Overview

overview

10

Static

static

10

d5f9fa1a8d...18.exe

windows7-x64

10

d5f9fa1a8d...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09-09-2024 08:45

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    d5f9fa1a8dca5319432f51a5891f7794_JaffaCakes118.exe

  • Size

    7.1MB

  • MD5

    d5f9fa1a8dca5319432f51a5891f7794

  • SHA1

    2a937328f5b99eccb9b8c13ed71d6ffb9dff4521

  • SHA256

    18f4123ee42f5a29f8df7bd1cf95ab73441f082584f390aa218c2dd1134f4055

  • SHA512

    87013b63a9b153c5268784928394dfbf1eeff1b91eea6bdf187025e63d25c535e468e59a33f47d23682a386605bb314311e50a7edd1d6deb1b60f5008237a7d0

  • SSDEEP

    196608:TfavVYaolX+aFFLlPKQ8hY/RkQWslX4ge+:TiYaolrFFEHYu3sSge

Score
10/10
mimikatzzhendiscoveryexploitpersistencepyinstallerransomwarespywarestealer

Malware Config

Signatures

  • Mimikatz

    mimikatz is an open source tool to dump credentials on Windows.

    mimikatz
  • Zhen Executable 3 IoCs
  • Zhen Ransomware

    First seen in September 2020. Drops ransomnote as .ini file.

