Malware Analysis Report

2024-10-16 03:25

Sample ID 240929-d8m6ksydpm
Target PCCooker_x64.exe
SHA256 d850d741582546a3d0ea2ad5d25e0766781f315cd37e6c58f7262df571cd0c40
Tags
agenttesla marsstealer ragnarlocker xworm default bootkit credential_access defense_evasion discovery execution impact keylogger persistence ransomware rat spyware stealer trojan squirrelwaffle downloader lumma phorphiex evasion loader worm xmrig miner
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

d850d741582546a3d0ea2ad5d25e0766781f315cd37e6c58f7262df571cd0c40

Threat Level: Known bad

The file PCCooker_x64.exe was found to be: Known bad.

Malicious Activity Summary

agenttesla marsstealer ragnarlocker xworm default bootkit credential_access defense_evasion discovery execution impact keylogger persistence ransomware rat spyware stealer trojan squirrelwaffle downloader lumma phorphiex evasion loader worm xmrig miner

Lumma Stealer, LummaC

RagnarLocker

SquirrelWaffle is a simple downloader written in C++.

xmrig

Suspicious use of NtCreateUserProcessOtherParentProcess

Windows security bypass

Detect Xworm Payload

Phorphiex payload

Mars Stealer

Modifies security service

Phorphiex, Phorpiex

Xworm

AgentTesla

Squirrelwaffle payload

Renames multiple (1970) files with added filename extension

Renames multiple (7830) files with added filename extension

XMRig Miner payload

Renames multiple (6873) files with added filename extension

Deletes shadow copies

Renames multiple (6890) files with added filename extension

Command and Scripting Interpreter: PowerShell

Command and Scripting Interpreter: PowerShell

Downloads MZ/PE file

Stops running service(s)

Drops startup file

Reads user/profile data of web browsers

Loads dropped DLL

Checks computer location settings

Credentials from Password Stores: Windows Credential Manager

Executes dropped EXE

Windows security modification

Writes to the Master Boot Record (MBR)

Looks up external IP address via web service

Enumerates connected drives

Adds Run key to start application

Suspicious use of SetThreadContext

Drops file in System32 directory

Drops file in Windows directory

Launches sc.exe

Drops file in Program Files directory

Unsigned PE

Program crash

System Location Discovery: System Language Discovery

Enumerates physical storage devices

Browser Information Discovery

Interacts with shadow copies

Uses Volume Shadow Copy service COM API

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Uses Task Scheduler COM API

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Opens file in notepad (likely ransom note)

Suspicious use of SendNotifyMessage

Checks SCSI registry key(s)

Suspicious use of FindShellTrayWindow

Scheduled Task/Job: Scheduled Task

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Reported

2024-09-29 03:40

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-09-29 03:40

Reported

2024-09-29 03:41

Platform

win10-20240404-en

Max time kernel

30s

Max time network

32s

Command Line

"C:\Users\Admin\AppData\Local\Temp\PCCooker_x64.exe"

Signatures

AgentTesla

keylogger trojan stealer spyware agenttesla

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Mars Stealer

stealer marsstealer

RagnarLocker

ransomware ragnarlocker

Xworm

trojan rat xworm

Deletes shadow copies

ransomware defense_evasion impact execution

Renames multiple (6890) files with added filename extension

ransomware

Downloads MZ/PE file

Credentials from Password Stores: Windows Credential Manager

credential_access stealer

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\e235bf13.exe C:\Windows\syswow64\explorer.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a76e49df84ba2a7b33e8ea959995b5e6faecb90d551ef169d8272ce9042c35a5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CryptoWall.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\24.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\23.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\21.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\20.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\19.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\16.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\17.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\15.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\14.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\18.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\13.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\12.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\11.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Files\052b9d39fc2e8571f1b8319a832d3ab9ee066b19c037900d3e1ab29f5616621d.exe.exe N/A
N/A N/A C:\20145506\arwup.pif N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\winlogon.exe = "c:\\20145506\\arwup.pif c:\\20145506\\WUGGDQ~1.NSQ" C:\20145506\arwup.pif N/A
Set value (str) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Windows\CurrentVersion\Run\e235bf1 = "C:\\e235bf13\\e235bf13.exe" C:\Windows\syswow64\explorer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Windows\CurrentVersion\Run\e235bf13 = "C:\\Users\\Admin\\AppData\\Roaming\\e235bf13.exe" C:\Windows\syswow64\explorer.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\asena.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-addr.es N/A N/A
N/A ip-addr.es N/A N/A
N/A ip-api.com N/A N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PHYSICALDRIVE0 C:\Users\Admin\AppData\Local\Temp\asena.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 6992 set thread context of 5328 N/A C:\20145506\arwup.pif C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Microsoft Office\root\Office16\FPA_w1\WA104381125 C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Tournament\GameModeKlondike.png C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\OneNoteSectionGroupLargeTile.scale-125.png C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Assets\quickreplysend.png C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\Configuration\ssn_high_group_info.txt C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\DailyChallenges\Tile\RGNR_CC283BC6.txt C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\RGNR_CC283BC6.txt C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\ko-kr\RGNR_CC283BC6.txt C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\home-view\RGNR_CC283BC6.txt C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail2-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.NET.Native.Runtime.1.4_1.4.24201.0_x64__8wekyb3d8bbwe\AppxSignature.p7x C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\Images\RadialControl\TiltUp_E809_Normal_White_64x64.png C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL116.XML C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteAppList.targetsize-256_altform-unplated.png C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\Assets\AppPackageMedTile.scale-200.png C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\AppxMetadata\RGNR_CC283BC6.txt C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Themes\Jumbo\mask\cardback.png C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteAppList.scale-400.png C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsAppList.targetsize-36.png C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.WindowsStore_11701.1001.87.0_x64__8wekyb3d8bbwe\MS.Entertainment.Common\Resources\RGNR_CC283BC6.txt C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime_eula.txt C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\WorldClockSmallTile.contrast-black_scale-125.png C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-white\OutlookMailSmallTile.scale-200.png C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.contrast-white_scale-180.png C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\Assets\LoadIcon_contrast-white.png C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\Weather_TileSmallSquare.scale-100.png C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_1.0.45.0_x64__8wekyb3d8bbwe\AppxMetadata\CodeIntegrity.cat C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\zy______.pfm C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_MAK_AE-ul-phn.xrm-ms C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\ca-es\RGNR_CC283BC6.txt C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\themes\dark\RGNR_CC283BC6.txt C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\pt-br\ui-strings.js C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\zdingbat.txt C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dummy.aff C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\fi-fi\RGNR_CC283BC6.txt C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\7357_20x20x32.png C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-black\Dismiss.scale-64.png C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\themes\dark\new_icons.png C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\en-gb\ui-strings.js C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\pl-PL\RGNR_CC283BC6.txt C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\fr-fr\RGNR_CC283BC6.txt C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\s_radio_selected_18.svg C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_KMS_Client-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Grace-ppd.xrm-ms C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\8794_32x32x32.png C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\root\RGNR_CC283BC6.txt C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\include\jvmti.h C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Grace-ppd.xrm-ms C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioProMSDNR_Retail-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_gridview_selected-hover.svg C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\sv-se\RGNR_CC283BC6.txt C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial1-pl.xrm-ms C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\Assets\manifestAssets\Icon.targetsize-16.png C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Arkadium.Win10.Xaml.Toolkit\Assets\Buttons\RGNR_CC283BC6.txt C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Place\contrast-black\WideTile.scale-100.png C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL010.XML C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\nls\ja-jp\RGNR_CC283BC6.txt C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_OEM_Perp-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\en-gb\ui-strings.js C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\file_icons.png C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\sat_logo_2x.png C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\de-de\RGNR_CC283BC6.txt C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\fre\StartMenu_Win10.mp4 C:\Users\Admin\AppData\Local\Temp\asena.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\a76e49df84ba2a7b33e8ea959995b5e6faecb90d551ef169d8272ce9042c35a5.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\syswow64\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\syswow64\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\syswow64\vssadmin.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\Files\052b9d39fc2e8571f1b8319a832d3ab9ee066b19c037900d3e1ab29f5616621d.exe.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\20145506\arwup.pif N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\PCCooker_x64.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\CryptoWall.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe N/A

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\syswow64\vssadmin.exe N/A
N/A N/A C:\Windows\SYSTEM32\vssadmin.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\CryptoWall.exe N/A
N/A N/A C:\Windows\syswow64\explorer.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\25.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\22.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\21.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\24.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\23.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\15.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\19.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\17.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\16.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\14.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\13.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\18.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\11.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\12.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\20.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\10.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\9.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2764 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\PCCooker_x64.exe C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe
PID 2764 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\PCCooker_x64.exe C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe
PID 2764 wrote to memory of 2760 N/A C:\Users\Admin\AppData\Local\Temp\PCCooker_x64.exe C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe
PID 2764 wrote to memory of 1312 N/A C:\Users\Admin\AppData\Local\Temp\PCCooker_x64.exe C:\Users\Admin\AppData\Local\Temp\a76e49df84ba2a7b33e8ea959995b5e6faecb90d551ef169d8272ce9042c35a5.exe
PID 2764 wrote to memory of 1312 N/A C:\Users\Admin\AppData\Local\Temp\PCCooker_x64.exe C:\Users\Admin\AppData\Local\Temp\a76e49df84ba2a7b33e8ea959995b5e6faecb90d551ef169d8272ce9042c35a5.exe
PID 2764 wrote to memory of 1312 N/A C:\Users\Admin\AppData\Local\Temp\PCCooker_x64.exe C:\Users\Admin\AppData\Local\Temp\a76e49df84ba2a7b33e8ea959995b5e6faecb90d551ef169d8272ce9042c35a5.exe
PID 2764 wrote to memory of 4776 N/A C:\Users\Admin\AppData\Local\Temp\PCCooker_x64.exe C:\Users\Admin\AppData\Local\Temp\asena.exe
PID 2764 wrote to memory of 4776 N/A C:\Users\Admin\AppData\Local\Temp\PCCooker_x64.exe C:\Users\Admin\AppData\Local\Temp\asena.exe
PID 2764 wrote to memory of 4776 N/A C:\Users\Admin\AppData\Local\Temp\PCCooker_x64.exe C:\Users\Admin\AppData\Local\Temp\asena.exe
PID 2764 wrote to memory of 240 N/A C:\Users\Admin\AppData\Local\Temp\PCCooker_x64.exe C:\Users\Admin\AppData\Local\Temp\Bomb.exe
PID 2764 wrote to memory of 240 N/A C:\Users\Admin\AppData\Local\Temp\PCCooker_x64.exe C:\Users\Admin\AppData\Local\Temp\Bomb.exe
PID 2764 wrote to memory of 224 N/A C:\Users\Admin\AppData\Local\Temp\PCCooker_x64.exe C:\Users\Admin\AppData\Local\Temp\CryptoWall.exe
PID 2764 wrote to memory of 224 N/A C:\Users\Admin\AppData\Local\Temp\PCCooker_x64.exe C:\Users\Admin\AppData\Local\Temp\CryptoWall.exe
PID 2764 wrote to memory of 224 N/A C:\Users\Admin\AppData\Local\Temp\PCCooker_x64.exe C:\Users\Admin\AppData\Local\Temp\CryptoWall.exe
PID 4776 wrote to memory of 3596 N/A C:\Users\Admin\AppData\Local\Temp\asena.exe C:\Windows\System32\Wbem\wmic.exe
PID 4776 wrote to memory of 3596 N/A C:\Users\Admin\AppData\Local\Temp\asena.exe C:\Windows\System32\Wbem\wmic.exe
PID 4776 wrote to memory of 2112 N/A C:\Users\Admin\AppData\Local\Temp\asena.exe C:\Windows\SYSTEM32\vssadmin.exe
PID 4776 wrote to memory of 2112 N/A C:\Users\Admin\AppData\Local\Temp\asena.exe C:\Windows\SYSTEM32\vssadmin.exe
PID 224 wrote to memory of 1000 N/A C:\Users\Admin\AppData\Local\Temp\CryptoWall.exe C:\Windows\syswow64\explorer.exe
PID 224 wrote to memory of 1000 N/A C:\Users\Admin\AppData\Local\Temp\CryptoWall.exe C:\Windows\syswow64\explorer.exe
PID 224 wrote to memory of 1000 N/A C:\Users\Admin\AppData\Local\Temp\CryptoWall.exe C:\Windows\syswow64\explorer.exe
PID 1000 wrote to memory of 3304 N/A C:\Windows\syswow64\explorer.exe C:\Windows\syswow64\svchost.exe
PID 1000 wrote to memory of 3304 N/A C:\Windows\syswow64\explorer.exe C:\Windows\syswow64\svchost.exe
PID 1000 wrote to memory of 3304 N/A C:\Windows\syswow64\explorer.exe C:\Windows\syswow64\svchost.exe
PID 1000 wrote to memory of 2208 N/A C:\Windows\syswow64\explorer.exe C:\Windows\syswow64\vssadmin.exe
PID 1000 wrote to memory of 2208 N/A C:\Windows\syswow64\explorer.exe C:\Windows\syswow64\vssadmin.exe
PID 1000 wrote to memory of 2208 N/A C:\Windows\syswow64\explorer.exe C:\Windows\syswow64\vssadmin.exe
PID 240 wrote to memory of 4272 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\25.exe
PID 240 wrote to memory of 4272 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\25.exe
PID 240 wrote to memory of 1584 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\24.exe
PID 240 wrote to memory of 1584 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\24.exe
PID 240 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\23.exe
PID 240 wrote to memory of 652 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\23.exe
PID 240 wrote to memory of 760 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\22.exe
PID 240 wrote to memory of 760 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\22.exe
PID 240 wrote to memory of 64 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\21.exe
PID 240 wrote to memory of 64 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\21.exe
PID 240 wrote to memory of 4836 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\20.exe
PID 240 wrote to memory of 4836 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\20.exe
PID 240 wrote to memory of 1212 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\19.exe
PID 240 wrote to memory of 1212 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\19.exe
PID 240 wrote to memory of 4840 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\18.exe
PID 240 wrote to memory of 4840 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\18.exe
PID 240 wrote to memory of 4748 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\17.exe
PID 240 wrote to memory of 4748 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\17.exe
PID 240 wrote to memory of 4136 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\16.exe
PID 240 wrote to memory of 4136 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\16.exe
PID 240 wrote to memory of 4216 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\15.exe
PID 240 wrote to memory of 4216 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\15.exe
PID 240 wrote to memory of 3048 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\14.exe
PID 240 wrote to memory of 3048 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\14.exe
PID 240 wrote to memory of 3156 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\13.exe
PID 240 wrote to memory of 3156 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\13.exe
PID 240 wrote to memory of 2912 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\12.exe
PID 240 wrote to memory of 2912 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\12.exe
PID 240 wrote to memory of 304 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\11.exe
PID 240 wrote to memory of 304 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\11.exe
PID 240 wrote to memory of 1884 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\10.exe
PID 240 wrote to memory of 1884 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\10.exe
PID 240 wrote to memory of 3108 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\9.exe
PID 240 wrote to memory of 3108 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\9.exe
PID 240 wrote to memory of 4316 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\8.exe
PID 240 wrote to memory of 4316 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\8.exe
PID 240 wrote to memory of 3732 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\7.exe

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\PCCooker_x64.exe

"C:\Users\Admin\AppData\Local\Temp\PCCooker_x64.exe"

C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe

"C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"

C:\Users\Admin\AppData\Local\Temp\a76e49df84ba2a7b33e8ea959995b5e6faecb90d551ef169d8272ce9042c35a5.exe

"C:\Users\Admin\AppData\Local\Temp\a76e49df84ba2a7b33e8ea959995b5e6faecb90d551ef169d8272ce9042c35a5.exe"

C:\Users\Admin\AppData\Local\Temp\asena.exe

"C:\Users\Admin\AppData\Local\Temp\asena.exe"

C:\Users\Admin\AppData\Local\Temp\Bomb.exe

"C:\Users\Admin\AppData\Local\Temp\Bomb.exe"

C:\Users\Admin\AppData\Local\Temp\CryptoWall.exe

"C:\Users\Admin\AppData\Local\Temp\CryptoWall.exe"

C:\Windows\System32\Wbem\wmic.exe

wmic.exe shadowcopy delete

C:\Windows\SYSTEM32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\syswow64\explorer.exe

"C:\Windows\syswow64\explorer.exe"

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\syswow64\svchost.exe

-k netsvcs

C:\Windows\syswow64\vssadmin.exe

vssadmin.exe Delete Shadows /All /Quiet

C:\Users\Admin\AppData\Local\Temp\25.exe

"C:\Users\Admin\AppData\Local\Temp\25.exe"

C:\Users\Admin\AppData\Local\Temp\24.exe

"C:\Users\Admin\AppData\Local\Temp\24.exe"

C:\Users\Admin\AppData\Local\Temp\23.exe

"C:\Users\Admin\AppData\Local\Temp\23.exe"

C:\Users\Admin\AppData\Local\Temp\22.exe

"C:\Users\Admin\AppData\Local\Temp\22.exe"

C:\Users\Admin\AppData\Local\Temp\21.exe

"C:\Users\Admin\AppData\Local\Temp\21.exe"

C:\Users\Admin\AppData\Local\Temp\20.exe

"C:\Users\Admin\AppData\Local\Temp\20.exe"

C:\Users\Admin\AppData\Local\Temp\19.exe

"C:\Users\Admin\AppData\Local\Temp\19.exe"

C:\Users\Admin\AppData\Local\Temp\18.exe

"C:\Users\Admin\AppData\Local\Temp\18.exe"

C:\Users\Admin\AppData\Local\Temp\17.exe

"C:\Users\Admin\AppData\Local\Temp\17.exe"

C:\Users\Admin\AppData\Local\Temp\16.exe

"C:\Users\Admin\AppData\Local\Temp\16.exe"

C:\Users\Admin\AppData\Local\Temp\15.exe

"C:\Users\Admin\AppData\Local\Temp\15.exe"

C:\Users\Admin\AppData\Local\Temp\14.exe

"C:\Users\Admin\AppData\Local\Temp\14.exe"

C:\Users\Admin\AppData\Local\Temp\13.exe

"C:\Users\Admin\AppData\Local\Temp\13.exe"

C:\Users\Admin\AppData\Local\Temp\12.exe

"C:\Users\Admin\AppData\Local\Temp\12.exe"

C:\Users\Admin\AppData\Local\Temp\11.exe

"C:\Users\Admin\AppData\Local\Temp\11.exe"

C:\Users\Admin\AppData\Local\Temp\10.exe

"C:\Users\Admin\AppData\Local\Temp\10.exe"

C:\Users\Admin\AppData\Local\Temp\9.exe

"C:\Users\Admin\AppData\Local\Temp\9.exe"

C:\Users\Admin\AppData\Local\Temp\8.exe

"C:\Users\Admin\AppData\Local\Temp\8.exe"

C:\Users\Admin\AppData\Local\Temp\7.exe

"C:\Users\Admin\AppData\Local\Temp\7.exe"

C:\Users\Admin\AppData\Local\Temp\6.exe

"C:\Users\Admin\AppData\Local\Temp\6.exe"

C:\Users\Admin\AppData\Local\Temp\5.exe

"C:\Users\Admin\AppData\Local\Temp\5.exe"

C:\Users\Admin\AppData\Local\Temp\4.exe

"C:\Users\Admin\AppData\Local\Temp\4.exe"

C:\Users\Admin\AppData\Local\Temp\3.exe

"C:\Users\Admin\AppData\Local\Temp\3.exe"

C:\Users\Admin\AppData\Local\Temp\2.exe

"C:\Users\Admin\AppData\Local\Temp\2.exe"

C:\Users\Admin\AppData\Local\Temp\1.exe

"C:\Users\Admin\AppData\Local\Temp\1.exe"

C:\Users\Admin\AppData\Local\Temp\Files\052b9d39fc2e8571f1b8319a832d3ab9ee066b19c037900d3e1ab29f5616621d.exe.exe

"C:\Users\Admin\AppData\Local\Temp\Files\052b9d39fc2e8571f1b8319a832d3ab9ee066b19c037900d3e1ab29f5616621d.exe.exe"

C:\20145506\arwup.pif

"C:\20145506\arwup.pif" wuggdqksgh.nsq

C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe

"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 urlhaus.abuse.ch udp
US 151.101.66.49:443 urlhaus.abuse.ch tcp
US 8.8.8.8:53 49.66.101.151.in-addr.arpa udp
JP 140.83.50.60:8001 140.83.50.60 tcp
US 8.8.8.8:53 ip-addr.es udp
FR 188.165.164.184:80 ip-addr.es tcp
FR 188.165.164.184:443 ip-addr.es tcp
US 8.8.8.8:53 60.50.83.140.in-addr.arpa udp
US 8.8.8.8:53 184.164.165.188.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
FR 94.247.31.19:8080 tcp
US 8.8.8.8:53 32.169.19.2.in-addr.arpa udp
SG 47.245.97.19:80 47.245.97.19 tcp
US 8.8.8.8:53 19.97.245.47.in-addr.arpa udp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 208.95.112.1:80 ip-api.com tcp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 1.112.95.208.in-addr.arpa udp
US 208.95.112.1:80 ip-api.com tcp
US 208.95.112.1:80 ip-api.com tcp
US 208.95.112.1:80 ip-api.com tcp
US 208.95.112.1:80 ip-api.com tcp
US 208.95.112.1:80 ip-api.com tcp
US 208.95.112.1:80 ip-api.com tcp
US 208.95.112.1:80 ip-api.com tcp
US 208.95.112.1:80 ip-api.com tcp
US 208.95.112.1:80 ip-api.com tcp
US 208.95.112.1:80 ip-api.com tcp
US 208.95.112.1:80 ip-api.com tcp
US 208.95.112.1:80 ip-api.com tcp
US 208.95.112.1:80 ip-api.com tcp
US 208.95.112.1:80 ip-api.com tcp
US 208.95.112.1:80 ip-api.com tcp
US 208.95.112.1:80 ip-api.com tcp
US 208.95.112.1:80 ip-api.com tcp
US 208.95.112.1:80 ip-api.com tcp
US 208.95.112.1:80 ip-api.com tcp
US 208.95.112.1:80 ip-api.com tcp
US 208.95.112.1:80 ip-api.com tcp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 kenesrakishev.net udp
US 3.33.251.168:80 kenesrakishev.net tcp
US 8.8.8.8:53 168.251.33.3.in-addr.arpa udp
FR 91.121.12.127:4141 tcp
RU 185.215.113.19:80 185.215.113.19 tcp

Files

memory/2764-0-0x0000000073E61000-0x0000000073E62000-memory.dmp

memory/2764-1-0x0000000073E60000-0x0000000074410000-memory.dmp

memory/2764-2-0x0000000073E60000-0x0000000074410000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe

MD5 2a94f3960c58c6e70826495f76d00b85
SHA1 e2a1a5641295f5ebf01a37ac1c170ac0814bb71a
SHA256 2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce
SHA512 fbf55b55fcfb12eb8c029562956229208b9e8e2591859d6336c28a590c92a4d0f7033a77c46ef6ebe07ddfca353aba1e84b51907cd774beab148ee901c92d62f

C:\Users\Admin\AppData\Local\Temp\a76e49df84ba2a7b33e8ea959995b5e6faecb90d551ef169d8272ce9042c35a5.exe

MD5 6f8e78dd0f22b61244bb69827e0dbdc3
SHA1 1884d9fd265659b6bd66d980ca8b776b40365b87
SHA256 a76e49df84ba2a7b33e8ea959995b5e6faecb90d551ef169d8272ce9042c35a5
SHA512 5611a83616380f55e7b42bb0eef35d65bd43ca5f96bf77f343fc9700e7dfaa7dcf4f6ecbb2349ac9df6ab77edd1051b9b0f7a532859422302549f5b81004632d

C:\Users\Admin\AppData\Local\Temp\asena.exe

MD5 7529e3c83618f5e3a4cc6dbf3a8534a6
SHA1 0f944504eebfca5466b6113853b0d83e38cf885a
SHA256 ec35c76ad2c8192f09c02eca1f263b406163470ca8438d054db7adcf5bfc0597
SHA512 7eef97937cc1e3afd3fca0618328a5b6ecb72123a199739f6b1b972dd90e01e07492eb26352ee00421d026c63af48973c014bdd76d95ea841eb2fefd613631cc

memory/1312-15-0x0000000000400000-0x000000000043D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Bomb.exe

MD5 31f03a8fe7561da18d5a93fc3eb83b7d
SHA1 31b31af35e6eed00e98252e953e623324bd64dde
SHA256 2027197f05dac506b971b3bd2708996292e6ffad661affe9a0138f52368cc84d
SHA512 3ea7c13a0aa67c302943c6527856004f8d871fe146150096bc60855314f23eae6f507f8c941fd7e8c039980810929d4930fcf9c597857d195f8c93e3cc94c41d

memory/240-30-0x0000000000C60000-0x0000000000CD8000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\CryptoWall.exe

MD5 919034c8efb9678f96b47a20fa6199f2
SHA1 747070c74d0400cffeb28fbea17b64297f14cfbd
SHA256 e036d68b8f8b7afc6c8b6252876e1e290f11a26d4ad18ac6f310662845b2c734
SHA512 745a81c50bbfd62234edb9788c83a22e0588c5d25c00881901923a02d7096c71ef5f0cd5b73f92ad974e5174de064b0c5ea8044509039aab14b2aed83735a7c4

memory/1000-32-0x0000000000660000-0x0000000000685000-memory.dmp

memory/2760-34-0x0000000000B20000-0x0000000000B28000-memory.dmp

memory/2760-37-0x00000000053D0000-0x000000000546C000-memory.dmp

C:\Users\Public\Documents\RGNR_CC283BC6.txt

MD5 0880547340d1b849a7d4faaf04b6f905
SHA1 37fa5848977fd39df901be01c75b8f8320b46322
SHA256 84449f1e874b763619271a57bfb43bd06e9c728c6c6f51317c56e9e94e619b25
SHA512 9048a3d5ab7472c1daa1efe4a35d559fc069051a5eb4b8439c2ef25318b4de6a6c648a7db595e7ae76f215614333e3f06184eb18b2904aace0c723f8b9c35a91

memory/3304-649-0x0000000002F30000-0x0000000002F55000-memory.dmp

memory/1000-727-0x0000000000660000-0x0000000000685000-memory.dmp

C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif

MD5 e1a74085e6068ce4f3cfa0de86688011
SHA1 e6bb400f8d2bbd1684885f68488f2d6c91ec6f1c
SHA256 cca620844e01c64a54b5d6a6c05011fb7e5049c4f64a008ce1d90eb3e565d555
SHA512 d8ce7b59041acfe370760d3f005a7f84a1cedf7841fa3493bf6b0b451b1064b8d05658142906cbdf26b5783e9021ab04d584c10e7be7f3e80b7374c18cef9a97

C:\Users\Admin\AppData\Local\Temp\23.exe

MD5 7e87c49d0b787d073bf9d687b5ec5c6f
SHA1 6606359f4d88213f36c35b3ec9a05df2e2e82b4e
SHA256 d811283c4e4c76cb1ce3f23528e542cff4747af033318f42b9f2deb23180c4af
SHA512 926d676186ec0b58b852ee0b41f171729b908a5be9ce5a791199d6d41f01569bcdc1fddd067f41bddf5cdde72b8291c4b4f65983ba318088a4d2d5d5f5cd53af

C:\Users\Admin\AppData\Local\Temp\22.exe

MD5 296bcd1669b77f8e70f9e13299de957e
SHA1 8458af00c5e9341ad8c7f2d0e914e8b924981e7e
SHA256 6f05cae614ca0e4751b2aaceea95716fd37a6bf3fae81ff1c565313b30b1aba2
SHA512 4e58a0f063407aed64c1cb59e4f46c20ff5b9391a02ceff9561456fef1252c1cdd0055417a57d6e946ec7b5821963c1e96eaf1dd750a95ca9136764443df93d7

memory/760-1261-0x0000000000330000-0x0000000000340000-memory.dmp

memory/652-1295-0x0000000000D50000-0x0000000000D60000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\16.exe

MD5 0ab873a131ea28633cb7656fb2d5f964
SHA1 e0494f57aa8193b98e514f2bc5e9dc80b9b5eff0
SHA256 a83e219dd110898dfe516f44fb51106b0ae0aca9cc19181a950cd2688bbeeed2
SHA512 4859758f04fe662d58dc32c9d290b1fa95f66e58aef7e27bc4b6609cc9b511aa688f6922dbf9d609bf9854b619e1645b974e366c75431c3737c3feed60426994

memory/1584-1293-0x0000000000390000-0x00000000003A0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\20.exe

MD5 f18f47c259d94dcf15f3f53fc1e4473a
SHA1 e4602677b694a5dd36c69b2f434bedb2a9e3206c
SHA256 34546f0ecf4cd9805c0b023142f309cbb95cfcc080ed27ff43fb6483165218c1
SHA512 181a5aa4eed47f21268e73d0f9d544e1ceb9717d3abf79b6086584ba7bdb7387052d7958c25ebe687bfdcd0b6cca9d8cf12630234676394f997b80c745edaa38

memory/64-1253-0x0000000000690000-0x00000000006A0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\19.exe

MD5 4c1e3672aafbfd61dc7a8129dc8b36b5
SHA1 15af5797e541c7e609ddf3aba1aaf33717e61464
SHA256 6dac4351c20e77b7a2095ece90416792b7e89578f509b15768c9775cf4fd9e81
SHA512 eab1eabca0c270c78b8f80989df8b9503bdff4b6368a74ad247c67f9c2f74fa0376761e40f86d28c99b1175db64c4c0d609bedfd0d60204d71cd411c71de7c20

C:\Users\Admin\AppData\Local\Temp\21.exe

MD5 a8e9ea9debdbdf5d9cf6a0a0964c727b
SHA1 aee004b0b6534e84383e847e4dd44a4ee6843751
SHA256 b388a205f12a6301a358449471381761555edf1bf208c91ab02461822190cbcf
SHA512 7037ffe416710c69a01ffd93772044cfb354fbf5b8fd7c5f24a3eabb4d9ddb91f4a9c386af4c2be74c7ffdbb0c93a32ff3752b6ab413261833b0ece7b7b1cb55

memory/4272-1241-0x0000000000910000-0x0000000000920000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\24.exe

MD5 042dfd075ab75654c3cf54fb2d422641
SHA1 d7f6ac6dc57e0ec7193beb74639fe92d8cd1ecb9
SHA256 b91fb228051f1720427709ff849048bfd01388d98335e4766cd1c4808edc5136
SHA512 fada24d6b3992f39119fe8e51b8da1f6a6ca42148a0c21e61255643e976fde52076093403ccbc4c7cd2f62ccb3cdedd9860f2ac253bb5082fb9fe8f31d88200d

C:\Users\Admin\AppData\Local\Temp\25.exe

MD5 476d959b461d1098259293cfa99406df
SHA1 ad5091a232b53057968f059d18b7cfe22ce24aab
SHA256 47f2a0b4b54b053563ba60d206f1e5bd839ab60737f535c9b5c01d64af119f90
SHA512 9c5284895072d032114429482ccc9b62b073447de35de2d391f6acad53e3d133810b940efb1ed17d8bd54d24fce0af6446be850c86766406e996019fcc3a4e6e

C:\Users\Admin\AppData\Local\Temp\18.exe

MD5 d32bf2f67849ffb91b4c03f1fa06d205
SHA1 31af5fdb852089cde1a95a156bb981d359b5cd58
SHA256 1123f4aea34d40911ad174f7dda51717511d4fa2ce00d2ca7f7f8e3051c1a968
SHA512 1e08549dfcbcfbe2b9c98cd2b18e4ee35682e6323d6334dc2a075abb73083c30229ccd720d240bcda197709f0b90a0109fa60af9f14765da5f457a8c5fce670a

C:\Users\Admin\AppData\Local\Temp\9.exe

MD5 28c50ddf0d8457605d55a27d81938636
SHA1 59c4081e8408a25726c5b2e659ff9d2333dcc693
SHA256 ebda356629ac21d9a8e704edc86c815770423ae9181ebbf8ca621c8ae341cbd5
SHA512 4153a095aa626b5531c21e33e2c4c14556892035a4a524a9b96354443e2909dcb41683646e6c1f70f1981ceb5e77f17f6e312436c687912784fcb960f9b050fe

C:\Users\Admin\AppData\Local\Temp\2.exe

MD5 012a1710767af3ee07f61bfdcd47ca08
SHA1 7895a89ccae55a20322c04a0121a9ae612de24f4
SHA256 12d159181d496492a057629a49fb90f3d8be194a34872d8d039d53fb44ea4c3c
SHA512 e023cac97cba4426609aeaa37191b426ff1d5856638146feab837e59e3343434a2bb8890b538fdf9391e492cbefcf4afde8e29620710d6bd06b8c1ad226b5ec4

C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md

MD5 2c8def4b030d4a1fab84c0e11e4e1771
SHA1 5af7d0b6df64552805d1a4d257ec646363b36153
SHA256 355bb4493d8fc786ec1d2a069a8a50bb010f511e6d0a40d24a29f2f2c52b85bb
SHA512 431f7dcbe136eb3c6f07cad855fc4c8778bcb3729a88f218dd1a8a547e9a17ca139e5b937e7dd41599563cd920d6c19345b037b52b469878079b1b3030a696cc

memory/4564-1569-0x0000000000570000-0x0000000000580000-memory.dmp

C:\Program Files\Java\jre-1.8\lib\deploy\messages_zh_HK.properties

MD5 2ddd3df3e342f1fec8963fe598c5c86c
SHA1 2ec2bc78b9875e99590c59026b465319837a6ebf
SHA256 50635251b069ff52707582185d960d720714a22a52ffb9b7f6e43a943ae87418
SHA512 c8716efc2369a9689dce4e4e2af00e4ca262d699613813bac717b5e25c409b1c2142370aa48e929b5aebe5f911100ba439b120455a80fd46e68fe869c9d155c1

memory/3776-1568-0x00000000000F0000-0x0000000000100000-memory.dmp

memory/4768-1567-0x0000000000AB0000-0x0000000000AC0000-memory.dmp

memory/5088-1566-0x0000000000A40000-0x0000000000A50000-memory.dmp

memory/1808-1565-0x0000000000EF0000-0x0000000000F00000-memory.dmp

memory/4044-1564-0x0000000000720000-0x0000000000730000-memory.dmp

memory/3732-1563-0x00000000005F0000-0x0000000000600000-memory.dmp

memory/4316-1562-0x0000000000AF0000-0x0000000000B00000-memory.dmp

memory/3108-1561-0x0000000000620000-0x0000000000630000-memory.dmp

C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md

MD5 6225173d9c9e44d6dacbaf5548fe43cd
SHA1 0e396563363f34e5cb53ea4e7cd56833257e9c2a
SHA256 79b523d66e4190d437b8447aa627894efbe04e908a5c82db41033e8420eb86ee
SHA512 6c37453840e849c07116eef5f4e7c55dc47c399d197c80ee5500dc2e4297fc455419f97e3bf0177cd29508ea887dd97ec41cdc904582093e19dc750de1a165ec

memory/1884-1558-0x0000000000110000-0x0000000000120000-memory.dmp

C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md

MD5 c07a549f041e58757333a28bc79bf99f
SHA1 fcaa151644bddea2259c1f074c495089aef9bad4
SHA256 a441837dfbf4fb8486830fa25014f85811a6984ca4a304792668b42758120084
SHA512 3eacc1b12999795158d56f57bb96d20fa34e793746043e8324e3be8dbdfb10bc4b175fc90f934139d8c4d41c14e87423c17bc7f872190d2ba6a5deeab98c3713

C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md

MD5 6ed19d5570db492a751079ceb334e253
SHA1 b17345be3a00180b3e4363b9d923bc1b93f36fd6
SHA256 2af22e1322e51488ff88e797942085cb2aa80dfdfe407326c27c9b96b6d5f742
SHA512 f81b8f83b8bbd544744e4a23ed50a0dfbcac52f54c480bcb167610e608b310fd562d454960323a5360af539c67a99b1b3721ced72ee11af15ffb801f0d3cf88d

C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md

MD5 20e26fceb01f37615bc81fc1cb21f9b9
SHA1 a62b61d09f0deeea64e9835da04e1254dc364416
SHA256 c6a9c2812f2b3bfa501d372a495d0def008e0ad0fe8a4933b3fa9a80ea9ea31f
SHA512 651951bb1ba6afd7ba32275f85a4c9f9ba90a5b5b7921cd8489290d0a1a5694bb0ff39723596d066317e8517cd882f13c98cac197d818980c31d9d680bb895a2

memory/4836-1551-0x0000000000220000-0x0000000000230000-memory.dmp

C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md

MD5 d327a4f2dc3a68c0f4a7d919d6577b9b
SHA1 c355063babbef4418bb88fcd1c293b3c739f71c4
SHA256 12046306514ad08104dac35793ba944981f80e6c905c4aff92c7ecead32355cb
SHA512 bff5bce1d8be4dba0b072d6e32ff88124ba0fb7c7dfd79df7bec60931f43526b98397b09bd013f9a30e210b4da179ad946e30f34af433719ae1ce1567859f0c8

C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md

MD5 7a11d6e6a0c8ac9afcf062ada8808afe
SHA1 b9149f82e5a07c5e0b4ed4df9437507149590d69
SHA256 e5fc101382a176e7908b6a88e0834d4b9da4599ac6d91d52537fb8729cb2ddf3
SHA512 79daf8493b1cc90f03ebeaf8756c0f814790b58220c8a5a57446e98c562a102110b9a3ff93da7adb052900e1a5853a3bf53234a433e2feacdb15a61052b1e811

C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md

MD5 1f78e08da1605d906dec4ff98e714bdb
SHA1 8680b5b094275577a60f23faffee6b7ed24ef9d6
SHA256 7528ba2e1b70c2b36cfad3f24b3b455905b2a1205079bb949ea3e04be36c3cc3
SHA512 67bf639856296e7c9e1db33b5c9e676f0799624fa29f1573229cbdbd6a0fa8dd1a17626756865f4c0491eb500b2f519f8f01e70630c0a7293afbc53a698c1854

C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md

MD5 cacb4eaa1c68fb52d13381fa8a21a770
SHA1 abc8a4d5dd7541c41db6cea2950bf145e12d1f15
SHA256 6b3496f827323b0340d3b903b15eb75cad568adb0e7349b4d2bd65d82abd4095
SHA512 76b958673e0a03262f3d5f9addb2b5b6e2f754d27d27a5c484e1c6cfb7cfae5dae03ec56603255e5ad20347058fa791ea5e5a6ba093a348fd3a49ba139e873dd

C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md

MD5 1b8f162e7b7a53969a2c3c7a251d23af
SHA1 42667029a2abd4f364fc59b21897e6a348b429d4
SHA256 73d9ba25050ded7caf1514fd5787eb7a191bee984a56e1e8d91568a0783dd233
SHA512 1811aa74bc4d7c59f52b49c58034b8489ccaaa2d7753a522e29f32fba319d400cc1ce0ec5007b02077878e9521e9f2c9756ae813783db9c4d9eeb89548f6d743

C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md

MD5 b463b8497fc1f0588c07466a17eec6ae
SHA1 5acdf141de19bcf578ef05898d11f32f28aa6a1e
SHA256 b305f328c9f198e6fd11e5376c87f00168667614a301e0a052125c5c42cb9b7d
SHA512 7c1ac2a3b73758350c61112417e0e21051e51fa9f8951ed78779aca19d5e8913c6048ac2f5999f9353787b1290bb7c5f79ef91be27cef796e909eb1973c509d7

