Malware Analysis Report

2024-09-11 01:45

Sample ID 240227-wk2m6sff56
Target d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.sample
SHA256 d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae
Tags
medusalocker evasion persistence ransomware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae

Threat Level: Known bad

The file d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.sample was found to be: Known bad.

Malicious Activity Summary

medusalocker evasion persistence ransomware

MedusaLocker payload

Medusalocker family

Suspicious use of NtCreateUserProcessOtherParentProcess

Deletes shadow copies

Renames multiple (6568) files with added filename extension

Modifies boot configuration data using bcdedit

Renames multiple (5095) files with added filename extension

Deletes system backups

Modifies Installed Components in the registry

Deletes System State backups

Adds Run key to start application

Enumerates connected drives

Drops file in Windows directory

Drops file in Program Files directory

Enumerates physical storage devices

Unsigned PE

Runs net.exe

Suspicious use of WriteProcessMemory

Suspicious use of FindShellTrayWindow

Uses Volume Shadow Copy service COM API

Modifies registry class

Suspicious use of AdjustPrivilegeToken

Interacts with shadow copies

Suspicious behavior: EnumeratesProcesses

System policy modification

Kills process with taskkill

Suspicious use of SendNotifyMessage

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Command and Scripting Interpreter
T1059
Persistence
TA0003
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Privilege Escalation
TA0004
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Defense Evasion
TA0005
Indicator Removal
T1070
File Deletion
T1070.004
Modify Registry
T1112
Credential Access
TA0006
Discovery
TA0007
Query Registry
T1012
Peripheral Device Discovery
T1120
System Information Discovery
T1082
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Inhibit System Recovery
T1490
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-02-27 17:59

Signatures

MedusaLocker payload

Description Indicator Process Target
N/A N/A N/A N/A

Medusalocker family

medusalocker

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-02-27 17:59

Reported

2024-02-27 18:02

Platform

win7-20240221-en

Max time kernel

151s

Max time network

135s

Command Line

C:\Windows\Explorer.EXE

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess

Description Indicator Process Target
PID 2224 created 1384 N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe C:\Windows\Explorer.EXE

Deletes shadow copies

ransomware

Modifies boot configuration data using bcdedit

ransomware evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A

Renames multiple (5095) files with added filename extension

ransomware

Deletes System State backups

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\wbadmin.exe N/A

Deletes system backups

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\wbadmin.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Windows\CurrentVersion\Run\BabyLockerKZ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe\"" C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Windows\CurrentVersion\Run\BabyLockerKZ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe\"" C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened (read-only) \??\F: C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Notes_loop_PAL.wmv C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.model.workbench.nl_zh_4.4.0.v20140623020002.jar C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105530.WMF C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0212953.WMF C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA01358_.WMF C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\nb.txt C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Matamoros C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0216874.WMF C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\TN00217_.WMF C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-heapwalker_ja.jar C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\MS.GIF C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.ui.nl_zh_4.4.0.v20140623020002.jar C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Mexico_City C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Volgograd C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BOLDSTRI\BOLDSTRI.ELM C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00165_.GIF C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\EN00006_.WMF C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationRight_SelectionSubpicture.png C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\rt.jar C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-api-caching.jar C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-profiling_ja.jar C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File created C:\Program Files\Java\jre7\lib\zi\America\Kentucky\How_to_back_files.html C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA01066_.WMF C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0152696.WMF C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA00523_.WMF C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\TipRes.dll.mui C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\bin\setNetworkClientCP.bat C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-output2_ja.jar C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-swing-plaf_zh_CN.jar C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLUECALM\THMBNAIL.PNG C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\REFINED\REFINED.ELM C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Orange Circles.htm C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\add_up.png C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SONORA\SONORA.INF C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Trek.xml C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\vignettemask25.png C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.VisualElementsManifest.xml C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\te\How_to_back_files.html C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\slideShow.html C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0187863.WMF C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\GRAY.pf C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.directorywatcher.nl_zh_4.4.0.v20140623020002.jar C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\javaws.jar C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\How_to_back_files.html C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Santiago C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Dublin C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Spades\ja-JP\ShvlRes.dll.mui C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\requests\README.txt C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\plugin.xml C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\main.css C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\en-US\sbdrop.dll.mui C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\TTS20\en-US\enu-dsk\M1033DSK.IDX C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BL00152_.WMF C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\How_to_back_files.html C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Singapore C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0195788.WMF C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-applemenu.jar C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01152_.WMF C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\meta-index C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01745_.GIF C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Reykjavik C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ICE\THMBNAIL.PNG C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00004_.GIF C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BABY_01.MID C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Logs\WindowsBackup\Wbadmin.3.etl C:\Windows\system32\wbadmin.exe N/A
File opened for modification C:\Windows\Logs\WindowsBackup\Wbadmin.2.etl C:\Windows\system32\wbadmin.exe N/A
File opened for modification C:\Windows\Logs\WindowsBackup\Wbadmin.1.etl C:\Windows\system32\wbadmin.exe N/A

Enumerates physical storage devices

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\vssadmin.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A

Runs net.exe

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2224 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe C:\Windows\SysWOW64\cmd.exe
PID 2224 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe C:\Windows\SysWOW64\cmd.exe
PID 2224 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe C:\Windows\SysWOW64\cmd.exe
PID 2224 wrote to memory of 2708 N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe C:\Windows\SysWOW64\cmd.exe
PID 2708 wrote to memory of 2548 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2708 wrote to memory of 2548 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2708 wrote to memory of 2548 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2708 wrote to memory of 2548 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2224 wrote to memory of 2424 N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe C:\Windows\SysWOW64\cmd.exe
PID 2224 wrote to memory of 2424 N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe C:\Windows\SysWOW64\cmd.exe
PID 2224 wrote to memory of 2424 N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe C:\Windows\SysWOW64\cmd.exe
PID 2224 wrote to memory of 2424 N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe C:\Windows\SysWOW64\cmd.exe
PID 2424 wrote to memory of 2576 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2424 wrote to memory of 2576 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2424 wrote to memory of 2576 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2424 wrote to memory of 2576 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2576 wrote to memory of 2700 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2576 wrote to memory of 2700 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2576 wrote to memory of 2700 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2224 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe C:\Windows\SysWOW64\cmd.exe
PID 2224 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe C:\Windows\SysWOW64\cmd.exe
PID 2224 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe C:\Windows\SysWOW64\cmd.exe
PID 2224 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe C:\Windows\SysWOW64\cmd.exe
PID 2584 wrote to memory of 2416 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2584 wrote to memory of 2416 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2584 wrote to memory of 2416 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2584 wrote to memory of 2416 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2416 wrote to memory of 2412 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2416 wrote to memory of 2412 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2416 wrote to memory of 2412 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2224 wrote to memory of 2436 N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe C:\Windows\SysWOW64\cmd.exe
PID 2224 wrote to memory of 2436 N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe C:\Windows\SysWOW64\cmd.exe
PID 2224 wrote to memory of 2436 N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe C:\Windows\SysWOW64\cmd.exe
PID 2224 wrote to memory of 2436 N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe C:\Windows\SysWOW64\cmd.exe
PID 2436 wrote to memory of 2492 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2436 wrote to memory of 2492 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2436 wrote to memory of 2492 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2436 wrote to memory of 2492 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2492 wrote to memory of 2328 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2492 wrote to memory of 2328 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2492 wrote to memory of 2328 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2224 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe C:\Windows\SysWOW64\cmd.exe
PID 2224 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe C:\Windows\SysWOW64\cmd.exe
PID 2224 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe C:\Windows\SysWOW64\cmd.exe
PID 2224 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe C:\Windows\SysWOW64\cmd.exe
PID 2720 wrote to memory of 2368 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2720 wrote to memory of 2368 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2720 wrote to memory of 2368 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2720 wrote to memory of 2368 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2368 wrote to memory of 2396 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2368 wrote to memory of 2396 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2368 wrote to memory of 2396 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2224 wrote to memory of 524 N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe C:\Windows\SysWOW64\cmd.exe
PID 2224 wrote to memory of 524 N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe C:\Windows\SysWOW64\cmd.exe
PID 2224 wrote to memory of 524 N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe C:\Windows\SysWOW64\cmd.exe
PID 2224 wrote to memory of 524 N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe C:\Windows\SysWOW64\cmd.exe
PID 524 wrote to memory of 776 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 524 wrote to memory of 776 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 524 wrote to memory of 776 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 524 wrote to memory of 776 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 776 wrote to memory of 1084 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 776 wrote to memory of 1084 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 776 wrote to memory of 1084 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2224 wrote to memory of 1416 N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe C:\Windows\SysWOW64\cmd.exe

System policy modification

evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe

"C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe"

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c rem Kill "SQL"

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c rem Kill "SQL"

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlbrowser.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im sqlbrowser.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im sqlbrowser.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sql writer.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im sql writer.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im sql writer.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlserv.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im sqlserv.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im sqlserv.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im msmdsrv.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im msmdsrv.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im msmdsrv.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im MsDtsSrvr.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im MsDtsSrvr.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im MsDtsSrvr.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlceip.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im sqlceip.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im sqlceip.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im fdlauncher.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im fdlauncher.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im fdlauncher.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im Ssms.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im Ssms.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im Ssms.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im SQLAGENT.EXE

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im SQLAGENT.EXE

C:\Windows\system32\taskkill.exe

taskkill -f -im SQLAGENT.EXE

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im fdhost.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im fdhost.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im fdhost.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im ReportingServicesService.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im ReportingServicesService.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im ReportingServicesService.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im msftesql.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im msftesql.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im msftesql.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im pg_ctl.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im pg_ctl.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im pg_ctl.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -impostgres.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -impostgres.exe

C:\Windows\system32\taskkill.exe

taskkill -f -impostgres.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop MSSQLServerADHelper100

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop MSSQLServerADHelper100

C:\Windows\system32\net.exe

net stop MSSQLServerADHelper100

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop MSSQLServerADHelper100

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop MSSQL$ISARS

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop MSSQL$ISARS

C:\Windows\system32\net.exe

net stop MSSQL$ISARS

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop MSSQL$ISARS

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop MSSQL$MSFW

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop MSSQL$MSFW

C:\Windows\system32\net.exe

net stop MSSQL$MSFW

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop MSSQL$MSFW

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLAgent$ISARS

C:\Windows\system32\net.exe

net stop SQLAgent$ISARS

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop SQLAgent$ISARS

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop SQLAgent$ISARS

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLAgent$MSFW

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop SQLAgent$MSFW

C:\Windows\system32\net.exe

net stop SQLAgent$MSFW

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop SQLAgent$MSFW

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLBrowser

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop SQLBrowser

C:\Windows\system32\net.exe

net stop SQLBrowser

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop SQLBrowser

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop REportServer$ISARS

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop REportServer$ISARS

C:\Windows\system32\net.exe

net stop REportServer$ISARS

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop REportServer$ISARS

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLWriter

C:\Windows\system32\net.exe

net stop SQLWriter

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop SQLWriter

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop SQLWriter

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c vssadmin.exe Delete Shadows /All /Quiet

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wbadmin delete backup -keepVersion:0 -quiet

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c bcdedit.exe /set {default} recoverynabled No

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wmic.exe SHADOWCOPY /nointeractive

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTABACKUP -deleteOldest

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTATEBACKUP

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTABACKUP -deleteOldest

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c bcdedit.exe /set {default} recoverynabled No

C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe

\\?\C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe -network

C:\Windows\system32\bcdedit.exe

bcdedit.exe /set {default} recoverynabled No

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c wmic.exe SHADOWCOPY /nointeractive

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTATEBACKUP

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c vssadmin.exe Delete Shadows /All /Quiet

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c wbadmin delete backup -keepVersion:0 -quiet

C:\Windows\system32\wbadmin.exe

wbadmin DELETE SYSTEMSTATEBACKUP

C:\Windows\system32\wbadmin.exe

wbadmin delete backup -keepVersion:0 -quiet

C:\Windows\system32\vssadmin.exe

vssadmin.exe Delete Shadows /All /Quiet

C:\Windows\system32\wbadmin.exe

wbadmin DELETE SYSTEMSTABACKUP -deleteOldest

C:\Windows\system32\bcdedit.exe

bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\System32\Wbem\WMIC.exe

wmic.exe SHADOWCOPY /nointeractive

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c pause

Network

N/A

Files

C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\How_to_back_files.html

MD5 54f660bcc5f320a797ea1083a986bb3d
SHA1 95819a4065ea6f0fbecd4dc45ee580c6337d704c
SHA256 1b6e158b6e6c9785de1a9377170e43eee6e26f36a54a1128addd70f5edb9dacf
SHA512 3a554a19a0c799444a49f6ae04d4f4d2383f924c2f2ed4f95c4b8122b15d1dc0484e82315799277b578777b0738dc0a4731813d9d1986cdda9cb9469495e2dd4

C:\Program Files\Java\jdk1.7.0_80\db\bin\ij

MD5 ebe28cdce9332a7cfc4cd6373c67302d
SHA1 c95e119ceb43c52d58545163ab2081d7e4fb039b
SHA256 2073aff72b956593ac1e0f496f8d8d63c6584c6e79c6a074543b17e8dbce32f3
SHA512 413d11b8c8aea623d207532e85ac358111503a5cf38b739d1c0cf4da50cf5e6aa5375b48830db50f34ce86c94589c9d054351b4cf60a10e86dbd40f6131e3319

C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif

MD5 f4f5380e3364d441ccbb3a8c59ced2a5
SHA1 816e682e9bfc722aabc35fd4c82261cc366e790c
SHA256 dfc1728378bfa2ab0b6b5bf7584f2d534187dc03abd9fd61dd59b19d70b9a187
SHA512 c2add2e19abb723c179fb94ab526cb5f0bb5a05d40362be749c0b416fb77c80da868b21f4bb72217a11bfe8a51efc7895d37e1f509d9b23343e4fba8b77f4941

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\UTC

MD5 517e2a53339de2c685d6bc1dad2f170f
SHA1 6315747a0a2e64b5a5f4b2849b31353e422b1e2d
SHA256 457d284516838a5d1ca5c8ffd6ec1399935ce1e0e6678e9cb5b85f7efa298cae
SHA512 9bb615ed24efa1ce68dead5673d3b002b05f81a988171c5066ccc3bb9f5aa462796aa50f579067817ebb4ddce7c61b96d8a4aff145163ee537e023e007e5d933

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html

MD5 390347e3bd72544d55be66c9af6038a1
SHA1 ed96dcdb76cbaff11390fc189074dd75c27061ba
SHA256 41668b2ab3c311f200c22d70f3fcad3281eb81b52d87e51f05463249b652f16e
SHA512 bbd19b77c0cca4b59cc5755bb2f47ca300f5945c74e54f4d057d58267cf08f06ba9b3e1aa4f56b092da25536ae5592796f1861689e26674b87acfa65c52478d7

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html

MD5 77692dc749e2c0d5f32d5b671456b8ab
SHA1 e836b260f3b6db5ea98007a6768460d586f59e2f
SHA256 2f7f241d42f6589625ada3bee5cbede2caca906c4f5355a5824c47621a240977
SHA512 8bccfe664084224407370663b5b1e725519ca279f2357dd79fecf50de23e5c8cd007a0bd70c3bd2f1a2f5e6e86558d22be50bc26b5c76b4324e425871312ba32

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\eclipse.inf

MD5 ab1241256a5ac47829b2d64e23245a97
SHA1 43661f335e1e82795164f3b7aba27c072e93b1f0
SHA256 bf2e42ec4f258d472126c415f956bb97e8aa504653c19aea631cd3bc74b4816d
SHA512 46c41ef761a074f1cae95a74a7d414b5f55d5a8d9441c16df7693da6f95ee361384415e9f15d063f9ca06ae3a6b004896263492db847aba1deb8846658a3ace6

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt

MD5 4d427054df5b9e9ed97f86ff78a77a6d
SHA1 7881485e63e1305d2a382d17ab6aa58029cd1968
SHA256 bea35f1ca59551b05d689b8dabba90bdb07d7b4226f29148d8dd673b4675769b
SHA512 ed0fae4aebda5f01174ee7c3aa757c5fd5ba3701791d77b1a803f3ad7b166fde0c1ae03c226c597e021a0fa8699454f75040a03d99a40f9c1d3721a344e20c8b