    ransomwarezhen
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Renames multiple (2439) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • mimikatz is an open source tool to dump credentials on Windows 1 IoCs
  • Possible privilege escalation attempt 2 IoCs
    exploit
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Modifies file permissions 1 TTPs 2 IoCs
    discovery
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 6 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Detects Pyinstaller 1 IoCs
    pyinstaller
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Kills process with taskkill 7 IoCs
    evasion
  • Modifies Control Panel 4 IoCs
    evasion
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 30 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: LoadsDriver 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\d5f9fa1a8dca5319432f51a5891f7794_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\d5f9fa1a8dca5319432f51a5891f7794_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4816
    • C:\ProgramData\d5f9fa1a8dca5319432f51a5891f7794_JaffaCakes118.exe
      C:\ProgramData\d5f9fa1a8dca5319432f51a5891f7794_JaffaCakes118.exe
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Enumerates connected drives
      • Sets desktop wallpaper using registry
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3788
      • C:\Windows\SysWOW64\taskkill.exe
        "C:\Windows\System32\taskkill.exe" /F /IM MSExchange*
        3⤵
        • System Location Discovery: System Language Discovery
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2860
      • C:\Windows\SysWOW64\taskkill.exe
        "C:\Windows\System32\taskkill.exe" /F /IM Microsoft*
        3⤵
        • System Location Discovery: System Language Discovery
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2036
      • C:\Windows\SysWOW64\taskkill.exe
        "C:\Windows\System32\taskkill.exe" /F /IM ora*
        3⤵
        • System Location Discovery: System Language Discovery
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:3976
      • C:\Windows\SysWOW64\taskkill.exe
        "C:\Windows\System32\taskkill.exe" /F /IM tns*
        3⤵
        • System Location Discovery: System Language Discovery
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1728
      • C:\Windows\SysWOW64\taskkill.exe
        "C:\Windows\System32\taskkill.exe" /F /IM mysql*
        3⤵
        • System Location Discovery: System Language Discovery
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:712
      • C:\Windows\SysWOW64\taskkill.exe
        "C:\Windows\System32\taskkill.exe" /F /IM sql*
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2608
      • C:\Windows\SysWOW64\taskkill.exe
        "C:\Windows\System32\taskkill.exe" /F /IM postgres*
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1764
      • C:\Windows\SysWOW64\takeown.exe
        "C:\Windows\System32\takeown.exe" /F C:\Windows\Web\Wallpaper\Windows\img0.jpg
        3⤵
        • Possible privilege escalation attempt
        • Modifies file permissions
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:4132
      • C:\Windows\SysWOW64\icacls.exe
        "C:\Windows\System32\icacls.exe" C:\Windows\Web\Wallpaper\Windows\img0.jpg /grant Users:F
        3⤵
        • Possible privilege escalation attempt
        • Modifies file permissions
        PID:3724
      • C:\ProgramData\x64.exe
        C:\ProgramData\x64.exe 04298718c4ed4c0a282605560f30b8f0::72a50cf6d7d1042c8b2514f9768fa499 cfad00e8748eaea::7e9372bd97ed3aec6 25427320e7f946c9::7c3a5807a37a26a9 39d6c0440ea63b::33854dce8ddd35e877 exit
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:436
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c logoff 0
        3⤵
          PID:2064
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c logoff 1
          3⤵
            PID:216
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c logoff 2
            3⤵
            • System Location Discovery: System Language Discovery
            PID:2548
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c logoff 3
            3⤵
            • System Location Discovery: System Language Discovery
            PID:4728
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c logoff 4
            3⤵
            • System Location Discovery: System Language Discovery
            PID:4280
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c logoff 5
            3⤵
            • System Location Discovery: System Language Discovery
            PID:372
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c logoff 6
            3⤵
            • System Location Discovery: System Language Discovery
            PID:5112
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c logoff 7
            3⤵
            • System Location Discovery: System Language Discovery
            PID:4364
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c logoff 8
            3⤵
            • System Location Discovery: System Language Discovery
            PID:1076
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c logoff 9
            3⤵
            • System Location Discovery: System Language Discovery
            PID:4168
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c logoff 10
            3⤵
            • System Location Discovery: System Language Discovery
            PID:3700
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c logoff 11
            3⤵
            • System Location Discovery: System Language Discovery
            PID:4516
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c logoff 12
            3⤵
              PID:3396
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /c logoff 13
              3⤵
                PID:4488
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /c logoff 14
                3⤵
                • System Location Discovery: System Language Discovery
                PID:1292
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /c logoff 15
                3⤵
                • System Location Discovery: System Language Discovery
                PID:5096
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /c logoff 16
                3⤵
                • System Location Discovery: System Language Discovery
                PID:1800
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /c logoff 17
                3⤵
                • System Location Discovery: System Language Discovery
                PID:1428
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /c logoff 18
                3⤵
                  PID:3456
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c logoff 19
                  3⤵
                  • System Location Discovery: System Language Discovery
                  PID:1248
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c logoff 20
                  3⤵
                  • System Location Discovery: System Language Discovery
                  PID:2624
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c logoff 21
                  3⤵
                  • System Location Discovery: System Language Discovery
                  PID:3012
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c logoff 22
                  3⤵
                    PID:852
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\System32\cmd.exe" /c logoff 23
                    3⤵
                      PID:2132
                    • C:\Windows\SysWOW64\cmd.exe
                      "C:\Windows\System32\cmd.exe" /c logoff 24
                      3⤵
                      • System Location Discovery: System Language Discovery
                      PID:1228
                    • C:\Windows\SysWOW64\cmd.exe
                      "C:\Windows\System32\cmd.exe" /c logoff 25
                      3⤵
                        PID:3432
                      • C:\Windows\SysWOW64\cmd.exe
                        "C:\Windows\System32\cmd.exe" /c logoff 26
                        3⤵
                        • System Location Discovery: System Language Discovery
                        PID:516
                      • C:\Windows\SysWOW64\cmd.exe
                        "C:\Windows\System32\cmd.exe" /c logoff 27
                        3⤵
                          PID:4640
                        • C:\Windows\SysWOW64\cmd.exe
                          "C:\Windows\System32\cmd.exe" /c logoff 28
                          3⤵
                            PID:280
                          • C:\Windows\SysWOW64\cmd.exe
                            "C:\Windows\System32\cmd.exe" /c logoff 29
                            3⤵
                            • System Location Discovery: System Language Discovery
                            PID:1460
                          • C:\Windows\SysWOW64\cmd.exe
                            "C:\Windows\System32\cmd.exe" /c logoff 30
                            3⤵
                            • System Location Discovery: System Language Discovery
                            PID:300
                          • C:\Windows\SysWOW64\cmd.exe
                            "C:\Windows\System32\cmd.exe" /c logoff 31
                            3⤵
                              PID:5100
                            • C:\Windows\SysWOW64\cmd.exe
                              "C:\Windows\System32\cmd.exe" /c logoff 32
                              3⤵
                              • System Location Discovery: System Language Discovery
                              PID:4484
                            • C:\Windows\SysWOW64\cmd.exe
                              "C:\Windows\System32\cmd.exe" /c logoff 33
                              3⤵
                              • System Location Discovery: System Language Discovery
                              PID:4496
                            • C:\Windows\SysWOW64\cmd.exe
                              "C:\Windows\System32\cmd.exe" /c logoff 34
                              3⤵
                                PID:1476
                              • C:\Windows\SysWOW64\cmd.exe
                                "C:\Windows\System32\cmd.exe" /c logoff 35
                                3⤵
                                • System Location Discovery: System Language Discovery
                                PID:3500
                              • C:\Windows\SysWOW64\cmd.exe
                                "C:\Windows\System32\cmd.exe" /c logoff 36
                                3⤵
                                  PID:2284
                                • C:\Windows\SysWOW64\cmd.exe
                                  "C:\Windows\System32\cmd.exe" /c logoff 37
                                  3⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:644
                                • C:\Windows\SysWOW64\cmd.exe
                                  "C:\Windows\System32\cmd.exe" /c logoff 38
                                  3⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:764
                                • C:\Windows\SysWOW64\cmd.exe
                                  "C:\Windows\System32\cmd.exe" /c logoff 39
                                  3⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:452
                                • C:\Windows\SysWOW64\cmd.exe
                                  "C:\Windows\System32\cmd.exe" /c logoff 40
                                  3⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:4260
                                • C:\Windows\SysWOW64\cmd.exe
                                  "C:\Windows\System32\cmd.exe" /c logoff 41
                                  3⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:3284
                                • C:\Windows\SysWOW64\cmd.exe
                                  "C:\Windows\System32\cmd.exe" /c logoff 42
                                  3⤵
                                    PID:3792
                                  • C:\Windows\SysWOW64\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /c logoff 43
                                    3⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:1028
                                  • C:\Windows\SysWOW64\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /c logoff 44
                                    3⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:712
                                  • C:\Windows\SysWOW64\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /c logoff 45
                                    3⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:216
                                  • C:\Windows\SysWOW64\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /c logoff 46
                                    3⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:4476
                                  • C:\Windows\SysWOW64\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /c logoff 47
                                    3⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:3296
                                  • C:\Windows\SysWOW64\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /c logoff 48
                                    3⤵
                                      PID:4788
                                    • C:\Windows\SysWOW64\cmd.exe
                                      "C:\Windows\System32\cmd.exe" /c logoff 49
                                      3⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:1992
                                    • C:\Windows\SysWOW64\cmd.exe
                                      "C:\Windows\System32\cmd.exe" /c logoff 50
                                      3⤵
                                        PID:2356
                                      • C:\Windows\SysWOW64\cmd.exe
                                        "C:\Windows\System32\cmd.exe" /c logoff 51
                                        3⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:1076
                                      • C:\Windows\SysWOW64\cmd.exe
                                        "C:\Windows\System32\cmd.exe" /c logoff 52
                                        3⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:436
                                      • C:\Windows\SysWOW64\cmd.exe
                                        "C:\Windows\System32\cmd.exe" /c logoff 53
                                        3⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:932
                                      • C:\Windows\SysWOW64\cmd.exe
                                        "C:\Windows\System32\cmd.exe" /c logoff 54
                                        3⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:3384
                                      • C:\Windows\SysWOW64\cmd.exe
                                        "C:\Windows\System32\cmd.exe" /c logoff 55
                                        3⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:4000
                                      • C:\Windows\SysWOW64\cmd.exe
                                        "C:\Windows\System32\cmd.exe" /c logoff 56
                                        3⤵
                                          PID:4240
                                        • C:\Windows\SysWOW64\cmd.exe
                                          "C:\Windows\System32\cmd.exe" /c logoff 57
                                          3⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:2900
                                        • C:\Windows\SysWOW64\cmd.exe
                                          "C:\Windows\System32\cmd.exe" /c logoff 58
                                          3⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:3996
                                        • C:\Windows\SysWOW64\cmd.exe
                                          "C:\Windows\System32\cmd.exe" /c logoff 59
                                          3⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:4756
                                        • C:\Windows\SysWOW64\cmd.exe
                                          "C:\Windows\System32\cmd.exe" /c logoff 60
                                          3⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:2460
                                        • C:\Windows\SysWOW64\cmd.exe
                                          "C:\Windows\System32\cmd.exe" /c logoff 61
                                          3⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:5036
                                        • C:\Windows\SysWOW64\cmd.exe
                                          "C:\Windows\System32\cmd.exe" /c logoff 62
                                          3⤵
                                            PID:1344
                                          • C:\Windows\SysWOW64\cmd.exe
                                            "C:\Windows\System32\cmd.exe" /c logoff 63
                                            3⤵
                                              PID:3028
                                            • C:\Windows\SysWOW64\cmd.exe
                                              "C:\Windows\System32\cmd.exe" /c logoff 64
                                              3⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:3372
                                            • C:\Windows\SysWOW64\cmd.exe
                                              "C:\Windows\System32\cmd.exe" /c logoff 65
                                              3⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:1564
                                            • C:\Windows\SysWOW64\cmd.exe
                                              "C:\Windows\System32\cmd.exe" /c logoff 66
                                              3⤵
                                                PID:304
                                              • C:\Windows\SysWOW64\cmd.exe