C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md

MD5 a91fd56f9471557180cd51d4709cec9f
SHA1 b557b59890106121911754317f2b78821cd1456a
SHA256 c04961b95b1fcdfc4ca268d2695ce20c9447c39a6751e78cc56e34a7f556fd21
SHA512 e7ff4e49140179c22a28e5c70311459d588a76ee365a7b45f1c46c8bc8fc9822c157cc025904071febb1373b8c5ce07f2f4bdf291cf73a50c85e7f7baed029ce

C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md

MD5 65fccab7866f0fbc9bc9e22941f05946
SHA1 e33d6ce1549d62598d11821928fbbefecab540f4
SHA256 37c43170914bccbbf43c8b05ad64e2539a6fb64ced1ab635443d215856202e1e
SHA512 a96250e1056427d8617f7ae13ba5d4166e934d1a4ade27f14e41d24d3ddd9d9d05fcf7734413edf2dbeea321851173974ff23e8fd5e0c9587508c00674b3bcd8

C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md

MD5 6b328c0ac0d17a201ab051bc395015b6
SHA1 2c1de5068779295c1c8cf62e2951aead637ba76e
SHA256 93d9cf37fb92dd6ecd29ada6f56de09c73fa751fb6412acd9dc0d569cd831373
SHA512 c45d0bd2fe8f92fad102e6dab0733aebbe2f3359343d09ee5db4e36b2de14a3d04ca054bf254ce61a7429d7d7805c89c78c595a9c64149766f2cef3ba6e7810c

C:\Program Files\Java\jre-1.8\legal\jdk\libpng.md

MD5 39873a6e56609cf6e6ae7371cfc0ff36
SHA1 3cf3cd2571c17d92670c91e7bacdeaef0aa5e567
SHA256 c7cbebabeed6b8681cf3abbd0bd2a8079d9d9bd3b78fc0a392f54bcc46251d25
SHA512 12d8563ce4a410b5c04774c3a3d26a69c29df895c6174bf0e629559a65f3a933dcfb66c9d21e524f3f38bae6604fb60e4805a57a6f9860e3e4b0c3a4b2f721ce

memory/304-1529-0x0000000000E30000-0x0000000000E40000-memory.dmp

memory/2912-1528-0x00000000003C0000-0x00000000003D0000-memory.dmp

C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md

MD5 e44d7a7f223c9e1954e9f7ca0cc39e3c
SHA1 db33f641f2ef7f670ed4e94fda4ed3cf000391bf
SHA256 0b0a6e8ba79ba28627f007fd37a49a18d31eed3bda690a66077043e764a7fb0c
SHA512 fd684cdc001489323f1abfc9a38ddaa510ff2ab71767ad9696a35a7327bf84e9e17f78e448290b896bb695c4a3c32cf9a1fe50dffc0a4da9f66fdf11cf7a0ef4

C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md

MD5 d501b74553e6b7f30861a0fc65d6e5a4
SHA1 2a08f539709e13335c1f57b2a1f4d8d0b328db66
SHA256 7e477a8f2bd3df090a31007e30a4fcb5791c70c8354a98b955e5c37d2e09e9fb
SHA512 6fa9f3c3b362ce1d57dc32129e2f8651b0f0fd35289d05f80a87d9e2a598f9c7b66247cd77eeffa3e1503fea2d1b3c01f96a61dd3637eec0a68c6f7feddabf0b

C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md

MD5 381923eabb6c4480aa2603d5d2a753c3
SHA1 490a6e401eb22568575a974e1535d69a406e38cc
SHA256 41d9ee7305c297acef81c4370b52bb2f44e836dc225b45c84569b6330f6df85a
SHA512 257cacaed0cb7c95b6a1c12bdc2231b01efa656a61e796bc264812be1d75a529b67f289c380e21006d9768322500cb5c7683be18481bf2f52a2affcc3979e131

C:\Program Files\Java\jre-1.8\legal\jdk\joni.md

MD5 ce92a312ad63add4d7b6e9cf3d05f7ac
SHA1 96d3e418bd53b6462ef362948c5456850ef61ae4
SHA256 791298eedce3463b5059dbcc6d502f4a2d952c801bca369647a84288c76be913
SHA512 36770a4700f600146f35e3bc7c16263d3b59e8a3a026a082bed3f6dcba8fcb392fb26ec003113f7eca4bb0677f92bf008d31f3ecba9ca40708af993246fff773

C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md

MD5 5fec4c6d1f511b3613af4392cf321639
SHA1 9c8cda64b487a58af5f502845afef786e3c7437f
SHA256 32c01430cb9a15521d4dbf58a77ed98728e55b28f5d35218fc35718ea00b809a
SHA512 06dc695707e19b0297de911b55906a3c06a12460f091b35f14c2e52e0168edda4ca6785ba76d62cef2ad52da221910a0a87422d18b6fb27c87a7cb0ca0372030

C:\Program Files\Java\jre-1.8\legal\jdk\icu.md

MD5 2252f4ce24d5dd154278ae4cd30421df
SHA1 7b34480389674c4fb41f4050bab633d890c212e0
SHA256 59bbf81f36f0ac395634f5f5da57d2805a825e8225a4542370b1ea489aa3d89e
SHA512 b24b8c84c00025d582539de418623960058cb9d2177eaa932e9737aaf0702cdb4cb540da767869c72ec92dfb41beffe86ce34d35b86b42ebfccd97dda386759c

C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md

MD5 efb384af69472d17e75d5d856ee7950d
SHA1 a580b137568945b2a4c6ffd2dbcdf964d92f557a
SHA256 7cd04d69e003bd46e10f6588e7b177944cedef5dce722b156f8e008301d6768c
SHA512 7bccbca7db0cfb31438116291aebf9e4e2df3f5e0ddc3ef639890893cb53c7a1ba77b89efc660ada45777df766daa97b0c9d4a77f8248e594743e613f4f25082

memory/3156-1514-0x0000000000A00000-0x0000000000A10000-memory.dmp

memory/4840-1513-0x0000000000FC0000-0x0000000000FD0000-memory.dmp

C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md

MD5 0c9033738614349cfcb2eec5c292e6fc
SHA1 873f047fb0c0fffa113c0b3700888557649ff181
SHA256 cdf2bfe735acda87780912136da684ea1e5ce3f396454c84ca6c1e9752b5e840
SHA512 7aa51ea66cdfb4cd661763b558a68ffe86e82a625e77141c0c0587bf5cdb8146ac03c6c97728d6a5a4f23e318120ffe153da7792f953d486b23a17bc22b69b73

C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md

MD5 e1fb699c28f8acd2d8c782db0055b0a2
SHA1 2452545daf4df2776c257f9e29084a6c369d1fe1
SHA256 dbded0f1aa82b0136391f78c371067197c1a19e8661c9ecaab771537213a9df7
SHA512 c91f339e075e7f0f7f68d41d0711d230a8de66bd759604f14f6cb0e7c3bb23816c73a484314f250acd8b1e475b8264d76fadb0ad8f3e1606ed3fd5cf7a59d687

C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md

MD5 f4d0f0c0579db54396160c40c80f9912
SHA1 dba9347ca8221aa575b19113278952f87b16a95a
SHA256 92267e3835b2ebebc23c6796d6913800d41a32034b0184007b4c3658f39a22c2
SHA512 813dc6d88f70fca00be6773aa276ac8b995960f9b8eb4f2ca39b258d1a30fb671edbbc86e5f44c60e361ca50701a51a2998167cdec17db49390f2225b15d54c4

C:\Program Files\Java\jre-1.8\legal\jdk\dom.md

MD5 f2db33dfb2086b64efdd7ad8b36bf5a1
SHA1 d684d01ddebcec7adc8d5b3d88914c8a78c04722
SHA256 165d35c6c1973ec807a50674089e2412aa3e4b14aca43b7792fb31aefd7fd6ed
SHA512 932e6db020ee10ca2ffb790e09838f45f66da77297d19d780bbee266bf3e29b3bd50f7b577b5bc06f95d78711d3e4f04479fb80e58e7899b8f4ab67e8ae0f8b4

C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md

MD5 10baa5587f24d129b01291c22d483352
SHA1 2b5b381022ce4d7816304f747972d51f9b6fee56
SHA256 55b379c3ffa5e6c3f06baefef45070c39fdda061bc430c51ad5db5ebb1b69357
SHA512 04adadf108061e7773c82c47814a1bdbd23e011bc2657ec925c9c30a1c80e09c900494b06c29756d78c5a64a276622259a0d42dc2f3bde6d7806ff41d206130e

C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md

MD5 835a94bcb4bd9b5c8a2316293da2577e
SHA1 05a4c04427de6178b86bff68ed83f36daa3dcde4
SHA256 56e26bff8f278a09ca8cea6f9461ac87016a589d5c71c500312d75f9cf672133
SHA512 40c85ca2f74aa11ec7a45e57e47915819aab94fa0e5caa91146bd55287e3ebc33f870aed72ace50754ae5fc990dfe0a94c0692a1cca3e3a078b09ea366d8d0f7

C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md

MD5 05f229b78f104cc61c6694cfc5e282f8
SHA1 f94ca98f6be2f9a3155562bb04d36aa6f3d7cd49
SHA256 cebf1bef4dbf696d676112a8c2cf0b0c498a017d4dda818001c9a49a66d11ef3
SHA512 dc0af18899cb454abb430bede08621a961abb5c602740dc0c36d3df5685164c1a92ecb97e48f6099ad94715ded6ef3af7fd0717d713b4dfd86446b4c47cf2bbb

C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md

MD5 727823d4bc3681bf31823498cf8d7737
SHA1 507fa65853977ce02477299444c56a00a0a60883
SHA256 7a6ca8c10bcad3e55212118bfa4cbc22a142841718a0da44cb415de34072ca50
SHA512 417e0872e20e448baac4311fba256f6af7be9a696bfb9859cabd9f9752c2497691c494eaf3e8408d526658f9146f711b9ea24e397e2a9212120843a13ef5d10c

memory/4136-1496-0x0000000000720000-0x0000000000730000-memory.dmp

memory/3048-1495-0x0000000000F70000-0x0000000000F80000-memory.dmp

C:\Program Files\Java\jre-1.8\legal\jdk\asm.md

MD5 60ab0be8b208b684ae66e4b93c53707f
SHA1 53c508cdfc0238e64f5ddcba53af413635a6ee85
SHA256 7cd109ff4802d3cd4744dc7ac0812a64d24ccadf590bc1193dea46486763da17
SHA512 e92942d65beb5af92f2e2f2c2ac8909e018e9bdf0f5f3ae84661973dacb688c2024f8537b70b51a97f44067af0e8a5869f9457aa6c7c5f5021ea4ad19586336d

memory/1212-1492-0x0000000000EE0000-0x0000000000EF0000-memory.dmp

memory/4748-1491-0x0000000000FE0000-0x0000000000FF0000-memory.dmp

C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md

MD5 b7985cb6d4acbc289024ed71a9620547
SHA1 483487573b355798cb8313a9d8f7fe4c548d8d12
SHA256 866942347dd4f4fccbeca5f928408ca94c189f2e424c14a98b4d45f41bedc0dd
SHA512 d47fce7d7210d9a00947fc202ecf61b881906c2d1b75bdf56b8dad7652033b33d6e92472efe365c2ebded36b6b7985b9141da62caaa1d22c37150b7f97cc6e14

memory/4216-1485-0x0000000000520000-0x0000000000530000-memory.dmp

C:\Program Files\Java\jre-1.8\legal\javafx\public_suffix.md

MD5 67257a21600fa87bd0f7683a1d2f3444
SHA1 6cbc886fb6d7bad642fed2a4479d36d854317bd1
SHA256 7f23e676f5cf1a2f98aaba30835ee430be1c5efaf71f880a162c8acf5458fdda
SHA512 05052bbe18ad816e944be6ecef629b7fe3215327a94bdfec141f348831071c99227f2c1cebe7d57925f31e209817d1b666d56f0461a36c15489dacfb3fb3055d

C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md

MD5 fad73fcd890393fae26a08df21ae4a99
SHA1 80165a64e14196d643836fcbe62c4929dbb7d050
SHA256 289e93a4ac1db592d52013347b8c3ae5d293d27c1a624369b2a5f55fc1f0ffc9
SHA512 b6e8cc1af69f0b12e85d9a650aa9997a4ef9bc3eab10408ddd58b14822b66d72cfe31a3662153255302e5d046541e1de3bb94ce99522bd72b11866659624a8d1

C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md

MD5 0866e90e53f5b19ea249d88214661777
SHA1 0bc38f94d7698325db4efaf1548afa7e1982e9c3
SHA256 298d195fd6198fc0d068f0351e27cf5e3d6cfe63f623b0a9d1c38353fc4f2560
SHA512 83f16e912453d5ec435fd8282131c8f6d40719b4c3f81220bd962fb3c403a4b0bea344892bae468f4fea4b790b3124a7e4e7abdf81af3757bae32faffc251df7

C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md

MD5 2f2a19c41de52ab8b799d2f6ec7a096f
SHA1 d41720bfac1da670e319b5e002a6328ab5d5ec2e
SHA256 0785aead686e84c84aa1dd0d96d832f3b408de9145573f2530bc48ff92de6bdb
SHA512 7cdc891e8bf705da1b899e0df76621627566b4bc25b29a76018bea64b5cc02c7bd71907b86bab3e90fad3b565dc06b3649e31fd01e722e0a2e0c3f8cfef81ff4

C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md

MD5 b2816d55c9ad303e4da0dde1fc8a5f98
SHA1 c8b01efc54f00ac69d7a0756b7207afdd9d2d1b0
SHA256 6ae93bb1a01d19bc0f83472c2121e168e1d9ac81800a726de2f857435147f855
SHA512 d22cbedfaa50c75223402b967b674c03e48e1843f8567f30718e4da30b96b00022221ed07ec85913c68c12f7d88e862eb0eb99737474869672c9e3d62cd7b1cf

C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md

MD5 9875e57f7a79bae6aaaa4c4010fcc8e1
SHA1 44ad9fe098e9b7d486b3e4499866a434fefe476b
SHA256 6c38f6d41ee21cd7d6a710cec757eaf69e4213c405a6341e10a706cb49fa327e
SHA512 361d9c63ea0c4d0852042a1cabb6e8f60f249e8ea724644e6180dc7de82b007dc0403d311c3391fdc72322e3a259dbc2349592ab2b081868f5e95e6098dbc9c4

C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md

MD5 e7bcdee43f38cb282e756ba06e58b658
SHA1 1f80912b0210c672ec24cb0a478e7b2bfd911d28
SHA256 6821b08ae5ef04499f625aa20c194265932fad1f9a02db2c0526c20bfc9b0402
SHA512 c866dc6b8a8087c9c15ef4f84a2c99758f22dc51847a288b092c750d26fa0f6a705627a1c5e7d34c258681eeac45e5cd9cf1aaa8bcea932241edd4fb5821dec5

C:\Program Files\Java\jre-1.8\legal\javafx\glib.md

MD5 f31261196815fb3abe4890df44deda2a
SHA1 99113bfb9c3d070a67af58ecc93ac1cef0650bf0
SHA256 0b2dd28d491183a5866652dbc89b52a0139d130af12314c8aca1a0f39186f496
SHA512 3002e78f17aad2b00eea7f92749104244b74c3d0223f198f07702903cbb4c970a993c2118915a6569e57ea3276208e74bcd7026a6666518094c78ca636b914af

C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md

MD5 4894eb3378ee3a88c06ccb518ebf5db6
SHA1 48581241d5c34647f094607f954c7e303dcf2bbb
SHA256 db51fe37751d588959d1c241954b2b1597350be2b4b42e1bc4fa5a8b7f1d781b
SHA512 a586c40149f48b8a8d50615a751431994eca6d024b12ae89f65c40f9abd3e8f1be3cf7565d494d64010f66865f0e12cd4faa0daf7648a62db3206bfafdf2e58b

C:\Users\Admin\AppData\Local\Temp\1.exe

MD5 8ec649431556fe44554f17d09ad20dd6
SHA1 b058fbcd4166a90dc0d0333010cca666883dbfb1
SHA256 d1faee8dabc281e66514f9ceb757ba39a6747c83a1cf137f4b284a9b324f3dc4
SHA512 78f0d0f87b4e217f12a0d66c4dfa7ad7cf4991d46fdddfaeae47474a10ce15506d79a2145a3432a149386083c067432f42f441c88922731d30cd7ebfe8748460

C:\Users\Admin\AppData\Local\Temp\3.exe

MD5 a83dde1e2ace236b202a306d9270c156
SHA1 a57fb5ce8d2fe6bf7bbb134c3fb7541920f6624f
SHA256 20ab2e99b18b5c2aedc92d5fd2df3857ee6a1f643df04203ac6a6ded7073d5e8
SHA512 f733fdad3459d290ef39a3b907083c51b71060367b778485d265123ab9ce00e3170d2246a4a2f0360434d26376292803ccd44b0a5d61c45f2efaa28d5d0994df

C:\Users\Admin\AppData\Local\Temp\4.exe

MD5 c24de797dd930dea6b66cfc9e9bb10ce
SHA1 37c8c251e2551fd52d9f24b44386cfa0db49185a
SHA256 db99f9a2d6b25dd83e0d00d657eb326f11cc8055266e4e91c3aec119eaf8af01
SHA512 0e29b6ce2bdc14bf8fb6f8324ff3e39b143ce0f3fa05d65231b4c07e241814fb335ede061b525fe25486329d335adc06f71b804dbf4bf43e17db0b7cd620a7c6

C:\Users\Admin\AppData\Local\Temp\5.exe

MD5 84c958e242afd53e8c9dae148a969563
SHA1 e876df73f435cdfc4015905bed7699c1a1b1a38d
SHA256 079d320d3c32227ba4b9acddf60bfcdf660374cb7e55dba5ccf7beeaedd2cdef
SHA512 9e6cb07909d0d77ebb5b52164b1fa40ede30f820c9773ea3a1e62fb92513d05356dfef0e7ef49bf2ad177d3141720dc1c5edceb616cef77baec9acdd4bbc5bae

C:\Users\Admin\AppData\Local\Temp\6.exe

MD5 27422233e558f5f11ee07103ed9b72e3
SHA1 feb7232d1b317b925e6f74748dd67574bc74cd4d
SHA256 1fa6a4dc1e7d64c574cb54ae8fd71102f8c6c41f2bd9a93739d13ff6b77d41ac
SHA512 2d3f424a24e720f83533ace28270b59a254f08d4193df485d1b7d3b9e6ae53db39ef43d5fc7de599355469ad934d8bcb30f68d1aaa376df11b9e3dec848a5589

C:\Users\Admin\AppData\Local\Temp\7.exe

MD5 c84f50869b8ee58ca3f1e3b531c4415d
SHA1 d04c660864bc2556c4a59778736b140c193a6ab2
SHA256 fa54653d9b43eb40539044faf2bdcac010fed82b223351f6dfe7b061287b07d3
SHA512 bb8c98e2dadb884912ea53e97a2ea32ac212e5271f571d7aa0da601368feabee87e1be17d1a1b7738c56167f01b1788f3636aac1f7436c5b135fa9d31b229e94

C:\Users\Admin\AppData\Local\Temp\8.exe

MD5 7cfe29b01fae3c9eadab91bcd2dc9868
SHA1 d83496267dc0f29ce33422ef1bf3040f5fc7f957
SHA256 2c3bfb9cc6c71387ba5c4c03e04af7f64bf568bdbe4331e9f094b73b06bddcff
SHA512 f6111d6f8b609c1fc3b066075641dace8c34efb011176b5c79a6470cc6941a9727df4ceb2b96d1309f841432fa745348fc2fdaf587422eebd484d278efe3aeac

C:\Users\Admin\AppData\Local\Temp\10.exe

MD5 d6f9ccfaad9a2fb0089b43509b82786b
SHA1 3b4539ea537150e088811a22e0e186d06c5a743d
SHA256 9af50adf3be17dc18ab4efafcf6c6fb6110336be4ea362a7b56b117e3fb54c73
SHA512 8af1d5f67dad016e245bdda43cc53a5b7746372f90750cfcca0d31d634f2b706b632413c815334c0acfded4dd77862d368d4a69fe60c8c332bc54cece7a4c3cd

C:\Users\Admin\AppData\Local\Temp\11.exe

MD5 6c734f672db60259149add7cc51d2ef0
SHA1 2e50c8c44b336677812b518c93faab76c572669b
SHA256 24945bb9c3dcd8a9b5290e073b70534da9c22d5cd7fda455e5816483a27d9a7d
SHA512 1b4f5b4d4549ed37e504e62fbcb788226cfb24db4bfb931bc52c12d2bb8ba24b19c46f2ced297ef7c054344ef50b997357e2156f206e4d5b91fdbf8878649330

C:\Users\Admin\AppData\Local\Temp\12.exe

MD5 7ac9f8d002a8e0d840c376f6df687c65
SHA1 a364c6827fe70bb819b8c1332de40bcfa2fa376b
SHA256 66123f7c09e970be594abe74073f7708d42a54b1644722a30887b904d823e232
SHA512 0dd36611821d8e9ad53deb5ff4ee16944301c3b6bb5474f6f7683086cde46d5041974ec9b1d3fb9a6c82d9940a5b8aec75d51162999e7096154ad519876051fe

C:\Users\Admin\AppData\Local\Temp\13.exe

MD5 c76ee61d62a3e5698ffccb8ff0fda04c
SHA1 371b35900d1c9bfaff75bbe782280b251da92d0e
SHA256 fbf7d12dd702540cbaeeecf7bddf64158432ef4011bace2a84f5b5112aefe740
SHA512 a76fee1eb0d3585fa16d9618b8e76b8e144787448a2b8ff5fbd72a816cbd89b26d64db590a2a475805b14a9484fc00dbc3642d0014954ec7850795dcf2aa1ee7

C:\Users\Admin\AppData\Local\Temp\15.exe

MD5 c936e231c240fbf47e013423471d0b27
SHA1 36fabff4b2b4dfe7e092727e953795416b4cd98f
SHA256 629bf48c1295616cbbb7f9f406324e0d4fcd79310f16d487dd4c849e408a4202
SHA512 065793554be2c86c03351adc5a1027202b8c6faf8e460f61cc5e87bcd2fe776ee0c086877e75ad677835929711bea182c03e20e872389dfb7d641e17a1f89570

C:\Users\Admin\AppData\Local\Temp\17.exe

MD5 c252459c93b6240bb2b115a652426d80
SHA1 d0dffc518bbd20ce56b68513b6eae9b14435ed27
SHA256 b31ea30a8d68c68608554a7cb610f4af28f8c48730945e3e352b84eddef39402
SHA512 0dcfcddd9f77c7d1314f56db213bd40f47a03f6df1cf9b6f3fb8ac4ff6234ca321d5e7229cf9c7cb6be62e5aa5f3aa3f2f85a1a62267db36c6eab9e154165997

C:\Users\Admin\AppData\Local\Temp\14.exe

MD5 e6c863379822593726ad5e4ade69862a
SHA1 4fe1522c827f8509b0cd7b16b4d8dfb09eee9572
SHA256 ae43886fee752fb4a20bb66793cdd40d6f8b26b2bf8f5fbd4371e553ef6d6433
SHA512 31d1ae492e78ed3746e907c72296346920f5f19783254a1d2cb8c1e3bff766de0d3db4b7b710ed72991d0f98d9f0271caefc7a90e8ec0fe406107e3415f0107e

C:\Program Files\Java\jre-1.8\COPYRIGHT

MD5 ae69d23c6688b4098158dda10b607f85
SHA1 50c645e392e5c162faeb47f9db65dbd3f92cb7b0
SHA256 bf95a3a9af207104b9e235aeed94b9f975bba718745596c2121bafe057439b96
SHA512 d5ac625762879f30dfc20d8a9457fb75f1194be2b6943d33a117960ae383c4e039e87bbe186d3290ad7f282a3e3c79a4e4908d6bb549f4cf83856f8b045cee0a

C:\Program Files\Java\jre-1.8\LICENSE

MD5 9fad91bfb66e8c279dff466b1b6e0370
SHA1 7e248009358fc554420f1573bef0bc2ef7cd91bf
SHA256 ef36e0131e3f8967d8b6e20530244e5ea843171a0f7684748276b1d28f510337
SHA512 f9c3f898ee1a03752672d0c113eea6ed777cdb8ca79bdbb57caeed75ffb15a9dc16ff5073e55ed9019a0a905781fc43c481fbecbcb963d94125a30a1e0ce28f8

C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt

MD5 a29bd714ebc1fda7edae67057dfd7f95
SHA1 f09fcf582b32f1d0e587f135409730c678ff5664
SHA256 5d00064d4209da759341996da1bd0295513fc8c6c5df932913f529bf5b2fb2ff
SHA512 4936c96eefb6d0f1b776fd1ba404005af137a5eb4f18d45d40b54017493d20c4fcbd837bf7dd433c7bd0d94c4c9973b3eaa20ba0b1b37402b2257b04512f1cc9

C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt

MD5 020b6a1a6e6dcc0ab757d269e4619405
SHA1 6d721bedc716bfc28f6eace9937b02d3c026fc0d
SHA256 93f520a6b1cf56eebf77cc7bc189ba2efb6b9963fff3159971a7ac4858e610e2
SHA512 f74fbd2c64b70b6a2df1a04fe265507e6a23b369d335c10178e042a05224ca3b61306a2d8d7ab990f0dbcf8aea5154aad494aeb715e767acd17523c4a9b7143d

C:\Users\Admin\AppData\Local\Temp\Files\052b9d39fc2e8571f1b8319a832d3ab9ee066b19c037900d3e1ab29f5616621d.exe.exe

MD5 ab65b7407318c476a31d5204caef97af
SHA1 a44440efa36f7c024f26e00ccee50671abc36ad9
SHA256 052b9d39fc2e8571f1b8319a832d3ab9ee066b19c037900d3e1ab29f5616621d
SHA512 cb452ba020a4eb620110909d6f62ff8747a61acee2e6dab6388b0d08f534e4464e647f63d93a11183ee6b95ff2af62002e1fc03279718385beac820039339d07

C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt

MD5 ba9255a91b9a7b8aa83c6b644148158f
SHA1 78df11389eb9b9de2e31c75f5bf30c78b733ddfc
SHA256 ff91c4a305e26858d7872f6089fefeddbebbbee6c7464787c50f9eba32be7d10
SHA512 14317b5f3bc234f6b01ae5d22aad7d3151cd88992459cff73a28c0cef162637e661232d9a22fb130ad4cedb92b56827ce9f4eb632a37b17298d31bb2292e053b

C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC_K_COL.HXK

MD5 355c87b176b4046906a722f41fd74db9
SHA1 76b1ca11f788e46609368464355d6a352ec3f425
SHA256 737c6af161b1e783834bdee3567f4e479b67767b3ad01657a665a2bdc4a34619
SHA512 50ab7be63283c631fd3208718a7b1b1609c20b3172493aba66dde5d2c51121bfaa4c73569de5c8ee11f8dc795f758564df6b4d3e7c811a068a46c4727f5faca1

C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC_F_COL.HXK

MD5 99152f696995122ddd8298946dc31ab0
SHA1 8757e9a9c0cb1e37700bdb88caab32072c7d5755
SHA256 ff8371de897a12e63bb9ce37ad31e8db48962e67b3267d5377bc86ebbcdd9153
SHA512 1ee6cf72aa6cc6e8e4c64c1bf2e5d72ebdec3abc39fb2ddbff185df5074e8527a003a164be54fee7189d4fb904afdc7b33595c1ccc0d52e3710efe6c1325ef4c

C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe.config

MD5 1afffedb1f296c24ffc3e93f67553a02
SHA1 2ea49bbfc7c96dc6c229f5e42e3527d5982dad62
SHA256 09089185b970c5fbe57ac3355f19e53662aec121e8bf9799e762c1d39a72a5aa
SHA512 cf645f0f3f0861e474e7aa3a3cd1948a205a4633f200c759ba44fb847f9ca08e36d1d444ed4fbeda370f2a131442ff67b951eeecb3f1aaaa5bfbb8bef8963941

memory/2764-4888-0x0000000073E60000-0x0000000074410000-memory.dmp

C:\20145506\arwup.pif

MD5 9fc46b6036032a8d8a89e3567a3dcec3
SHA1 42dcd68b4a35686b000a18efb4c2b2ae07d5cc94
SHA256 0e96860caa7e17fdcacac170b59189eb500761d5a80954d92e7f7b0ecb6b9534
SHA512 45c10d083b1abc6cfcb54cd5d1a5343c1f8b25ac89c3800b173634073204a94cc7bbbe52caa2c465af739a438cc0df7daf2a62defc5220b2b72e507dbae0be3d

C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\SIST02.XSL

MD5 f3a0ac25bbfa3d03874f178a81f894b7
SHA1 5b6ade33aa20b0a72f8efdaa75c70a903b7013d5
SHA256 04939e45f726491a53283ad6ff07316a8cc46d365686994aa2c9d7cede2d473c
SHA512 d7d3339c9f0f9cf51070adca7189190826f1aea7e27ec0f14194ebba73db308ab3c61a73fde9e6c0b2c62d01cd08f46846e4590bff2344f7ee2043a7b1c4df72

C:\Program Files\Microsoft Office\root\Office16\PROOF\msgr8fr.dub

MD5 114b76a61bd63bb8ef4e41da183815d4
SHA1 3372240ed04127fd120f234c2f60986874fd9de5
SHA256 b3e23cd7c999f2053ddddd028e5ee22ee38d44d53cb36b111dde4bce9f997940
SHA512 0710071ac5976d7530683b9d1973c91015f58e076dae7221be753733f2f18ef64514c533eb98864fb31e4092fb227d8c317df027dfcd1ccf7a79c5131325a086

C:\Program Files\Microsoft Office\root\Office16\pkeyconfig-office.xrm-ms

MD5 d702467205dd7ab9d1a1eac031c6136b
SHA1 c6ac4a44a19d775f859d99b9741ee3c153beede6
SHA256 eaf1038fea51a2b6945e0b611018ca0b2f63098e5d1f990c0280618e77f617c4
SHA512 2a21a1eca6c02c99f6800432b1a72fd272b1df68e2bd5a93941de8dc8655580ef7d8035b95e398726bf3ab719b26f375eb6a46022a88f6f89b5a8d263e8f8c65

memory/2764-6805-0x0000000073E60000-0x0000000074410000-memory.dmp

memory/5328-7297-0x0000000000B00000-0x0000000001087000-memory.dmp

memory/5328-7362-0x0000000000B00000-0x0000000000B4C000-memory.dmp

memory/5328-7508-0x0000000005A00000-0x0000000005EFE000-memory.dmp

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Cartridges\Informix.xsl

MD5 a1aeecc5b92931e3aec836319eeb62ed
SHA1 f277d1fa84324a2c40f7e68602a172877129a1a6
SHA256 09d0108f5ff18a962b273906083a2792db1930edf41834781d8f4678199711c0
SHA512 3e28661c07fcb65c787802f53179820183320bda497c724b2c7cf65716d0c454ce4e774c1b8e85aba966629c689007ff49beee6fa81edd227cd9123dd5faf605

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Cartridges\msjet.xsl

MD5 73318bfc92f91c7a08bd09672ceb9d26
SHA1 75834d36bc784003cae96175e4fd35a455668548
SHA256 149d3e024b3b2fcba0bb8523271ce9a35007f97a278e1dfe11b625f373c74fd8
SHA512 817194a9aa694c17b705bee47879e69f5923291af6c30e8a061850b7d5a85987a25f7f6bf0769735bd73a1b2720cad61963cbaed498427f81a89f78d44d7f80c

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Cartridges\sql2000.xsl

MD5 170fdbf5e7309c2f32eabf5a80fe5a84
SHA1 ac1ac8f0cef60c2f3081498499b26c77ed55dc1c
SHA256 36f050704978a512990a19fbca929760dff3d1daed86ab0b3a1a49866b721347
SHA512 c7c411944816c8326a9c3cbe419f7637ea3e9ed4c51caca008e0051ec078ee2cf00302983d3040dd86e358820a44f17cffb46b02e18a92df05bfe2e7478eb968

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Cartridges\sql70.xsl

MD5 a351b3c6d92c197c38b4e8d666a841b4
SHA1 5c99049cf6bb5370f0e364dd85409a63a632aa09
SHA256 a60d26bfdd53c8bb8bbe2f44b956ec612d35f7dfc90a9987269d59b53c2a172a
SHA512 7462b985ffc8b6e9a6c9ee067e8b8edc88a3d97b1d58be81f07ee2951f6a51035e4628ea530ef929bebe590541b665cefe81091eb334baab189e7fde5b37b4cd

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Cartridges\Sybase.xsl

MD5 2a5e8e539f8143bd33d7b4789fb5535d
SHA1 2de04982deb9fccc37aff2a813ea70263c5eb05b
SHA256 7d367eeec005b42f84267ce78a3db80126f4ad5c9a5455f766b5d711bd32567c
SHA512 90ad0cf44c19989becb0d29f822848f6b074b0c2421bfafc8e3aee122317491b9b82a9982b5203bca76d5dd9c5f9af725976d32e9b5a591e02826b502dafdccc

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Cartridges\hive.xsl

MD5 bd7d1cd021b7c9c16ab4c76643c9c08c
SHA1 507cf250fa0c6e7fcf5b148654a6ab78956b1470
SHA256 9972370cc1d52c53537cdad15fd405ee10ace6e177c132fb0b1ceb96e2b315e7
SHA512 79334e32345a6c53b028ba6a7f04bb693a2d703357e8707781f720ae32dd3cff60d71f92d00d8aec17a2ca017dd3027c43c4a0f0ec14d4fc506c7f0589a0d336

C:\Program Files\VideoLAN\VLC\locale\da\LC_MESSAGES\vlc.mo

MD5 2d13c94b7766e3eb26925b651d5810fd
SHA1 fc1027a5112d6971f564246eb5e5844d4122219c
SHA256 d56156fa0a71c031eb3165b3024bfa549e43077c4d8037b870d65342ff0264b1
SHA512 0e72eb6d98cb2ca55f88868c9490fe2901fa54ece40a190fc7cf941f145efe680e9885dc0206c10ff86627c250c6f19c65a79e9d8efcf82b1a35655ae4321e85

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\aic_file_icons_retina_thumb.png

MD5 c9738db27866f6ea7c29d8f4c379dd39
SHA1 381a465252532441ae18f150b1a7433421b95de3
SHA256 2e244c9984c05efdf1db0fd44c5e2d04fd807b78ce994e6581a48614786a1fc1
SHA512 31cdc74799be4e21cbd63f44087a77f3e34e8581331c2c80b0fd29171ebd309d4b3db34f8ece3d4194486f353c3e96529d45b51d9bd4a561af19ed97d3d7cc29

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\duplicate.svg

MD5 f91059f8833de2c078e0fb93f829fe6a
SHA1 50d98fc464fd9880aa14dbc9f93853ebde14eb75
SHA256 ee7797ff5358ee6edbf298f1a5740bfda418c07cb27ed0c79ef3c3f3df1b7b4f
SHA512 b3bf55f2e13b87db7fe444d42a1c1c6ff0e7b85ccb9a459a2a2cfec243f1444de9041b82ac0a946b007d82d18c333583c1e7721214883462774a92a9022ca899

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\remove.svg

MD5 0ccef6b790881249ef0ddd6eb140958d
SHA1 226f12ffd0ba7be8565a65ee64b68e6c295fdb68
SHA256 da1200bc1413c6265293d7175f1dd3c17fbd11983a795df0d03868446c005427
SHA512 3ea76e3ecf2ae1ec125643a544746a049cb88ac993342d8e88a8e530aa28c0a4c40357cd29189c50a6ed359398e87fbed9d89672ab01eae09ac1c5fd6af55c71

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions.png

MD5 741e1d2373f7d1ddf3ae1ba20d69c5d6
SHA1 f6284407ad371b812c91cc207c65a281cbc911e9
SHA256 4c460053bb47a04c5c8c5d17b5b7c2faa9737b4319729b0fbfe844aa2b7113a2
SHA512 4caa0842f7d1f28c2b8a9d17e13dfdcc5333b7656d583a3abe37fb9bdfa5584392185dcb73df1a8e063065785aa68c3e0b8109db621264630f61181eb6150bc2

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions2x.png

MD5 ef4f68d926968631d4f0f6539ce99036
SHA1 cfaf5bb32a3aec7681b888173a946006a1b5d617
SHA256 e27b7e5ad014693c39939936361bd380d85cd91c742e7653cf8b60aa91fffb0f
SHA512 efd81d1de578b4ef7d6f190ecec214e991c444cbe156b4bc3de6d3569fe657de81d527d05fb401a2e4035ed632e75ed3c8553e06897d516d82a204993f9642a8

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_backarrow_default.svg

MD5 9c17cc075a048b5a3063e992b95a3d86
SHA1 9b38ef7d2fd6865a2a0c7b9786ef1d6f2fe8f325
SHA256 126e5146d7fc20a083df6c4ec5980261365aa2a84767eb0723d4de9c4b563214
SHA512 c4d286f7d7450bed7e797dfb7c98d7705f2991247f838f8dd57fada124574190566d63dc6b6c62bd04f7ccb8292e918cb1e93e12ad08e81c143482c15fa6c947

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_closereview_18.svg

MD5 687cb5a0a5214c53e79d6cf950c63b92
SHA1 a856965cb98267249b9fff825138a8f67e1a4134
SHA256 890e9f15da259a31c90b7d5e0ba0d254b32bc8e6595dc43fbc341bf237af10a1
SHA512 406ac559452e373478abff32a570fee22e252570de7ca6c64cfc394e07cb1a680f493aa3897ac8593540544f7c19e498f36a74c247ac3e7efecdfad6589f9d14

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_comment_18.svg

MD5 dfaff6661edf1036995f9f8bf32b6234
SHA1 fc2a917cd0ea19902994959888de308707dd8522
SHA256 f499f9088e60d6ee0d9a6f14ffb08a812cdc0ac700a018b08c3fe611404385d0
SHA512 9d78978a64a1a9804a7c86dfc5cc22936fc7f35d41ef26f85f297c18842ff7c9fc97ee6182201a09496ff14f2c0e9b4bc173eb33707006b477d75043415fe62f

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_editpdf_18.svg

MD5 c0d68d82b34023a1a10def7089f38efb
SHA1 f79cfcf85079d447bf7a61c4241dae9a5f2fedb8
SHA256 7deb075accceca1cbbc885ebb61a552f23b318ea520769a3de8b414742b5ac0e
SHA512 692638eefb11d882e4766a6d3e11f3953ade2839d6a4868a2d436780c868ec2edde22ae209ade733757286b4149829f3a66a08f5a420c9d2e50a0fd6ee1f375d

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_export_18.svg

MD5 a0d1bd5394fc58d8c3d166326fedbdab
SHA1 c3364ed586f103fbbd079cd10ce7222539f77dab
SHA256 8d6691cf01492c104c018abfc3a8457e5caa1d2514cdb634f754066d3ed031fc
SHA512 f894ee6f48c6e1bacdf34365b283cc36ffa23eba1a6935dbc4772cf5b484b225e88ecf8c546385da2aab7a9f0ec813f2df80a6293781275525c13d295144932b

