a0d5c71c4402b7f2bbc6d9c5f25b91e4165a1a11
SHA256 aea90f5235da9b1b97f35ef61277ac43f21c59fdffb5928265dd545330680986
SHA512 b29d126a37efe87f52958da3d9021dadf2ce14f75761492143a7024d2e64e3cac1482ad8c804f7a6c7d1de6e863fb4763096a0776b93618a891096b73a026ff4

C:\Program Files\Java\jre-1.8\legal\jdk\asm.md.busavelock218

MD5 aead2ae64ee028c3c94f4d236b249dff
SHA1 cc16aed190e091286a50fb2a7328cdb95a07a6dc
SHA256 1fc9be409a524e5552c0721d0583fe9e1fdc031bf0a2f620ba7cd5e1fa757f84
SHA512 dc938f7bd14f9b0e64a92631e377ec581731705987a4a3a23fb7d06d4734c5435c90a1d2338676b58622202ba1d8ac79dc4012824fdb2658d3e98dc0c6d5a5ed

C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md

MD5 ebe1cb1bac8997375a35ffad146b3cd4
SHA1 ab0d38928bec788514873ea1071475f403f6a758
SHA256 ecd36123fe11667a12a8eef406ec347919670ec9fb38340cacf3a24c1e4daf41
SHA512 0a025451f631ecfa269072ae40c453c0642c10c456be9a474f536d2ad987a2baaf753a76acb6c559b3325e27dc820697cc7d04aedceacc937e12def136f3ea21

C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md

MD5 60280f96969b2a8ae455713d9e7d0fab
SHA1 88ba94ce160ee45e815b075671acf5f8ee5b5309
SHA256 f48ab0c5eddc89fcf3bea9773b4347997a3f37d228252dc9d8adf21efb147dd3
SHA512 86f6172acfbad6ca132a0b5e8bf75668a2a8146a4ea99f1627d51ee4b2ff0e4b18e3ded16fa44dae7d79519947e5c0a04b1a8398c21f7f85addcc13304f42e75

C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md

MD5 c9c6ccb6469b217fa2e6188f0b7e4f36
SHA1 b4f703f439e2e432b54acea9d731ad547216d7f0
SHA256 5471a30831fcd699d3170343cce1b53f7bec80151f80278caa3de0704db06ecc
SHA512 4001a3604e10a322c96c04ab9782acc9e9943ad9b1fa9ae4760c062bfb13b85507173a83d848064efc6c6721f09ac87dc11043af34b0d55e7a7558f778c07c7e

C:\Program Files\Java\jre-1.8\legal\jdk\libpng.md

MD5 fa100ab227108e0b9736291a1a193b39
SHA1 0ba926c1b77f99065756d23252f2bf9c52fc5a41
SHA256 ca8404e14f9db4a0108943579283b08de8a52b8abf9a177aaa8ad3992932cea7
SHA512 ac9dfbd6c6890cbd60eb147e092ffc1fc90d351f605c3b2dff04f1287a4a282cf399b378b29b87d00d75bc479ccbe51cbb51a987f559c89d84538b6c04b820b3

C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_LinkNoDrop32x32.gif

MD5 edcd075ead97b3b5d9bd4122f77edb48
SHA1 7c84785277f5523beebd8bdc71d4e0530592b0c0
SHA256 7d7f151ef91df214e265edbaf5815587da5d5ac1cbceb57ae06e5688fe4e7ab0
SHA512 97207a6b394cd4d25577ea304697a8f44d4e825735ee8dc0b5e3061023d5da68843dcf13099ea3e6c3d8f3b3a0e83ebd20b2e0896ee257ca84b8d368f5402a69

C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt

MD5 485e5cc1d197267ae7ac18630ee5c5fe
SHA1 9f4421820e777d5867496407dfdab1486d7239e2
SHA256 2f572e53d244113da9897d891c36ad1212fa9d5b68b078be89588e7cf28b9437
SHA512 c1cd0931ffeef22b0456edfba7d9217b224737d6522dc4be84a4632b8196914e020311790b5bbd1bec4abf90512e39d015944710f7b2085110a3776a37d1605a

C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC_F_COL.HXK

MD5 c824ff1728b8edddfb2d7a5f3d6a5357
SHA1 927ec208aae4e14aa21c0fe5aaea586142ead061
SHA256 628cf5e6d5d9f4a5d21eff8407be7ad4b1fb78607f0f64ceea8cdd574bf354cf
SHA512 d0c2a31c66a1ddacb35b4488741cdc120e9fd9b7c51ab134b0349544e81ee13fb08967939f114abb1914d92bf108130ac6036bcc23884ad63a1924ad49414a15

C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC_K_COL.HXK

MD5 f312a8530c0632cf00d5e38d5e18d1c8
SHA1 cb6898cd24f368ae7b2a8dbcf968f52f7ff744b0
SHA256 6f092d852f05de3c98cbd6ae9449840252b236c4ac246406db58271f08a7fb8f
SHA512 f4a3b89b36e56f540f7d3bf1f5e3159c172ab85bfbf90c801119561e686e65c72ef57edbb0768445de79e9da5f2d90e29493b61afc8a127afada4fa4001c0423

C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe.config

MD5 4f507b584349e979302a0f8abc9c7a3b
SHA1 3d8c2b8f2ed6a94ff3f7ba0649c1f9e36c2220fe
SHA256 af4983a7b5a5a99620a2781ea7827b82c45a8923f2898b2246b796e214364d76
SHA512 4604f6c12a33fc4293a7a61a8d9f3083ab51a0d3af87aff66ddcb8b6531b39949cf529f5fa4f3c6f02f92c13d6ad02453a14531a5bf1dab57b1d639cc265e856

C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\SIST02.XSL

MD5 1e76eae7b9f237416bc70aabc48fca78
SHA1 1e259e9bd83a2c954c507ddd88fd7021eae84b76
SHA256 0aa26c1e5b4ab797e2e651da67513e30268418f37c713142aef34c90127a2fe4
SHA512 73cc31ad4690b06296516e520b75efdfd0bd16141c2e5370d46f09bfd45c12229afad618998d3071e32f0e2cde3bdb9724952a78b8efb905cb6bb8d06028679f

C:\Program Files\Microsoft Office\root\Office16\PROOF\msgr8fr.dub

MD5 3788c5689e2974a39c65856d04ce853c
SHA1 1a868b5ea4c578dedbbbb4557599e394c698dca1
SHA256 c2193d76d67b2e62329f5f970fad0d30879ed2d67d842f96c3f928030464dcc2
SHA512 2cd22b52ba3d505eca1008398acd13c5520e02da25e2809dca224102ca872d16f667cc47ad43d655517044cf739094bbd653b518d6f2f02d0369c63f48deddb0

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\osmia32.msi

MD5 8ec4d8aef7869c7b82519f56a3e5c19e
SHA1 51e6cfda6fc72462354f043aab0f803d5b549d5e
SHA256 a39c0e8fbbe25b30e297852ca5e1e6428485a0f67ad4886e9aecd24294d8395f
SHA512 b5e8d4e683b0a2fcb6bc590977938f4c9b9b15b3363aab6ae312fbfe89d274b82432eb9c9588290b2902710590a997cba98e74dabe08a4860751cc1a8e6532d1

C:\Program Files\VideoLAN\VLC\locale\es\LC_MESSAGES\vlc.mo

MD5 3550b6236609cf3c132fb9039dc9f71c
SHA1 6da2d28359340057c584908c3757a15400062141
SHA256 047760cd40a8bdfb24966566bba0d1288811bfa87197bc6ee3d2898ef076dca0
SHA512 a1e6cf393062301d2b6ab68d63299b9444add063a7e7905106e34a003bf9a6f29d9f434b98c27e7f03b49f8fdc2bdf0811a3c914fde982861a6d79b05ed0cc99

C:\Program Files\VideoLAN\VLC\locale\mai\LC_MESSAGES\vlc.mo

MD5 f8645a64c4ce1b81b35c727fe4ac9866
SHA1 3faa24d7009b3d17440e19d1c4fdd6dee229c2de
SHA256 00a8906fa1b9eed585b6e125c32859de83f57b5a19e9bdd1fbbfd9d51cb3940c
SHA512 8b8003121752870c737d29c7745e4407751898f9b8b2465aeb555a7447d8382bf9f99821b8ac5c53af118d016c9bd5be0251488b3d1ab4d3f2faddcdc7a925a3

