Malware Analysis Report

2024-09-11 01:45

Sample ID 240227-wnd2aafg24
Target f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.sample
SHA256 f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50
Tags
medusalocker evasion persistence ransomware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50

Threat Level: Known bad

The file f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.sample was found to be: Known bad.

Malicious Activity Summary

medusalocker evasion persistence ransomware

MedusaLocker payload

Medusalocker family

Suspicious use of NtCreateUserProcessOtherParentProcess

Modifies boot configuration data using bcdedit

Deletes shadow copies

Renames multiple (7559) files with added filename extension

Renames multiple (6539) files with added filename extension

Modifies Installed Components in the registry

Deletes System State backups

Deletes system backups

Enumerates connected drives

Adds Run key to start application

Drops file in Windows directory

Drops file in Program Files directory

Enumerates physical storage devices

Unsigned PE

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Modifies registry class

Suspicious use of SendNotifyMessage

Uses Volume Shadow Copy service COM API

Runs net.exe

Interacts with shadow copies

Kills process with taskkill

Suspicious use of AdjustPrivilegeToken

System policy modification

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Command and Scripting Interpreter
T1059
Persistence
TA0003
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Privilege Escalation
TA0004
Boot or Logon Autostart Execution
T1547
Registry Run Keys / Startup Folder
T1547.001
Defense Evasion
TA0005
Indicator Removal
T1070
File Deletion
T1070.004
Modify Registry
T1112
Credential Access
TA0006
Discovery
TA0007
Query Registry
T1012
Peripheral Device Discovery
T1120
System Information Discovery
T1082
Lateral Movement
TA0008
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Impact
TA0040
Inhibit System Recovery
T1490
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-02-27 18:03

Signatures

MedusaLocker payload

Description Indicator Process Target
N/A N/A N/A N/A

Medusalocker family

medusalocker

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-02-27 18:03

Reported

2024-02-27 18:06

Platform

win7-20240221-en

Max time kernel

150s

Max time network

129s

Command Line

C:\Windows\Explorer.EXE

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess

Description Indicator Process Target
PID 2460 created 1204 N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe C:\Windows\Explorer.EXE

Deletes shadow copies

ransomware

Modifies boot configuration data using bcdedit

ransomware evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A

Renames multiple (7559) files with added filename extension

ransomware

Deletes System State backups

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\wbadmin.exe N/A

Deletes system backups

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\wbadmin.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\BabyLockerKZ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe\"" C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\BabyLockerKZ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe\"" C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened (read-only) \??\F: C:\Windows\SysWOW64\cipher.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened (read-only) \??\A: C:\Windows\SysWOW64\cipher.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened (read-only) \??\F: C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Salta C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Mexico_City C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\css\How_to_back_files.html C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\calendar_single_bkg.png C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\gadget.xml C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD02161_.WMF C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File created C:\Program Files\Common Files\System\msadc\es-ES\How_to_back_files.html C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\sr-spl.txt C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\VIEWBY.GIF C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA01141_.WMF C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15056_.GIF C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Indian\Mahe C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\Austin.eftx C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\SlateBlue.css C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\rss_headline_glow_floating.png C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-sendopts_ja.jar C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host-views_ja.jar C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\How_to_back_files.html C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Backgammon\es-ES\bckgzm.exe.mui C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\js\RSSFeeds.js C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_gray_thunderstorm.png C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File created C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\How_to_back_files.html C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE03236_.WMF C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Detroit C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\How_to_back_files.html C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Module.xml C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened for modification C:\Program Files\RegisterRedo.vdw C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SKY\THMBNAIL.PNG C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Foundry.xml C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\Form_StatusImage.jpg C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\How_to_back_files.html C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-execution.xml C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-coredump_ja.jar C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLUECALM\How_to_back_files.html C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0287641.JPG C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SY01252_.WMF C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Waveform.xml C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\2.png C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\How_to_back_files.html C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_INTRO_BG.wmv C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\images\prev_hov.png C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR9F.GIF C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\fr-FR\micaut.dll.mui C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EDGE\THMBNAIL.PNG C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0239611.WMF C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Paris C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0152602.WMF C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21327_.GIF C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\POSTITL.ICO C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_choosefont.gif C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\settings.html C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File created C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\resources\1033\How_to_back_files.html C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD02115_.WMF C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH00685_.WMF C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-waning-crescent_partly-cloudy.png C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_ffd27a_256x240.png C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked-loading.png C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR14F.GIF C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-queries_zh_CN.jar C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\slideShow.html C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\applet\How_to_back_files.html C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\default_thumb.jpg C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\Horizon.eftx C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Logs\WindowsBackup\Wbadmin.3.etl C:\Windows\system32\wbadmin.exe N/A
File opened for modification C:\Windows\Logs\WindowsBackup\Wbadmin.2.etl C:\Windows\system32\wbadmin.exe N/A
File opened for modification C:\Windows\Logs\WindowsBackup\Wbadmin.1.etl C:\Windows\system32\wbadmin.exe N/A

Enumerates physical storage devices

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\vssadmin.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A

Runs net.exe

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2460 wrote to memory of 2484 N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe C:\Windows\SysWOW64\cmd.exe
PID 2460 wrote to memory of 2484 N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe C:\Windows\SysWOW64\cmd.exe
PID 2460 wrote to memory of 2484 N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe C:\Windows\SysWOW64\cmd.exe
PID 2460 wrote to memory of 2484 N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe C:\Windows\SysWOW64\cmd.exe
PID 2484 wrote to memory of 2588 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2484 wrote to memory of 2588 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2484 wrote to memory of 2588 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2484 wrote to memory of 2588 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2460 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe C:\Windows\SysWOW64\cmd.exe
PID 2460 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe C:\Windows\SysWOW64\cmd.exe
PID 2460 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe C:\Windows\SysWOW64\cmd.exe
PID 2460 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe C:\Windows\SysWOW64\cmd.exe
PID 2628 wrote to memory of 2532 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2628 wrote to memory of 2532 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2628 wrote to memory of 2532 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2628 wrote to memory of 2532 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2532 wrote to memory of 2500 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2532 wrote to memory of 2500 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2532 wrote to memory of 2500 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2460 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe C:\Windows\SysWOW64\cmd.exe
PID 2460 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe C:\Windows\SysWOW64\cmd.exe
PID 2460 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe C:\Windows\SysWOW64\cmd.exe
PID 2460 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe C:\Windows\SysWOW64\cmd.exe
PID 2728 wrote to memory of 2572 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2728 wrote to memory of 2572 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2728 wrote to memory of 2572 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2728 wrote to memory of 2572 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2572 wrote to memory of 2512 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2572 wrote to memory of 2512 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2572 wrote to memory of 2512 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2460 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe C:\Windows\SysWOW64\cmd.exe
PID 2460 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe C:\Windows\SysWOW64\cmd.exe
PID 2460 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe C:\Windows\SysWOW64\cmd.exe
PID 2460 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe C:\Windows\SysWOW64\cmd.exe
PID 2544 wrote to memory of 2424 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2544 wrote to memory of 2424 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2544 wrote to memory of 2424 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2544 wrote to memory of 2424 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2424 wrote to memory of 2376 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2424 wrote to memory of 2376 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2424 wrote to memory of 2376 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2460 wrote to memory of 2440 N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe C:\Windows\SysWOW64\cmd.exe
PID 2460 wrote to memory of 2440 N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe C:\Windows\SysWOW64\cmd.exe
PID 2460 wrote to memory of 2440 N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe C:\Windows\SysWOW64\cmd.exe
PID 2460 wrote to memory of 2440 N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe C:\Windows\SysWOW64\cmd.exe
PID 2440 wrote to memory of 2820 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2440 wrote to memory of 2820 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2440 wrote to memory of 2820 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2440 wrote to memory of 2820 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2820 wrote to memory of 1572 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2820 wrote to memory of 1572 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2820 wrote to memory of 1572 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2460 wrote to memory of 1664 N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe C:\Windows\SysWOW64\cmd.exe
PID 2460 wrote to memory of 1664 N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe C:\Windows\SysWOW64\cmd.exe
PID 2460 wrote to memory of 1664 N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe C:\Windows\SysWOW64\cmd.exe
PID 2460 wrote to memory of 1664 N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe C:\Windows\SysWOW64\cmd.exe
PID 1664 wrote to memory of 2160 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 1664 wrote to memory of 2160 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 1664 wrote to memory of 2160 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 1664 wrote to memory of 2160 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2160 wrote to memory of 1488 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2160 wrote to memory of 1488 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2160 wrote to memory of 1488 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2460 wrote to memory of 828 N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe C:\Windows\SysWOW64\cmd.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe

"C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe"

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c rem Kill "SQL"

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c rem Kill "SQL"

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlbrowser.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im sqlbrowser.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im sqlbrowser.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sql writer.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im sql writer.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im sql writer.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlserv.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im sqlserv.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im sqlserv.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im msmdsrv.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im msmdsrv.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im msmdsrv.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im MsDtsSrvr.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im MsDtsSrvr.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im MsDtsSrvr.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlceip.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im sqlceip.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im sqlceip.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im fdlauncher.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im fdlauncher.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im fdlauncher.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im Ssms.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im Ssms.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im Ssms.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im SQLAGENT.EXE

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im SQLAGENT.EXE

C:\Windows\system32\taskkill.exe

taskkill -f -im SQLAGENT.EXE

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im fdhost.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im fdhost.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im fdhost.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im ReportingServicesService.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im ReportingServicesService.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im ReportingServicesService.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im msftesql.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im msftesql.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im msftesql.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im pg_ctl.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im pg_ctl.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im pg_ctl.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -impostgres.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -impostgres.exe

C:\Windows\system32\taskkill.exe

taskkill -f -impostgres.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop MSSQLServerADHelper100

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop MSSQLServerADHelper100

C:\Windows\system32\net.exe

net stop MSSQLServerADHelper100

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop MSSQLServerADHelper100

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop MSSQL$ISARS

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop MSSQL$ISARS

C:\Windows\system32\net.exe

net stop MSSQL$ISARS

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop MSSQL$ISARS

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop MSSQL$MSFW

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop MSSQL$MSFW

C:\Windows\system32\net.exe

net stop MSSQL$MSFW

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop MSSQL$MSFW

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLAgent$ISARS

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop SQLAgent$ISARS

C:\Windows\system32\net.exe

net stop SQLAgent$ISARS

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop SQLAgent$ISARS

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLAgent$MSFW

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop SQLAgent$MSFW

C:\Windows\system32\net.exe

net stop SQLAgent$MSFW

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop SQLAgent$MSFW

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLBrowser

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop SQLBrowser

C:\Windows\system32\net.exe

net stop SQLBrowser

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop SQLBrowser

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop REportServer$ISARS

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop REportServer$ISARS

C:\Windows\system32\net.exe

net stop REportServer$ISARS

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop REportServer$ISARS

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLWriter

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop SQLWriter

C:\Windows\system32\net.exe

net stop SQLWriter

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop SQLWriter

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c vssadmin.exe Delete Shadows /All /Quiet

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTATEBACKUP

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wmic.exe SHADOWCOPY /nointeractive

C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe

\\?\C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe -network

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c bcdedit.exe /set {default} recoverynabled No

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTABACKUP -deleteOldest

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wbadmin delete backup -keepVersion:0 -quiet

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c bcdedit.exe /set {default} recoverynabled No

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTABACKUP -deleteOldest

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\wbadmin.exe

wbadmin delete backup -keepVersion:0 -quiet

C:\Windows\system32\bcdedit.exe

bcdedit.exe /set {default} recoverynabled No

C:\Windows\system32\vssadmin.exe

vssadmin.exe Delete Shadows /All /Quiet

C:\Windows\system32\bcdedit.exe

bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\System32\Wbem\WMIC.exe

wmic.exe SHADOWCOPY /nointeractive

C:\Windows\system32\wbadmin.exe

wbadmin DELETE SYSTEMSTATEBACKUP

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c wbadmin delete backup -keepVersion:0 -quiet

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c wmic.exe SHADOWCOPY /nointeractive

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c vssadmin.exe Delete Shadows /All /Quiet

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTATEBACKUP

C:\Windows\system32\wbadmin.exe

wbadmin DELETE SYSTEMSTABACKUP -deleteOldest

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c pause

C:\Windows\SysWOW64\cipher.exe

cipher /w:\\?\F:

C:\Windows\SysWOW64\cipher.exe

cipher /w:\\?\C:

C:\Windows\SysWOW64\cipher.exe

cipher /w:\\?\A:

Network

N/A

Files

\Device\HarddiskVolume1\Boot\hu-HU\How_to_back_files.html

MD5 7df3ccab2ebe176a63bbba964b16f0c9
SHA1 eaab2ed5bded5d5ccba512742e0f225393fa5cef
SHA256 61266cbbae3ec277e3c94fe16172cb3a5696c3588c619ae5c697ba1addbcc177
SHA512 e207cbd7f73072627e7cc12fbf8ec22f25f139ace74a7c9abe798776df015d663dcd5aa4c2fce4c3ddec7f58898e2dd5fbca1254e6179a8dbb202f7c109f93fa

C:\Program Files\Java\jdk1.7.0_80\db\bin\NetworkServerControl

MD5 2e8c999fbe2d98bcbd56845a8c23ded9
SHA1 2b1b236debc8c5e459ef58e13a8f623063f3bf7d
SHA256 061245f7a2b97494d781293866c0b4ea3fa3a38195b7194898ec69165c6aabb2
SHA512 e25febb8774351777dfee9bafc1295a91abcc8a4be8b47209b0483c04ab24bf480a6a6a6d98ec435d87b93a8529b194c18f9dc0dfcf2a7aa799b536071b94381

C:\Program Files\Java\jdk1.7.0_80\db\bin\sysinfo

MD5 51e2a9fd97136f733eca57d1f6cd5df7
SHA1 adef7b915612cb25bb31fb490300033d5e986b67
SHA256 618b8b548b7e1592a49b1b65f4ad77b117b368a23db55231f9638f3722fddfe2
SHA512 3cfeb1247f2feb40cc512ea45690c12c3c16417776dcb89517f58d72d22fb5e65c4bc6ce7beb7035776317c7df22ae6d4b2040d3e6fabaf1b171f7094a2939b8

C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif

MD5 2b7602d035c66cad780111523b907ac9
SHA1 ab657cba07155b155c295aa08860e270f9a18919
SHA256 7fac8b3942c89acaad4b9772196c52847f2809c86a74bce8a87f1c91c524ed4b
SHA512 47965ec62b9c7aea6b57821fceafbf1ccc5ca401df1973e945520379ee0b9e9d69a8fd1637020f25377910452173a0f9edbe70b0cbb8682e9dbe90a7e8057da8

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\UTC

MD5 6f0a962e3922eb6d3b9adf83bcd1e3f9
SHA1 24f2bc45c7a52cc3a49faedebb6e34c851c4937c
SHA256 8db86d23188bbb1cf310d17c4c71eecad731403695d3a61d5361fd5c60c258c3
SHA512 679a1951284305c90782fcb2c39bc034fbc7210dc30b959b8e9b41ab7329e9b3eddb18020cc58b5f0479f6c1347d7b3716db28fdbb85d08e0acb41fd4a432e8b