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_fillandsign_18.svg

MD5 f1f7dc005a12433c31defc6abdcec34f
SHA1 d2d6fe1436084475362919f08475f598176d8235
SHA256 bdef17b7fc9fea59d3462e20841714fc0bcf7a8ba4a55181a6ca6b2c9f179eaf
SHA512 60688f19484d5a08e48c4b7fd053701f1fadad459fed74b4c700b5c519a49c6a5869284491d3b9b2be39a323d6035ef79189ca6b63c21a034acf8abf4ea90753

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_move_18.svg

MD5 898b12ffdf9225a013e0e02c14e1068c
SHA1 7e8676edb84235704acb8f985c5df4d78afd716d
SHA256 c3d584cda817708d9e3641cf6a10c92b3966b9d6bf2d1f255567bda0efe02826
SHA512 d5fc4d09e1e370865a38f71a6bebd5e93eb4d4bd0976e018acd5f874ecc13563f343df17e64a4d8b635eb3d05df175a7cd10214c4a546ae0c12885c4a141c328

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_newfolder-default.svg

MD5 245f235139b3aabef491cabbc21a5a65
SHA1 1612338da3cf88ca710af70c0ad6a03acf244cc3
SHA256 21840fec7509f673d47e5d8883e5726c5a04a60fad1a5de196421c5dcddea319
SHA512 e50df8a30c058b545ca7b640b95f2909921c2dae1bbedabddcb34a9773d8d2a513c86fa1f5212f965b5dd121e628b0b468d7efe0db4e70ad0ffe21539afda15d

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_nextarrow_default.svg

MD5 735577e3931bce516336ece5355076f5
SHA1 7fd6fe00e10a5aa4a82048b04189678b7a7fc63e
SHA256 e0167aa7274f283512972ef7627937bd461978781b9f4f0cbd062ff9d84f01ef
SHA512 ebc26bad4febe5bec7134ef6b4147176a25d7ec2a8f190a9a6f2645f3e56e5eb9cabfdade327b0e6db6305fc388a8b4f852f0501a0baa17b5e6a964806fa2e0a

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_organize_18.svg

MD5 abbf42b512b92dea31ed9383ab32e5b4
SHA1 9c9044a512aa2cd0c887e2a8b19aced3d7b340df
SHA256 cde77b594b4b8fc69c661991ed699ffc52689399f1107887e81cdd4e08adf617
SHA512 5e9a240f862302c62e7660693d9e133f74c9ccb80f182727ca5ac9ec28c7a7e2e1d39cf388a6f6710ba56d09090bb20f5c3cd6014eba1bbfd9f84288a20e5ca2

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_rename_18.svg

MD5 d6825fcf02c0e59c6ca55819b1e78699
SHA1 f856afb052a517cf2ddaa0a67014b9aad88197f8
SHA256 390e1f39ea37b3727cc6fb58506f938559084d2aef2d3b88bf194cc0c9c732ff
SHA512 343d4eb73ddd6d21577129a1a4f82c7a25a12e59ad463e305abe5235d71d2ec52ac072902afd69dae140723826a7afb466fa28c0b5e5e66eae49b25e6afeb131

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_sendforsignature_18.svg

MD5 3e1e024fa6f2575b11e98352a29a6bf7
SHA1 25f332a20a204c5229b00576e3a7d24e6f95eb71
SHA256 b2cd0234af3ef159f377e6d5b94ac64b945e24af3ea9cf59d43b36096178fe80
SHA512 ee2dd226ecf4b9892da026e80f316ed2c5d1b5cd271bd560d699398ff58b1c91464b3db1a74c4eb220f86b03176ae14679fcb89f6ee5bb44694d69151142e251

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_share_18.svg

MD5 860fb705e75250c9cb100165b4329239
SHA1 3115561a6ac80b7f2bf83ff882319a0d0f7ec22e
SHA256 0fc8156cdb5060e98b619b599a9e83be3f88f73cd839d199c7f881266e9dc6bf
SHA512 c083deb388a256bf69edca101ea72ebafbec23498508bc66599269e02db87ddda17fa51b8f89a473ef2af9adab022563055e3063f39caf9ecba5136f99d14e68

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\root\ui-strings.js

MD5 89d95241a452d286e50ee975b2efe4a3
SHA1 72267ef221b6a84904173f11d5dbc48d59173e2d
SHA256 ac9c4aba25039527eca35276f808b20ee233beb3128072348f6f1fe51be07d21
SHA512 9454855729bba380bcf25629bc3d4296f39291936bc38c6110d97fde103ef0c2fc5547e9766b1c8a5ae77920290c773b3687a6ea65d110733d08b87343313b07

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\root\ui-strings.js

MD5 95043352b90ba5f5fc62652d0f1027c1
SHA1 80c6decea2f8ed829cf12329920034cbe7a8df33
SHA256 887a123915a11e9636f5923ba006f2e3f9c989e3ab647694c03a72d77848a9ea
SHA512 c47d4ff9a62d9e7d9eadab3f4c9cb19ee3eac93228e8c24ca91e10186a1188459eb1f86588e4a2fa6b3be329619b74a696e2f04415b8386d3e45ba9e3622e5ae

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\root\ui-strings.js

MD5 23f4cf15cf6eacaaf2e524a9acaad030
SHA1 d5d3861fe49a26c829ec0b4f4bec580d504aace6
SHA256 9a5a1f76f7e4f09569a0fa7884991bcd240ae137a8578fabb0b7918af951a538
SHA512 7cedf239abfa16b06162441c47c71ec3c01b0ebb18eb2e52749348e310ce411c2705e96fcf228ead186c9de2b7117828b8e82d2a0cd1d429538c8ce8ba1443b8

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\he-il\ui-strings.js

MD5 9e786f766cbad70e3b8f850d6515be62
SHA1 f5e0e5ebf165c0a3cb0b697c0e7da12bde6f4a2f
SHA256 2df78317fa0c2ade0d39696cd39ad6689c7e881688af5bd406225bd3047cc7e1
SHA512 8e6dc6c6dc75f500e98d2ad45518c7993e7439fd9c89edfdeab120ec01eed60ca035cd861abc3f5c38baf4d94d6f6ed39a393d7906a1d4e8bd145f7a404b59a6

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\root\ui-strings.js

MD5 9494d9d4aa8b5bb3f96da37eb135527f
SHA1 1031ea00b15a51c09bcb14766eb66f496d62d585
SHA256 afdba9f047ab58d4ad81eceb166aa46e2d2ffb00748e02bbc55c7cc8d801e162
SHA512 4686d7dda8117435ef3feb3af4384d1dc3ff21d5ab0ebad6627a4ec73c20b87e916b3baee49c43b47875ef2e8c9034ea1d2ea5998a64c6b0d8af66b939e4eaad

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\root\ui-strings.js

MD5 2a379b49d2114abaa51747dccd95a8ad
SHA1 c648d3b6f661adc0b23cf3d2d1448133e8ec7db6
SHA256 998d7882b660d60ce3a201c22ca5ffc67a6165489ed514999a7cec3dfc6822dd
SHA512 b5d4748c1c13c9db8972141b921806473f0ef5411cc551fe7007d978b779efa8692cad0d971bc111032113c2fb016ffefa9a01d838fea5551531a1e136dddf7f

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\convertpdf-selector.js

MD5 c04da16b31710d6caf797ea05bf073d0
SHA1 4d4e31221809b47c123f9e3c11dfb2497c61ea80
SHA256 b9594f2cb5968d7f1be4963aa46a2e9a37a649b9634d6e77d77bf304a315ed1f
SHA512 2808b9b47431567594e0ead17310ee7f5717b7e5ac59a786c1e766bb107610ad1c54c8df821fefbd240f9cf92f19d69d60514efbdb3fa461021da3c393a9074e

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\convertpdf-tool-view.js

MD5 87a8617da17298e5f612129b9affcba4
SHA1 9e22c2192d65433378e8874acf47a8da7009ff3a
SHA256 27cc43a6f82479b7b0ec40e140fcc9ac2bfeba17a1191ffac3a726bf2963c37b
SHA512 14ef7ae8e78f401351491ca07ec382392635ecdb641a5d57776b5a64137c604534b6a6124dbb2782e47bf95a0ff183ab8a44f8db7a691bf80ab5b6db8118058d

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\root\ui-strings.js

MD5 11f58eaa37fd36c6e9cdd47770d81689
SHA1 54e5012bc1453621344b04d2dcbe4820f0a16187
SHA256 a3d1fe01d994b2edd6fc9fd3c2271489c9557370179fe32c178a8a31d4a1a2e7
SHA512 c262a6329c95c4da7559ba4792cb1bbfd3bb7a369dc76962b223ca455ed5fddaa83b614af4472a4425bf706b1c0b28d9690cd6a6056cd5e4c11e7d79a1824c64

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\root\ui-strings.js

MD5 8a0d8c21293a6a523f8d15a4103f0b60
SHA1 22edc276cbc370797c8b7c00fe19cbc6ee3e0d28
SHA256 5d52ead5b40176a1a75fc9036b2b00045952d1758508e7746a90532bd82b20c1
SHA512 dcf468cac857949db0d225c446f50c06d53bf54963531424a2dad3c20138d5f8026b8272bea42f7260c1bd901740400ce87e91dbd159f295c5a6159b34316b82

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\example_icons.png

MD5 f013ade6779db58f764e1411a416f7d3
SHA1 d404ac1fc05cc4049096b284b0359cd40c6bbb5a
SHA256 6d032aa11c871db86027cca64da1c1cc810176aa8081d86f5dc22f6b400af34f
SHA512 12fefb4a16a779e393dcc7713d3572d06fde328d24e6495b27f8d67ef04e0e1c732373332f929a784047d20d365b0950e33f18ef5096360b0e4e3d6724461ce5

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\example_icons2x.png

MD5 c0cf52fff08717854c04ea0890bb4934
SHA1 e923db74e79c69f8c16cc841de057e2b98979139
SHA256 8cbf4f43573f83b9b8797f60e511f7554f8914693ded434846c456c6a3e4b1c6
SHA512 4b248e9efe5f8263e403ee48b40ed1a336255511f7275fa9f6b0070e409c82d9de12a506afa9a959ca6c5d59336573c0b4dae01f134ac22413326559d28b5143

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon.png

MD5 5a15cc05fa861774fb6733a49fa33b61
SHA1 79aeeda34e123391fb66dc3fafe27b4f59cec3eb
SHA256 a25a4a4f7364fa2916286050213331d1bfc894af3cd8159fc7bec10b9ef7de17
SHA512 7582b4b4829ced50b9d12c3cf7672e7c970d281f67fee8ab7064e713aec2bda43314711900f4fed8f4d3d33bd078f035ac6e20593dc9b67871a27ee5e90e1483

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png

MD5 82f180aa070cdf92d9e981d647aefbf9
SHA1 be05e1677344f962b5a8f3448956392817bf33ba
SHA256 67c07e80d3bec1f24404b2ca59f3e51134673ed3d5791463a09a58544d3b43d9
SHA512 e4407915811c016715d3af40bcb0f146195ac7e2b604c52fb1879bac6c4bc58660a0b0e122ecd485a0593128fd5a3633f9131fe01ab39d80984fe9f272af7d91

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png

MD5 d1d4c5d84f0e6c5c1deff516ab86c8a7
SHA1 14d750c7446ff9161a0dfc8748991defd3ec4407
SHA256 63b8493a25424275c563083a5a0b11428b11490b378ffb536af2356622663941
SHA512 eb61bf7eb303c981b8af07c7e256b4ff822afb643ef5d4d2633f39945a11f8d7a756be0664f0d3e86f85c8e06e59bb3538b265e41ce13ed4ae8bd6f36848c8a2

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover_2x.png

MD5 d4e00717ed3a2c2c76f74322a312a605
SHA1 c633f69202da4e347245a67febb8d9353a44f8b7
SHA256 44a558432c0e53109f99c44824ed2949fc41b958f86680ea9052bb3080ab00ef
SHA512 4e01f8629a20b2b56ebc029caf70bf57bcb38d455b914d731eafd05d20a6bd33b4e6dc4bdbbb23b0838c958a963b9860f09c1cff0957ea022fad73e265d0437d

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover_2x.png

MD5 44c7232ac601c55864899052a4eb43d5
SHA1 5dbb3e8da19a6534a92a3afe91bb1eaf5583d4e9
SHA256 98ffb4b4a184aade4a21fec40f9edf00ae57a10096d26608a28c02f8c8ebda83
SHA512 66855750711dc8ca3e1447b7b85e56c0724bf76ee014a9bb52c72e8cbaa9d27b98b588fd5e75dbc533865bccda89c4b1b8e7ad8181360b962fcde96c06f7b8c4

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover.png

MD5 0d9263f7b37fab2b98d69cb92d333b62
SHA1 c93e3fb26f4d14bec08798e5dc3450453494bcbd
SHA256 583779ada29d53185c5e14ad36a7348994f4b7ad8e203ea2b81451fb1e2df2ff
SHA512 c204b0f8811f4dde5f40b004418c5885f819957b15fe2bb92b9724359ba37b38afd0d129f6c322cc9a2279c1b715d49e4192a8831f84c2d1e0babfaf011904fd

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_2x.png

MD5 a4c2800f1be10e9813361e5409afaa96
SHA1 19efd045476b570110c03479c7b694e092ebccab
SHA256 44f3c2ef7451e5a6dd41e78cecd3deada77cdc95f1b4a78d18666e58c834b53c
SHA512 c4d4e785cbc55f0b7b2ddc8e1b30fd0d96c6dc694b2ee9cc2354f8b1ae2d5fcaa7e9fe7d693fc68409d285a9baec969c2a4411e31d0e0fbaa930e054b1876f54

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon.png

MD5 8b34a92cb1c26292097523e87c8a212a
SHA1 1f256034d03a7d84a01ff1b1f52be5c421fccfb3
SHA256 00a97b344b4d93a4d0a14bd1cf528c38c7fc7273bf0fa9b4e0d605c0ce696e98
SHA512 3613d767a3f824b0bc938b1ac4ea4f6320dbdf13aed3f8592def98a31ab64e46f0b95ff156cc1a36ed9a893f806bc6b067ec771a3689367cc702e2d897d5a877

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fr-ma\ui-strings.js

MD5 c7c38b6545dcaed3e18cb29f5eea87aa
SHA1 fe10301b114cd5dcc57b8139ae0347702a14786f
SHA256 2eccf2b75b416c7d47fa2e15b6931632bc428577ecaf9d2ae93c32232919fd97
SHA512 de88c1ec0db602340cf7e09223b80aadb56d292df2792dc5dcc648d46053c1e5df2a824c082c9d429e97738085e78b64e59363e3d5d278246a1d35d9c497d2d7

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\root\ui-strings.js

MD5 7994413fd46adada6cb67c217af39403
SHA1 928514e00d1d6eadaca8213f6d341cb62f97b5f4
SHA256 72c24976948a176db573b7e01213f140211e1edf7080beeb270d5b04a8c06313
SHA512 7d88311de73ec85b1d63d7f23a16e2bd7cea6356c207ef5438f349105cb3b802721e3a1918be1add4431d23469c14a4e7feb800c55d56527d133b5a1e26e1f23

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\images\themes\dark\s_checkbox_unselected_18.svg

MD5 4610fba5cd1d3af8bc00eb8bfc6b100a
SHA1 919662a586356bec9e2f22e1b1faccba46ac3e8b
SHA256 d54b15ad7ce0a33776826189c980a29fa716de9c32c69ff17463880ce2ef440d
SHA512 e934c1e0fcafa94baceea2f98bc4034971635bd75f2fe393ffc0490723a3b02af86ac428a6340fe8ae4508dff741d2928aa03aed695de0ddc2815bc91c9746bb

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\images\s_checkbox_selected_18.svg

MD5 747a76c0e0692cf98d8b2a8d5c1ef1d4
SHA1 18148d75b7c57d5bb62b03e76dc8145a585bf27f
SHA256 71433ecb7130c375ea4c750c1aedcda9d92d0e6502ad0b9043b3889650b759c9
SHA512 6f5cc6cf941bcaa69c701c4114b9b2d64c8806f71edb35d1342183067a268866688380ffa41c146dfe1db434849a6138e85e06b0885370fa93e98b5e20af79d2

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\root\ui-strings.js

MD5 503fdde026f80f6054daf73a9b6f3915
SHA1 4ac2c8b5b04b76bd117dc243b886d2ba6690d68e
SHA256 1bf90edd499107f8eeec65c15471762d872caab2e9a6767dce75c988efa80e1a
SHA512 b8005efd493819671a52f5fb7e96392d050fc49e7e417352b8c07143cf2a639c7ab64af0194292b60f78740c269d57ae4741afa68a9e4beca01e2ef55d76a611

memory/5328-14254-0x00000000059B0000-0x00000000059C8000-memory.dmp

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\fr-ma\ui-strings.js

MD5 7a36fb177e9546f720389385470ce75d
SHA1 c7e538930d86fd3c332331732b65a38f0e960fb7
SHA256 da79511de787bfe6dc4a552f148e3bb1239974418f39edd79a87eeda60e2fde3
SHA512 1dca8cd88898bcd3ab0a7adb4183aa1975263d41d562ecb8fd7d14b9ba98126c8460fccc0eb7a3162065ef42c959b4ef5df615bee0ff5529be096f5d11026ecc

memory/5328-14315-0x0000000006160000-0x00000000061C6000-memory.dmp

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\fr-ma\ui-strings.js

MD5 d8555e5aa9dc92ac69fde8ae684f2a96
SHA1 2312da08952b49d4c0a6b8982518a275fb7e72a3
SHA256 03ffe8111bfc6047a483c0ececfa950fd7dc82821cc48326642ab02cedf4152a
SHA512 1176f2d90e40531cd0f3939c5bff32e8e93e404238e499d0b702f8a48cfd2a59aedf5d3f425eeb6e50833a7b0a3ba959a93c2ed0c3fda8f4ffd29cb856c02226

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\themes\dark\icons.png

MD5 defb424a7865362f6e076a79290e0ffc
SHA1 4d6f9e69665b59328d7e3cf62a0ba12ba8d88c7b
SHA256 f4dbd68851ec7709f24192aa476737b190441310d15d3b553f31d01098d83cff
SHA512 0e5cd9c550edf5f99a287af29d2c031c63ac696594d71e12171cae28a57988dc06fb117f12194f1f265d59f73a79081b457cfff70bb954bf3ea7e016d3f762bd

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\themes\dark\icons_ie8.gif

MD5 5fca3bbfef5f5d19388d90d0abb29ce2
SHA1 17a68f30cbce456902dd0d3753eaf71cb1062456
SHA256 303ad448fd0f1e74bd647c6e892f7494575ae5b04e63e84f32f0745dca36a61d
SHA512 a2599a50eb8afdb189fcb8bb3f89323157a91da20dd03af51ca6dc2c80557fe02cbf31518419080a535189c0d76fe3c6a6e672ee11005c613540110249e62013

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\themes\dark\icons_retina.png

MD5 4780994efc9439b168144d2652024209
SHA1 331fa5ea32421462d4956b337de761a1d5a9464b
SHA256 4177eb15c8e2beb5281b460fd34e6e9e988f6b671716e816d242fb02604b14cc
SHA512 9c6d5eea32c0327d03e5828dccbdedb0114586f4620cedd77a3cd1513e6c4ec93f479ff0708d8db64b687b7e94b6dcf55c07e24d7937edc4800c4e9cc8f7aff3

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\themes\dark\new_icons.png

MD5 274ed2cc1a5137dd9bcdf33fee044e61
SHA1 cb68517c3310b79b24ac0bee291b09784894d9e2
SHA256 cf86bde391b7eaa2c1e3a1877f7b1912ca482fd2de9748e618c84c398d9506a2
SHA512 77f1c4ed3b25c1059fb96c6d55e4b0502bb2037f8c7036456d10de62d9fead5d606a49ae381765d7beaf7d87f80393a23b3ac0ce4fdd3b0b9b89f48df2243024

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\themes\dark\new_icons_retina.png

MD5 bb0f00c835732895bb9d14762909b05e
SHA1 97dee94197e9066f8a178dda5a589fb4db290f8f
SHA256 8141cc17cb44ca3e2127dd0dcde19262ec7893de8a58226ee711445db07a60ff
SHA512 54a93ebee18e1149006a272e7a5df9c7faa9f4086c08693a2592340a4337bc03a68a701f19631b0c2f6edbb3890b52d3f35dab78413e2bf9679f7050c3414618

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\bg_patterns_header.png

MD5 e57eb86d7763862fad1d51f2ae019e01
SHA1 1e288ea9cba72ee27e4db348194a93920c7f15aa
SHA256 a42244c7deb4f8d890b70b4ac568fd64b0d19a87cfad95054c25fbef81d03be9
SHA512 225ed2ba203fb8db8103dc44552442b1fa993e551ff1736170dd7a799ed63a2661dd04b8bc9755fdae008babe395a23a7b751aecdbc55a6696df55dca9b7a7b7

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\bg_pattern_RHP.png

MD5 5feb6a7b6f2c5c13b37f9f4c126531db
SHA1 d1374f10bd3004a0ad98cf0c8ae807d62847c26a
SHA256 0d3aff9c63c1d1c2688fc3d87d907d49aef960af31891bc6298586b7cb571550
SHA512 0c1e31499edf710bdaccd92e8802d36ef6f947d0c2a943c91656376686399fed74b4636369a82a83aa933ea1900eae2e7537e1f612a62f9e3c7e846e693dc603

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\illustrations.png

MD5 7769da70609cdb8df20c88c0532b78ee
SHA1 96913b6fa3ec099ad09b680119d6ef59e173dada
SHA256 04918e3aa3cd1d464aeacf81f79734a2c69205d9c69e853ecc9198a30216ee0c
SHA512 e2e1b81a62326b308ba228804f62b1f8cde18137c298a131bf0a104ccc0cff91b38a6202baf951e3977016cc2ab57e84c2901a44b5b7d188cb57c82cb6b60993

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\illustrations_retina.png

MD5 ccaf97bde0f98bb98e595ff9b7596142
SHA1 d98fbf97558501314d40f161f9f4495648ff5431
SHA256 399df698fff30d9303d9b6fb51149e53fc7ad9f415556831335c1b3428cb329a
SHA512 660419b089da11b5b193f91ec64ba46e408a21097883b2c47c46f0072e0566e351419a0fc95b354cd0424dbb48e3f9dc3c97d6966f5f51436c4b7ce565a64941

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\root\ui-strings.js

MD5 9cfe50094ace228bc7e2da5815b0505e
SHA1 4e0a7a382adace64ebff78665cb3ac8e402cd91a
SHA256 d62859e371693e583e82d683bd88dc438d873ac892d2347fe3c548f0d4ad582a
SHA512 35472f66d9f3e9249b4c92a3264155c3ced303fb938f37317d07e416d89b8a771243e8678f11fc9159856fad39065dd43e71aeb8d3bb51926104ccecdc6f87d1

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\sl-sl\ui-strings.js

MD5 8484a3eee37a661683530fb41595c45c
SHA1 90cc040d3003d11896dca9e977a00e2226e3634b
SHA256 9e3e9d37972db01f40f792f05bcce26ed697ae810dd7c6ee0100d013046f725e
SHA512 c5fbfcb4e261d7072a0ab910c51c251606cae982a418487a845931ee57402dc5f52d8ee87103b2cbfbe681fd18e1213b3f62aad758ff436be2339aaedc99ad23

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\en-gb\ui-strings.js

MD5 d44d009dcb4c7da7166e38e7a39370fd
SHA1 463fcd19ecddd1515d8e96c26d082ddb2cdb5993
SHA256 1629ca8aeca4a6289006876afd81fc30fe1f71730150e4539b723cdefb109c42
SHA512 275d26f9b94f0f3e54ff2a5955b3b3f6dae2f8b202df159c5182777aa90236f9552b0fdffae285cfb53e265a36eea7f7a1a39f751a692d7f45656bcb74a0d425

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\root\ui-strings.js

MD5 6902d192e2bbafde121f02a43fe6ece7
SHA1 7d19afa79371595c332c54a1f91f61f40e023d8e
SHA256 4a3219e401896484adb2239dee813d2bfaab27d00a6bdebd179cdd683ffe0195
SHA512 d4ebd3eca90b43c7cf61b6826a86f995e9b5240f75b459e53d0fdece4381216c71794dddcda6b657697f2e068df6a0983bc7d595937bd965c781fde9599aa9e9

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ui-strings.js

MD5 4a8d31070c37e37fef5dd39e425a5e3a
SHA1 1e6a4de3f67be3f82ee8e6a2b89a9aa062976e5f
SHA256 beb063d86dd6d7f0ce73da319c02c3f7e444ed03b490b8640fe0537a95e8a371
SHA512 8516e9c325ec98c0d86ba63dc782910a17eabd37df61f4f5a8fe79d92f596688d6e56a712dac38ce56edab6f8d7ba128bdbc142ec350cfc18b9d782221d07b3e

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\css\main-selector.css

MD5 7216e6e666249b2dbad79b83ee0dbbd1
SHA1 b8d854eeef7fd353e3fcddb787a5fd35adbe303f
SHA256 656aca4617595df6df304699cdd477e593b08a30edca1797e03cd1ca00d9c57a
SHA512 0112dcbdc60f9ddb816ceb7cc6d7dc53e040bb430e58304c4eea4978724f73af4d9fbe2e8e9f8c7e4f7b586b9444f6223b20d53e14ea461ad0122e2f1f82e12e

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\root\ui-strings.js

MD5 cbb2bc42da2c0d3af10a95f4cc47a2bb
SHA1 b1870e5111ae63192c97eeaeaf53edc67a5accf1
SHA256 37507bbd18ded597a1912ae8d185694cdf6866e2d1a83f219b33bda805e4bc11
SHA512 d6992126897c3a4b99d9f8d5b4ff73e6d5837f22112f890a28fd0bde94aafa92337e17ea59b2e2597be0c8bd69a58c2f892d2c440547b0a623c9fc68c71d2e18

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ui-strings.js

MD5 22442d43c821c256010106eb1c1896b6
SHA1 5dda87364e73a5301d655db6f003eca366a10610
SHA256 7748d57bac79af9a827591481c7bedebd398ef71c8772a92e8f81e734288927a
SHA512 7abbcc80e18a30f047ffb954c776fbd99f1850c7671910b46f55adda17918d1fa236bdd4dc3c7499f41172bb6ea443dedf850550c960c54792a01a057acb01eb

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\root\ui-strings.js

MD5 351d1163b587ca7abc245b3ee6c46be8
SHA1 d8c7c98f0c72ff40208fd9700609891be4512f7e
SHA256 e17c9923c2572b7b07a7cde749e6c4dd351b74153d5af7f206c85aeafb85edc0
SHA512 b53168fd6566058242fe643080200b11d3a52ec0731a1aa63f249b746211d716d0e7b09c292b73785592373d6e29ec306577101234655a020169922f8ceba7c2

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\root\ui-strings.js

MD5 1a5f88d2c8a2556da01262a775582c37
SHA1 ded02bc3349071ccd9d4b1bc99306e7646f4dbaf
SHA256 737ed0b0857139813a9643b8caef7a5b532d527866b0b8c56845fe3d66d902ab
SHA512 237501b320f144461f38df044b2f395652ff00af21d43f3cd8e676a4e435c11b5a1ff5eb28f64c088c36a0e14cff61cd847d2736fc9ae9dda628cce43ef94835

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\en_get.svg

MD5 981a1664dd41071e649e91aba48d778d
SHA1 70ee803eba573b97600fe52e736c139aef5927e6
SHA256 2d027122231ab5940d1bb1936abafbdc57141e4412f0667fb0bd21d451a2a1cf
SHA512 d567a16745ce7ec13961ae1acdfe97c34e795e4cc7089726a31b5e48d30df6e5d01b3e025a53e579d2b0cd0a6b86b31dcee18033d4c7234cba1220d55f425b68

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\root\ui-strings.js

MD5 d7e1f6b943ea324ad73d0d7e553a7793
SHA1 5bc49130c0c089692618519437ebc47e853d55c7
SHA256 e93f637a39921499495c53c9429cfde52964df1417a3a34aa36717469313c980
SHA512 811918ad894015bbedd3ad91fe8800163308f06e0e06123ff118063c3625d786fda5a0ddec873f8c305368eaa3b6b77e2b1c02f7f67061fcbbdf0c006d25f869

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\root\ui-strings.js

MD5 95ce3f9df26fbb4b7549bde458c618cb
SHA1 2770c84e811fdcb75ea36ac4a210ac9074f96ab2
SHA256 4351a748a438b8619ed604a7059bef5d6acd69917348cf1d7b6c7858bc31f671
SHA512 5716a2958aa3c48ac49afda8712447090edef40191b26d3060d485d82ed9d53830606c95fdf281caa57cc20673320c9557656e170794bca57347da3ae7ab2327

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\root\ui-strings.js

MD5 ad3677598b86930ed4392559209e26d0
SHA1 e754a8ec52eb67bab3ec36ad45fb3266a0b8f4e4
SHA256 275d11eb33267b22f55811d7f69032683157f2fb88e82952f5b49bdcaeec8ff7
SHA512 473ab503d5c4e9f36fba83583695bc86b2110d6732dfc1c659f57017af56e2dd47b2e53d6de80defa109c9122b7f6bf685de6cd34db20ef0ff78471df70cf334

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\css\main-selector.css

MD5 d6fa4ad84a93bbb4996534ca3a7095e1
SHA1 3e0af9c6daece5798fd99eb3959a1c2e448c47bf
SHA256 113b4def096f218cd751ad25165c06336d18f3e3a34cea6146451ec9f9551195
SHA512 3fb6baa212c00c3bc6b79d7220feffecd4bec71d171181cb279e5b541bfb4075ceefa5cb9efaaf73320d9a87698e2e859910e6ae445c87438a558079a5db696e

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_cs_135x40.svg

MD5 13abc777035491eabc7a11c7aa0baa54
SHA1 70a004c2517014b680ac8f8aaadaec390baa003f
SHA256 724c8ff371f24aa96458d7c749f1c32c208206949b9a096d6b792e3eb0324afd
SHA512 a6a285a4a82aceace77b3f5ec805d83aab51ff003c2a195a658cae52760f94d3a815661663d81785daa050d4e72c2b0ee96669e880262e23674350d2085820cc

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_da_135x40.svg

MD5 85634f3604edd48873219f564011f543
SHA1 1ddf91802635f170c89e1bb1b82e66dfa9f66261
SHA256 ea23b76f896ad8e20c62b767a7267a95dba6cbaf79674b6949e3e2059c1e8be0
SHA512 968105deb28b511974016fc46462edb06c3205cbc84e667859053e0107ca6e6ad22ea155afce4a68393cec3dd4df8597e97bcedc48a50922a0f67868fae3b97d

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_de_135x40.svg

MD5 e33346b865c4d0320004c8308fb198b3
SHA1 056ca0e89ec5c6de6d4575e9b3accf4eadcd78b1
SHA256 43b72d7555531af89180cb49081d0ad78a1b7e23fa3ed0ba7a156da10fb01d73
SHA512 1bc669d0e3e3c623ae75d0032cf88fd95b9481bb07d29f2c4ef90e93bb650ddcc28ab312901e9bde51be39cd1fd55f7380a7d82b6d2000047162c8cc16ded454

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_es_135x40.svg

MD5 b55f8e5b92c215161bc917bf0d1605ec
SHA1 162514842e7b9df2b313526f5ab884adc0da3186
SHA256 01a5c26e665a7e9af9aaf2b3a645b85a5c754c06879be5b37f7c91f1c4369b74
SHA512 22de24c60d725b3aa51853236068ee80ff7f457b885b3904f5f6bd03d9f50bbb0de47ec5d49c0259ed98a4fc2cd5511205ab7bc6d8c1dc0793e1460c306777eb

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_fi_135x40.svg

MD5 d2ba9932ed96c14f27151a84108d94f1
SHA1 f54b6e86d6b7154676b89de53a97ef6b539d45af
SHA256 07011393ff5d4211b8665c6da3017f4b51b80140236fa6fd99db510bf6acba63
SHA512 ed1ae8912ff3b920e62b09bfc3ead94a3ab432fde7be807565671b85cbe66e1698a4930468fe703adcbf7a4646c6376a4af64fec02294e0601909666b0ee4f65

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_fr_135x40.svg

MD5 fd18a4894c6fb4ab76a4cd33f85c72a0
SHA1 fe1f7b7b165bd933489a2173c70abc67719bd280
SHA256 f1a3adb0e013ca14a0bae7c4911460835081407c34d2e25c9e929db01f9dd88a
SHA512 c49db2c0e73beab5aa39e9f07a37fb0b9fe45ac2b9e615c75b934221e1b5d862cde84c556efbb8a11cc4d811ede783d1a7bcea87f50e3354888f60bb6ac53ab1

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_it_135x40.svg

MD5 e2b53848a99109dcd90f1988e99cfcfb
SHA1 d415082ea811823e8c6f86857ed351e9e10427ae
SHA256 593aee3d58f8bb3255110052c5a95c35a71f60376d53f8ca8e14c7cdbda66d93
SHA512 664b0bad367314dde60948fd5edf58d07f0b773c79416b1acb29b23a68a386fb55212ee6d54f1eb244c333d593ffcbb689003e1dd69084c82356396d6568b022

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_ja_135x40.svg

MD5 50b42763b18584ae413ae447b7b90688
SHA1 bb32b0e485b01225dc403de2a91659ba467386b4
SHA256 3135aa7a8605e0e85892b21a1f6ec541f7cd275d5f8d50ebc6931b5e436a49a5
SHA512 5a032906bdc639505ffc6b4ac93afa58a5023fd5492c34e4583b89f6f38590712d696e6cce9bb5f60711a0319379ad84c11e5d80a86c7ecf64ead2f594a327b7

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_ko_135x40.svg

MD5 e21fb6adefc4b5e4fb6e88c756360ee8
SHA1 9eccdc68dadbea0e642f84d4dd981900aada0a93
SHA256 5f2e45575e45a9917cfa62f10b56345a2dc4c64f147c1062e90dd4bd78099f52
SHA512 ae8e7368214f202b39b9c36f9dea10f8b6d79dc2aa00cb795022381eae65494e70243ec125af0c138fe7063090ffe568dcee4def89b99d3a8e64a30226c439fa

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_nb_135x40.svg

MD5 c7f4f8fa61277e2ad0b9a3ca72dc37c6
SHA1 b88aef656770d45f097f193d2aa23e2645c2a0fa
SHA256 12364aa899204a1728900f640851a480feaccbeadee7fa85c28b3c0774434407
SHA512 c2a9eeb3a1f8a816583aa4929724b54175b2cf122eac0b922711d1e40727e666239f762ab78ffbcea9622a1dbb73aa12fc180bdce06f5df882e981242aa0bd8c

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_pl_135x40.svg

MD5 715f85e08e8bdbcab02810d73ecd2ad0
SHA1 872a0248a02a09d50e2a4dbaca7adb91c98bbefb
SHA256 27a79a13b28315cc71960ecad44ca52a885fa8e91951c5cea74589a00232c41d
SHA512 8ef0e16dfef13139a731e19d632184572b3aecc4b52fcb91066b9731fa7e3b15947dc2daa2b3fe8acbc84c0d53ca6e5208ad2d17e6ca4686e2696f2cef231d53

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_pt_135x40.svg

MD5 bfa65ce77591c1dca1f9ddda7e3ffcf1
SHA1 8fc55a00c26afa36888170f679b2ecbb611fc167
SHA256 1bdc489874569a44e6d4dcbffbae1ab8691c30c8cff07a2785784c76106e5925
SHA512 4ec401454f09857692ebd717df189ebeb6ec0687c9d076fc81b3439c230475d1c8f727f637acb8d28d719db26a38a13f17dda97d4db6362695b5a62db9ed1200

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_ru_135x40.svg

MD5 8916aaa771bea8453ab77aa120d79e34
SHA1 9f9515bd7a72bfeccac50dce6791b01da7904386
SHA256 6488f87a39057bf1289e6ba7d0e2660d1b24e6bc4c80633e11e43202837467ec
SHA512 871668ef5d41920e3b34c360e380efb878856cda7f8bf7091b6d96bf3c92e5840781c47fd1d17545d72a8603341023b82500c154e08dd3a24b5befbbe602491d

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_sv_135x40.svg

MD5 2bdf852163722ee18021372e353e5da5
SHA1 e72fec0da35b19cbe2de8d0a9a50ee6b87f2d469
SHA256 4a83e835b097e7ac0adb7083ff0f1dc442de0dc85d2ef4a638c2fddc045d8f34
SHA512 7af7d857ef35ae0ec744abd308963c379cc333f7e70a2c86c7a72e4b4082f9bebef00c8d95fb241e2dddf055d047816dc227a8591456fac541d2a36a4e39cb25

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_tr_135x40.svg

MD5 e24c4dda84729974b4dd821b5977ef91
SHA1 44752fe59e7cb900195a83fba62735a24914dd7f
SHA256 1fc3e08782374f7a490079252c4689ba75abe02dc9f05301b54fcb258bfea3a7
SHA512 cc2f17c50e9afafa41ec9ac0b61bd49b52f88c5c58b9c2e8deed532d333ca362bd2c6e6adac197eb73f104b75c68bed3a5094aaf17eead987f0eae0df43709a2

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_zh_cn_135x40.svg

MD5 6f3c7764525fcb39e089f00d29b0d52e
SHA1 2b8fce0941053a2bf40745b905cc00bac1b43170
SHA256 d0c138105512dd30c3bf14203ad327f68b0179f65042c80065c995eab3f57bcc
SHA512 1584558847c6925a6d2a83b84b2ca1f9f18d3d2e326ca7a2fae9081be7bf47264918663f9cdd10285327b7cd9d06f420ec0264c406e83124844d7a19a2fea9c4

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_zh_tw_135x40.svg

MD5 eeb5e30c9226953d93b363464e782178
SHA1 34c02bc5766d0e251692c89b9119152a5285305a
SHA256 72e21e6c6c9d03dba71e08297e633f58ef4a29fa800137003ee880ebea0154d3
SHA512 0ebae40076b23cc9037be52e0c388ea3c0d2f48760bfa61904fd55db7f7093a5198bef30c737f790681787e228455cbf8260e6f599dfd5d9a7a586e13d1a45ef

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\es-419_get.svg

MD5 8237aac1c1a41de6e4f35035e270f66d
SHA1 2aebe534b40765cc8c1662d45d6221c1a99f381d
SHA256 a289548d334fc3bd78ebcfeab263bb13acb8121083491a4ed9225a5c3040e358
SHA512 db2762776edaa290b5f7125746b7fc3a8d749bb55be6c496219f6d08bff291ae7ce68f3bae9b2df04d8fc7433d9c5542185516aaed8b3fa52cdb7c0b2a671816

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\de_get.svg

MD5 f79177c6f782d991490a31d2f0679f13
SHA1 435fa6f831cf18c94accf3ebd29fbd68d61faa92
SHA256 6637a463e37811b4dda63144feb847a33f6c861530185bf7b4d3a27e76ac8e04
SHA512 2c3e0ab5a8957a84c299db62c28ab3bd1a8eaf4c941678c1852a91c076c5c3c755946489649561976094eaa465623db81418de1890b18c2529bb4f222cb9a8ae