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\cef_200_percent.pak

MD5 211a296679d8ef72cb3ef09810be2db0
SHA1 5620962a2b5dbb643810aefaabf3eea76579b39e
SHA256 e47d21fa03005c221dc2b38d8ea73ee6d6b160577b495d6865af5e7f4c02c106
SHA512 08eadbae72f1a9eff823c05a702d49cfff6dd582f00504e362c359aaa8b0eb91eea7aeecb314a40712f497772fafae07ac015836dc99508f57fe06bd7ff9c2d3

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\aic_file_icons_retina_thumb.png

MD5 c2f219ef7b5c710e65ce0ae48902ef85
SHA1 2479334746ca011ebc2a9f56ebcd0da4dad07fc3
SHA256 10378e8ccb5536ea91238bcd57705e390eb0805a2e5074cfeba5299e03659b9d
SHA512 71d499f2b1086697859b675a44a7bd8a943059d2296ee01db094132091376234e5abd3fc456eb46a7653538a1aaed61b85c4ba92418353d8b8079cf8d8376f6b

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions2x.png

MD5 25b9acbff73950d45b029d676d367b0f
SHA1 dca075999b9eacb0c1e193bc7d1189c2c703fb2b
SHA256 e16fe003f7559cd64fbf3ef9a10e687ad4b15d9eebabc40a1b24684be9859dab
SHA512 75d1c87c8b4b53310888cc01606b2dec465609942ad1d2dbce21a638260641694013216487b56f8263c7523043e9fa8de67e8cf28f64d2e8fd7d604d8e392fe2

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions.png

MD5 31d6e454ef89d3e3cb60fc2bbc102d72
SHA1 1cb0b1bb9138876df97300caa14b400dd81a9488
SHA256 91fd122cb11fe6b68fd4c7d5359b001e22d3b85eb069068335efc1bafc4670c5
SHA512 6fa9b07a471a559cb3021b68df7c55e5eeeaeb6fd59c999d4697b7c76d33a5a81c5d605a8c7c4dbe5635ac52911fb09709930398d39b41e77240fb3ba15c4295

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_remove_18.svg

MD5 608c285861643a8ca112cf66a84a2b0f
SHA1 21a918d4cb88bda21d1a8fd1a8277d180ab703d4
SHA256 b1a634cfaba03813d0446c71d6f4fe8f2d3d62f103a7a78ca3b6087ad21468c6
SHA512 4b2b61d05e1fe445d8ae7e37933084accdb1e1e27ca339e39535343a70abd0022179fa2ec18aeade257967f55b46e1216f0e85ec41c4a1c70208e0c6d33cb1d1

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\remove.svg

MD5 7c8ab4abf3f8d0a49e651a070db0d046
SHA1 3c1077f471b923a703999c15ec5725f315f36124
SHA256 c34849f2b64013ece60c11fbb03e9485e9a1104c3401beb5258becf046b3aa09
SHA512 4831867f0e958233444b27a4084b9dcb75352e53c0c2b35c0d3b3cc98ff27fd86a0c33fc79f2b5d83e0c0ef31235d297b5e0d3953c9ef9662df15836f42469df

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_fillandsign_18.svg

MD5 c44330b1cdcf566b62769a3156c05f6f
SHA1 a88ac52de798e420b425340b94e7b0ae364c1099
SHA256 f8d8ec1d583e6f0b816e5817879683ba1ba731fa738a82eadb53e7ffa56517de
SHA512 19da77dea33f4e2c04473b9cd1252cf4ca312b0b6b31794ec5eaea718c5f55df3a1cdc2d8e9a89835effd600827eb38a6d8ad6fbc6cff3d42e397032d3a7a777

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_folder-default_32.svg

MD5 00c2933d823c5f895cfdb17e3a7b4c90
SHA1 efb07244c656a137a730e8735b488dafaa94886a
SHA256 02229f2bd50851c70d8b2fb768c3a5385d6fdd1b15a44d695b282cc3b40815ff
SHA512 976fa2e32a2d0f7580a05e53ee412c311d20cab75706e0d32e89ee0bcd5bdd01c826d287bc84dc186c3764de97ad35b83d5b3a3a87212373365d9d623c77fd4a

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_nextarrow_default.svg

MD5 09ce55e7aa4981dbb55b3d2c55021f81
SHA1 1b4888c7f5f0dcb5b98943308bf9389a5dc96ce2
SHA256 926257168239d45f89285edb02b8a4393d7bb4640fec8f4ad3ccb87b1bda4a18
SHA512 374b932a878a618ca59a9562d509007e7195d1f15881ec98a862001457490e4c429d1c1afabcc600875c38cbf342481b2137c0c2ba4ee9989e6228e40a8f0a7e

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_move_18.svg

MD5 4576642640087e08717c34eec2d713ed
SHA1 c40493550cf0157cd8e196984fb5b9f71b2cc4f9
SHA256 a78d4f39480c8c886627af713df50bc7bbc8ca74a13dda93e90cdb9600a6ae30
SHA512 810fb786d040ba0ebcfd7ec1341fe0c0b899c9541dc270a37690b0740a45f70913a401f118803d2d3a44792654e5f6f9c502f1bc4dce990a5e8080331b90aff0

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_organize_18.svg

MD5 16723073f73ef7c3ee3a52132213bc41
SHA1 574bff7bececa57e5710f569e1de41e76708f2d6
SHA256 769d35764f9f71b1f7a959aa724574ea54a0e4d7504dde2aea901a78794a9c30
SHA512 0333b372b1f5eb2a0d467b6670d332ab749d1d7b09390194f841436ca2f98f4f144214cd67f26ccc949ce22daeb9911d028cd42e4006efaaf1d084ba86f0fac4

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_rename_18.svg

MD5 86372a64f781af66c906c9abd36829e9
SHA1 1404146f7e908f0e573a2f46bbddb190a347e89f
SHA256 3ed7c4059d1c4bb0b8e7f62e8ee558261878568cbabbda343ee38fae6ffa8f8d
SHA512 1d98b87efa5d5d693fde6d4006a7eb6a686bf2c65b873acd823600f0c827ccbc18b301a44b2f5e8a876048e4ff75a4809f8b814c18138e0c4f8181e45ab01a53

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_sendforsignature_18.svg

MD5 5669d47738ea94ec2ca22171821f0b25
SHA1 19e2832a9cd441eabd936e18eba258af8475a9b5
SHA256 b6f5c7d76ef5333da40be5a5e8c85b55ee26d7d84687ec9b62030bbfc0a62794
SHA512 83f9bb69e85b0816d7b945ffbd71101698b99950b868c98c59a3ff28e097cb47f811373b3d8673696b9c16465f3ab5d8bc101c432e5818cc01dd3601780fb01b

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_share_18.svg

MD5 94bf872d202184176f9f24a658df7e31
SHA1 bbdb16dbf2090cdad8ec756e9c8d896e7035345e
SHA256 62a7889072ed2da2c792327e8c094f2e603c8c31753ae194129e6e4e8604b721
SHA512 a19d14e17741f1ad9bbcc5bc330b50df0a6cb7e2230f454d456efda6bf537dd84d67ef557c76efafc328692776f7d9a1229ef722c6539713fae95782301c799e

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\root\ui-strings.js

MD5 a394d61fc46d6394b68baf84fb46a3f8
SHA1 7e85b61e43e8977d610da26cd13b2236ae2f879a
SHA256 b293ea0d2b9d6f5ab1158eba733a95847d085a6f354463657aec81258721f6a0
SHA512 2ec642471bf4578b78727b036eb6a71aa7bef9d17ffbbf116db750512b85c30ebd249a9a57189ec9dee2e260a9c1433561835a59f13324d4369223f64cf9bceb

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\root\ui-strings.js

MD5 b2a21228660bfcbd8900a3bb54a712b8
SHA1 796ce0936a490313408df973664b91d3226e9a3d
SHA256 b8cfa3f1866656ab013a261bb38869c78f185f4c3c6d0b2625cc5d117a747995
SHA512 b352fe7eb4222b8fa391e319b3b88a60e9eed858091719f1594b7de51aeb36fcbab6583db874c0c078512073c1012f866d7e9289d7c787bfe0fe1617217992f1

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\he-il\ui-strings.js

MD5 191041aeffa7054e8652aae0177722a2
SHA1 2c393acc798884e3d3c16f3a2170216f0765697a
SHA256 5a63a1398e6d3c6a427bc05dccfc44ada3da704ae62f7f0c0956250bb27c9268
SHA512 e29d534edcec40729e2e16fafd4e66338ee2b818fbd8d4d4823827217132662d1c219471131dc4b797e8b4bbf51317d41650fe75baa3ecd20687dba00a85d92d