                                                "C:\Windows\System32\cmd.exe" /c logoff 67
                                                3⤵
                                                • System Location Discovery: System Language Discovery
                                                PID:3408
                                              • C:\Windows\SysWOW64\cmd.exe
                                                "C:\Windows\System32\cmd.exe" /c logoff 68
                                                3⤵
                                                • System Location Discovery: System Language Discovery
                                                PID:3268
                                              • C:\Windows\SysWOW64\cmd.exe
                                                "C:\Windows\System32\cmd.exe" /c logoff 69
                                                3⤵
                                                • System Location Discovery: System Language Discovery
                                                PID:2248
                                              • C:\Windows\SysWOW64\cmd.exe
                                                "C:\Windows\System32\cmd.exe" /c logoff 70
                                                3⤵
                                                  PID:3472
                                                  • C:\Windows\System32\Conhost.exe
                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                    4⤵
                                                      PID:4640
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    "C:\Windows\System32\cmd.exe" /c logoff 71
                                                    3⤵
                                                    • System Location Discovery: System Language Discovery
                                                    PID:3820
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    "C:\Windows\System32\cmd.exe" /c logoff 72
                                                    3⤵
                                                    • System Location Discovery: System Language Discovery
                                                    PID:3068
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    "C:\Windows\System32\cmd.exe" /c logoff 73
                                                    3⤵
                                                      PID:3292
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      "C:\Windows\System32\cmd.exe" /c logoff 74
                                                      3⤵
                                                      • System Location Discovery: System Language Discovery
                                                      PID:2264
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      "C:\Windows\System32\cmd.exe" /c logoff 75
                                                      3⤵
                                                      • System Location Discovery: System Language Discovery
                                                      PID:4208
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      "C:\Windows\System32\cmd.exe" /c logoff 76
                                                      3⤵
                                                        PID:2480
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        "C:\Windows\System32\cmd.exe" /c logoff 77
                                                        3⤵
                                                        • System Location Discovery: System Language Discovery
                                                        PID:4996
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        "C:\Windows\System32\cmd.exe" /c logoff 78
                                                        3⤵
                                                          PID:3500
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          "C:\Windows\System32\cmd.exe" /c logoff 79
                                                          3⤵
                                                          • System Location Discovery: System Language Discovery
                                                          PID:908
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          "C:\Windows\System32\cmd.exe" /c logoff 80
                                                          3⤵
                                                            PID:3864
                                                      • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                                                        "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                                                        1⤵
                                                        • Drops file in System32 directory
                                                        • Checks processor information in registry
                                                        • Enumerates system info in registry
                                                        • Modifies data under HKEY_USERS
                                                        • Suspicious use of SetWindowsHookEx
                                                        PID:1168
                                                      • C:\Windows\system32\vssvc.exe
                                                        C:\Windows\system32\vssvc.exe
                                                        1⤵
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:5000
                                                      • C:\Windows\system32\LogonUI.exe
                                                        "LogonUI.exe" /flags:0x4 /state0:0xa3913055 /state1:0x41c64e6d
                                                        1⤵
                                                        • Modifies data under HKEY_USERS
                                                        • Suspicious use of SetWindowsHookEx
                                                        PID:2828
                                                      • C:\Windows\System32\smss.exe
                                                        \SystemRoot\System32\smss.exe 000000c4 00000084
                                                        1⤵
                                                        • Suspicious behavior: LoadsDriver
                                                        PID:932
                                                      • C:\Windows\System32\smss.exe
                                                        \SystemRoot\System32\smss.exe 000000e8 00000084
                                                        1⤵
                                                        • Suspicious behavior: LoadsDriver
                                                        PID:5096
                                                      • C:\Windows\System32\smss.exe
                                                        \SystemRoot\System32\smss.exe 000000ec 00000084
                                                        1⤵
                                                        • Suspicious behavior: LoadsDriver
                                                        PID:4516
                                                      • C:\Windows\System32\smss.exe
                                                        \SystemRoot\System32\smss.exe 000000e4 00000084
                                                        1⤵
                                                        • Suspicious behavior: LoadsDriver
                                                        PID:2900
                                                      • C:\Windows\System32\smss.exe
                                                        \SystemRoot\System32\smss.exe 0000010c 00000084
                                                        1⤵
                                                        • Suspicious behavior: LoadsDriver
                                                        PID:4756
                                                      • C:\Windows\System32\smss.exe
                                                        \SystemRoot\System32\smss.exe 000000c0 00000084
                                                        1⤵
                                                        • Suspicious behavior: LoadsDriver
                                                        PID:5036
                                                      • C:\Windows\System32\smss.exe
                                                        \SystemRoot\System32\smss.exe 000000e0 00000084
                                                        1⤵
                                                          PID:1228
                                                        • C:\Windows\System32\smss.exe
                                                          \SystemRoot\System32\smss.exe 000000c4 00000084
                                                          1⤵
                                                            PID:2248
                                                          • C:\Windows\System32\smss.exe
                                                            \SystemRoot\System32\smss.exe 00000108 00000084
                                                            1⤵
                                                              PID:3472
                                                            • C:\Windows\System32\smss.exe
                                                              \SystemRoot\System32\smss.exe 00000108 00000084
                                                              1⤵
                                                                PID:1460
                                                              • C:\Windows\System32\smss.exe
                                                                \SystemRoot\System32\smss.exe 000000c0 00000084
                                                                1⤵
                                                                  PID:4484
                                                                • C:\Windows\System32\smss.exe
                                                                  \SystemRoot\System32\smss.exe 000000e0 00000084
                                                                  1⤵
                                                                    PID:4496
                                                                  • C:\Windows\System32\smss.exe
                                                                    \SystemRoot\System32\smss.exe 000000e0 00000084
                                                                    1⤵
                                                                      PID:764
                                                                    • C:\Windows\System32\smss.exe
                                                                      \SystemRoot\System32\smss.exe 000000dc 00000084
                                                                      1⤵
                                                                        PID:3284
                                                                      • C:\Windows\System32\smss.exe
                                                                        \SystemRoot\System32\smss.exe 00000108 00000084
                                                                        1⤵
                                                                          PID:3792
                                                                        • C:\Windows\System32\smss.exe
                                                                          \SystemRoot\System32\smss.exe 000000e8 00000084
                                                                          1⤵
                                                                            PID:644
                                                                          • C:\Windows\System32\smss.exe
                                                                            \SystemRoot\System32\smss.exe 000000e8 00000084
                                                                            1⤵
                                                                              PID:4476
                                                                            • C:\Windows\System32\smss.exe
                                                                              \SystemRoot\System32\smss.exe 000000d8 00000084
                                                                              1⤵
                                                                                PID:1992
                                                                              • C:\Windows\System32\smss.exe
                                                                                \SystemRoot\System32\smss.exe 000000ec 00000084
                                                                                1⤵
                                                                                  PID:3384
                                                                                • C:\Windows\System32\smss.exe
                                                                                  \SystemRoot\System32\smss.exe 000000b4 00000084
                                                                                  1⤵
                                                                                    PID:4240
                                                                                  • C:\Windows\System32\smss.exe
                                                                                    \SystemRoot\System32\smss.exe 000000d8 00000084
                                                                                    1⤵
                                                                                      PID:2460
                                                                                    • C:\Windows\System32\smss.exe
                                                                                      \SystemRoot\System32\smss.exe 000000d0 00000084
                                                                                      1⤵
                                                                                        PID:1344
                                                                                      • C:\Windows\System32\smss.exe
                                                                                        \SystemRoot\System32\smss.exe 000000c4 00000084
                                                                                        1⤵
                                                                                          PID:3028
                                                                                        • C:\Windows\System32\smss.exe
                                                                                          \SystemRoot\System32\smss.exe 000000d0 00000084
                                                                                          1⤵
                                                                                            PID:304
                                                                                          • C:\Windows\System32\smss.exe
                                                                                            \SystemRoot\System32\smss.exe 00000104 00000084
                                                                                            1⤵
                                                                                              PID:3268
                                                                                            • C:\Windows\System32\smss.exe
                                                                                              \SystemRoot\System32\smss.exe 000000d8 00000084
                                                                                              1⤵
                                                                                                PID:3820
                                                                                              • C:\Windows\System32\smss.exe
                                                                                                \SystemRoot\System32\smss.exe 000000e8 00000084
                                                                                                1⤵
                                                                                                  PID:2264
                                                                                                • C:\Windows\System32\smss.exe
                                                                                                  \SystemRoot\System32\smss.exe 000000c0 00000084
                                                                                                  1⤵
                                                                                                    PID:4208
                                                                                                  • C:\Windows\System32\smss.exe
                                                                                                    \SystemRoot\System32\smss.exe 00000100 00000084
                                                                                                    1⤵
                                                                                                      PID:2480