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\cs_get.svg

MD5 ee03e8a73be52e8f7593cd9f805eb5f8
SHA1 892016f01338422f274200e512e53e2ff74a1204
SHA256 d60741af583fe2d34ffd4f11f3c36b614459bcee5d078f00bd813bded4d1155d
SHA512 f29ea8f6169f8ebba8175cc7e18388e849bbc739f5cc34360de29357f2859bb9bf122ae682ac0d09ba13cb6b6528b15b7efeae606b3b95b62f5835b370565873

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\it_get.svg

MD5 100d66a6f09d110d8d17534a0baf5907
SHA1 4b0fbeed7bfa0c79acf49f587ac6bdfe5ecedeb8
SHA256 58bdd55c7b7fa2d4c5d02ab348294d49d5fbd369c0753d34be02a48c5b170b46
SHA512 021110378310d3940ce2e9655cbefb2da204954f8fb3d0e8f4657cf26bd22e9ab6e87011a8969169f55b4ed207380ac852e28eefb213397adf57c6607a3302f9

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\sv_get.svg

MD5 dfcab60f4d40ca952fe0ff2f9a3cce06
SHA1 3603668562c37e44f1bbbbc6580cca366a2428aa
SHA256 992ff92def172bd85037f8cb61221072e5fd6d6835ca51cb671e9fce0e0a11bb
SHA512 6be2baddbe70ba3fa68df672082dd4d44b179c074a60bc1d1875427a9e7f22bc94fd1a1b87ecd77675411d424b0913c34ce47291ed41969a73624b1254ea88f7

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\zh-tw_get.svg

MD5 f5d47e40a564dd7af816463459fb6652
SHA1 57e8bb015f6832053009702f57fe6f76b3a1d783
SHA256 6a339d716463827716c67ebca4c15e85c98720f6e586d9c65bb834c7fda04b3a
SHA512 9ee2f876150a7141da552e381675e00cbed1477b598c4b5ba569fda0b0402703dbfb0c763f41a1ef714247cd4f86efc3aeb27d849ff1df2d4384efea394f1bef

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\zh-cn_get.svg

MD5 f40d42bd9e61c9d58bcfd567000e4c73
SHA1 c8eb08ed53839c15063f94537c55d43224939008
SHA256 21344717babc1885a2da3137fd4120cc96e0d6d92c917058f63bea362c8d3a6a
SHA512 3e01a388e3bc740c038f34df1e1d41ebd67a8358f654a997fb8f2f917ef4ad05a503e3bace70e2075918441a23d47a6df7fbe53ee470af628f877622f3a280e6

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\tr_get.svg

MD5 7548ed4319ce2766d4b543e1ed4dc13c
SHA1 432c4f3682f8242eb3c98f94266cfd5a1b9f32cb
SHA256 9871ccaf68d326096e09f979a8129370142f46375e456d64a74cf21e4d183547
SHA512 cd08bb89ec67bc847a7ed695ce88e505305d479d71ececb7a9f5b5a110b91766041220ffee33008d6ed1faeee14a83125effef71fb57a371a805ad924dfb8903

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\ru_get.svg

MD5 27a699e7f8190aba773787749b8de8ad
SHA1 0cc7ca7e5404c719b21f131920ec6299c3cd18f3
SHA256 9eb8a6cab668aca0bb087c4906dd401be486ab8f6447e14c4549cf7e95d72e41
SHA512 40e047a491e81cac61ff531a9fd106cb4967020f85af9752edc59fcb2844918569d21065a49004dcf92753d804136995914ca18b1968ef3bae0e1fd331b584e7

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\pt-br_get.svg

MD5 c96bd716a455a4dfcca1fa9f19bcdf29
SHA1 48bde96a5fc04121b954e857aad2e953731f03e4
SHA256 c23aa1d916459b4f788710d649afb5bdb6c440c74a325000a8091de967fa16c6
SHA512 4d0a68810b45e9b987ef4caff568f5225ef2be6e6f531988d449f8ec0fe2a1d0bc5ce90ab1b3c682e40798f1d1927afa0e97bf4a538cf9174c2ee8801381738d

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\pl_get.svg

MD5 33a537674378b6dc627e8b449dc456eb
SHA1 db268ec80fb0e23d6f41e50cf02709e8e8c0a26d
SHA256 fd43756a987db2bd9b776b0b25b46236776809cb235deebfed0c29fea734c597
SHA512 05d51ec33bbf6e19c2844d710894245061660d4b80b58c95f1c904a86aa884229796e8445e3bf5afd7eb380c2026f5340c365d5fcc0e9f0cf18d795cf0773edd

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\no_get.svg

MD5 d9b5d3a279c08d5e1cc2a3a239b12ae1
SHA1 d3f6aa7042a5c44495582c5b6ecd157263c1e8d7
SHA256 86e4ea01a778bae2f11dca354b028c3334609ca8f239e3fdc965acc928252c62
SHA512 cbabe87fb48d9bda9a6bfa8f95aec072dd273818ae973ee2f13e9e873fb03188db9e86fdaa03239ac5ee5bff4f778708ffb3d60c1251a2d9d145e04789aa744f

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\ko_get.svg

MD5 cc3444952d74414c352b6e252f40b029
SHA1 58e5d7f092989e5fc7b7e469bc1457deb8715710
SHA256 ab6af09db65ecd099c47bf511f36ef53e71a7387e2c1a0d9e78472961eac41bf
SHA512 03d2d4dc2caafb57ed762960008cb765f0f0d716da73157afc3ecaac77480e8ff040287da73c7ee1712745fe1e205142be0f2959e9b081e1f1c9833f2d16c11c

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\fr_get.svg

MD5 246304a1d4ba2225396a0ec0d004e703
SHA1 f15cf5554198fef571a522352c288d8b75941671
SHA256 80e69f97b4d2456c09bb4f672e88b6b8384cbfeccc19eba88d9b19dbecf5869d
SHA512 b7cb8fecf37e303fcba04b2eae0050986ef07d55f290480e9c3a495d7362d7290e1d541cb96d76e070d357dde1aa03fa314fccaec2d1db685d5df5fdd84af0f0

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\fi_get.svg

MD5 b13f64cbbb4c7e9e548d51cf5219286f
SHA1 bc06beaa7ea93ff2ed12981f5c2604b44090f61d
SHA256 29e84257bc69008552aead44f26ba629fa5eb9c9071cf48fd897a084a03495f5
SHA512 74a7369c96bf88297e6e734e045c00ae577873979bcb0bc3c895428d04a7a28f73ad9a2b919a5e2aae1f0a87f1f9b78254251f9462939389bbd986e579e5a84a

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\da_get.svg

MD5 01e4cfbd30e3056a940e38d74d8c0d86
SHA1 b8e178a7736260daf3470b760d5b5b7a1d3b3d29
SHA256 3308b42f27c7ad04b7ad55757ddc988859ee95574f07b53762e53e0627df8ae7
SHA512 7bda4e2424ac4b8cc2ff0fd34429cc578a6f6f7a70cdd26356a3891a30546f8a7e7bba8cab3bea57d5a494bd3d6cce22a89239e92dc7035c9fc13803b7a394e4

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\root\ui-strings.js

MD5 d130177458950659cb3cb5325cdf1369
SHA1 963d5e38cfdaeeb910349e259cc9fa09c8bc0bc1
SHA256 e07fe018aac18244c8b808e905deb7d5b7293894a839c4a385d6423499012415
SHA512 9450746dc5c06d1110598afa0fb2e4cecb1add1d8cda41627b6fde77ddeeadb9d1f0a17741ddde8244fc595254e29206ada12aad588ae1c8609f83faa3e0f58d

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\ui-strings.js

MD5 30c716513c60a3a17adda064759ffded
SHA1 358aad8867247614e1dbcbf107d9c32483b8afac
SHA256 f0c25e46886a674432afcc20c7b44db9023a0bee892a24efcfa789645e705beb
SHA512 29e923785909cb4c22208a0dcf6ad99f58040a9d8c4a05f001b0d7a38e83f130f8a822758ab203d97c51cc926493f8ff02788d0a365f6be8d5cf3750b1333a32

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\css\main.css

MD5 1b02c1d3636f1c3baa1dcecdfc02aafb
SHA1 adf18e3e720b6933b4251dded782d610408538bf
SHA256 210f263a264b040125014466bb5dd7def8961bffd1184dd3e9dded0a66cf7fdd
SHA512 05e1125369b664415886e08334db107a056cb87cefe2a42c1030dccff96815a987d3d64f309744bfd4e169608678b844df295ba373b6a4d77eb76c6b904b3ec9

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\he-il\ui-strings.js

MD5 91153740039dbff7602e91e0faa73413
SHA1 58a6310636241cdb6ddcfb2235b1ca1fd66ddcf8
SHA256 805d7c17737808c901f6228e7b0b48ca572204b559f3413bf29e562e89f57466
SHA512 ae1c5cd283b15388d19572dd21ef675ccaa27f1cfd2f4b8cdd2f84efdced185dba5ae509c68ba8bf9336db268c9e1e211e801a0511cc764846b3cc9eb7de5906

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\nb-no\ui-strings.js

MD5 c5c27543c5ce15def040d118269db509
SHA1 1b18543861a5c0c619f53e5cd55d3addf02d0994
SHA256 d11d893741eb9b71570f3fedbe9a29af6df5efe6fbd073159d9dbc13371e863c
SHA512 97a9e7ec6d53ff679538b023e96f126cac02fd820c391b6005e60f707205c2f04d741d7c49c53f8f247825b2400971ac0f8298a26d3e00fcc40862cfe9af258d

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\root\ui-strings.js

MD5 53c39b7680ef9c0754ced43c6fcdf92b
SHA1 d1b79b484c7a914e661de9f6177e5848578a0ff9
SHA256 11fa0567575cb92cbcf372bdfb680719b0a4cab109aafa3c91d1e5621ae83d14
SHA512 44bfdac4cb0cfbc944c822527d356ba2bd59403664a8982afbff4b70a1f011625acb872df9bd15926b35df88352920cbeae5cb4146f2dd4765745cf0a913b6b9

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\progress.gif

MD5 0c0de1fdc6e6546930eb77219b5626f9
SHA1 dde1943cb9ee194d6efcc343f79d1e19d8d6001e
SHA256 184dcb1bbe43f283ff08affc4f3a4f5bf773111d7883ce1b1d3e53c0f506eb73
SHA512 cf5793976c9f89f1542614e663b18f7a2a78d8cba6b58cd48a03d57785c13d8302fceb1198bd2d6aa92051a8c183d5d7a82a260b769b108a3f1df3880f3376e8

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\css\main-selector.css

MD5 cdc9bd4e564981ca42c107c0276c11e9
SHA1 4604a1d7269b3b53d0d511cf56fceaa4eaa8122a
SHA256 7f37e22cffdde21515c0723c2d335b58ab00e0ce2aa022e540e69f889ef0084b
SHA512 76317beff9a31819c8d23f4546aaf04ecf3bb3c49c3d6b0ba75055d46222dcda53da3c1ff15d67fe719b7b64d6f854aa7a4b827ccdd59c67596a3a3de6c5929f

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\faf_icons.png

MD5 441cca46165f4e6ded7a92ef06ba1d34
SHA1 9fc4b4f898c74bd0e2c61d734cc8ae31be3b3938
SHA256 ad141772e4966de480a55d03cf45affbed2026eec8c6cb4775308c7a22d21a18
SHA512 9c7a055dfac869188c13dfffaac1f93a4ab2ced234ac17054a8dc11d9ab70801aee35b088f76474897f2d27748aeb1a2f0fb4681e1e66c14f3c2dd281c4785d5

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\root\ui-strings.js

MD5 98ff5af89401be895a5dfe57191c59dc
SHA1 a8997c285232db034b9f54c23289c6179c81f8f3
SHA256 804ed85749a2eab833e2e5fe40d085b18ebb8d8f4df2f2f592188b0927d5c7b4
SHA512 08f02344563ec9f167aee980309ac84b6e9a4a2765973f19c2a2923d5a75c78976c7f8cbf931f5e366a0ec64cf8585cb27d46143a943622b40c3a18016b5e892

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\sl-sl\ui-strings.js

MD5 72197dfb320c2d3d60250cb98dfb9e5d
SHA1 8d1522be5ac4b9ae9facd9641eeff4a98459b41d
SHA256 b3135e205499ac1c7f996a8cfe9a5e9d8fb6a6a013f2503f8a8c63962e64a94d
SHA512 a937dfd87a27f6338e7d89f7a3a3b3d5420e1075bd12a774452495b3c30799e6e90e187083be4bb36919513fd96f6d365910579a64cd8d0787ad6ab7b5f2fe53

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\root\ui-strings.js

MD5 45554c8186e4e8b86e12bfd90a1a07a6
SHA1 66ef204c2e654ca2832b6ddbc5eabb122285cdb3
SHA256 d626c67dd1268294d51580ab3d0901717f087313ddd553971ec341f6f381676b
SHA512 e06c8285b01a237276a4583232b632c4e4892780306282f57eb1c92c04e05e295d27ad1d73ffb85fe37bc04ec6ebdf7c87ff4eb6defdb82fd6553e6c8434d765

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\bun.png

MD5 62d7fe65864d182da6e22e4375db8c72
SHA1 9828eed5326386c4df0dd5c5b61bea47dec6950b
SHA256 883e6f277f41922c06b58a111b564b5fb8def7f69cd570ccb0008afa5a709ed5
SHA512 e2103ba8c9c99676d88090cd407168cd2dae945df9e9e4d209f08843adac58f7679f7df2ed7409c1d77fd79519811623564447d8c858288dbef6736282f5fb47

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\cstm_brand_preview.png

MD5 634bd2d4a38ef987ad81f54ceea33c49
SHA1 dbc3b6b2c0b27d4830c2e5be9905a87f9e4407e2
SHA256 56c0be56f448ccdbf5f2966b1c0fa437e6f63cd1f48500334fde33f42d5a30a8
SHA512 b7cfd75f1cd3adde1b3c551e29a4188467a921633ffd23463f31c2b7825cf66747deb154ebe714c5c416f7a0ebd9881abc190e7cde2d34ef604470f630f16a95

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\cstm_brand_preview2x.png

MD5 57e1cb68905dd2b2140953aba6945b36
SHA1 3f3b6bf8af9b99a9bbcd9eb01e5c29001cc24177
SHA256 d5ff81a50326669bb5a275e33dd2daa2c0cd62369e07a2bfa99e321124d83e0d
SHA512 5c391c41a17819c42a1fa3e33ba312ecca22b1460d3d0c3e119204a6612de622a9fa8f7fb328a441187b6abcc9bab0f7bf44e92b518a8c3e64938cfc2268e2c7

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\dd_arrow_small.png

MD5 57da82e3555db7aa1b7681e0f6ac73c0
SHA1 4109c63e83566b7bd4284d880e6f9238606af679
SHA256 b1ccb5f8d838da3a8d852197f9ddb527eaf20d23d71be2e1099bd35df5222e59
SHA512 d82b37fcfed29bf72e253c1efbeb6d56be0c95894959987536ac10d1d05bbfd0ed5189906ca1697b707761f039310f5179a7c3ef6f87a7bfbfc7caa84212b1c0

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\dd_arrow_small2x.png

MD5 b9bb61838fb4e586adc73f34d68a14a0
SHA1 b15d55a85f0aa73e2dd93016c595ba82dec42576
SHA256 f8c121c028bc56988cd9c40a9dd58cdf1467dc24dc1ce9517bad523aa5d1e71f
SHA512 06fbd91d9b9907f87e55b42e74b41c38455151f48f5165dc985911c08fc02d5e691048e3648a66f47d5c42bed22186859425747582bb89745ca4294a45c310ab

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\illustrations.png

MD5 a385655c6032fdac5d4ec32066d867e2
SHA1 fcfb769b3192ce71837503654dae91bb6f3e1603
SHA256 44efe008d89ffbd5deaf229393701fae14a66e032ebfe929361117f6b740e818
SHA512 7d1381426310387ec1e384d4c04f18fcccf6a60f2d2f5f57514c5090d8f76cb9117b53fbbe397fa84890ce1d707abb3dc19804bf73311d52d359182acca7121d

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\nub.png

MD5 6f3a8dea0af401685fa3cfc5d6fa1ef7
SHA1 6659bf6ec4ffdebaedf1b9787f5bbe0fc64d5490
SHA256 f56fbd8b3876c69b60b83665d294693c0e3ab34bb47a71dc625b111b340ecef1
SHA512 868c8bff46432761d4ca31aeb82242197de4c884136e22b4e6d3c9f2991ef760b6e2af1d0d1ca465b469ed65b0ecd8a300dabda384028d5a0110a86b231987e9

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\share_icons.png

MD5 0dfb59debb93447b6548bbdb32699e09
SHA1 d3a09afd5532e2e45e0462ec5f36be536e44a2d7
SHA256 39ae0dbeb1fd69166b453ae73df078c066fc9e399968924c1fa64e31210f0706
SHA512 7720237b5dc3e162b7d0ca67a9f96df176bceda894f4071ed72a6d9998a47149297c0ac7efda5a35c4648819837497dbacf9e59ca469059dbdc5f3b9160b6de4

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\s_thumbnailview_18.svg

MD5 d34b00f7dcee4307c05b9e11adad8381
SHA1 36954b9c4d7c07ed355a54852fab558433ab79fe
SHA256 ecc49cf8bfe9068de2a2dd6d3f11e150a1983f336d3eb6258208e4b913d5d962
SHA512 176ba23d772873f7091b64d6874135818e5e0abf2fc5d8ad191a8e1137def07f7fa4a9e3f95a17e7562456c3ae5aa84d41c43729de9a49f153df5a0c7a4445c4

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\s_opencarat_18.svg

MD5 a1bb3dde007d28ffa792cff53b17e437
SHA1 313711ad2e60c5cbe16862597d6949f3b441b2ec
SHA256 5a147b76c182ea48fc00f03a2e6d23d7aaf052ec4bb40bce49e24150a836309e
SHA512 1173118f0a4d20d59aa5cb2d37e3592403cffe18e946bf205530b197c3e30a925fe6e49f4c7db03f8ccd4808b1d6a80f9e8a8050f4a5466840963cb7dd7d5431

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\s_listview_18.svg

MD5 2078de0985666e3d4cba09d542e0e5ec
SHA1 1cfeb9215e632b4af798565ee0b0d76a3ee0d752
SHA256 3ba89b252f98b27ed26aed4b570f454800f05756ea792a277747d27e9fe335a6
SHA512 b76eaa8b8d258b78d6a1c89f4a080b74c7608fbdbb5beba1e73efe294e58e16dd21d25bd23d8801950f85733902db373a2c89390ed134e5d5d662819075a9168

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\s_filter_18.svg

MD5 5881e971cd2d9e3fd59b3d88047cf941
SHA1 f96aa7eff71e10c2bed32cc9dc20726f756698a3
SHA256 3774ad2745302b9157fe8dd7e57e929fd92c8befb533b1f98089eca0b1907c69
SHA512 adb850182cb2c94922cd9e4a11e4bc6e2fecf69ec076501fbdd15f8463655ad37e174db136db519e7a8fcc307931dd65a39a9f828c7dfdd255b4d952350542a2

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\share_icons2x.png

MD5 abb64d05cf8d02a6665cd127cfa00744
SHA1 d3f69d18ffed13df2dd4f6da3de0ae419429be41
SHA256 a0ddd6007a996bbb1eeb8e00438cb2d424b237ae1fd783a163aba017e9713cc2
SHA512 b88e0ae9c5eaac55859569e5c37c729caa4dfc19c8f4b05468bbaa9cbeb5dba5e0b718dc3833168f6b0ffedea7b6f50824b8a87c81cb230c2669d04e7bf533b9

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\root\ui-strings.js

MD5 2e61e368c8ac12a0fdc96aba747b7e32
SHA1 1255f123bb18cb0e089d91918da4c93d3ca07f19
SHA256 af73b5fba1690c9d59e94540ed5e08208493fa107056f7acb9039754c2f3ceed
SHA512 7883418103424f21f94799567dbaac5acb910fcc3a9020940751c4b04ad6227b774f46ce49cb8ddafacc0e1d40bbb480de0c6d5729eb1750827c4861de921fb6

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\themes\dark\adc_logo.png

MD5 2d2e56fe0ad4fe0def50cdefb9b5b8d5
SHA1 ecf9319bdf88f99c758c3d635291b8f5de7f0efd
SHA256 dc4e443b737f290f2e6fade5fe327745e443e704ccfb0b03fbe788675abdc1a2
SHA512 bd4b3c0982fdc04cc3e228724104889857c25299919aab61a4f57e947341f3f3142f483eed3b043b31027e81034e71787d3987011e502415c0f6b83ae4d22908

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\themes\dark\logo_retina.png

MD5 d6a7b8e78cfe4d6354fed94bcc1a5973
SHA1 3018bac7a94515cafa4eac9506e36ba6e574f224
SHA256 c4fd5767ab3a424520de2afbd7720ef49bc8cdd3f3b6ffa59d5d8f314fe72bf8
SHA512 52d840b1b5ab44a0a261190bbaa70855216f091cd28fa67d878e960517d6bd9d126ea3a015ea3cf6237148391def4c13e73dbcc64666713c2c104b507d7a25eb

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adobe_spinner.gif

MD5 80f2a9b1aafe22b44d66404f0d2f2b2a
SHA1 e48abe2887ee47d549eed819e58103024cfd2dc4
SHA256 f4d4d8f6d6f0e2c390dd7394b0de5b20c88b633bfa95a37fb03420f11ef3f742
SHA512 acbcb1b7018cbc9ee4255a5251ec608449b27546df897db8f0b46d0331bbd733c13482a5e044d2c15b64770d73a66187c6a06c4de6563034c66fb9daf19c4379

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\dark\sat_logo.png

MD5 6d1fb3f921153414a09b59f92a9d4570
SHA1 597ee92b8335c8f05b7b5eb10068c2c7011d1ea6
SHA256 01b9d46d13e94dd8d747e578e0412780380a3eeb8edee8d5b3530f58abbd8d8c
SHA512 bb5fd1ea2ea3f158b06222e4e68292497b5d12d82eeb120d3c246e0718e27562a618a75ba24f8ef15db7d4eca5857b8265afe9967ff0b1bb00b4b1bfc9a957b6

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\dark\sat_logo_2x.png

MD5 a0c7562a5b73fd94d8c84cf7115a5d1c
SHA1 0897d84640c77a34c0ca51af307361d15aa4b1b3
SHA256 5027b8e385c60d73d54c3ff6c27ad4e2db929ec413e7c70d5e1d9c3c147f956a
SHA512 90b4602e507a2b81738325a93eb8eaafe6727785d04205f34f7bf851a9e209ba0e18c97b27c078abb402e449847dfd375985af54bfc3fa538d2c2cb59251e18e

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\en-gb\ui-strings.js

MD5 899284fa374e971e4f75a6aeedacf484
SHA1 117b07fddc2785854b801b0625268216c3e5d63e
SHA256 f61fdd030b1f48fc3360c7749f887c4bef125b8dd77222847b340976050bc716
SHA512 39c5c3a56efaa548b4242fb66d02529d684de795e7365cc4478b7f37948d676c44f6a0793b2aca3b00d0401fabe8e38e4a89aac4c228e1b090a7586fb3d77e95

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\root\ui-strings.js

MD5 dcf0a1c476ed3d386c3551a6bd50061d
SHA1 812c865dc4dbad7f72ebdd64996d3ec4c4000da9
SHA256 f801b79bc4ba5f3cd3aefb20be2702135a45f0dbc552733477365685bde6c1ab
SHA512 914902b5225910bbae33acb4380ab7a2de238abf33a3ec4ea036eb38405b90151a5169504613eb71e2cb37fce2c274599826011c375f92a6fe6e3863953b4bb1

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\es-es\ui-strings.js

MD5 e2ae53aa5a2c598681a7c9e904c27b96
SHA1 78b0f87a983dc4ce7e011ed96b1a6b32007bcfbb
SHA256 faa47a12e8f62762bf0abcbb9df23c575e9765309e0f08cd229ae73ad70bb997
SHA512 fa23216ab3446a7d0d83fb43285df7bd10dbc0b5fa4d631f459fee36a7759816f19a8f6c0845abc5173cb44de5738e4b300c15c8d7209b17c2cfe6ee6eca3eb2

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\root\ui-strings.js

MD5 a7d7cad3dcdb4c089a429de4306efbf6
SHA1 2dfa9254396dd7404d107cdfd68b2e6779253b8b
SHA256 e9d975742584387f5627f2460ab1c8132e98c6d24f666ef894c7b45841b65b5f
SHA512 10b680f098f82849c5678340cc97652d95ff08539165c58ce4965f38258c5e4fea72c327a3c3abe46856294f4b22c17f93c2071d4805db989387ae282fe4dcf9

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\ui-strings.js

MD5 96741e469a03df577a7e5942efac2ac6
SHA1 d10bb2e2a434995cf89339b7681d858ad2f5304e
SHA256 3d5a6336e718d20011cc9e2c276ebe07e446aaf5005b06fee912c7f624a6c8a6
SHA512 8bf66a02eec9a5dd367ad764c9155d449802ae1a4ac8774bd5a0732f0f1af8c666d9d2fb724ec178c549fd7e2de2783f2cb0a6a2b624312ab7550555d458ac09

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\he-il\ui-strings.js

MD5 174994848307d8fa83510d8e7591a6c7
SHA1 994473a1df88eb73ec21a9a3790e5e9c84584619
SHA256 e41a53cff59b07d5ff33e44683a33e0be7743698c127ff0ea0d0f8ace1b01158
SHA512 74b1c2b5d1bda6cc5726c8ed221bba702e938113ba006cb8b594040085ec41b764a1721f5e064b27d53ac605a816499bd86c2cd587c69089d68c35468c06a2f6

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\root\ui-strings.js

MD5 af496f1bc6d26d05e72e7374a826e869
SHA1 467ba54a8e609db990803acc78f4dfe88ba3fd7d
SHA256 e93cac070441fc929c1afaf073179e6a70fb4da5bb4982794a8bb95e6cd417cf
SHA512 8fe535cb3d96a5d50b98cb6f438483ec742ebecf25bbfd5c2dd82b18df1d2b159263aa8763a965460412afd17c04326ea05d216263084e06720502013a8024dd

C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB_EURO.txt

MD5 8e19ce5508a009dc745003b1316e4c8f
SHA1 22e52acffe2fa1b828702851a4cd9ed1d652bc92
SHA256 93a19c7cea1f3300861c03537c1f7cd3535b99a3ab1548e548ee4b17beaddc58
SHA512 c570666af7fbde5e43cf5a6f784585cb307e128cb78895fb6500d5ef3f6c5b917a23f86829d02ea453bd1b047162397db398614197f6b6b9662cef25f4a9a663

C:\Users\Admin\AppData\Local\Comms\UnistoreDB\USStmp.jtx

MD5 45de0a304f350c2b3c715c40fa0084ef
SHA1 57ac7fc96abbd5210f00c0ed30a3ecbb417b41e1
SHA256 e6a3ba2f8b430ccb8a171e4737d5887fde5114db465212d38726d6e94e5be6df
SHA512 a838758acacf19847cb7790d52ce39b6523487da2f78f6ebdb7e02c3b5318a1741ca2742110b9b05deacf113a8a9fdcd5fcc693e9e1911ceed95e73daf73faa2

C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\winword.exe_Rules.xml

MD5 d17cb425bd7c7cf6b58bfa87223a3368
SHA1 20e80ceea3e4c7fb1168eae09dea9d6946c96140
SHA256 25d713340f8ca5bde01c59d7ac4464c77806d3a14fda9ff436acaa3b0af19f09
SHA512 36e756ebe7df0265efbe7da63b75c59456bca0a3ead62deb8b49d6dca87c4772d67a9983fec44b169441e77269b4cdc9396dacedd0f4f8e7490c76632d9add21

C:\Users\Admin\AppData\Local\Packages\CortanaListenUIApp_cw5n1h2txyewy\Settings\settings.dat

MD5 d9db487e1476abb6229328fb45852612
SHA1 c7373d4e556c46d9917c9abc085f392d39828232
SHA256 2a99d2c5430363dd25dc86c9eaf7eb4284ce8ee4b3e6c324b572bc6fe253d472
SHA512 18f06438751f016600a54dbb25338d9da710f477614d8290929feb1d00aab21f221d420160152553935838bcf7a53cc4c2988eddd4cb00fa93f2573f3c971ac4

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04

MD5 e4075153c3a66975097273633040f88a
SHA1 c8267ecab0831431ecab6f1c1cce46fe6d30a441
SHA256 c00a4b45a90683d45794a0777b89bcb69d660866da26ad0ed839e307466d0820
SHA512 4173209de99d94b9db4ce472c3a487d8896551194bfc5ce2bf32b7fec37f95ac623120a78508cfab95eebe50a888d9b0ad869a1ff9ce3c49971c5638379c8c27

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\LocalState\AppIconCache\100\{8525D3B8-B30D-497A-9CB7-C496A7C2569D}

MD5 49314dde1b7a893ed68b1ea3c79c4462
SHA1 8715cb964dc39763234a7b92a8a5a4d21e385f8a
SHA256 8c676a3d9f7b87f69563156871ee3c8f05cd2a9d5b522c876341aaa28819e593
SHA512 9de09ec2388759d154b5e518c97774d39da3897fc84b68b3f2cb08e52450e576c073f3f71cfa1c0b94763b1bebc3345f7cc31bd6c13df38e335adedcc6c58aff

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\LocalState\AppIconCache\100\{CD4DEEB5-DC4A-45AF-B9A2-15A516B2A6FE}

MD5 52700abf57dc8b311779bb003fd9e0cc
SHA1 5843dab16b69acb556160b38dcc5e6894127abea
SHA256 512967d8f4ed7485353abc2a08afdac5cfc05ed8a2e78eb57ba9cf0b824b0d0c
SHA512 fd0968ed2c8fb327d156bdc62a63e00052d0ed976f56db9768a43b5941269dfef907157c863f2764c44d4dbe0056ec6ee6a26e287a8c7d93f4a753897804c31a

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{c152ae75-f75e-40b8-98d6-484119d344a4}\0.1.filtertrie.intermediate.txt

MD5 e93bd26a9855760c958a98f19debb715
SHA1 9b14d074020e345836a1a6e629411ba03059089d
SHA256 63de8442ffc426d72d3aa61912d73e3a3cff44cd52e0bf30d00f07b430256e1e
SHA512 57b9049a88a7da286398ef9a321d50bd7f1d798bc675f7452d1ea272d01085390e9da506af5e95093f76153bf39d2e6956f60306b80de922abde87fb5582721c

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{c152ae75-f75e-40b8-98d6-484119d344a4}\0.2.filtertrie.intermediate.txt

MD5 5ceb0c0588f13a6803da0a41c0461f85
SHA1 771c5ebf6502d0db97b2e81dfeda4328706fbed3
SHA256 d357a1229063990f3fd8cd43873413a47bf4000e901336d41304b3a63d9792b9
SHA512 87ed5dbf7ebe30f4e67fbe854404709e335eb6b0db4e00afa3f0dc3b4206dbf6e74e3ef8a20a1a13f01e988619bb3ef0cbc8837857a8acfcc87cbfef8b22a875

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{c152ae75-f75e-40b8-98d6-484119d344a4}\Apps.index

MD5 c2fe0de8af7e7df67baea39bc337b111
SHA1 c2bd31e5fde70e5a82ee22490070e0e07fdf1861
SHA256 8811809ea12e3301d0e6d6c44eccfbf7266759bd0cff48fd3019dd487f384cef
SHA512 3310b6f8f001f85702ce9600348cfc7b1b886b879e2d7076a5edfcdd48ffbfba272963871f226ea54c45feecb34eca04f8e5caa737bab14922f05de61935f53f

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{f3271623-6e8c-4b45-8c59-0538ad01f718}\0.0.filtertrie.intermediate.txt

MD5 5a7d185586b8e09b73157b3596a7c842
SHA1 ef367c8a8c35cef4435911180fe45258f0e3b2d5
SHA256 59b9f6895f9c79c14fbff5c27e1e945a8c00d21a63866f1546a53067ffa90d99
SHA512 5d27a402c8b1d55c8cffd59ab2e5b2632072a75d0c0b4cbaeb830016196d7fac047ac930b1ae6eaf8f5d2ddffae051e8cc56dd3944b9a3e889a725a937db1e54

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133567066558862035.txt

MD5 e749d50b676a361c51da97ae6e5e6eb8
SHA1 7ee665a641553cfa21f22e824d54f02526542359
SHA256 31c29a8a1c02dc542bb725d44876507a454d658980e900605ec754de70406431
SHA512 2fcf8424c999da484fdd2e4cf2a6560727720a896dcb3a6563df92c9729c47ffe7db2163fdcf501a2c19aa7dafb9f5ea0872d6c57daa97d6f9548843ca795382

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Cortana_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133567074226908351.txt

MD5 29dbf4fcda2832ac0367b1836cb8a40b
SHA1 d3b5a73bcec14107d506ed6aac4de4318de3248f
SHA256 d82be66918486f420969749e0b3c9593d797474891589317690250796f9f72cb
SHA512 9bec4ae7879e9d317e440c3af0aa59481fdefce11182af50649ae17e7a987df7b3d51e2a4b71aad4bfd0b9e0e30895b4ea8f1f146e5c6dd15fa222ea5c0156f2

C:\Users\Admin\AppData\Local\Temp\tmpDE1.tmp

MD5 130992b6d334f172faef304f48a7d30b
SHA1 3a60034ba7ee08406f6c4bb0d2eb8513b5f8a760
SHA256 4b57e4e1fd8339cf9d7558487c52939fcc57b923543cf896707491f4f66d536c
SHA512 c1dbf1f0387caa5885f53cf6e4ff7de327362efb6d3550bc13ef7b7aad80f50a832d67108552a09ef2008806d7c08a4447764b3213ac24a6c854dd46aacef4fb

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A

MD5 21b8d3304548cb919a7819ad9deb1d91
SHA1 5b7d37210c3a67a514e0ddb828ba294e86a235ef
SHA256 6ae0601c47bd03654b795fb79f2b50b4ef7fa86ab3433659a9d3dce48c022282
SHA512 e9f8c44ace26a008178ab8c0b67953daa990ff542f87ed04b0b5c6e9b2ea5e261b9c565da1464c9e7fc717af546749603516eeb028a09904e3673ac4267bd3bb

Analysis: behavioral3

Detonation Overview

Submitted

2024-09-29 03:40

Reported

2024-09-29 03:41

Platform

win10v2004-20240802-en

Max time kernel

30s

Max time network

32s

Command Line

"C:\Users\Admin\AppData\Local\Temp\PCCooker_x64.exe"

Signatures

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

RagnarLocker

ransomware ragnarlocker

SquirrelWaffle is a simple downloader written in C++.

downloader squirrelwaffle

Xworm

trojan rat xworm

Deletes shadow copies

ransomware defense_evasion impact execution

Renames multiple (6873) files with added filename extension

ransomware

Squirrelwaffle payload

Description Indicator Process Target
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\PCCooker_x64.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Bomb.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fd4ce0b0.exe C:\Windows\SysWOW64\explorer.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a76e49df84ba2a7b33e8ea959995b5e6faecb90d551ef169d8272ce9042c35a5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CryptoWall.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\24.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\23.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\21.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\20.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\19.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\18.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\17.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\16.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\15.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\14.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\13.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\12.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\11.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fd4ce0b = "C:\\fd4ce0b0\\fd4ce0b0.exe" C:\Windows\SysWOW64\explorer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fd4ce0b0 = "C:\\Users\\Admin\\AppData\\Roaming\\fd4ce0b0.exe" C:\Windows\SysWOW64\explorer.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\asena.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-addr.es N/A N/A
N/A ip-addr.es N/A N/A
N/A ip-api.com N/A N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PHYSICALDRIVE0 C:\Users\Admin\AppData\Local\Temp\asena.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\RTL\contrast-white\RGNR_6F1190D5.txt C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\selector.js C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ar-ae\RGNR_6F1190D5.txt C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\RGNR_6F1190D5.txt C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\uk-UA\View3d\3DViewerProductDescription-universal.xml C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\SplashScreen.scale-100.png C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\AppCS\Assets\FaceReco_Illustration_LRG.png C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\LTR\contrast-black\MedTile.scale-100.png C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\150.png C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Square44x44Logo.targetsize-24.png C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteSectionLargeTile.scale-100.png C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\LTR\contrast-black\MedTile.scale-100.png C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Functions\It.Tests.ps1 C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_ca.xml C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription3-ppd.xrm-ms C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\AppPackageBadgeLogo.scale-400.png C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\da-DK\View3d\RGNR_6F1190D5.txt C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial2-pl.xrm-ms C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-black_scale-80.png C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\example_icons.png C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\example_icons2x.png C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\locale\kk\LC_MESSAGES\vlc.mo C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Thumbnails\Sticker_Icon_Sunglasses.png C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.targetsize-16_altform-lightunplated.png C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-80_altform-unplated_contrast-black.png C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorStoreLogo.contrast-white_scale-200.png C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\uk-ua\RGNR_6F1190D5.txt C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\images\RGNR_6F1190D5.txt C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Functions\TestDrive.Tests.ps1 C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\pl-pl\RGNR_6F1190D5.txt C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\he-il\RGNR_6F1190D5.txt C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\cy\LC_MESSAGES\RGNR_6F1190D5.txt C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\km\RGNR_6F1190D5.txt C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-30_altform-unplated_contrast-white.png C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\en-ae\ui-strings.js C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ar-ae\RGNR_6F1190D5.txt C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\RGNR_6F1190D5.txt C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File created C:\Program Files\Common Files\System\msadc\de-DE\RGNR_6F1190D5.txt C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\StoreLogo.scale-150_contrast-black.png C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteSmallTile.scale-200.png C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\AppIcon.targetsize-256_contrast-white.png C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\zh-tw\RGNR_6F1190D5.txt C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Locales\az.pak C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\lib\security\blacklist C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteAppList.scale-200.png C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\LTR\contrast-white\WideTile.scale-200.png C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubBadgeLogo.scale-100_contrast-white.png C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sv-se\ui-strings.js C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\pt-br\ui-strings.js C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Locales\el.pak C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneVideo_10.19071.19011.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\SplashScreen.scale-125_contrast-white.png C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\ko-kr\RGNR_6F1190D5.txt C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File created C:\Program Files\Microsoft Office\Updates\Download\RGNR_6F1190D5.txt C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\done_listening.slk C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\nl-nl\ui-strings.js C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\SplashScreen.scale-150_contrast-black.png C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarAppList.scale-200.png C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarSmallTile.scale-125.png C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\BuildInfo.xml C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\RGNR_6F1190D5.txt C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-100_kzf8qxf38zg5c\Assets\Images\SkypeWideTile.scale-100_contrast-black.png C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\FacebookDialog.xbf C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\hr-hr\RGNR_6F1190D5.txt C:\Users\Admin\AppData\Local\Temp\asena.exe N/A

Browser Information Discovery

discovery

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\CryptoWall.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\PCCooker_x64.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\a76e49df84ba2a7b33e8ea959995b5e6faecb90d551ef169d8272ce9042c35a5.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe N/A

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000b58935fac5ebb7730000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000b58935fa0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900b58935fa000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1db58935fa000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000b58935fa00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 C:\Users\Admin\AppData\Local\Temp\asena.exe N/A