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.RSA

MD5 feacc681cdd08031bfce69546d43c2a7
SHA1 e800e3840f49b46e0f0437529e66f4f8660f6200
SHA256 ccf52fe9a7debb9b1168891a7a134fb32614e35d9c6bd69304f11e15c5ad9793
SHA512 c0b9ac87a2d3deb63d48bb3f457ce00166d0f50e05a7a8827874a90950f94d0b9c8c848a9c01d325671c618cc69cd2cebc15c59eacdd9184376b4bce3e6944b6

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\ECLIPSE_.RSA

MD5 8d8e53d28ca27595f4579c8f517142bd
SHA1 97a20449c6caa3e750504b4b86c64301cca02ab4
SHA256 f3f37aa2c6dc864d82814d414753424671922321c6b884d2a02c0e214421417b
SHA512 e913351f14c67feb43ad5d31aef325a166452bc459f70dad38c15ccf17f58d0a646e64ab7af1bd3f515a9f65c50451cbb78b0bc44161f8d57d2a54997977d448

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\epl-v10.html

MD5 b4b02d363bafe8f1c0220703ab05671f
SHA1 e7d68a609a5cac05700e9f7366b4068bdeb18de4
SHA256 dd7671e5e760a94e5c189996e39b3ae65f9f9de8fccc260a72a0d861636a9d1d
SHA512 747977d4f45a2d9ed9e8ff3465df9e187c671a7a4311eb886c6e0201fc25decfca8b047e1bf9bf18bff324b46d0cce2538f485b24253b9b5aca60e9c4832999d

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\license.html

MD5 3540997d2246b1b1f50742215f7c4676
SHA1 94fd06df7328fb330851921f64fbc396327daea5
SHA256 104aaf0cae574b3c0ffce6e7fe4d24149988690e4b92e3392b07c12304379996
SHA512 102318ec880ef42dc6084869b0c19b4558323676e965d55a9a7baa376a99e435a9864784523491d68153c2c1a5420dc24d5024af8033b5401901d9891847ac1a

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-api-visual.xml_hidden

MD5 d896b6f76716aea451b24c9fd819a0d0
SHA1 f7c93f4444a478eb0292158547b96c10c134c80e
SHA256 045f20119eaf5f6413264b069156de8ecbc44b1b6de2b12513f8b64ce240a384
SHA512 25cda3b7c7d984b87016b318f39d1e0a121165cada1d9e16ddf20fb3d775db1afe1f8805c568515c1b7834b8fa1c676bdf21b807805e8db53dcfb5f2bc71f5bd

C:\Program Files\Java\jre7\lib\images\cursors\win32_MoveNoDrop32x32.gif

MD5 f2cf86c07b4fa5d0ad0e57d02d2f4444
SHA1 e4eb22487810ceea725ad44c0d95c7bd2fda9211
SHA256 a42ba7d773df0be8345333bdd803ead1fc7acc8e926e4850d955d90dc1eaad6d
SHA512 c8b0609cdc4704fcfe29d4a02ab52defe1119c9ec37833393ee4595c3fc3f058628654a89fc59965a35308187c4131d4bbd7bd2972970842ca4561675534c89f

C:\Program Files\Java\jre7\lib\zi\Etc\UCT

MD5 28c541590c9ceed8b0ff140cf36411b1
SHA1 7fa5eaebb0db1f0a2132b3289737309abefb1c1b
SHA256 098e7855a7884c470ecb3660e4dea1343f852509734f3367e07af2ad9658666b
SHA512 3602583810a9056f90dcca0b014a10c0fdf3d795bd19777fab09a5dc23b80a81bf4b3be9e32482fb20516781ff69d5b27841ce5dd24240e8ea8475ad4adeaeea

C:\Program Files\VideoLAN\VLC\locale\ko\LC_MESSAGES\vlc.mo

MD5 52c232520dfd56a735a214dcd265e1eb
SHA1 b079350bb278c4b70ae1c788d961d5370bce06ab
SHA256 f5d08686c75b5de010f67da39a26b1f3a48f4e93de57d73f854f692eea416301
SHA512 c21d21fef4481e13e24bac44bea76f592a4236f3e3ab166021992225fe07697cc2f79651aa8b3667eab68c401ec280862b30a317e9c659916206f6f54de861ce

Analysis: behavioral2

Detonation Overview

Submitted

2024-02-27 17:59

Reported

2024-02-27 18:02

Platform

win10v2004-20240226-en

Max time kernel

149s

Max time network

127s

Command Line

C:\Windows\Explorer.EXE

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess

Description Indicator Process Target
PID 4804 created 3448 N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe C:\Windows\Explorer.EXE

Deletes shadow copies

ransomware

Modifies boot configuration data using bcdedit

ransomware evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A

Renames multiple (6568) files with added filename extension

ransomware

Deletes System State backups

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\wbadmin.exe N/A

Deletes system backups

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\wbadmin.exe N/A

Modifies Installed Components in the registry

persistence
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Software\Microsoft\Active Setup\Installed Components C:\Windows\explorer.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BabyLockerKZ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe\"" C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BabyLockerKZ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe\"" C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened (read-only) \??\F: C:\Windows\SysWOW64\cipher.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened (read-only) \??\A: C:\Windows\SysWOW64\cipher.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened (read-only) \??\F: C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-black\PeopleWideTile.scale-200.png C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailSplashLogo.scale-300.png C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TRANSLAT\How_to_back_files.html C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\models\fr-FR.PhoneNumber.ot C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\nls\it-it\How_to_back_files.html C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Retail-ul-phn.xrm-ms C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PSRCHLTS.DAT C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Advanced-Light.scale-100.png C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsAppList.targetsize-72.png C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\zh-tw\How_to_back_files.html C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File created C:\Program Files (x86)\Microsoft\Edge\Application\How_to_back_files.html C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\pt-br\ui-strings.js C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\How_to_back_files.html C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\sr-latn-cs\How_to_back_files.html C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\423x173\31.jpg C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-36_altform-unplated_contrast-white.png C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-white\AppList.scale-100_contrast-white.png C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-32_contrast-black.png C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened for modification C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\PackageManagement.psd1 C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\hr-hr\ui-strings.js C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC_COL.HXT C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\HelpAndFeedback\BlogThumbnail.png C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\PaintStudio.winmd C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\How_to_back_files.html C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\Store.Purchase\Controls\ProgressControl.xaml C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-72_altform-unplated_contrast-black.png C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\contrast-white\MixedRealityPortalStoreLogo.scale-200_contrast-white.png C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Resources\RetailDemo\data\How_to_back_files.html C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\zh-cn\ui-strings.js C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\ar-ae\How_to_back_files.html C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_MAK-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\sql90.xsl C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\How_to_back_files.html C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageAppList.targetsize-96_contrast-white.png C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PeopleAppList.targetsize-16_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Advanced-Dark.scale-200.png C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened for modification C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.nuspec C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_flat_10_000000_40x100.png C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-30_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\ExchangeLargeTile.scale-100.png C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Google.scale-100.png C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\sk-sk\ui-strings.js C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Adobe Acrobat Pro DC.pdf C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-white_scale-140.png C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\EmptyView.scale-150.png C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\hr-hr\How_to_back_files.html C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\root\How_to_back_files.html C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened for modification C:\Program Files\Common Files\System\Ole DB\en-US\sqlxmlx.rll.mui C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_OEM_Perp-ppd.xrm-ms C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteNotebookWideTile.scale-200.png C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\manifests\BuiltinOnboardingCommands.xml C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.scale-125_contrast-white.png C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\Icons\icon_play_nor.png C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\fr-CA.pak.DATA C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\How_to_back_files.html C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Dial\RotateY.PNG C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.UI.Xaml.2.0_2.1810.18004.0_x64__8wekyb3d8bbwe\logo.png C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsAppList.targetsize-80.png C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PlaceCard\contrast-white\How_to_back_files.html C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-white_targetsize-40_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\uk-ua\How_to_back_files.html C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\LogoCanary.png C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\How_to_back_files.html C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\SearchEmail2x.png C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.1.etl C:\Windows\system32\wbadmin.exe N/A
File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.3.etl C:\Windows\system32\wbadmin.exe N/A
File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.2.etl C:\Windows\system32\wbadmin.exe N/A

Enumerates physical storage devices

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\vssadmin.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3270530367-132075249-2153716227-1000\{BF5B8B66-910B-43C0-8303-E3DD9E3031C2} C:\Windows\explorer.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Windows\explorer.exe N/A

Runs net.exe

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4804 wrote to memory of 4260 N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe C:\Windows\SysWOW64\cmd.exe
PID 4804 wrote to memory of 4260 N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe C:\Windows\SysWOW64\cmd.exe
PID 4804 wrote to memory of 4260 N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe C:\Windows\SysWOW64\cmd.exe
PID 4260 wrote to memory of 4060 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 4260 wrote to memory of 4060 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 4804 wrote to memory of 4776 N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe C:\Windows\SysWOW64\cmd.exe
PID 4804 wrote to memory of 4776 N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe C:\Windows\SysWOW64\cmd.exe
PID 4804 wrote to memory of 4776 N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe C:\Windows\SysWOW64\cmd.exe
PID 4776 wrote to memory of 4328 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 4776 wrote to memory of 4328 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 4328 wrote to memory of 5036 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 4328 wrote to memory of 5036 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 4804 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe C:\Windows\SysWOW64\cmd.exe
PID 4804 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe C:\Windows\SysWOW64\cmd.exe
PID 4804 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe C:\Windows\SysWOW64\cmd.exe
PID 2016 wrote to memory of 1320 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2016 wrote to memory of 1320 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 1320 wrote to memory of 2028 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 1320 wrote to memory of 2028 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 4804 wrote to memory of 4500 N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe C:\Windows\SysWOW64\cmd.exe
PID 4804 wrote to memory of 4500 N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe C:\Windows\SysWOW64\cmd.exe
PID 4804 wrote to memory of 4500 N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe C:\Windows\SysWOW64\cmd.exe
PID 4500 wrote to memory of 4080 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 4500 wrote to memory of 4080 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 4080 wrote to memory of 3200 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 4080 wrote to memory of 3200 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 4804 wrote to memory of 3552 N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe C:\Windows\SysWOW64\cmd.exe
PID 4804 wrote to memory of 3552 N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe C:\Windows\SysWOW64\cmd.exe
PID 4804 wrote to memory of 3552 N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe C:\Windows\SysWOW64\cmd.exe
PID 3552 wrote to memory of 5052 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 3552 wrote to memory of 5052 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 5052 wrote to memory of 4324 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 5052 wrote to memory of 4324 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 4804 wrote to memory of 1140 N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe C:\Windows\SysWOW64\cmd.exe
PID 4804 wrote to memory of 1140 N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe C:\Windows\SysWOW64\cmd.exe
PID 4804 wrote to memory of 1140 N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe C:\Windows\SysWOW64\cmd.exe
PID 1140 wrote to memory of 1612 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 1140 wrote to memory of 1612 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 1612 wrote to memory of 3612 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 1612 wrote to memory of 3612 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 4804 wrote to memory of 3792 N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe C:\Windows\SysWOW64\cmd.exe
PID 4804 wrote to memory of 3792 N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe C:\Windows\SysWOW64\cmd.exe
PID 4804 wrote to memory of 3792 N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe C:\Windows\SysWOW64\cmd.exe
PID 3792 wrote to memory of 1776 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 3792 wrote to memory of 1776 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 1776 wrote to memory of 2592 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 1776 wrote to memory of 2592 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 4804 wrote to memory of 464 N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe C:\Windows\SysWOW64\cmd.exe
PID 4804 wrote to memory of 464 N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe C:\Windows\SysWOW64\cmd.exe
PID 4804 wrote to memory of 464 N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe C:\Windows\SysWOW64\cmd.exe
PID 464 wrote to memory of 1616 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 464 wrote to memory of 1616 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 1616 wrote to memory of 1700 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 1616 wrote to memory of 1700 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 4804 wrote to memory of 2412 N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe C:\Windows\SysWOW64\cmd.exe
PID 4804 wrote to memory of 2412 N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe C:\Windows\SysWOW64\cmd.exe
PID 4804 wrote to memory of 2412 N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe C:\Windows\SysWOW64\cmd.exe
PID 2412 wrote to memory of 3668 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2412 wrote to memory of 3668 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 3668 wrote to memory of 5116 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 3668 wrote to memory of 5116 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 4804 wrote to memory of 2504 N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe C:\Windows\SysWOW64\cmd.exe
PID 4804 wrote to memory of 2504 N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe C:\Windows\SysWOW64\cmd.exe
PID 4804 wrote to memory of 2504 N/A C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe C:\Windows\SysWOW64\cmd.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe N/A

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe

"C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe"

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c rem Kill "SQL"

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c rem Kill "SQL"

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlbrowser.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im sqlbrowser.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im sqlbrowser.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sql writer.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im sql writer.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im sql writer.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlserv.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im sqlserv.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im sqlserv.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im msmdsrv.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im msmdsrv.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im msmdsrv.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im MsDtsSrvr.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im MsDtsSrvr.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im MsDtsSrvr.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlceip.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im sqlceip.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im sqlceip.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im fdlauncher.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im fdlauncher.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im fdlauncher.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im Ssms.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im Ssms.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im Ssms.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im SQLAGENT.EXE

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im SQLAGENT.EXE

C:\Windows\system32\taskkill.exe

taskkill -f -im SQLAGENT.EXE

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im fdhost.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im fdhost.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im fdhost.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im ReportingServicesService.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im ReportingServicesService.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im ReportingServicesService.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im msftesql.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im msftesql.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im msftesql.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im pg_ctl.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im pg_ctl.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im pg_ctl.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -impostgres.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -impostgres.exe

C:\Windows\system32\taskkill.exe

taskkill -f -impostgres.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop MSSQLServerADHelper100

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop MSSQLServerADHelper100

C:\Windows\system32\net.exe

net stop MSSQLServerADHelper100

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop MSSQLServerADHelper100

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop MSSQL$ISARS

C:\Windows\system32\net.exe

net stop MSSQL$ISARS

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop MSSQL$ISARS

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop MSSQL$ISARS

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop MSSQL$MSFW

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLAgent$MSFW

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop SQLAgent$ISARS

C:\Windows\system32\net.exe

net stop SQLAgent$ISARS

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop SQLAgent$MSFW

C:\Windows\system32\net.exe

net stop SQLAgent$MSFW

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop SQLAgent$MSFW

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop SQLAgent$ISARS

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLAgent$ISARS

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop MSSQL$MSFW

C:\Windows\system32\net.exe

net stop MSSQL$MSFW

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop MSSQL$MSFW

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLBrowser

C:\Windows\system32\net.exe

net stop SQLBrowser

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop SQLBrowser

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop SQLBrowser

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop REportServer$ISARS

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop REportServer$ISARS

C:\Windows\system32\net.exe

net stop REportServer$ISARS

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop REportServer$ISARS

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLWriter

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop SQLWriter

C:\Windows\system32\net.exe

net stop SQLWriter

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop SQLWriter

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c vssadmin.exe Delete Shadows /All /Quiet

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wbadmin delete backup -keepVersion:0 -quiet

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTATEBACKUP

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTABACKUP -deleteOldest

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wmic.exe SHADOWCOPY /nointeractive

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c wbadmin delete backup -keepVersion:0 -quiet

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTATEBACKUP

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c bcdedit.exe /set {default} recoverynabled No

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c bcdedit.exe /set {default} recoverynabled No

C:\Windows\system32\wbadmin.exe

wbadmin delete backup -keepVersion:0 -quiet

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTABACKUP -deleteOldest

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c vssadmin.exe Delete Shadows /All /Quiet

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c wmic.exe SHADOWCOPY /nointeractive

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\wbadmin.exe

wbadmin DELETE SYSTEMSTATEBACKUP

C:\Windows\system32\bcdedit.exe

bcdedit.exe /set {default} recoverynabled No

C:\Windows\system32\wbadmin.exe

wbadmin DELETE SYSTEMSTABACKUP -deleteOldest

C:\Windows\System32\Wbem\WMIC.exe

wmic.exe SHADOWCOPY /nointeractive

C:\Windows\system32\vssadmin.exe

vssadmin.exe Delete Shadows /All /Quiet

C:\Windows\system32\bcdedit.exe

bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures

C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe

\\?\C:\Users\Admin\AppData\Local\Temp\d9de562ac1815bf0baad1c617c6c7f47d71f46810c348f7372a88b296d68cfae.exe -network

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c pause

C:\Windows\explorer.exe

explorer.exe

C:\Windows\SysWOW64\cipher.exe

cipher /w:\\?\A:

C:\Windows\SysWOW64\cipher.exe

cipher /w:\\?\C:

C:\Windows\SysWOW64\cipher.exe

cipher /w:\\?\F:

Network

Country Destination Domain Proto
US 8.8.8.8:53 74.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 180.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 167.109.18.2.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 57.110.18.2.in-addr.arpa udp
US 8.8.8.8:53 196.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp

Files

C:\Program Files\How_to_back_files.html

MD5 a8851a93a70303f7b952ba726d122a0f
SHA1 c1e40800ca11d53ada68574238ec274fb8a9d762
SHA256 afba7ef5b4038745436c4af85f2c152460a15f849096cbcfa9f11c3f1bf63b90
SHA512 e91cfb6eb9c1c3f58ecd665c12894c9045a86c00b883b2cbe8aac032a52e16e37b6d0c9a377d24f5c27401277759596da5b737f8a6cbcea8dee78e65e7cda2de

C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\invalid32x32.gif

MD5 49c80debce6c1320d4f2d1dd5115144a
SHA1 7b65b7a72c42b1600a68d89a4bb731fb243eaeda
SHA256 cad59724c94b1be07e3065f915c757fa27cbd06f4f3838a8a73c513298430c98
SHA512 a7f88921a2f9ce233dfe810af9f133f719df1a035e4d734d15f21c4e552ff221a7259b41ec3104323d82ae819e14c23c0f5e1d686ae6bfadab0749eae3e50243

C:\Program Files\Java\jre-1.8\legal\jdk\asm.md

MD5 bc0c10796a6505492a73f833ce641bd3
SHA1 41694f899b183e36b85fde91226ff0504a9eb8ca
SHA256 6254d547465995b2eaa91fabfb3d1e56fb0b30f7e2b9bbf918fdb91771cb457c
SHA512 5bf1cd4298abcfa0996fe38d104bbbba9c056876f8969bea52a4cbc9982e4eec8778e31e597af2276fdd95aae476711be40ee946fabf70a73d3a9b65c5ec49c5

C:\Program Files\Java\jre-1.8\legal\javafx\glib.md

MD5 9983c843cac99d6f433459300fd27100
SHA1 800db781abde1644a7906d6fd9de8d042e993e6d
SHA256 e63fc5ab5cec0d9773869efda917fc0391e221dd5f6bca6d897744935bb57ddb
SHA512 c9d987588718bde9261ee16860186fe24c5f8925c5c7340f3a769a1e2798102da1b5fc6063d6d692f642621155665a60ca453c8e3258c032d3e53056a05a2dd6

C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md

MD5 15cb85fb88bdd01a0ad0072ea5b6ba49
SHA1 11808c3dba1383cae879592a214d8ad8ae8e0090
SHA256 02897763b92a818aab9cdd66466013f1c0a1193495e260d46facf0d3ece40f91
SHA512 2cdfa88162f45727e870c1fa4a3f803dd42a3579de9a3dc29900b9754f85a16cae5d0e47c9d0c8a56cba440e08cd0dcaf7a26f3d8a27568868c9834ea4a6fb99

C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md

MD5 5fa88d708deb41b82b56b26eb6ab7959
SHA1 c89b307f438a4514a431039adcfd96e6ad4bbc6b
SHA256 d80bfb564bc3075a01551778993de767a53035a1c9c7a52d6b42b82503ce0feb
SHA512 9159726ce2820540441a034e9c4583e9efc035be35df42f093facb91d052b2cdd5b806142bd58061930133959ccdc42fa85539c72d20486d3004db58c258a129

C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md

MD5 22ebfa2cebc4a195e92157950b829e57
SHA1 5ed8d153b62b8741cc1865ba04fecca0b399e16c
SHA256 ed6fccd3a0fcb11244ef5a4041ef12d969b95c0588cf17208cbbdd7409be0f59
SHA512 d2a15e1fb3801ecb026813e7a8d278bbdd32e682e77d668359124f6114f8830eedb5bdfdb0bdd14c040f4b2f1f3dfae2e783b557f380296c216297f86eb8496c

C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md

MD5 919a5dbab3b3fb014b83017c1e72cdb4
SHA1 888bbb192f388716df77466c6ac53a89fbf98470
SHA256 2fcbfc60fa8536f89ec10bc55e95dd31864b3c7cc08abdca5590ea6474855c9f
SHA512 0cb22f7d84bf5aaf84df2525a1e428fd83f66c7dbd3be32d92a9e0aaba69c3c377faf07ee739c86d02c01d6ffc0e2538a44308b7221dca2c256716acbe9bae56

C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md

MD5 dc4086fee7219edebee7d54232ea694b
SHA1 fbaf9ec517d28bb50fcd51b220d19e94507fb964
SHA256 53e487a540e5cbefdd2285c1b6045d5f0534e2e4f054fc0ee1c908e4271945e5
SHA512 03091e7443a3477b87219bab876c7b4218a83b239f7966d769d79391fa386ed1aec3c8a23268286b179032bbb90a8f0d2cf8dd6628b39e53209c21665e476457

C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md

MD5 391b897d9f3f064224e51f7d3bedd946
SHA1 8a39125dd136adb007faeeb389768f4b5bed4746
SHA256 d219e1f79676dc55138037a9bdf9d917f1d55fbf8645ed0e538ffc929d7727b3
SHA512 c55fe73bfa16977d9c1c6e35ebe8d6b81ffa0d258c74c3192e6efdb21acbed8513dd37a9bb02e77a799a199d5160d802fb28a7ba112a5e2cb6948f46cbf519bc

C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md

MD5 3bf4f1e79ea97a926bd2df96e69d1798
SHA1 bb01900d927807dd03679dad8d251cc66d2fbc16
SHA256 cbcbec45a3f06f7dc85b555bc306e3a709ee8972d0a4ded88f060be2c1dade72
SHA512 b114d586b7a84ecc9fde4129240c5120fe68a5d5f90c70127909721c8f29e6ad78f8c70ef8f21c69be2d0db95d577cceec7da25e1bdfba8da52d62988d357d34

C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md

MD5 481e45bb328eb2a07bf64ca52c8e223a
SHA1 ab1c1f26e739f6c38c324eab2700a4b966adcca5
SHA256 bc86d15bbf34a0006ab29f95109537d5db5cadfd90d2322adbbc28c7014de9f5
SHA512 ea05dd92b6ec5ceca065a3cd0572be6e16036c6475812ffb08c45f9b34cfee9ce4f8c9d765687b549e6ed0748f26e9cc3d6233a5621faa26eda3d4b6798f0615

C:\Program Files\Java\jre-1.8\COPYRIGHT

MD5 1650202e8c1fef407560152947e59bca
SHA1 80ac6745d32fa59a3ccd7f98f8574378fe5846e4
SHA256 eabc948077a92bc09eaa81c3c7f53cd5cefef61d0de3b0c27c7e48b2e05ac1ea
SHA512 623ff8b9951c16ab99443a3808879361565ec08eafa15be32eded791175750b273b8d1beb9b05d3cc9e3cc2d6aa0fd6abeeb8dd8836dac5c7e508fed5b7d5a05

C:\Program Files\Java\jre-1.8\legal\jdk\dom.md

MD5 0f9bb1a078c8dfc02e3228d1088cae95
SHA1 637bee07eb4b20d257ad47ffbd377c567f11a6fd
SHA256 86d3261e9b7a54b51dc971d84fba08542a0a9cdc9688741235f9bdb30391c650
SHA512 1600490c0b0130c904be7de7efef9e05b5a539722e53768cbc8d944944b0eccb35af0fa8a310cb0ecb6725cda8b744a4624f33bcf738f9f59c1c9dd3bd622373

C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md

MD5 03db0ef9923a176b9e2364f016e01c84
SHA1 86b4424d54838536e8392039bdb5779f87807dfb
SHA256 e7c70396142e8865d0e67689c3f05c84140a649bf4e4b80127f8c61c3beef698
SHA512 047c70a64b9f7039915c86ab5fca65b2b5f4131391648eb12b3ea9a3860ea13f3d130e87ee9b1b11939f7096c11f1bd52c7b46c9ff6d6312cabafd1f7eada018

C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md

MD5 c8344638b29d5ea7027e86708c97ef83
SHA1 5d5b978a0e7d9687780a20263ae873ceeefd36b4
SHA256 4d68e649940ff45edb812703e578be2ad95d2833f0087059e6fa6d6c717a1c38
SHA512 cbeca079219403722bf7ad190c0aeac2ca9299c6c91b8a94d43738cbdad532e64994547769bc5b8eed01d3a8573df26ec6346112789a95f62f8dfa0301eb9d28

C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md

MD5 cbc847d9dfd353cfcc15441f83691457
SHA1 ade3e309cb81bd6567047b6188802a00d7a33f91
SHA256 c6d5871fac9217c299080151b02b505d3c88d4d55f9f1f5f6525b98eb36651ff
SHA512 54a74526ba795eaca18ffb74ce9a42d47d2526a92c187dc66477080eab40d6eda3950ae44eb68a61d4c43310616b7b221c8cfddc0a4e50d2f244b64ef8c9fdb3

C:\Program Files\Java\jre-1.8\legal\jdk\icu.md

MD5 90ed5e181a9a7e2fbad19a51513d97e9
SHA1 5fa6e57f22243ce7cafb0b8e1bbf1414d655f101
SHA256 94c9eae40a48f70e47122d3e9333e207342f1a79cbb7784c9927c7edc85b7f6f
SHA512 bbfe31f443e579386c59018176b6496d663e63547fc0c78bcba59133826bb1d072348d4f9ec57920f1e7ab87273963d08499a606ebf467e21fba131dcae08473

C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md

MD5 7d9bb3b2c1432557366354674407b153
SHA1 76da10641bdd2a4d40719ec2fa757ce1d7c7257b
SHA256 65df744f5c42c1ceb659e85edfa0e5ca0163c84ddb2b2d590553a0a70cbabe52
SHA512 626c8e8f10f9f16a9648ededa7ec04f975d2d8a154777356a8bbd717dfd1a28baab42fd06b6ca111adc9df7024a820075af92f5a5032958207db2067d6a28e83

C:\Program Files\Java\jre-1.8\legal\jdk\joni.md

MD5 172804fe586531905f96006920384819
SHA1 c0796e590bbfe8466126475f068d573a5808697f
SHA256 d9ace5444378f93bd03f21d41614378c76dce9718c4b92bffe08223b7807d2e2
SHA512 eae99690a189f9906b383622e9138113027e85019e695ae9bbf048945436c5f837390d060305c351fee2adac63344c87a4bd8d1318291d30a523135c3f099fe8

C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md

MD5 79d2748630d4aeced641ffbe0ce9df80
SHA1 b44c64447b6e5e7415c0c676cf91b02c24a2b12b
SHA256 428d9427aa342b47a1c88bbdc83d1c4bb66b6dc635befffd8bdc12cfcb1c5781
SHA512 d853f126b4d936393fd39238f9049211ab53d07e2c322eaf9b3f159ff3fe843e74e5db3a54cd0e03c95957cbc1e0880bd1a9d8364a2e9f7c424f38e86f51954b

C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md

MD5 d0bdfc2a14cdb1955e39c833b81e4485
SHA1 5b55459d17a2a16e8592ab8f11823ca73a2f68c3
SHA256 b75d74b150562e74b104346fde689fcfa994982f80f04c6b17d299794e63298c
SHA512 2b062144a5a75aaa84a834e04c0ca5dec42ce593fb31a849fc709ffdd37cd9dfd6a11ef0a3b1f75c72797756d04f3e7f16a508eb5b5b1e9fff5f3e2fc6966310

C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md

MD5 21631a2c0f6a2ac809a78986933754ad
SHA1 e390b732f17d9200348176222db51db204e42e85
SHA256 de66b0305329921a856c66fd64a32d990b179f68b8565c8ba00c9d92cd598f55
SHA512 2c407c5dfd994f3475c1abc90b3e889d8bf1a1502d5dd14ee737c605ffc2af28b4a7d66fa2e6a0754ccaff482b513fdf24a9d3e468cc4586f21a79de30bb6fbb

C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md

MD5 1519a1052d5be972b0f9c7992ef6185c
SHA1 be4b3088f2c6cc948cc85338aa41161c3c12ad1b
SHA256 2ea2425fe1b40ca1606e9ea4add72e62febee598a2e8dfe25195f18def2cf580
SHA512 c38574e8289f6b363988aa8f01431fc704f1e7697689c3a874be5f6f2961e31f08e06c2842a2e42480e93259191dbfe6052fc4be02c5c33bd0df9432c36b4a9e

C:\Program Files\Java\jre-1.8\legal\jdk\libpng.md

MD5 d0a735f0fadfbc2afaf53dc1ae10f341
SHA1 a9d6247ec1a9b2eed6171613d246642bd5f96855
SHA256 43c59a62533bbaee08917effcdf139c37d642055cfb9a3bb6de7aa26d8989915
SHA512 89cdb5c35c6d233c6624883a3c01b5f8f9d1b9bd7daaa0c82a9c128af76ff21cf1c1d1612cd1caa4c61be3e40db1e20b059daecd0ec18b0cf4f7cc878247607a

C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md

MD5 32b59c790027a029d0a4a8268e68ee79
SHA1 cb82d27fcfaab4faf0ebe5daee1c07424d8b1c3e
SHA256 b8c6f6eccef18488980f8716d71138449f99a8873b6448f6574bb996bb59d44d
SHA512 d1d92cbc5bc59de77dc931f481851d41a385db7a4e1886a40e575ca7afa7d45eb5dc0bb85d255ead7a0ebefd27192e3f694b4f76f8aba8751f292cf35b75ec0b

C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md

MD5 77aa54efa6f59349d709cbb8d1fcfe64
SHA1 42044b59d560fdc4700c985a99d8d73f8126410c
SHA256 4dd8fd1d5b282f910cb8b8591e82d2ef5b77c0a6cde3d1c4f1e2d1184df30c3a
SHA512 a9d91871dc8c629f86a70f4bda734c69c5b44473183d263a188f61aa78b81652161a0ce3adc57d9473044e06e300563ed0f4f4743297d607ff3efdd4bbad0590

C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md

MD5 d58f1583133d6953db7f9ea97c4c352e
SHA1 b50b01075f800a12ff5c73854c2d3b562bbde033
SHA256 8db7dcd699eb347c4e18b57436f5a2be0e528e2c59d219a41a98b1033e3e4e0c
SHA512 4d3938f8f673cf9a2de5cd839f6211662198f3955bfaf4b728755e29c228949394159369d1a1954284981c8372485948be9d4eb3cac736cd1a5275ede2d5b7c7

C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md

MD5 6a88924d373d1fff869a6cfd4db2e877
SHA1 3e86bfa100faebb5576dfe6b9604169d83953309
SHA256 d8f8c4ea9f985825dc2b8d97e59ff45d89de79c1d3a149f65fcbff200e1ab072
SHA512 667a476f753beeb019d753451cb453624ab3eb05c108f2cca4865e561885934d24aa37683aee3dc9b9beda51bebc0f21a2aeb9b23ce58a6b031fcffbf2a76f0e

C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md

MD5 618373414a8939899195803d12f55c46
SHA1 e71768c9d575c521ce98a2fb0ecb16265afd6a84
SHA256 c6a80a17d2bf531a881d66e27a8d6c818d682f12170d8f6e6dd3c9027782b560
SHA512 3a4cf686ad0a0c77ede347072b2c33b63fa66bee8b10c503f9ddb0595c38fc713cb0104640ade577a499a84b8497abb6794ba1e65f0d0c06e194672c8aecdb7d

C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md

MD5 60db36e8c29b13f9efcc110de9e48d5f
SHA1 219c8adcf2449e02b0da3d42a0a10e1d7dbb8e02
SHA256 57d193edeb9df0163183bf1447d42bee656c50890d5f85036d0e7dc43da851a6
SHA512 d13e513d5609662d21fae73dc5bd87aa9321a53deee30b65f0676fee37379caeea11e7d4f3cf5281a0e880f3ecebdbed2a5e069394129de3258650fb60149474

C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md

MD5 9be38f645ba77b9afb2fddae9fec45d1
SHA1 14b9bb4eff7a4e72c0dda26cc505d58be02e5c8a
SHA256 556b092a9be5f6518ca0be6112493cf28477d167bb97bec579005621e55da1ea
SHA512 0c850b1eacf8cb8c20eefa9e1c5e67d12c5f72e51f20fe88a57d33826ff104b350ae76c73a1f8b49225a9a905f2a72e27d2fc9689ed84bcae7ddf9aeb9e76997