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html

MD5 d69aebd2fc785b7aa3d609bab1638471
SHA1 c397a6fa407122363825a154ad58bce3c2270ba9
SHA256 9c3aa7ffb6d43fd6d0ae133effce1c4ef15b7dcb88251ebf1ae4692f71e94f12
SHA512 1cc1fab88ec6207f8e376a610f848e07f8ebd6371c2bc02458c60ef5fecd00ec02d0ea7d11469cb1391918ca0d4ff4cd50f0bab7600ae184e29412d0c1980ad1

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html

MD5 6b9998d9aa18f73098efe47116b20199
SHA1 3a20a94d188fff3fabfc6ea2d6fcc528d93724c9
SHA256 a3d2f280e1e1432074c3582708938d39b8497167c6cce32260a8c1072feb0ab2
SHA512 8cd1e421e320f199e8dcc7fa8ebb9d60c918fe1b215928b912721270b2264e61a3840050ba396f8009780b8627f755e961977dc5f1728df862222a4dc9761f33

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\eclipse.inf

MD5 fff06a9cdf234710e9b65523d51f91a5
SHA1 6d62e283a81576c0e33428629e245d17f895ce81
SHA256 382ba91d1e22ecc25f34cdf3c61e60f2541caa8f3737ecdf1812ee21c30e0ac0
SHA512 9cd8762c339fad45360e3152b664fe50849160f234611acfa9993dda72dabefcad1a26390da7da39041ff62b0d78a213c9b772b15bb57a6830c97a68f0775bb0

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt

MD5 d801f4eb3950b70f7eaff2bfecf547fc
SHA1 83a1ac0ef3b55f0a35b70ba8bcebd05f783958f6
SHA256 d13ada53d4a96425cee591598f27bfb8eba0f27c63c48f6cdaa8725c3161c110
SHA512 e317244ebc65c06b1cdf965f23a1563d8d70dc82f96edbd45b146e891a23a4fe7816508261c23895f3c5e6c185c5350c294e3167f5a040b231093cac7baada69

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.RSA

MD5 11126f8501d2c381954831dfdf98ad17
SHA1 2c3a0dfa56081a475d5585798800eae9a9ed80b8
SHA256 b79723d6e86e3c31932d57c18d773c2f327844c9144830da8656077f9f9196a0
SHA512 55b63b59137c71ecbe2d905cd35d8916d3ce7ce9366f8e54d266ce3ec1e028122998ef8440231fb972339a10149cba47561e062a5c700f3d688b5ca03a7fdbb6

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\ECLIPSE_.RSA

MD5 86265d58f27220f953aff7e2f0f0516f
SHA1 f299410bc6473cf2a89cfe5c0561eb25c7ad119b
SHA256 5b4596f741e5929d21878c1a259609aa95fe8a0d05e9a6614fc1774fc044403d
SHA512 bcbe76e482eddd8047af73c4d755a064e3cb5ef657a17b269f249b267091a51f63e6e83ba774a8d042c89133a06e4fc30d22879f0db342f1341abf2cc7af684d

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\META-INF\MANIFEST.MF

MD5 2650eed9b099ec7c30b17adea0fbb34b
SHA1 8fef7576b2654c997e29ec053fecc345c606f9bf
SHA256 02018b78991e2b3481f752f04250172138f962eeb3f2a4c18a365422d3b9d8fe
SHA512 4d6925918cfc8c871c84d545697f5748a7cd9c1e042acfaf3680fce70e18b1741973944644b140fb408fd8be721780be93aa0a4eca722c4e64013a9babb3b6e9

C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-core-execution.xml_hidden

MD5 ab34aad1d92289c4ff9783977b8ce878
SHA1 2621bbfcd760b61bd3b713e9fa1a238cccb32f69
SHA256 2844b1b241c0cd681ada1cb6594d6a3db68464bd569a5ac97c9c345cbd792f07
SHA512 7e10a9533b20be78558854ba8df7f0f7d66806736b8a2d20cb02cd217b13b9e41c2bd9568642d37c9a8dc479c09d0e7bad343be0fa55246c448d0e6e3c338f8e

C:\Program Files\Java\jre7\lib\images\cursors\win32_CopyNoDrop32x32.gif

MD5 fed367a1243529a4b1a8144d5bc357a1
SHA1 c4936cf597aa935af79670e1f8f6e6ff91dda757
SHA256 12bf9cee9a2680f00d4f693e466c3453fc8267a8cc9755ef75d96e975e936a8d
SHA512 77263f4f05325aa276a65f81ad70e89c3ef1bc348cf1e54ff6a5ff69b2f9a9c3dd0d5463d543987b5713e0a8b83c65bc4cec9889c840b9c81d05a2a19f0305ac

C:\Program Files\Java\jre7\lib\zi\Etc\UCT

MD5 06d291dbf4d3b24e98a2dc040a0943f7
SHA1 ea6cead7a374af65e44ae7b13819231617f1cd29
SHA256 ebe4f6087d3ce91de3b4fdcd3bc5b8a027e9a5d497f48823565f989dcf2c675f
SHA512 8366b0a5bda1a062d4eed1fa2b9c6c41089fcbbe6a927cd48f7f2f253b53318556f39376af27b42befd73d8df9b15208e3db9db59fa8af69ca7ec98541591ce0

C:\Program Files\Java\jre7\lib\zi\SystemV\EST5

MD5 433018db14631f80b7edac0a16d36362
SHA1 07ec4317dfc6e65c69bcc33c1099e8d909c63ef0
SHA256 7dbdd1c6adff0877c36b11376f719a333c7807f7ff13c9948526c332d8c11157
SHA512 8926a02b1d4169e757d5a36ef35c675198448bbf0fa412ef003dd627ef0d5542e08d7f530c99dff97b73fc216d72c25135381f76856739a9e89cd0848f13e56f

C:\Program Files\Java\jre7\lib\zi\SystemV\HST10

MD5 2152c9cc0d953042ff0a03dc5bf0a8fe
SHA1 291fc0e64f773816ba150da7febce4f86a40573c
SHA256 e5ed7a623d8a1d29c54c9f02bffa90cb519e41dcbfe5215893d1a535b5c864f3
SHA512 e7c927438522fb3a33b3486f8852dcb75b0207381212fc3dc2b144994beccaf8f4566f2c65d47f90e070c2cf0ea4f815ea48d93e49a9689337eea6c9894eaa33

C:\Program Files\Java\jre7\lib\zi\SystemV\MST7

MD5 7fbd796345d634b5c8b4f33d3fcce392
SHA1 8e35f69603d030499f886a340ea8d9fe75d031e0
SHA256 34fb1e6fa1e820490034f21d1ac1976ae32b2edc579d4720d8cd2b4b52d5a0a1
SHA512 523246268be666dee3d4e965e9caf14716a663b584640b0d2c7e34c84b8e96d6436e990aee93ea835b7ad2195eafd4cad16413b4106bf8f3d01c6dd9c131ea1e

C:\Program Files\VideoLAN\VLC\locale\eu\LC_MESSAGES\vlc.mo

MD5 be68fc8845756580e4c2f8f30b702ba1
SHA1 3b8d372e7d0a650dec788a6473619b6d9e3de985
SHA256 c79ff6ec68729556fe6cce342e079ab411413f3f3986a9cdcc2a68f3e8dcb00a
SHA512 f4a6a89a8fdabe3c9814ad765740e64f143d8f4b30d463f4a1515d1cb1b68328fad02a161297ba4c5be79113bc396af61a11a6b152e511470e7264618a9ce262

C:\Program Files\VideoLAN\VLC\locale\mai\LC_MESSAGES\vlc.mo

MD5 37ee6c47668e9d449b0a6b22d88b4e43
SHA1 a8897f42432f143d76474f8f834affb06d607fa8
SHA256 bbb5974d71b24d058de9834d488dbf9263cc87f3432b5a999af8c0ae90caebe6
SHA512 2604e67975731ce6550dc4f2713964e27a002849f6647e865a638d3b34d79cb39beaa07bed61585031858918ef87c87e51c5bb78de5deef005558f928460405f

C:\Program Files (x86)\Microsoft Office\Office14\1033\GRAPH_K_COL.HXK

MD5 bbeb946848836652cfe8518077892dce
SHA1 8e5bbcc4fc789f13af3cc0c2655fa4ef4e7b51e5
SHA256 17f851fe04c204a12131597fa0d3e53bfb2e3ade99a2efb212bada5f16fb8a0c
SHA512 ae523cbf662366ac4ca552028baf624fd95b5fb31909290141b8fecfd9693f301838ab5575c2ca36d34f2f51f0bdd7ff7343c4fe360bec04c934dfe75380df51

C:\Program Files (x86)\Microsoft Office\Office14\1033\GRAPH_F_COL.HXK

MD5 0605452783ebb2153555a147d2754df0
SHA1 b9ec7210895c2fe976eac3d86866d119e7dfffaf
SHA256 62f61c5466401464be26d14fb25cc94c40e879587ebe09f89236e842dad9b45a
SHA512 4cb83912ebd56acc763c0fdd154b968ca156231978f1961e8d38930408942da393adfd7a097a5e7dcb0733ea835f8b66228db0ff056cea1ecb338774b84c7787

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_OFF.GIF

MD5 d423b8474992ec3ea651ae6d4568d4aa
SHA1 f8151a15d9e8b88176e14c5e946cb89e8da56330
SHA256 f5e35dbcb6af628b354253cc30d2116299091afc6cf3178929503896133f4b80
SHA512 8baae0b89ec0a6efb09b6df2eb616d4b2b9416c4dfd9b419279bc8c0bda5775a341fe0e92438751342f187b62303a7c9f84c58c811ae993b1be6799f63ae9e78

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_ON.GIF

MD5 8609992c6c9e023278818d24266e0d35
SHA1 c597d06680d53bddd61258d222b684f5693dcdb2
SHA256 efd33f951217a710fc6a7bddfca2666d6c5b38c77a7e9e13c22f7bb9d85ec889
SHA512 4bacca2fb6f235191cbb30d79ebad4016d2b0f24da467417ec3b7ee94fab6d557d588c85eef31d98d93cdaa54ea148f8553be9d7cb49019e36fee12cab4002e6

C:\Program Files (x86)\Microsoft Office\Office14\1033\MSACCESS_F_COL.HXK

MD5 85a0da64aea242079db3916d9ea33a09
SHA1 d2e2f0a602b81ebc19da897755a0fd05fa28b5c6
SHA256 ddbb4f20942101794fc430566d38e9475df0e890df2a9cbf868ad6d3c86ea063
SHA512 e53a504c97dbe87833232956a2f16fe539349331a1b0251b5a962c760e3319f6da91829a98f06a4dcfbf690f0aeed4250611838c4918ed628935c2855982aade

C:\Program Files (x86)\Microsoft Office\Office14\1033\MSACCESS.DEV_K_COL.HXK

MD5 64cc85da4b5f4abec0aaceb0606810e4
SHA1 fbe2c5da4d7f25c9698d6c5d1857f99aeb4818e6
SHA256 49e9bdf1eeea07a9946e56e05252fcb3a6e00ec673ba6211f343a4fed977c856
SHA512 100ffaf8455c9d08fb6b23cb6625a385a62f82988c10c9cdecfceb551584e0866a0a81de12c04c866ef9a0e367b1fff8ef144e03d45fb33e47378d68aa3f1fd4

C:\Program Files (x86)\Microsoft Office\Office14\1033\WINWORD_K_COL.HXK

MD5 a64ffbec15de5915923a4b1958715929
SHA1 97a1743de98031b7f7b13024dbdbca481ade2e3b
SHA256 57951470ef9da64d28638c77c32a7494f1ee29e57974a8f6219a06908e4c6ec2
SHA512 09065961b6d184d9314dc95f7ffe5cc19e107098dd12df40f68189b491f9c6ec2db8c617cb42fa897ae328a3bbd46a47d52b62bff8e791c71a4559135abb8b5b

C:\Program Files (x86)\Microsoft Office\Office14\1033\WINWORD_F_COL.HXK

MD5 bed9c2c7ea0e842a367b9a1dd842cba0
SHA1 855530256c50deb8eaa7e6bafb5b3ea433f3c273
SHA256 a9ebca866d7bc3a812140d729afa5519754130d89a8a3b52bee7ac860bed2dc8
SHA512 563ebcf8d660e1a5d2733b00dfaf834fe51e1bb3fbcac75aef561075b5ca6179efb03c6db3d8cfbdb42bb5492eb1d672ad860978356de8e9ae2ca6c6172e4232

C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\Style\SIST02.XSL

MD5 5b9bfa9053513a95075e1151245555b0
SHA1 bb89631cc69b2dafb13261d2f211371e7ac9a802
SHA256 a33abd845b0357e68a3feef912d5954f1cb1db1a42376d56e994bfbe8a119c66
SHA512 06cde1cc397a54f3693a15360e23a91e7309ab28999cf13a4085a962aa42def7acc36c0f078ea95ac8fc1e9e627f5ad4a7f05e0fed8ad9ec7cb0be5c4a5a4fe3

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Biscay\TAB_OFF.GIF

MD5 3c018899c618146cdfcd1b8cb5ef6b84
SHA1 c1be775290d158faac0cbe47662c17dfe636e0e1
SHA256 878d01c308ec1d99d7b8babbe61a0706265aa8d5bd153bf8cef2eb43fdd9b5fd
SHA512 5d3256bb3cd3286df24d645afe1dbc2488a927693747539aa1d3431705d3573a3899bd69c07cfde2dde1b5792dc9681dbc4dcfa448cf839c4835626d9c1b2112

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Biscay\TAB_ON.GIF

MD5 c9850ee1f422aaad3c2c9799c48f1674
SHA1 98b3900d029ff7b1be2bffbd79f146c18812f0a4
SHA256 3cc461519931a5984c5d95c3bb8f715bfe02342b8b6b683b5e90f4328c608e21
SHA512 19575c5320fae195c61898bc899b555e58de393e2bea5d0d38b91e70ed61837a1e35c3d3b3eeded9525f9175a9fb44bc34b6a1e0135bb0c995f5dd80a5bcd10d

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\tab_off.gif

MD5 55ab03dbaaf10eb4d80018a834ca8ab7
SHA1 5e84fd966bc0cccb7aff172d0c116e69e825e733
SHA256 1e7904a21029950412cfbdb2b8246b62685f68b8d4b32e79a514484d9ac5e143
SHA512 b1b8d91a3cfebf47a52c2a60773d6a60cccf68bd2f568df2db545ff4f891747b2cb86189c90cb0095ef0ec4dd37eae57774bca41edc593322f8e34f128e6da35