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\vssadmin.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\CryptoWall.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\25.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\23.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\24.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\22.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\21.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\20.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\19.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\18.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\17.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\16.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\15.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\14.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\13.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\12.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\11.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\10.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\9.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2364 wrote to memory of 1752 N/A C:\Users\Admin\AppData\Local\Temp\PCCooker_x64.exe C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe
PID 2364 wrote to memory of 1752 N/A C:\Users\Admin\AppData\Local\Temp\PCCooker_x64.exe C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe
PID 2364 wrote to memory of 1752 N/A C:\Users\Admin\AppData\Local\Temp\PCCooker_x64.exe C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe
PID 2364 wrote to memory of 1848 N/A C:\Users\Admin\AppData\Local\Temp\PCCooker_x64.exe C:\Users\Admin\AppData\Local\Temp\a76e49df84ba2a7b33e8ea959995b5e6faecb90d551ef169d8272ce9042c35a5.exe
PID 2364 wrote to memory of 1848 N/A C:\Users\Admin\AppData\Local\Temp\PCCooker_x64.exe C:\Users\Admin\AppData\Local\Temp\a76e49df84ba2a7b33e8ea959995b5e6faecb90d551ef169d8272ce9042c35a5.exe
PID 2364 wrote to memory of 1848 N/A C:\Users\Admin\AppData\Local\Temp\PCCooker_x64.exe C:\Users\Admin\AppData\Local\Temp\a76e49df84ba2a7b33e8ea959995b5e6faecb90d551ef169d8272ce9042c35a5.exe
PID 2364 wrote to memory of 3112 N/A C:\Users\Admin\AppData\Local\Temp\PCCooker_x64.exe C:\Users\Admin\AppData\Local\Temp\asena.exe
PID 2364 wrote to memory of 3112 N/A C:\Users\Admin\AppData\Local\Temp\PCCooker_x64.exe C:\Users\Admin\AppData\Local\Temp\asena.exe
PID 2364 wrote to memory of 3112 N/A C:\Users\Admin\AppData\Local\Temp\PCCooker_x64.exe C:\Users\Admin\AppData\Local\Temp\asena.exe
PID 2364 wrote to memory of 3560 N/A C:\Users\Admin\AppData\Local\Temp\PCCooker_x64.exe C:\Users\Admin\AppData\Local\Temp\Bomb.exe
PID 2364 wrote to memory of 3560 N/A C:\Users\Admin\AppData\Local\Temp\PCCooker_x64.exe C:\Users\Admin\AppData\Local\Temp\Bomb.exe
PID 2364 wrote to memory of 1444 N/A C:\Users\Admin\AppData\Local\Temp\PCCooker_x64.exe C:\Users\Admin\AppData\Local\Temp\CryptoWall.exe
PID 2364 wrote to memory of 1444 N/A C:\Users\Admin\AppData\Local\Temp\PCCooker_x64.exe C:\Users\Admin\AppData\Local\Temp\CryptoWall.exe
PID 2364 wrote to memory of 1444 N/A C:\Users\Admin\AppData\Local\Temp\PCCooker_x64.exe C:\Users\Admin\AppData\Local\Temp\CryptoWall.exe
PID 3112 wrote to memory of 916 N/A C:\Users\Admin\AppData\Local\Temp\asena.exe C:\Windows\System32\Wbem\wmic.exe
PID 3112 wrote to memory of 916 N/A C:\Users\Admin\AppData\Local\Temp\asena.exe C:\Windows\System32\Wbem\wmic.exe
PID 3112 wrote to memory of 1088 N/A C:\Users\Admin\AppData\Local\Temp\asena.exe C:\Windows\SYSTEM32\vssadmin.exe
PID 3112 wrote to memory of 1088 N/A C:\Users\Admin\AppData\Local\Temp\asena.exe C:\Windows\SYSTEM32\vssadmin.exe
PID 1444 wrote to memory of 3184 N/A C:\Users\Admin\AppData\Local\Temp\CryptoWall.exe C:\Windows\SysWOW64\explorer.exe
PID 1444 wrote to memory of 3184 N/A C:\Users\Admin\AppData\Local\Temp\CryptoWall.exe C:\Windows\SysWOW64\explorer.exe
PID 1444 wrote to memory of 3184 N/A C:\Users\Admin\AppData\Local\Temp\CryptoWall.exe C:\Windows\SysWOW64\explorer.exe
PID 3184 wrote to memory of 4440 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\svchost.exe
PID 3184 wrote to memory of 4440 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\svchost.exe
PID 3184 wrote to memory of 4440 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\svchost.exe
PID 3560 wrote to memory of 724 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\25.exe
PID 3560 wrote to memory of 724 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\25.exe
PID 3560 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\24.exe
PID 3560 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\24.exe
PID 3560 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\23.exe
PID 3560 wrote to memory of 2660 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\23.exe
PID 3560 wrote to memory of 4624 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\22.exe
PID 3560 wrote to memory of 4624 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\22.exe
PID 3560 wrote to memory of 4080 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\21.exe
PID 3560 wrote to memory of 4080 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\21.exe
PID 3560 wrote to memory of 1448 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\20.exe
PID 3560 wrote to memory of 1448 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\20.exe
PID 3560 wrote to memory of 3908 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\19.exe
PID 3560 wrote to memory of 3908 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\19.exe
PID 3560 wrote to memory of 4292 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\18.exe
PID 3560 wrote to memory of 4292 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\18.exe
PID 3560 wrote to memory of 2944 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\17.exe
PID 3560 wrote to memory of 2944 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\17.exe
PID 3560 wrote to memory of 4592 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\16.exe
PID 3560 wrote to memory of 4592 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\16.exe
PID 3560 wrote to memory of 1476 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\15.exe
PID 3560 wrote to memory of 1476 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\15.exe
PID 3560 wrote to memory of 2848 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\14.exe
PID 3560 wrote to memory of 2848 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\14.exe
PID 3560 wrote to memory of 3132 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\13.exe
PID 3560 wrote to memory of 3132 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\13.exe
PID 3560 wrote to memory of 4704 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\12.exe
PID 3560 wrote to memory of 4704 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\12.exe
PID 3560 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\11.exe
PID 3560 wrote to memory of 2784 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\11.exe
PID 3560 wrote to memory of 4348 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\10.exe
PID 3560 wrote to memory of 4348 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\10.exe
PID 3560 wrote to memory of 4712 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\9.exe
PID 3560 wrote to memory of 4712 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\9.exe
PID 3560 wrote to memory of 2196 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\8.exe
PID 3560 wrote to memory of 2196 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\8.exe
PID 3560 wrote to memory of 4980 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\7.exe
PID 3560 wrote to memory of 4980 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\7.exe
PID 3560 wrote to memory of 828 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\6.exe
PID 3560 wrote to memory of 828 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\6.exe

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\PCCooker_x64.exe

"C:\Users\Admin\AppData\Local\Temp\PCCooker_x64.exe"

C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe

"C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"

C:\Users\Admin\AppData\Local\Temp\a76e49df84ba2a7b33e8ea959995b5e6faecb90d551ef169d8272ce9042c35a5.exe

"C:\Users\Admin\AppData\Local\Temp\a76e49df84ba2a7b33e8ea959995b5e6faecb90d551ef169d8272ce9042c35a5.exe"

C:\Users\Admin\AppData\Local\Temp\asena.exe

"C:\Users\Admin\AppData\Local\Temp\asena.exe"

C:\Users\Admin\AppData\Local\Temp\Bomb.exe

"C:\Users\Admin\AppData\Local\Temp\Bomb.exe"

C:\Users\Admin\AppData\Local\Temp\CryptoWall.exe

"C:\Users\Admin\AppData\Local\Temp\CryptoWall.exe"

C:\Windows\System32\Wbem\wmic.exe

wmic.exe shadowcopy delete

C:\Windows\SysWOW64\explorer.exe

"C:\Windows\syswow64\explorer.exe"

C:\Windows\SYSTEM32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\SysWOW64\svchost.exe

-k netsvcs

C:\Users\Admin\AppData\Local\Temp\25.exe

"C:\Users\Admin\AppData\Local\Temp\25.exe"

C:\Users\Admin\AppData\Local\Temp\24.exe

"C:\Users\Admin\AppData\Local\Temp\24.exe"

C:\Users\Admin\AppData\Local\Temp\23.exe

"C:\Users\Admin\AppData\Local\Temp\23.exe"

C:\Users\Admin\AppData\Local\Temp\22.exe

"C:\Users\Admin\AppData\Local\Temp\22.exe"

C:\Users\Admin\AppData\Local\Temp\21.exe

"C:\Users\Admin\AppData\Local\Temp\21.exe"

C:\Users\Admin\AppData\Local\Temp\20.exe

"C:\Users\Admin\AppData\Local\Temp\20.exe"

C:\Users\Admin\AppData\Local\Temp\19.exe

"C:\Users\Admin\AppData\Local\Temp\19.exe"

C:\Users\Admin\AppData\Local\Temp\18.exe

"C:\Users\Admin\AppData\Local\Temp\18.exe"

C:\Users\Admin\AppData\Local\Temp\17.exe

"C:\Users\Admin\AppData\Local\Temp\17.exe"

C:\Users\Admin\AppData\Local\Temp\16.exe

"C:\Users\Admin\AppData\Local\Temp\16.exe"

C:\Users\Admin\AppData\Local\Temp\15.exe

"C:\Users\Admin\AppData\Local\Temp\15.exe"

C:\Users\Admin\AppData\Local\Temp\14.exe

"C:\Users\Admin\AppData\Local\Temp\14.exe"

C:\Users\Admin\AppData\Local\Temp\13.exe

"C:\Users\Admin\AppData\Local\Temp\13.exe"

C:\Users\Admin\AppData\Local\Temp\12.exe

"C:\Users\Admin\AppData\Local\Temp\12.exe"

C:\Users\Admin\AppData\Local\Temp\11.exe

"C:\Users\Admin\AppData\Local\Temp\11.exe"

C:\Users\Admin\AppData\Local\Temp\10.exe

"C:\Users\Admin\AppData\Local\Temp\10.exe"

C:\Users\Admin\AppData\Local\Temp\9.exe

"C:\Users\Admin\AppData\Local\Temp\9.exe"

C:\Users\Admin\AppData\Local\Temp\8.exe

"C:\Users\Admin\AppData\Local\Temp\8.exe"

C:\Users\Admin\AppData\Local\Temp\7.exe

"C:\Users\Admin\AppData\Local\Temp\7.exe"

C:\Users\Admin\AppData\Local\Temp\6.exe

"C:\Users\Admin\AppData\Local\Temp\6.exe"

C:\Users\Admin\AppData\Local\Temp\5.exe

"C:\Users\Admin\AppData\Local\Temp\5.exe"

C:\Users\Admin\AppData\Local\Temp\4.exe

"C:\Users\Admin\AppData\Local\Temp\4.exe"

C:\Users\Admin\AppData\Local\Temp\3.exe

"C:\Users\Admin\AppData\Local\Temp\3.exe"

C:\Users\Admin\AppData\Local\Temp\2.exe

"C:\Users\Admin\AppData\Local\Temp\2.exe"

C:\Users\Admin\AppData\Local\Temp\1.exe

"C:\Users\Admin\AppData\Local\Temp\1.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 urlhaus.abuse.ch udp
US 151.101.2.49:443 urlhaus.abuse.ch tcp
CN 119.45.21.247:9000 tcp
US 8.8.8.8:53 49.2.101.151.in-addr.arpa udp
US 8.8.8.8:53 ip-addr.es udp
FR 188.165.164.184:80 ip-addr.es tcp
FR 188.165.164.184:443 ip-addr.es tcp
FR 94.247.31.19:8080 tcp
US 8.8.8.8:53 184.164.165.188.in-addr.arpa udp
US 8.8.8.8:53 64.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 32.169.19.2.in-addr.arpa udp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 208.95.112.1:80 ip-api.com tcp
US 208.95.112.1:80 ip-api.com tcp
US 208.95.112.1:80 ip-api.com tcp
US 208.95.112.1:80 ip-api.com tcp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 1.112.95.208.in-addr.arpa udp
US 208.95.112.1:80 ip-api.com tcp
US 208.95.112.1:80 ip-api.com tcp
US 208.95.112.1:80 ip-api.com tcp
US 208.95.112.1:80 ip-api.com tcp
US 208.95.112.1:80 ip-api.com tcp
US 208.95.112.1:80 ip-api.com tcp
US 208.95.112.1:80 ip-api.com tcp
US 208.95.112.1:80 ip-api.com tcp
US 208.95.112.1:80 ip-api.com tcp
US 208.95.112.1:80 ip-api.com tcp
US 208.95.112.1:80 ip-api.com tcp
US 208.95.112.1:80 ip-api.com tcp
US 208.95.112.1:80 ip-api.com tcp
US 208.95.112.1:80 ip-api.com tcp
US 208.95.112.1:80 ip-api.com tcp
US 208.95.112.1:80 ip-api.com tcp
US 208.95.112.1:80 ip-api.com tcp
US 208.95.112.1:80 ip-api.com tcp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 kenesrakishev.net udp
US 15.197.225.128:80 kenesrakishev.net tcp
US 8.8.8.8:53 128.225.197.15.in-addr.arpa udp
US 8.8.8.8:53 file.blackint3.com udp
CN 182.138.200.248:88 file.blackint3.com tcp
FR 94.247.28.156:8081 tcp

Files

memory/2364-0-0x0000000074CA2000-0x0000000074CA3000-memory.dmp

memory/2364-1-0x0000000074CA0000-0x0000000075251000-memory.dmp

memory/2364-2-0x0000000074CA0000-0x0000000075251000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe

MD5 2a94f3960c58c6e70826495f76d00b85
SHA1 e2a1a5641295f5ebf01a37ac1c170ac0814bb71a
SHA256 2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce
SHA512 fbf55b55fcfb12eb8c029562956229208b9e8e2591859d6336c28a590c92a4d0f7033a77c46ef6ebe07ddfca353aba1e84b51907cd774beab148ee901c92d62f

C:\Users\Admin\AppData\Local\Temp\a76e49df84ba2a7b33e8ea959995b5e6faecb90d551ef169d8272ce9042c35a5.exe

MD5 6f8e78dd0f22b61244bb69827e0dbdc3
SHA1 1884d9fd265659b6bd66d980ca8b776b40365b87
SHA256 a76e49df84ba2a7b33e8ea959995b5e6faecb90d551ef169d8272ce9042c35a5
SHA512 5611a83616380f55e7b42bb0eef35d65bd43ca5f96bf77f343fc9700e7dfaa7dcf4f6ecbb2349ac9df6ab77edd1051b9b0f7a532859422302549f5b81004632d

memory/1848-22-0x0000000000400000-0x000000000043D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\asena.exe

MD5 7529e3c83618f5e3a4cc6dbf3a8534a6
SHA1 0f944504eebfca5466b6113853b0d83e38cf885a
SHA256 ec35c76ad2c8192f09c02eca1f263b406163470ca8438d054db7adcf5bfc0597
SHA512 7eef97937cc1e3afd3fca0618328a5b6ecb72123a199739f6b1b972dd90e01e07492eb26352ee00421d026c63af48973c014bdd76d95ea841eb2fefd613631cc

C:\Users\Admin\AppData\Local\Temp\Bomb.exe

MD5 31f03a8fe7561da18d5a93fc3eb83b7d
SHA1 31b31af35e6eed00e98252e953e623324bd64dde
SHA256 2027197f05dac506b971b3bd2708996292e6ffad661affe9a0138f52368cc84d
SHA512 3ea7c13a0aa67c302943c6527856004f8d871fe146150096bc60855314f23eae6f507f8c941fd7e8c039980810929d4930fcf9c597857d195f8c93e3cc94c41d

memory/3560-48-0x00007FFCECE23000-0x00007FFCECE25000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\CryptoWall.exe

MD5 919034c8efb9678f96b47a20fa6199f2
SHA1 747070c74d0400cffeb28fbea17b64297f14cfbd
SHA256 e036d68b8f8b7afc6c8b6252876e1e290f11a26d4ad18ac6f310662845b2c734
SHA512 745a81c50bbfd62234edb9788c83a22e0588c5d25c00881901923a02d7096c71ef5f0cd5b73f92ad974e5174de064b0c5ea8044509039aab14b2aed83735a7c4

memory/3560-57-0x0000000000D80000-0x0000000000DF8000-memory.dmp

memory/3184-58-0x0000000000B10000-0x0000000000B35000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\d6caf64597bd5e0803f7d0034e73195e83dae370450a2e890b82f77856830167.exe

MD5 e8ae3940c30296d494e534e0379f15d6
SHA1 3bcb5e7bc9c317c3c067f36d7684a419da79506c
SHA256 d6caf64597bd5e0803f7d0034e73195e83dae370450a2e890b82f77856830167
SHA512 d07b8e684fc1c7a103b64b46d777091bb79103448e91f862c12f0080435feff1c9e907472b7fd4e236ff0b0a8e90dbbaaac202e2238f95578fed1ff6f5247386

memory/1752-41-0x0000000071A0E000-0x0000000071A0F000-memory.dmp

memory/1752-59-0x00000000005F0000-0x00000000005F8000-memory.dmp

memory/1752-60-0x0000000004EB0000-0x0000000004F4C000-memory.dmp

C:\Users\Public\Documents\RGNR_6F1190D5.txt

MD5 0880547340d1b849a7d4faaf04b6f905
SHA1 37fa5848977fd39df901be01c75b8f8320b46322
SHA256 84449f1e874b763619271a57bfb43bd06e9c728c6c6f51317c56e9e94e619b25
SHA512 9048a3d5ab7472c1daa1efe4a35d559fc069051a5eb4b8439c2ef25318b4de6a6c648a7db595e7ae76f215614333e3f06184eb18b2904aace0c723f8b9c35a91

memory/4440-928-0x0000000000C20000-0x0000000000C45000-memory.dmp

memory/3184-951-0x0000000000B10000-0x0000000000B35000-memory.dmp

C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif

MD5 9715c90a371af3e7831080121db57041
SHA1 733b64e74841a73405aa333b3ffa29e3806ba5b1
SHA256 7a2fdb775ce019d74c5583044c5c7e29e809d41d349b49f06982d4f7399b3983
SHA512 8eb70acc528fed60daacce489bb9d5e7e6b54b31830bf56e62544e14b49d495fe4184bebb9aadde3e1cb6193db12e9645b2216f21cf6e67a97ff3f1c8fe508be

C:\Users\Admin\AppData\Local\Temp\25.exe

MD5 476d959b461d1098259293cfa99406df
SHA1 ad5091a232b53057968f059d18b7cfe22ce24aab
SHA256 47f2a0b4b54b053563ba60d206f1e5bd839ab60737f535c9b5c01d64af119f90
SHA512 9c5284895072d032114429482ccc9b62b073447de35de2d391f6acad53e3d133810b940efb1ed17d8bd54d24fce0af6446be850c86766406e996019fcc3a4e6e

C:\Users\Admin\AppData\Local\Temp\24.exe

MD5 042dfd075ab75654c3cf54fb2d422641
SHA1 d7f6ac6dc57e0ec7193beb74639fe92d8cd1ecb9
SHA256 b91fb228051f1720427709ff849048bfd01388d98335e4766cd1c4808edc5136
SHA512 fada24d6b3992f39119fe8e51b8da1f6a6ca42148a0c21e61255643e976fde52076093403ccbc4c7cd2f62ccb3cdedd9860f2ac253bb5082fb9fe8f31d88200d

memory/724-1520-0x0000000000EC0000-0x0000000000ED0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\23.exe

MD5 7e87c49d0b787d073bf9d687b5ec5c6f
SHA1 6606359f4d88213f36c35b3ec9a05df2e2e82b4e
SHA256 d811283c4e4c76cb1ce3f23528e542cff4747af033318f42b9f2deb23180c4af
SHA512 926d676186ec0b58b852ee0b41f171729b908a5be9ce5a791199d6d41f01569bcdc1fddd067f41bddf5cdde72b8291c4b4f65983ba318088a4d2d5d5f5cd53af

memory/2660-1569-0x0000000000FF0000-0x0000000001000000-memory.dmp

memory/2988-1574-0x0000000000D80000-0x0000000000D90000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\22.exe

MD5 296bcd1669b77f8e70f9e13299de957e
SHA1 8458af00c5e9341ad8c7f2d0e914e8b924981e7e
SHA256 6f05cae614ca0e4751b2aaceea95716fd37a6bf3fae81ff1c565313b30b1aba2
SHA512 4e58a0f063407aed64c1cb59e4f46c20ff5b9391a02ceff9561456fef1252c1cdd0055417a57d6e946ec7b5821963c1e96eaf1dd750a95ca9136764443df93d7

C:\Program Files\Java\jre-1.8\legal\javafx\public_suffix.md

MD5 a31266925496d9b0da074205cc043893
SHA1 390d017257c729e45d91c7b115efbacddd99651d
SHA256 b9226595855754da4ad521e6b244a697d5c2796b303a79055a272f92c74629da
SHA512 6840174d0485588b9766482f445b3eba79cce18a5d12a5b614eb6b2d16e6f5b93501ba096709344cd0827e799cdc819d1e621b91dbbbc05a223185de55ba7eda

C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md

MD5 10396003498817c4eb74765c80d2cb7c
SHA1 dde1d2f20bd1fb07861a095ef207ec45bbdb879f
SHA256 0a9d2db63c38b0c5a6368a77e799e01a51b47c405eb8f63d280e4bcbaed408d6
SHA512 0a2e76f3e477ea7c97383ad9b27798fcc88fb4e04f4ad07ea60ad479f933212f857214df5ec2e7f30e2f82f0e4442ca35508c3109440672d614039955354c538

C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md

MD5 7db905e48b19366c0cb4a3e14226623e
SHA1 f407791051f2717412074559cbd03d7dc74e2553
SHA256 298a7a99b507c409e538eb2ab9283135f6d6b43fb021ef55032fdd3895045132
SHA512 516ac8e30a1426e13b93b1f57ff2d953f127680b2b3068bb52f15d54332094031b6f3e235e2dbaa61926ff1d0c5209e2b1e0aa4aca6a61271256d5f553b5cc6d

C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md

MD5 4ae5e16adf921072e4969ad9301fa988
SHA1 6b57a2fedcf9c96c61764e3753dbee9799a5fa4a
SHA256 8a864e2acdba65c945d49608534b123e9147c233d542ba46e99c197b32f553c9
SHA512 2098ab7bf47cd4aba9140d8b16e18c77b4d24988340836789c2930a4e00ca6289d68d947f1aa68bb95a095c6fe2ab682bfac4d4ebf123ae731889076db04b4e9

C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md

MD5 47734c6f796136aa5b528fcef21ab9d0
SHA1 3251317a444d08583485db953a2861d3339786ea
SHA256 167a0b7b792c38e5033ae41e3d1c0770a0e514713c37869861119d14da327413
SHA512 3bcc3192b2daee0e5f2b49461f815a233560fabbdfc86c965ae00537aa895c25ae753b92577756ebd8ceb3c85c2fb5de5615a1d7c04679dcb4c09d743170ed3c

C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md

MD5 d950fb5dbc2b30576ea3767b2c9f3ef1
SHA1 fed74ba51c4456a7e0e19dfe1858937a713b0d88
SHA256 614f0db60bad06e50c1957be3d06ec08a57b71caf609059c9012f1b3392aa1d0
SHA512 b4eec0b9c144eec3dbe7370b7f46fa5cd356d1d988ffd1aed7a2935e2ccc2b63671bd35b83f0f57d1fdaacd4ef4a3fc14688083aea6abbda28ce0a49c9ebb1af

C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md

MD5 3835b36ba5791f25f50040dcd43c94da
SHA1 0df0a86a5e9a22daad40a86352a5671de0b6e249
SHA256 afaefa0b72e61198118934d8a41606a994b4f5b934958f9f2ac02759203afc3f
SHA512 2c0f088267d4beb3c73de9b8a1caed3adb17c8a12e2a9dedcceb92710a75c1ca4dae89e10e98f95ba4d15fdff3ff7f173f1f43e36b19d8d9b0f28a8d6d596835

C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md

MD5 c64ff445385648809ec6365dd8bc5736
SHA1 96806014e3465e6fb0807d1a1e7d9c768b9c58f2
SHA256 76d997ab871202b26b826a4e0137fdfeae02cd192eb220999b11c36c7da0097d
SHA512 98103c09d6d24941ab1e8204c56bf75ab78cd5f9b7f40d15dab453975e369dabc8420b4d26a1e90c29ef8e7c8162877a38db90aef4a5e83e008a8ed4888abd79

C:\Program Files\Java\jre-1.8\legal\javafx\glib.md

MD5 a20dbe5f20c1a31b36c9034ae9f88f0e
SHA1 d3f169f69650e9da5327f2430355ce3f5c581c88
SHA256 7f91b9cdd14b860c92ecf5d23dab566b7ac48f59cadd55ab61e897b76e00841d
SHA512 61540aecc4c4e5c9360b9ba97bb118246db2705cf3251ed3311a75a05b5cb903379cf266e65f1f36ff616a5106b1b1a3de80171e2a6fbfd1a7d35c55e502a88d

C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md

MD5 57b0c78fedc10e9515d1793fe50d5aee
SHA1 e3023df8ce6e1a86981e71562134b1fab1a77f19
SHA256 8c051353273de8ff82a60231e4921a287225ad15f725c173dd1692d4e434178e
SHA512 d91eb3977e818ad64b9e99995a55d50ccc61e175fde57f43031b2b4ef8aecc97865294bcad32ace14afcfff51435d836b112cb38dc24350f61666f2e3a825b27

C:\Users\Admin\AppData\Local\Temp\21.exe

MD5 a8e9ea9debdbdf5d9cf6a0a0964c727b
SHA1 aee004b0b6534e84383e847e4dd44a4ee6843751
SHA256 b388a205f12a6301a358449471381761555edf1bf208c91ab02461822190cbcf
SHA512 7037ffe416710c69a01ffd93772044cfb354fbf5b8fd7c5f24a3eabb4d9ddb91f4a9c386af4c2be74c7ffdbb0c93a32ff3752b6ab413261833b0ece7b7b1cb55

memory/4624-1655-0x0000000000E20000-0x0000000000E30000-memory.dmp

C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md

MD5 d3801b86a4c1cb740e9cf65a84c724ad
SHA1 20c66ef2fd13d6c6e941a562d55e3a9170395f0c
SHA256 dfa51ba709829352d93ca1337a87c81b99550f23bd2d910611284d5267c053c7
SHA512 daaab8ed28e53e4cd37377e48e5eca4fd2056b9e4cb9aae665a58b6afbe0f6deb047deb42d96036ef53a12acebf9fab633cd9efa93c3030129118d6c9234fef1

C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md

MD5 f204279e740663585a7a2f211953a10a
SHA1 d2f92651ea76258400f80a8bbd4b4777f530bd17
SHA256 40b52e987e4cac27ed98eacb66c13ab4068215891d427676f916452633050833
SHA512 37e75af2408daa309db98580cd590440f22a3282953c35b6fe8c963a4c239aa9c67bf77ba7820c09d93e1eff384e317ce1e6ee6236d37dd095b486cfa90487e6

C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md

MD5 6c7ac5795024c39d1d5fd7115d6dcaff
SHA1 1f121cb5c4815f44f2b4bd3f5d8594b6f4b9a0e1
SHA256 2729442f9e9ba0f596b0f0290e32b6f53f1ecf4edc41b4b84702b447e1eced98
SHA512 ef77bade2aa66a980e28af52f98a9abf13e00c1e512034f6594be01deb73b2b083cf75d993b00c91877dc81fc255a491f4bccdfdeef0db8a5771fec88d8a9ebd

C:\Program Files\Java\jre-1.8\lib\deploy\messages_zh_HK.properties

MD5 ce0fd0500971f091729bf7fd0a7e22dd
SHA1 bbfb20eee28d6afb8c60cf3c5139603059bb65d9
SHA256 3e18db398e135048802f5d5da038836403f17c0d8bed1f71a211ab85a1ff0841
SHA512 8bcf5743e0e6634fb3d9d7b56abd19652db5f89ffeea5549ea564c94a722f8242daf901072e5122e6e3959d2cfbfb233f6e57c5e4f425e34b282eaaad016c086

C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md

MD5 63c53505b85802ced3f49c44270c307d
SHA1 c5ba1475e8f4be9b1652a72e0c1e56aaac2906bd
SHA256 6a16642eb166c1c714fff43e4696fb9835436c50873ee5c9fec24c8c6ddca319
SHA512 8f998c715c6853849fddb02cf27ecab699daa4ca3dc7e701e64b70d9d7035aff30dcff0edd7d400334cb0f9eb2c8f0fce0c6af0e1f3549f5b72f30784e37a480

C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md

MD5 f767a2850326084695202b4696eb5dae
SHA1 3afc27ae85bd54c252b26e3c11d1942e61ac9a60
SHA256 399daf54948f033a0b777bcb3dc6c44be18d2ea34d3cbcc2119a9724c050c788
SHA512 0f0f86f00a96f06a03dc7838180ce261d6fbcd4bde8d51208364243714390f463771e897f0ea4c43e60d4d08eb0aa15f17a7648f8a86e478b772ccdffa95b77a

C:\Users\Admin\AppData\Local\Temp\19.exe

MD5 4c1e3672aafbfd61dc7a8129dc8b36b5
SHA1 15af5797e541c7e609ddf3aba1aaf33717e61464
SHA256 6dac4351c20e77b7a2095ece90416792b7e89578f509b15768c9775cf4fd9e81
SHA512 eab1eabca0c270c78b8f80989df8b9503bdff4b6368a74ad247c67f9c2f74fa0376761e40f86d28c99b1175db64c4c0d609bedfd0d60204d71cd411c71de7c20

C:\Users\Admin\AppData\Local\Temp\20.exe

MD5 f18f47c259d94dcf15f3f53fc1e4473a
SHA1 e4602677b694a5dd36c69b2f434bedb2a9e3206c
SHA256 34546f0ecf4cd9805c0b023142f309cbb95cfcc080ed27ff43fb6483165218c1
SHA512 181a5aa4eed47f21268e73d0f9d544e1ceb9717d3abf79b6086584ba7bdb7387052d7958c25ebe687bfdcd0b6cca9d8cf12630234676394f997b80c745edaa38

memory/4080-1805-0x0000000000C60000-0x0000000000C70000-memory.dmp

C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md

MD5 eb9518433a84fb7450380b484f68aa6a
SHA1 ad6e4c091ec55c2bd929244b23f473aa8ff94402
SHA256 9b64b330a87a4e0535675cf046cc860a03eb4422d03eb7b59a6054b63631df57
SHA512 9bbc0463609d4891908b77b95ebb2554f27a060f544085ddf073c62629fa1ce95582c50f0a5468c88d8baf401e27065f1c4730c5468df977bfd1f39e815627b8

C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md

MD5 c189a174cfa49072cde66798737b66e5
SHA1 98eec4441942efd21821e9b7decaa08f1a8bb126
SHA256 bd527938b21feb2ef6961fc7e3416e966d4cc036cf1af5a85be76aa7696881e5
SHA512 56213a3452302a8bd710dbdc64395766c255d2d551ce93b64bcd66c473e4500d0221b930d48c8bfe3d453f9dbe5923e2560414d2995d42e3c367d198078078e6

C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md

MD5 8b7bc05d54d70069bd725bfc2fc30b0a
SHA1 d3a4f05faabc254faf60d09a4fdae33383e91a8f
SHA256 19ed80f4ba324532f0e1d95b6b5aba3ae74600b823a65f55946e06d060c3c799
SHA512 3e6b9adf535ff4d706e4ec5f2641095fb674c5457d4d48813e89608fdc0132e738a28d7574716c2e5e7459e923894426a0bc0bfb97c78cbd647ef5cd827f67a8

C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md

MD5 d38e1c6f428215ed84c4d8ab0b3cfeb1
SHA1 ff82f92cda2084675711e676309a56a18352507c
SHA256 5297a4af99ced60daf04844a73c82d1fd7449a130e4102ea9dbd737b6275be1d
SHA512 79937feda952212601e44201b968db647008012d5ce51d6e024fcdf2b43c4b7e86c5b52f58fb6420b8ef1a3296af1cbbaf85107e4472b6dc3ba9b2d4bf4079d9

C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md

MD5 235803c5536c351c450480ed7e407ee7
SHA1 d9d1638b07692bd1b71eee603fbfc44b1fc27412
SHA256 ee314f3d27c2d9e40ce01be8b1670d5592ff4c3f0a032eec1395d9e2832fdb59
SHA512 3bebb408c7a022eaab22faf23d9df6277652025b2e69d766364b4c59440f9a1c537dd34770b71b601b799f6fa3f8482e8af50922f4e6598395bece25e5ed6594

C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md

MD5 a62375519432e2cd454b410ec499e964
SHA1 5b40e93842ec7e53f517d02998ed532e29add8a8
SHA256 1bc3b70be156d1c417695dca08c68cc5bae4bafd2817421d163709b252dbea67
SHA512 4512292ac41f2f0acb326b50c4661c41295c553893104688769145b5708124d367fb70cf9f271afd2f92de515687fb032b656c93eca22aa4faa802b5f0d0c4f1

C:\Program Files\Java\jre-1.8\legal\jdk\libpng.md

MD5 146c39118f6bbabe8566cf669888eb12
SHA1 2248150f826b5a9a58c825a26f2f1d20f4eaab69
SHA256 e58188d07d1fbad45442d704ed024db5333e1741ef3c4b1749b60f3577325353
SHA512 ef2e9c7cdcab671d7cc8a57b6adbaf7e7c481e845944e58a6f76dcffe04cbf9c52f1d431e75706e8b05b7021faa22a1c282ccefc99ea4a9bc6201e73ab9265f5

C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md

MD5 b8037743643b6508109c6e5a9ec443ba
SHA1 cdbb1e5e7f5406c939592b7df6dc923efcd9a0e3
SHA256 c839c56194601be4f1b2e478b70bfc35cb2e6af348799f03a9154e3cc3dade4e
SHA512 3d2248a302a5c2dca85c29b5808cded64dbbe17a6235bbd1008949e0ab2cf40194e9e7739a262b53fa5c39e77c8fccac238742525c02798063cd2ce4a0d27d59

C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md

MD5 548fc168673cff6be5fe6df9b5a6be13
SHA1 899d95da4148f06cc3e108ba65e98ff447ba1a5c
SHA256 4e071128bc1fd1a09b93c70369a66148ee0cd96c40a457fc621353c185e6803b
SHA512 1095a8b0d687811bc8056e174ebbdabd6025c797ded1061d0fbeb4ee93b38259fb39b9606057e758a539d37adb66cc7aab378cf1396dd3f3cb2e3c7d05ed286c

C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md

MD5 954e1a915438f661269c36d36753b2b7
SHA1 885beb4e8fad44255e7063e9bc873c1a48f0f213
SHA256 f37179c97d0db9105846fdda75c4327cbf0786140791abf7782270257be958d8
SHA512 33d5a7fa6117e685e93253c97393d9d3ea1f3bf5448c823b659d209d371a8ca45c9c4d032031c6abdcf34c28b1ebaa659e704b13734e579c9d35c4c3cb4bd2ce

C:\Program Files\Java\jre-1.8\legal\jdk\joni.md

MD5 7a7509a29c0221014b58cd7915a79c31
SHA1 39e418ccf852c66310c1c1659888111d2257e0ac
SHA256 88779ac7e11a10de51401dfb18f2067f1fea5576361f08799ba652d96cf7bc78
SHA512 664429337530e7112848acbbfe3b476c9c806d1864771944e73129e546d38a02b006226de7a1ebb160b85da461c289aa7e9760ce3785ebe93fc1551ab75add24

C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md

MD5 397a3bee40ca1a22ef2ce01afef3d156
SHA1 4a575a0949150c277d84e86d27400b5e707f2310
SHA256 6608fffcc3289ebafb72f95a907c16e5e223ff07280a9c63d5f8f62571946a16
SHA512 2433b002c726cbed21222a5519dafc3bc7ab49666557797e7864fd7be81bde7b0738ef0c2fd137935b6280e400f61ad3ecc12dc9c74b27d5f99a5229947b7e3f

C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md

MD5 9ed0001ed590305775a42c34e8c3a583
SHA1 d5173d07360609e2b127def258d89b6291856ea8
SHA256 135c7691440a3a518282d0134c30d103ed50ae78988e33b6199deb4dc0536835
SHA512 ade710974266b53cfb3e2657d2f8ac265302974708c56473fd06f1d73ae990305da0d387fd19e2a415822586fe0c3e4f2ec6237965960021cfa2b28905630962

C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md

MD5 eb787ab92c77eb7c083bf01321006b87
SHA1 1f2db690e9e8a8f9d6a111f190934b88cc76929e
SHA256 4cd45805f88ca6ac35b6d1e33dcff7c6982ab64a22abeaf7af610420f9830483
SHA512 013dacbc37437bf9b2d5939c4cf156e209b2ad57bb571e5627af1359009a4ad0402105c647f2859978ffd1a671f48d17b5d1f515c1f7d1ea0a3fa1d39a9a66ea

C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md

MD5 64ab5535c7d404f9ac3a5bb68ef0f677
SHA1 fce8c0eb0bd41f1157e4c8a54e15bd1d8fe452dc
SHA256 8861d70a3f0c6b0849f4ef5d1f5260fbf347364b72cb3c0222528e14e5e78eb9
SHA512 2658cfe1f227ed1ef3ac372a91c35455143d9ab04526b21072d111046d3e0092ea9204b3fa265c7cee10317a644edaa7da14cc05bb79ef46f6d6daac870422be

C:\Program Files\Java\jre-1.8\legal\jdk\dom.md

MD5 87c14798cdf93082bced0c266f683a08
SHA1 4c37e3efcc5d5e8627ba5298aa29354e86f5b497
SHA256 8299f4f7881e4cc67fc1c8c2f87bb9418176a1348ee2576382a976ee5ac4511d
SHA512 0928d3828c6773c84f0bb363cc2b3190b5c9e56c96b31a5783a57d447486aa8931884eb8d9f64725abc5e728ded443fc4e33d0f1c646e19b063d01a15ff36591

C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md

MD5 6daff937546d3cc8f379b65d439261b3
SHA1 d9c876eb8703cdbad3ebd27bb1f00f4218a9b628
SHA256 76c2bf43cbf1910ba141b6479b37b5f085ab645cc3a5dd4f3c6615dd66980b1a
SHA512 df60d273662ef8711d16cc55f56e4b507ba020008ea2400e95e8623f47913ebff5aed0280796b826528235a6b21d8ad96a2613c914f8d975682ccee474deab58

C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md

MD5 3095d90ee21aef857ec25364d7a8a8c2
SHA1 a9e4d533c3c86c8c00d113118779076e86ab562f
SHA256 ea1d3e4f5d2297da2644127d8de3086e5f9d01373b87c439ae58427471278696
SHA512 da3a452aea72483bf89b61873123e72a6e709715c8b0d7d3f5c3207a395fbe6b0cea5978c53ffd4c955dfe411a335d49765d7aa3e21d184f3b2131fa3fd6b24f