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\root\ui-strings.js

MD5 5b421161d66b7ccc362aa9693bf1e232
SHA1 66a591e83704197f56f92e4d2d10585fc85ab13b
SHA256 1929c148e13347b7acea2361854e35a35c0215c31082979937f5140dc44334a3
SHA512 7cccdc1c12ac3025e4d95f311acd9f67befa978381b1f3547e8326d403790b7da436b9404f8762fc0202f6cf4ef8092efe53842f9f08081d74d597484947eb6b

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\root\ui-strings.js

MD5 eaa3c31d4524d805a51cd12c7fa06f2d
SHA1 19558c5018a45e30a0fcea81dfc329695850d566
SHA256 69141376990696516e80323b36b026f60b50b93921b0d6f7dcaa2991076a15ce
SHA512 cbb67f795ea3f04bd6aca5dc6378b4a72bd6d2d66def20e1e357e98d0fef5f17d39bc459212321556a1734632bb1b45e25fee8f371519d924505e6c8543d1cc5

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\rhp\exportpdf-rna-selector.js

MD5 b185a27032a02b9c4f42c75c86e58591
SHA1 a99040b1651ad1696a5420ba83db268a11d16f0f
SHA256 98236ea807b6b4c4cddb40ebd05ed74efc5f80e18eddaaf71c9b3e45b3954d5f
SHA512 d8efd3e6aca2f21b9b85e954e80aac32a78c230bf79253171f45bc2120bfb7bbb25969a770b3825aaebbcd4f975947224c4134b6d708d60c3bd1a16d3191dc59

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\convertpdf-tool-view.js

MD5 7b04b7e718ba068e9571fb0e8fab772b
SHA1 fb793d648dc050dea277dcc5879da40bb8d0a68f
SHA256 9280b107af5a00158f8ca1fdc11ea07161e2b9c19fa7e68a7fc5a7e3c9348f12
SHA512 1884209f2156380cad3bb089104df08f22ea11a4252eb80f0dbe078eebc3a1441ddae502e52746796b6e7153c6b61634ee6e39effd88ed9747a6974e514b4294

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\root\ui-strings.js

MD5 fd0f89977c6c9493293b7ad48bc6374b
SHA1 64484b00e5219319d956fd80b8fd4b891a97bfca
SHA256 5c0de1ac442fc5802f532619a9e7351dc2757302ec9cb8c9b9b89c2447223922
SHA512 16597ef7defbb5a1592515c487c907b50b6ff8ef27c82966b14d34be667ed35eeec3642dcaa929532732ebdfe23db6025d753af0087932933944f159d93c377e

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\root\ui-strings.js

MD5 1ce692d5915a4b8caa1707a522cf7acf
SHA1 331bec5be5686d22c5e7153c1205227afb58e8d0
SHA256 1d905168d806d19f32fa8c2c80b2b307c062f5e93fd90955abea15f87523650a
SHA512 dc8cb43730605aff59eea943d4f9cbfddf1be0360a4e9c0f6c722994d879030dfdfefddb8d840ddbec92e40597292a5e0c5083d0c4918ac1d7130b57d82be207

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons2x.png

MD5 f5a0ead2ac166491376184e43a66cd64
SHA1 ca7c325d17c7c917701a8513c00edf2d3c9037ec
SHA256 175c9d5c8f7453da87c25119e277746af3ee98a852f9ea8858e91de61abc54de
SHA512 e39929b64c6261e3b2f21be653ba6b68a5b01bc2a52437aeb8623320c88648ac9fbd338eabc26d10acd2225c7283c6af8eb8b0046e06a8128b84012424331ad4

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_2x.png

MD5 173dbd211c7a66c7ddce1410c9665e2a
SHA1 d7fc6095f1378f2f98a1230075c6da5688ba04d4
SHA256 cfdc37fcfe9773c205832ca274ccbd479a86008733a4f0db59ed8085502585af
SHA512 a0f5e3041a12ae7cb08dc998108e5f4412557e2d04080a9c57668440eb9a957edcbe685a7fa506e9c71583cf37e7157a62720bede15ecb1de9e242fd9556a2af

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon.png

MD5 87dfeede20cf8e9467b811d22905c3c6
SHA1 7ac3062e0bdc0bcebbc6e76e17ddc2f8db2ddd96
SHA256 7dc4a4778bb257793cd5ec8d770f08bb31efe2bcc4834a0f0f266b4e7e427012
SHA512 0ad1341b97c2c1f114a96d4e3f0639802dbf42121695240926e4824b147221a8848595e2ae8ae1fb70ccc0074cbb0c0b20d49414c08f69617a1edfc324290632

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon.png

MD5 1f626f13e3dd7fbd93fd50b22d4e4efc
SHA1 9fc4213ca04524a85c6449775f8f7f376ea752cd
SHA256 03ff2e623deb1b81687532f47f0dafe650322c67fd2bef94289a9f745ff508c3
SHA512 07237fd8ff744a38875e1d5d9ad79fdb9ad22d1fa433b1ba73d9790a198234970c3844e4e495c5ba85163ed932fab935900137337b8857518fa2f6ceacbe7a39

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover.png

MD5 036cee7e6328e0fba66d45dfb09072f4
SHA1 87360f4a69868c4dc105306c2ac8fdc4a60ae649
SHA256 211647bcc0dca0c60d860f793aa3e684e5933c2144b58a14151d2e6b2e3f9ff3
SHA512 48cfcfe91167c3a590b7194bab8839196e6c16c8b7af091886fa6ada7335f4ff3d353d6d1e0fe1e658a4ef3e65d9d4eea5aa8a19ae4c36ba2a36a72478f1505c

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons.png.busavelock218

MD5 6498f9a2e43b821bb255eacb8f37ab90
SHA1 1dbcdb55d286cf519bcb56b6eedecfaf81cf82e4
SHA256 aeb40777c90ffb65be459ab20ca404bcef1f1e1ffaad8673bccad9a2bb860765
SHA512 7c1431961afe3730cbbdb99f94efa532709a88084ba0809e4ae60dcb397f7d93a186ca46ae747298d8e9d72a639b09eac80ee293249c3bffd4c661749a2ba133

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover_2x.png

MD5 4f0e803b0447934a0e1ad8ff91c7da68
SHA1 1c40ceb8bccf38a1cfee9bde94d083db8c62834d
SHA256 4503c31e5dd71a8ef76afff23320132a2bfbfaed2d7ed3768321e26dcaf0d274
SHA512 ac3c54780722aea78edbee8646a00d07600bb1300e1cd56c9bed2c8bc747fe54a28015855bc80fd4794b001420fe3712fc446a3ae6b071823617199101565f5d

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png

MD5 9de9e74ceea975f773916b5a341941a9
SHA1 88d72ab17e6a0c63b50669896b8270e8797a4b10
SHA256 4b8ca556a8ca66fa218ed79b1aca1c64ec76e82b8dceb0af60f9541f3fa3d6f8
SHA512 67fb5d75818b14623a346f6973eb4c7f8353e62feb875c23d2566bcb61109c82e06ac2e10b7a9d0e68894a705de71f705f4cbd960b8f09188959dd7e23cbb874

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png

MD5 f6d508b3c20a2a345ed2d0a219d4b236
SHA1 5bc678d623bf97c86da7b4c7b4592adb781268aa
SHA256 2580c062deff33ede86352bcaf2dc0edf61fd1aedd22b223ead62bc5ca7e7cab
SHA512 dfd5d37bc4f064236c9b93cd7d07a2fa175f62931746e1b7d7a19cdf2fb05cf30544b94526842c8b729569c9d7e81255f06bdc18944009ee3d7f9550db3cf04f

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover_2x.png

MD5 a5d27b9ce43f52714f511eeaef3b9a82
SHA1 785a88f36db1efa28625f936c0a3df8454f1aab5
SHA256 d1c66d916313f220b114f8aa106965d97e70d1469f41d05dd865e6f27aa92242
SHA512 b900a9afb2b63ea4cb07f91202d3f8c3a4ee2e3d0c0d87876e4c18e19c759983fb83c33a5d185a9a100029a8221bbad46d48bc2a14e788f83180931a49e350b8