C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md

MD5 91f2dc065d3e8846b1aec4120f51e68f
SHA1 2e929302cdae4ce41b39963e4922d375eee382c4
SHA256 62218f9516e416a763c5456ad564c1c2a744d8d8bd90867467419a583c7e0912
SHA512 ff2e45c51c7e452a976a0c8ba7205b32ea305466c812e9aa546ec7a89dafbcd2d4e222b04ac14318b38d86f820406bae78332d1cb012fb6d4d344734dc456d53

C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md

MD5 f4e9582b29230653fd5423799b21e5dc
SHA1 954cdab69896561894f7aff61e49e5706617bc54
SHA256 36bbebccf7a771e725a302c2ab33d4cba0d17d796fddf809d0ac83a0030dc653
SHA512 042608d256f5cf0441bdca40e9faa57352c03c778208529ee435c0a94040a3e6caf12d2982deb73b4e315769190c71f169a175fd8477485783da157cd5de853b

C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md

MD5 700052587ea19a3b08401e81f508171a
SHA1 66d8738e33979e1974fea8c90391ae229b8a441b
SHA256 2d38d97cb867c9d0408e5e4f8880c3d8727bfdd08ec6b23b8a063bf603503fa0
SHA512 feb392b4bdb610b47d147c4ddafe2b5f591b62304d54cbb97ecbcd4d42b5cddbe332c131121b2b22211ca085a2c68ceac4f7ae6d12b487b80b5785d8d96ecd45

C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md

MD5 a18c0f93ba0c27454c1e36c57421a962
SHA1 825d1196e467a6f6885ffd0c5d8bad61d578eefe
SHA256 7ad93fa7f08c2132c0473e5fb10a42911eaf92d00bd95ba593093615b6ff99d7
SHA512 8158cca8b5955d59087a234169badec296da777679c20c3bc7d3838fc250099fcf7f19644918fedd2bde35f48733e38e01d7edaf70b7910287c88119829a59c4

C:\Program Files\Java\jre-1.8\legal\javafx\public_suffix.md

MD5 6b8f6c1b490de0a75316451059efcd06
SHA1 de024c8228e0d2bd2264849b8559a07da22eb467
SHA256 197269da8760a6b36576aefc68e8c5727323922f85e6b4bbd1538d13a8c23adf
SHA512 b4151ac34e18fabe99628096c1c19b53c713dfafe05065905c469340a8c58d5871b48b0ff17cd3dc37a3af2c2b19e182a7141907cf78919811e3eca7896b5452

C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md

MD5 ef37326af3eb9f50a8684018bf0231a0
SHA1 caaf295957cf47be19574fc56e569795803b1e1e
SHA256 090e15ae57f6842d28d1db0ee8e07ac523a0962af6ed2d7579d4d6fd74112893
SHA512 acaeb5a9cef51d4634555b467541edb013d681bd3c212677b35d4f4bbcb6c8552031d3a9df4dbc58878c2fcd87534fb71e497f159b2fc4a4e0126b28f8a0b150

C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_LinkNoDrop32x32.gif

MD5 d1cf884048ab544ff6371d563e036d20
SHA1 a43d212e7596cbf323a2c870949d903062e9849d
SHA256 0e0b720e34a5b7f26e69853a987f68a35ea568b3f8f7db43077374c0f8726cbb
SHA512 99c64eedd50a2cbec4ab326fc4224c77d25f4cdb8804bb121151053d7b25de3b88c72a5fe86f9fee1cbe4af124d39760f4130bb8b187851d753de0492a7fe55e

C:\Program Files\Microsoft Office\root\Office16\1033\ClientARMRefer2019_eula.txt

MD5 1730f5c5503662934952b85706c01623
SHA1 881cd3ffd9e98541a507ee787de5550f5b0a4bcc
SHA256 491480f8e44a8b2a89ae3011348973ccf0ee0279ab5f791264e72efdffb14a2f
SHA512 ab01dfdd932811bbb2bec17801e3be00850493e36ded9d97e5daa9070f1f0c4cd339b4ace6d7753d7c9d503a51ae0f9f9c5f8c48b3118ce60b6eeb69e3e339fd

C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC_K_COL.HXK

MD5 df2b96be7d8a1b82101aff38a1c7a619
SHA1 87a3ec9ce594028674ddede428a0f241c77b5257
SHA256 09858b13b68b72f1228c7fd411cb8739d6c55a4496b1ce7f67752644abbd752c
SHA512 35017b95d7a21c7c1c5860f543bfe8397afd11ffa04bf7f678e48a92aebacf55f68cfc32d6e0792a8d44434e402dab11f2f0987866efce7a7a6b150838cf7be3

C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC_F_COL.HXK

MD5 84729bdf9c380c491d37638374169e2c
SHA1 d8e6d2937147af1edad451c0d1e7dc5d538e8fd5
SHA256 ccf122dc94a0237df910db70e4d962508cc105a7a0a64ed09f757f80a9f49d60
SHA512 94868466e91e35641931a0e6a3e799fb2c6fdae94122a0a25177e47bfa61f5c95c5ff91c247b1067fb64267d462667ebcdf82944371939a26ca1e984e4403df6

C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe.config

MD5 c5ed740a6b297a2960dfe51532989071
SHA1 5fb304f2f4fde7f2011a6fd21f0ce14e40e6cbeb
SHA256 9551883f6273c3095a54db345ac4583d23b7e7bbed40354176d352535203f7a2
SHA512 9f2052fd0ebdb0448b189b3711663edf20908d3168ca866c23bb822725791e880a7d57d7c8ce0348d8bc7af859f2964eb189bca763f4a3c97fe4e8892d4c56b5

C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\SIST02.XSL

MD5 d059886373cbf0dd7a83b244a874d6d2
SHA1 b1f940778d4fe96e67e1b0cb967092786a26d21a
SHA256 3805aee4dfed6eb4f26ac90f3d8f015bc23bf09f1da48ce246ffef88b7f84d3d
SHA512 bfadc943b4adeaceac17befbee4d3e70f571e9f46c23a99dbbd825ab1d7832623e66d1447295b84d45a21ec1d2078e38648c2d4c7fcc97dddc85a02d6921317c

C:\Program Files\Microsoft Office\root\Office16\PROOF\msgr8en.dub

MD5 97cd9971b41bb147ad58289efc06f6ae
SHA1 f44b8b24713ad8032716defd5d737a57e37a5424
SHA256 558f9efc2cf6bf4a9041020e2b39d88fa5c1edf3c71b1a33875bc402e6f45379
SHA512 f3072a0c02f97fce3b695e1e194994ee1ca2e72cdd00d68f9059e8b785257d314f0087257cb37a06f8264f2c5db2c3d02fef2db6dd9536efab4e09ad7e47af8d

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\osmdp64.msi.readtext5

MD5 822dd81fb917dcda1e685a0cda77eaa1
SHA1 5ed91a0046c353a75f500f0058e67833deb86510
SHA256 284282abdb2f6c9c7acdb196cb94c5791c67cef7103e115675757777137386c9
SHA512 9bbceee1e066542b0c5ae31a7b46a42d745542e82577c728318ef54e748533689fdd45d3bc52c5d666586351b64218d6c64de8c223125a7c07118adf34041ea7

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Cartridges\Informix.xsl

MD5 226930fbba276ccba4978bb8e26e1f3e
SHA1 7985a4769ed82b9e26e4785bb2f4b833493841b7
SHA256 ebb8f6927cefc0bb9634e750e4aae8f9c01f46569e6d1500a419303a70271a92
SHA512 6eb3a7faa20b9042cc5f3bac7adcd0f2580df5758a80243c2be4704c4f89b1f760c6f75e1a1540f8ea5e7b562b18f2cb96398a1d9d1a94e1c3b601654e63819e

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Cartridges\Sybase.xsl

MD5 ced9b175151c1e040458703d9e70a392
SHA1 ed79c1609259618767886228d4642c368090fc8a
SHA256 bded8750205a4054b50f15ef84505e0a4299e8dbc5c70631dfcf00737406e09b
SHA512 00393e335dcdeeb394158d6e16282b253aec38940c5c9b64bd73fb325c675cf2ce9082ee01d1f22d1aab86ab35f3a83fcc1297dfc319ef150c42c6d199228f05

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Cartridges\sql70.xsl

MD5 a535c756ac4d4fb91b50b6135e55ac9e
SHA1 b3225c9b55b4a5a38dd19fa4644b573f9665f7c0
SHA256 2ebd84d57e03cc16888391d120bd55fa4917aade1ef49c443efdad4d97b37f2f
SHA512 6742875683de6ef64de2d3d2ce4b16804e8975e6090cc134c382d6f97e3c8f1c723a4898cdc63d9022d1e0eb7d1a502fcead5ad0eee0f8784d505b1f977172e5

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Cartridges\msjet.xsl

MD5 2abd55207d305157e091c4b3f3d738d9
SHA1 b9885ccdd239b0c0e0c3e808253b1b13d0bda759
SHA256 8eb4a3b9cef4bf1413d7035a567ac8355d7818da8955812b6a7693bce06bbcaf
SHA512 fea097c1f4cf2414782556180d403cee6344cb052c606dbc8cabc08d69194478c57c2be62cf963d132630dc2f35c6575925420e6b8c3c88b9600986807533c50

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Cartridges\sql2000.xsl

MD5 53a25a9bb001f6465e9ca0d031da38a2
SHA1 a8ba98e462ffe7246db52cc7d1491e8dcaac1cb2
SHA256 a71d7309ae6d53d7a20b8336dbe0038f50a53b70c368ad5ae0e610f6859384c0
SHA512 3276f3d1a8ca477f9425d455eee0555bb1690056fb7528802afd3f481a0b4aa0a17c1f999149daecc319494dd143e14d6cc4d5d5835a90316055d651b396b5d6

C:\Program Files\VideoLAN\VLC\locale\fr\LC_MESSAGES\vlc.mo

MD5 31455cdc6f6233b77b6bb40c29f86f44
SHA1 cfaaef0c3f40c299ecacf8bb1b1e5248c101b541
SHA256 10d91af01ad1fe7110764e05033b12691baf475eac0fc7640b779ab001d8f24d
SHA512 1af3cac0dc3e0fad2fe9e0aa14c51d4f0386797c31f9f7c4c944160e939eadbc54a5c229de2ca6ed75a19c90734230fa4cb31ea2af9ef30a92605436db80bc89

C:\Program Files\VideoLAN\VLC\locale\mai\LC_MESSAGES\vlc.mo

MD5 40f9080fd542ce57c527e3e051dd348d
SHA1 ecd96c6a22bef52531a8e1f45a9b3c87a334ac9e
SHA256 b539c5a3b1bd39fb5172206dca6d4704cbf5ed035ace04b5e15390dfa67a8370
SHA512 9c085b0ad1f9255024435472589cfde60be33eb0720bcaa66a9aabedc3ebfe0d2ffc35d5d25061a55eab10cc74c685e950d36dd637f628f7284fdc96fc9b9348

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\icudtl.dat

MD5 3a40a3890eee1c9c800c424fcfbe8191
SHA1 4b26295a8a23a069681d991e90c34e7bad7d6dfb
SHA256 e348740fc13202c58783ade7311e4c564e04b2ad0bcee2532b644a628d5caf5d
SHA512 bc8d65fcae4841a939ad0e57d02eff4ac497422da0317907adb852b15c45ca3bc44791c5e76a433c4cad461b442c0f60b14718604d51b6483416434c3bd18075

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\aic_file_icons.png

MD5 28f35218f2ecb47b6bae9a32c376a01c
SHA1 e0615eaf876f56797d268951b3452c103a648729
SHA256 7f4801db8d6fef3d202a50fa179e5f287f87e182c0c756d756ac8c2cb960ca76
SHA512 928bbc3eee023bcc71f527963712eaa82a52602576f4e83dbf8a1c96f61104076a09523333d1928532c7e8fae7bed2eec28427779753fd7b1b2918fa0d3004fa

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions.png

MD5 dbf5b68cbd713a162db274c7ab279cf9
SHA1 ac552e1b8ba31515d3b996ba2f0042efe82d4e10
SHA256 d52803fa5114bfc719c800fb4878186ef360796d8ce155b3848873ac7f1ef0f1
SHA512 84493036c0ff4166fbc4a24cb436f3f64033c0872e893dd6cb80511dd57e2416eeaa5a74493bc80d8f39252ff7448a306960a12fdda79b39b716c28e397a330f

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions2x.png

MD5 fc97741bfd8a8960f49b6c5ec835e5cb
SHA1 40c0d932c5251e4ec62f25404135e770b6900edb
SHA256 72fa6bd6eed1e7f71fcba3afc6685d4a4f2d030c1416133b5f6bfdeef73fb3f0
SHA512 c352c9499d2edba928f8a8b5de18b03b2d9a4fad5871086afe6c18f9e962880e278da1ca69f9dab9c499b08b4542f6de2fea997eae075d9184d6c0e0c859c4d5

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_remove_18.svg

MD5 a3383d6ff3081d2009403bc3bdbd8891
SHA1 a43ef6817aa900c99d81b22b5a223b9fc9761431
SHA256 a10ab7a7b1bec45f1942734d0013fe1ef4a2e1969ced258fdf1546d89f68a7c2
SHA512 ba79fa3ef04793153896e0f24a9dcbe6bc5e967c7c38246495a940642a239a7969fb26a94a2ff5b6e6dd6fe131b5484e2ad3e408a7e4eb2689886aaad00ca0b9

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_backarrow_default.svg

MD5 4518132bffcd3ba21a2c1d0b558b1cb5
SHA1 6526cc3f512d70f187802f384729f8e6c4a136b1
SHA256 b1df3d1f5bcbb86112ece85b0c8ddecff4f1739dfd2c6841cb8aa55bacb66172
SHA512 a55c91eacfa0c3c66e6fdf3981e914d08e97a17e6ffd49a48c7bbf54994cf8b930d6a1f6319245b56f126681545f3a6e161d3a6c038da91f6d6aac0691b44933

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_folder-default_32.svg

MD5 888dde006ca1bb4af058187114e947a0
SHA1 7117f67e3f0148064479bd07ad75c5b68055bcc1
SHA256 9390d4b15e6876d67231112792139d9c8fbf55dae1951818255656e599f134df
SHA512 ab7da8194511572e04bcf8240af1faefc8f8841847cfe8d5775c7c2de031cc4b14ae0cfa3902b80ea1bdfed95b9c464f03f359f72f763bb86bc3a553bd543cf8

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_move_18.svg

MD5 da4255a5597a210a3f92c25c1d1d2fca
SHA1 0590f80e6edd5cfc40a8a0aeae23559c236d6fbe
SHA256 9095988cbb808aca520046bfd28f352ca6e3f3a32db3869b418fcebd2a912c44
SHA512 8ef68a3c3d0f0b7f797042f1c298f5a126faa44ce70a46dde292a9470d8234f265321f709ed395af9ca70d53bcb1f11ad514920bc8c89b04b04c7fe5cb8ab259

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_sendforsignature_18.svg

MD5 fc168a8cf104db0ac94b8b0485f20198
SHA1 584ad83c91cafb91fe63fc8d19713ef5298b9bad
SHA256 7dc9d76aa40e61524def71bf675f1f5f14281595755783b35e21bba24fddf8e8
SHA512 0fda076cb61c73963c235052500673289853f8ef7b47a94ac6bf43ba426c95ffc308ba5bdb6f9a6f290ace6532352b61aced646c34fd6245e9944465064e6d17

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_share_18.svg

MD5 d20a406aeb2f75031d7b50d758711da2
SHA1 f925fe704e5e06f98545f22c95712dc6074d262a
SHA256 4f0a540c66017525f4047de54a97d370b7f064816fba66b0b3af59f8e6a5abb3
SHA512 a7cf2a1430505ac35ea3622e2fd734ff62be60ffc20fbd9a05ecc51caef23daab8b266163b0b0dd4d888cf64dcff72ea42db531cb739410a2a35b822e54049a7

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_rename_18.svg

MD5 393ccce0c2c281cd66a38f6840eab205
SHA1 202c0e9751cc27253188e0c9ccb0f288665f8354
SHA256 3ff49c2fc13b44fb4580a18c44eb8bc97fe4e1c270365ec85861184a67dfd3d0
SHA512 16e9fd207e1325bbae2e10d38e9dfa7b7787c0e7a5923b7dc2f9fecce3d7ee447d111eb043ed34ad7e93ea29cf421f4479235392089716c3b7d7f543922b9433