C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md

MD5 9c31544d4caeee57a23288e9ceb2a067
SHA1 4adcc183cf8ca7a121bbf18dda7bac58700339ac
SHA256 6a55e7940ebbb6a0fa688567705429d25db947285e50e11c6107318c1d7c5b2b
SHA512 09388978ecf66a42ac8174a27e7edf3f525c5553ff1ae7594f1c4647e15521c7be580e762deda389fe75903c259f7fb927183a464a5f99e9fc9889986090fbd0

C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md

MD5 da1dacf0608da19f7419867f2b4d7656
SHA1 6e638ab4028df9a2752f78650d13fb66dde595ad
SHA256 1681b6adb0fa4320b4ba347fb98fd4e2084cd3af44cbd844df67c0746847ee0e
SHA512 d9f4707145d3cbfc0cb33c5d8bd04525007ff0820be3ae18a304fb85c1b5745c25a1f1250f88afca014456ec4cd2cb199880c9fdbffc0d1bc932acbea65997fd

C:\Program Files\Java\jre-1.8\legal\jdk\icu.md

MD5 29dc15af026d13c409783f87c444840e
SHA1 cd288561ffdf7118b343855014efd37350ba08b4
SHA256 b8a5c4ad0981a55c0470f34cc5cf99f1bafa8474787a31de5bdf96eeb5e07b1e
SHA512 624f3ed680e52f2f37dfb8478985fe6e504d35f0a1502a5adfe01f78fb744d6770358810174098158fba2ad3ed22317d171e9855997fe8d347b755a9ef12b641

C:\Program Files\Java\jre-1.8\legal\jdk\asm.md

MD5 d0be2ebfd8271bafa57feb1aaa150727
SHA1 d5d65b8c3baee1a3572e5970f1c0d64c73ebbf4f
SHA256 ea56f5ced6457074e9e88a158de66d4f05e5dc42412b2e936a2295f4e739b756
SHA512 d849d064230461aff4dd86be2a94d3f70a5bcb157d541422a66ac8c71931383e12e8c769958d0762d563650ecda6aed77c779c3de6101f4191ff25a1a02c74e6

C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md

MD5 5a93c6f9d810109ecfdf4bec4b0380c0
SHA1 22e0d64b6f06082d925536bc17693e71ee346489
SHA256 4c658c3cb47bd44873ff54a168798cc373bf8ea8faf0c62e413be22015182150
SHA512 424d98943a909353d1a00ba80d4664446c64c17c5cf861cbc07e25a76b2cde91567ba0ac99522379f6ba0da0e2ed9975d760bf222882da2feb11ea0de6bff108

C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md

MD5 975bfa1d850317fa3473a2421d8a3ed6
SHA1 088eda9fa1c06a96bf5649fb0d682f9c3a28e0ae
SHA256 4cb44dfb564614e1237adefa22ff22d6ce1e37ae02313077e4673025535ca05d
SHA512 6e089daabbe216b809e3ee3685281d114120009f8a4bf5f94bcd901e68d370d9d7392e31cb18ecd3c206b16ecc9dc431af065e465568cd792bc4395bac16edd6

C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md

MD5 034b422818c372dc1e85c7d35f01b175
SHA1 6d149fa3caba8f35576cbf17bb214412b090efbd
SHA256 62f13a34397c007708b0f013f3d3c76ceb5a723b31ae7f8f1e8a5b93b5f90227
SHA512 d34112a4882fcfbd10c704bb28cf77244b58b087f12de7628b6c73b7f3c7ef43cf9a82abc22c7b922b148ffec6a04588b0e6a26024de1cd77133705eb4ddba91

C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md

MD5 bdb6212841581270cf3ebdbc5d16845b
SHA1 95603b71fa112fbe94ff02bd232f86966312d983
SHA256 81edc7c883e808a7190f03b5998ec110e2a510d5b8fb035af87c31201004a685
SHA512 9a9d127c99313d2b45b0c41214bf47accef1d813edf775ce1bd47637ad94b469911a98169b8a3e7ebfc58cf9d16e3295a39c0de23ffe686c167dec4a4697a680

memory/1448-1819-0x00000000002B0000-0x00000000002C0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\18.exe

MD5 d32bf2f67849ffb91b4c03f1fa06d205
SHA1 31af5fdb852089cde1a95a156bb981d359b5cd58
SHA256 1123f4aea34d40911ad174f7dda51717511d4fa2ce00d2ca7f7f8e3051c1a968
SHA512 1e08549dfcbcfbe2b9c98cd2b18e4ee35682e6323d6334dc2a075abb73083c30229ccd720d240bcda197709f0b90a0109fa60af9f14765da5f457a8c5fce670a

C:\Users\Admin\AppData\Local\Temp\16.exe

MD5 0ab873a131ea28633cb7656fb2d5f964
SHA1 e0494f57aa8193b98e514f2bc5e9dc80b9b5eff0
SHA256 a83e219dd110898dfe516f44fb51106b0ae0aca9cc19181a950cd2688bbeeed2
SHA512 4859758f04fe662d58dc32c9d290b1fa95f66e58aef7e27bc4b6609cc9b511aa688f6922dbf9d609bf9854b619e1645b974e366c75431c3737c3feed60426994

memory/4292-1962-0x0000000000090000-0x00000000000A0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\17.exe

MD5 c252459c93b6240bb2b115a652426d80
SHA1 d0dffc518bbd20ce56b68513b6eae9b14435ed27
SHA256 b31ea30a8d68c68608554a7cb610f4af28f8c48730945e3e352b84eddef39402
SHA512 0dcfcddd9f77c7d1314f56db213bd40f47a03f6df1cf9b6f3fb8ac4ff6234ca321d5e7229cf9c7cb6be62e5aa5f3aa3f2f85a1a62267db36c6eab9e154165997

memory/3908-1956-0x0000000000C80000-0x0000000000C90000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\15.exe

MD5 c936e231c240fbf47e013423471d0b27
SHA1 36fabff4b2b4dfe7e092727e953795416b4cd98f
SHA256 629bf48c1295616cbbb7f9f406324e0d4fcd79310f16d487dd4c849e408a4202
SHA512 065793554be2c86c03351adc5a1027202b8c6faf8e460f61cc5e87bcd2fe776ee0c086877e75ad677835929711bea182c03e20e872389dfb7d641e17a1f89570

memory/2944-1989-0x0000000000860000-0x0000000000870000-memory.dmp

memory/4592-1993-0x0000000000EF0000-0x0000000000F00000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\14.exe

MD5 e6c863379822593726ad5e4ade69862a
SHA1 4fe1522c827f8509b0cd7b16b4d8dfb09eee9572
SHA256 ae43886fee752fb4a20bb66793cdd40d6f8b26b2bf8f5fbd4371e553ef6d6433
SHA512 31d1ae492e78ed3746e907c72296346920f5f19783254a1d2cb8c1e3bff766de0d3db4b7b710ed72991d0f98d9f0271caefc7a90e8ec0fe406107e3415f0107e

memory/1476-2029-0x00000000000C0000-0x00000000000D0000-memory.dmp

C:\Program Files\Java\jre-1.8\LICENSE

MD5 0cfd2cdf9a7bfe6b64f1751d668580a5
SHA1 80ff30eaac8d8144199759d4a7c9a1e3df11ceb5
SHA256 89c4efd3877eb336ab55c96063f7449507981c9e4c2278ac682e4c529245212b
SHA512 f2219d29384a0270312330e68e966742476cb6840393e8d8b82f1967679f80fcf07c71fd687150e484a85b6882b4f153252ac5eacb978330ea7b8c26d02612ac

C:\Program Files\Java\jre-1.8\COPYRIGHT

MD5 ac482449f7aa62cee6784ee8dcc5c53b
SHA1 184f86de0ac21dc21fa9e0d64a403c635f08f310
SHA256 84116787857efa283d8606878f5e91b96c56582b170bca02c0d33e4da2952972
SHA512 e83d236dc914d0146531575ea036b8ae0934aa5dd8b72abf2596019c7ca32c1706673039df799a29b22bd4e721082fd17fed0c434c0fd1241473182810a771cc

C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt

MD5 c013dfd097f994634724bdbed335ee9f
SHA1 0f35f292d3617969515e1b6c439243f593d832bc
SHA256 3a2ee5f99ece1bfae85b8703a3f976657830fac7f16a0b4ebd9c6941665ff9cc
SHA512 2adedf28cebbc47267b54378a5206d8d132b56178e5af30caf1156738cd5595e6095e3281fbe4bae056d6a5523137947ba383623564dc2650963cecc212a1f8d

C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt

MD5 302ca3426297a823ec45b12ffb409c6d
SHA1 5a6cdde6cb26203c001ab8bb547395fe76f74228
SHA256 f86cbb670b2f8d5b3cd7a6cbd36cebea09e58e6cbba6261737ebcd0fe6f92488
SHA512 a7cb8fe34e9b4376ec1185397c41f262c0bb7774101f84308eec2b8506527c37cbcb2496973f95494d6d8345fa09f133f0e41856b5bbdb3c01c368bf58c820d5

C:\Users\Admin\AppData\Local\Temp\13.exe

MD5 c76ee61d62a3e5698ffccb8ff0fda04c
SHA1 371b35900d1c9bfaff75bbe782280b251da92d0e
SHA256 fbf7d12dd702540cbaeeecf7bddf64158432ef4011bace2a84f5b5112aefe740
SHA512 a76fee1eb0d3585fa16d9618b8e76b8e144787448a2b8ff5fbd72a816cbd89b26d64db590a2a475805b14a9484fc00dbc3642d0014954ec7850795dcf2aa1ee7

memory/2848-2086-0x0000000000E30000-0x0000000000E40000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\12.exe

MD5 7ac9f8d002a8e0d840c376f6df687c65
SHA1 a364c6827fe70bb819b8c1332de40bcfa2fa376b
SHA256 66123f7c09e970be594abe74073f7708d42a54b1644722a30887b904d823e232
SHA512 0dd36611821d8e9ad53deb5ff4ee16944301c3b6bb5474f6f7683086cde46d5041974ec9b1d3fb9a6c82d9940a5b8aec75d51162999e7096154ad519876051fe

memory/3132-2214-0x0000000000530000-0x0000000000540000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\11.exe

MD5 6c734f672db60259149add7cc51d2ef0
SHA1 2e50c8c44b336677812b518c93faab76c572669b
SHA256 24945bb9c3dcd8a9b5290e073b70534da9c22d5cd7fda455e5816483a27d9a7d
SHA512 1b4f5b4d4549ed37e504e62fbcb788226cfb24db4bfb931bc52c12d2bb8ba24b19c46f2ced297ef7c054344ef50b997357e2156f206e4d5b91fdbf8878649330

memory/4704-2258-0x0000000000530000-0x0000000000540000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\10.exe

MD5 d6f9ccfaad9a2fb0089b43509b82786b
SHA1 3b4539ea537150e088811a22e0e186d06c5a743d
SHA256 9af50adf3be17dc18ab4efafcf6c6fb6110336be4ea362a7b56b117e3fb54c73
SHA512 8af1d5f67dad016e245bdda43cc53a5b7746372f90750cfcca0d31d634f2b706b632413c815334c0acfded4dd77862d368d4a69fe60c8c332bc54cece7a4c3cd

memory/2784-2318-0x0000000000200000-0x0000000000210000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\9.exe

MD5 28c50ddf0d8457605d55a27d81938636
SHA1 59c4081e8408a25726c5b2e659ff9d2333dcc693
SHA256 ebda356629ac21d9a8e704edc86c815770423ae9181ebbf8ca621c8ae341cbd5
SHA512 4153a095aa626b5531c21e33e2c4c14556892035a4a524a9b96354443e2909dcb41683646e6c1f70f1981ceb5e77f17f6e312436c687912784fcb960f9b050fe

memory/4348-2347-0x0000000000C40000-0x0000000000C50000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\8.exe

MD5 7cfe29b01fae3c9eadab91bcd2dc9868
SHA1 d83496267dc0f29ce33422ef1bf3040f5fc7f957
SHA256 2c3bfb9cc6c71387ba5c4c03e04af7f64bf568bdbe4331e9f094b73b06bddcff
SHA512 f6111d6f8b609c1fc3b066075641dace8c34efb011176b5c79a6470cc6941a9727df4ceb2b96d1309f841432fa745348fc2fdaf587422eebd484d278efe3aeac

memory/4712-2409-0x0000000000450000-0x0000000000460000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\7.exe

MD5 c84f50869b8ee58ca3f1e3b531c4415d
SHA1 d04c660864bc2556c4a59778736b140c193a6ab2
SHA256 fa54653d9b43eb40539044faf2bdcac010fed82b223351f6dfe7b061287b07d3
SHA512 bb8c98e2dadb884912ea53e97a2ea32ac212e5271f571d7aa0da601368feabee87e1be17d1a1b7738c56167f01b1788f3636aac1f7436c5b135fa9d31b229e94

memory/2196-2524-0x0000000000850000-0x0000000000860000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\6.exe

MD5 27422233e558f5f11ee07103ed9b72e3
SHA1 feb7232d1b317b925e6f74748dd67574bc74cd4d
SHA256 1fa6a4dc1e7d64c574cb54ae8fd71102f8c6c41f2bd9a93739d13ff6b77d41ac
SHA512 2d3f424a24e720f83533ace28270b59a254f08d4193df485d1b7d3b9e6ae53db39ef43d5fc7de599355469ad934d8bcb30f68d1aaa376df11b9e3dec848a5589

C:\Users\Admin\AppData\Local\Temp\5.exe

MD5 84c958e242afd53e8c9dae148a969563
SHA1 e876df73f435cdfc4015905bed7699c1a1b1a38d
SHA256 079d320d3c32227ba4b9acddf60bfcdf660374cb7e55dba5ccf7beeaedd2cdef
SHA512 9e6cb07909d0d77ebb5b52164b1fa40ede30f820c9773ea3a1e62fb92513d05356dfef0e7ef49bf2ad177d3141720dc1c5edceb616cef77baec9acdd4bbc5bae

memory/4980-2578-0x00000000003A0000-0x00000000003B0000-memory.dmp

memory/828-2645-0x0000000000180000-0x0000000000190000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\4.exe

MD5 c24de797dd930dea6b66cfc9e9bb10ce
SHA1 37c8c251e2551fd52d9f24b44386cfa0db49185a
SHA256 db99f9a2d6b25dd83e0d00d657eb326f11cc8055266e4e91c3aec119eaf8af01
SHA512 0e29b6ce2bdc14bf8fb6f8324ff3e39b143ce0f3fa05d65231b4c07e241814fb335ede061b525fe25486329d335adc06f71b804dbf4bf43e17db0b7cd620a7c6

memory/1588-2768-0x0000000000550000-0x0000000000560000-memory.dmp

memory/3752-2797-0x0000000000C20000-0x0000000000C30000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\3.exe

MD5 a83dde1e2ace236b202a306d9270c156
SHA1 a57fb5ce8d2fe6bf7bbb134c3fb7541920f6624f
SHA256 20ab2e99b18b5c2aedc92d5fd2df3857ee6a1f643df04203ac6a6ded7073d5e8
SHA512 f733fdad3459d290ef39a3b907083c51b71060367b778485d265123ab9ce00e3170d2246a4a2f0360434d26376292803ccd44b0a5d61c45f2efaa28d5d0994df

C:\Users\Admin\AppData\Local\Temp\2.exe

MD5 012a1710767af3ee07f61bfdcd47ca08
SHA1 7895a89ccae55a20322c04a0121a9ae612de24f4
SHA256 12d159181d496492a057629a49fb90f3d8be194a34872d8d039d53fb44ea4c3c
SHA512 e023cac97cba4426609aeaa37191b426ff1d5856638146feab837e59e3343434a2bb8890b538fdf9391e492cbefcf4afde8e29620710d6bd06b8c1ad226b5ec4

memory/2080-2915-0x0000000000430000-0x0000000000440000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\1.exe

MD5 8ec649431556fe44554f17d09ad20dd6
SHA1 b058fbcd4166a90dc0d0333010cca666883dbfb1
SHA256 d1faee8dabc281e66514f9ceb757ba39a6747c83a1cf137f4b284a9b324f3dc4
SHA512 78f0d0f87b4e217f12a0d66c4dfa7ad7cf4991d46fdddfaeae47474a10ce15506d79a2145a3432a149386083c067432f42f441c88922731d30cd7ebfe8748460

memory/3592-3081-0x0000000000830000-0x0000000000840000-memory.dmp

memory/3928-3092-0x00000000005A0000-0x00000000005B0000-memory.dmp

memory/2364-3172-0x0000000074CA2000-0x0000000074CA3000-memory.dmp

memory/2364-3226-0x0000000074CA0000-0x0000000075251000-memory.dmp

C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt

MD5 b6006bd088e92b822748a135b06fadb8
SHA1 51c17e00dfabf817f43d97a780a3bb2221ec3d22
SHA256 1fd4e2244d707db0fc325ef9726151d6d66950c8f512c76a58266fbc4bc1c63c
SHA512 f2589236a93f16cd19a73d4afaa499289f3c833c2ad3b69cac2fa18cdfc33d9c6878a32dce55ef0f38f4f6af2cf4c9f389241eb958aeaa063056049f0c30e6d6

C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC_K_COL.HXK

MD5 044e3cefbb328ad6079cacd53e996550
SHA1 77b04c23366f7da79ef6116649411d3acde81eba
SHA256 8b786b138c6fc9228abe40999e587408b15fe6897dbf6c53f7a3a179d6828984
SHA512 1a78c0cdd9bdd593fb75e49cf8b174e8ba36216f221fb14cc5d32c640404e536353ea88331deddcabd9eea60d25b74cc67df53476745696c29cc7423785411bd

C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC_F_COL.HXK

MD5 a840806de871dfee2b966250477bd866
SHA1 90c1a545922451a5c9c38220721156d1ee433cd1
SHA256 d276320179a0c02693ea42028a892fa649ed038cc76c70e03487e25b5cea5954
SHA512 0e8fb66903a4d83e5cf9cc9da3a39df9ae8a6a044ccba4051b631abce47e08383043f2842928401698a3a4b163df799d854dd6609aaad3232dadd113c63be067

C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe.config

MD5 ef72f09bcfb39e527523d7f73bb78eba
SHA1 7eca862b15300f802b2a2633d4fab302b9fc21bf
SHA256 bca553d7536800fec1e8de7e11a8d5f4ce39edb19317ec3a0523ae320cd12510
SHA512 597ac27685070abb1fe2f86f94fbbf17832e8e278e0a276e9d0c1bc69dc5dda81a7081fef033982cd378a6847671fecfb986769df8e31a307a34834f5f368184

C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\SIST02.XSL

MD5 60560a997f2c2b1357b23f8c0ee23e3b
SHA1 5758960cc7985ef7514a8c1e3301ab74587f3d54
SHA256 6dcae907a651a08a7b05bca952540f1d18008e64400d76468c8c2e74ea0c49d3
SHA512 d268a1708f95f5798b94edaee76454c50056cf0db526227ed8eaec1fc5a3668c9de9764766c6c41f9e7eaf5b62ba271790e928ef64bc654a7b75050f341c3691

C:\Program Files\Microsoft Office\root\Office16\PROOF\msgr8fr.dub

MD5 091a27172ae2f66acfc2d7c3c7f09ae7
SHA1 70f89363a82c8b1309de8df0333b3c09cca755fc
SHA256 f839424dc85dd761150018da066b75b0758fe9693af4d28ef9493fe28822a4fc
SHA512 f6458c3441bcb53ea38bb9d3ed5a8ae275c09c27117dce3de9fdb4bb85709e20b0fff258f2953c278fa3513e03c60a699647aa277c584cefc572fa944a94b362

C:\Program Files\Microsoft Office\root\Office16\pkeyconfig-office.xrm-ms

MD5 710ccc148cf1c3a564d7398ef49042ee
SHA1 3928cd6c2cbcb3bcabe7b83120467348429b02c9
SHA256 02035a125d1dc59a7bd07f6236bb75267f6f6876c13cfbb1173dd3ffefb51f79
SHA512 5d6182ef1699127f0dc126ad63349672b9a0e5fb56d1338be460c11e53d5f90608853478089847565baa715694450b2d86013076ba55a8e18ff48c978bdd0a2c

memory/1752-7183-0x0000000071A0E000-0x0000000071A0F000-memory.dmp

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Cartridges\msjet.xsl

MD5 a6de67656c5c3c4ca0fd245913e00857
SHA1 c29a7e8f28147166ea0b9a3a57458a5a593588df
SHA256 c2bfc9cbf6565c1a816d34ef4e547194516db20e64f5d965a130ea6d76e1b16b
SHA512 57aa2c67c93dd27d99543b4af3319285d0877c8ec4d9793ebad272f8c86ba13fd1ff9642fdc70fbd4673af4ddc19c8c6759eb6821d77fddaab03820b40c14f68

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Cartridges\Informix.xsl

MD5 ae6f89c676f3062d2d273ec7aaf70667
SHA1 c6769af3e71d8797e529b8bf6c4a328b1d46273e
SHA256 c204f941e72b5506dc4c4b47446aabce1ca0c132a2958f1135915065112835fb
SHA512 ed0a381bd10edc7ea2f91d2243cdf5d113c0d15e00a1daadaed1ade3c60d82ae7c0113602ec4712e510e5118d8b627c734cd2f8c4a9fd4bec44b50f1940e08c6

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Cartridges\sql70.xsl

MD5 84a313ab4bc69e70c783285f8244930f
SHA1 d8f465454bb18300620eea72531065f98b5ed894
SHA256 6747079f8625879265ae8f13a281729a200cc45fbcacb91f8fe0cbda2165eb6f
SHA512 18c715840a0b44489c9657861f081d683568940b17a13e885a63f587ec92fab1152ca9c994fb35832c5c47b72ca509cac940d56c9363bce3677361aa903f7556

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Cartridges\sql2000.xsl

MD5 0f20b1388c80670171d00ff1aeb23cd5
SHA1 9b1ba0bc5492c0742780d0941debf5736ed6e64c
SHA256 72b28e0d8e45d78c666685d665a103030d34cacab8ae575ea446cacbd3d22017
SHA512 44d8a32a8649e6f45f7e632cb57ee8f733576fc6612ad4aac8203b6771feea321f91aaf4dd090022ffec4c2287ca8cf0b1e25c2f85970e16c534b377f3d7541a

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Cartridges\Sybase.xsl

MD5 9e6c43ddcd3f109181add54fc8eda7fe
SHA1 76b8045163934e113cf25ea08631b45c85725169
SHA256 c5d17d90b77293beb9f8ae8dc0260a81dac0e99e1f08749d05ffd9f586da9233
SHA512 772e3294e5ec6e3519527c1c0385154aa48f4241faa7ed61e5c145a8f3dc0e8c7158abc86df6b6a3e7df6a51c353b71961474109177442d2e967e987dfcaafc7

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Cartridges\hive.xsl

MD5 4543c11266a87397d25706d9b893e8ae
SHA1 d6d090e74fddaa306817d6fd3fb82a9d40917b1c
SHA256 ea8acbb5f65ccbf8e9ddec8856a93d1624cf04992b1ba6f23bb30716f75dc389
SHA512 60ba61e545607a9242a53326fac57860b6b7e43c94b8c6e63615d969f936f59dcb06e03d01022b3607cdb4fbd8819e292d4a5912dd434e25f977d7682eed70f0

C:\Program Files\VideoLAN\VLC\locale\da\LC_MESSAGES\vlc.mo

MD5 04b6621b74403b667f8e49bedeef07ee
SHA1 d15b0ac08d7491ea3e1ed1c2fc12c7968ef22d31
SHA256 3e2e021271fc37fc3cf816d187e7652dee196414a0b1e8717549028c57086add
SHA512 33d1eb88f14c8462856d40204c30a7dc90839a4182fcc6b3c2c9d3b3f4c137beaebc057ca587fef97e0e5d88878ee0621e2d466b9292fdb4ecc292ee45bf5d02

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\aic_file_icons_retina_thumb.png

MD5 0e4ba9aa0606c64f803e4631df9d0e23
SHA1 5a32fd065375899d221bd13915c7fb3539762ff2
SHA256 d833fa9620907bc1f39d3bbd87e7bed1281d86d8a6031668de9e10350dde934c
SHA512 d12a99cad8942ba91f37dce1efd3e161c464224bdf43c041d589ff1dfe58b23c08b295e993ac8cdd0299fd9094a4d7a418475e5a922a45d89cfab748edafdd6d

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\duplicate.svg

MD5 9d323942c78d660fe3a5182f76d3efc1
SHA1 e34a137fec9637fde78abc8d02662b3ce33390d6
SHA256 53e90018bbc7770b75ed0a2422dec20aeb3b10b87ea079c8b0b22688ec953fc4
SHA512 12009ad5ab6e2f4f6b81b3f34c08918752c0341f87b600a2b809c6f4330cb231de4150b45742daf6476297875a8f44f29b82ca73a18f4ae2b3207c59334a505f

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\remove.svg

MD5 532fb787bb92199737440f5126b3c4a3
SHA1 6ae5dc536eb4ec8800feab552576ec151b3e0593
SHA256 e59c39c2d8f1c369f7bcaf0ddedb5da3fd9b1e271ae699eddc3e660961a37609
SHA512 15313cdd05b8ecbc45b527eae860642220bb50ed9aed4b01ddb5285e962fb8e92910e73665279fd564e858e17bc2d7181f5801438e9ff85da85725dc637cc7ff

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions.png

MD5 f0db34440f45faf2125a77163618a6e5
SHA1 fb8cc6886ce60174581a11de7ab21055c81dd546
SHA256 a1f1e8ee4fa785c91e1af94f322cc9a9e78a88afefb3b005f4a46beeefa379bc
SHA512 45fcca9a50ddf3c5b179145628dcecdc14e6fe7a3dde2ddeed6e88ff0084bb59804a0be418374c1addf2521becd29f921ea5c1c41a4f34acded9c86ec1d604e5

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions2x.png

MD5 e2af1129f688dace8d0df4bf02398a7f
SHA1 3e6a9881f1115196c6f6bc6b25a0b8699f32acc5
SHA256 362152ac55591014cf4a200aee7f8fe73251f3740ce7a8c5e4933a6dab71572c
SHA512 ba3ad713336ce95aea538c1b3146e60500ef79979da6e8b531973bd20abf3fea86d3117aa30612ab1ba674f450cc6d9627f46a610fdd7e0e3d6099f899dbc399

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_backarrow_default.svg

MD5 38a4b3796dafaea658ce7fb215d0cd56
SHA1 6b698405b3bf883ee1e992a015258e8990674dd6
SHA256 d9e00be3ea0bfeaa2f1b7c435843b757005080e168daca7343498eb6acd26cfe
SHA512 45cd25337b5823968006cc29948fd7bbbc5930fa1745222bca926c359b7fcf69f1acbed38c6929ddeddeb0e0c268d00320172577d908877986c0a492b773cbff

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_closereview_18.svg

MD5 0fd6fc881a6107b453c9f635c19c8767
SHA1 f0c25656df80be309c11af9fc4c7518fde450471
SHA256 0b12766c33ac7eb28a9b18f562938be9e6fd860350ea30dadf76a27a9ca995ed
SHA512 8dd6f386759d0e3ebe685017b6977f8e5c0a85c198e71f15e09e4f40e94acc2b14d775e4a17215c27fcf12f15d61b1acf7182a1a80652d24da9c04407f920289

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_comment_18.svg

MD5 6236b59fbc1ef71430f5ae211d207208
SHA1 b4c30c0a1369f372e689b3b2beed828397a3efea
SHA256 4260f6119cc214b66a7d939ae4f37b8d550844bc7dae2dff7035fc9b0fe1a954
SHA512 eabd88fcc2ea5a4f07c80559b6b50413d38219f297296f57cafec9f61f43dd9812b8b98025e172dde90ebdac359d15479c1e1d92b6fdccb04d56ec31af75175d

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_editpdf_18.svg

MD5 9b3f4437df5cbba8ad9b91a5e179b8da
SHA1 8e42bd28c5c7b981d19d448b8a6c8b7a07e16759
SHA256 27f2c3a40fd421f99084c1fa5eddc213d746c9fd877438495aee23e687972424
SHA512 a339fcdcb25cef55ab533c85fdee088e9693479e8cc4f4c66da71325115d7ae6de9cc61ceb20b821abbc720e6d569a237451f95ae452005c379d0c98b89696dc

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_export_18.svg

MD5 774e6e97c67574e22dbdb1300e9257d3
SHA1 24d2ea1230ce14e888813845d8c281208edc5440
SHA256 12225c57d949a819db7cc16a963d593fad77cc64f19910fd7d852f551f8d74fd
SHA512 e837e5da9d8e256cf07cd3f739338e81ebd08918eed41dbe91946947f81d41e8b145ebcc36aef5c9c03d7f9f113b05923c2ff019c7035db974afca12ca35da8d

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_fillandsign_18.svg

MD5 4802dd9c3dd705c170f3ce63e65f5243
SHA1 a263c37572446926f84215fda8dc815b1eff4ed5
SHA256 b416182b2675d3f88a0927f230c13a4f30badbace5d234c125777bb79f2e515e
SHA512 b3a0a4642ed99eea74bcc5c2a895ae41db76ab97a269ae5480937f231f1eb7deec6714a1aff300d309dbcb8a612df26c3f1f65e3abce771b3daaf365891e2d5b

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_move_18.svg

MD5 048d26a208290b8232b974bf21ae43b5
SHA1 f6b22ea6475e9f2f3857e970f6b54ed1ab8e7a01
SHA256 3a738ae53bb78ad7f7d56a0deb429b3ce7783cae1879485c64c8fd2df006ca14
SHA512 434d5a464e76f91112ee7dfc5e3ba667d67f830dd8ef4c39d43883aca0e739816bffc0ddca15a30a746ef3e7f0fca040a6fb5f533764559c361e287eb87f4c60

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_newfolder-default.svg

MD5 9b03f5bfb906c39a543b76f9828dd801
SHA1 cfd74312057c35a111d5bfd14730f284cdbc1f96
SHA256 f96f2e2d61de9b530b1dc2f8b5e99fa539ca7f13c0cbb650e5c11ebf6c65d325
SHA512 df134f7d6c919e20d94a44dcdff11b79f229f4ad71d11f81ba4cb446d6eacaa9d018de9b0cfefa868e0ee0a7fc54b602555d47a5f4bc53b4c7fb0baf022304b0

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_nextarrow_default.svg

MD5 908ef6c2302cb64061a14f12e7381e1d
SHA1 f799126f1f5b0e2a65110e3ea85e696637487dac
SHA256 d88df1e2554369c94cf4b92c16b8579879c469fac7ade80981cab9aa0d1ed9cb
SHA512 ef69967ae485c58c07c4c69dc77f9b957a4aa2821e11112f2e1cb18a974b3b6a7fc761064836277377398ef7d0994994532bdea0e9b1f040995fa0f29e0a6c83

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_organize_18.svg

MD5 f3150c6aa7ceff003d6ad18aa9ed6a56
SHA1 affa7385755562e69f36e6328d80eb2281ace882
SHA256 b9fdb600e976b0d154db320fe4aca2ce2ca629368a1e13748af76ba9ad740a13
SHA512 21bd32f6b9a1d1fda72dfcbb07aa03ebc9e830e31a6b42a7d9bab7319ad02605038b9f01b4194fd28e1a1ef683352508101b78046866b6460b161881a5b5e7ec

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_rename_18.svg

MD5 404ac32df670e8353538c4117986e249
SHA1 e902e87b84a3e231f9523f9c74dd068cdd16cd01
SHA256 14ea1f07f0744a39bcaeb939b66721881cd8d0ea9754a296c34d1bbcd4b9e89d
SHA512 fc26f3a9cec22bfd54e3ce736d7f4ded039a9efe324367dc8d2d047b3bf98079e6d69137580ad4de87393d25aa6b8fd254911d42cae18cb96084dbd55ade2c76

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_sendforsignature_18.svg

MD5 b227daa9f3983408a72c25141628ac28
SHA1 e02bdc9b00bd8aeefa6c539f787297cb14601e55
SHA256 82d67010d6ba9209e4a5927dbda0645f3451d1cd71f7f183504f9bf1d53e4500
SHA512 6b2d5404f0b349cc5138ee3961ae3ad3716f586f8bc9a6477d27fe6e0958051559afdb203fa8c69400887dd2830b3d2db4426903d52a012fe22011020e1d7dc4

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_share_18.svg

MD5 dde911ebd87bebd8dd7eac41421096b5
SHA1 95f1cca2974f29500e7cbfb4ab0ee7a5f14ea7b3
SHA256 38b62b8654b05b667c4632763c096e5fbdcac90a171af42b02bbc12adb07fdcc
SHA512 c3137ed23fe636df6666145f7258eb3121104c4ba808be8ac7cbdd4442a73d4d0aecead3882d594022cf51eeac8421350d5b1d20ae3a3c82830943cac95c7dad

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\root\ui-strings.js

MD5 33b462834d9a7888ef80eb0c3f255edc
SHA1 5a2f74e66e09b7566f75b75f54589d95cfba083c
SHA256 014ed965dfbd15a052f08d2e7d3983614997b05675fa5954d3ac7578ca55c0e5
SHA512 3ed46c830357c73c38f1bf367a7b157b1c58b9b0313268e86c5393b0c814899196a50c11818d1080f1180a6c2c6f7ef37dff4aa52bfcc5f2f5a856bd385db1f4

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\root\ui-strings.js

MD5 c57b434bc5534f613424c5cb9eb97287
SHA1 29df62d48fbcedc101fadfaa86d8f97d5b7fdcba
SHA256 06704cc1232d279d556f09adc3a8b7b5d36f1cd6e74d580e4b3b999b2194fc7c
SHA512 07f32d570cdb79b7f1488aa55c912efcb49eed2ea837a18293bdc516541e3c5c8d55186118958cfae98dd1ce6f74b79f760a3c0b8805db8f8ea9253db61f38f8

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\root\ui-strings.js

MD5 fc89ac096385101cbf25ccd1c1cdd507
SHA1 729ba0f6af676aa03f4ecedf19abfc82b367c708
SHA256 68c1267c3926144898b35785b64eefddc06b3be1a8fc74caf3ba1a79aa622b7f
SHA512 a9227a745e21bb1274f6e4aac37419e740c36f01dfa6fa2f3d74d8687a167c849a482fea563c151edbdb53e8e04327e5cc1b89bc47d1d5216c7cb75332cd71a6

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\he-il\ui-strings.js

MD5 20d23e46304acfae64687f158d9e8968
SHA1 a36f5086d8b1823767d4e5accf0c4208a5c5efc1
SHA256 4c91232c9ba0fa8415c6fb1b1a0b9fef1857b189c20ffe31928e7813d7c0e9db
SHA512 ec4db12afceba60a43dac653f8d9dce403f279ce2d6c417f69f1640fc08de326dcdadac96527a578146e8c29717f4b9e13c2a7d34123a116eef2ea6ec9e461e7

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\root\ui-strings.js

MD5 b08fc434e404eaf4d96d5b509aacdd92
SHA1 f56aa2f703fe10abad044930c0d41ed8af3f0cb6
SHA256 7883639718e3f2e3fa81a51ee38f3457410bb8b908d8c55732a76835a6bd0372
SHA512 46104911f5f4d5e2a61a543bb26d9a7c690b789a866938c1eb3a7ac87652c3b5dfb05d3c188e22c3d99cc10384ce1e811a50243922da7ff098e17b1f6371131d

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\root\ui-strings.js

MD5 972ee7f22f0832e64074d5d8bcc8a068
SHA1 346259d6b960973223cade0c57ef606149445d64
SHA256 c7811047de3c0eecdafc5fe20bc743b6414fec4f6403676c82e4d9c4dfad4b53
SHA512 1765cc63ed851b920f58eb20d39018af37bc100aa905ad9887ae97b3c626a96d40fed9c4a57b784429775a5eac3c08744361f1c86f52ba1a6d78928a0a555b57

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\convertpdf-tool-view.js

MD5 bc898db9cc8bf0481c355f17520c9c33
SHA1 16ee312e43adc95ae4dca80ff518ca4cd90fd6f6
SHA256 ebe3e96976cc5bf53016a40cb65544145aabb90fc7549c907e3bf66706b339f9
SHA512 f1a18b94b8f4d60b4e801c32100d04a9e9963c0375e6b448788d457c44d5e25c83e86438b551a2cbc8fe7d547bfde56739073d6b1effddc24a97b92eba0f3a76

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\convertpdf-selector.js

MD5 7fde5587078598cf376e9d0584a2bde6
SHA1 e6ec11027890ead3b24469596b1e9094c08da1af
SHA256 e69bd6f53c1e6d02324ff31dd2e26503ef5ef0847482e2d5d1a07c9c54bb00ac
SHA512 9e55a9106b208d78978b2edacfb4ffdc0619ba0e2a93c17ab3705e7046a5dd28b2c9f9669281199a5a726d130b5b8f014ef90fcfc6eab5c1dc36b2ae6e81a398

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\root\ui-strings.js

MD5 9a26dcf6bde9993a8b404a6b0d9e3191
SHA1 f76c1c890b595c7c98ed5e4994f2384e2e7cace6
SHA256 1e6915c3b50a927fb1e53ef57544c93263d1bff148d726b879744461e38782c6
SHA512 464d6869672ab6084c7468ec358215873828a2eab5eeb0b00c353cf5253abee0376e481fbfe0afe519ccb426b5978ccd91dc53373a5ebd25a45caf96a2bb1d71

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\root\ui-strings.js

MD5 acd8232196edf54fbfc86854bf6fa114
SHA1 bebec1680e1f6c24f50f2846568cda0d05425e3f
SHA256 400d00bd2f44877f06f308741540c648b3cbec76089e9cece3b5e90d9e60e0fd
SHA512 d48bf898cedd4d8bd594036d7d352468a23a33ca7db88bcdf8438fec41406a1f9ae07e0544f164a9ad4110cb969b386a45c6761d2d67d1759a748198db3223bf

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\example_icons.png

MD5 d3559c8a2fc4cba60e281350e08fae3a
SHA1 0c4b2a2fffb9da65e4549dd9008487dd177648f4
SHA256 2a4b6c61e07d51906f1be2f5ce274001cbfbf2b849213f4a9e49c6b408603b09
SHA512 a363ee722828a6609e4014b29448828f29c2b735b20a071f0917cc3713160545d60033249fb075634b77970dd76346d9bc920acf48ddb7f70ef57e5eacce2b6e

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon.png

MD5 bec2f299988850f410537e604fd87574
SHA1 ee225877c25cf4b6d2ca36094bb40b4502a4063b
SHA256 45242a5a0d21ac030d02905caa56f16b3f717eb12e3d48038bd9cc3d51e24a25
SHA512 b19ac8a57652a2f05a215005fe142caafceb765d816405a4dda5b11b0d72fb95df3c813f04747d61b16871544e9b9da160ea60872ebcf3cf1824905f3dd2f2e7

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\example_icons2x.png

MD5 f1e329e71a679418523793650a17ea02
SHA1 83b360c9b838766d7226185415e62ff81bb0413b
SHA256 7b5bbeface04b9c7d86b74dc83995c6f759669591a3384c3699d138a2bd06520
SHA512 595b7fc580eecb8f66dfc96d2b7467f8d60acd1319fd0063b9cbff039166013376db6b995dfb0211664b30828e78cc49f4adf16a2cd5cabddf19a85e25c9396d