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fr-ma\ui-strings.js

MD5 464c5f5a905de562d47b711aa9a238ae
SHA1 70c5bc1953453c2771955ac7ecfd186962fc88dc
SHA256 c6ee1c2137e6cea78a7b2756a63660a77b023b293a0ada7433738e6cd509ef40
SHA512 47bd115cd3329d84981296349e0d6ec68c1ab5564cba1e633b4a5d79c84da90955d10c56c2518e6cf533c0f026450d65398810e03ca3431b5887fb5d8373ad45

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\root\ui-strings.js

MD5 466c75ac6e16adcc1bc2780c145bac02
SHA1 98a7ddfab75ae64ebe0e44581510d75505b5a850
SHA256 7d2600ac34abc46e66b49c82014270c341098f154d69862f5740549d44e3050a
SHA512 8f973265b17b91b528328933509075250b2d2f55be2e205425f2d75882a5da0670cd8c55e22f7ce53f5352ab60b3151a716b339696f3a6c86fcecf8d9579622d

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\root\ui-strings.js

MD5 fccdcbe9b7beed30167d5f9f027cf585
SHA1 776909b1ad1b074b7dfe21584e54b3ae6c4450bb
SHA256 9fb8ee39d7cdb995a50690476f8f9846ba68acb742f4d3d88d1ab3b78c249907
SHA512 a265878da1300c005ffab2ead9b28866490500cd358f2a058805a7926038cc27b7096e1d44545fe1fbfc439970cb9692692cc0b8321df2f7a6b6e0985f75de24

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\fr-ma\ui-strings.js

MD5 bb35caed522038f1d7f1e4f89559f749
SHA1 762dec5e2ae86ae1de93428537c9602001276cf3
SHA256 67e978e345228b4c406eb01138a2bcad41b42da9bbef5bccea1ad4b95fac24d0
SHA512 8dfc4d23d06ff97b5c2896b45437f40f48a12f03e64bf2751faf1d42697dc70ab4a83f34db4b15a42ba6ec0e535a62c11e2910a40bcc669ccf7f7a47964333aa

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\fr-ma\ui-strings.js

MD5 c36df1420e22d82d96ad8b24072b2f23
SHA1 ffea0f74042b55d45bedf83a931eeab0a8444426
SHA256 0ac3f68dceaf76e0f5f8595c307a3034e6096cb33ef352e274e4b42e41baa1c0
SHA512 986994aecf19b18f0536dbbbecbc94ac5a3e22759cae78fa5a0e7be6a4c2fd029883567d97ee9605db1a302edabcdc41750819e82dddabd852e99c6e31edd045

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_retina.png

MD5 6e3bebb1c789f1c8c4ea4b32158343f0
SHA1 6c75d0c66f05510ee22f353f45dfc61419b3214c
SHA256 8289f0c55deaabfdf5d3ad281ab3be01ce2bd2996b008b1533eb0394fe13d363
SHA512 8e88eb65f4c7dfcf6d1cd780397b90a88de2f2b985eb81966b3dd7ca5577cba09e0ab7b9e968f0d5ccc5e47d975cfecd44be91db7d896d3b2f34c767be8df9eb

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons_ie8.gif

MD5 67462d79e453f4044007a55be1b7eee6
SHA1 7853300d04ed91fa524699d06c29a34fc02ae12a
SHA256 d2f314b9f9d49bf929e823ad2f493174e4f129c615f09b7ab953824a81698607
SHA512 15f90160c6f3691cc6e04f7ae7d831533148fae55b6c69677e942b4b493935b40f80b59bf87015201206f9fb4ef53d82e8ff79fa439ab47f2afbd756e2b6c591

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons.png

MD5 ef569a240a21f4c87824e3c18752eaca
SHA1 e80c5b4e728aec20d3ca1ca538b9dc9d6e2116f5
SHA256 7ce7a902a7e6ee7a455b3046bb13777fa203ea09e0d721db0e8b8464072e1b29
SHA512 e89a03fd98ef96543e1d70c5885f522650638e3af8d3d3af76ed7be4f8e8a4206560b6c2443e86e4006682941c611ea107e333612f84947252e5f4eaa44e1a4f

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\icons.png

MD5 d608c2432160a7dd54d0ec8b4deb4483
SHA1 ffc078a3cbd6cfeb4b5de625cbf32c60457acb67
SHA256 ad351d07a8a28845a28a15dd95504828e845d45d67ec91ffe111fc6a0e35c705
SHA512 8709981e0f7e9368c8141247ead9d45e7b44813f767ee38f2bffb2f173881d141545780535b496748a02fa216bce01a9118b62e380e995f92e41b7aa3f9cfd10

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\new_icons_retina.png

MD5 c68f4c1ac4ad5e802837a78f4eb42039
SHA1 e202c2b6ee3ccc60d3bcbe76ad12df3ace83578b
SHA256 0fc35f2510aa980a4b769975692217b52b5be18dbf9e3478e368fee3a24b0b31
SHA512 01f1dac1566465cfeaeb63c3328c03cfafda8b4e37355379484475c707042556341d8f5c111b0467ef9baedca79df7aa9d06fd342d9355cd8028533d87f05dd2

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\root\ui-strings.js

MD5 92e463fdb35df0c945d0a122c3f64f88
SHA1 dff96fc9c34c7c319e04cf7fc5f0442e0ab6b394
SHA256 8cf32e53ddbce6840016300b3474adc930f84559a9f02a296685c99918cc69ef
SHA512 138be5e0741cf9b719b6706eb58728a163a07594d850e984f020148c8667324505023e72666947083c0493bf8b1204f548f17b6e2fadf828bd155379be792cb0

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\sl-sl\ui-strings.js

MD5 9872aeecd2c2ac68d5d20f3d80b1417d
SHA1 968ef2102829dfb316cc765a4dd8241f24bccd55
SHA256 faf97738136e87624291921c0595aa8e1257cda2cc420f6078965dbddaea3033
SHA512 1a42f93a3069e2263296e82d3a067918caba4c8c703896a444143f931d1fdd90c2a76e7b8a238a2b013b90fcb1b27d06b9ea50bf8b33c0f4b0a2eb04d95e8f2d

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\root\ui-strings.js

MD5 39fb4c567bfcccd6018e219df48084c0
SHA1 00070f1bfa7422b57f6124b31ac3cc054d6a92fd
SHA256 6b02aa57849279be1b8e020e45d2b288ee27bcb451b6122f00a780bed47022d3
SHA512 d71131d0bca29704d6c323df4a31438ef5ec963a2f16fe60ed9ac584a4851d8d17f71d32254d0deaedd3b7121cb3b589f3b2716ec5fc91bb9f17f8edad37f1ef

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\css\main-selector.css

MD5 b9fc16aacb656a6f047f980528bc9e09
SHA1 7912241cb5fe4b559b4fc18965a5e85bedc399fd
SHA256 1ce12f2d847673ce70a0b72db06d42e737ae5a3e960b41858ab639a4b3a01a6e
SHA512 1ea6e51b1216d1d62ec0f27179ebcd64c43292e59a026c5fea6cf9dca409d10c73e4c195fc0a3e1c2bf5117b6ee9c9ebe31d72a7d73f87263b6fa2bfbaaa549b

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\icons_retina.png

MD5 8327c66f9037ccdb3c1e0b3665766469
SHA1 a15809700a8e1e793dff311680105c6284666ea3
SHA256 adfc6fccb2b3369cd79db77a89ee24baf76fc491bf724c72d0b453dbb264109a
SHA512 c2bd0c3bca2f237cd597b161066a62a464ae540b457a4abb22beccca489e974c3691b9a754d9e3b240bb8059cdf962b39a167e631db13c5a3c0be0d74d325338

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\bg_patterns_header.png

MD5 3978ec4904e9b8fdfee16f64a9a10ce8
SHA1 3bb10bbaaa7ab13225789e25a80d8ea91e2648a9
SHA256 85cb3fbc59d25090b320acfccbd9f09edfbded732bb64cdfa035d65916242be9
SHA512 814c5d85d5eb4b5ba8155b661d2484b0149522f7053d370b377729130f34d796ee6a3aba233efa9be0e54d4ae780085e15978f523befac34b279af54d944ccb6

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\illustrations.png

MD5 e5b92a7f777b82e5167b17ca73211469
SHA1 521f6a114dfa961b26a875e22df110c6b3db78e9
SHA256 1527d9f88f341ef7bf8b60a5726ac9420649cad8d1210a2a0cbf913b64ee8074
SHA512 d0b5132d188ba553cce8d66a085f0b6d5bba1c1bde7067409d7c96028d6f01492ef11c0f25f3ae9b6dc70a0fa5e6d3fcdc260ff42d2548a2408790ba2661f5a1