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\tab_on.gif

MD5 a2c681b3f22e3ef07d07782583cc2e7b
SHA1 974bd311745472620c544c4711ae90f409fdbca5
SHA256 b15b076ef5cadc020d96d3674435dad1e9e66cd0b1bf6f392ad064b6d0e30ad9
SHA512 e5ba6341d893d10d04cae92dc90c1a3089c61172b3a68c63eadd569bbd9680e0fefd0d2d0b5457f3b6270cc7a548cf3ba7279a29ac244a91326e77d0c9d436e9

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Oasis\TAB_ON.GIF

MD5 2c5ab6962554015ea19c3e458aa08f2b
SHA1 9d950de5dc382e7d21ca3281b279bb8687d55c5a
SHA256 3c377dd317e5d030016608d0292ce30725777be8e765f561981b4043e50c0347
SHA512 5d88d546e97b25db64301a00518ac1689e99994cd89bd1a7c53463cd9cbbf26d0a62ae1876cd02262ad11ccdd863d16eccfce1beba65c161f5c47a6f4ea624ff

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Oasis\TAB_OFF.GIF

MD5 31d315884f1fdc26b9f13d856ca933c0
SHA1 abab18eb7077840b095bed08975846a30e93c808
SHA256 78f907cbd32069447cf5a581129b344c96aacdaed331f796ea3c234bbd1e5a5d
SHA512 6504378e28e7f8b624ab9b4ef2d318fd4c9090725c2bd26de7363e969deab38713cb7b783ef5d42eed632dc1f2dadb78f1f8e125d26fce23b57b42ded0aba6e5

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_center.gif

MD5 20125feb41ac26040b911ce763f1b150
SHA1 70125bc16faa0e5c358dba1610b41e06222055b3
SHA256 15a0842613bfbab4ac96a6fd8f282bca5d4f61f910e6f856bcafae6ad3f86fcf
SHA512 82b27c8be54553a956d26012bf3244b180f6e09c5a9b702057585c4114b8407dc1ecb6137fa69ffecb57f39ee8baf9ff2d203f6a31b5b503c091801721e340a5

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignright.gif

MD5 02844f1523d18df9eacdc80909a8edf3
SHA1 4b98ecafcefe9873455ebb876b96ac3665353266
SHA256 b19ce850989cbebd74570d4444f069e690eebce68058756f00d77bcebbee03ba
SHA512 e35c7a57204f398e4c58f9cf101c6f12a81f05e601a8951dacd6a1fe41289668ab6945a9cd79afaff32ee8c547edff44ac3b538c70125626402b1669ad379264

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_pressed.gif

MD5 51dd219e8f7b8bff62bb11aea06d439b
SHA1 3a1a518f1cf0d36a319e1af93e463b23a7f81fa9
SHA256 20d5d5b95526c392d149e3bee28c0a6eedda1a8e538834f403af236db02bfbd2
SHA512 0a3b99931b5493c06871987b15b70aa17bbfea86a3d4c9dc1b0f2fde88da5b4806d5f7330d19d1f137d707e6f67d8e7e83722b5fd6490e5614fd2652ab6adbcd

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_justify.gif

MD5 770ef143ecc0c8bfee9fcdf1ddea8039
SHA1 bcfaad945da184abb29053afdbf00cb4fa26a67b
SHA256 a46da86506405a699304834b6a3d994dcea9b1028c06fd5db8b4d30e987e3465
SHA512 bed2ee5faa68f2a431becfb3f73ce10bd697d4dadcdfcb96b64c36c068f521600412ea966c8bdbe5a36db1603f209e6fd78e623baf1a60ef878679baad62063a

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_increaseindent.gif

MD5 87adf9cca8694b6310ec79554a1b86af
SHA1 e152e5d6e0cd7722ee0abaaeeadda731a66c1d7e
SHA256 452cd3cbe7a6c296dde625f4cccbc6c96fa4b2451eacb45fbcbb15980c849185
SHA512 ee3cb11528d45c1dd231f148f0f3a523949123d2035d27150be63ef3f309a8fb5f168bcb8f67e4d95ea6969a07b3560d241f3b7b413228e4c60a986367c7b733

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_decreaseindent.gif

MD5 0f4ff6706d5b4a4bbfed1e1b6fb748a9
SHA1 f3f23f1b8a41439cda5464de4dfc7ef578887078
SHA256 0b5719cd91ea2d53dd204d39f0f2fed5eeae30471067ffb7c914e2c7a6533302
SHA512 c3e6240986c1ebe595c3b83fc05f93eaaa031eb31d998c03cba11d4d7b6cdaca7fa886939eaeff7ee5f62fd83b5169bda4768bd745f2f56379e7a95272dd2e13

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignleft.gif.savelock52

MD5 605c75af9489bb779e0afad32860b22c
SHA1 a29758952c7c21f17e14fcfbc8282750f8d03223
SHA256 7f990668095ac5de7d6bdd72ae6c70f5ed5230da402c2e18df20ce4ae5f2c7e0
SHA512 c222fff1dad7a44583da377f15fa96cf85f138b55683ea9147211007c532e7ddd177f0af588534d4dd90763303368dfe6a95ea906bc72760eaf1fb7b094c1d8a

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_bullets.gif

MD5 3018aa13f7fb930f185a7adf4154c07e
SHA1 d99390fec520bbe05b444a640e8fc7784f08c805
SHA256 7f8d833a042641e899148740fa5e33dc9beabb8fa23d9d8c937d54fca7be4cb3
SHA512 8ff03f76c571042ae77941336772731d11793a7c9cd72eb52ae40d644bc8c2ee0859dde2296783a4ab7123d50cb62603aafba5a1a950a0df5dc3de6fde7c8cad

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\LAUNCH.GIF

MD5 4ca2ddd5b8186a1b3687f986aa1aceef
SHA1 a885c87a0d41f173236a4106486754c53aea5556
SHA256 8f24984befed8cb01942874aa64f196a59af07bf7c271a3c36b84fb0ffad6d41
SHA512 bc2679de6dbb2fe35dfd42ad638786aa372031eab3f30fa47a9f2d3173b736e4fc1a72df65db1aef54d0eb283d4e8be686a5fd13d086e3d6d4070b1b58104147

C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\InfoPathOMV12\Microsoft.Office.InfoPath.xml

MD5 101035a8bac5337771ef6c39576afd2f
SHA1 2fe4ab26a7e1191c27d822a2a2126e386df8a87b
SHA256 646cca6f187992b6c3c018eca51fc97b099ec422fd638675fe58dee7a898d145
SHA512 2001bea5788d501471481d04fd3c9bf9f24adc0cff476247476158b5df74c72bf8a21cd13b390328773113f513210ac59849d85caf511ac51f346ac5a82e5c87

C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\TALK21.COM.XML

MD5 3ae4ea217451b7d0a15370ea32bd8069
SHA1 8836d7f4a7230e8b02dec701c6127c5df61417a8
SHA256 26cdb9366723ce26bf847dbc3847f66b496caa7f287923d8ab5b17322bce3cc1
SHA512 dafcbb82c4e87c6ff593412e2f5be0b2b37f12075dffb43d6342833f09e4697aeb61c5abf27d0e6db014fb4b2e848ad44246e73f96ba829937bee5b0cbb6d526

C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.COM.XML

MD5 a3e06b8aa5e0b5748767bdf3a038f317
SHA1 e3fd1d36163c75bd11a646a11f5ea095f4e289d3
SHA256 3e9e32e0eeef0f360a5f1e8a912d9f93ef8281c7d719ac7c3ca7b58781f0a9a0
SHA512 79808b4c63f2a8278de544e6dcf4580247cb5763ab1107d864300817f339367fb4aaef0f9f221e86f1acd60cd216ed00c1f8cc36c4d0b78c68fd9266fba9b530

C:\ProgramData\Microsoft\Assistance\Client\1.0\es-ES\Help_MValidator.Lck

MD5 41f986d5e0de90b0181f1b710eec82c8
SHA1 3f5f67f55b8101bcc60e96fc9b51005fc5acb086
SHA256 9169fa9b64cd7910faf9b6f07df4848d55f5c5e7456a2058eaf9120aae35ce8b
SHA512 86408a26075d15a9eec2e4782f1f74e50023d6b1ff6cdd64919e3fdad76f289313310c97d13b3269b486509fc5a0fcd2ea0ddb719887ef84de8eea28986b7467

C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\CiAD0001.000

MD5 2f36e31b2847a3b71d2f3fcae2127f3c
SHA1 27983055f3fe8d9851c5127f201f40f4a34af377
SHA256 7a4b0e1bda193ef2af096fb40da2cab0141cbc3b37f82bde531935f53bf3b7c0
SHA512 35101320a669c17b6f323ec2982f50a70f0cb751035689cbe4f621e1ff85eadc96230536c35d7b0abb500436583861f9bcc4e2b6c610fb86733cef417df3c332

C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\CiAB0001.002.savelock52

MD5 256a15b505fa214ff0f272a99950d685
SHA1 4728e9305f6ce7727b87212044ad4d9cb9e6e097
SHA256 3d33de1dc904b5871d1dc00653c964e77abf1a4fdd0cf9c6aeaa3ff4b0f998a5
SHA512 3cf6df71c6c76a403fdd4fe1c8521c6b558f0b30cdf54cc33d0e748064601647f5dcdda849fc1fa709317bc5cd4a972c5c417efc7efbddf8044fe2cd5ec59d76

C:\ProgramData\Microsoft Help\Hx_1033_MValidator.Lck

MD5 16b50bed87d7ef719284c6137f9b728d
SHA1 9fc1be5b4fad027462d36dbc76b8040e7d0ad407
SHA256 160df022c84ad566164b7ae51feb1e77965f74d71bae16950e55db0882d34557
SHA512 0683abb6b736f934e30e2b8fddbdb269019146385328b4ac9ea3aa4d84c7bd769fc9592304104f7b6aa6f4ded129c9dc903ea86615b3f2935e14833ee6b2d957

C:\ProgramData\Package Cache\{7DAD0258-515C-3DD4-8964-BD714199E0F7}v12.0.40660\packages\vcRuntimeAdditional_x86\vc_runtimeAdditional_x86.msi

MD5 ae6afea353023d766a5668cb95d94f5d
SHA1 fe55dd687457bb6e80a9c5d3c2c7f100b9f7368c
SHA256 05cf7f74d29eef5d0265d92c4e1a501fafeb1b1438398f789ac9e1a05f123277
SHA512 c470deea77b8441776a3ebe848903f27d11abb410bd904d55f710138c8798cc7eeeb30fd20f2ab7f523675ec324ee7be69f12eaca0d4effa8bdc9579e976c761

Analysis: behavioral2

Detonation Overview

Submitted

2024-02-27 18:03

Reported

2024-02-27 18:06

Platform

win10v2004-20240226-en

Max time kernel

149s

Max time network

95s

Command Line

C:\Windows\Explorer.EXE

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess

Description Indicator Process Target
PID 2772 created 3452 N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe C:\Windows\Explorer.EXE

Deletes shadow copies

ransomware

Modifies boot configuration data using bcdedit

ransomware evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\bcdedit.exe N/A
N/A N/A C:\Windows\system32\bcdedit.exe N/A

Renames multiple (6539) files with added filename extension

ransomware

Deletes System State backups

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\wbadmin.exe N/A

Deletes system backups

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\wbadmin.exe N/A

Modifies Installed Components in the registry

persistence
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Software\Microsoft\Active Setup\Installed Components C:\Windows\explorer.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BabyLockerKZ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe\"" C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BabyLockerKZ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe\"" C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened (read-only) \??\F: C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened (read-only) \??\F: C:\Windows\SysWOW64\cipher.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened (read-only) \??\A: C:\Windows\SysWOW64\cipher.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\How_to_back_files.html C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\ca-es\ui-strings.js C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\WidevineCdm\_platform_specific\How_to_back_files.html C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\FetchingMail.scale-200.png C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\favicon.ico C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Videos\Help\Sticker.mp4 C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTest-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\LTR\contrast-black\WideTile.scale-100.png C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\How_to_back_files.html C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\images\How_to_back_files.html C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Cartridges\sql70.xsl C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\sr-Latn-RS\View3d\How_to_back_files.html C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-80_altform-unplated_contrast-white.png C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsAppList.targetsize-64_altform-unplated_contrast-white.png C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ui-strings.js C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\de-de\How_to_back_files.html C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fr-FR\tipresx.dll.mui C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteNotebookLargeTile.scale-100.png C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailSmallTile.scale-150.png C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-16_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\sv-se\How_to_back_files.html C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\new_icons.png C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\How_to_back_files.html C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\hu-hu\ui-strings.js C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\tr-TR\How_to_back_files.html C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\MLModels\autofill_labeling_features.txt.DATA C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxGamingOverlay_2.34.28001.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\GameBar_AppList.scale-125.png C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Viewpoints\Light\Cavalier.png C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsSmallTile.scale-125.png C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\How_to_back_files.html C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART13.BDR C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Microsoft.Membership.MeControl\Assets\OfflinePages\Scripts\Me\MeControl\offline\webviewBoot.min.js C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-black_targetsize-96_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\Standard.targetsize-16_contrast-white.png C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\Doughboy.scale-250.png C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubAppList.targetsize-36.png C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_listview_selected-hover.svg C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_CA\en_CA.dic C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_~_8wekyb3d8bbwe\AppxBlockMap.xml C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_222222_256x240.png C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\index.win32.bundle C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened for modification C:\Program Files\Windows Defender\ja-JP\ProtectionManagement.mfl C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\node_modules\reactxp-experimental-navigation\NavigationExperimental\assets\back-icon.png C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\Glyph_0xe7d1.png C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File created C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\How_to_back_files.html C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\nb.pak C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\lib\management\management.properties C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-black_targetsize-30_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\es\How_to_back_files.html C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_MAK-ul-phn.xrm-ms C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AlarmsLargeTile.contrast-black_scale-100.png C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File created C:\Program Files\Java\jdk-1.8\include\How_to_back_files.html C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-48_altform-unplated_devicefamily-colorfulunplated.png C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\ExchangeLargeTile.scale-100.png C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailAppList.targetsize-72.png C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\cef_extensions.pak C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\LEVEL\PREVIEW.GIF C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-black_targetsize-60_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\ar-ae\How_to_back_files.html C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\it-IT\MSFT_PackageManagement.strings.psd1 C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsAppList.targetsize-64_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp4-ppd.xrm-ms C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTrial-pl.xrm-ms C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.3.etl C:\Windows\system32\wbadmin.exe N/A
File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.2.etl C:\Windows\system32\wbadmin.exe N/A
File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.1.etl C:\Windows\system32\wbadmin.exe N/A

Enumerates physical storage devices

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\vssadmin.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-275798769-4264537674-1142822080-1000\{A3BD40EA-156C-4100-A6F9-A13A17DD07AD} C:\Windows\explorer.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ C:\Windows\explorer.exe N/A