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png

MD5 423238c2a25b51a857c20dc32cd2eab7
SHA1 919c44c5dd23635b5c1ff1b41120d8ab2a8a6702
SHA256 eb022ed506bcbb0a26a3250ee6e5496e55489cc9c6f37757f0bef5a8e44df4c8
SHA512 02a540b13c2e5643728885b9c0bdf0e586c8a5fcf0e315feb53476444ffabc59cae1e7994f934adb803e5751846007efee91eefb8a46575cc395aa7170c04eac

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png

MD5 95b26ce5b7ef6f041ff6963a25dd43e8
SHA1 474ab816dcc2d34f864069ce103c5496209ff93b
SHA256 95253a91105e900a0f89ee2753a93273de9a94dea73880be20ad3f08d41ba649
SHA512 0a7925fae7c13fe6bc1e04ef0aa6b38b7c9cba5c586f781c7c61f37a4cabb36dace9b98a2d72aa50a121e990b9de33a83266c55a37b676f360ec3b1180fa0505

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover_2x.png

MD5 69db5915f390e2481eef3d3f8a94a8d3
SHA1 d87bc5c612823ea11b0f191c4c0c2373f86b0635
SHA256 f26b43defcd3e7d7da0ce87a97db55346a5d41a2e38b2eb4c0b6937b62e7685e
SHA512 831cc3afb474bc9cec1846fec42f09c1ed0795763bc0fcade08843a53de52163895799113516bf1433be08b6644204e9a951912f502ce4138ee7993f0a26c33c

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon.png

MD5 3e23b99f6e8706ae96f29e6bc1f50fbc
SHA1 a7c70942aa29aee7f20210eb2c7dde4b474a2118
SHA256 af256db671976987f1fd31655e22e18b0351afe16a21833c4be442f1390a904e
SHA512 8374ec9ee1f86658dff22b15211f4949423e3717d8a8ad1c5856b889de13b9a7d2a6bac432b269e7f6bcf44c400d6d395733e8e225153c59e369b3377d217feb

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_2x.png

MD5 362f23acb3edadfb9d4a829db16dca3e
SHA1 8229b2ddaccc430e62047b8b2355f21143cc48a7
SHA256 b4056b426d6a3b24795e165a064424d613d0bc9b9333d52449263eaec4958163
SHA512 f03ecdf219b90c099798bbabc9de2cf63e1c8e8d687d08c37c0f4a18cb3eeecacc00192d58209651b9389aa103cd8a202ea9238cf785ee450f3e5564f91c54a5

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover.png

MD5 fe15c1ad1c043d62c44717b1ddb74568
SHA1 e180008ba06c9d398c01e64222c685df5fff961e
SHA256 ecc08014e35eeb0352dd02d8b8326189351672e469d92be39b77533b4fc89ede
SHA512 badf8caeb52beb688be192e62650ec838effb53f6fe2d03057ff4f58904637bade50d2b3bd9db12a859b1861a3f96a1727b934b9b3fadb42f404d849a8c77bc5

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover_2x.png

MD5 5028a19e8fa2ce21b5743356ddc73443
SHA1 65e1441322d703b744daf6b4dc65c370e70ea031
SHA256 9dff57ef95d59027a75ce98fa7cc2e28ba3f834a9dcd9aaadb7084aaec8b85a8
SHA512 47778cd48e55fe661c7a4f10c4417d43d59b17eee7c062fedf43b6db67fa18f04f1f7b321ded490a1ae551d93d63e5b5d9295a0e93a41b7ef39884d2e8f8e9c1

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fr-ma\ui-strings.js

MD5 ec05fe1d8a9f993be6cd9b45481e1bcb
SHA1 3fa8e1034f3d262327c313af3c05dbf46d2feb5b
SHA256 db2d823739696832a229aeb92df97b0b6468f635fae42acebb0395cd60773f89
SHA512 62c376e54b7602995da667132927df218c0c1adb6d8da055c004cb7a1252d952d448358601870d6ed5aa8b7478b45b655330ae227ed1671821c4b94d350eeab5

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\root\ui-strings.js

MD5 e74dc8611326afbd7e9f3cca921d6cdd
SHA1 3ace41f215a1b497d759f59049069b48190687ed
SHA256 474065a1b4fb714ba42d2e1ef380f81a4091a11faf5bc95a5c9f2ee8058b8189
SHA512 925a16efeef6f6449fdea28b0c3d355ad212c9d5d94aa765472906eb01c1fef48944240c43f6d358ba002ef0ebd16e3dbadef12e538bf644cf7f6fd6ba5145a3

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\images\themes\dark\s_checkbox_unselected_18.svg

MD5 c6ddfe7eee8bf8e622c0902699041add
SHA1 58cf1fa14e4c5805ef830bcd5a81164d64f7b788
SHA256 a09d134102837011ce51561fc5a1c8b12bb3d73b1ebd8fa9a8fd03bf4a99c64b
SHA512 761d24bfbe8f98374b34d3ae0ba29e910bf73ec3d0abcd5a7a0c8274b76252519e915a0685eb11087504e3df974951f9f54b39bc4292819eec38e705258d6217

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\images\s_checkbox_selected_18.svg

MD5 490eda649d011f920c7c15aecf26db91
SHA1 a388a39842621ff378eeac6f5f424bc5660e6aad
SHA256 7a2aeae8f3cd1e177d227239a9dc897abfdf6d0f502fe192201ca74558130f24
SHA512 10f6044577a706e9201f92aa946fe8c49ccab70782afc9c73e34ea826e8a8d3d8b47b9a1f7962036318eaa97da039ace058816b6e7458af3a2a122931812494f

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\root\ui-strings.js

MD5 d6d0c405d6f5c5a9cebe39389f2d8c83
SHA1 6b404421b22ac94905e41e6e6b2d87f383477222
SHA256 afe73271c42e6ffdc2d2e02dd816a0f6bf1acd2b9b614c9f0705277c9ce63184
SHA512 76eb7caa077fb3c17c9eb7769bc55034ec0a706251ec1447152f1541e0a06ba12d516364e78a2766e634f4f8e7161ae457cf44ff6fef1b046c1e6c1b9c45994b

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\fr-ma\ui-strings.js

MD5 1c3cebb5a424094cb34ef22e7201c563
SHA1 2216b35e092dc9e13b3c877f4ffa83aefe280c7d
SHA256 c540351b6fb6b1d89a806c64a0159ba347ace232511f2426d7c0c429d46c5d85
SHA512 8e5ecd3c3963586a3e829cc75d3662f989db24c5522c72730bb6e8df2e12ad3442d72ebb361b326cab70bb8d3757c23d0488f1a211773886a19904c2eada97f0

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\fr-ma\ui-strings.js

MD5 45ca0057a01d328421ce31a9f3de5d5a
SHA1 1d8eaa7f737c585b54b254f3e4842ad686f4174e
SHA256 fb000512a529a0ad9d4194df4422e1787d1f0584a9c562a3050beb761e6e272e
SHA512 2ee2111574ae6ec0a39b3f16d8eb2552d7b0fbcd0c89b40c5fca1f1fc3388c1a432e9b2155409a12701e7f934b13f063132b3b1f497060da5111decc3626e3ef

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\themes\dark\icons.png

MD5 24fb61b71d348a47fa62a177df24abd9
SHA1 468ae63aae81bb5d4e05f7cf8b2be8d22e96a7bb
SHA256 467ed93cef96f1a69e729df145d3e81630e8b41809c06d1d4ea4d1feaad1aae6
SHA512 7662fb5e893d2d34c50d2bc6d6af93ff5e41b230518f4a1fd2a2169abb66001630d63cfde4ee339ab5a731872bd31d96d91261b022f664201b39ef8408ef50dc

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\themes\dark\icons_ie8.gif

MD5 3b0dc16657c6b43236c1e6f6336aad77
SHA1 b4a2333f25d11d1e6bc21582e42715de6da61cfe
SHA256 2de5f1b60d8230de90bd35f90434ae878f582805fe98508fd6bdfd64752509fa
SHA512 64cc7a743edd0a657d4023892082585283d85aa4443402b27c4e167a39aa83238d354c711a475b53327d95e5a5a272db8a63dc44c599762565ed52d1da6969c4

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\themes\dark\icons_retina.png

MD5 89496c6b449a7d0477644e523d1e9d77
SHA1 8e5a77bb2959820cecc32645ae8a0a17fc47a680
SHA256 02a260f6b925d96945fb07f2a67a6c0e6b532e10995fcf621f6ddeae3cbade0a
SHA512 53d039367292995f62cfa9f4b5ef39260038a3fc7baadab2177b8fed21c717fafce57685cf43fa0df2fc09d474f6de9a36b8960d82e5bbed4579c46e0ef5b350

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\themes\dark\new_icons.png

MD5 21d13c280e2e5a3416b9ad1268c76610
SHA1 1794e1a0c319ee973d15ee4b9c6043b5cae145a2
SHA256 9d3d15310d949f21c6cd273e47c48beab7750e2542a2041462b57c845f6e8270
SHA512 910eb6db9d2ec6e27b3147ae96706f21990ffef7f35768237de56de632a6ba66af9ceb16e79ef5bdcf94141738f33d7d814fe6fc4f4949f0d00b2d795cdf96f8

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\themes\dark\new_icons_retina.png

MD5 c5a55efc00b74df22d9f281c92231931
SHA1 5df6c19b4c28d092df3f559058b1a124e1ddeeff
SHA256 d8cafcc1f12efc445d45a8136f684a113a7c4f712af4c5cb5300d3db2e7c484e
SHA512 0dcd154b1b4ba2d32640ac04d1080f4ef2cb4f95e2b4af8b501f5132d45e314b62102734c090be57c4f2fe861d1aef19ad6d6a8b443e42ae590313a054f0488a

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\bg_patterns_header.png

MD5 1fc1226bd9bfc847d98fcb4e4a922c12
SHA1 d4cf35e70340b8114e5112d577e3b00e1c0147be
SHA256 1355ba25af670643a837c58cea5dfc45700d3f29362eb444748da70e50899b00
SHA512 6418500b015d60fa3e4ef53e0876ec184953b60b6ad52159ac0246d1537bb72cdb8f5daa57e8d1cc237ca4d2773a4c87ec73f3bc08fd25e29cd3ab96b65a775b

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\bg_pattern_RHP.png

MD5 32d8f0f51262c8baac9067ba65ecaa06
SHA1 8601ab51f47d0b4f1e5894ee60cf1669acc5cb4e
SHA256 85ca4ae4eb03b06977eb485462c069d134d464a504a6487b6cbb66433c610547
SHA512 8bcccd0c3f289968ca896177fd55b9606fc0923ecef25a7f6f18945e2b57a4d76e446b8dd8acbcb338f3ca4ec980a354a7cf3b3e695f686128a624724b2c3abd

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\illustrations.png

MD5 d542d96bcbb92eb5832ee98ed0b5dfbe
SHA1 48995ecd9c525304233c386cc226468dbc93c4c2
SHA256 33f077399cf7f8b8b2a37b35aad624ea7fda1e264d9c7b528297ffc9da44e85e
SHA512 b5575d0cfd5e46fb0e0e118587a3ccfb0014ec84ae3397b8cbc635946d180d3737c5b4793dd79aae6e1d470801b1622a3761d5449e24f1351efe4772bf428d1b

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\illustrations_retina.png

MD5 97e5e7738463397ff22cd6d50dc16c6c
SHA1 c2f24cfa5856fcf8dc4c6bcb30bb35ac57d2cb86
SHA256 250413d9bbbfb6f2643ea154cf7c712c542e90d6410ef985827bd3758ff45130
SHA512 c360eb6a657558c835fdb62a748d251bfc3ed50cf84dde967e4a1d504a435f2d3d33d6450991ccc5a07552fa9e280358d2d3f33c73e8d6759fcc1803ba49a9d8

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\root\ui-strings.js

MD5 a60ee267bef233373d98b8fcf09e3d9c
SHA1 9abc30581727d4cbc17dd94361edaba14f8f1bc8
SHA256 415b1d10507d77184630364930781dbf47d0cd9b784ffe0b39773ab1522b5d7e
SHA512 14a7d8e3e94c01af5a2afba3d63d5534810eaad24eb4e2dfdfebe628fc9abeb5316f4c83be1b668d399c4c2a3f39887491cbfcdd848a7c6ef9973778e0073afd

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\sl-sl\ui-strings.js

MD5 6a1182e808f1fa4bcc198274afe116c4
SHA1 768ee8067dfbf20d3a3661ddb0c48a2c9161a90f
SHA256 733830aafb1d404aa7a1b89e8e06def4b84fadb4bc03a0752807c17a7f52e1c1
SHA512 c3c8dddd51b386a44d6ff276050309532a1994c1a70668318c1cfadb00d49f1a2cb2844beb8d9dd854e4eece6628320647d6ce31c5eb22aafa2c22ec1c407979

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\en-gb\ui-strings.js

MD5 0ed4e0b89b772f926991ab01a094f3d2
SHA1 7d8673ae37a7e44ab73741d26d1835c0412b65f7
SHA256 20da7e68029dd58d86e2ce1bb9d5e3e711f3145a65fb6872d1bc8f4cc4a4e9cb
SHA512 851e2193e202202e12ebb79e07564bbc76ec670517055281b2c79df4c20aaeade69674085081f8ecc124694006a58162b18e99cd87f6cce884e8891d6cb4cde3

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\root\ui-strings.js

MD5 d32a14e4f9436ced6b2a2d605c0b47db
SHA1 f7751ca772617f80285191fc9793a7b5b0c3d9c2
SHA256 c63e7d09774db8e0aafee8c5bb1494acf3684bcdc83af7438d6077930d7800de
SHA512 92e372239fd502ef54e7c1f100b05a33dec46f6bc0c87d948fcb2e9c3861fc368fb3b0e06b5b592b5aec51c57ed00984d982e258f78129f7d0979522bb8eed79

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ui-strings.js

MD5 aaebe1cfe780c0f70b6ad8181f33edf4
SHA1 8747c68d8c2b593675e5ece1e743b5d1103cbb5d
SHA256 f592613b9ab7361fcb535f29129ee87845c66bcc8797ed34dff59419bae60c32
SHA512 5b2095c7f7020ceadb089fa719d3a896f537eea4802e20f127625acd9a95b72800badb36cb2df80b8a1bce878e1e921349fe2a208bbe98184bb172c33e8ddc8f

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\css\main-selector.css

MD5 9fc7d74137a102d83b84be4f8b20c568
SHA1 c3d4a38eff8dc1bf7723f2bda0b2a54192812d5c
SHA256 4c186cc93e115ac4e31a4a3c17903c858e14e0a5d5fddfd7d5f470a166ab0cdc
SHA512 0213a0757d9d5faaf9e2a4151fa520eb1b5e952fc35ef3fe2fb63169b7152d55fb5e2d13be0a02250c79538a2c08d6dde1cc396ba34ed4a63646984c0e3045b7

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\root\ui-strings.js

MD5 255bb72094ebabf6e92c7364fc385e99
SHA1 296f413c517a3886d94eda1bbf449c7407b8f3c8
SHA256 d06694c3af86867f8f52409edfed8b07703cf8b7a3ac305fd531a7d5457d2e5c
SHA512 0dd915a3e754b1bcdbb5eaacc3b522d832e51b13fade993ece679014c8ed6462fc3c82bde70531634361e87fa86a644aa73c281b093159b52a9c24b10beebcbf

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ui-strings.js

MD5 9941a3fc073fa3a96c380ba7afdea830
SHA1 1ad73d05ccb673b19c601c3d2ab14a5369087233
SHA256 76f3706a2731a7a177dde7b0a4ae9a08198eaab340073decce32e91238b78684
SHA512 9452a1391bd17ef08065efa51c8aae7b6da7def9e96e1074069109afd03bf9fb39698af8f3813b71bbc6f2650fa41b893d0b0bd37795e089c286ed76de030b80

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\root\ui-strings.js

MD5 6eab7e9b5e7896f842a5b35dff0b1012
SHA1 d7201ecf9c3af6476e1d3e50436f9da81580b7ac
SHA256 0716ceb155371873493aebe9e71d35238be412ae19ff795f82fdd1b62d9754f2
SHA512 18bb74235bfbc608f0491cdfe8813d767bbe3463307ed8e60a93be68dab503ccd3e6326d90057b9a6fb56bd00532a4eecf4b5a4bf8c05f67214ebb1a62ba8682

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\root\ui-strings.js

MD5 93298aa2cf1937bf69e5a438fc65e750
SHA1 64c9f2e50f0f29f64ae8329ac6355a7d24bb0b1e
SHA256 11dabbdaa7b3288a914cfb01d8bacf1993ecd4ee05942f4ac7c4942cd2fd5cc1
SHA512 1c9a6893f62ae46e0e6f22c49738926911e568445cfb909b1525ce04b425821426f423ce0d380748843413d162d9c0e5c63cc086c97e1d9fba67a43942adfe38

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\en_get.svg

MD5 8b20714d3f7f21b12dfe175226ec6fc8
SHA1 ece7558843d827ffe3bed20b8a598dd7cd7cb154
SHA256 edb242450c6c8faf96baeb9a20802d95e42d7681cb7ddfb61e43d167dee89e38
SHA512 957469765112e8c1372e3a14c0c3522953b7f199697241084caf67ca512cab9375373f7677d4e06561d8ab0a1f2f5cad275d7397301c2c7483561dd9e5d2e465

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\root\ui-strings.js

MD5 764650de17f1e4c82b7c72b04983a43b
SHA1 5ad12cef922d4e37a0133c8c8785ad4dd191dce1
SHA256 0aac18ac895220fa8b38d36f6241c63c1c398c1ff3d44ee4947a0ad6ed086ed1
SHA512 bbb288f527ea2d31d18addbda87fcf9a38545b55a8e346d0cd02b7aac34aa0e69b11f9ce1e83635ef790b95f14756cf7dbdff3d8ac21683a64f130e70eabfd41

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\root\ui-strings.js

MD5 6021f3f99ccc4d1a4e026a4ddd3c50bd
SHA1 da38b1dfe5ca42b6133655cdf14eff06e0f38c57
SHA256 e20766ada97b30fc9a05fa93faccafa7466c0517d25d6cfa19de4950829976f3
SHA512 86d957490ee2b7b61cf193963731584b602bbdb31753fb1a8d20202ffce4605fb755c1f393ddaf4158994cc80f3c275716ce92ec08c3ebf5879552891d219e1a

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\root\ui-strings.js

MD5 bcce01df53fc3ff7c6e752dea022436c
SHA1 2ca0830214427157316bc379b1214e52a4a4bc3c
SHA256 b9d07ef5607baaeaec219665e658c2d1bda42a074f8fbcbd230b98ebe174bdf4
SHA512 41c2c11cbc624db2c33918af3e5bbe9f33ec52c87e8c412d5a009d0d26a0e1b35794160abd44476bffa84d1e2ceca1b3cb98fdb2350b423aaa2bc21b485cf37a

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\css\main-selector.css

MD5 a72263a26521c512f880ed0d7b83dbd1
SHA1 dcafc236694745f7fa5f98b7304f126ad8f092f8
SHA256 cdd5a85beebf2553faff1521ffbda9f4b93c44a866af18c1c6daf72b0c48d684
SHA512 55deb2d2a2e81478c81af5405fc9306921a067d2a7100d3b10d70f10b31ed81eb32b65970e7ae70c4688bf336ac6d2b7e05630d8fc064f961d6788a5fe0407bd

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_cs_135x40.svg

MD5 ce0dd3a63429cda2dd6095ffb0ef7f86
SHA1 d8a1e990911109bd116961d6536ef85d523c6362
SHA256 bc96c5244360957790cfe82e28d40fb1d0d97d2158d839b0cca8baa1beb541cd
SHA512 1e0f20a76b0a3769027c7fe0184ac6514b42f9742ecf32e5338762d3cbb86ec7b670d65758d65372345b1febc05ffd2974359fb10a15b8f48dc18cf423d27cc0

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_da_135x40.svg

MD5 8a080d28060b7167d4ea512c89e1203d
SHA1 d846cb70b0b9510eac491163836a421a0949490e
SHA256 6d0dd3784c3a58116e4fcdc1fd80c45e4a93809d45c5b783fbdc5e1f35e5a6a5
SHA512 d6f7dd1e06571c73864b5789e38c8a4a48030d93c2aa079a507465eb771dcf6049e5449be8e1eb908d261c81152b36e95671af4d858aaac472c6ddb31d9a8698

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_de_135x40.svg

MD5 0847d81b9d2fab48e06bf8f83192faca
SHA1 886d24814a00e8d1e87367b1361025c95bfdb4ec
SHA256 1e48ffb270d5559bd1f4526992faa0bd154b7532c15380f68f3ec153d7310724
SHA512 6f24b1032b8e4ce24985b39549eaf81efabb92ae3f2292a9ac5ac74714b2289a3d098e67cc46b314995fb339b9b6a500e48ce94d5594863e1055bdaf8af60109

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_es_135x40.svg

MD5 0e86f2a806c1b2f856e94464209219a0
SHA1 91c22b25e8f72fa469c1da8fc2b0e47ae076b9d3
SHA256 a3ddf64f6394d31b2a5df6c45707ec384cc52cd47e31344b9524d01564e359bb
SHA512 29a1cec6d23a17036fc890c7a710940c96b31dacf9371f22f602523857de57467b47bdf12897bfd29c000a91f16af7eebb052aa9abb08f339839412d4237db87

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_fi_135x40.svg

MD5 db67173b392fb09d492f1604095711b4
SHA1 b6a5d7c9c3637ca3c903bcca41f256f789426685
SHA256 c4531182336f8a10b5cfe0c552a5b7f48c92090498148b7e9521e59b3ccc075d
SHA512 9c49b2c6060274b1638c0f33413a021aab50c662e4bb2f7d28d9c2b17a7b5afc8723b3f8d9c431a4f7f95ac51f0ef455eb590cbde7d9905ef91d7254aa05dd45

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_fr_135x40.svg

MD5 608a9117b6cb8c5838413d8d7ac0945d
SHA1 0fe8413490c60087176b2ae7f27f682622094156
SHA256 bccf98835a0093096924661cb5c349270ee0c32350cf5ac899fd76a00d8a70a5
SHA512 51b5cddc118b59d9be2ad054e2b6341fefb68d368096e824708a4438a405354c2e02751098b1d9a48263c8b25e7fb71b81d7569a60783761101b73b0e91c7ea7

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_it_135x40.svg

MD5 b3934a30e402e9d8b29934f96561e464
SHA1 f0e363129d31580281c2f37d72b848a1f1f30d36
SHA256 77df776a85178f3e8fdae1bdf389bc7e569fba8dd809c0d722721818acb2dae4
SHA512 a20bc4472d8a1d67ecb83c58266a7dc7d777632809d3242ef4caa23f3daa9e8384cd3e613105420574fa35c59e914601f0b8f54536daeb1cca8f25471aba3d4a

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_ja_135x40.svg

MD5 4adc9f6988574408e52fcf7be5b22cec
SHA1 efc7e0c6b6436f101f35361365bf7fb581d6924a
SHA256 662ff2bffb34e307acab0b2e02feb1752454436d0d6f7e29255c3d1672b192df
SHA512 9a42708e3dbdd050de8a497ba13b6c602475258588059162ea89985de27c4cabb099e5d237e8e3bae68a43da497fcc9d21946be3952e45000da589c74510864d

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_ko_135x40.svg

MD5 92e4e246219b4ef195d033c95799fe54
SHA1 bcd3a57a08653e56d16a19ad1751a1c33bb31ed5
SHA256 20400c53183359858566b4dc75cbf9346f7683f19f0e763dc57c8d136c21f516
SHA512 7684a946f680d7c07f6eb37bbc4d8542ab0ce9eb7ad5dc46481200c9362814db4f4f82eadb4f1191400d75b1844b91fc80cad080044a3ce6e923515fad4ebff7

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_nb_135x40.svg

MD5 07cae0fcb069ea570bec8b3bbbeff7ee
SHA1 d559b3ea73b5e807407bb102d84f7f15912c69ef
SHA256 1c2e858f387dfb1d55bee390fef9b838991c59a4a9aacfc4a8c4946db40ce391
SHA512 eb7ca218848be817c0e93ecd17913d1cf34f2bc9dade473d2244ee87fff30e890eebe53b870649536901303e23a0ede342518b8d0c353069bac58f4e05b2387a

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_pl_135x40.svg

MD5 80e990ecf9f60bdcb580ed183dd45769
SHA1 ee8ffc78a31636b57445edfde22136410eb4a3c4
SHA256 ce607c55183a8e64736e03585962b85eeb7cbebf30eb6a1099cb961e40480901
SHA512 30c204e0188f5fccadfe004bdfaaaa9faf95df49819bae09fb5836cae7a335ac86eabb7c8a4b35170bdbb56e6eb3e4db9b74ee7649207e306e40f715e5cc4f60

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_pt_135x40.svg

MD5 e3a2114835de5da403ff852b856be7ff
SHA1 238c0a616cdc6e2df255315946ee5b44042fae39
SHA256 9562a77f6620cc134d696f2db78a06e0192f0cb3b56f7911c59f644cceaff5eb
SHA512 551bcafea5909675456d215e3baa862ccc055d2b21247d49e1936c03d2631bbece024274919a1d7eaf72c975668afbb79f92386b7731089c7ccdb05a6f7b0637

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_ru_135x40.svg

MD5 aac61d2e926da5778b656857d751ba04
SHA1 7aed7a4c2a665cc025ef95f3615a8f3cbd5e4c85
SHA256 602e72cea82999ceaa94091972133bc2605f8333d634ff8f99b0e65defdfd86d
SHA512 3c67dc95a8fd63cca8a34fb1425e8b2a6db51ff045227a387981b246bafccbb0a0bcce532c5c27daac97d5fbe98ca8ddcbdadccf19919e1d66c0da84c7962358

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_sv_135x40.svg

MD5 6ffb258b626554db2905d3822d263642
SHA1 4e9fcb548707be644b9aeaf05df3d58fae25a244
SHA256 1985ef856b1563ef4d171905baeef3977638d4a4093a99ee395cc8e56b6ae7db
SHA512 d2631adb9e8bde2d0cf5ffafbad0697f6a152b4da5fe73d12ba953fa9624992a440a634c22feeea94b98a74f10783e32bdb68a7685b454af1a810d7312ce35b4

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_tr_135x40.svg

MD5 69409a2a30128991ffd274e9efd92f95
SHA1 6a8a64c2014821311c827f7eaf081217f0828674
SHA256 ed66936e911cbef3fc1d7b069e95917d679445be154559fb1cbf3ab1de7808a0
SHA512 fa959684ac075ba77e728a33d02ab6dec297d3c3b61f14f733002e992decff4fdcd2391e60bc6156550f02d0656c7726c64bf79390310686696a3893aa833982

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_zh_cn_135x40.svg

MD5 4c1226e6396a8191f9bd632873348bea
SHA1 4178627c04e6ebd64e47c9364cf553bbaa0a669a
SHA256 1609c6a9cc1ddf291733db3daac4d049cd76600f7c2cb538f80cb1ea15b94f42
SHA512 b2693130a7c142c49f7e0a73446e62b5561003ccb7c158815af0bc5ab21ffb21f057c04a874c4ac83b4b7e2dd64837e2dc148686f1b580e4d4de9c92669b1790

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_zh_tw_135x40.svg

MD5 c7c0a21fc9e29a01844ac9041a1b9873
SHA1 0d4cb53dd996137b22c15bf8ba5410eb3e5139fe
SHA256 8dd0c1ecefe1ec69fcef39d792f50c9f477a321b1543b8ab79bc95b054409c60
SHA512 5b8d5d11b2a32a9922abd6be5b671ceba768b55c0ff361989806b71dd759f61b73f4404c365677a134a16c05fcc91088e9ec1b557fd27c8330daa1e7088defb4

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\cs_get.svg

MD5 a4dc38fcf79e4a5abffaad93de432b54
SHA1 33c0781a98630047ada947e0cebb3ae01f7c3140
SHA256 d3d0f87045442d5fc2ecbae7c96529c836c0cc1882478f0d48a697bc654dffb0
SHA512 2190406a05efb0a92173cf61fb9734675de2d2351b60bbf857e41b242d3c8175956da11c018666c0b31246206d94dae2243b0ed4e3726635555914db96c933e7

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\es-419_get.svg

MD5 6f0e1aa6273efb48b5dae5bb7b6d2dd5
SHA1 e7c40ae796b55c4257dae86700ab371f4b4bfae0
SHA256 10d865e54741e94419162798caeba6f0929071bdf5096598320559373c94a4b4
SHA512 19ac0854a3eb646631fc72c1b2b89127bfd53402554e8ce460686b5f1e31f4ee4d4f3df73c87b620ef3fd1d5f6cd25f9ff87b1056716cb32a0375eb96e35a5df

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\fr_get.svg

MD5 af3304ab3cae40aca0e185e97cc70871
SHA1 2aa4d33a8f07d84fbe45cd6da7571c5b00e7e027
SHA256 897725419ed5aa9381a213ad68f652aac039066a575a5946be88d38c5f9844d9
SHA512 850c392a169f26e97e56ac27c86d7332604bc3cd48d39dff7f38f0105704e67687b9a5c672b9f0c7b19bcb31c52f9af0f09448b06d6c288bb503eaacff406da2

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\fi_get.svg

MD5 536d273eb1787c957793ee338f2fffbc
SHA1 cb9c8976c191c3c4532db0c9638ae93bff30c2de
SHA256 1a9eaa5186241a50fcc1346cf8a990b9fc309cc63834bfcf2a35508a6ce96385
SHA512 1895762f784a72bbb1c7902809f978771b9ebdd79dee345e3116673aea8b1a81e4a26056ac96e63777b998f36c5fef79f45884964f3bc5d53a90d958d0f14adc

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\de_get.svg

MD5 7dbe6cc316901b64a1790fcf19fa9f50
SHA1 5517ee400e97818c09242c1c93603b6eac561bab
SHA256 c324fb47e6b8d2e83a91f8704536b9b4e1f6f912e75cb5f9d6f1342d26bdac8a
SHA512 f509de5af796707284263d865e2f62b3a1b92e888e64288b6ebe823418eeb944d405704b09513baa990a6cf6e52c735c6291da6cca2b8e7285c805ec7c4d73fa

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\ko_get.svg

MD5 d53394446cd5e301350612204bda9761
SHA1 136bfa04fd83acc71e07773104002be18e6849c0
SHA256 5e8d41ea5d3f05bbeb71e252ee9e64a88ccc3e2d4e8a7fe5bb3846716a8e201c
SHA512 15a59d7f12ee2d3e1eca655b5fd4ed5b7d859a8c8462de4fcdf37a052867962fff27797b38c9692435a92af57add972120c9f830cce9e914c701736bc16b0577

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\it_get.svg.ragnar_6F1190D5

MD5 30bf4b0cc3a594add7904b4dec2d42ce
SHA1 c2be15d363ddb7ebf516d389c0e6610b0008cfd2
SHA256 57aa205d5b2997c514d922e5727ae801bbc55b398bc69a2b01cfc9b4ff6e79b7
SHA512 c35fd2daaf96d99b10150eadbb6f6227b672bcc64bf4c61fd488848b95d4d4b3e7e83b2d31198795f65e32a007ffef9cfe4967656517310c4ba9376a81afd6ee

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\da_get.svg

MD5 b5b2e1ab84447e196850af0011e55d20
SHA1 8f3154a3a9a97eb609c91f35c644fa31e6e11a5e
SHA256 87804e8fe76ff919d4d4b922fb9acb026f909015418b8bf6a0080b46c4a298cc
SHA512 f81404995e7b4298f3adc24498b6b61318ff769659799d77b7fd34383df9fcf98e109826f9c8b7ed5ec4d27faf015de41a365e033de6a6a18c340283dbea479b

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\no_get.svg

MD5 314cdc09169d218a94e66b34a895e01a
SHA1 40a90836d2dc02362e016dbb7e00f544581bb127
SHA256 410bdb62927fcff0233da4e7961a6e604506ba23ac7163a2d310f3793fd871f4
SHA512 3177b314e7ac3fceeb8cf2f956874104923055697654c8e8f47d2012a665055ca81a497015c193518667a6a6a9206e25056d7c321d6b39016552390859ea7a27

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\pt-br_get.svg

MD5 9eb85cfc49ac64a3d2f02a164878edc7
SHA1 5773fc1c858d0de0bd44a66c76759e5cf04e1ebc
SHA256 aacf32791f209998125702248cbc091d758c2f5b8916203734bde19e67865c81
SHA512 630526e436af79694b3342ab04dc56ae6c239832e9d90c04d5a728de5faca36327f81a9f2446c72f3a16124a8c5b6677415a2c415b9cc58cbf71b529e19389e2

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\sv_get.svg

MD5 53f45e209b20d9ca7034a9ff08b335d2
SHA1 1a2ee9d4a86a8d5878cee8550feb0b1f37c1d94f
SHA256 d42acee699f25e519335a56be9a83808112e75ea03d802a53b02b474b22991c0
SHA512 c6c514eb163a952f7cf04cbf980a23b6d1b0b6bcd7db7f4f1a6e25145c2b504660e823bee47aa949505cd4daccd7e8af36be2662df59df9f82e365c7c9935502

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\ru_get.svg

MD5 e23b52249f75cc2bfbe00ec3d55c33e7
SHA1 8d2d0fcd6c88f2f9ba0bd4dfd932023084523e44
SHA256 260d52cc1399cd8834ddd4715ee3fb86ba262749cf4f13f1da0c32eadb853ff5
SHA512 285ed25c552f1416985e98c339651e57ea4241135b51c03659fa369499a4f2cf8dc8a365be1a38e71d889c6e9f711fdadb7cb588fbb3203ddea18d3e1bdff3f7

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\zh-tw_get.svg

MD5 b4b7ce6d06c1cd874a456df9cd1311be
SHA1 f1b96ee352564be2a4aeeac2a9897450d4a7e407
SHA256 f8e8a7fd2e2f98d399c40c3f7b02661bfd4bb3b4ab4a1440e2e6ddf32d5e5ecb
SHA512 26906129ee244b19b038035615622eb6f5d599a139a683a1f93dd648b66152db4622f4766b107edd78079db5823a280444fcaeff33a1780f8a78717f0e845c3c

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\zh-cn_get.svg

MD5 f732cbf23df54f2fbf949ea3c9e0e47f
SHA1 192019081bd20bb4066ae006134a47c193699213
SHA256 def347e2c21248302200739b4405c9a3c16f1c56d1c924be5b9c4da942da6936
SHA512 ea39575d3f7b7d9ba96c25d7ae47068df0e120a6928b0668be1b9af5ebde1215be661655beba0b93f90d420889772b1d08a6d83dafc579fcbc51c412cfa41696

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\tr_get.svg

MD5 93e4167a77dd18a7fc2a981b06e073bd
SHA1 14250f02ae1d10de9c069b0b67d654ea424a81cb
SHA256 ad3808ac42aa9a38531e0f9f4321f9c0504277a0869ab0cbe1ece050633913cf
SHA512 c1286912d1c4ba0a376e39d691ceca4fcaa1cb02696c31d3398212adfebfc626c2257e1d2590cdb3ff8d4794071ebd36d6087188e642cf7226561320adbbdb6b

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\pl_get.svg

MD5 4437f4cb679cc24a92a2f2c3b3287d93
SHA1 639527666686a36cd370e28784530b0d65503dd5
SHA256 638906ff80a1054cde07ec4569b73890fb7c9b4e1166abfae9dcc33a8de0b18f
SHA512 6841d78af4c5b7cc0ed8717fe651c69f30659098451d2cd8368282770cd4f0612dc1d041be9fa95e8f9c5fc015d5fefc55ac1eeec9d4aee2f162ae5696148e1d

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\root\ui-strings.js

MD5 59acd4723ec0204ce503b9ad3ea87007
SHA1 895dc6508dc71764a4a945800e18713c80d0d705
SHA256 2e954eaa9818230956c6c526809d046b6cf95f2eab29ed3372a6d9e81f1055c4
SHA512 4d5de2f4b76a788bd243079177fb23090be9e2ad705f4b48fb1edb4ae31a00623950bd6e0ea33a3c25ba848f8d015e24dd023bcd12789c6317361a3d873a918b

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\ui-strings.js

MD5 c06b04606e7073475293860d4e75ea55
SHA1 a468d9e1612fb2269d09557d82e28882185fff9c
SHA256 b5d6799a77770045f8f7c5c1427691e0fbb50181a34f225110ad60c649450278
SHA512 4c49cdd12ce412788feaa913de39100dbac6e7e209a4d6bcf98f2997735ef97df38924cca26b00adabe8554d8171c67beabaf1b3c7de2b9828412c1b981e7e6e

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\css\main.css

MD5 2a0b11a70f7d9b02bb732de3d67e2a06
SHA1 b74cb1338e7478424e588e80ae5a02912631dfc1
SHA256 5f44da733595e58a55abbad79ca10cc2615388dc960e9d3a9b1fc61ceccedadd
SHA512 aafc2eeb55a0136ce9375978db43a45c90e9aa465999e62c1c6c4e90bb2fa1d9a1a48556fbc48a9ce67f8268edd9dbe86b78c651be6c9fdd65aaececc60536b6

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\he-il\ui-strings.js

MD5 32b76b6ce515d75b3ac418b516469c18
SHA1 1c07010293fc01f7bf0060330c687d824d495ac3
SHA256 b527499255bd37df1866aca6cf47aeb59ac1fcd37b5d4d93751640aeb167e382
SHA512 cab8505bfa8f8791758e5a60110d0e75f9f1e92544193fe195a85da326e114eed5a37ea28a8ca086f568916da1ba4ecfd54347571f08ada94b573e2dbbc33d3a

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\nb-no\ui-strings.js

MD5 78fc1bee53d15fd375b65200d92c4b0e
SHA1 f49fc0ad5520ff6e4d3d7c2ee66495f496ddd796
SHA256 b5c34aa4435f39f8eda43f28d48d2b604d660b4df82c6c5142905fb02319ae9e
SHA512 313de4fc3329ffb9476d02ad70a9daa15d0e46e1181659e46ea678b7dbb6cefd398bcea56084d71fb44d8359c8054634d374716602b4d4d1419e6933ceb286c3

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\root\ui-strings.js

MD5 82a290a7971438b5c3ffc2ced994b50a
SHA1 5e3c7d4518398212e83910f98f1211a1647d3a03
SHA256 25f46995e5bcde5c0726ccea40911f6406f938848a57e5cd45872ae12bab19ea
SHA512 615315626ed56f5b94f1fb05dbeee5ce9349c43059e1311a9a71fd3be596c8120bbbc1e67e7f6fb6df718f1ef7f56ef67f3e5cea528012070a256524f0c53262

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\css\main-selector.css

MD5 740333c71ae75fb074705f37f3e445eb
SHA1 9f848381640fa36838b6a4b94a64ec98af19e2f4
SHA256 87a7142a7d7610335856c04955e17a21a574c6fb8ba7f269986f914df340e532
SHA512 22404871e937688b05f6ef47e3b55b7277d98167b02024a5c5b9b14a43a89899ea3e233f394616448620394e20a0770a624ff58334f10e7c4eafc45a6380b70d

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\progress.gif

MD5 7fe92ee3ac1aaffe96533b767fe0ce25
SHA1 5e75bb936d04466ea1ebf7a328859451aa3b25f8
SHA256 58dcaa04467d15c1e970cd766116f589b6ac98c0f90c363411dfcc515ceaf2f2
SHA512 85915435be21e03ec5e43674df0e1547a585faf6210d83c43c90a101f6731716f8f3955de573c1a7473fe01f8cef8f69c8b202548a600c17ad60e74b5b56a3b6