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\bg_pattern_RHP.png

MD5 90a0b61031d1367a59870dbb6620824a
SHA1 4cd3f91e390b6355099bc6b046ad19cf0e714f9f
SHA256 9b34eb53183379b3ea8a0043bb2cc7ab4332cd4e70052e4bbad533be107546f6
SHA512 84e391eebfa9e0cc2b4528041d21986caa2f52cc5fc0bb175f39d330ed853aa6b4468d119ea3013b6e0d077501c5a1d811ff9fac98b67b831c7403fe020e711d

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\illustrations_retina.png

MD5 c185e1eb34cbd322e87ebbe0c6c68c35
SHA1 e68fb65f65d78d793e42b47fc274b06da68abe28
SHA256 19d74a2316a1022a9a36d1f6500d07d9a07835954c92165f1b143dc984b444d0
SHA512 e1cfb6195feb54d32411a05d3c4a5e4e37750ba58734d6575888ab6d7e9b7271c4710539a68507734a43224e9735e4bf5c71d9b4df8be624200f09b1729271a5

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\icons_ie8.gif

MD5 e5864d35a0b99184d3bac02526b691a0
SHA1 a51eb8fbf2986661175c14aa584fe7a1af70c4e0
SHA256 49bddd024aab4cefaa2cd50cd8fcf57d9adee0156f98b412741106a48d2e1676
SHA512 53cf45dc9325a1b3584e49162d134741c48bac6b184f96c7487b00c4d7d2ed3f750dd0b2f500391ea33dbfa76de9a4099f8b6e8b7f5aedfea03e429999d78f8e

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\new_icons_retina.png

MD5 f210ad5fb19131b9c4ceba22e9f1b0fd
SHA1 5c41db94a06d3c8f66be6c8e2829e28297cfa5a6
SHA256 59722c41854ca3b8ee3b2a465e1a18956838474e46dadb35dcd4b02fb6516bea
SHA512 cd1a32113ddb0e5b72317d23a6f7d2d01c34f5e9a0f3f82f9d5d54fc165e98dc97bec1ebb3c4db40e7539bfa161707e1ac2c92db4f3c98c57a1b4be9c088c86a

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\new_icons.png

MD5 a46c4cdef81e9d059f5557759dbfb50a
SHA1 fb4955a232eef992915d0271fdc95f31e41a3200
SHA256 ea3ed195779ac27dbf7541c0feb99301bf3c005d2b6fdcc1524a7a7a04037b83
SHA512 9c9fad92a2ff9e2ef205b60bf5592a8b9264669a1afcf69c90667540f729b8720d309141dec00827a8aac07103bddbf9334c1256c2e015b6b71d292d9a4f010a

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\icons.png

MD5 1a32d83a5bae01cacc82e56b31749316
SHA1 bc6f8bd0f40db31104416ff346e97916bebdbe6d
SHA256 c07f566b0d8d75ea1ce0fa1025dc758e22faa29ac7f718c3061439541cb4637c
SHA512 b0bab2f04ee17da13e46b272f0c5f3c3fa33f5abad63e0ad0b460580196653932e3a8452f6937cb9f7b2ad94c463fc62c561abe9434e359e37268760a2f1f5a4

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\root\ui-strings.js

MD5 e7f15e0ad3f0043502f49f190ea41674
SHA1 396c16aab3d9fde038a942352e0d5944988ac572
SHA256 12bfabe63f00e40ccfc22505347a1e462d46f61346be32a1c7bc7a363a368dd0
SHA512 7cd3b62fbb256d8b7966069fe347ce2fa335588002a8f06563d6dc5770cdae451877597d32bb55bae75dcb10fd04ed69fd5397a9d8f9a7d8d22fe9fcbd00b02f

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\root\ui-strings.js

MD5 4cdce98504bc991ed83fd76ec49fd8e1
SHA1 f569f8a2decb4ea59d5595db06b68b47b5bb6d89
SHA256 ab4fa2d00f4a671dce5b5295e876469d5d4217fe97d078a291c7bc4e7bc0a54a
SHA512 386d15b1efcbb752e0d33102e9a15ce52f3ead2719dbee1a000accdc66a60a82e222d66aaa99c9185ceb23397faf363b2eb6c3facd6526362542abb930528f32

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\ui-strings.js

MD5 ab0be2ea06ed2629ca0016b996671ca5
SHA1 254b5dae3a632dde9ed09162d5d552ec60c7f636
SHA256 ccbb7d8bcaa6262b13c83758a0578b2e0c26d741ff3595776abd1b529a7e5d43
SHA512 fce8d549a09ef516033570d10ace6b0413f1fa0216fd86b40e6ec33a6c771570be40ae91acb2d12dc40dd1da30b3841f1f4d84a5a89512093f22e439f7c7b913

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\en-gb\ui-strings.js

MD5 e43f1cdd6f161d5b3dbd58b30f5fc5bf
SHA1 923f0862bb06f45d6aa9f3a0f4d8da9cf5513f54
SHA256 15566819e3c59c6c279844ce745a55e04bbf3224d8b25dba2110c44ba4e85ba4
SHA512 edbf933e4fe1406a75a0358a3e0464b225511148d91362306ff54df1d7e9ec4dd195e9b98d9d11fde55695a8850b16e6a6208b40f506be03eac899f8eb9fd868

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\root\ui-strings.js

MD5 07a5d30eaf147e295910df256d1cc4a7
SHA1 503006ea9ab454d8824b2f9999d9f4a848788190
SHA256 023223b7a5b3c91564227df10e4f894162862319a83c14d469bc566c2bca9006
SHA512 b5a6df01ad30ab39548af756dee18ac3d420d5921fb4d6a9ef446b99f4d0d041c1347c5667b633aaeba46a3709f862bd063e4c11b21ef1602b1b6817f0b471a7

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\PlayStore_icon.svg

MD5 0645562a01a5a2d4f0cbc266dd94b371
SHA1 ccde036b69cb9d68d2e04568f9a02b215f3b798d
SHA256 95ea54e32523ba0ef4dea602707be8f109c936c72807666ee1a110c8c4cb45b3
SHA512 b8e9b109db67cc1267213d0d34fd329cf507e8a6232350113939300182c90df75d2bdab2b4ead8d5be714f28dfc1f4af9a828e29e05aa5c53943ad9955c09758

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\root\ui-strings.js

MD5 e06a31fb0c9afe82fba271fa6a08d8d6
SHA1 7e7fd89a32d99dd8d011c756a76529d363c09101
SHA256 82d9115bb7e22a6325e0e6e7bf16807c486d559a9928aa20691164cc6d521704
SHA512 fcd9c3ccd03e1e194b7082bd987f9c95a5d02d27947db6c38068c09c149ef1364e0919dab7dce2701bbdaa35925efa1c18d4bfaa3fce297e18413a43e1eb67e4

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\root\ui-strings.js

MD5 23ad9bbda2e2d5623e88582ee906b8db
SHA1 019e95407fb4bb8750108f66083648d023596a30
SHA256 4182d266c00fd8867691420e82942a87b8b13c0589217ccae9035dbf7089dfa7
SHA512 97d66aad0ccbdcb670d42cca586e11476e009a1ed443b8df703959e61a01ba18d6211a9ad622ba388f74755de52c33e0fd5831b161bbc8e1e502e53ae1adb3f3

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\root\ui-strings.js

MD5 ccf756d887e53e9ebc88ef413050ba91
SHA1 96efef40abdbfc7ee8ab746f667e6640ba6b1359
SHA256 ab6c853a8475c85af15914342703a4809773f4e3cb89a78e2fef14945eb3315b
SHA512 9c77f17cd756b64f5c58974672eed085ea67de910e5717dd3c89fb40ece3a8797fa9231755d17ca7fd90e980390b4f05e04395b1fbdee2b31f6a7aa4e54b4cc0

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_cs_135x40.svg

MD5 c95119b651b7f11190e814cf76203613
SHA1 99f0638a45a1ed1012dee1f69f4503d5a873f764
SHA256 7f62a11612bf64f3f79a0c7b2db29f44ec8a788ee6b0515fabea35dcf8a2f711
SHA512 e5eb928890ca195cc1c8ee1c6b6c888694543eff4534634f21a452ab8dc885627b3f1eb5832791cb8a49cc45e347a75b70ffb960e016ff569ea4760c5efa6508