Runs net.exe

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\explorer.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\explorer.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2772 wrote to memory of 4752 N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe C:\Windows\SysWOW64\cmd.exe
PID 2772 wrote to memory of 4752 N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe C:\Windows\SysWOW64\cmd.exe
PID 2772 wrote to memory of 4752 N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe C:\Windows\SysWOW64\cmd.exe
PID 4752 wrote to memory of 3612 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 4752 wrote to memory of 3612 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2772 wrote to memory of 2432 N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe C:\Windows\SysWOW64\cmd.exe
PID 2772 wrote to memory of 2432 N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe C:\Windows\SysWOW64\cmd.exe
PID 2772 wrote to memory of 2432 N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe C:\Windows\SysWOW64\cmd.exe
PID 2432 wrote to memory of 5104 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2432 wrote to memory of 5104 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 5104 wrote to memory of 468 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 5104 wrote to memory of 468 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2772 wrote to memory of 3768 N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe C:\Windows\SysWOW64\cmd.exe
PID 2772 wrote to memory of 3768 N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe C:\Windows\SysWOW64\cmd.exe
PID 2772 wrote to memory of 3768 N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe C:\Windows\SysWOW64\cmd.exe
PID 3768 wrote to memory of 2256 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 3768 wrote to memory of 2256 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2256 wrote to memory of 4248 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2256 wrote to memory of 4248 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2772 wrote to memory of 2980 N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe C:\Windows\SysWOW64\cmd.exe
PID 2772 wrote to memory of 2980 N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe C:\Windows\SysWOW64\cmd.exe
PID 2772 wrote to memory of 2980 N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe C:\Windows\SysWOW64\cmd.exe
PID 2980 wrote to memory of 4928 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2980 wrote to memory of 4928 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 4928 wrote to memory of 4984 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 4928 wrote to memory of 4984 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2772 wrote to memory of 4644 N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe C:\Windows\SysWOW64\cmd.exe
PID 2772 wrote to memory of 4644 N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe C:\Windows\SysWOW64\cmd.exe
PID 2772 wrote to memory of 4644 N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe C:\Windows\SysWOW64\cmd.exe
PID 4644 wrote to memory of 2272 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 4644 wrote to memory of 2272 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2272 wrote to memory of 1672 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2272 wrote to memory of 1672 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2772 wrote to memory of 3416 N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe C:\Windows\SysWOW64\cmd.exe
PID 2772 wrote to memory of 3416 N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe C:\Windows\SysWOW64\cmd.exe
PID 2772 wrote to memory of 3416 N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe C:\Windows\SysWOW64\cmd.exe
PID 3416 wrote to memory of 2056 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 3416 wrote to memory of 2056 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2056 wrote to memory of 4816 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2056 wrote to memory of 4816 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2772 wrote to memory of 4256 N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe C:\Windows\SysWOW64\cmd.exe
PID 2772 wrote to memory of 4256 N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe C:\Windows\SysWOW64\cmd.exe
PID 2772 wrote to memory of 4256 N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe C:\Windows\SysWOW64\cmd.exe
PID 4256 wrote to memory of 2796 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 4256 wrote to memory of 2796 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2796 wrote to memory of 3568 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2796 wrote to memory of 3568 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2772 wrote to memory of 2276 N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe C:\Windows\SysWOW64\cmd.exe
PID 2772 wrote to memory of 2276 N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe C:\Windows\SysWOW64\cmd.exe
PID 2772 wrote to memory of 2276 N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe C:\Windows\SysWOW64\cmd.exe
PID 2276 wrote to memory of 3056 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 2276 wrote to memory of 3056 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 3056 wrote to memory of 540 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 3056 wrote to memory of 540 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2772 wrote to memory of 448 N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe C:\Windows\SysWOW64\cmd.exe
PID 2772 wrote to memory of 448 N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe C:\Windows\SysWOW64\cmd.exe
PID 2772 wrote to memory of 448 N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe C:\Windows\SysWOW64\cmd.exe
PID 448 wrote to memory of 1596 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 448 wrote to memory of 1596 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe
PID 1596 wrote to memory of 2860 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 1596 wrote to memory of 2860 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2772 wrote to memory of 2752 N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe C:\Windows\SysWOW64\cmd.exe
PID 2772 wrote to memory of 2752 N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe C:\Windows\SysWOW64\cmd.exe
PID 2772 wrote to memory of 2752 N/A C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe C:\Windows\SysWOW64\cmd.exe

System policy modification

evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe N/A

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe

"C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe"

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c rem Kill "SQL"

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c rem Kill "SQL"

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlbrowser.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im sqlbrowser.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im sqlbrowser.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sql writer.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im sql writer.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im sql writer.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlserv.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im sqlserv.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im sqlserv.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im msmdsrv.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im msmdsrv.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im msmdsrv.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im MsDtsSrvr.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im MsDtsSrvr.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im MsDtsSrvr.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im sqlceip.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im sqlceip.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im sqlceip.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im fdlauncher.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im fdlauncher.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im fdlauncher.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im Ssms.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im Ssms.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im Ssms.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im SQLAGENT.EXE

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im SQLAGENT.EXE

C:\Windows\system32\taskkill.exe

taskkill -f -im SQLAGENT.EXE

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im fdhost.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im fdhost.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im fdhost.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im ReportingServicesService.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im ReportingServicesService.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im ReportingServicesService.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im msftesql.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im msftesql.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im msftesql.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -im pg_ctl.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -im pg_ctl.exe

C:\Windows\system32\taskkill.exe

taskkill -f -im pg_ctl.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c taskkill -f -impostgres.exe

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c taskkill -f -impostgres.exe

C:\Windows\system32\taskkill.exe

taskkill -f -impostgres.exe

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop MSSQLServerADHelper100

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop MSSQLServerADHelper100

C:\Windows\system32\net.exe

net stop MSSQLServerADHelper100

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop MSSQLServerADHelper100

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop MSSQL$ISARS

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop MSSQL$ISARS

C:\Windows\system32\net.exe

net stop MSSQL$ISARS

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop MSSQL$ISARS

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop MSSQL$MSFW

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop MSSQL$MSFW

C:\Windows\system32\net.exe

net stop MSSQL$MSFW

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop MSSQL$MSFW

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLAgent$ISARS

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop SQLAgent$ISARS

C:\Windows\system32\net.exe

net stop SQLAgent$ISARS

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop SQLAgent$ISARS

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLAgent$MSFW

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop SQLAgent$MSFW

C:\Windows\system32\net.exe

net stop SQLAgent$MSFW

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop SQLAgent$MSFW

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLBrowser

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop SQLBrowser

C:\Windows\system32\net.exe

net stop SQLBrowser

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop SQLBrowser

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop REportServer$ISARS

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop REportServer$ISARS

C:\Windows\system32\net.exe

net stop REportServer$ISARS

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop REportServer$ISARS

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c net stop SQLWriter

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c net stop SQLWriter

C:\Windows\system32\net.exe

net stop SQLWriter

C:\Windows\system32\net1.exe

C:\Windows\system32\net1 stop SQLWriter

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c vssadmin.exe Delete Shadows /All /Quiet

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wbadmin delete backup -keepVersion:0 -quiet

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTATEBACKUP

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTABACKUP -deleteOldest

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c wmic.exe SHADOWCOPY /nointeractive

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c bcdedit.exe /set {default} recoverynabled No

C:\Windows\SysWOW64\cmd.exe

\\?\C:\Windows\SysWOW64\cmd.exe /c %windir%\sysnative\cmd.exe /c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c bcdedit.exe /set {default} recoverynabled No

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c vssadmin.exe Delete Shadows /All /Quiet

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c wmic.exe SHADOWCOPY /nointeractive

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTATEBACKUP

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c wbadmin DELETE SYSTEMSTABACKUP -deleteOldest

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\cmd.exe

C:\Windows\sysnative\cmd.exe /c wbadmin delete backup -keepVersion:0 -quiet

C:\Windows\system32\bcdedit.exe

bcdedit.exe /set {default} recoverynabled No

C:\Windows\system32\vssadmin.exe

vssadmin.exe Delete Shadows /All /Quiet

C:\Windows\system32\wbadmin.exe

wbadmin delete backup -keepVersion:0 -quiet

C:\Windows\System32\Wbem\WMIC.exe

wmic.exe SHADOWCOPY /nointeractive

C:\Windows\system32\wbadmin.exe

wbadmin DELETE SYSTEMSTATEBACKUP

C:\Windows\system32\bcdedit.exe

bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures

C:\Windows\system32\wbadmin.exe

wbadmin DELETE SYSTEMSTABACKUP -deleteOldest

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe

\\?\C:\Users\Admin\AppData\Local\Temp\f584c124d92b09ba12d2538d52300dc38ef255c6ad23c30e7569ff1920388c50.exe -network

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c pause

C:\Windows\explorer.exe

explorer.exe

C:\Windows\SysWOW64\cipher.exe

cipher /w:\\?\F:

C:\Windows\SysWOW64\cipher.exe

cipher /w:\\?\A:

C:\Windows\SysWOW64\cipher.exe

cipher /w:\\?\C:

Network

Country Destination Domain Proto
US 8.8.8.8:53 84.177.190.20.in-addr.arpa udp
US 8.8.8.8:53 196.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 167.109.18.2.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 208.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 181.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp

Files

\Device\HarddiskVolume1\Boot\How_to_back_files.html

MD5 2d4ec84e4d633b51b4f4a98a7038f478
SHA1 0ace9eec844ff282ce0b2efc528da4537cbb0e4a
SHA256 56c2c54d557c249e23aa046c92e892939943ba90ee2a0799e8f6885d317e9443
SHA512 768ea7da80c46166594ba092dcb5256844e2af26bd4c7764e05025ea02627da62789bf93524927e31851d30916754768be1a21660eaef2bca330f246808ec777

C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif

MD5 21b50658c21ab79d0d6477482c0975d1
SHA1 dc19722c93a1302bf415ed34ba46fe9833e84042
SHA256 c37fdcb0b1e615557cf947977e2e7718318565c2809c0bf1096492aea7c769bf
SHA512 15ee8c8509700e5fc35f8405336d06873c773d2483ad237745341d12345470701344d12da40f07252b1bc6bc5a01f40c12f1c26c4fa85e9bd81b1ef876f9d3d6

C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_MoveNoDrop32x32.gif

MD5 0c360b017e3d554e670a7299da6fc404
SHA1 c0ffda1d2f0e458f399929efb77303f050b80045
SHA256 8c26999f2c20176fad6cbba9e2808b35acc26ed710c5ce5c505541718d92bd9a
SHA512 555aec0d4f6345db77c5f684b3fb4384e57e83a6df870d28151fae659d20660a9a21d8cd9128501f0e15fc89913ef9fd4a863023536e13cdda91f8d8cb74ead1

C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt

MD5 4d6f097458fca8bda3d06712cee9b374
SHA1 5dfd234e5d52d10738f2bad2da30f7fc818f1699
SHA256 57d275bfdf94d464929cf880a38db7db63ea14b5356e9b5f6629fea4ea60b135
SHA512 15004052bea6b37a1c36f6883e55e2fd788d47a7addfba845f64856a94501d958da09eee5fd41b7140f25a807ab4796552159e96490e1c0cba94abf646e39fd3

C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC_K_COL.HXK

MD5 2c4b6698c61d68c36ad468e83833d825
SHA1 d2ed839cb5d0a9636c38d79f7cb003e59b0b87c6
SHA256 9fba44f21e90a3d4004113ce3c4a36505adb6443f532c68517a733f53d6b6663
SHA512 ba0653a32ab2c78fa811d62c35af957d7b7e39735bbff06e47aeb53319603bc98756ea2e681b81cc1e48e00ab4781d962f4061db8fbd530e4bee54442f6dbdcf

C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC_F_COL.HXK

MD5 0d6279f1c43055f27ee76160f39041d4
SHA1 23bdd2f5f2b716124cebc4675e74a0426c0a4d7e
SHA256 a78e7a54d5d2d0400126d5daa0f13af92e0753412cb4b92ec26c3fa4f12ff13c
SHA512 bd5f79cc5ae2e76091b8fdb24104066fb03462ca3f70e61ac4cab4bcb286a7533c515c70d4caa9ca0fca04d1e3c8988b5631339df5d276a3c0a8524e1d894d26

C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD_K_COL.HXK

MD5 1deb95a56682db3b5c53a31b716fa8a4
SHA1 23da4a36acfbae78990e2e44cb45fc233adbf03e
SHA256 38ed36b2c6dde995c05c211ac68ca2d9d79e42baf2d21165627112984b2046cd
SHA512 8b80d8526329d8b7bbd9f7de51255e480dd2bf6a0a8bc9aac4851f896b6328712cb464172198527ab5660c51475d48a41495c0c95fe6b4e46de8af86ffbbefc6

C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe.config

MD5 9ec7945cc115e4393c55336558169c4a
SHA1 94d3816bc8dd9438c56e8272f4a251b7ed7452fd
SHA256 3675c20b83f61289a61b044e223b65513afcaf6fe0eb61daa63af28b2bcdf8c3
SHA512 a3083926edd7e8f37f5db120d3543a7b954d8dd184c4fb45d106e29511f498c91cb61e0638b4850072662eac08134a82d861d1cd7023f649a84cbc0f7c177754

C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\SIST02.XSL

MD5 71f3d699561182b9483e778ba36d03dd
SHA1 ddd21e447271e6bf73085ef770bbb73f061b15e6
SHA256 5922e8618f97ed2ac2936272945ca0cda45abb198667736c9dfdaff9184f7aac
SHA512 7a09efb2e501796e4200cd9346d48c973345302e6e1338801bf520f5fa6fd7b04d88fa63695e967a6c2950a88d3c4565866f5664b4e887020f46a88f31199829

C:\Program Files\Microsoft Office\root\Office16\PROOF\msgr8fr.dub

MD5 9613a57c90135a0720b52c6a29a40c30
SHA1 f497cc8f07c148a7c82ba3f1c2ec94394141cae6
SHA256 1b59e0acc89990f907eb1b88bbc3b86c6356894e564e05b90baed5b8947d7773
SHA512 f2d0dc0e2396cee4138128e5a182a69537edca25f0ce13b252462b532de898f7b52d235cfb56b273fb57580f04c723f5fa3a5ecc0395b72822ab7a820f239ab8

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\osmia64.msi.savelock52

MD5 947effb65724ca42b44c7623d60c8373
SHA1 95d7d7d9be67ef87dd1aa1f7ef753d9650ef3cad
SHA256 b0ed1a30c0da9b3cebbbc7cb61d552bfdb837ea453de7a6b76258721bae5ce06
SHA512 149738de6f240bf6181556ed11345d4a67364a84c5a07e6e26801528e95b1e3ec585e20e0363c6e4502180199f5b116cb47891e944aa2783669f332f02513383

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Cartridges\Informix.xsl

MD5 449310df8f8115283f4f472bda97bcce
SHA1 e4a25df7764157b80fc725ce6e4a55cda14fc107
SHA256 07935da670a68132711a43cda84eb4014c7dac1b94cad60b3b8d558f14fc2cf6
SHA512 ff1b87f66304c342b30eea450bd9cdef1164e668fb411040c2320773423a95432e339deb6dc6ee5ff10b80c08e7c7933f50253dffe7be7d85071672a8c4854c2