                                                                                                    Network

                                                                                                    MITRE ATT&CK Enterprise v15

                                                                                                    Replay Monitor

                                                                                                    Loading Replay Monitor...

                                                                                                    Downloads

                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\rhp_world_icon.png.zhen
                                                                                                      Filesize

                                                                                                      445B

                                                                                                      MD5

                                                                                                      f00e4f915f50eba5d2dadad5e69135ac

                                                                                                      SHA1

                                                                                                      10ba95f20474bc3c14122af887ecbadacd0eae62

                                                                                                      SHA256

                                                                                                      bcb0de2a4dd9f1b8fb7fe185bdfaf98679e13a94278a157ece7338a3dbb270d2

                                                                                                      SHA512

                                                                                                      f798682f69a819408e75258b353f8557f58d92bb6d6595a6fb3f15a415e17c3eac9cac8e852eacf564037176b8aa1a7e95981f6a28e44b7f516823c67b068a4a

                                                                                                      Download Submit

                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\rhp_world_icon_2x.png.zhen
                                                                                                      Filesize

                                                                                                      611B

                                                                                                      MD5

                                                                                                      1c1b42020d07cb4772f8f3e32d3b9a6d

                                                                                                      SHA1

                                                                                                      59c8c1e2ae117703f1e7f3b9e4f61b2b0823b414

                                                                                                      SHA256

                                                                                                      b979ab2ee1b33ab63829e18ce17a4be22390d3bdff84fe7d1e0a38f377998138

                                                                                                      SHA512

                                                                                                      55f4def4f02e155d46042ecbe1478f3652a39edff3f96729a31ff4d19d27422ab734e72a6dc84de560c585a40a61c0123d7e31a34e4c1040651459d795ac1ece

                                                                                                      Download Submit

                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\rhp_world_icon_hover.png.zhen
                                                                                                      Filesize

                                                                                                      388B

                                                                                                      MD5

                                                                                                      fb32f64a5582fd03a38e610717ff214a

                                                                                                      SHA1

                                                                                                      f80eb74149a7c20ece285322d0d10c308eb9ae14

                                                                                                      SHA256

                                                                                                      624ca756c0bf21fedc97e298c95c1b3fbb80424a48b8588927a72c4004c6e7e6

                                                                                                      SHA512

                                                                                                      d449f7a6f0574605403736ab45718c91e38c3110a24a33c00474a3dc7c8f5d00b15540dee2303324dc6bdaa68c13acec1b7f1dbaf24b77986bfe11a77f28973d

                                                                                                      Download Submit

                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\rhp_world_icon_hover_2x.png.zhen
                                                                                                      Filesize

                                                                                                      552B

                                                                                                      MD5

                                                                                                      f7cf2998f3f804797face4f614a92b6a

                                                                                                      SHA1

                                                                                                      6f518a522f372581dc5bd8e5b4e03b52739da026

                                                                                                      SHA256

                                                                                                      bc0dcb3f9bd7915464e288776738c28194e22323b4c07ab88fe9734caed90260

                                                                                                      SHA512

                                                                                                      110675e8fefeaf600dce6ae9f74b1fcea0c29d9256107199f3d142c331a4e50ac1b1fa54915e0b386ba6a2e69367f4b85a09d1683e8c2433eefeeaf6d11ba915

                                                                                                      Download Submit

                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\themes\dark\rhp_world_icon.png.zhen
                                                                                                      Filesize

                                                                                                      388B

                                                                                                      MD5

                                                                                                      1ce442961cc54b6ce6203d1312eb8248

                                                                                                      SHA1

                                                                                                      44b04a6fe2dacd4a26d7dd7c1a676d1d3a192924

                                                                                                      SHA256

                                                                                                      bf3329bcf4574588aa071179faf247f6a9352623be263dd8d58ec065aaf53dac

                                                                                                      SHA512

                                                                                                      3552baac46e0f11a1a2a53a37255ccc2a228412b7eea50712af4b4a7e3b8f095af71d5f5efc3968287e5f2e03180421d6d1ee2e59b097cdaae992a9d756274ec

                                                                                                      Download Submit

                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\themes\dark\rhp_world_icon_2x.png.zhen
                                                                                                      Filesize

                                                                                                      552B

                                                                                                      MD5

                                                                                                      e6d85eed5f62dddb8c5141007fe232cf

                                                                                                      SHA1

                                                                                                      b7bda4c0ba3fe1af0e9ee45681d9efa978ffcebc

                                                                                                      SHA256

                                                                                                      498b3e9391c3b98f0962ecf94efbd379ee04749cae7fe46284997285892773ba

                                                                                                      SHA512

                                                                                                      04b7a23b4642676695148c1349f6185698f2cf3b3f4f2bc8288b29757d9e155a257b39cbdd3cc96ad619b9d2510c2546647bc4cd2dca0bd66781cb18d7f05a62

                                                                                                      Download Submit

                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\themes\dark\rhp_world_icon_hover.png.zhen
                                                                                                      Filesize