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_de_135x40.svg

MD5 81fc87d3a6841f28546fbf1f13ca459a
SHA1 acb31d171774939a68f23a7f82484df2f10c1273
SHA256 9edf02d92518a1341e0a194d51ac467b73da58ee5f5a50ed8f527e43dd2dd0ba
SHA512 3940b945632ac542b16734a2b103ff40425a17223bde344e02ec952395e25c03e29b808c9323d4ba2b43b2e2f060aba411292d1f5197b8ce325c6f1f4801e9eb

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_da_135x40.svg

MD5 571816b2b541ed65bb348a44c7509980
SHA1 1fb3fda00f549705f93f53373e4c013da32cfa78
SHA256 35d084a26bad7ef8c7904c73d61dac40177979926e0f6af299b0f4ba95bdc2a8
SHA512 1a9c8a3a70317472d577bdf3c640f028f9de5ddb21751fd73174b8f52417b8957a2a2f63a4c8aaeff43971dc75c5f95ce5f644981bfcf2762de10bd9570d7795

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_es_135x40.svg

MD5 ab1c0c1558aa130d134702f9c2dfc5d8
SHA1 98d9b9cbe2147f7582add4cfa7b81ad0d85ab1e9
SHA256 caceb788df81716dfec1dfbcbed4175228e227b8e8ed80b89e95082720d844db
SHA512 4b075ed24d9bc4d4400d242ae4ec76cb51877eadcc82fd5f65ccc99dacb9ebdf263e6992a102a59546f186650bf7e17b69f77b3a3636e694d087d62ee6113968

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_fi_135x40.svg

MD5 63e79659b33e2c833f2ef2568caa4075
SHA1 ee55395256760f4778c6296ba7bdbeb33c1e71c4
SHA256 26b97343045dd56712eec8bf15e282c4cb56aa2b499e26f654607a04f2b981f5
SHA512 07ccc2edb3f2b2191a20a4730b35599b559318683726ad77fb00cdbcb58e8c3e629f8b80920f368ea3ac14bd4dc9a3e0135bd336755bbcefdd7b0c07f355e72d

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_it_135x40.svg

MD5 82ed07dd2a074029c8a429f147c8393e
SHA1 0d02f62de3659dc0098494ac2bb155ad455481a1
SHA256 67a3d6f2eae8e88958a168bcf330bbe4ed3f18e27e5094ca133d35a8417ce6c1
SHA512 7cc8decbc5d0a753e379e55ac5865f1225367602bc4080f60bc7f10253f45952f153c4827a4c746f5277ebbebc74d8b75e7d890249bea85f19e0680df5061b37

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_nb_135x40.svg

MD5 31c61df4897783b338f050c334a4e5c7
SHA1 19d96cd4fb14a092e0966483fa329cc59bacde54
SHA256 0131558ea1daaf851f455681e0e00b2563063a17d50abd03700c9f39153877a0
SHA512 7061a5445984a10bbac365da925e71cf98c5c1031a964c051715d8a184e927df8a1c2babe180464c1c82e739fc8c5a4f7e3894de161459257e962244ecb196d5

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_pl_135x40.svg

MD5 b925931d486d6707cc4723592255e792
SHA1 4d8b35d2510a00a21f0d076c8810ca5f368601d1
SHA256 9ee160cf91db2c8103933139d03d6d4c9cfb972394641cb1a2f7d28e4c4bcd4c
SHA512 dcf286e4e6e3e2d5170ad8426d00bb7a56884bd48d53aff0bf0642b4f4b9fb4c6abb16a0b1fa65ea94ec936913578e4ba5766704b26536c738762e2e6cad0b4b

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_pt_135x40.svg

MD5 18d457fd9055e883ee2aa5c46cd4f9ac
SHA1 899642d28794129d3aa033035d95bf7a16318c98
SHA256 a2f783900a2526b955861f8e77d7fe9ac82260d3646454357522008498fa3fbb
SHA512 1ece6b75b899f347b726dd8a08735774220f0fe944666d0f0343d1eb984c158eea20575fee63a081c488232d05c54583659abf0baea443debcbaa4e11e28c65f

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_sv_135x40.svg

MD5 f0f25096b9b0dc803d5a81637a3aa56c
SHA1 a22edd2bc5f69b1fe7d89ef1f2d5642266be6974
SHA256 ccc3e0a13f03c09c7f1b33049e672393813c286df0e82152dfdf4e18a53fc40c
SHA512 2bfbfea3253923cff3ae5deebc266034715895da43ba27ba33295c18ac9699fbfa535dca5bfbcc1cf6ffbfa71284653065f5dbf148e8b07ab2c67e1f8646db42

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_zh_tw_135x40.svg

MD5 6ab4c845be3e347382e17c962ed41903
SHA1 a431e1773ef95d5fc12022fd936d5943d6bbca2e
SHA256 21b0140f4f2fb4b635002e6a18619bd14e8557467f35f10782fab14fdd1de7d6
SHA512 810cc0e56a261ced595f496f21df402702b4e33f6afb218f191df95c67e60a44ce14ae760f7533dc02b181cf0ef262f15aab7e7eb5a7bd12ba9d34b7f3e3e347

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_ru_135x40.svg

MD5 dfb1771e73e37740af05e9ac60f34fb3
SHA1 bae75f9dad4f436df0f53bbd1abc6317b43f3031
SHA256 5140d44a1fec045e0d65ecef6a3fe9f01cd6ac69ad0c6943f0b42f0270332742
SHA512 d7744f5aa32ec3183725cf932efeb118c78aa45522037ff014dc2de6cd04ce423ac2b48152cf725b8580a78ddc7941de3370fe66c079e0a3a37ccf7ad11054e7

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_tr_135x40.svg

MD5 633760aaf5cabbe5d0ea412a7ebcbbf1
SHA1 bf735e72258ae882e0deb036ef226e7c1d1daf0c
SHA256 6b1978de6d991110cb81b666ebc9e95bf0f9c5a3846c57b00874d83e41245c7c
SHA512 427253e511647147b0c8f1322258a19878f2a1c7c0edb93c41e8f5487fa5a56767db862971d710a515c42f38e0c913ba6b7615f772d41fc6213e1c16c89533f4

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_fr_135x40.svg

MD5 cb338808dd90b79ceeec5c32268e8b00
SHA1 ff4afb76ee8ff6dbe73aebe54dda30c3967dcdb2
SHA256 3fc80a7ebac15558850e90aacc6455b1c68bac97ba1794ba145712cd89951625
SHA512 f044081f69173b262c01a857e8ea5fe9878b18d2b7fa7a3a8c391536b33493544768fd614af34d3aefbb6af82dc9690d2a2ac16ceac24aaef1c8019a7ed5cca0

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_ko_135x40.svg

MD5 acb3d875be2837bf92b20a00d895c3b8
SHA1 9443487457a5077ee3d64bb53ec2f20f07b9e1ef
SHA256 ac5403fc3622b4d1a3e2855c9c0b4585a4e40b1a2152c14e92bb2266c3d35a03
SHA512 3bea00d5f628b3138f224c4f18ada0210c0b483b7a570bce8938caab71fc98b7241a0e067d1a2978598535d4af49669e546447acc7e4a3a286e2211b77a23bdc

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_ja_135x40.svg

MD5 156b9a002cb78a27d30a77826654d7af
SHA1 be5ac50213fc0692072f2bf5522d383f0f7b494d
SHA256 cb16a9fe5c06daf4613e0b4d27a9bfa7a5b1f08d8baaa16795a5507904d4f262
SHA512 97493ef865b9c7026df1e2cd555b5b6427f31fa1e0ee1c08fc9aa3585985361067d1ff0c7bcc53b938c7f7dc35da326c92f31d4014fe17e2f94231709850d850

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_zh_cn_135x40.svg

MD5 52f500b3fa824dd1db9a9cb46592eab8
SHA1 5c0d11f2a79b76e8f616f262b9318e3531908e63
SHA256 484d0940699f8d20d838a33efcba54fba744524d4dff45861bcb39f74fb156b7
SHA512 0580438e1cee21d1db36b718918d8835c511bf540afdfbf4dce9b9ecb33e4378b1f4b04b66aca8330bf785b0acaac36670d93e15152501ad6d78f6c90e49f0ed