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_organize_18.svg

MD5 108a20283e5c570f8d9188825b538d18
SHA1 64739a3f38b5c22f6209f2adf158cb6cd194a7b9
SHA256 98841f8c2cf4c667b966b47ef9a6ecb64aebf5e706e86b90bf3c9402e75a25c3
SHA512 35d15acb43770863a7bef29bd69ced24109d4824e60fce5dbb4898b157874709719983a41f6977a1fd1c7951e83987c0c41b38c14fc7ce48fccb6a06e7c4d57c

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_nextarrow_default.svg

MD5 29bf4bdb5046cbefc8d70ac84f7f6a17
SHA1 9ae8b9d47d006fbeadc48a2664a5ce6067ea9886
SHA256 abd5ad9ec720c1bdbbd2d6b643efa6774ffed6df564d783ebb2ebd5df02289b9
SHA512 dd97399646b750000b6176651c271ad835f037a5e413b83711830b1003d3967fe2b8ddd2c238a2674bd66e67b32bf00b8a538471b2f2d3d24d4350eae32d18dc

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_fillandsign_18.svg

MD5 c1dbf0d57e70c226f532f581cc240e92
SHA1 909d62a0d9c037e46137612e9688bed72da931cb
SHA256 75495787fe20bc639ac42d94a7c3c679edafe329bb54c8d4df0f45459fd71f3e
SHA512 e705b533731a5d6a86e2c6bdaa23f69547570d37335ad03130c06be70889d0a5be6b81d205e7445b899283e0cd7d17a38f826cab1e7ae8728f197aff7da28664

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_comment_18.svg

MD5 ec89dc801de8fc3a5ebfcb8cb377203e
SHA1 6c6a6ff6ff64c6d4664bbaaaad0a55f3683d009d
SHA256 82ba5b6dc1032b17bdd200bc0a92fd07f79c03aae392ff01de2eca3056ca02d5
SHA512 58f5608390eb498fb0bc5cb9e8563425b899b4a717432ff381a457822150069825d8ebf2ea2e3308666ab944a77823f6a29396299c855ac9be663e73bfb36805

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\root\ui-strings.js

MD5 26b00f4de9bd9cd63916068dfd3e603a
SHA1 1198e1f9867412ce61b3179aa45fc2ede83c2ef5
SHA256 d3b41d31b8d1d2b716ce4241e10060998a9f5fa406d3c27bae8f88f9cf480f87
SHA512 54ddf5dd7c5cceff62eb456f82ed7233bcac864e6dd3f9830d2c1be34bc3acc3f1cf1d66af0bee29f194f73ee7526a83f84c5df2eb841d8d50e1bd968f277e32

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\root\ui-strings.js.readtext5

MD5 476725f0a08ebe1b97779e7ace65399f
SHA1 98352dfca035fe8b2ffe451828f99d2422fe7ed8
SHA256 ff400056f026c7e3d98046e24c3cb551774d8529d6a0797f1f35dc3ff1328dba
SHA512 384c54c7039d14068c8fec575c28c67ffe6942285aecf3f7ddf150324ea7eb62b54ed9261d41f7a9ffaccedfe381b45bb3496b90875ebaed37c07fc5fe4db917

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_editpdf_18.svg

MD5 0a900372355db62be08706bc5ed3554b
SHA1 8d1f18e436b3a19f7cba1fdc80c5145ecc3ff2ac
SHA256 1def42308570507205726efecd398b7a4d5b40f61d723965c774e45901f498ff
SHA512 f1e4e54f875a929229636ef6e6f42c6decd0b55aeaec5915eb87d99ab533fd6ba46ba7fcffc26c5047a638255913643941837073ce6e20cc85c2a031796890c0

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\root\ui-strings.js

MD5 7f15804cdee8d2f1280e5d2cc0119811
SHA1 04419896a11479b729a527928c9a27b75222fb8d
SHA256 29f346e14a092a4052e4efb96e6dbb9832d3253736069c14225117c22794eb8c
SHA512 09202742a5f20491549a8740ecbefc894e01ef39b22733cc9550f1fb526f04f595bc2ce73ab04c29ae4a3aed4f91157f11c4c0f8983fbe782239ff6e7dfb824e

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_export_18.svg

MD5 25261fe41980e58f2ad967eedf0a83e9
SHA1 5cb580062063f54715e5f12938c272a09786eae6
SHA256 ff801a635043e0241b7846631c88eaa3779338d338aead1849473a6c9655f5eb
SHA512 694a6923ecbe23a440097e9a3dc821d144c1c6e26b73b356c40de58893bdd7f2a3f258a22ac2b76aa814b261e99bf6358be209b38f019c37980d6a9f7f5b97b3

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\remove.svg

MD5 bf962fc69793d303ace3d84072a89bbf
SHA1 bec8ca4fc0f93b9cb705f6fcb1e9432d501d5f9f
SHA256 478a925e7623fbe58e2a1a98f7fa4762affb425134ba0ac588e1a403d6fc53a3
SHA512 0544df99ade29aacdad7a08c3e424ec4f598338c226cf3538cd6a4297705fcaeb85f7d52df1c43f83b8a65aea1ba73d7df6e850c707f1b04acd6bec7c8a93eb5

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\duplicate.svg

MD5 5c3a6b2deb500c4d9894b7d70e815059
SHA1 98b9967adbe2f62260b65a5b8fa9666511caedc5
SHA256 012237a4cd1cdb143f15e17064c01462f50b9bcf109538f898eccf3ffe79295c
SHA512 dc3ef3cf1e643ccefe116678e5522de1071f0da8eb3a1f5ec0a5a03338f92e5ee51e1844d18ec82c2b3abc5865ee8fa15787779ef58f5bc7322b660a789c34d3

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\he-il\ui-strings.js

MD5 9f094db1bd55af15b58ad5a091ac9ce9
SHA1 ce5ce929d772fbd7654af947f22309eb34963400
SHA256 7c637ffd3063e76557705a68a9c3d0f883e3366259f5cf69f986e665c5613965
SHA512 84bfb7b56b8e29c7308e09bd68638d90e8d31c54c4ab5ec31a7b055d80f92f3d2a468527f8fae445cd432acf97e487c3ec4c0fc0feac8e80ac244e15158a73e4

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\root\ui-strings.js

MD5 fc6337c602cd287530103bebdccad5bb
SHA1 c9c2b3c892d36a5e0b0be8a1057f0c645a3cc347
SHA256 cb38475aa6ee7d409789aebe532607fe54f9fa15ad3e1c2281d8fb6ce721962f
SHA512 46f478ff6aa3e503d4f947487200b9947aa9633b6a0f90454570fe8fb8f6e8847e2264e9401a109a05d82058df2f40c0e5ca30f0db9fae05670dbe066ea58f86

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\root\ui-strings.js

MD5 65b48d31f63d15ef6351042a15d1fe08
SHA1 1d0f041bc2ca71f5e6c578571391ee13d56d06ad
SHA256 893d45e86f257af35b8c1357aa4f1f7639f2bc72587b6277cde95ebf7e3e2547
SHA512 3a7cc51c560a65df89e112ff10891c8af1a2c72293919f7b8bcc99b2271fa35deed675f61b9367c1b878d6d7787e5d56471e45c8afd90381e04abab517b0d761

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\rhp\convertpdf-rna-tool-view.js.readtext5

MD5 548fab27cefd45df5c5f9005ca04f644
SHA1 a517f9395831b346bc39907f36622b11c5cc9817
SHA256 b288f45c1d0cead971b9514d2987067bf08dc2d0c498f6cf44f96ebb44643c42
SHA512 047ee29cfe91024fe0f582f5cb7ce6c001c211ff07e5520ab0d02fa4669084e4fb5259e608e781f4bba3b1081d0408d7d129284767b7198015a025c6fe80cd5b

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\rhp\exportpdf-rna-selector.js

MD5 e4ccb0dc1ba9b60467b33fb2f1df2c91
SHA1 4e80e4428ff55e8b190cc178924b9173140d534e
SHA256 e95c40467c295c77c0f3b18efb249cdd36f8d8fefccdea78735d622ca6a8d253
SHA512 6c79ad1e3d2d5e4b39e707efd4b7e537125426530bbd8008575dde69f341b8348af20f1c9b1091edfa913c43a0a10e9fac557fc230865823bca8526cd23b439c

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\root\ui-strings.js

MD5 0084971ad5826494b16bc23ff8c04edc
SHA1 d617b923e51af17dde5cc0fccc69a5b88081a59a
SHA256 233ba1066b06b5c084fe8381abe161628e7710190cfe0978bccc01353c46b7f8
SHA512 7230df825773910813c3853f5201bd03672094c5778c13a8d6f0c72e28fbfb769188dc6cc1cf8ce3a2a63261b3e9de03e75a38ebdd40b39fd900700fa306ef02

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\root\ui-strings.js

MD5 32871dd572f34e74e391dee717ac1add
SHA1 e92d9fae2572b6c4f8a83a9af4b863d89d72d7c5
SHA256 2be496da90f5d19ace031a21ce51bd8441dcd3a33c7245c4bbe9712a3b8ab183
SHA512 b2841276c276d91689d7a7375107c7b389ae7ba5be6614368e8b7bad107fb3b242549c46b38a05892f5b3db16d4c3248c600e984c8860e31cf6a57f2c9861d1f

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons.png

MD5 3328fb9149a755d60fcbcfcef34a11c2
SHA1 9bbacdefc26357b3ee89757a3d4b803a3c361b4e
SHA256 9a31ad743cbf4a93c9edd7848f35c45b8e27cb20d59075db3d3ac704ac61b36d
SHA512 376557fd9baf654bb367de723adf91f3af4903657bd7bf47ed3d7f55585310c995328a4f6a44cc09b7078ad98e05281c704553f874af436d381e1e56f69cf915

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_2x.png

MD5 638cfbc6acf0c83651df07e3a7b8fd99
SHA1 16131b4632e9deaad445777634693dd58800c257
SHA256 aee590b49022bbde3357b2aeff3422276d93427bdec859285e187c2f3d2565f9
SHA512 e32d8a7aade73e57d7eaebfb3ae0b1824fce9df219d0375e5d17030ad5f364b9e6343c7dc7228fba3f497cfb0512b3575750d9e4e238f0e1ede6987a6c8a6fd0

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover.png

MD5 b10d67edb0ec42e104d86a4f93812e49
SHA1 a326c4644314cdce4296bbb74680f4f04a9f03ce
SHA256 aa5c34eb544339661118185ef0a68f690905af1a6bdb44e6bf664276ba4eb447
SHA512 03ff7d871e98fb5bc291b0f249d6854ce19a27b09cfc2bf12c449e8e0b515279f98c15c695fdc6793fff9fe5bd713ad8e71a2296a047242a696a97aeff143318

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon.png

MD5 6e66701f3914afbdd280112b395cce9f
SHA1 097484bb895312fcd8592b440fac13a875a0c60f
SHA256 5afaf7e7efdabc709b94307cd8a7c7bd2ed8735546ecd39f59e0beccdf43f7e9
SHA512 b175d87696f0c4afbb84fbe4fb07561ff270218de4c55c1c281bddf32a0e14cd51d6dce9bbd68b1c9b71d425b2791a6347dd96b484b738dc7519e875148597b2

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons2x.png

MD5 2e2dcd671daed9aa60d53329e7382cb6
SHA1 4eca8ad3a49bfba109d7c5ed49f9cbd17ed705d9
SHA256 80952ea863c43a90f3209b9e43d852ce7c524d80220954dc7c4a9f65634e1e80
SHA512 9b772b0f49d4d29d8093a4bf2a06a629711a528890d0dca68e9aa28a62c6b1888c6e240d23e9c93b8a78bde49f4b084e2b312df61751fdb30bce598d2947981b

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\root\ui-strings.js

MD5 54161e6cc061024d200047c9fb4413e2
SHA1 c8ce418b7b450a1025bcd2dc3e0c76ade51b5b4e
SHA256 5cfd0d0044605e07288552e6b78fb454071557309b15db74622e2470f2f86b04
SHA512 35b319718e72078d61b05b684d3d0a100ed3be3eb5f1b2ab614b3ca1570a5cd4c93cf9d490e87b9f6751df040697e8d6a1387a78d47543a32148a112d458c010

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png

MD5 e4a60f023644851e59b8ba923cf927b1
SHA1 3b5075455764598dc9797c2a92951eda15a4b1e2
SHA256 d0f48fcf4f71b56dcc373e8797d417ea2bb873e8be428a41077c2ce38afb4301
SHA512 3720ec3d2a356eef2db7d974e804283b8b40d1acfac4fcc663e2ff13c87149eff1bbf550e61e03c4e68e67b773246d1a8d35cbff02ee90bd2f1cf06512c54793

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover_2x.png

MD5 6976688f8ee69f19a1290e34cfb7b9bd
SHA1 671920025571d1aa0ccea6d20cac2081867fe66c
SHA256 0d51b4a2caa4934b02bc47953f626a4bbd0e7a26eb87a81721dee74721de195b
SHA512 f56ab054341c75606819b43a3e676a8194a3822aa80f79fd7c16618c0af25f3175a435c3bd2451a2475826e692fcee0ed65a6d88cfed9d5e29e8e4ea8b95abee

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon.png

MD5 c133044b463d99cb37a14e1d2c48d37f
SHA1 790f8dfdeee00bf2554a7d8bef9395d337d6f25a
SHA256 20508e5c411d29c857bb4997cbdf8c151ca6fb088170f2eb18a717a54d499950
SHA512 a8a8927ad95770a846ccc46a605dde34ee70f3ccd48e6cb111f9d3be7a4f65bd76fcf8e043915c4cf8eb859171a839b7811aac7ea082190b10d0b3437eac17be

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png

MD5 a3077de50da7cde1437d9d77448b35b4
SHA1 483d9c9c8e7ef80856cee3e8307ff82427516fb4
SHA256 aeacfd03fc71bf26ef1d184bb37e79a92ba24d9424e1583510ff218b8ef9802e
SHA512 bedbc6d653e705906d013f0be1d0473413691cdddbf609a002acbcaf037e30fc0372af7330cd58479503bae53c525205f5263e5c6441a69284ad20ee2d61499e

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover_2x.png

MD5 ec76a7264f4a7af35ab8e3e0766861b0
SHA1 5f75989c79c831fac4689501925a85ab5bd622ea
SHA256 66144f57e51c87d26bec0d72cfb13bcd53b487192179fc3d58525ddf957afb75
SHA512 ec4afd860842b51df77409b078fe20c5bf0de5a3a9fb1e74e11a4affd258ea25985c6bdb3f92d432699fb816504902e41a19aa6b01e3a796d6f7c6813b13b132

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\root\ui-strings.js

MD5 89c5ec80ac98e82d8e6201e3da3a29da
SHA1 27f2fc50b88cef18ac90e4832ce0967346b70c52
SHA256 533cceb604836c708ecd7f7848ad89e4cc82ca4e4b08f4969aaf16ec17516632
SHA512 423c01a0df83eafba1f703bd7abf679c254d2a0caddd8a8b2e5f1e110909dee5ac54eec33f2f6710336bae7d019934cefa107084c19dcbae291322c5867966b0

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\root\ui-strings.js

MD5 7287ec1d8a927b0307eecb2f4d4a3a07
SHA1 7dde1adc482e4c865b4d4ab5feaf8610a7d432c4
SHA256 ba2333873abe122cee2c0b12ca96167332113ba21c517d0cc62b8bbb1f3f7962
SHA512 48d57e80344dbf64f4fb984f6b9cb52a561702d6fdfce5f9f3e28a3814b13c0711626084cff553b43c05f9b5e4bf9d2fdc6d9d5ea0ded6e55ac7602469665f3c

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\fr-ma\ui-strings.js

MD5 cb5f27823df69d19f188f90d2925a650
SHA1 f8dbb1f50181340f07469db224cb6feecf21a3e3
SHA256 a795c3aaac2d7602abe8ad24b96055bbdcbd0cc0daa55a594244d05e120e0878
SHA512 2a91e4576470722e76d0dc0edf155ed72809d0346c0cb4102434d5470b7e0645a450961bff267e8e990388163947c11fcb14bfc4b0b6e8620e2b06ad26de915c