                                                                                                      388B

                                                                                                      MD5

                                                                                                      ace521b874c0dedb78c7a869d8fd4b6d

                                                                                                      SHA1

                                                                                                      5458264f50b335ae61c49ef75b7707649635e680

                                                                                                      SHA256

                                                                                                      67c4f995d3be92ba3dfa114477341a458ec0b238c5275bee0595ee8b25f1904a

                                                                                                      SHA512

                                                                                                      af1729a8d8271de4fdad354c872ed92ebcb0aeffc82c23f0391e1da512110f08c92528715b1187a1ac03ee8bac9830b9ce82e4198d1cd60073aba444ce721826

                                                                                                      Download Submit

                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\themes\dark\rhp_world_icon_hover_2x.png.zhen
                                                                                                      Filesize

                                                                                                      552B

                                                                                                      MD5

                                                                                                      cde4d23e891c0270f0c2c4c66304d704

                                                                                                      SHA1

                                                                                                      340e0e4bfec6d3e473196638d294de261af70a29

                                                                                                      SHA256

                                                                                                      762986cad429a0ace8608dfb475a3684854325ed6f60496c841e4d35b7917e43

                                                                                                      SHA512

                                                                                                      c6164b7bf1c0ff72377197c3fdfb64c9650bf3115c3b85804ad01daf59a85f00ab0f41042c449a35a80d8da9869fa74b99dba20722a1f4441dd6666f8b1d73e4

                                                                                                      Download Submit

                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\icons.png.zhen
                                                                                                      Filesize

                                                                                                      7KB

                                                                                                      MD5

                                                                                                      b57d735c38725879cd993596de7d2657

                                                                                                      SHA1

                                                                                                      ad2d989754d6a6926ef9a4921259e14f99f676a1

                                                                                                      SHA256

                                                                                                      41cbdaefb38b4f9d6e03641559ce9bd742092cb028a7a06a19ad8caf5e44403a

                                                                                                      SHA512

                                                                                                      19a4fcc1733bddf6a071138ed890f978b2c0cd5d0a826f5b474787417a21b25907fd30a09cb96d6ead16120fc8945ea46d68e853d4789ca3cea4b04fdbe46ffe

                                                                                                      Download Submit

                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\icons_retina.png.zhen
                                                                                                      Filesize

                                                                                                      15KB

                                                                                                      MD5

                                                                                                      8f14d4e2437818364ca6dff3ae11c8b5

                                                                                                      SHA1

                                                                                                      cba59554b06ca5ea7c76ad7c042138364886a0e9

                                                                                                      SHA256

                                                                                                      c6afc500ec5bd5626fbfdd24a6fe42b63fe334f9dfe72363974fdd8253250530

                                                                                                      SHA512

                                                                                                      83b508817b41774ddcc8550c2b7b3ebb9b69e78ca873585f87cdea15f3da364b78ed0b83442cb640d9edd7874d763719df138bb82d3af9a89db77dcfb6e26964

                                                                                                      Download Submit

                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\new_icons.png.zhen
                                                                                                      Filesize

                                                                                                      8KB

                                                                                                      MD5

                                                                                                      6544ed025448ee141005002d7b921ba5

                                                                                                      SHA1

                                                                                                      758029895a5dea985a899bcc2d0b157b824f7235

                                                                                                      SHA256

                                                                                                      cb25bd3b335fc2dd302a377ab38c5a527fa4b5a8576191b9ea9764d4de60cd3b

                                                                                                      SHA512

                                                                                                      893b5b097bbd2f9ddd40d1ac1a64ba5ff619ba9e5241bcc97523651c27d3628984c32f7c7dcfcab197ad70bbed1c39c18bf5d639394396bb5b765f628055301e

                                                                                                      Download Submit

                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\new_icons_retina.png.zhen
                                                                                                      Filesize

                                                                                                      17KB

                                                                                                      MD5

                                                                                                      e02ab9e70f69c1e13da86b9c8c17af9f

                                                                                                      SHA1

                                                                                                      7a0429c20e9704da5001912a411c6fe97d9f3db6

                                                                                                      SHA256

                                                                                                      0498b88829a5cd33938801c8b0a58798a3e0ab03a0ad00a079e25da904b504a4

                                                                                                      SHA512

                                                                                                      8e44b1b0d9d3371590f2711a15bf0b6d205701257206498c18b82883b2921e859e5de913f4ef6b357369088a73a3a2f70468d8ecf38ed3003ef6c7ed296dcb03

                                                                                                      Download Submit

                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\bg_pattern_RHP.png.zhen
                                                                                                      Filesize

                                                                                                      179B

                                                                                                      MD5

                                                                                                      86536e1e1c1859c0f11f0b0da23b2dbd

                                                                                                      SHA1

                                                                                                      3e4efe02dce452ed2315a5770542e537687df64d

                                                                                                      SHA256

                                                                                                      1e8c45de16f3a614e35ffff03ca3382235b4c6b8d477f124d5fb787293d58f07

                                                                                                      SHA512

                                                                                                      693812d8ee445bab9c677dd600c554eff2f675c5b9af7e9698e8a8cc6d842ec7a0a2ce3c634a3d83440ca16be81abda2e32cc3ec8cfc8fc5a9de19303429a30b

                                                                                                      Download Submit

                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\illustrations_retina.png.zhen
                                                                                                      Filesize

                                                                                                      19KB

                                                                                                      MD5

                                                                                                      3b9f8475bb2c03094fa122d957c5a005

                                                                                                      SHA1

                                                                                                      3df03334a55cc5f7c6606a411d034d36181454d6

                                                                                                      SHA256

                                                                                                      84b1b8cb3decddd1919775be98e65bbdc5d452bf3367056d629cd49997347754

                                                                                                      SHA512

                                                                                                      aaf12b3fe8fdc804b5efe9cc927e3fb1865a0736ee0e7900053f4cab510b83e44c18b635f29d8c5839e4228ddbd265f9a8d7c9d2d1823dc99941bb3cb8016933

                                                                                                      Download Submit

                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\themes\dark\bg_patterns_header.png.zhen
                                                                                                      Filesize

                                                                                                      703B

                                                                                                      MD5

                                                                                                      81a9b0bc5f77a3547bec0a36120c4e92

                                                                                                      SHA1

                                                                                                      7e171541018b743ea10a91d8d80022a24c2ce4b3

                                                                                                      SHA256

                                                                                                      5a240670cd166a87795a0ef4c1932dec98d80ee570d37204e985a501967c4d49

                                                                                                      SHA512

                                                                                                      2cfd0f3cdda15c9f5a5d8ad74c4f8894611a0022607c448d0a08d36930c48232dc4b26cf61082426e84b334b3a74a4d5f2c056da5b5503da2dee2ba67cafe141

                                                                                                      Download Submit

                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\themes\dark\illustrations.png.zhen
                                                                                                      Filesize