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Cartridges\msjet.xsl

MD5 cd27573dfec72865e9dbb85b5811a5b1
SHA1 59c17db38c3a417cea7e5a0e0559f92523780554
SHA256 360956a6c34950b4941dfaa2d47511b9aa0a7040b78dd42020f2fcb44a482401
SHA512 f5fcb1e7aba8c71a61a24a6c8b6e972ca415c1441803d86a1ded02aa23a0e4c29f82e38c2f0158756b13c68f68b4b76746640b26c00d6388a17dc175c65db11a

C:\Program Files\VideoLAN\VLC\locale\eu\LC_MESSAGES\vlc.mo

MD5 79eedbd72339dfb041a8d9bd8f714221
SHA1 3252c93ca10d0f2fc45676c65621fc1f4229ad1d
SHA256 85c9d34a8459b6e7393ef2647297fdece0d6233c3b0a258abd3454c870c8070e
SHA512 397cc22e521b61344d914ce077c6fe5368d4efa29bfc36a014178d5079a06b0250d150e284499e09af061e71c6af12b85b01b81991f8a65a527a9db32f00a59e

C:\Program Files\VideoLAN\VLC\locale\mai\LC_MESSAGES\vlc.mo

MD5 8d53255fb701101ecdff4e34f012365a
SHA1 7b4126bdad96e9334b898d6f39ef8a1cfcdba494
SHA256 8cbaf107714f9af92847dc4a5e9879c7f39f01bfb21885e8c843b828de645087
SHA512 791ac5a089b0308d2e73a03779ebda043e977f2ad2793ea57f74cc7f20aff9f1773100b2c24fa19219e1e68967ecc17e11594054afb9c1580374fdaa48c292a0

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\icudtl.dat

MD5 1c9124ad9eb79feb1e1ee8d30803fe49
SHA1 b7e2ce7defbdb91690725ce209775ee016200d46
SHA256 4546804bf075582020ee9f0e6d0458069793a054087bb36bcceec872de7024b0
SHA512 8f30a0f11ad8108bd06a003aa82b44631061371aa32db7c7b39f1962d3d00fd58e6c794a6ec24c08a93e2908d90016e1d1ad9a8d873a668c705ef40ec232d44f

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\aic_file_icons_retina_thumb.png

MD5 2261131e3bf88a786e3506b72b49b030
SHA1 193abee8d1b7e79805e9591e26b41536b83f0206
SHA256 92d1e5d95399bc3f8dff2da6a95b03310777b48309aa5db4cead98366f5fc2f9
SHA512 d475676148e8d9c30e80eb559f77f0ec27d5961012489a5f2754716133037fee1c57e00ba84ee3066d98f3bd4e6aaa76d06826c2b14c121acb6d4916d3da13c9

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions.png

MD5 fe5aece804dfa3a1e171ac0e99e69381
SHA1 083ec11fb996e60919c070e559a7f0769fab78ce
SHA256 e79d40b77cc25b9d324923da4a07eb9b666003c09349a3f09be8253ab23bb9ec
SHA512 a181d976fb166428220ad7d3b0ee04d38c13acd0456b4e8844a160d9dca63e4b66976bb5ab92d2247aedb40e5d635de83736000840159940e6580ad5b032d436

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions2x.png.savelock52

MD5 74fe563b02d89c7ff590e983af347b10
SHA1 b156c561f24a327c2fd893e12fff9bb6665e8772
SHA256 ab0ba1929a0a0d6e461fe95d45aaccfcc00017b419064da7a526b2e8da81a937
SHA512 51715255da1abfd0fe099757cb1f782e32aa00bb9ecf09ee52a89e79663a77a2de91a831f3a74bbc54a3e0072547cbbff6832d78a2d207659bf436782bb2819f

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_reject_18.svg

MD5 2b631e345266112d43ea5e4e371e2cb6
SHA1 f3af6997c213718dc3f277305d72861ec70808d9
SHA256 849764469c318d0f5ee0d57907c460296eedcd23c560ed4900772927bfa74bdc
SHA512 19b9d6944af20d9cd37759dce33574c5e1be6781f956a7d56155b6b821b14d22d07450376e190e451776f1a4e8126f664e6522fe34e5bb48c4305cb1b718122d

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\root\ui-strings.js

MD5 09c672b3ac37c7022c86aaeb0171da85
SHA1 992177952821b17526473eff805275fefb272681
SHA256 94473eed1a170cfc2fa4678c6cd7c6668c47524c26c1c4f939da2aca67ab5114
SHA512 cfabbfdaf03234c65c327ba7c0dbf27ba1396ed8897cb84f608808a31d3f6cb9f20dbf264f114d7525055636eb93eb5512e5a08e0b71d5fe15cacd762e43a581

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\root\ui-strings.js

MD5 50fbbf898db23bd16d258100182878d5
SHA1 33fa7500f87f4348e09a12c5dc4d60e5fc1a1b9c
SHA256 4b4d1399b1fcaa832b58b17e167af2046fa93ba9a44e206d27c1c2a020ff9fa7
SHA512 dff50af73bf879abd5b3503f0d95df8d6924387bc5faac5464a0b86ae9825f036d381518cf4d1d77831e00a0f26b4690be88d0d0cd83f365499430b164d07229

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\root\ui-strings.js

MD5 4f562e3b3b5d9d6986eddf1659648341
SHA1 a80cee4b544647233f81f14e94e2d09fe09a5300
SHA256 f141758bc33346c28680be98d59783d250cd5f3e6ca735b6d158055eb701c91e
SHA512 0eb9082a17884034ed3d612c483d72a37513a98c77fd31cee5ea382fcd409aff9820db47f647b0f742a6d1cd54b526253df07591d820713a5ecebc688d3799fe

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\he-il\ui-strings.js

MD5 beae905c9cb5ebc02306076ad1119ba5
SHA1 b6647efb8f662f2cf4453f7d25af005c5eb2502b
SHA256 1717957d4b8d32c3e3369577f2733e10e44ca77248c5f4115b550cdce23f6828
SHA512 29123ed547e60b3191e9110401f71344e920e165ec00ce4162103087c9e619368a510a5741cd6e96a91bba42ffaa3a2e532aebd2053818cd9e7e04937e772168

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\root\ui-strings.js

MD5 f2352dd268075001786a4231fae6bb4b
SHA1 8a31aa78b524ab6673e6e9e9a159de72339b9f37
SHA256 e2ce71392cf685c3387350381f3f941fc0cc97562a7657c1dd079bc0b0282266
SHA512 6fe980c646681c0810740b4dbb98f3d61149058fead928b7dc51b4973b4f2cafa75b7fbedc7a0e224a9456e0188bda64dcce57ed8b6d71c0b2aac24ff23ecd5d

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\root\ui-strings.js

MD5 b58e1db0e85384ab73a2d6dad97f18a7
SHA1 fab98fe6ce0f2117a719a4436b1d52c1ef0afbe3
SHA256 06bb9cd9179139cdcb772f070a28f845e6d444d3365216c7bf3bf60cbf3d9647
SHA512 7119b1dd9e5ad71f6f1b23d9ae759e2dfc7f883c0f285602fb410c66072d03f4bb8bfe9d3d36e3a882fbc6bcdf2cf726c1a4027f1232002ce1f64c905ac12692

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\rhp\convertpdf-rna-tool-view.js

MD5 07ddfb4720c48fc9cf4965c2565ec1e5
SHA1 b8cbecb897240b94aedec0fb24b9d795b93c28ba
SHA256 700ba79f67bdc3fa9a71f97f59af7b25d175f7ffd1ac9cceca83cedd61298722
SHA512 c72ee8c8b5865e87d31a7aec444b7bebff322024723331e7519dc858d5ecd48c01a0b4a046c2a974b9fb7a19c90e19db54461a6e6da34c30747b7ff9476f28fe

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\rhp\convertpdf-rna-selector.js

MD5 680ad70aac92824503bc1f5a0f86cdb9
SHA1 be7faeeba61479238488c1346497f51259c6bea7
SHA256 d2b75ea464845c58bcce72d307b041605566792eaec6ba9c86076c59be77603a
SHA512 d82ed76c1448888c0ec9c71a18656b7a2a1c086f42f27ee367f418371392ce566493587384248f2c2d48a9737e661e5983e5eb3d55227ee4ba2ec2953e70f45c

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\root\ui-strings.js

MD5 3d3141d4d34ed0b640fc7e07257b897c
SHA1 9095cfe0ff4bd681df8780d3b5b46c9ff88fe1c5
SHA256 32004443000b7357e9b974a75b4f29d5c43cb01cf0b6060a744f627399c5bc95
SHA512 a5679f0f864c5a9629181f4daa56825f1f068f06674a04a237f5479e7aa716938492511a4ee3cc571361400b0629f64319b54c4f69c40c528bf1a5e476832d45

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\root\ui-strings.js

MD5 03b7513918492fe8820d404da8f8019e
SHA1 d07976f55fe4a6677a0544c5e070fd59ba225e5f
SHA256 a50bacce97f34eebec5c62d4d5b785a010d3fd9cc0d740566faf9f6566e32633
SHA512 0eb1049f9d04a98765a58f1b990b48c0cdb8bd2b1cca5112967ba8920296bd4fcc4f84c03ab40b50978970e5b831f5618a4d28dd79f08c2fd97d6350c13e1005

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons2x.png

MD5 74494787aa7f281fe24f27291f18efdc
SHA1 cf7f577b7768e21b3642656e8c9c27e325b6afde
SHA256 84cc8b988c0d241286a22f5d330e70259bf48a8b50446851c22aeaa374c3c1b9
SHA512 c699b0de1b51bd1b9fbff0a3268bffcbf2e253baa4b4b03755639fd4e6f7ba02c0c1486bf718fb1cfcec5b14daa47c32386e145b830d1c0b496be92203f50475

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons.png

MD5 151e29accd64a436373799d963835c25
SHA1 258dedf4569b6759d05f572229454e84eaef548a
SHA256 17d028e83e010ad7edbc6dc9c366a953e13a10d8008199d984b82b5d347d4c1e
SHA512 1990aace3109eb2f3ad8229da44c0624985e57edbe203e09e6a82049dcaa5e3d819e347cca730de5882c0d7ae709f1d789d71f72992e1596dda7ccf5dc9985ac

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fr-ma\ui-strings.js

MD5 110ef5bb309222757ce16758be395c69
SHA1 8f853ae6ea72eb1ed5e46bffc03ae30bd47b59d5
SHA256 592d4cf9fbbe15b125d21674182168bd9626128f564e0b26c3ca6dea8a3c5ce0
SHA512 d370d3c6fad91781d792a0287bfb1dd34ca25f9d7401de6a4f6e318634a5b3ef0ea824ff2bab687de9968e484dc37a76659b61d52cf011bb275fb3ce16380c97

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\root\ui-strings.js

MD5 1983d7814c9d7a0f94aba129641c4dcd
SHA1 120f7ab2bbf3151f709bcd7ce75929923b4b36b0
SHA256 dc43317abf0ec39a57bae8ebc60eb18ac3ef15207f600116e21c283fc834025e
SHA512 e4426d93cd4804f346d7051086cdf5d18f45a1d1caf8d2226eadc8110f581ecabe4743ea641de4afd6336aad16c0f6fc2794b3e40a63077d8f308cabe7b30c24

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\root\ui-strings.js

MD5 2d44242d65c71063b47fd1dd6dd81968
SHA1 1b20755f8684f3b4027d362eb4534d2f484c6118
SHA256 a388739ae226be6cb80bd878e12d535eed48769924cc2dde96cdd87da6c21239
SHA512 9ee953dca72a16037f78a43c886a1a06b33eb5810e1ee7810c36f3f96edaa49399f070823d537235b6fc0478462d801b3233cfdedd49f4d02ff327f91e6eab4b

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\rhp_world_icon_hover.png

MD5 937bd9e63a88d45279081505381892b9
SHA1 d4e1c978bccce827871b416dc91e68822f934c6f
SHA256 f97d51b96d78117c8438cec8b3d8f2024f98659c21939005a8a811aa051821f3
SHA512 975d9e08bcef48470822c48f55bf94fcf8f86738e7b79e16f2be0950d0b31d5501e6768f86146f74777009168a25675443978b62fbfe4bf17afc7974863a9bc8

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\rhp_world_icon_hover_2x.png

MD5 fa691a092cbbb001a50a664ba29905cd
SHA1 0713f09e10103a4a82994c57dafa2a2c419aeba1
SHA256 b83b7163cd3f55f95c2cee8cce0710a67a9e790f8d53a81ad656208a81bef799
SHA512 8d2a302d5f55b56a73d2a389af9c6f4bd56eebf0f1ec8507310dfa6cfd0d45fea5d70dcaa87c76fb0fe2889a1e61dcef8662a7c376295b2c9b6a485938ea1647

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\rhp_world_icon_2x.png

MD5 7bcf01cbab2604c03c9cff0b8d53f156
SHA1 7a3763cd2a10e33b15357f0c95ebec7ea91c1f0c
SHA256 b8ac40bd523006b7932d6407c8d97cda56e6e05b95a8b939df44194cdc648252
SHA512 b18bd077987498877e6ded78f0a85f6b3a166f63315de0cdbb251f8045b3c9e984c13f86c7b708dd1b02a2c3f98d919703a92de99c3bd18a4acb0bfd24148cb3

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\rhp_world_icon.png

MD5 a6d936b985a5551d7bac46794ec3f858
SHA1 2670e16b425607953a78fd6f4a97f8b4ec01ae58
SHA256 4f3bac2f48f43b005b8af91f3f0f92cf2247b899c2344d059fb57b28ce96f03b
SHA512 bc5baafdfbf46a4b4a626bd7f1bf25bcec82ff0fba0ce7884d3a5dd242ac6960ebca587507efc0307b76c64a8dd22ce72d26513e06efb8eb0cd2ff7c7e89427c

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\themes\dark\rhp_world_icon_hover.png

MD5 4390349b4b093436738c21296dfaa44d
SHA1 60a0c3a5b11f8c72a252891dc2162a06db621e31
SHA256 f8be45714f3d26421f092a99109e3b835c11aa421ce2fdb01535d899023d28f6
SHA512 b1df6707a9536a17269c26e7ff7923e36c0397b0cab831084635a3d2ef25366600467028c256adef3d7ed3f14956250abccfb10116a0e1c0a1065d2a735a5407

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\themes\dark\rhp_world_icon_2x.png

MD5 d2e04ec86ac8f5565696cb85f986aeb0
SHA1 a292e6da13facf26ce385f2109a74180af053161
SHA256 0acf8755e9dcc1af9b4d5fbbf12282f02d25bc12a4e90b59eb9b0c7b0da4ca08
SHA512 feeb9af9b09002b7de444dc5049cefda5a2685b32d27c357b502e88ec658a8ba1e6b1b149239294dd13ad0c5ed842a890188344607535ed907e9864ddf20c0a2

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\themes\dark\rhp_world_icon_hover_2x.png