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\example_icons.png

MD5 c1649ffb7c32e16d276c78be2ff9fc75
SHA1 490ec2029f00cbea9affc7dc089aa633c6130475
SHA256 70ce61c1f0a957a51ae67ba21013a2816dbccfaeddc4284d2c3a239cdd176dc2
SHA512 cd6bf11408dd5699d3d2a6f608a4fabe61474b14c251372424c6b30eba49584c5cc74c3432f1ae3b672f3878949214215b705e781109d510f1b532e28c81cd83

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\example_icons2x.png

MD5 f2a620d7ec9e9a414dea173b29237574
SHA1 27920eda47b7fc973442f5753bac7528bae9d5eb
SHA256 5fc2323c2bf21ce6c1c0e01a64b0dbc74333fd2f204517cace009e5298f8ff25
SHA512 3240fb7d6a09d92c4a5d81e79fb85d1f86cc8c9fc5997e161154343de30ef1e96fd5ea15855ca312eb69ad29646892da372ca2483377da14c4fe905d73eb36fb

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\fr-ma\ui-strings.js

MD5 f4aec902fd4f27c33442dece45481ce9
SHA1 8eb2c79af165c39809710f6d290cead968d1bac8
SHA256 70bdd628813a68dd68777ecd4e77fa60940db08c528273a81a1eb253b6d2e471
SHA512 b896654c7648f1acf10667e64e65ee9514a68104ef379ab3c462b583a22f658336e9d3b4126505bb6e952f9fe78e26880a28f861246bb4920bf58ca0d23e3232

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\rhp_world_icon_hover_2x.png

MD5 1b9074a60e0fca11fcb56238bfebf7e9
SHA1 b686dfc3eb687270fd3fefabfc727e34b6ba8280
SHA256 00da43833e1b388e50399860892228329e286bb48992521a94d84a107694e7c6
SHA512 0c431d1a0218eef863c183bfff45e826cca91cb05de74beda5d1d60d3b54c17c7cf78c981dc230d451f2cfbfee9412013c4097829d818c8c870708d90b974ef1

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\rhp_world_icon_hover.png

MD5 02fa544842d8e000145dde674fb35bcf
SHA1 7ee87c36d2218ae2444b753284b15df6e9384171
SHA256 09c1dfb8a248852d3f7168b1fc5e4dd2bc76a8e12cb786ae7f9ac93da1c4edc7
SHA512 f23e6150806a1c2aa7d9242feab57d96e43cad9b68630b8f5939253466547c32cee2256431d1db4fd718a06459a086fd3683033aab9d3c30aef46c39d96c0500

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\rhp_world_icon_2x.png

MD5 976e706f972b944390f3cef8c76a220f
SHA1 018935a780ac2cba2c8d063aee7b227bd8205162
SHA256 1198a8268957847522c399af4a8b16fc49f50c859f323b2c92e0aef021f0e6ff
SHA512 3cc9e3c7d5aad4e418bb3c0c6c084e926b53c97835b022c8cb09153aa3e18287dd5b6a53c1e3a504a04dc7e5a3dab309813a9a78b66f668302fc5d45b7c0cdea

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\rhp_world_icon.png

MD5 58e3f0e6cd80381ea9a2c4f511eef631
SHA1 843aa0d38c5484869edc2b5370b59599ec77f6af
SHA256 87f78a1a93870bf125b59a56cf21a42a84ec59d54b8686219b7e2f30cf49a856
SHA512 5b0f874219005d58bb92f18a5eb6a4b9acd5ca9bfdcc3810ce38d3af9dc60e6298102f2c4561389cf22f155601411075c111635cc0a5d7166c398bdbd9aeecb5

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\themes\dark\rhp_world_icon_hover_2x.png

MD5 c625287bf2c47ae9eb19491a0833f1f4
SHA1 3f6852928cdd380b133ee3552e13b7ad5cdcd4e6
SHA256 de57c4e9e0aeef61bd7cf8a03281e1b4bcf96d981e77c460c38c1df04cc8806f
SHA512 8e623d3003c8167efd2fd325d1a4ffb4910c815a73278e473b2207bbeccb45d7bc5138ca06f833b7a28cfc3fe38691899f5f07c6ac84fab0492da05a7f4642ea

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\themes\dark\rhp_world_icon_2x.png

MD5 27b7a122392dc239b309679ffc98b3a2
SHA1 23bd894511f3551cc8fac145e67136dd7d6f9e0f
SHA256 39f3bf210fa9a6d53588a23eeaf041fe9abc9ff743c1dc7cf1cef858fc563ac2
SHA512 8f60e35bc8d5dd26d7f3219e98df1a132524fbe943923ac5d54bad2cf75f72dfd394fafc8ced550851298432184f60d7a9078aaae133ff630c4d9ffb40666f9b

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\themes\dark\rhp_world_icon.png

MD5 c0a5f68c5229b2d3d0666942241e6b08
SHA1 2b6ba51e30c9971a6904723bd5881e3d5f529fc8
SHA256 76eb69b779d75ed0248b5915932060f862fe19dd5f3da93636e022f20ce28cbd
SHA512 b8fcb184c373f5a21fe35cbd3da3093e6efef17d5aa90fa922ff287f22cd52b79e420561ac3876ddfd2583397063f2d0a495529e13cc271e37983292881d11ad

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\themes\dark\rhp_world_icon_hover.png

MD5 47dd2cb2b9b36fb418bab320c4680506
SHA1 258bad122dc417722819eb1f4443017db0b370f0
SHA256 ae15121bb2a7d5f81c30fe4e5299f5e69b7ef8d253eb67d5619fd0375c258821
SHA512 0a14d51ca737506de5d6650994e66f7cbac8e6cbfa2f7db2ecc764cb5d645064219db418b7e5fea53b0e278630e0076492bfc1ac7b2878da9857cf3cdd34f4a9

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\new_icons.png

MD5 ece1a2a72020b6f69f3aa707c5fe02aa
SHA1 675c652af4da5540d1623040fe99a13fd0d349e4
SHA256 f49342a7fb828e07e12329b3e81d0ebd63a6db5c5117547a3dfab6cf753aeda0
SHA512 1222d39cc7bc7bda1373b29b4605e5a1f690cd0f6e17c88d8efbc74436c82fba90c37b5b6d70a7604f543691c5b5a3eb38fdae99101a4e42ed4065a5afbfd6d3

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\icons.png

MD5 ed13d0d23a209ad88d8ab31a924be97a
SHA1 76742fa5a6df6fce8f89d50e7fb09e02268101ff
SHA256 38399fa2b1a5c55fbbd15dfce5c3839da917891ac1c4ab9e284f411b945c91d9
SHA512 07010d9361fd846f438914bb4f829d6bea5c4a2b48adac4d33f20a99264799052d029bf7dd5bba935ab94cb1a14217a2e2629ddb101fe3f795e1daa339aee472

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\new_icons_retina.png

MD5 74f19ef4535a1af83333898841758ebc
SHA1 c68da7c219b078e42c486410b50b5310ccaac4d9
SHA256 a0997e551dcf8b136b4314f1cec3faebdfd0a8b98b1af861742f876f0ab1a8bd
SHA512 6ddbf496a20ffe76d83e4e81f61d26218aaba78c5a3ac02432d0ec0a0fc8c8fb1813ffd7f1fc58c631fb590f4b2bb9f5956ad91e8238ecbbe5abfdbb460a0212

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\icons_retina.png

MD5 1f064a53feb8f0f46bcae87e73438d3c
SHA1 c38461ffe366fcf3806c964fd0515730b1c69554
SHA256 d06302aafb908c3d80ac9b484ba608a1123289dbaccbe9f962c89a01fb20161c
SHA512 078bbc23554ccbbddaf0759130e2f73d0557b154e70ab5893c1ba7a571491cad98d0516fa32ec97ca7bff10e290b965b2f6ae85e91ca5979f6cd0c89feba8cc7

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\icons_ie8.gif

MD5 854fa5f8e0151dd58a3373df09398b67
SHA1 95ffc9cf873cb51795da5d7938c47de364a489de
SHA256 dbd303f0c28e9eb15e13b5493abf27d73d08e02e80fa39f30b5dc691bd253207
SHA512 32116cba807fe5b0cf534573b6636bbff9e81beb0ebc0343de13ff9f4a0a4bc382930bb36f836cb231163ddb3059e8c6649d4f43e82aa99956d56ee2dc375d9e

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\root\ui-strings.js

MD5 c6e95c50705ed94017154e1e5c3a5a51
SHA1 5e15742d6676200050a04d02374cf188e6d59d65
SHA256 7f87edbbe5fb8e725bef6499c8e6847b9cba51972e29138baa31be8ee7f4bbdb
SHA512 c7c02e39f626ce554036230f88aa94c8ea828c7b25035fb4083a0011b7789e7b02daa725620f5eee399f3f280e89559e03f69298425cc0c549b6defb37baf5c3

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\sl-sl\ui-strings.js

MD5 3d1eaa879d5112a9c18847eec005501b
SHA1 6bbf2f0656868d54d4e6055c2810308c0d3aee6b
SHA256 316475bd121cd65a515b4e4797f3e66fa51e7f5c337237e9d60b6399bafa0025
SHA512 d81cfbf25214f3ad81c46efa8360dd805cfd445011a09d107c8c8e515f26b570d9da80660fe4a3bf4f5ab2f6c2abaca9f219c6899826a2f578eff598326eb90b

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\root\ui-strings.js

MD5 d4648874b247fd9926a2e11c062afe4c
SHA1 4ad7e981aa9354282fc1dfc5eb591b562861d369
SHA256 73846066034fbd76636fe874cc7cefa12069673a292cf9d6c13710a1ec8ba11c
SHA512 00659396101d2fe2dfedcef3d4f200d95e817e19f06d57ba9178a0291aeadd8b62cad4b701bfa13f1d088a4a8ea32d843774b37c36b1eb39edc9ee88e55cd057

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\css\main.css

MD5 97199d60ebba1217c894165a84933683
SHA1 716d2840c4a062b90752e4f5a417b12d50fe8373
SHA256 9b45562fd1328754d04c28e7d1712a4b6941dc1ba358359609950753b3cb71bf
SHA512 184c07106ec15d823e240daf1d57359fada088a7b9aca2195c8304e962b5c492b5f009adec5a5fb47f674e632bd353eb125adfd700f3f76919fa305e2989f7b9

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\bg_pattern_RHP.png

MD5 7c2d3bb4fadfa092a01b45a4e8161f10
SHA1 c1fa97faba967b90c82f8ccf2c895e25a2debb0d
SHA256 597c91593701647de59fb96db0bafe767b7165e214552b3403cf84483296b257
SHA512 5b8417c049fb78ad4df42a544593966a021ff5b3c14d6a1b572147e79a17ab10c3e98b70b0a49cb1f77d2f8eb896d60ffa24bb3ada7b9a859044470b0c2b48d7

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\bg_patterns_header.png

MD5 b358b086418abfd006bd5702426d2de2
SHA1 dc01dfc921abfa457a9a11aecfa93e38691f0ec4
SHA256 8be161e27944141eb5bb94814ec78b907b1308817ec15070d191e7d66b14fc5e
SHA512 c6b22675e7ae328ffc2f64892fd728515a091b6be67f319ce4cd0f7213763dda5a7713dcb15e6c27f227e73cf3d1f6762f5202d70bc7b5f261a49c2cd0756160

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\themes\dark\illustrations.png

MD5 0070a951f7527ee9d8a1488405a39205
SHA1 1ea8ed9f77da0a67ccb457777096110c639d762a
SHA256 9073ec537576fc969518b87eb5008c5047df7aa92045bc3aea8a6ae7adecff2d
SHA512 b04d3efa3b7815a6d0e371cb44b9dac495e814e00a0d5d13ecd5a61b2b3cd6958d3420a3e51315aacb7508a3134fe7db6a01404db2bd963dab73272c4eb87b70

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\illustrations_retina.png

MD5 283ba544a6078295f6c935ce7a933f54
SHA1 8aad2c8cc70ca83b685630a7d04dfb1aef1f196a
SHA256 b1eda41e5947cd1b799778c4c90f344343324f921af29d79dbbe1c6a57958c2e
SHA512 422b70e4ee661dff7aadf6227f6795a1c20c4171e943c249fe2642d7d75d5d737f80b8c37601f1d539e1b5a65d79b4ae7085b0c984acf44e10a3ce1cbd833dfb

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\root\ui-strings.js

MD5 038ae866e749ff428418a5565c065c67
SHA1 858b403e3d63f5e58cf1207e25dffb0ae83cadab
SHA256 d52b4813fc1e2ab4466f3b551c61cf252a847155f7feb62d8a6171fd4de8d72f
SHA512 9ff6c9420f08b7de1f101682fa3c3b614472ffbce2ecf790c2d185f5368d58eb89cadfd2984aa927f596f1d5a9fde8a1b779ca1e194269c6ba991372c7f3d5c0

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\en-gb\ui-strings.js

MD5 7c2618de22b5b2bb1072e589bada5b8b
SHA1 7db070e69f65c399f985c1767c45bbcdd8d141fa
SHA256 e3b5c43d0631c17ef023a20392b06205288c637261a72ffa38bc3dc64b46f9ad
SHA512 23c7dd8c9a5ae0a701bb6b924762fba2628ae5541facca1e68d5839b935579897b24e212da3c01d5d86a6aeef09636852a51367bbc723f4d33d0dbdc171b88ec

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\root\ui-strings.js

MD5 fde646267aa8843d54c207e38f0d6dcb
SHA1 caa31f75602aa456214a66533df6ccbeaed6ea84
SHA256 509466da38ee236df41c91065df42dac292927e76535412a89830a9d4f1c73db
SHA512 76d8231b557ea2d5482bcc8a783b333258ba24ed6a2aefa2bba1228dacc4ef818c43308c2c49f63dcd41669c58fab112fb5d139acf220ef0b90464561b2ce91d

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\ui-strings.js

MD5 8a6cb9c3d4fedbc74eb17cbdad70ed1d
SHA1 0cf8fc8ea543399d841739daf6da7f0c64f112be
SHA256 85f62a04cd472585b91770085edc58d98a71d05766e5448b03b606a00310f1ff
SHA512 c7ba5fb77fbc86869edee27cc9201c48dc8bf6d3a4ef29d6221a1fb12bf283b393073906ec6e33b806c8d26446e2d566d40a721ed9c3ba32dfdbbf54df8b212f

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\PlayStore_icon.svg

MD5 c7b4c1fa2dd682516b3d28c907e848d0
SHA1 f72785560f1e9319f396dc713de3c81713d9a5a5
SHA256 5f034f6f9c785a5c92c7aca98d055c657745ab7c94198c97fd5f16e321159fdc
SHA512 b3bfcc87757cb03518b12efdc8c85e68f8de17e2dc3bb1f7356629b73a47e104124a73e2f5a783f0e3e1fd58c709e3ffab3e11211f2041780f8d20514cd5f7b1

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\root\ui-strings.js

MD5 48815e88bc780d0562ad9bd9c09eae60
SHA1 536b7e5e05f9c6f335b79c6b86d64773a0f8898f
SHA256 59b31176924c6b8e3f5698f94d160efa912fa894a07d08b16e54f3fedfad7031
SHA512 d332081445765a83c145a4658e55afe40127a56f19d4902e1481647e471ec2fa313a15572c10b93216821e50e7572df944b3b8064f4122c8fc6bf3e7226f9f48

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\root\ui-strings.js

MD5 137cb543c6a2cdfc62c6f7b6bedf657c
SHA1 878e499e1397d9108ce0a07a2e51225a8f448a8b
SHA256 287bf5109bf4c9e5ba5f518d8acac1d820fc80f718cc7bf04d698505fc9b9a5f
SHA512 5106303d2b8c2a854cef4431c93e9141d9884eebdc6d96d75603dc388ce235e0d40ec206faa5bc45d468224e1dad961505679fcc0d0cc3928b6e80f1842839cb

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\root\ui-strings.js

MD5 c19e9edd4b5810af36b16693cc9cec8c
SHA1 eff3281ea278c6b7074663b8611583e77eb4a4f1
SHA256 4166f87d2c78cf6d2a5ee7b2c7944182e3273f5af588586028164bf84fd71ec7
SHA512 e75f8edddacbcab978cc03187920b2d8ec9331ab1d58a51445f34699c35c50752b0da9822f40fd24ae08078a4a00d8ecd5c3592c919e15e2472bbe2c97b73574