                                                                                                      8KB

                                                                                                      MD5

                                                                                                      3e3833cd8dcc6c67cbb77639817f0476

                                                                                                      SHA1

                                                                                                      f4cb5ab08611c47a9df73a226661ec39df2c37a5

                                                                                                      SHA256

                                                                                                      1f93276bb600adacb4998e309e0265ac09948a7103a0d5941c62f13ba1812e41

                                                                                                      SHA512

                                                                                                      9de0cc940fc20ed408b06b4d830884e7c920d0937c690915fd98d41e7592b0374e097e79c0f9510b655e124bdeaa2475ec8c967708c7fd07fd6c4e19a726e022

                                                                                                      Download Submit

                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ui-strings.js.zhen
                                                                                                      Filesize

                                                                                                      1KB

                                                                                                      MD5

                                                                                                      5a74a6cdeb3180a4d34822278a144946

                                                                                                      SHA1

                                                                                                      67cc1e3845569ac44560fd2a0758e989275451bc

                                                                                                      SHA256

                                                                                                      3cda63c22e43c8aae04c25cc1ed4d0b8f3c55d54383f73c4ca526cf836504ed0

                                                                                                      SHA512

                                                                                                      41a3b0ebd4694ca4297008deceb0a14b20ff3907cca66238e76a963d10b300382ed544015d16c7970e1a10bd407fcbdff6c2d891c8cac0ace279311fdaf682e6

                                                                                                      Download Submit

                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\images\example_icons.png.zhen
                                                                                                      Filesize

                                                                                                      683B

                                                                                                      MD5

                                                                                                      2b286c468ac42e8ca6ab2f19f5264856

                                                                                                      SHA1

                                                                                                      3a4bbe03c1f4e9ea551eec952d882b81115275cb

                                                                                                      SHA256

                                                                                                      83868351c3a186250fb39dad7fe7a66db6eb95e39ecabc82e8a8186f9cc4f84c

                                                                                                      SHA512

                                                                                                      1b16b47c69662b4db2cdcf3e7faa336252589c28b50e643a4af86a0b70589543a39c94b41ca4a729b18b4ebbd3c1120a288833441e3c0d214250cf92e8213b6c

                                                                                                      Download Submit

                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\images\example_icons2x.png.zhen
                                                                                                      Filesize

                                                                                                      1KB

                                                                                                      MD5

                                                                                                      e32aff0fba98b20e96559140c3b97a3c

                                                                                                      SHA1

                                                                                                      0298e4be812227a7182da37b38261880596385f3

                                                                                                      SHA256

                                                                                                      0395a359bfd6ed5c47802671a6258f29926a659c8bfb85e6464fade2a0084285

                                                                                                      SHA512

                                                                                                      6e4f67e37bf489b474d0ad66ad85ca4486c9775c9e78e11143a79cd042136cc071b72612b9289df51f3ed9dbecafd0d4ad90e0233e2d5f81d95b8aeb52e40661

                                                                                                      Download Submit

                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ui-strings.js.zhen
                                                                                                      Filesize

                                                                                                      1KB

                                                                                                      MD5

                                                                                                      42e5e204b40d5df56beb2cf5d821b951

                                                                                                      SHA1

                                                                                                      2d7892abe775306580cc3d1d1ccdfe32d087ddeb

                                                                                                      SHA256

                                                                                                      c2e12de3fbb24f328081a80692e5fa2f6dd90c8a3fff53c299a23360736276fb

                                                                                                      SHA512

                                                                                                      0ec71131d6c01bc5daaf7c4020ff701db39757a6c1e36444dbe73afd9f131a86554511d82d0925eea702856cb5ece6ac3ce650d9a90bfbf460df8361402d0241

                                                                                                      Download Submit

                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\fi-fi\ui-strings.js.zhen
                                                                                                      Filesize

                                                                                                      823B

                                                                                                      MD5

                                                                                                      5c1eb847e35c415942ffeeaa6e1d3d60

                                                                                                      SHA1

                                                                                                      5c4c55424bceefd05414f6ab90166c00f18c921d

                                                                                                      SHA256

                                                                                                      debcf4833de6ab09c367302706ac857872ac606419810bacda3c4af6604d4cf5

                                                                                                      SHA512

                                                                                                      b1110f5106611b647983781ca69e8b19fa342c821cb97d7899ba8c613c299b1ce237854f53e367bd1beeeb046ca1a4d530e8862e336db4e85a62bc6dc5ca63b2

                                                                                                      Download Submit

                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\css\home-selector.css.zhen
                                                                                                      Filesize

                                                                                                      802B

                                                                                                      MD5

                                                                                                      bdb7d199f41b4f376696f6380c567ee5

                                                                                                      SHA1

                                                                                                      7964e6a66e125ada45e5791ccf7b32da693f55bf

                                                                                                      SHA256

                                                                                                      05de6bb6346b9dba2f29e9baa5e9e1dcfea1274379c705885508bdfc57ce7a51

                                                                                                      SHA512

                                                                                                      ba3d082dabcb0e5d4c7a1c22d0749415c28dede6b8fcc97d70cfd6154c212be7b412ee67a364f842fab0d7844e17b3bf66117f77686d013624289641cd462307

                                                                                                      Download Submit

                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\bun.png.zhen
                                                                                                      Filesize

                                                                                                      2KB

                                                                                                      MD5

                                                                                                      35fc330f6b628d3b88fccb932e452f9c

                                                                                                      SHA1

                                                                                                      5bc7807821375dad1c055f18c27faf0bd682b27c

                                                                                                      SHA256

                                                                                                      10772bfce2fce9ad463011ae1418d6b5269d1ab59356fd1acbd0d192381b96c5

                                                                                                      SHA512

                                                                                                      fe01332d5eb86cb1aa1f5ad404cfafe139c0525765556f519e7054ad50a486565992a8b42238732f831a763edffaaca3ac8f8f0c45b00c3e57695acd4c8dd543

                                                                                                      Download Submit

                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\cstm_brand_preview.png.zhen
                                                                                                      Filesize

                                                                                                      2KB

                                                                                                      MD5

                                                                                                      dd98f30856345783b777c927d58b280b

                                                                                                      SHA1

                                                                                                      fd6fd3852d76b2fca60dbbeb1e5f70c8e7d2ea4b

                                                                                                      SHA256

                                                                                                      15038764970b1e0755ce66b257006755bcc5630501bed726e15cc13900f16154

                                                                                                      SHA512

                                                                                                      03b8a301bf2ddacc26038bf4b12be3d5bc4745dfba2fe08161a4b30afc32b8fa31e8db75afd1c5934220d95606ff103a0d22d2839626d1a6c653568a64db4c28

                                                                                                      Download Submit

                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\cstm_brand_preview2x.png.zhen
                                                                                                      Filesize