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\cs_get.svg

MD5 d4371a2e295a83518312cbd5f2b12f7d
SHA1 a24ff34fc8e7bacfab2e4c61e07e55a2cc3ca430
SHA256 f9d57f868170e1a935675bfe0ebcc9be47127a859a2ef22a6728fa58c86ff16f
SHA512 818c037dc0629c2f5f59ba85748010b15fe19f35c59af21ff054b42419decc245305da68caef58564b85a7a4863cf3b1a426de84ece3ffa4d0b6cab86073217d

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\de_get.svg

MD5 85fcfe990a79a384e60006c8199ceb66
SHA1 cef0619b757f97d5246369a26a278dc5bd9de5cc
SHA256 174dd937820ed72e221d4fb95856e528a3b3d971387321b4da40b92f187c8e45
SHA512 0d4ca5cb82e7fa14730b01bbc905fb67df4b54f577f2bcc66461052d67750b47a30c8624227231315fee46611c076b7f08070d6132498346a6bc952be0694245

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\da_get.svg

MD5 61cbbea6fd46f39088f304d10434f84d
SHA1 13ebd0e12c47c4f7fec4d2d45481f2222a69958d
SHA256 0cf690a343553bc032e741a9e0411211aeb0ba32bff695561ba27c5fd9a5e1fb
SHA512 1facbe9c1c9c3c70099606b1ed0df97393ca2178dc1951f69989f905eb94ce3512732f09a0af61cc36eef66cf553bf351da822ec69846e342741230225d54b13

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\root\ui-strings.js

MD5 bfd056a1931b9ee8457d8cdfa2867cd2
SHA1 ebe7e539abe1829920934aaabb1052ab4e4b4069
SHA256 805312786431b8ec7810beda6dbd7c2d259c31ca8d3a9d9ef57c3b8722f4016d
SHA512 e92367e62d69c1ef06fd8dceaaecf7278b1cb1b973d1e7c466472a329ecfbef6a969d6e468c93f7911eaefa4918e20e66462f2fe3bddc195a71cfdde9a94544f

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\he-il\ui-strings.js

MD5 634782814bd045d02f41076c584255e8
SHA1 c64137b6b8ac5ff5f662f0315bfbc16a6d2bdcb7
SHA256 66dcaef4cd4290bf3eec52e55586348ee5cae00686ce436f067f74aadc4cb927
SHA512 2777e439419bccfdb5ff3a2f300eac5adc66b8be241f40c4cada7a5632884633afc78be74c88105d8fae898c5a1611be3d875ef77ab951db88ba07e49598f5d2

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\nb-no\ui-strings.js

MD5 04ccf3d88c8d1bfbd9e577954f4b79b9
SHA1 9c4bfed992a8b9725dc53bef689249ccb6868edb
SHA256 c3f97849a8aa3add206908e2e1a7122d1ee3c4bc7e2eaf566993c49991f4e52c
SHA512 a5ccfc52cd6431192e696128cbb5ab1fbc8a38d63ca69a286af409439a3a939a6858fe4ead932c3f819087d9e669b38fd564767455f5d0432fd7dabc6ad4c3f0

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\root\ui-strings.js

MD5 64f660a86b5590eed0c0fdcf59efbb6d
SHA1 25f59631534be6366f380d3d78b829b0a71d8cd8
SHA256 951476264d6e96a0480ddb3e77d7e16e12b7d29f5ad156461a5fe333e64baefa
SHA512 279de9c28d84d6908a365dab955d45ff815e9e6d57583e9298367bcbef38679b87c60299d35e063e30cb7a7083328516e8cd6e5afe7a3629e29e8ef3d862caf8

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\root\ui-strings.js

MD5 eded81945dfe002c452bf77555ff0588
SHA1 bfa01df12a60d141648dc7abf65b3321a0800c81
SHA256 f69121b9621f00ba50072e3442b4c9877aa335065303fd1b979086ae4ee990ca
SHA512 84a4e2be4268f9d76467a2b7494e213b4d3ad0911a90929b0b6f248c13886241fd8e4e433626cd6c9bdfdf1927c64bec3d5412c25fd45036bf1537d703a8cb59

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\root\ui-strings.js

MD5 c98efdaabc095891ce0a3260fc9a923a
SHA1 b399c326a60e57d9476210f1edd1ae88f0649ccd
SHA256 392b2490fca22c4473f2f2b183e8f573fb45714ce3b571d0723b27e0af90a991
SHA512 92d5aa3b7b50755581dca80025e4075606c763da3a5294a7a1f764a2576bb524cf14b1f0a5ac9b537470046308b33b60ccc1f93f091d5cda929d057229033fd5

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\root\ui-strings.js

MD5 29ef1224a79624e79296aa8f03446b23
SHA1 d63ecb41adb1c0fda3afefc83c6bc072fafe8134
SHA256 cc8865dfd9696fcc9be0e38fa379757e957532e1ce9b0380995c80c705d64b65
SHA512 e6762490c08266363bb739d16db263d13f67044cea1ce37f5cf4ebe6678e6a6b85ecd8e5d3ae9d38b2979aed55ad7af5e647b82a0cc31cbece2109ebff33447f

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\en-gb\ui-strings.js

MD5 60d5c38b290ce4a80c2223d284de92fb
SHA1 f0955cca6768b9aa3494abdd959fa539112f8d5a
SHA256 917f3fafe81c0e817870f60b3f5cf993ab22e5277a377ebde36c193cc566cb50
SHA512 0f7830c5e19881e13097a40c00aa00a27631a9fbe73fe4e90101d171e5bfeee0323a190e0fb04abc0cf398fda9d678c0546911c6e62a0d7cdb259af055d7bc7a

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\cstm_brand_preview.png

MD5 6acfcfdc999b9f72c87ddf3d6ecc053c
SHA1 aebfee90b1ccb169b5c1a34c71df005b3c1af411
SHA256 82d1916a58855a870d6b524f665981616f1fe21ffb59e72acfd92cc658a95b92
SHA512 c4f2f33180063da4934cddf9fb54f9cf2854dbc6bb5f10cd81b7026ddc0eefde94770501b0e564c42e14716aaff0a84b0a1bff77e5547ccd44fd9f1feef298dc

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\dd_arrow_small2x.png

MD5 16869a473259ce6ac9cdd28fb98c673a
SHA1 54c5cd4df5b5d5eb5f73a235b1ae188f36ff7399
SHA256 e7bd2d388764183ef0fcfddbab5d56cefcbab2118993016dbd686cb847dfb719
SHA512 bf5a7240b6c5d3cd17e47563cee5aff808d70799a7c76e6bf11b7e3eee475b653f751373438ced5dc597ac2e0e6ef1ed5d009c75d9de088aa3befbdd4860e92f

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\share_icons.png

MD5 85a7cb701e07ef7a175430255fd8aee3
SHA1 0d6b9f0bf6d3fbe31cbd4549a972d6cfc6b572c5
SHA256 ac461cdd42fd66930053244b0fae3b5fd299a2a4c0041e33725915302076441a
SHA512 a4284be6d22ac88b6bb9ec30e6e902a101e403fc12b380cebeb3b91d997ccad97bcf0e6763bcc3de1a411eb639f72b4dcf3d9ec991a3f8177a224338c9e3da9b

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\share_icons2x.png

MD5 8beceaf66662b56a11a58652b0993d24
SHA1 0281ba5310aae8139ed384e5857b9811c73800b7
SHA256 5a7704b303b1fc46c449486f43fcf51807a324157b8232511311e0e8ce68aa1e
SHA512 cdf7e7d8f35b480e128c057bb9c6016ec7502f8beaee45323493587e64d27298c84f9ee281696c9b303ea2cd00deed6b2b4552d224a3230f7a8208c5b334ff70

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\cstm_brand_preview2x.png

MD5 2df478de7ce241433cd6e13b9d0e6673
SHA1 ed04f0ec107c8f73add3dfb35fbabf38ea164123
SHA256 f98faa3153311b35632c17ebf82c997e5fea2920c3f54acd7d2e8e86d14b2dfc
SHA512 61d93aa74ff477ee2131d6d46f87b2841e72afeecd27c98a4dc39a6ec105a3df8284dce61ffa4db28848999d6916b62cccf9d80f47df2bb3dec83bd14a98ce21

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\nub.png

MD5 d75e7bc5c0d4b9b6fa4333e825a5d567
SHA1 66910d407a3c9b788112686660d9b3535d087ab8
SHA256 7212a1e649eb9198d759bef4aff752fac069aa32e6e0cb52b6218e7f48473aee
SHA512 cbdeb5c66562c1ae8807756ef073a194844ba7ae42727ae5a4afaf22550ed39c6da9523274a14d65c47dac45e100f9d40d8b42671d0440812f07aadd2af5d644