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_da_135x40.svg

MD5 d72ecdf32d2a67cd7340f766a3850289
SHA1 8e7012f35f686e312310b25a713a5e32876a1211
SHA256 16fa888ef444fb95da71a05a81eaa1bc3028daa6cbbaa75bf9543623417e79af
SHA512 915c4788be27f5997b3f92f297774b8360bd8c41f84ae124ebf114b89b3aae06da77e111e5b94527c99a6c5da1b6d820c91e6481bf960afbd0e8f8b82768fe77

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_cs_135x40.svg

MD5 ab32e00f568de9ff0f398740538fea19
SHA1 2753543c39893931854453485835f5330f53c356
SHA256 7d352cc2d6e81d0fd2b04a7e2ad6dc504da3f82d368990892503acf4b2469549
SHA512 0ed65933d6bfd536520f7ccaf064169f3b613855766a325ef1eb8ce4754c18a8c64c4fd5285043b8a72901a9c94c33fba645e693724020642101065ecae9a85d

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_de_135x40.svg

MD5 ab0392d3cd645b600e8e1b11c8dcca51
SHA1 ed548455f66a489a1b74beef818ff6d097d2a22e
SHA256 83df2cebdfc9839fdc57fd3cbf85cf64066a8e4e4fb86c4006d4c0a01ae7556c
SHA512 106b04924b3be268f3d508c82f0f50db6ff2aa6061440e7820361f7a7bf61306cc48e86bedcbe5030aeff38484125629c77685aabb702dbada06df700330ef39

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_fr_135x40.svg

MD5 60612736905f7be3df5c062652a6db90
SHA1 f2dcc4888d85ad6441ed33c6cd071647494f25a3
SHA256 1f090137307277baac4f6e028c2e9e07d87a94b8f313a437674e1489a2371a96
SHA512 eed8d708ea6663eaf27d535ecbd5b2458f3ec421ff7c3c5e97b5562dd0861b348c838a5de564dce65289bfb31cbb2e0e34d6c078c8880eea9f02c4406e8aa8ed

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_it_135x40.svg

MD5 2079af8516c42a3491b5c83616404fe0
SHA1 ae02340d63e234813b097b62c064e2dad9aa1b98
SHA256 7923ffdeec960df6bb0fa14505ade0743d42380102566dda16a327ecbc9ef424
SHA512 245201effd5aca479d7b6fe84ef147ea6b63694b595fcd27e426f29dff26f3c44bce8b07f02f6dc5c1b44152acf9eccc26339981c819055e92accfc3e7380495

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_fi_135x40.svg

MD5 5e2aab376242a1fffe6061299c4d7292
SHA1 38b15bf1717ed6ec1dbfa7961fd7cf9ff7c7a59c
SHA256 858ac96172ebfab3422d613e8aba838be2b3277bed321411722eaa028e30784f
SHA512 38599d0f197783c42ee2463d7914342e28ef24588de1a1823ccddb3e66818ef73cbd7f15a35898d32ea4116acc42f6440f3207518b85f3a22fbb8dab0aeacf90

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_es_135x40.svg

MD5 8aa8bcab270ea943a9bb744273eb275e
SHA1 e1eee9d8f2082e03e669c239af686d54b7783534
SHA256 fc22e20a44dd794e2dea81eaa327b5e4172e9250c260adc19d8f3c7a9e0b0ef3
SHA512 67a4adb0799f123b5645a15275afc0aeffa270b43ef3aa70097f735a6231200c8aeb4315646014e8ec3cbf7c92dfb7282b3beb162867cc6f3952aa6b05982393

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_ja_135x40.svg

MD5 fee120b99961a3ae2ff457aca4a33426
SHA1 ca183e037cd55bbf97aeb44d95aabe129d5fc2ab
SHA256 8d36c6fd6061d7afacd8ba1934de38e1e5a710f1fbab3006537f9743253cac54
SHA512 e11ee854a1aa5d5baa9de32f9fe363b853ae7407ea5febd6c95d608aec3f4c8b79d388dc76a29d9001e3f2b559ac9ac0065a530608957fa88648b4884f96a89c

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_zh_cn_135x40.svg

MD5 9d2c8d4b7b3757f64e06020d78ff84e0
SHA1 fdea12441bc951bb6dc84ef303b73191670fbbcf
SHA256 74cfccfca1883754bce367e4bb59f93d5f448339b3921f04026ac1c683b93d19
SHA512 c57cbc8356412902e0c9311f6d2023b0628b8dc29e6473fa6cf93927a0cc6b4a81052aa7a074261ee9412d33af4dfb62cd2fb21ac9d8d3ab75e90a7a7cea6a77

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_nb_135x40.svg

MD5 d3d96d70965db0789b993a7423101603
SHA1 764886e6cba234d341ee437925d90dfa419c39f1
SHA256 88a4d5bc4e449a22aa73afc4e2b76cce328749f5fc537274530d6dd293060f13
SHA512 8606cca4e6335bd30210315bb68eef8ea72ab65df6a98e24737a0b962932efc1ead7ed9affe77255612f3165da25d1ead70d0cb2fdbbaf98677c5ecf4b4882d5

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\da_get.svg

MD5 46c00012c6bf9f45aae316aeb61e9359
SHA1 4920e91a6862dd497fe5ee1f62212a97d7803e21
SHA256 74cbb1093ad43dd094fdd5e50fbdeb297a0670d238d843a85c41a267627197f3
SHA512 35e5f27a54a5a2025a55a92c8d2681397d2bd9877bb78990cba3504b9646069c826cdeada657c2f6c3e6ea52fd4fab5a40e74e8473466bfd33e39c9b1bdd0010

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\de_get.svg

MD5 e7bd38b4b0f39507bd419161333398d9
SHA1 249143fa307fe5f70abcc9c4232b99eb2d0c28f3
SHA256 8f9f20db1797ad9a330ca4f6f788f4a974cbedd6561e91a14d0da6fcbc4b936a
SHA512 1d07a224ee057218fcaf9d0f91c1d7f41ec72b9388b76f67602833a9f57b6c6cdb9c2f2ba9df83c66f2a437f8a31a7b1f537528d401d7752b1515ac0d6c454e1

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\es-419_get.svg

MD5 4e5d5c06dcce631579865759f43e7dfc
SHA1 7f2d58694012df96e580aa8e5184c77916445960
SHA256 12f6cf63a90442e9668cdb90c7eb60acade12de29ad9e38a4aef98f60ff79a45
SHA512 37a88ec156a42ed9e29cc7f6c497da0f0910de9fd9fea16f2eae600d08e125ae67e901076bae9b32d4795c42c93316fd948dff47654514c02f7468ffdf497c24

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_zh_tw_135x40.svg

MD5 dcd584d90280447f626fe78cd565e25c
SHA1 657afe5a68115ad6685732d50a6399cf6bdb4c82
SHA256 96e3b860be26abc4687703a8ff9cda2a151ffd7e4483ae625a007a50c01ae788
SHA512 f6f7e15805ea7479104b7ff211d5585a3bc566278423ea31d3affa15ccf3da7d77d5c7a10adc4258488d9c89869bed18fa3105c99f7596991bb6d26e58547d21

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_tr_135x40.svg

MD5 944933940dea75a27b852051bfeda85f
SHA1 629434c6159bf8ed12aef119f624541fb4a5dce2
SHA256 c4c39931c2863996903e4a2f34f0e96b8779a07c6affe39e79b10e2f016fe300
SHA512 fa07bcd9b30c27c50e89a06fae717b66f92096ab963ae22baafe7256dd3b311948023fb181bed2c992aeb6e7e3685a171b8317ad09d57991f2a6be7307572d3e

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\cs_get.svg

MD5 5d26e1e3578458c83409237bd3dba2f1
SHA1 c3381a9ee1a000c57b5463cd9881a20cc82056b4
SHA256 ba32eaf921fecec26f247f7bca313f92a6f154f1b398210a87edb77f8d1725c8
SHA512 7a70ef091555b8adaa135edaf80e65285c5d7b7e9261e4c53912e6e25262733c3a6184e0526afb5c00d2e598fb112c76e60906d897480e0ac515b6b1f720a361

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_sv_135x40.svg

MD5 3b20ec6f560c9e4f6d7c9a3b121e3c6d
SHA1 3e3a384b8dfda24595aa7868b01d3eba6fbdc5cb
SHA256 ba23b35bb81001530404fb22562ea1017984a5260f61c4b96847abddfd2a5b7e
SHA512 414aa136c5bdad5199f7b74dd347227225d8871926d973460ae4f171f004c76e4a0c158d7850dc46c5ca4de7cc3bb36e165cee8f36b814594051446212dff7d6

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\fr_get.svg

MD5 4eb69a75aca6d8861613535bbadccf86
SHA1 429051e73be0083d79c39832201d7e9b98afd70e
SHA256 8d609656b207c2bd52667d78ef15bbaaf66f161c74ca372dbab0324f686bc099
SHA512 a6b61e3842121bf8afa95ee5581aa9cacee0109fdd1d03c7f35090f0628be4841f6a850e57eac4cd778ed6e1eb89f9853bc6d104ea49657d9d65c29658f7ad42

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_ko_135x40.svg

MD5 5d4e92962bfc0b61a7a66231f69a43a3
SHA1 b9c3e831e695810f3c003ae8f2f9c054457d5c2b
SHA256 c47e5f50cee52c3688802c37af636b7d4a94ef1535f6dbb35b1ca77e50efe1ce
SHA512 c4d336d3be3343dcf8f75ac019cf9e65d6c89f528a636bcaf951b2460d40f7de8b2b97c4d627fa1c92c013b08f29b475f32c5129143a96306549f525a088dac7

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_ru_135x40.svg

MD5 419ae723e3df1760de5b5c83fc1c2e67
SHA1 d687b0c53b9ee200c18b04315eac043236f1d070
SHA256 a886c0920fcca88bcf86f4ef7966d10ee5b560da708e213e499fd03588ff3712
SHA512 5aee055fead1ceb7c2add141466bf2ea8edfa1682bf75d15d76709e9de4be6e073f5c195166008371db0871bc56b07dd3442dcadb86689c04108d94056924e23

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_pt_135x40.svg

MD5 35b241a2394990a85ea1fb9550879778
SHA1 0c8022f052519412b4ce4614c8fcaec43b0f0f9c
SHA256 b7d8187fe9fac2185b630e94ee2fdad9363ed8e3242c75d412498cfbb7783bdf
SHA512 607f75b9758403cb71e6e66ef9af95027861511b7cbebdb1f1b93910267b81f829eadf2db5283ace75c86ad68f1b750056e8284c905f74e5921ef6953c8bf3cf

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_pl_135x40.svg

MD5 e9b3fe1387a61edf215fac98fa2e1230
SHA1 d8556cc4d26a088fe680bf5fe6a1f38982b8fa41
SHA256 9114ba3c5acf39098e79ad24dc77dd1622d8096217a704f2bea76ce3e42c4592
SHA512 b667e9449662ac500225d8d30f41e18ae42c23338f9753120b87bd0fa39df2fa3a3a359586753170e143e3a800486214f7291544d9c3b7a4c415a801e4295671

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\pt-br_get.svg

MD5 fa9a530f8b331183ceb05f41aa7af1ff
SHA1 aa39c7de64cc6403e8d4f028dc50e63c13812323
SHA256 8f0061f80408b2e3209835c858fbb1d00007870849a1ed70027f4f44a7d68cd6
SHA512 2ee167dbb8beab78f52ec23db1b6c784e2763ba276ba4f431c5aeaaba1338b51fc82f3413b1b4a162ebfc2ddc9530ccedfb288743d2fece2c8a5073c6f264886

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\ko_get.svg

MD5 bef16d2131089e0135a8337ed4c2370c
SHA1 99e559f0c47e7b6fd3bbb28cc16f7942f9f856da
SHA256 8faa36bde5a6d5d6067fd98837df966f828c245a505292342690275a404d9d09
SHA512 1f02ab660ba6166ce57e982e0b04eb5f423636d143f24618068d63fc1958e282ec07b3e4f3a3ddfb1de4586b7b6c5ddd40fc3586f2f0b98dd61f8ccef58c3db5

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\it_get.svg

MD5 2e9973670e56ce9b8aa631a82b1060be
SHA1 6b3657d9abb4d2dad5b1e3c6adab63a1f5d73ec1
SHA256 18637a02a434357bd41c73c42beca62c00a46845f5f9c2bbb239455c8c92897f
SHA512 2fffdd9c68fc592a107094f43f91cc29326d28ccd5bef2dbf2cd87dcf30a58db77e26f0bff9e03adbf87ac047f0addc4555992e62ffdb0f24ab93b1b9c750ed0

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\fi_get.svg

MD5 675bd88f0aee0a08a67dea3f7e98d9aa
SHA1 dcd4c3c73ce67cbc242655ff7240779dd277dba0
SHA256 79252ce6008b3cd57c462fa872b1952dd34734ad2c2f9d1bfbf89190bbd07fa8
SHA512 e2b6d6e1c7884566ef8260def0549dbbc9311231d77080a8023947e70b91b16858d4a3861f25908d9d0f04913523646ca606797a3237069cbb38aac983b18ff9

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\pl_get.svg

MD5 d79b9062e6b1831f524890ebf06da458
SHA1 01138fdfed1b5172c7f9049774813a49c79b9fa2
SHA256 c14e221db33c89037cf75d986768af83c38e5e58bf373c76fd168e1c18f32f50
SHA512 41e57b48b8179a3a7e18265c02eb103c43c88d082034ca4904aab0acba2afc1ebeebaa1036949ef28c6db7ab76088584a6719c44b5e859da10b1ad840cf23eee

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\zh-tw_get.svg

MD5 3ba124f05a12530f39910f8961e74f14
SHA1 4719944c1c5e544a98fb9a993a19ecce68e92898
SHA256 b7d9bb94916e0bc3c8d7baaec35ca85a5dbd418d3e60c7c0fdc61f435300d844
SHA512 d2b0a5363afc18e3c9eab1ec1b3258903d36b3a3841852b1cb3bcf6cab84499ac6534098324c992447c1a112523254f941327957f5e03e1eace30e6006a7fe1e

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\zh-cn_get.svg

MD5 802aa93fe3863ce50d492f64ea45cc16
SHA1 cfce53e1b0bd56906574a320d585202b26ec5c5b
SHA256 bd915c1d69066a3402842f1d78fae476282394e521ab9f21ebafc82d4be86222
SHA512 753f8cea585a15a539eb6a717d46e3afb51e563c95dd218ec9e5e63065af62cd9f40e8b06bd1c06a1fbbef2da98f89061343906e624a889acc64f1230517f490

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\ru_get.svg

MD5 0cffa4c571b0abab9610383868678150
SHA1 be74181d1e13c2a077a99d16ba08b1b2dda974dc
SHA256 ce3b3c9a6b3993e9e3aecd82af26530515ef4f5203d62a61e5c6885f82593189
SHA512 e0b342044879818bad40275c54c95a8b3da73398a7e48b0fdb934e445e8d11f11101198de35817c79087906f5316871938641b36233cedb36fc36f734797eaa2

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\sv_get.svg

MD5 420805fd4c1b4939f67ba2c17dfc136e
SHA1 9b37a451b6394572cefbbe54073a32f5a958018c
SHA256 3a5c5f1c5c39617fa4e3159499eb84e54e60cb1eed371f43ef79dbf2e29de714
SHA512 0af73b87cfb8ac8900e2e9ab717de9c75b2c63b9963d464e83c95a2c2dfcfe5c720a5c8e03b89a88fbe43843180fbc7e98821f6ff6e2b845997f0b9655064336

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\tr_get.svg

MD5 ffd785411cebe1fc3369763f0e221a4d
SHA1 4b309576001734f5ede641ba4734267399915d70
SHA256 608c3cec9720267859ed23a65bf3763f439cd45122ad08ef02c4b22cc0fb725b
SHA512 efdbd3860ab8477ad5fa78ead9afd5ca9c53c9ef5dd3276343d8f2953ad539f06619b39ce372cd9d56c3832994d6e93bef212dfb33d55751d9fe7071ca42185b

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\no_get.svg

MD5 1eac85b7d90c3d3eec350abd3b19fed2
SHA1 a8520d7d6e622f1be65d0626081d13e6951bb045
SHA256 15e72e5960c9ae3fa5f9be9e4c36a3ed851b6ce0ee626bf3ef7df6606f243d76
SHA512 2051bad893a4208fec4bc621dd32aea2d05d1215c4262bc36ec02afd3fe5c993e237479ef61de9c55ca1768eebcfc1b15f5a8fef775c654019b80dac39004a5b