MD5 b45d23528af48e7e11c49b9a74e17db1
SHA1 66024af135d4cb68318e680043ed24b5a035e8d1
SHA256 e73b4e827e12832a05f77d2a58e9dc2cc4568da994186ebf8afd98cc0d9e3bb0
SHA512 80014d2da329e668244317b5314430f61d85a49886fa5f12a1ea69127e821a15e12e619bb16b118458df91f4ca064b183b1eaf452780b343fcf402beb30217a6

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\themes\dark\rhp_world_icon.png

MD5 6add0c9f3ce2b990b5cb3033e8ee0458
SHA1 a3c3fdab4097147eae4799c775713e7a2834b397
SHA256 0de683317a801b03b201640fba408e6fc8f953bf4004ea2c7b2c6f0984909400
SHA512 60f891846f61e4c6b200e0b21ecf82840cf42027690605f425c32acc4829c7a32a2bf2f5e4b895ab540a2c3b21eec780dacf6338f888b661823a5ec9bbed9f39

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\fr-ma\ui-strings.js

MD5 ef1e75e747e1ed2ed05a5ba574309dd2
SHA1 104928e49c0d04d0c8df19831cc76cf229af2475
SHA256 4a478f50f333a77c88dcc867b2ecad73c99d4322da52804aefb105360928ca39
SHA512 69ebff631e29fda9c81436cc3a1d637b8894dee7cf4d2af7cdeb809f1aa9e7b2616e9a9029e07fe7f756fbae34fea19bdadaf8ce51b279a2b35560dc7ac23bc8

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\fr-ma\ui-strings.js

MD5 4654a4c6cae3798dca628b3990b4e538
SHA1 b0dfd9f1a916615c38589ce12db653d903c98c44
SHA256 8ec430f8f452c38b0fb4e288f2a089d4fb0e3b7a28b216e48221686c78d379d3
SHA512 8eda4020c88b2be8de7079f6f8beba56c9515936670bfa7ce7f9ecd84382515ae9ddfdf54b6dd25fef4a0e746dc77d22fc3ec797a857ced10c149153c0cb8669

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\icons_retina.png

MD5 ab8752d1dab5acab46876e7e55884b51
SHA1 881c24c2478f30bf403f591a3ff6967e4447f016
SHA256 ff4afa2b268663f0e93aa088dd6e747af03d2eeb9f15362e3f0a5009e1604413
SHA512 6749ba85a83b48dbc01e0d12740e86aa7544599f2b909a060468ef3b2eaaf8363d16b651a01c7ef644cb600bf537169c2430a91c37e1e3e024228bca1a7199e3

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\new_icons_retina.png

MD5 a9bdd8bdd7c63604397bf105482a9691
SHA1 922677ac40e3886600fea4bc2622abd1d811db3b
SHA256 3e52b9bc8760aa063a99b8952a3bdc92a9e8dfbfd082b3d17a07c56db0cd4f61
SHA512 02a33b399788122e56d6396259602dad1fede84220a0d71fd873aa5beadba9e500b3ea099d490665e179efd40540570c71a8b48dd459ef7fc1d75f8153ed67c1

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\new_icons.png

MD5 86e570eb1a6a0d09e3a4d06c8eb48d8e
SHA1 3cbad374868b156148c5af743d8dbfb56c1fcce9
SHA256 1429d8ac89ad1aa4f58555aa608c27fa08fc8363c8deede2c0e49bfa6d640008
SHA512 f90c63f5d1bf12df5bf1972a6ac77bfcd04e0118eb2517a83b7f17d6295785beedc805a04f6fac32d2c4327426443e7e7bbc0ad40f79f57ba608baa2bd8e0f65

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\icons_ie8.gif

MD5 3659a36ad63c1661f14eeb21b772c7bc
SHA1 e9c6c80b242758e885546472be0ee65365dca6c6
SHA256 6702780ed1579bc933bf077a7913e14ed98e76573fc325f6a2e01e24aa8f564e
SHA512 825152121ab66d6a7fa31952968379bb7268e91c243abfcf799d676fefac453d606dc4f43f783b9624719a9a820de891bec2f14b1eed0583d5cedcb3bfc3bbb0

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\icons.png

MD5 fbbfe3e0e3153e6ba9c617f72e606905
SHA1 00611090f94e2fd3b9d40593396749495929b5de
SHA256 b2cbc72361b29a236e84017b5493e70f1fc876883548bd4f587b92ca87ad1ac2
SHA512 769575a57e46d9e292beaeefbd0b3583199517f1ea6b518dc39e40b684a11279a0c62a64f3d8de4a7e1b5645f0d124a0210a5e8e3877710bd094046f3c14202a

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\root\ui-strings.js

MD5 abb21d4e7391a8494a42ce4de7263742
SHA1 3d370faf21ef6f69d97ef666b5c78c129d6d667e
SHA256 458d87cdc8bee6367678bf36a5b3460e457f3fadd434c9c96db368b73ea4f9fa
SHA512 ae96eaf679c3c99bb93b76d62c5873c354f828a9df3491ffebb4a2e5281eaec50a004b848d91d0edbd7b263051fe03895ae43f6f645822dcd3d781c0feb9ead6

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\sl-sl\ui-strings.js

MD5 0eba90087d82735a91839aada94a0e49
SHA1 9df9d8b6786c2f3a88f173c596aba9179b6fc6ff
SHA256 d0d0bba0f5cfffad28d3591b43f71132c1d8c465b8497bc0c848084e071bdc48
SHA512 f662a061d1965af9bf7b5caf20f54b14e281f30caf63e1c2fdff17223821edf09c4e91a2450b11a66aba39b344d28b616b6fd6239778a3bf39f953490e31a969

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\root\ui-strings.js

MD5 eeeb9318c350c9db31c17632aad38d6b
SHA1 ff516dab72cf369640fe93441e75548c095d0f93
SHA256 364976e59f1ab97df4484adf230786b0fa79cfa16fafdebd1114bcdab2d2454e
SHA512 ed1dfcc917357ef4973bbfb4f9c5edb3c9d0f95291b8c90ad326931027011a8895429d2e34c9c08e701b3a3f6c7f722c6c9d84563c01998c6354f30b082074fb

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\css\main-selector.css

MD5 1c8afc4bb1654e87f0f6aa1fe66c99c7
SHA1 6ae09df1a829b4cb16ab92e08b1a65629ee2668c
SHA256 3aa50e7e4c4e076de408cdb2621e9e4366d0f07a69814139e1a8ce0d66848e88
SHA512 bf3fc3348b5bef9f16bf1e1a37270d4a9e82cf53ed0da5c09f72c2384c75b635c3335d7b4f22740fc92344463ce86ae7773b3799bcafed94aa21c02f644e14da

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\bg_patterns_header.png

MD5 09b0cea0dc672b7a33f5cd5e8e13ca4e
SHA1 cb2c964a0ba13029f240d784fc6753b268737db4
SHA256 fc17e6684f04f9832759c5b98c26afac3f0dbe5208639acce1207b954d1ea9c2
SHA512 34ccdf1574dfd7781fddbbcbf1e7a373a9a6dd18ca6497efb96cbe1eb38ed1e6c0613591a53a7faf9605310590b5dc18ee4b373a6c5b64feb86666aadf7df8f8

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\illustrations.png

MD5 b42f5820b8401f8cea5a87cd435cb280
SHA1 be447cf86f10f27cbd9af1cc961e792ed89fe163
SHA256 f375e9c9552205397718bc79e203011b821f78a5185379345fd136c519d799ce
SHA512 25aa90a1c7c8cf1905219a7b19b73cbb61fc3c4e193c5dd1db1d3fdd810b1190710a261adf99b9c6c9fde732003bb5980da416df4d525e8e5a182a6ca792e268

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\bg_pattern_RHP.png

MD5 c327a612e6bdc7d976e7d2f9eb2e6d25
SHA1 73ef1a0b63b614fbf017312b9f79a06de0182692
SHA256 ea7cedca3f7c0eef06927eb3baec2bb638c938007e30839cfc0b5f1ce59a3b5b
SHA512 b5661b0f1475a83f13e39b225b4f4cbe584f5ae4dc347280b2a2bb8009bb5014b348553bd681128c9527c53dbee575d94df5409db59d1fc56609eb6c78c6645c

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\illustrations_retina.png

MD5 c93cfe6855d30bc295f4aa547b4c4c4c
SHA1 8208acfa804b26d5463df651b38644c60d48eaa6
SHA256 dac2fdad4bc6876e93daee113643267b752a077ee9b0171184719321af325b45
SHA512 bfb04d341e7756e7b65f28e2a5505dc39f88c5c929f7a666844cbfa9c8b4078981b5dfa9bf1177b35193b3d6e7c8882c0bf793be23f2aa46d3928bbc27e6e369

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\root\ui-strings.js

MD5 95f2a929ec8822e5dd7e51c767ce497c
SHA1 dc45a0b68052f00ae762a4ae28ec11a2fcd68147
SHA256 cbda37b347e180e3ad608e1f85d1c2102750ba2f412c20f252e7853c400dd7e6
SHA512 65fdee481d277ac0715e911504fd8d0355208081736607b5990159debbd855315cd1c5b21ff6f5c426709a7af2986c6cfc35e6595ce4dad9422ba3b3bc043f0f

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\root\ui-strings.js

MD5 7e6649c4783f275ea87836b5aded4659
SHA1 72814b83e7d7706a09c51d0139234c0518bb2826
SHA256 07d87d4880d397c3740acdd2d83d4805adaff6e682a21ffe977ec7328e44bab1
SHA512 1acaa52069b516205c3bd98d25637a68bf386bd583b047cd47dd93be49fd5d1922c8c706e4ff82df8213ff1f0ac1dad9a7249e8ee163c9d1111756635af65eee

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\root\ui-strings.js

MD5 9d8f0fa1cd095edcc2c9a9bf02cfe00f
SHA1 4619cc81ecf7880691265f3e7e9c5772e47f597b
SHA256 010ac3cd60b8f468a9675b875e559c2f04f65bf47bd080d1508c94bef6f551e8
SHA512 7de36510a94618809e836c6239aafc0edf6622610ab89134b4e7e7115cea905e4ca34faecf263a88fe85b86e6e29f535c3d972054814df5652980655a5e16346

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\PlayStore_icon.svg

MD5 c1ddbc15f68a61e1d77a826fdfe37406
SHA1 76ff2836cf2bd7544410f8f5ed68e90c48f5c821
SHA256 d5fda1c81fa3aacdda48e62a983b1cf6d1ab85361c7048ecfd17af986856c3e9
SHA512 ed792b226bf72219e5e6d30a7b777d3b0c313a0b45bc2f04f1529b51d91a52b5b72cf320f405b62b7ef3ea176e8dc2a17449811af8634ab1190103be1eefbcdd

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\en-gb\ui-strings.js

MD5 a5a5430dc5c04075e88fdd133a57774e
SHA1 274cec74d6f482f37c44de40ca2de045a66514d9
SHA256 9d4fc0b29e51670e6c595f3bdbb77cc4beca895a6c68a04d4a5e26f6714adcc7
SHA512 c0b288926d6702adde8a9510ce59b02841f5c4535729a2062329ce34dbfff46528ea2549f6ac135a5217ed851a04686a3cd31ef0c833bff5eb1a790e77469e35

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\root\ui-strings.js

MD5 e83aca9631a5e825582d6655e92a10af
SHA1 273a1075e90825a8d22d078883f624d421e4f648
SHA256 d58f22aea08122e007e957ac20589096c40fcc77a7796f70c2c4e4c1ef304c5a
SHA512 e126e3774233d841b3570af4602148237befd40b66eb40cc4266a8271107d9ab10393bcb50938b59013190351edc3d94be73d69bffddce7ab72a59b7c04fe72f

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\root\ui-strings.js

MD5 e38b714b94bb3773a27393a227334255
SHA1 d64e7089c7d9ebf20513bfbc2bad967b7c3ffcaf
SHA256 987137c6d4013e51ec12b33f24cb348f847973b19e74e97c4a808f9fe2d8f0c1
SHA512 b7369fc1bf6f401dfe1305911468e8dca433ecdca136e9d2c492423e1c8353242085f1052ec3cd5a49354e25c28f11e51d174bf8fdbe55ddf13424bf68acf46b

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\root\ui-strings.js

MD5 844307b4bb037776056c4124dad9d3a4
SHA1 c1e86974c9064d758bc75401dcfa3911c1f745a3
SHA256 016b37fb31b9394dc6218a69936700487d7e49aa603b1492f555166b88e9446a
SHA512 f7e50e520c496811caaa564e0fb0ded4b616cdb08422a103b4a5f286fba64cfd67c3ec5c35579eb12a15cb684bce3277485696d1e05678b0f7da1b46afef92bf

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_de_135x40.svg

MD5 3879d6b32c40a022c1c099734be58612
SHA1 8339f2ae243d9ab501d6b1e64884d47d57c00682
SHA256 c385ad30b7911dd5108a6c6c35788ed3963c83907b6914b14a965ad7c668e072
SHA512 7389345a0a33c4ed138959e2b9fcb902177dfda2b0bc9c7c9554bb7300c078c0c68a46e67140c801688e2b567978f4bdafce257c6521e111a1267d23a49bcbc9

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_da_135x40.svg

MD5 90ce31ddd92e438a1dfc627adb510482
SHA1 cf1366b0a2bbc9a58ee9e9d3aa36200e25ac54da
SHA256 00b79d850260bfadab59c3a714e4d84e343ad3d18f424e1baee2fcae71e50e94
SHA512 c6c4506862d86e554ac31b5ac5cf9f7de775fb5011aced1bc01fcd3c2df499eb44bbea073fbb3f1cc5842656e41ec33e95799aea71b2e25296757578507c2db9

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_fi_135x40.svg

MD5 bb631c952ad411097af7dfe12a1bb0ee
SHA1 1bca732046e946b457ed0d05bbcfdd60a1a744bd
SHA256 f4d2c6a9076d41a960db916ce64f0980d0a20808f6e8f39a3702466923416207
SHA512 99546e20272b86899dfa7ed8032b89ac97442495a3742bcf25a346ccfbc991d11036d17e06a792e45b777d859be6cae16f0e7c88766921bcaff6372ec7017826

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_es_135x40.svg

MD5 26e3a6cf19bec127f715b4dd6580392a
SHA1 94f127f04a44bde93c5b355c4ebb7189d23e0435
SHA256 6d3dee15bc1320f122c27383deea752c3fa85f26e995df7ea12076349362d89f
SHA512 3f7bd486fe44dfac1bd51fcbc7ea0278884c6dd0e30abc415d7a984d92b89f5434c58a137b7987440b939671f548aa2c3b54be5b1cd4dc044091937bacecf651

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_cs_135x40.svg

MD5 47cf17db5e9150f89b9f89b315c8cac5
SHA1 730561e77f49cd523f9b16589a5e0372db817641
SHA256 92536c9dfc2d58772938e826fdf8c5b1be44d299d75552d6ffff285e9c8010f6
SHA512 3acc6a93beedbf732fa44ce7eafb016fb10b81ce3da74383c1968c7cfd64cf01ab09c818ae2362aaf07d7788bee3115e6cfee0810820cc4356561369101df4f2