                                                                                                      4KB

                                                                                                      MD5

                                                                                                      dd9d9d982c04939ae7b632a8dcc25fc4

                                                                                                      SHA1

                                                                                                      476a9ded983cc4232779c7d304c56f06a8214cdf

                                                                                                      SHA256

                                                                                                      b82b029a2a91c54a56126d647f1db3edacc88aff58f9c13cefb36bdaddb83750

                                                                                                      SHA512

                                                                                                      7f4c16006d90ea42d0985f848994ceaed4de708e1c15ba165af93696599456b8f8d5a669e6b1207579a76e52ce2c0746974087acb73b444c5e2f9947a481935b

                                                                                                      Download Submit

                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\dd_arrow_small2x.png.zhen
                                                                                                      Filesize

                                                                                                      385B

                                                                                                      MD5

                                                                                                      1ed80231cdfb69a295fff6be32d3c220

                                                                                                      SHA1

                                                                                                      5c38af9d9419caba28d9729d8afee981c82c548f

                                                                                                      SHA256

                                                                                                      450045edbf1fc76151a313bccc845d695fe54b51a17d17e33eb2c19d9ef813a2

                                                                                                      SHA512

                                                                                                      311c8255e465e4bd83f65dd5180ff441ac95c1beb36808e3f520932c739bba78eb724b8b1c52751282750ec26428cf01d818397d146babb857e1d219dff692ed

                                                                                                      Download Submit

                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\nub.png.zhen
                                                                                                      Filesize

                                                                                                      1003B

                                                                                                      MD5

                                                                                                      2ff7d059a0cb9393f4c7657f26b32afe

                                                                                                      SHA1

                                                                                                      00e40405e5ef2d0e1f4135c7fd7bafe3a5315dd9

                                                                                                      SHA256

                                                                                                      be8b4392c04d95ea533f07cdc363f7db0f8de34741c6a0a13be55ab5b9fd3ae7

                                                                                                      SHA512

                                                                                                      01ebb92b20b543c2beb708f62dc069a3a0a260216fc25ea2942e3df6ebf01e9d78024bcede7e64c252e0141f2abefe633e17d2b1bb233c3b363f1ee530d3dd10

                                                                                                      Download Submit

                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\share_icons.png.zhen
                                                                                                      Filesize

                                                                                                      1KB

                                                                                                      MD5

                                                                                                      69b841a5c97fd4e77a2c875d9fa19f88

                                                                                                      SHA1

                                                                                                      1b2cf75c8fe4ad06d77c1a317988a2ee02f3f6b3

                                                                                                      SHA256

                                                                                                      73a5d8305f03ba9e091da02377ac8140baa731efc6184e4065ca7f69072fa32e

                                                                                                      SHA512

                                                                                                      934cdf0acafe8f4c5f769170ed1149ec31babc3cdd44a76e7cede4f8939393bd472985f63568a770ebebff28f940b517855e6f9514b289092df067f202a8241e

                                                                                                      Download Submit

                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\share_icons2x.png.zhen
                                                                                                      Filesize

                                                                                                      2KB

                                                                                                      MD5

                                                                                                      21cd8687784d0ac91acd44b6e7fb88ff

                                                                                                      SHA1

                                                                                                      3b5cb90ff8bbab19afa301033d310c7b409a85b1

                                                                                                      SHA256

                                                                                                      9fb86f4e3d2b4161be325a97c162e78682da028f520e8fba8c8e521a461849ee

                                                                                                      SHA512

                                                                                                      b612403a22003626245f37e620bdf0fa00f1afdb07a531a5b6cfdd42062c56a3235647cf51473f83ec024e71989324007fa5913a22fcff2a568efbabe5af0722

                                                                                                      Download Submit

                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\dark\dd_arrow_small.png.zhen
                                                                                                      Filesize

                                                                                                      289B

                                                                                                      MD5

                                                                                                      109e7b579564795b83fc9c282779f03b

                                                                                                      SHA1

                                                                                                      bfd1deea44c2b908d6311c00c506c13f09ca6337

                                                                                                      SHA256

                                                                                                      3ad557524c39bd452f6100c5105fd0d7a4ff8b90eb80635bbf209d3c1e2ae7e7

                                                                                                      SHA512

                                                                                                      48db5c645168c690f0622cf960b886cb469863bb40fc64cdc3b039964d7af9078f343505acd24581b86f0ca29d99ddb4af3ee18015e80b84f220dc79ff54ebc0

                                                                                                      Download Submit

                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\nl-nl\ui-strings.js.zhen
                                                                                                      Filesize

                                                                                                      840B

                                                                                                      MD5

                                                                                                      21d7aa21b64a360ac5868c0a051dc396

                                                                                                      SHA1

                                                                                                      4471cb2f9aeed7f31470c5c4676a6612920824c0

                                                                                                      SHA256

                                                                                                      dabbabec7633b6891a28401d1167a4b27dabcd0d4297adea4a50dfc0cf59777c

                                                                                                      SHA512

                                                                                                      76f879483f4e6a2eadaf3483588b492f41aca5c0cad65461280c51b31603dd9cf5c590188abaa79d676468411ca93058f26c5a8576ae51b42ae2a6bece2acf04

                                                                                                      Download Submit

                                                                                                    • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_US_POSIX.txt.zhen
                                                                                                      Filesize

                                                                                                      32KB

                                                                                                      MD5

                                                                                                      68577fdcf67f992b61aa19bff33cd25d

                                                                                                      SHA1

                                                                                                      aaff36f17d5165d30b33707b519b95e728960bcd

                                                                                                      SHA256

                                                                                                      56b573aac2234c657da01877fae7b43b9aa12b4c8466065b023ad1f8f8a3d413

                                                                                                      SHA512

                                                                                                      c39d0bcf518e7f42a3e1c0e4647e376d66255baf1babed97484394b627ef98a54f5d648ba59c80cfb63544ba5e00594e45f8348e35cd9b9ad62703963d25e973

                                                                                                      Download Submit

                                                                                                    • C:\ProgramData\MSWINSCK.OCX
                                                                                                      Filesize

                                                                                                      105KB

                                                                                                      MD5

                                                                                                      9484c04258830aa3c2f2a70eb041414c

                                                                                                      SHA1

                                                                                                      b242a4fb0e9dcf14cb51dc36027baff9a79cb823

                                                                                                      SHA256

                                                                                                      bf7e47c16d7e1c0e88534f4ef95e09d0fd821ed1a06b0d95a389b35364b63ff5

                                                                                                      SHA512

                                                                                                      9d0e9f0d88594746ba41ea4a61a53498619eda596e12d8ec37d01cfe8ceb08be13e3727c83d630a6d9e6d03066f62444bb94ea5a0d2ed9d21a270e612db532a0

                                                                                                      Download Submit

                                                                                                    • C:\ProgramData\d5f9fa1a8dca5319432f51a5891f7794_JaffaCakes118.exe
                                                                                                      Filesize