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\root\ui-strings.js

MD5 238f6c0e9fec603b495d0bf72499f20c
SHA1 814b5fc78303be9c370673033e345fb71397b1db
SHA256 33ae0b742af446922f247ee938f888f21f11289d4adaca14f54f0bd109e75fd6
SHA512 9905f0235049d1805938db994439584b49ed9693754e1a016e682beb7fe2d05cda28312084b4b44ff9dcfea0f34bd916bb575b4e2b8b890b7c5e2da4ec1f758f

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\he-il\ui-strings.js

MD5 05595cac716d97a96ae70fc44a2cf80f
SHA1 3e4fe15ef98c911297ee064653da28d462e6c461
SHA256 fe1ecc2222b8c2c585be2edafc67b996c5dbbeaaf3c1c99f0c4fa92e2f28b9bb
SHA512 fee8487ea5a47e28284a7b28296c596bcc80dc0eb02c08459ffdd71de4cc475ef2847a6ec1788705cb1527a56ea7d939bc9ed833340df0fcd8fef75f5ebbf734

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\nb-no\ui-strings.js

MD5 ee98203b83fe93133bebc509672a96d3
SHA1 b78a80010e22ed03d456ed4e07da7645d27e0133
SHA256 4cf3aa3abdf3b00e00f028ae2a892fb5ce7a30d001e3012cd9b70cce759a0087
SHA512 2dbbc8d3e1a3a012bcf68986d0ad820713be0b4fa86bb36bb3aee67baef892afe3ba88f06f4668e04450b44d66fa2c491c8fcfb355a08ee4cc0ad5eb68b75955

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\root\ui-strings.js

MD5 d39cea5d81110624cd026c2a2e56fef0
SHA1 d61e422bdf019be971f5fbe83641777602a8b42c
SHA256 7978a5f7b3849ee6fa0ede804dd58cdb8dabf8a3531e8a2659f3f42993142da9
SHA512 c5f0c1d78c022ffc20a4acae1923c1e365755cbcf7a78e808981d68be2a43fc1a8ff4ee36210219f9e1083df694e6ab7a7cd82ba9754783afb0b640e815876df

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\sl-sl\ui-strings.js

MD5 5cde934d703cda11b2ad3e795d706a2a
SHA1 add4957f67be693c7d7c7b0543dd1ac17766ef6e
SHA256 468e9c9fd1e317f04a7dcab0d0994d9e24341fc48d9715335446d8acb4c0a38d
SHA512 7471bcda782903d0222d0f11a7c8125189c6447f17558bd3961713955503bf1a6d6ec82cdcbdee1a40a6dce25ffc474bd5c648ea449e9d78072d20f39ef054bf

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\root\ui-strings.js

MD5 343d9f21b677a87707e14a57ff0e8fc0
SHA1 80c37270b1d1a1b02542bc9ec6a0d753988617ca
SHA256 e9d6a3cb14067d860cb906dce7f76fa071f680033afc48376968cf560bb6c6f6
SHA512 661028d99012b94b62d0e59c74b9e842d9ba1d656ff65032929f8e7753e07b54c9290a336c70244063c4c7be1cc4972ad1d36306b993724fe26279925eafa267

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\css\main-selector.css

MD5 9b6d91c609f42516cf53381e90f2dec6
SHA1 5dc728190903ee7a0601ccede08181a7cf5f39be
SHA256 9504c6524cd278998eee00c41227a7cbf1af6fd47cad55d443aec3de01bfe989
SHA512 75abf800851e2c347ea7d14a5855f35eeb60720fcec40f5611ba0eb9d18b832874804e31bea0ee7e175803278a0311c5eb3bf7d909d67cd4c88c8d64ac72cea9

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\root\ui-strings.js

MD5 22b54d3b32dd5917cd4b8af9f64c5b2a
SHA1 99d33b363686c2ad5178ea6ab02d74c9e29f9637
SHA256 a839788ec08c7efdaf54deea2fbdb6402ae57f24df6d533e9acf5cb5d7b2b76f
SHA512 298da46f3687e6f725dce03ed2571e50c3b49830f785012962e78bd6101ab6715a4cad86194d16454338cd39002e6974e0d46ee18490392e83748269d075b309

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small.png

MD5 a3da8a3f5307726ec62e6eecd465fea9
SHA1 dc54e8d5ec49c7b32508beb7ef731073f6f15c81
SHA256 e871d9005b51cb4dd11f7dcde69d268fe0a91da0bb6559ca2b40a20a2c7a89dc
SHA512 f9ea689979ab276fc4389ecb04d826cc3c1fef6dd82b349fcba6fe9049c2d20c61f1cfdac57b6f23e85470d6dd59cbce816f2cad1650d8d87004c34b1267cefe

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons.png

MD5 042bd90276190e760e68a5c064b1eec4
SHA1 e4b850a56ee8c0bf5839d19c4a488175a84240c9
SHA256 60d1886563d3f83083a376fca369c719b01461ea6d91bf9c99e148663f4ecbbb
SHA512 26358a0b0ebf5ea461c54d937985d091f1eea2283cb97ad3c45e56afac18859073ada3229a790a36aad313cb660e361bab6ae9df2761177ba65859301a8030d8

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\dd_arrow_small2x.png

MD5 4e78d387a58aa0e799a05de3e3b15266
SHA1 77700b6037d424e8f0717a1da74ce1f5ed6489ed
SHA256 b9c507d2a554c2f18459c6e3621802610b99a0ffd0b31d8a93e1b23214d821e4
SHA512 93b2427100a4dbff1e83955b93c55d0aead89610443d835161b862528ece767ea4bbe9a6683377fbe6fae1c65495e3e525c9e63483ce250d2c89f7fa23a8e295

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\share_icons2x.png

MD5 064f120663205fcb8c8c4616a977aecf
SHA1 58580773fb712a7753b88a06369b3e5ae7226d46
SHA256 b34a984041cf271956ab83037202d4b065f4bf1e6d0b6d219d7503317c1ea872
SHA512 3ebd89edef740e80eee0aac69790ec0d57407976e6a313927cb754176ea77f52bf44dbdd882d11866579edfe09b660b78a989311189ce7c1c3a13899de4bbd0a

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview2x.png

MD5 755332b8ca2d85f2ea386cc92b04dce9
SHA1 bcaed2a3b5b9adb982b4c1bee206a0c655232a16
SHA256 8b4aa33dda7f30118e44696766213773a795bd01d3f98fd210bd3530fdc1b68d
SHA512 81b94cbd0f9d032da0b75a1b3dece4ef86b7ce462b6c9bd8de8c81847ec8486a8fb63a2dd887fd1831fb117c76a8a03908652c2ac38f3a7a31e1650272c0c4a0

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\nub.png

MD5 6b448f67febbbcf042f5ba3ed8be42a3
SHA1 76123d1eea814f6be3709dded9bd53e3bed601ee
SHA256 17e1037666d3526dff44cac8939f80785022ebdfd38bc42f544bd3bf5a97f567
SHA512 3cb0a8e97999b5f434fd3b299a3264dc86d8d95468e02aaa15977d2447dad3806575ba9354805bc89c38329088ac1a0b6504c5fb8b83298ca42f9e2c77f002a1

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\cstm_brand_preview.png

MD5 5aef67fee436f9a42d4ad4313e83d517
SHA1 c886d6d11d4b50030cacef7ac42195c4cd76966e
SHA256 9745f1bcec8b0bfb2b65b80161b9e348a00004ffce84f4c9f072be3971f86932
SHA512 b9fc042edc29bae6ebcb209b1761cb25768cc6a2932891091f471f5159a48c26f9731541ece85fb8f232afc52a0f6cfd2c2585a563b8da98a905ddafc0d0abf1

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\bun.png

MD5 d1ed942a18311584dc697481bd1aa795
SHA1 c0e29acc9aef4da167105504496628dd2070ae1b
SHA256 3ffba5e43356577996b51331cadb9e1a8da522380b569c7ca8d4838b5ed0bc87
SHA512 e86bf045e705267005e1f0bba1630da0721824199e2a1f3a3ec29de37ac999fec72fd4ebcc1a277d9d44c870a42ad3c65d27006565d567dc28e3da70f27609d2

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\s_thumbnailview_18.svg

MD5 16f81851e0733c7311930a9f56f595c2
SHA1 3523fe69779b11cd9ffc3ede2be40015dd77bd8d
SHA256 ef199ac82800bc1b7f237aed34f635c79cde34e1801379aed115530552289cfe
SHA512 34249fbe33234aa62a3a0b74f46fb887aba452c6459d69bf649b03beafc0423ab4203e8002ea33ae4158d069e65170c9108ab404436dae9cd1a0f303063b1aaa

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\s_listview_18.svg

MD5 2775449b23f22467111486fe8c82cd91
SHA1 6a0e006df118ee1471f17ea23a0471c542f8edc3
SHA256 1902aa385768cfbfefbc91433939e2e8b690203e90c9d45c880cd3dd86010217
SHA512 2d3a3f4e4ae1d4ad3b22db43f79bd59f12a898879c4e1006716e24600127488ce13e0dd7b365d70b7e07e227e9f8e679d7713717ce24426e07e6ace4a5710977

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\en-gb\ui-strings.js

MD5 afb70208ab37090ba73a794441de9445
SHA1 b103533908fadc4ae039bffb1703deb06d64193e
SHA256 22c2c76c20b7542a5fc8cd5d306087a874af0667ddd5beebc3b22ff0b0dd2ff5
SHA512 59ee55bc7655a7210678f9d321c33878647ce723ad859bf6ab43e94967865c99e543e1edd5947ccd985c40dc7eacb37480bea7b492bde4811fe25395fb862882

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\root\ui-strings.js

MD5 f6bebf54b88d9aac210b1d4a581ed6eb
SHA1 08969a505206a886303b6785ea534b1191ddac61
SHA256 2a78e33432117ff88381a674e63e7f575c6f9649789bd3ed2c608f410262c0b4
SHA512 316ae2ab54c0b388c35166c7efee48536b4c13dda5d6095c4f7ed2895a4a885c1f97a6fd296df80cbb6230be9184dd9c78b8e1f78eb9bc60317c1b3253bcdab8

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\en-gb\ui-strings.js.readtext5

MD5 531784aa1129068ed609b5b25f116b36
SHA1 9ec3f46ad8fdadcbf12c84d70f9ab439d37658dd
SHA256 87b7fe3a6d0a1783d63dfdc280f399331ee96a8c4ad747c4bde0a23b08ab9f8c
SHA512 ab95e67b48e70e4be600baee0492d2ebde0a0a88f6b9cfb7ab5d470e33b1425aad94e8a5fc278cf3e368430552597dda1ab7eb72024007a69f0b4054c0dd08bd

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\root\ui-strings.js

MD5 ecade07fb305f4ca459f205309f174ea
SHA1 82021ffc93b3c113bf5fa85f7d036460e00a5774
SHA256 986750ca984e61c721afe125a2a1d79f4af77c1b2b66c5121cb62ea658cb94f9
SHA512 85021e8871ad2dc1225d1bf0a943482997ed1f4619b60794f2ab2b701edb1ac7de601e2930a6ff8573e61b7fb82077fc5093ce24c2e78584c4c069efdd1772c3

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\he-il\ui-strings.js

MD5 cdade3dcf4280cd68a5aa1703a272558
SHA1 8b6f27823714ab945667eec7e98224a48b7da7cc
SHA256 0d62ebfb5dc928f18e27b2b96873f3d9515b5372efa83fa77ab8612007aed8f4
SHA512 e76a01f84ac02ab3b210fe280cdaef7b8979c245a77a7f55a9d219b12ea4b244e9c0a416a4e45f4b7737fcccabf332af73199432413f1491d06c5b37030b55bc

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\root\ui-strings.js

MD5 67b72256577e113d1078832a9d296daf
SHA1 4d2a17cdcac888b5444cf12f9ec3352b0120a7e9
SHA256 2d01b5de1b92d96f32120d7b98e4cf6db071d9321eabd97fc2e9968334f6abce
SHA512 19b76a24f719b626c2892d9e71268c3907688033be25ed8a2e402fd011d64564e44f35198bd9752ec3949430f3c9f289679d78d64343470a155936d5a8f0b245

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\css\main-selector.css

MD5 540473d462a7c5283993cd69cfc29d51
SHA1 1f2fcbbe6516769293e59d1c5879350204443407
SHA256 0288ba5879c3757eee493dc194e06d81bdd7a7182b270c19cb083e970309b2c3
SHA512 efd45fb123e7ce6b25827fba4c082558db0356b2ae5c54ed6251c8c31dd81819e5defbef69e2e208d4d7cb5c14374c1bb883179682265c660027efb0f0984041

C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB_EURO.txt

MD5 48fa96272f1eb80199c0ea852cccf421
SHA1 3035bd978a7cca6a0005e095efd6da1cb49bfe21
SHA256 1c8449744866c63261aae0fc6363c029061d9dec39af06e73d712ae24f4c9043
SHA512 0c7cac02fbab5b772b44c9ce60e437040947535e1d936e2a716b177e4067bd1a791d1c6c42b3ddf6ee90176fe6e8bace6fc60900c3ca19400f4fa38e54bc167a

C:\Users\Admin\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\000003.log.readtext5

MD5 704c4346873af4505d6dca446327a4b4
SHA1 c186a23e424df36d0ff707d0936a633f2e2fc8e4
SHA256 df5d88119ad04ede859e3d7ac0b6a1ccddc27390d3726e8822f9d9749122fbc9
SHA512 6e30c687b892e4afbf292997de211308c2035999d2c96bd814446c6257b2a1f88ab766e5d78c284d3dbe1cf28343e430b4f45443a1c52534c055e0a5abefb8dd

C:\ProgramData\Microsoft\Network\Downloader\edbtmp.log

MD5 bd7c3470d2656019e5ef88070e622dc6
SHA1 c5524c53b5998c025d33eb97d46356b44f023e69
SHA256 caf53fe8c58aa236d0d4abd2de45ebe422910513202b64c726d146498f38001a
SHA512 135e361dd2c4b10a99032fe766974c50a4eac0bd870af9100dfa9d8264cfff1e7f761899cf06ccb666c1b35c7aaff6e200fecdd815a35b4725c82f3a023ef57e

C:\ProgramData\Microsoft\User Account Pictures\Admin.dat

MD5 b59d579c27e33da239ca770ac25d9f10
SHA1 9a4787856878c4b508dc29fd26f6f083671cd6f2
SHA256 50c0ce74f1a3760aedfbd9b3023164f9b23e53c842275ef665051565119f01dc
SHA512 333303acef300d644cd6157d668ff8993403a3ce3790b3d01fccd547c20981f633889bcf504fe3c6d723f9f0c49c8909a96e36a8af3c443233cb6fceabb5e056

C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\packages\vcRuntimeAdditional_amd64\vc_runtimeAdditional_x64.msi

MD5 5ac8b767b181bb99875f88a99b4cb247
SHA1 aa46a3c29a59ffd0f7848f754bfa15546d43267e
SHA256 34b988d177fe34fa847073baff443e967c40cf09167e636a4464e5b163aa7dd3
SHA512 8024224333439a039bc8739d1255e4ae73002c95cbc1220e70ca25457668d22fab18ce0a4255bead715d2852f1a535a75fd797540efe4fb1681c4d712a32369d

C:\ProgramData\Package Cache\{C7141A99-592B-4226-A4E9-B767C1D0FBAF}v48.100.4028\dotnet-host-6.0.25-win-x64.msi

MD5 7391223830fff61e82d4ad5627f15cd4
SHA1 6703da2cab6ca0db4e30807c7606ad452e317c49
SHA256 ab1400969cd7c2e63d5ef77550dbd9c13b86c7c89f2bd031fa5efc6a4f0994b8
SHA512 761c819d98b4facdea30ce7eb5928c858341f73238f5eca3fa2c4269212db97965c1b0709de3cea719564f420ff182728b0af0eb1ded947706c5e15ee2af55b3

C:\ProgramData\Microsoft\Windows\Caches\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db.readtext5

MD5 d884c8a638fa2db69ee1fad86c83ebfb
SHA1 1f6635c3f74a17a0820b228fe9d8d6b8039143df
SHA256 8bb1b932443ccf85492110f7b85d0fb6175971cb9696829d3fd9bce92a8cb781
SHA512 a7d39a735ef6381e7c8ec7a72a327511a407da39379649670afa700bd9099920f9179c92cbaabb26e363d66c32c58166d5ac10f1be96f5ffbc5bddcbe3bb8f82