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_ko_135x40.svg

MD5 0500d2b1f9d005d1076c44bcb922481c
SHA1 ea53ddba939bc8b6fe6ff78f7ea9c6c27f62c979
SHA256 52b6b76f3427199a668444dac25a612a0af4da39421ead0c4f5f4d2636b5f3dc
SHA512 51f40516b52cf3ac96094ff9836b46a6fa96698c19bf499b790c367cf769d0fd91fb89e43030d4466456d2af89da9bfcbe82adc93010b3d80d6e894d12e7bbea

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_fr_135x40.svg

MD5 5b60015110461ed1ee410d416b29ff96
SHA1 f9d8b18c557a0c4e2548934faedfa276d3cfd921
SHA256 1b37d2a1f33965a8bb5211b6b6ad8766fe78d2a074bfff1b9bd13e59416f2a1f
SHA512 39cd177fc4bfcda5de9798744643d5e5d7b9ae69b50e448cc427b9712b3ede6a2d4db7c0a03af4b04b284cf07592e41b29b1b47d96002d22c19e20add131ab5a

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_pl_135x40.svg

MD5 2f9a6e16cf054b71d424f6383bae5311
SHA1 d0d6670cb6271bfe79aeaa7ac6ee6c1720f12809
SHA256 c21606d978bffcca179552604a4f161d1ea586ad2b3dc650a27bf901b91634a3
SHA512 d129e567d5d80c7bc3701f7585b057c4996c755bc1e2fe60a5c2e65e4e36bc15dd826341c5db0450b88f55dbc184f349d5d4e1f96f6f515eb971266a42885005

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_ja_135x40.svg

MD5 1c09915fbbee29412bcefb3acbdde302
SHA1 b7e75fe85e64410831508f8b3a424ba36340baab
SHA256 c6bbf8d9929ab0ff92106c645a7301a3461f4029cc55577def2ba4044ab32798
SHA512 a984bcfd97ea64e2cd6e696b6ba71eef01ccaaf38eb3a8cf2b64b084f25e53007134ef2bdaf16df76fafd24cf1cbb243f7cba79baae0038b33545e3739867493

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_nb_135x40.svg

MD5 4a4bea021fbce51d645b4d960596bc49
SHA1 520a5bb72095d87ec5b23897d5c717098ef2bc75
SHA256 b5b2837bd2e6548eaf26009729a9ac3c7d624d7acc4f272b20d0cef1be460a83
SHA512 cfaca6f47ab2e481eff73dd138e2cf908f8fa38d5755259d283453aaf0bda4ea6d20bd6811b9edcd37ac4218415bbab93a591eb554fe5782ac4a5f945e6341c4

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_it_135x40.svg

MD5 3820ae987a8041e01a66dc3664cd58cd
SHA1 297fa58ad975862616feedb6f94b661fc9b516a7
SHA256 9bc474597437ea42327bb340e66e643f9302bc5a5abf9e098f3032352286b1ae
SHA512 1c0ef73ece1874c0a366da57b803cf4e3280f58596d866e7c2688ce2e749364b6b8e4f3cecafe741bff2ca239d657c134d5b1ab8dde84a679e7597dcf2b19f92

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_ru_135x40.svg

MD5 d18ed0698ef79d4d6287ef2512ad5c03
SHA1 933fd601a382ad4e7ee454e855978092ffbcb8a0
SHA256 c9d9c11514b93982c34746deca8f9265793b083f131c0f01b754225da5447f9f
SHA512 6564733c7e4b643734aee6adecbcc15d72f0092f5b8a4233dba769a9658dc515007ac8453205ead976f9395bdeac9d507e952a20aa04acfad3e0e3c507c644d7

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_sv_135x40.svg

MD5 8ac036522d8860d52dc9896277681838
SHA1 627896521d30bb904307e4bcaa6e993bbe7ca745
SHA256 c468b0f1c41e57c29007ae38f7b38c77aeedc1238c6586bff6d650323aaf2588
SHA512 21af6b0a4792325fb8e53959c349cec2d6fddc4d948899be7693159e175c25bae9fec5ca37dac8691da0a91ac6b8193386c3bb82052cba5d5922776a69e7dd6f

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_pt_135x40.svg

MD5 e73b99a3bb61bdb64c476a0e84910fa6
SHA1 58446d5114bd91a86d9c407b1952340f12bd8acf
SHA256 7a6ba40696f4c414b757ec4dd33a0b7be7ccd5003c95e2b6fb8808b94f81f9e6
SHA512 269319bdbc8f07e3d2cd748cb2b495b9ad894288e32ac33338d79dd211ccbdcf1edfad1538bf5b8ec44a6544d61d593d25f87fa39fd5d572a6b856387c98a098

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_tr_135x40.svg

MD5 33ec76ba37848c46bedb493a0ee105bc
SHA1 b9f41b0a3b9b70a7b72cf3110dac78191b7a2214
SHA256 77905c3985bf9464bb407ce79f3699045c28b90c6a2286697556c492a69f0171
SHA512 c23220f1740f90728ccb62ded25ab75f798fbb27663233803c78c6920f4a1083830855294b86f22e008c1f83782c93119ed9ba831a2a778084976055b3876dbe

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_zh_tw_135x40.svg

MD5 38608320f11954183bab2129630adced
SHA1 4f28ab32bf8a7d351fc545bb8ef8e1ba97f71d34
SHA256 b2e61976cdcd6f0ad5b27e57d837c283b68196cafec9ceb137594097ba4b093d
SHA512 0954db0a01eceadbaaabc68bceddb7aa1a1fa1709bd5d40ecabfd718d844ec9373d776779486db7246fe066ead4e648d3a4d3412aaf6a10d29e813777f740cee

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_zh_cn_135x40.svg

MD5 505801ba6db114514155bd6531cacbf5
SHA1 25108174634d948b0df5571c99e604bd7d9d5532
SHA256 8cc42780c521e7bd96757795b573b8c464beaed8224cb499169ea68c874e1d33
SHA512 90eb1aa328d75dd82b84ad85a9cb047b70fae1624b5d94f81c8a1dbde3dfb28222e07b973c5142bed1b5db570cc8cf298c5c3a2b68f09f4c0e863cc1b0554d7a

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\de_get.svg

MD5 0c7adb6c1d9da6ac45a90ef257dcbfe3
SHA1 6391de8d5a420d81d182e6becc133be03779ddeb
SHA256 35dd6caa7311474867cfb59e09b8be06a9ddf65c4a2a0cecb642c9b9e03687d3
SHA512 f99c05a7a5aeca995b5fd416e5b9dce55d094aa478e1ee7a9f0ef35a16ad67a7016b552897012d9c1cd1c1bbc3219b571876895c8811d5bd2cf3f7d4d677df88

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\da_get.svg

MD5 3bb38a56d6f460d7320cacf974f746e9
SHA1 16af855e6fb7de51523729243aaea80467c655fa
SHA256 54720a1d7c0c969cc2dfa5d9677e04cf12d73d5783ae4c9df02ea314600b9ab1
SHA512 6907ece5d524a5d765e0ba7beac47b841b90161d18d8d6a3d9333803240204de8053a1c47513a2acedddfe7dc08ab65e209d7bc843d0554655172cb5bf651a0c

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\cs_get.svg

MD5 b5f7ba087515675803126aae2200733e
SHA1 155d7cc5240e0bee4d37ee432aed76c0eb890e49
SHA256 6cbf05c331373e76ca4efbec9607305297f966fe6f1bb513f3bdf5528ad2fb5e
SHA512 b6349a6bf13eddd1a087b9a359159dd97d8be4b1ec529ee6a5cf82d8e1338b9ad43de4ae40eb3b73c57533b6b5e39e745ec464f7559c8699e992f106b8cbc731

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\es-419_get.svg

MD5 2270b5de803fa2a7861a316087bcc05e
SHA1 1ef0876625cd87f08a14df47fbed37c22011a580
SHA256 f4a2e0df505bab9b8f794b1c12a9134294febd6d39eeb4c979e88ad453f70724
SHA512 38a260b1bd3e9dcd91b4ff483737597f3624d06d1532c61174dcfb9ed4cc2745a99df14ff92c890b52b78ba32b4338f77eabaa9b183697897df96705e46132ce

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\fi_get.svg

MD5 2ddf10c7d766f32390af44a4d4f8eca3
SHA1 69c4829bf64618e190cc40e3ebc75a2a04ec4e44
SHA256 5064cce9fb1f9faedc67b9150d9d771d13dedaf5149070edab4fd3c40f5a2790
SHA512 27fdfa15d38ccc6adadcc092e4f7ca16dae94f3425e85e54a2701d41fd4fdef4317ab890843e852d35fa97d929789ac3baae7b0cb11b2c6669a982bb51005743

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\it_get.svg

MD5 03e184987acc14b169897260fe236e49
SHA1 65b9682f972b449739096cb286fc2f4e29fa434b
SHA256 6302fb5301948d21fee528aaae5f6cb8a750d3a0a30b38d3e91c1d4235011bb0
SHA512 9f00a9cc82a3d398b2e909d9009865d7525d8d13d44343442f38021b3b9b94a196c3b071d1ef7dedf66d69246cdca2c7ba00b3461df09d777261d929eb50ca72

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\ko_get.svg

MD5 ff8702c2bc5ffc409f74cb9c078186e0
SHA1 18419e102d14c712c9afebc3edd71b99fdb9e681
SHA256 2c9d39d73b1e5d8ab396f09ad3e0c48d538d1a44e916289db9285dfb34f14638
SHA512 683a78f3556f861d975f4a4cd3d3a5a297684c9fa65f7add8fcabbed8d41133c2c7e53f8b2c4a39834b5b652973fdcd12a19dd365cd28eb5fd27de5c464a7ccb

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\fr_get.svg

MD5 7f6e52f8b5e181fa44f4936989595421
SHA1 f81702b8e59963cd3ba53fb58db950d79a27f49f
SHA256 a0ba2c82876a153400b1b505bd57c12d9835ed567d74aff26942ef5f1d036f35
SHA512 9abb3ed9c9180c619c9e97aa48510dbf68dc336de360122e8f67d540bb83626954534d13bafcdea84772b9f7e1ef9617084c6f0b7d3efe92b55ed1832a9cb332

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\no_get.svg

MD5 cdb3a7df881f6983bf8896b03e019a3c
SHA1 9c6bfbaeb0bda80d7b8d889c347776a8eb9d6679
SHA256 c897ff9a7d6aa23643ad5229941e518dee40c8bc81bd642c9db881a933d8b698
SHA512 ca5d8c8aa80c6705ff2fed6fa47d5bedf37d043140727096bab0122955bd0be69b3b1296b95a9c78609259e46585653631ee9c72e7393b67607fdbc1b76038dc

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\pt-br_get.svg

MD5 733318d8f14ef25db365e714e18de5b8
SHA1 9ea7894ef83e1d8ab46affc29b549efd20adca98
SHA256 4dd11febae60fd5993d89a7a939a5dfcabeaa26c768bbcb8c9d7d8a8f86266be
SHA512 2c1b9630e6bc178137187db30ecf61152123f1621ee2e11e29027ac923fd47d689c3de12c25ef918a404fd9ea0d34024f990e3744279c985572fd19ee6712941

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\pl_get.svg

MD5 12f6bde12b1287f2cad783b6696d21d1
SHA1 1c85e7126fad3380fcdb1d13334bb2e63c60b219
SHA256 c3c33ccded9799fd4ddec9ed73fe866899f6da897b297a66366229aba8c2f675
SHA512 166e0a31186e4aaed28e571ecfc1205a65da12401a1fbbd823c1ab92bf1936f19f7e38a756091169edcc5e9e462f77e298cb5e9ccc0e0249526030ee5a48d2a1

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\ru_get.svg

MD5 0fa32e45fba70493b04b93cbcd1b9c87
SHA1 56116f69a7ccc77b6dfff73cc83b4bd08a45a61d
SHA256 16bed5fe159e4b3cb99c9b52e8f02e2f1b32fbcf57f175efbd5042893af7ffc9
SHA512 427f2404142d4a94d4f0c6f5f8cb3d14bcea0f9d0e945f74435031b1408af45d14e71bba0a4fae27a0e3070dd1f581e17f0407e59a5ce66ee777aa9a5e9d87da

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\sv_get.svg

MD5 6f30a7842b282edab59f354346e67741
SHA1 012406d72a8ef4a8a18f7aa0e6d2780959ada774
SHA256 7037c1351b4be3ac31f3d86c0c8cf0441a2c8a323f3ddcd9ff72a7fd6bb60944
SHA512 49fad91af793257525ee873e9c23ba8c9697370d08105779ee58bf7eb7136a5b4ff9f1c9c0cd75c016a4114967e20034c0d9f35896a08136277fcf574a0d623d

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\zh-cn_get.svg

MD5 8d9b8b4456efa400123b7c301c56a934
SHA1 dba61ffe6bee79cbf5d5bdf497a63403016ad8a6
SHA256 b57584a7c8c2ded03bbbc7a6ccbc68d3b33859449de36b82f0172f2e29ae5619
SHA512 fc577560597452ee62bd5913a514aad1df3c535f62cd8e2049d367f8ce61edf1b89dc7ded84576703e0ae670988b3e2a4479d2cb16188995f086070a41e56a50

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\tr_get.svg.savelock52

MD5 a20281840eefd47a74a65f900981f2c3
SHA1 81db6c18d33f3bc30d1dea83e11f4f8625ead812
SHA256 a35d918e4d17121059d1e4b90b880b641be53ec9580b9d96764fa3f24ef6f777
SHA512 e3dfe1cd5173edf3fb5dba54afc39105d7f9598e1ce6028ed3af3e16fabacc487ca8b59411d6a036229a06be6ad50576ca15ed239b8c2ccee43e64bbbddd5d27

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\zh-tw_get.svg

MD5 0604e02521e606a984cf2820744c26ba
SHA1 f4d0d027631ec37db13e104000103c58f1d140b4
SHA256 92b58763fa74e307fe0c7888503fe9ac9d11586506535332bbd6a6c8427632b4
SHA512 3e18093fa28c2a4613293fcf4a80840d644130fcedae0297eee8a5000c288983f4144a6aa762372e5006c45af1e4c7fabeac8d8535c13bd862ddf5aeb7737507

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\root\ui-strings.js

MD5 8b4ab41a0bb69c287b46dd729807621d
SHA1 356343edc31d2741ecf361409e703667ee79aec8
SHA256 bd3f62e75f2a681ccddd3270ee02efddea5a2856b3e54a6fae5e5b9f5f9fa45d
SHA512 c3bf0f2e8749aaf8b113d6c3c9e129c966bd459f7883aa6dbe5b99a36a9a4620dbcdc297f2558e74feac59a364ac5a9b0f7cbfcc744842cbdf16b85ffb76e380