                                                                                                      7.1MB

                                                                                                      MD5

                                                                                                      d5f9fa1a8dca5319432f51a5891f7794

                                                                                                      SHA1

                                                                                                      2a937328f5b99eccb9b8c13ed71d6ffb9dff4521

                                                                                                      SHA256

                                                                                                      18f4123ee42f5a29f8df7bd1cf95ab73441f082584f390aa218c2dd1134f4055

                                                                                                      SHA512

                                                                                                      87013b63a9b153c5268784928394dfbf1eeff1b91eea6bdf187025e63d25c535e468e59a33f47d23682a386605bb314311e50a7edd1d6deb1b60f5008237a7d0

                                                                                                      Download Submit

                                                                                                    • C:\ProgramData\x64.exe
                                                                                                      Filesize

                                                                                                      423KB

                                                                                                      MD5

                                                                                                      1fc80528461d08dad2d9f234fa971add

                                                                                                      SHA1

                                                                                                      1c45209056da5f783cd707e7002597a31befb1c0

                                                                                                      SHA256

                                                                                                      17f606594427c58ff6cdf1270f83aa2595e9168b6cc1618665a1548650a40637

                                                                                                      SHA512

                                                                                                      0a71fd620ac01b031a240450a01af3ce592a228dbfcc74136a680946e36753e5107e8d45bc382baa3f5f30985321f1179fae504e59d13d8f469705b124b96156

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{65b90f5d-952e-42cd-8a99-8edbd94530d1}\0.1.filtertrie.intermediate.txt.zhen
                                                                                                      Filesize

                                                                                                      5B

                                                                                                      MD5

                                                                                                      83637d936296681019699ead2ec806ce

                                                                                                      SHA1

                                                                                                      707ee64aad84aa058425fba0b9f4b59f4e13a984

                                                                                                      SHA256

                                                                                                      8a154b0c8f6e38aab2b72937695ee2f455147151613a410392fbd7ac7fadbe21

                                                                                                      SHA512

                                                                                                      f5fb614342338305432e5042eb4c1ed9893f75fc1ac8162c17c447fa925f3222142319dc0900558c318b2e8017cadb7f1aa9dab640a8af4ea298f93b17de0f78

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{65b90f5d-952e-42cd-8a99-8edbd94530d1}\0.2.filtertrie.intermediate.txt.zhen
                                                                                                      Filesize

                                                                                                      5B

                                                                                                      MD5

                                                                                                      c996d2d766cc2f253a58a85aa23f8415

                                                                                                      SHA1

                                                                                                      49e4f244713a608b92dcd51109f5bb0a0777d7ba

                                                                                                      SHA256

                                                                                                      04e33a64c2cd597d03b1f7676fe8d50970826e24d0e7ceada803c6ed572b6789

                                                                                                      SHA512

                                                                                                      ce9a71078cb9c6a82f1632618dbedbec7a6f3608ae01ba8a81152e7485be305ad4e799ee15214e963ad9bb08e5fa250c626dda26dea0df647d232ae789788adc

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133670754071440191.txt.zhen
                                                                                                      Filesize

                                                                                                      77KB

                                                                                                      MD5

                                                                                                      98dae662db004c50186e6c1185590fec

                                                                                                      SHA1

                                                                                                      c301626587d09fa7d5bf8f5688417cc8a5160421

                                                                                                      SHA256

                                                                                                      983690cd05ef916b54118d3be7968015e586e13939186cf704dd40f254f8117f

                                                                                                      SHA512

                                                                                                      11577dc79448896e533f65abb27f39ddb3653ccb46237aace235e29ae2b6340df0384cd0416773f39a88d290f035f7f31e182c1d9d9d36735b6d238130f82f93

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133670754411894742.txt.zhen
                                                                                                      Filesize

                                                                                                      47KB

                                                                                                      MD5

                                                                                                      993451aa23ea4be42f14d12ee8369897

                                                                                                      SHA1

                                                                                                      56428787c3badafe0916f0a1c74c8b541eac3b8f

                                                                                                      SHA256

                                                                                                      53366097eb634af23917bf71f5168e4bff15b0b52c036a78d3941676e3af6ab7

                                                                                                      SHA512

                                                                                                      483bef452f1410fb9babc839024b16963532d9680172a452cffd5f81b77dba418665ff81273cf4f1b257360972f57ea7927ed0c68fdafdb8aec45ddc1cd2c29f

                                                                                                      Download Submit

                                                                                                    • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133670763096491428.txt.zhen
                                                                                                      Filesize

                                                                                                      65KB

                                                                                                      MD5

                                                                                                      def541c6ba45b92b4732419ff08e0fca

                                                                                                      SHA1

                                                                                                      8fce5d19857a2bd5b7f7cede085e8601c8dc06a3

                                                                                                      SHA256

                                                                                                      5922c33a153642e26b6477a970ffaac0092fbabae03b77b0113d9eefd9b6f088

                                                                                                      SHA512

                                                                                                      c640c5111acd8976fd9e9b930d17515e4906677734e92ff4ae8b16c1e8c677326fb25a92fc3f0bcb575902dd7d4c8cc57b74ac5b95443f589ed1b85a69fd028e

                                                                                                      Download Submit

                                                                                                    • memory/436-7301-0x00007FF719CE0000-0x00007FF719DE6000-memory.dmp

                                                                                                      Filesize

                                                                                                      1.0MB

                                                                                                      Download

                                                                                                    • memory/436-7308-0x00007FF719CE0000-0x00007FF719DE6000-memory.dmp

                                                                                                      Filesize

                                                                                                      1.0MB

                                                                                                      Download

                                                                                                    • memory/3788-4107-0x0000000000400000-0x000000000154B000-memory.dmp

                                                                                                      Filesize

                                                                                                      17.3MB

                                                                                                      Download

                                                                                                    • memory/3788-18-0x0000000000400000-0x000000000154B000-memory.dmp

                                                                                                      Filesize

                                                                                                      17.3MB

                                                                                                      Download

                                                                                                    • memory/3788-12-0x0000000000400000-0x000000000154B000-memory.dmp

                                                                                                      Filesize

                                                                                                      17.3MB

                                                                                                      Download

                                                                                                    • memory/3788-7309-0x0000000000400000-0x000000000154B000-memory.dmp

                                                                                                      Filesize

                                                                                                      17.3MB

                                                                                                      Download

                                                                                                    • memory/3788-7327-0x0000000000400000-0x000000000154B000-memory.dmp

                                                                                                      Filesize

                                                                                                      17.3MB

                                                                                                      Download

                                                                                                    • memory/3788-7329-0x0000000000400000-0x000000000154B000-memory.dmp

                                                                                                      Filesize

                                                                                                      17.3MB

                                                                                                      Download

                                                                                                    • memory/4816-13-0x0000000000400000-0x000000000154B000-memory.dmp

                                                                                                      Filesize

                                                                                                      17.3MB

                                                                                                      Download

                                                                                                    • memory/4816-1-0x0000000000400000-0x000000000154B000-memory.dmp

                                                                                                      Filesize

                                                                                                      17.3MB

                                                                                                      Download