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\dd_arrow_small.png

MD5 7b537e03d0f61573fe6fb68ff5ceb58d
SHA1 f2a842cbaf301aa350d1d18f9a6d1e3d6d75f812
SHA256 bcd7a54cc349a3f5093c53193b6b1a1ed4c9fab65c743e5fa4c9dd7b4bd5750a
SHA512 ce02ecc3608656d9f2a26c98e0d515d3c79e0c0c567bb2ab13971800a04b49085df2c6db0294266096e43bb00a5bf0ac49c6532ee32040a1320bd0d59569f80e

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\bun.png

MD5 efbd58498e30d1e08fe58da332eea362
SHA1 036ab6c099a21fb061f2e4a927ff343580b159cd
SHA256 1ba376824ae63cf7c3d687d9b30c7d3abebe00aa2b8c17b0a255bed9c712ecb1
SHA512 ccf9d1a6807008cc3e40ae941703d6c4c5e25b71bac0af71e0b83efd761eba5bcbb2246d6dd7b0f8ac4409376cc0de1de59eb54475c0f62eaac7cdf85685476d

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\root\ui-strings.js

MD5 48c23e5444db6b0cbd58e0fbf29c9f34
SHA1 d697e1e6fd1153825e62fcc942b7793ecfcf6453
SHA256 9ec00698f49d44b76f84fd833d2950509cb513e5b37153dd38fa38070198595e
SHA512 51636afc9705e16a121311708ba0c8ac19c22f0c1a87a3e7f104a91bb8d5c7f63a62082720b0482204c761b8e8b01b3cf1679fe31c91879d7f42e7449051d2e2

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\es-es\ui-strings.js

MD5 5dc7473166ec8cc7de8364dd304ee2be
SHA1 bc74d2cbd3e4d898d89148816e090b2057af247f
SHA256 8f80d897600d4d22baaa3093cb0a1a5c9de0020d4a0f6f6e66568760c1a0adbe
SHA512 8d8597f85f8783cf48d8f6845ff73f2c3d3ff93b1a77c5e868100f46a71af8946758ba2086e678678560d50062425c2583dcd5565f03725e8c31480795e0e907

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\root\ui-strings.js

MD5 9f3cabe0cf317a984d178ad0e7b5d866
SHA1 d23d57d051a204394c19d82f2ba4f12856198c7c
SHA256 a49842120e34a87a10505843f69c89d53f69c01e7842452e7566a5385e887d8d
SHA512 4b3af6fc2cb26d8d6d5f7390d65d4d8d202c7b50d23bfd7494cc84d6bae0cc4b360d63502b9776f1d3e839f56a6853ad434ed7ee71022bb864481406470436c6

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\he-il\ui-strings.js

MD5 98f5ee55ec9a8cb2c017ac348e97b3fa
SHA1 e57cdfa77b984d4b10cef6d0c06c3b78300050b9
SHA256 7ec70077ec521f98f85db64a39a98bb570f1fe829d7df2fec47764dd8a04efda
SHA512 a784132b1bc9f777c40366e05f739c4a1abf3c8622a80e1cc9f823cd562f2bc1b95e11772b8ca4891b187647ccfd280e648f85c6c0a33a7a75a0fac502ee69a0

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\root\ui-strings.js

MD5 1db538bb44bf9dc7dc28444b25939777
SHA1 f01562f74475b9cb882ad71869733ea157d0abd4
SHA256 a7be22874385fe5508635ae64521e17e923e32006cf413c126e6b5f9ef5eb023
SHA512 c416952b2feae232e9cf0a73a6f0479f9ce33c5ec437a327b8fb3338f10ff6e972fcc465b666e17dccc9de606f9e472896e74df447275ab5388133284f180e50

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\css\main-selector.css

MD5 f6048c3bb8d9f9ab3308cc72cd70c6d7
SHA1 ac76894f9534da978227927945119201f52416cd
SHA256 a99c76b7659d2081a6c4835110da8228083ada93eca7503a1916c2dbd0e5339b
SHA512 8922cd616c58d5c2999ef2cc40f505075e1e0e80ccff1254837355f8d22c37e1c4d89797b96a8c7d9287462c1d04dc6d2d1d2c9e3e5f5f0f3cce9ef12617336a

C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_US_POSIX.txt

MD5 199853ea110b1a41ce57553d3cff089c
SHA1 8a96423b6f95bccd82659873d2363ae83128b1d7
SHA256 ae8e79915cefe1b1b95e00fa907815fa0a594fc5a082b0f14072f46c616f47b3
SHA512 7862b762083fd73aa88573e94174a942998f9fb5528632fcc034ae1bd66965e81bf6158d6711bd1b96f7127113ba2d109c7a1f8bc031074e0594ff2faab8f519

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

MD5 6d92ecc06a21a3cd2b4979ef54ad1641
SHA1 82f2cec83b3e13d1d47c7faca8b4612799ad705d
SHA256 2425ec8f342627eda8100ab7a9ac3d86cc7796de5d976896dd0ce37b0e73a250
SHA512 e27b042dec82d5fecce8b79f1241b0864ce240fb43441de887491823fa3510e84ded498ffcc1d6aa47838149d015f274d4a3c4ecd7e7f141cb6db8f3a5c9ef89

C:\ProgramData\Microsoft\Network\Downloader\edbtmp.log

MD5 ff057e6219042caaf1a7a1b77f84a8d0
SHA1 6422ab62c8e52e50e27cda885b58d62412d4b794
SHA256 6b05f38f35d9f778966f90d05565e9909a18b54e3739b409d326c4ca860a1c8d
SHA512 74047d4c9b7b662bd95c22d5650414c66803e4ef7d74c1e46fd7922bef15381bdd6e95838620428b2385cedae55e09a2995b89b1a3f5e9c1945b8e1fa4318f7f

C:\ProgramData\Microsoft\User Account Pictures\Admin.dat

MD5 8f5727278e9092a520f58bfd3584929f
SHA1 7e1dd45b1c252cd39ea207e4b5d4b717ed08d19b
SHA256 6ee9e14f99e61da40d31a15722842cd5b8ee5d22c2aa2c8c37ed47ceb67bc113
SHA512 f5e782e1724eeadc1816b3a8b5c059d162d8fe20b1da1afad4ff1afab3b6e5b6aa63e09a8184568f27b87f643132c7403d8a19db350a654d6984d29040bde18d

C:\ProgramData\Package Cache\{662A0088-6FCD-45DD-9EA7-68674058AED5}v14.30.30704\packages\vcRuntimeMinimum_amd64\vc_runtimeMinimum_x64.msi

MD5 2058237f0505d844c1c708ed0550f5cf
SHA1 a0daf31ac4635adf29f818d4d6e8321a4de45acb
SHA256 8a4f4bd84b93ba7b8982691d709ee495b890253b330dea808cc6def9790e8b6e
SHA512 ca75fc6777cd045c25608aa1f50a79aee26f8077ec135622b7ed383839588b5970d1f2fb094313301bdf35342e1a564fbcfca7546ac7e3dc5f7f8c68acce8778

C:\ProgramData\Package Cache\{C7141A99-592B-4226-A4E9-B767C1D0FBAF}v48.100.4028\dotnet-host-6.0.25-win-x64.msi

MD5 c8452d00ad7a3523525b6980395e6eb5
SHA1 a1b51d2fa3c04602ef5d42c868daf8761e848f99
SHA256 7012f0cfaee579a26bcc92c2fee2a7c75f30acf9ca5ea61dc1849e838041e6be
SHA512 ce2ec47ee35ab8f5612c0ca7175ea433148a7d13bca63c9df13fe32a90f0497dd111e15e9d54525904ac9cfccf727bf3fb355e8af3349891ea213f701f069dc6

C:\ProgramData\Microsoft\Windows\Caches\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db.busavelock218

MD5 338d9e47051302fa4c1ad2f3212c6e86
SHA1 8bccf1ba79da7f886248e001b3d5f0554bfbe8e8
SHA256 dbfc906f7843e593bb3624991d547fa09a67de85af6504ab4b178bd699270485
SHA512 324249cfe5ee9522b5b45c31f83343d66b2d02cdbfd39fc748a46677555a305c2381027fd378c3a688a7d6baf964100c7da957ba1e05d99cb7fca7b7e8b4f6c1