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\he-il\ui-strings.js

MD5 5d4967d56335165132f7e680182ab586
SHA1 cdfd1d279e8d422351ac75103027a1680109f09d
SHA256 f3c7adbfbfb340b9c7ac1a962513b94a53e0d65c434d95a3f0b571c84a258ff9
SHA512 63f11231c02c86bc7186cfbf47ddeff89b53a6ead83d84b9bdf0999b514f16b73df9394931166edafe3a320789fd3769781085d8e38cdbb10ae4198689d68dde

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\nb-no\ui-strings.js

MD5 6741a96e66830318c29c495b2f67bbdf
SHA1 e5a3de4f7cfadc8902d8426ad8c4f0e27e581fdd
SHA256 94537ba797e409685da12d6e00de78bfd3ba544c3160bb29edf5525e927c5be0
SHA512 0687d2d788f200101562d4b5a597a1001b553ecb32b5820b6bf240c28c005860d00820e7e35e8de0e4332b00afd809ff0d62254e28b457a264f549cdc2c28fff

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\root\ui-strings.js

MD5 cd0a79c540888365ef5b8a4b2fa72091
SHA1 bf30d00ca6a3849d07e1fe9df04e9054130fa8b1
SHA256 03d6f2a879fe59297d3a75edde5797d530f82b2b558698187d76e61da4bb6c02
SHA512 a41405a6dc3e011d96d289a8ad79758dc6ba11337e7223b4fab2c7ba0f54607e72861943aa410c739c0430694bfc854065b76410b14a7494bced291b0b30f466

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\root\ui-strings.js

MD5 02394c5d96139c2ada7dde417a2c5f03
SHA1 a26b11d8c4276d7d74a43ce40acf9638daf34e7e
SHA256 825cff420d70433d4c3a4f5e910a121a25e730c6bb6ba82e134d8996017af780
SHA512 b537e256781d1169aa6368c0a102751ed32516059a23cdc101fb5e4ff24aaac07ae2f63c9ca523a7a5bfae3570ed9e6a5d87c8bc462856be5b892074142789ae

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\root\ui-strings.js

MD5 375a2054c8d79f94430811b87616c22c
SHA1 97337835c7c59440ac91c9e69bf5353e25b19223
SHA256 5c9f093537f92b5ae20b74ea13b387af44ba032c0c23ed16c6c92c7d14179944
SHA512 b8a413672d517ab6094cacd2e0003a18968c7538b2b0c04e7c834de198f94783a19aec5b272730369520bd81a59e8c48440ac78cdd02088fc55d16c994ed674b

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\en-gb\ui-strings.js

MD5 741073130c4383a01bf8c6562b9152d2
SHA1 0b9ccff79288a4ec0176a3e431a67a8ea5e60576
SHA256 bcd9ca52516ab7024782fadf632e426c99e7df8492d776e8b4a2ecaeecc25114
SHA512 717587ec65253c9cfec1da9586583aefe35b83530f3c61d7c66e5fac3278d982837cf0766e6c9964d69136802ada5e6f3507941c9a5e3de045e9b9dec532492d

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\bun.png

MD5 c596d0790e22d64f8311d2ac81a25ece
SHA1 3c031bef7faf6e927f52d72c23fca2f5c139ea44
SHA256 72587284ccfaaa66c9acc417fb837b3edb927eaeb97a9ccd4a47680e2929e5bb
SHA512 59b8b3f0b2c0d8cbfddb2b7186f0839e5d4c7ecc8ab830c387bfaf303359e59f88f93027315bc917ee60ed2a4258e6175fa51cc3f7110f2f09867d56d83ad426

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\dd_arrow_small2x.png

MD5 3ba51fa5774ff74349f9dbf62f0d56fb
SHA1 fb7e354bf0986443e638ca37750c22dfaa899395
SHA256 7d89cfae33ac923355396537573ac7e623dc348cdbbda255564c220d5744f898
SHA512 97fb1c202f783a103bb7a4097e3ad8308dd1c79a36660c995b34bfb64d7b50c9e4f5b03987beee2f87bb0ef4973eb00fd0b856a2fee988f367bae1d49ba42148

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\dd_arrow_small.png

MD5 8b13a615f1aef66cb297ef1f34e35898
SHA1 55fd6133ddd3307fc14eebd7d360afc9db8a185c
SHA256 a821fc8f4ad78c612153979721f5959d2ac045ccc89fcad1d950ac8d90ec7e59
SHA512 a0660267fc6f96f83155d448ee79beb308d52676ef34e26e854fede1ad4a33a2c53321e0013c70fe0117d2a737b47ee9430e373dcff227c71ce70b70a00d9206

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\cstm_brand_preview2x.png

MD5 c4edaa30e76de6692cd3e779169b5a6c
SHA1 4037e767afaa944ce76c667f4da17f9d63bf1397
SHA256 1a7eb8321f5fbc9ad6eda088d4dfb61cd11bc938ba7dab7375a415b34a51c04e
SHA512 3ae9d10a09aa804777e68530825ac9cd3d18de3655bf85c8d4586980bf7038568c78cd69607082a3409f0bae6c8a80157772fd2f20c72c3ffc120b115dffec7d

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\cstm_brand_preview.png

MD5 6f5e0233f91cdf9df316d33a10687be6
SHA1 c2cce3fd5c16fac15364d4a90cf1d2485f3b3ce0
SHA256 bbdd23fd1981be12407549ba98ef24121aab406c18913b374e263761be2b5435
SHA512 627e766062254736345d4480f045d38d0c750fbc566022bc54307315d170193714d9e5ab9c3d16f679c7ed859cbbdd520cb00d79d6bfbf758b18c724d4259832

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\share_icons.png

MD5 7eb2f2dda5730c9c5fd54fc62eb0b27a
SHA1 478548e33556a256f859c8c4f7a6f89dd02abe97
SHA256 af299c369688ebcd3924bba6762dabfc4bedb87a8837bc7eef840c6ba577300f
SHA512 8ac0236066c4910330ab2080f74441977f8dffb7fec9c08cc67ed23704fa00f243492b4f65b4f18e449d06685e2bd67498f2213df048782995509e459f274542

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\share_icons2x.png

MD5 46c8f832a03322dee569017ccf4e41a5
SHA1 6e5360f581116ca154b298a5ed24b50927ff241a
SHA256 9913cda95948df536c1c91b7668593cbe43d6be11ba26b6a804d2ce226bbd0a4
SHA512 6f67ecbd17cbadd3913957d7e72d53ea24fd5ad8d2484486a86b36d76a449383ce6fcd7a3a9fa17a4ddfce309c13a7b9610e116f983d8e7466f4e65e00ed6af1

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\nub.png

MD5 372fb1247726cd7a9aecb17fe4d9edb4
SHA1 25919bbe7ce8fc750a8b82fbae981edc45f24e9d
SHA256 282214096101c8c49f1a8290d1d759f01d509bd8fcbf9c5b6ec7c80e58873087
SHA512 c1151b6e20844744f458f2f17d03ad0b4f04af20b601322a991e4101d664ac753ad345028f7f92bb1e39abd71be51e3292d2fc835bcc1e164ecba3b155c8886d

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\root\ui-strings.js

MD5 178832b4c09b7496c7f6141e83cbf7a0
SHA1 c623f3b51ec154c3fe043f24e243e00a4b21281a
SHA256 ecd498fe2ae6f454ecc2c4d760f3b4572d268011671630a00ae4311de83771e5
SHA512 5a1bccaac69075955dc3a3c985219359fcc26e46556bcb611fafda43a418cecd8c2d8917edfe6da71e06e611daf5becaa856250c5d90899f28bed1f6563edc68

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\es-es\ui-strings.js

MD5 88f4c4937e73b91ccdbda03f1a2c1f24
SHA1 226793e227d7a84b21e0e8c62038d820c4b275cf
SHA256 8ee48cddbfdb0a49ee6f0861b0aaf65e672f99341b327b25bf5189ffae9f7448
SHA512 2ca72e7bfff649a01c1d37f785e9a4490451bc9bc56a899c6860bae1d7ed5be7f2ea790dc7cb4ea6e702391532016abc929efcacdea64937047dc66f8f1a79af

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\en-ae\ui-strings.js

MD5 05182c7ada7f7efec3c64ba76dd51963
SHA1 3dcac5dc9e1014d14a52f511a099594642e65896
SHA256 ce93f7c5f26867c05f4f560dd73ab7f8201a4425534cabb6f034d43fd782b8c3
SHA512 d6ad4ffbbcd9670104ca20b8d23528603775753236bc017563135dc362a4fcb49446b9b42ffddaff7cd530a699585ce9c59b93c6ec1acd58f31750d5cc92de03

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\he-il\ui-strings.js

MD5 464e2dff16036998a9428c497105b86c
SHA1 0b77323e6c14e9f6acd77b850c922afd4cdb67a4
SHA256 16938a91d8823f0b2b1f4e8950b04302a7d7799681049317856402fa81231674
SHA512 74b7446c05090e0f0ea21515c9602987f080cb19be09bd1bfc6734e085829e48057659ae651b838882e95ced830c483d338d56c52204322d989d7c96ace33fc2

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\root\ui-strings.js

MD5 4c6220f43c2e9cb37d32b95028ec4767
SHA1 5cebef5202dc6b5f4bfcfe7c62d85c1ecff70838
SHA256 8a07db0535fb060fa190b3702a6dc5aeb033c898a12d7cceb21cb41e64b70140
SHA512 b1337f49a389cbed41b825076f33986c2dbf3e42f4e283848077f5d177335336a74f6a6c0507831c356985273cf7ed6da3009087f5740fb11bc4eb8078f2ee46

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\css\main-selector.css

MD5 3c500ccd5583b6f49387df0b648919fa
SHA1 38ecf46f7646aac6c9cb14f010e2b4a82d838d44
SHA256 c5cf54cba1e0753b7aeb77c65305bcb0fc6d5c40ea9ae9a65e06ede34e595938
SHA512 14e798145756ec87aaa213b9b27bec46786571a990223c8385cbbe5093358d9419a8fce41a40728fbaf9ee61e305ef11d3650d4935125271b0ca000ada95bc36

C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB.txt.savelock52

MD5 ed2f081a37d5202541c32736fc7f2754
SHA1 3e56f21d8dcb0b50b062a49b1d19fd48b0554b66
SHA256 530e636fc7b524d50f25d2f48d437224423c0a12273bb7590268e70228c60962
SHA512 e5f4feadc592c9505c3e0f08efea869c99a04ab2a3f6afd0a4b7183f0c422e9d641152fc14794353c2cf3e333cc4584e449ad3038be8c81f117def2cd540fdc7

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\notification_helper.exe.manifest

MD5 731769b74e0ce6952bb3414a333cb5f4
SHA1 3a7ca2057edffe15ada0abb6642d40c0b084c1c7
SHA256 ecab4e2ddc7fa5226708716b1db6b648943f1473f59499a2461c24d60fd98a7f
SHA512 0456e85807802d303da21a7bbc8f287abfb14b0031347fe6794e2c80645843fc25c8480b9f67f95b8bf6641f0075b71a223fe5c04c25cac279c6f2b7367243cb

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\identity_proxy\identity_helper.Sparse.Internal.msix.DATA

MD5 9bf065a442051b1316832ae485817bd6
SHA1 287d0d812155f1e928962fe5623ab0b8e7311409
SHA256 1299d636e82086b3cb4a1c14a784f789417a0340a4e71718fbfc9269fa4da703
SHA512 a00d867802d4b93162b5925f6a145dee0cf5ec0ad1e21eb0872ce56ed612b6e247303658313cb4fd28bc3aeabbc6ab6fcee9206a22bb2c49c3f87104c8b1188c

C:\Users\Admin\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOCK

MD5 4e652e5a6939492cfa9b9d6e55d40446
SHA1 5b48c9de2da03c820eab3de990db61f9dd3c547f
SHA256 80c61aad13150e8eda8aa41f663fe1953e82e5a06e25388ce47acbb3ff242e65
SHA512 31c8d32d5f0b2e8b712a69ee39a9742240a5a039f8469973690eb527e96ed3ae0eb748d96398a642ed93c1d66e2c8aefebfe79e616f48937901de89e72fd5b33

C:\ProgramData\Microsoft\Network\Downloader\edbtmp.log

MD5 bf16aa0f6500587fe11af919cc441f3f
SHA1 e838d0837fb1dd963a8c6f48b495b7f7a1c288ee
SHA256 b8d6423e469aa7188d7dcfaa8a2e4044f1eb10cb0d37e6a8bf0aace3e04fc25e
SHA512 23c825aae92f651be4518e9aab4dda477661e5a546e25c4d67664d6ba1578887cbd18f59f8d5efb1e53d9dc7b7b5350d18fac3cf8dfa87e8bc1290c96b342607

C:\ProgramData\Microsoft\User Account Pictures\Admin.dat

MD5 53ac4c8f91bf0536a1741456f55df3f3
SHA1 eb45dd1e6e8baa97d7d32a4ef918c490a686f578
SHA256 9a4686c5d96b999bedbc30c99a4465655b6f57c52824248881aec7824e9b8523
SHA512 2ea68cd79250dbe5d91e53b503951c113886c67e585e19c849ac10bd86b605d1892a50ee7b47291c610431830b5a14ea211319b4f21af6130ad2cf88bcebb18d

C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\packages\vcRuntimeAdditional_amd64\vc_runtimeAdditional_x64.msi

MD5 8fe06516843cb683333bb5836393d3ee
SHA1 ff562070334780f28ccb0addc2daedbfc48ff917
SHA256 d83a8390dc596c70e2dcabffc102c79c13117ebe56cf197762aa4e3bec3c34f7
SHA512 c4ecd6ff1f583f9f213f9142770dcae2e5753002351962bb83138e0038fe1e95006b59ec743258c64de18ad464051c582ef78a254612d9f68e3c44f5112a7db7

C:\ProgramData\Package Cache\{D44822A8-FC28-42FC-8B1D-21A78579FC79}v64.0.4211\dotnet-host-8.0.0-win-x64.msi

MD5 22a789386e07935847e1f4b49c665672
SHA1 f71ffb107265ed31ed7dd8434bf6869f881dca78
SHA256 b19554d37a0990af8c46e9cb46ddf574e6e66de087bd9e0edac623c4dcc956b6
SHA512 65fba381c19f86011c88a0126fc8855b7bb19eb0acf3b0677e64e59938a54cc3b6d2d44cfec7278045734e10b24d5fdeadffe262a7b81900bae1747bd7c843f1

C:\ProgramData\Microsoft\Windows\Caches\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db.savelock52

MD5 1e4c7e086b17427cdc1ce0753aaf8c5e
SHA1 515d6ef81acd410de2fe200c8a3f4ce06555fcb0
SHA256 b55c05b400cdc41d25731419b88b746b70640ac94295d02be85a7512608f6326
SHA512 d47a446b2810d3b8e04b5443f632df10981b58e2ca278a6acb79b929f793d8a366e0764014dfd7baf40b893e7dd1fe8919c7e57983f2e9a2d6f2044eac789fba