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\faf_icons.png

MD5 d6cc87040ff118f1cf33a357cc1272cc
SHA1 2900213bfabc0b8eb0c12f4e6aa867618d350481
SHA256 d06272ef18501963dfd32cfbde9fd6a4118b387c8b4ff09a759bf19e84bcd732
SHA512 e295257fe8806503b8fc6e56e9110bbf251a3b9ed1069ea763dd6c1da3a1e45a7112c5144ef1e9d7df8712583e147b6cb37379a738dcdce90971b65c5853b383

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\root\ui-strings.js

MD5 5764b3c2dc6884e3d15a1e3227881a8d
SHA1 590666254074c9845ebc0aabd3dc4e5f000b431e
SHA256 7c5d4008ff6005d709e03a4e74c3a822e799d6d4ce5913bca894a86d99828e6b
SHA512 81e374494270c327e4faad63c8f10becb92e50cd3feeab472573c0ed3f676d84a5bfdf86086eaa1ec6fed7ba20c2ba221a7464c689c747e430d1563ec152e655

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\sl-sl\ui-strings.js

MD5 4b33ff516b2ba9875e87926a250db031
SHA1 8cd72e0f76dda5dfe30013c6d9bcee5f21befccd
SHA256 7b099a9e4d39022416919cfb28b6961deeb94607e9994d68bc6bf41cc29b9fd1
SHA512 d889b2954c886f7bbc7196d32b4cba636bd9995681df9410f9f4d955ac3a92262add87e5a557802db39add4897e1247d03854ae51f4318e73ffa24a0b8169095

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\root\ui-strings.js

MD5 6c7ba1aeb53886fd3654ed5f3c144a78
SHA1 dc81e42421754c76b46adcab9dd016a20fd7ebbe
SHA256 e40035a8f62a603b1503878759bdb0568a30517402b30aa490adbce07a15ab7d
SHA512 b2433716c61011e24134edff6f3e15194244b14c0f918d10d76586d538765a189331658084a634429590215f97f9403f52d8934964c0c190414b05bfcb268237

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\bun.png

MD5 c389f473957fba0d56cfe4d3a6320329
SHA1 7d20cda9263ad58738b6dc9f894e643551725f0f
SHA256 fe272acd644cffb1bc81991881040a99b889df430dacf0b02a9dfb4ca6e13ed8
SHA512 e9fb00ac5580c3d87b92be581e7ff2fe6e8c7f2b2f5665cabd354eeeaae5e2c0a7433f8d8db7687ea28957f3ffbae46b24a2dc107acfa7fb5e5800f91bc1f0a8

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\cstm_brand_preview.png

MD5 fc5662cd271b0aa60002daec20d5fc1b
SHA1 1609ba0af13845d2468cca4cb55bb4703f709f25
SHA256 c7003f0aec385abab85e6e5d52ecbeb9d23954f30ac3b44f5ad6093142db6d50
SHA512 0a32420391ca4a7366f17654f31eb01f2d8dc51a177f1070d48706b4345e492ab2ed24e526d90479ae21411a9d56aa1773f5d0a430edf966c9234146aaf72851

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\cstm_brand_preview2x.png

MD5 641c15be1484cdab4019edc45554a234
SHA1 55fa6e95f535f59407f0512a7f0e1401d9ba0161
SHA256 76a83b2ea4d24d5827880788d09b773b02c6f8db6b53e65430334a42c44373bd
SHA512 722d2d18ab5a65987a3f793677dc8c47aeb9998abe66b92961051a7c5ea430fb1e1b6b29b32273f976b9c09bb2181a6d944d048e4d094024f790647a884a09f7

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\dd_arrow_small.png

MD5 5497d6cf3c613e803b623d96a4d7bfe6
SHA1 9bc358f4b29615800de43be70cb4bb2a7c37bd9e
SHA256 9b55f7fee5feb0b33803d26a2400918284c1e341c3c0f8b454fd5f44fae678b9
SHA512 61b3cc8c8d68f878802d7d9ddbb40256129469c852ef604567dd2920c38b6fbf526b2786d768f27a7be00760d557e1106e198a1208f6b3e22744452127a04706

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\dd_arrow_small2x.png

MD5 2323076ce752723391c32ba3f3c4399e
SHA1 c02981ba090146da068c0bf2e1e4c75bc3542b3f
SHA256 6af7e6625954e283ac0c5a92ef2f2fdbd9ea048d84026bba258b73e02063840c
SHA512 b90a108b064857430a58148a706255b3962e3c367f62a089f1232d5711dd97e1952187e80066892951f1542b9188d007f972158ec2e4a8eb42cf568109baf1b5

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\illustrations.png

MD5 c9b4dab7334246077693d161342be8a2
SHA1 233fae02510a10c8c9e8d839ebfd8ef0f880c3b4
SHA256 1d72de38051f6497fe8bf727259d035df8d999f932ab349838e9b868d2fd187b
SHA512 fd29e781b77385bd30c5a3a94c53801f4bca219257d4830aaf1c4326c4e8629b7be0fe2db1983d04a39533045316c6d2079c32944615ee02fd29819459413f16

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\nub.png

MD5 fb176b3e8a6dd6365f5b139d74c3c080
SHA1 20c7d459c6d51b5f672056be7f16e49a7991ceb4
SHA256 1d0320ae1de51478305857244ee4e9de2e0b81d287fed86b0a52b96297e57b27
SHA512 e3fe6fe45af4c634d74b47f91766ea90f6c01e4eeb03a0373b54332542d6f90b0bcc655b53a87eb8026b0e4e43e9c64dfcc738963da46d9d81b637da70b91317

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\share_icons.png

MD5 3e204422340e509c3f428d02e4fe36c6
SHA1 08544378217fc7a55a81b305584d211fbe4e03d8
SHA256 994e4c071599c51751c66798af178851026bbfab9a289ba1e6e69d36d7b92ce8
SHA512 f3bbc3adebaf51eee24fe5386ae819666015510d94635e7799853e60376927a40b3a946d8dbb0baf156586ec78e92eb7ddb5fad2d49db5be79a71ea4dcc0506f

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\share_icons2x.png

MD5 43c21264e5e854dd4c0bda09b19dbeeb
SHA1 d1d2fb36356dcd73e50e1f0ca04a1844f526b952
SHA256 df4e3695279141be17bd44e365d6940f297ef01e3c7fc0753e03a276875713bc
SHA512 2cea1cced0a27bcc2012c9f0c6d4aa556ebe68294101c17b1ddcbba86e4bfc6eb52182d5676da8f63cb2da8f4f51236b46fb814e1c8404c2520ed55ee512a013

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\s_filter_18.svg

MD5 52f03e3ec42aab6ee75d2b27bb36e0d4
SHA1 46d271afd9157872fbba3921c03a4ad763caec48
SHA256 e481cd5425430f81fbd44103ffe14c0b8fbd515335785850363f14436bce0947
SHA512 65a18878d52624df4049855f495a74f93569a2dc81071d2fae0413290de72aca10ba8ce63ff8ea66556296c0e1cd8e5ac97d43d3f0105585ffb2b3d6482715bb

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\s_listview_18.svg

MD5 543dc7d200d17a53141255258800edd8
SHA1 d29b0c6769cf5e0e553023974846cf11fc140d65
SHA256 3836e82d2c4722cfdcee87515a74354ed31b69a131215774b5788886675f5489
SHA512 7370cd9d76831b8c46f89f190901cb884e0b5fc751f240a61fd9e9932c13f9b2959a6a244248aaa90d07f19663b3adb574f8796f6ca0307b109b8ec06858cff6

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\s_opencarat_18.svg

MD5 e3766320a6b780056427766edd42296d
SHA1 06cc5538a79cd91144097141dabae31b099e10d7
SHA256 3da8778fb4a088e7d2c0bab020a3027cadf7cbae41a567e0f075f148acd98245
SHA512 050d29ab18e0f933051115a5067cb9a3e008e91844d8aa4957d72dff9f5e9f3c50cbc1682297f940b9b1daf93f81e569ccf85266599052d69fed353d1c896891

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\s_thumbnailview_18.svg

MD5 618e91d49ace95a7096fd1969f85fd47
SHA1 2f7e69284788dddea116e90ca74fccfccb9b6ee0
SHA256 745a449c4231690c37fc283049760470be02e4bb94457ec8626165f2c2ed9b95
SHA512 466f2549f779aaed1d3b9003ad855f1c872c1d9c92e8f147114f10c592e7d28e573025ccd98c4ee773339f48e188bbde64792dce9ef8ebc0f9b0dba9f47fddb1

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\root\ui-strings.js

MD5 03782876b28c1f5a1b1a609495543d32
SHA1 edc6ebd201136c721e5258e38d606b295c7295be
SHA256 05c227c783179ebc1f8538f8cab7062e69697f1f06fd9ffe5f0b73fcedd34270
SHA512 32c1104ce4011680414ab7c8dfbb172eec00e61ead9a9059c0167b8c5b33961854ca638ba1c88c8c93e1535318810b84c21810e4997311f3ee73095a04037996

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\themes\dark\adc_logo.png

MD5 a25f8b40fad0ca45ce1e8208419f7009
SHA1 78d89935e8f9b9c848128a21ffd8e1839a85c64f
SHA256 c68a40e8f57a2919deee638a2696c1d73f18f960f47b111699c5697761319bba
SHA512 420b3295b77e4b268462ec4d8e6cd33c3b866dccbd4f2a5590bed0a3461cd2651d6e404276c237d36d57a6b2fc142fbc61a6ec78822cb7ba7cf4a592415d21d1

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\themes\dark\logo_retina.png

MD5 5a15d219811f49a8dda9058aa8e1895e
SHA1 e312ad59377f1d8ebb0fe36779d28d36acf41e20
SHA256 cbdfbf592156e69fe061c5db6c1d1947d2b79b334a3329a050eee7a39437eb31
SHA512 ea7553e1cd7d7f1a103473248e3625e1d5824a492a52081b6f4cf4a785c9372b3ed7d59d43d43943c38e6c8009771afab1311b321133601dfe5427425327d3e8

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adobe_spinner.gif

MD5 9fe1fec2d7ec366577f61c2f7bfba853
SHA1 88aa84955291969273ea32d2f16ec6337d4b3400
SHA256 bdff38a37b3cf868916188661a2365a2c2124e38b575348167e6730812661cbb
SHA512 8a29a05d87f764b0a4512da4acdd47d6a2730a2d442e992138b97f51d454abe7a9f50cce05f037b3f5086b377046230b3cc467ba4ba71e91d854b690e86a2369

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\dark\sat_logo.png

MD5 34a48d01ecaa0c2354a1cee7eee1ee60
SHA1 f119a98365917b062edeace88b841d4e92cde4d2
SHA256 e1fdcf090f4cd7c8e028021a4b8f6b36cf0271ddf32e0df092850787814df3c4
SHA512 1e71427fc79e700c82e923c6f7a85f20e326a8dd90e2c5c78e80d9fee876ae36f0fc5f1237a76e74b232fa4eec4fd5dbc4946a7692ab15548e093afed9fa2090

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\dark\sat_logo_2x.png

MD5 4745d5a535722ff885357909d2fbc419
SHA1 70a2758ee30a7eaad6e274f311576a983965c806
SHA256 656298202164c6152150bb8b0a14b67408cb790c2612476aef89d9016956c707
SHA512 1032c4debd96c48474b283f67fff2420f4e8939ee82e5c71d4cb1f8c2e25acd90c2b0a8eca6362396e1013c4f64252f5acc61c2dd02735a225a8b405cc7edc33

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\en-gb\ui-strings.js

MD5 954c85152ac62ced0be05bbfa45c71b7
SHA1 ae3e0dbf744e2e0da2c6919c6d9fda3f4b8ee579
SHA256 36c0936acfd64d188d659b941f06f628d01ceea77e65a051fbc5ca93c65e5f25
SHA512 8458380e4783d9c5d745e2ee1768c2134838968317f91814a4cd6cd31c86848bd70252db2600d510ef4b77c6e1864030e52bf0d0d42c358dc3efc471b9790bfc

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\root\ui-strings.js

MD5 ab77e87d83bc09fa1ac4cec47cbd08b5
SHA1 0307210b9bfd14dd9b5800de248efc2e6083099d
SHA256 485d3a684b0a48526c6b40f5d57a9475feacbc9166db96b45547450337214d6d
SHA512 73c5691a80155508a735054b4d5d264ab6776106362bf8b26a53cd5951026e5dbc604a3c48d7d0d48021269c0c45aa5710972011bf80c761f58e973bfc0c390e

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\es-es\ui-strings.js

MD5 4dd1809d90c1d22200cdb89cdc94a18d
SHA1 2684c7a9113c582bfac2f753ce0231d89b63e78b
SHA256 bf022f93875d373e8e64d278a06569b1a9a8a13eb6831ac7086b92c19878226a
SHA512 1bc1547e02977e3e6cc684fb053c75390fa0033fd4c8671d449d8f6fe13e7ebe27e7a56f8c6bc7db9702156ebe0404e091500e120b03458c35e37cc50723d7b3

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\root\ui-strings.js

MD5 79abece7b4c70769fba9fbab829a87ed
SHA1 bf7cceb09f08085e90a37354c990f695b9e4f5f0
SHA256 f9aaad6175f78c11ebe0d5ac1dcb56b61bcbeebe7a3cca02fef285123803f8a5
SHA512 1463d04311aaeb16491e0e31e0774e27d93b269eeba8ab2e34f7182d4f32c4727105007133a260be8cebe64bcfe49c9c14925babf214b25365c238a48d615b80

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\ui-strings.js

MD5 9010103e2c2c4637701d78bd3ebe1464
SHA1 97926b4586c1009fb2518095461d2564111408b2
SHA256 1a5aacffa6a92e18faddb55e51dc6d6a0ec3fc803c69c8d9d2bffd46cf5c9f95
SHA512 01862801b32aa7797262ded11f95d30a1e0dc6c7a77f0a120069d5863e4bffb770acf442ebdb6df2c4e29b7d32d33fd6a08ef2fe4e7fd5ebabb11977478f5bcd

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\he-il\ui-strings.js

MD5 5bf85b70e214dd56ecc3308c0c7778a7
SHA1 2b12fbf95fe8f16e42647728487bdc203a110fb7
SHA256 1ce6c62ed982e25f06680f9f79bea0ca2bc8bddc9c0ad55c4fa02763dc000bee
SHA512 e5526990cbb136774a699b4300d204d9bc6e45bf744300d35895f0b3252bd41ed87312f1caf682458e6133a9619b62b444f73e8387a9a98720ee8f368a947c95

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\root\ui-strings.js

MD5 7f8b1f4a1cfb298ecd8559b2fa8af10f
SHA1 7cc73a7c0325693e4d0a378f8b5d898ece04a3b9
SHA256 c8528d9d91c31b3c4f422f61d9590bb6905d0f9103b824896744314e61fbff1a
SHA512 9248396ff17c028d3e8af033ede392062cd53fb522143a3edd32c7f77ef829f6a6f94de8647147b6a01d82933c7d6f122d1737756b6a97280beffb2efe98a07b

C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB_EURO.txt

MD5 adec3e41f6d2bc209d6263dd8f0e8f9a
SHA1 86e6db2cf1fd4091766da3ec329b8aa2dd6c8624
SHA256 9e10664018a122ccf7d44d9510186d7ec002b469c9af1c96657e070c384d6694
SHA512 314ddd8578994e0e83a27e5e3fe46cdad78740f1684099274927b5d3bb7741e1e90fd8af7f92783e286b2f0afebe33f73d6b5f617a7629d975ca69071a26b123

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\identity_proxy\identity_helper.Sparse.Internal.msix.DATA

MD5 07824106f9defa128e772ffa45b5305b
SHA1 3d6fb4b1c86450bfb6d13f2d521041420f031581
SHA256 bbe07f07b97407979bdc666163d1f857f4a9987bd424325af7f6a83e965b24bd
SHA512 b5ba8696b6b0a6c98cd0d9f7358be29b16806b2e41e7863df9aee5602c3df29ba83fc7fe7ba3d91200db52ae98a7902d374e5a7efc2ef1a63fe8c3d7d1996ad2

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\notification_helper.exe.manifest

MD5 0d2b6adfe3427083598553728534ef8d
SHA1 f6a00748def916a61f4fe70adce666c6b99a0e3d
SHA256 bd008c78bf4920b29a74be2eca07ff0f963c444c2b95a546d35a8e7792c40c7c
SHA512 8fb5a2953d99fd1d3a822f2b18c4137e33cdc7b52ee0f6f79b0f171c587bbbae20a69c231b3ef777faedc32c1bcff6f5353b3d6d8598b38b7244ea180cf8727d

C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\de-DE\MSFT_PackageManagement.schema.mfl

MD5 43136f8a07a5374ee77e759649f02dd6
SHA1 c300f0a6756c4745c87211f4a9c8a64ec521adc1
SHA256 6ecb7e7cecd2e4e720cb8b899544af443bbfd64410bd870fd9a9736ba73def76
SHA512 b9192d87841b5d2bea8c33dbeed33dbf3cf7c751bb8560d31da64adc439cdbfb50e5913aa022ad29d0fd7f42e6f6bb0a28d6a3a7b5b1c0b4c32b45165846139d

C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\en-US\MSFT_PackageManagement.schema.mfl

MD5 e3ee08f6935b0fca7ca40a3923e8fa8b
SHA1 b5b15b405569a604dc66c952e706ff7a1218c9ec
SHA256 b5df8b5dc2c4e96c68b0f1902576ddaca83015595b57517e239ccdb1891f6aeb
SHA512 942dbfb5bd89ff3691d2b9431f8c7a1d8c325185d6a9fc6c07e8abd145d4cd73261cb8392597c99ce72d4cd02bab478b9fe8333eee7f478666536d599e69e157

C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\es-ES\MSFT_PackageManagement.schema.mfl

MD5 0855dbacdcb781663af6255fde29ff00
SHA1 b5c64bfefe7c0dcb331dc242e0e4e2e8f22f871c
SHA256 be60b62da12072cb6bb47376205fe9bb93e6ef1bd88750f6eafb273a121bf29e
SHA512 134dc693cb89be85d71b524e196f32a13b70da535e2840f7658f18a0346cfeea4fc61ffec401eca5f1ab14371570006bc57edc18bfa61d596800f1137c4b1429

C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\fr-FR\MSFT_PackageManagement.schema.mfl

MD5 7c0b3f794fd775a212e5e4d7e47f9d40
SHA1 aae3594a49e693dce7cc7cb65e6072a3ad847a3c
SHA256 42368fee73bd84f2ad0caa3a161d54fdce967f13201f7b90cfbe8ceb79fffa7b
SHA512 2f52dcc7aaf0585ec69982e7bf36c210bd25ac17d4d88f48ec44c5827cb0cbf456e9e421228fac0af351cf77ff90a4e2f6c24d1164f3120e8eccc06439ecec17

C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\it-IT\MSFT_PackageManagement.schema.mfl

MD5 24599a5d90656f31c085f175f6bde3b7
SHA1 6a39e070708ca7bc3852954d214bc910e85a446e
SHA256 d01c8c338a59b5eff41753b8dd80cc0296c4a6345b2cdcb4ad28671b7237cbe0
SHA512 1e83020293e9a6f24c2a788ac89757ea7494048d8212d74627196f036517e1fdfe705d88cc3551ab26b2c0688991ecc855e2146300a034e4136d402898db9b01

C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\ja-JP\MSFT_PackageManagement.schema.mfl

MD5 40be955656e056ffb6b5d5db5a1b797b
SHA1 06fab79b98ebe02c75f18f76666afb8aec35b58d
SHA256 09b2934d1c729ba93874e78bd3c0fbedb18cc4c51f21cd33e604e69c149b2332
SHA512 89da75c0d33533ffdaf0d34407780211ac17fd7e55b9e845972f56a72f9d011e12459297c656afdae4a0ec07b0418fa0d53cfd1bc90da82ae725b85fad714018

C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\uk-UA\MSFT_PackageManagement.schema.mfl

MD5 3aed933113645700123500c8666ec23b
SHA1 92f8d3a7d41af93c1a98812eaa4a466d75ab3466
SHA256 64ef4982e8723085d32e046c393827d8afcccc2195d19baae82bdbb8abf503fe
SHA512 41e9172857f828a5ea90de78f1b666d962140a94c379aa57e1bf618c845063d9cf6f1fa8f858992fd540926ed525a4263cbd553d7b9dcb8411afc1a7d042102b

C:\Users\Admin\AppData\Local\Comms\UnistoreDB\USStmp.jtx

MD5 84f39125a5308d625072f962655c39c5
SHA1 ffe382ad5e8388ccd5daf430b607c09ebd9f1aed
SHA256 ba9dc42af0ebd3c19a9a2668d41df844c638931933445857e00f99784096fe5a
SHA512 12d9f19d3156f388e57c0bc7e0f5ec36cea86c73da63f4ae630a3135e0250b4e887c0e7b4665c4d17a08ea5b66218363d8ab36ad1e27a1f33e2bf1ae7abdd659

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Bomb.exe.log

MD5 ced9fd5e8bad38494833c0d5950da9ea
SHA1 5fa0fdb4f4a845f9ba1d14c30f90cb6ffa605caa
SHA256 09116051d50001fe7058c54ea25914bdd57f25cbeb28818c34b1e5624871b7b8
SHA512 dc7c8b2b4a65f7ea5ca54abb196fff3975d9d54fed916a4e61b594b68a90f127877745a380a1069609639a992333b5f9fa732593951eeb6e39ae2c74f3d656c9

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\MANIFEST-000001

MD5 a47aec43c553c301e21a4dc480b7c965
SHA1 be395cc09f4423d2ba9625c963f263c5536f0162
SHA256 a17515ac63740f4bef9eedb7e756bfd589e7427420845c5dfe41a125cc15405f
SHA512 d685bc309a7859a24f7b043613357923d288ecb393e4f903f7bde07b403fdc87a105276bc489e18a24f7a8b2eef73133995226de2b9abd2b6b32a1dab81be7dd

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\CURRENT

MD5 278a3e11718288556c7191ac1584a402
SHA1 dcf5a32bfed2b23ad724c0627b62782cccbbd673
SHA256 6ba0c595c5c44505eeccd2ffa21160e70e57baf4eb399b9ee50ee828e0cc4279
SHA512 fd9ee3962c03e3bbfb343429debe58dfba42f9b28d31f6d4ac5cd600d1ac90d60b7c3920764e7b7529adb49d9e3b959c6e551078f32008a01897330fcffe56fa

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_3

MD5 ab4538e4fb2ccc348ecfe3c761649c31
SHA1 c04d44455557bfd787d0f2ddbea87252ee499fcb
SHA256 fe47b5398d06a319097922426ab6fcd7c457969e2d7f215edde6aa141e3e41f8
SHA512 f205598a7002872b8ece01353c570353060b10d49c2e39be03ececf3355b1f7b62382370ee035482d31e83dbb7bc3e20097ee1491f51306d321858b0808447fa

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_2

MD5 f7e757b4abb844ed38011489c7b0e36b
SHA1 7c4b34d7f644201f2155a9aa709dc3abb4f0405f
SHA256 817909770fc3f306c814260868ef5f17aff7f334e22bc7fd8bf67b0862834cfd
SHA512 3138bfdb0fd5fa7592652a85c03f4f466f5b955207c7f94fb4306853e12c919a7558620bb2a9512d9dbe9ca750e4d7fa7dd501773f2e77533d8e1948457c2e4e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_1

MD5 60da2c82c358f6a0320c7027c2f6f057
SHA1 dc8b3e244328101acd0b56ea31c1a7602ea37037
SHA256 79b2d606dffb0916d786d71a3d437952fcac7f8e69197f4026994f54f4147aa2
SHA512 51891cf8b79c5a0892beb16543346cd2e5ce1b22529c2988db40724ab7d4a958fc8033bc8fb84b918e178830a27f83d6335b42ded23a92ca0d0b16cbe9fec78e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_0

MD5 ec22e09f6e2db2089577444ee7564d75
SHA1 fa1082fe26ae78ee0d8cac0f0342dc4fa7619922
SHA256 060e65ca27957d413763cdd03b46912e05d10a1f611e4218e393403714f99b3d
SHA512 9ee9c3990fb483a701f27cacc42b8dc88381cf44d75ae8576f10ed6f9f78325620ab8943d9276c2eb0788a25d8d0bed3eb500b10584aba99e318bbca40eccbbd

C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\winword.exe_Rules.xml

MD5 a442ba935ba593f4dc865897d0fd26fa
SHA1 7f2b0d5e1c6aca246c56871c577c5ad6075394b5
SHA256 0b80cb446e144f683904913799409793ed0621d2fa2d050956635ef68f544e31
SHA512 901d9113b3257b9b0d17b4d3bbe6a234530d761a21a863f9811603d078e0450026d9e8b506f77ab0d7ca56152ff6d1a3d490e544d169f30e07671db39b97a3b4

Analysis: behavioral4

Detonation Overview

Submitted

2024-09-29 03:40

Reported

2024-09-29 03:41

Platform

win11-20240802-en

Max time kernel

7s

Max time network

29s

Command Line

"C:\Users\Admin\AppData\Local\Temp\PCCooker_x64.exe"

Signatures

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Lumma Stealer, LummaC

stealer lumma

Phorphiex payload

Description Indicator Process Target
N/A N/A N/A N/A

Phorphiex, Phorpiex

worm trojan loader phorphiex

RagnarLocker

ransomware ragnarlocker

SquirrelWaffle is a simple downloader written in C++.

downloader squirrelwaffle

Xworm

trojan rat xworm

Deletes shadow copies

ransomware defense_evasion impact execution

Renames multiple (1970) files with added filename extension

ransomware

Squirrelwaffle payload

Description Indicator Process Target
N/A N/A N/A N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Downloads MZ/PE file

Stops running service(s)

evasion execution

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c277bd25.exe C:\Windows\SysWOW64\explorer.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a76e49df84ba2a7b33e8ea959995b5e6faecb90d551ef169d8272ce9042c35a5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CryptoWall.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Files\66b211924622f_LummaC2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\24.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\23.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\21.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\20.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\19.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\18.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\17.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\15.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\14.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\13.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\12.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\11.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\16.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Files\twztl.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Files\peinf.exe N/A
N/A N/A C:\Windows\sysblvrvcr.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-4272559161-3282441186-401869126-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\*277bd2 = "C:\\c277bd25\\c277bd25.exe" C:\Windows\SysWOW64\explorer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4272559161-3282441186-401869126-1000\Software\Microsoft\Windows\CurrentVersion\Run\c277bd25 = "C:\\Users\\Admin\\AppData\\Roaming\\c277bd25.exe" C:\Windows\SysWOW64\explorer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4272559161-3282441186-401869126-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\*277bd25 = "C:\\Users\\Admin\\AppData\\Roaming\\c277bd25.exe" C:\Windows\SysWOW64\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sysblvrvcr.exe" C:\Users\Admin\AppData\Local\Temp\Files\twztl.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-4272559161-3282441186-401869126-1000\Software\Microsoft\Windows\CurrentVersion\Run\c277bd2 = "C:\\c277bd25\\c277bd25.exe" C:\Windows\SysWOW64\explorer.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\asena.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A
N/A ip-addr.es N/A N/A
N/A ip-addr.es N/A N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PHYSICALDRIVE0 C:\Users\Admin\AppData\Local\Temp\asena.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_Grace-ppd.xrm-ms C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipstr.xml C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\.version C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\RGNR_40B57505.txt C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\RGNR_40B57505.txt C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProO365R_SubTest-pl.xrm-ms C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\deploy\splash_11-lic.gif C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail2-ppd.xrm-ms C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTrial-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_Subscription-pl.xrm-ms C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\SETLANG.HXS C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ea-sym.xml C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\jdk\dynalink.md C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription5-ppd.xrm-ms C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_Grace-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_MAK-ul-phn.xrm-ms C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\en-US\InputPersonalization.exe.mui C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_Trial-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_KMS_Client-ppd.xrm-ms C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_MAK-ul-phn.xrm-ms C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Consolas-Verdana.xml C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest3-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Trial-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_KMS_ClientC2R-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\sql90.xsl C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_MAKC2R-ppd.xrm-ms C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\gu.txt C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Retail-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription4-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Grace-ppd.xrm-ms C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Retail-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\legal\jdk\dom.md C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_Retail-ul-phn.xrm-ms C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp5-pl.xrm-ms C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\en\LocalizedStrings.xml C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\lib\ant-javafx.jar C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail-pl.xrm-ms C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\WordR_OEM_Perp-ul-phn.xrm-ms C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\7-Zip\History.txt C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\limited\RGNR_40B57505.txt C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\legal\jdk\cryptix.md C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_Retail-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\en-US\RGNR_40B57505.txt C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalDemoR_BypassTrial180-ppd.xrm-ms C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_KMS_Client-ul.xrm-ms C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_MAK_AE-ppd.xrm-ms C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\WordR_Trial-pl.xrm-ms C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\jdk\freebxml.md C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_Grace-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_MAKC2R-ppd.xrm-ms C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File created C:\Program Files\Java\jdk-1.8\legal\jdk\RGNR_40B57505.txt C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Paper.xml C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Integration\C2RManifest.PowerPoint.PowerPoint.x-none.msi.16.x-none.xml C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTest2-ppd.xrm-ms C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_Subscription-pl.xrm-ms C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\da-DK\RGNR_40B57505.txt C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File created C:\Program Files\Common Files\microsoft shared\MSInfo\RGNR_40B57505.txt C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File created C:\Program Files\Common Files\microsoft shared\Source Engine\RGNR_40B57505.txt C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\legal\jdk\bcel.md C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_OEM_Perp-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_OEM_Perp-ul-oob.xrm-ms C:\Users\Admin\AppData\Local\Temp\asena.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\sysblvrvcr.exe C:\Users\Admin\AppData\Local\Temp\Files\twztl.exe N/A
File opened for modification C:\Windows\sysblvrvcr.exe C:\Users\Admin\AppData\Local\Temp\Files\twztl.exe N/A

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A
N/A N/A C:\Windows\SysWOW64\sc.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\sysblvrvcr.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\a76e49df84ba2a7b33e8ea959995b5e6faecb90d551ef169d8272ce9042c35a5.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\CryptoWall.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\Files\66b211924622f_LummaC2.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\PCCooker_x64.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\Files\twztl.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\Files\peinf.exe N/A

Checks SCSI registry key(s)

Description Indicator Process Target
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000b38cc7aac7e825c30000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000b38cc7aa0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900b38cc7aa000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1db38cc7aa000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000b38cc7aa00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters C:\Users\Admin\AppData\Local\Temp\asena.exe N/A

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\SYSTEM32\vssadmin.exe N/A

Opens file in notepad (likely ransom note)

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\notepad.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\CryptoWall.exe N/A
N/A N/A C:\Windows\SysWOW64\explorer.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\25.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\24.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\23.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\22.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\21.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\18.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\19.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\17.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\20.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\9.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\13.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\12.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\16.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\11.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\5.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2688 wrote to memory of 1616 N/A C:\Users\Admin\AppData\Local\Temp\PCCooker_x64.exe C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe
PID 2688 wrote to memory of 1616 N/A C:\Users\Admin\AppData\Local\Temp\PCCooker_x64.exe C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe
PID 2688 wrote to memory of 1616 N/A C:\Users\Admin\AppData\Local\Temp\PCCooker_x64.exe C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe
PID 2688 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\PCCooker_x64.exe C:\Users\Admin\AppData\Local\Temp\a76e49df84ba2a7b33e8ea959995b5e6faecb90d551ef169d8272ce9042c35a5.exe
PID 2688 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\PCCooker_x64.exe C:\Users\Admin\AppData\Local\Temp\a76e49df84ba2a7b33e8ea959995b5e6faecb90d551ef169d8272ce9042c35a5.exe
PID 2688 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\PCCooker_x64.exe C:\Users\Admin\AppData\Local\Temp\a76e49df84ba2a7b33e8ea959995b5e6faecb90d551ef169d8272ce9042c35a5.exe
PID 2688 wrote to memory of 2908 N/A C:\Users\Admin\AppData\Local\Temp\PCCooker_x64.exe C:\Users\Admin\AppData\Local\Temp\asena.exe
PID 2688 wrote to memory of 2908 N/A C:\Users\Admin\AppData\Local\Temp\PCCooker_x64.exe C:\Users\Admin\AppData\Local\Temp\asena.exe
PID 2688 wrote to memory of 2908 N/A C:\Users\Admin\AppData\Local\Temp\PCCooker_x64.exe C:\Users\Admin\AppData\Local\Temp\asena.exe
PID 2688 wrote to memory of 4856 N/A C:\Users\Admin\AppData\Local\Temp\PCCooker_x64.exe C:\Users\Admin\AppData\Local\Temp\Bomb.exe
PID 2688 wrote to memory of 4856 N/A C:\Users\Admin\AppData\Local\Temp\PCCooker_x64.exe C:\Users\Admin\AppData\Local\Temp\Bomb.exe
PID 2908 wrote to memory of 4680 N/A C:\Users\Admin\AppData\Local\Temp\asena.exe C:\Windows\System32\Wbem\wmic.exe
PID 2908 wrote to memory of 4680 N/A C:\Users\Admin\AppData\Local\Temp\asena.exe C:\Windows\System32\Wbem\wmic.exe
PID 2908 wrote to memory of 5056 N/A C:\Users\Admin\AppData\Local\Temp\asena.exe C:\Windows\SYSTEM32\vssadmin.exe
PID 2908 wrote to memory of 5056 N/A C:\Users\Admin\AppData\Local\Temp\asena.exe C:\Windows\SYSTEM32\vssadmin.exe
PID 2688 wrote to memory of 4092 N/A C:\Users\Admin\AppData\Local\Temp\PCCooker_x64.exe C:\Users\Admin\AppData\Local\Temp\CryptoWall.exe
PID 2688 wrote to memory of 4092 N/A C:\Users\Admin\AppData\Local\Temp\PCCooker_x64.exe C:\Users\Admin\AppData\Local\Temp\CryptoWall.exe
PID 2688 wrote to memory of 4092 N/A C:\Users\Admin\AppData\Local\Temp\PCCooker_x64.exe C:\Users\Admin\AppData\Local\Temp\CryptoWall.exe
PID 4092 wrote to memory of 1272 N/A C:\Users\Admin\AppData\Local\Temp\CryptoWall.exe C:\Windows\SysWOW64\explorer.exe
PID 4092 wrote to memory of 1272 N/A C:\Users\Admin\AppData\Local\Temp\CryptoWall.exe C:\Windows\SysWOW64\explorer.exe
PID 4092 wrote to memory of 1272 N/A C:\Users\Admin\AppData\Local\Temp\CryptoWall.exe C:\Windows\SysWOW64\explorer.exe
PID 1272 wrote to memory of 4172 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\svchost.exe
PID 1272 wrote to memory of 4172 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\svchost.exe
PID 1272 wrote to memory of 4172 N/A C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\svchost.exe
PID 1616 wrote to memory of 4848 N/A C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe C:\Users\Admin\AppData\Local\Temp\Files\66b211924622f_LummaC2.exe
PID 1616 wrote to memory of 4848 N/A C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe C:\Users\Admin\AppData\Local\Temp\Files\66b211924622f_LummaC2.exe
PID 1616 wrote to memory of 4848 N/A C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe C:\Users\Admin\AppData\Local\Temp\Files\66b211924622f_LummaC2.exe
PID 4856 wrote to memory of 872 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\25.exe
PID 4856 wrote to memory of 872 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\25.exe
PID 4856 wrote to memory of 2268 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\24.exe
PID 4856 wrote to memory of 2268 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\24.exe
PID 4856 wrote to memory of 3352 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\23.exe
PID 4856 wrote to memory of 3352 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\23.exe
PID 4856 wrote to memory of 4108 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\22.exe
PID 4856 wrote to memory of 4108 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\22.exe
PID 4856 wrote to memory of 4948 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\21.exe
PID 4856 wrote to memory of 4948 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\21.exe
PID 4856 wrote to memory of 412 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\20.exe
PID 4856 wrote to memory of 412 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\20.exe
PID 4856 wrote to memory of 1000 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\19.exe
PID 4856 wrote to memory of 1000 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\19.exe
PID 4856 wrote to memory of 4000 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\18.exe
PID 4856 wrote to memory of 4000 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\18.exe
PID 4856 wrote to memory of 2912 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\17.exe
PID 4856 wrote to memory of 2912 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\17.exe
PID 4856 wrote to memory of 1008 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\16.exe
PID 4856 wrote to memory of 1008 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\16.exe
PID 4856 wrote to memory of 1536 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\15.exe
PID 4856 wrote to memory of 1536 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\15.exe
PID 4856 wrote to memory of 1580 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\14.exe
PID 4856 wrote to memory of 1580 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\14.exe
PID 4856 wrote to memory of 3092 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\13.exe
PID 4856 wrote to memory of 3092 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\13.exe
PID 4856 wrote to memory of 3936 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\12.exe
PID 4856 wrote to memory of 3936 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\12.exe
PID 4856 wrote to memory of 4400 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\11.exe
PID 4856 wrote to memory of 4400 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\11.exe
PID 4856 wrote to memory of 1976 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\10.exe
PID 4856 wrote to memory of 1976 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\10.exe
PID 4856 wrote to memory of 4940 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\9.exe
PID 4856 wrote to memory of 4940 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\9.exe
PID 4856 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\8.exe
PID 4856 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\8.exe
PID 4856 wrote to memory of 4248 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\7.exe

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\PCCooker_x64.exe

"C:\Users\Admin\AppData\Local\Temp\PCCooker_x64.exe"

C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe

"C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"

C:\Users\Admin\AppData\Local\Temp\a76e49df84ba2a7b33e8ea959995b5e6faecb90d551ef169d8272ce9042c35a5.exe

"C:\Users\Admin\AppData\Local\Temp\a76e49df84ba2a7b33e8ea959995b5e6faecb90d551ef169d8272ce9042c35a5.exe"

C:\Users\Admin\AppData\Local\Temp\asena.exe

"C:\Users\Admin\AppData\Local\Temp\asena.exe"

C:\Users\Admin\AppData\Local\Temp\Bomb.exe

"C:\Users\Admin\AppData\Local\Temp\Bomb.exe"

C:\Windows\System32\Wbem\wmic.exe

wmic.exe shadowcopy delete

C:\Windows\SYSTEM32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Users\Admin\AppData\Local\Temp\CryptoWall.exe

"C:\Users\Admin\AppData\Local\Temp\CryptoWall.exe"

C:\Windows\SysWOW64\explorer.exe

"C:\Windows\syswow64\explorer.exe"

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\SysWOW64\svchost.exe

-k netsvcs

C:\Users\Admin\AppData\Local\Temp\Files\66b211924622f_LummaC2.exe

"C:\Users\Admin\AppData\Local\Temp\Files\66b211924622f_LummaC2.exe"

C:\Users\Admin\AppData\Local\Temp\25.exe

"C:\Users\Admin\AppData\Local\Temp\25.exe"

C:\Users\Admin\AppData\Local\Temp\24.exe

"C:\Users\Admin\AppData\Local\Temp\24.exe"

C:\Users\Admin\AppData\Local\Temp\23.exe

"C:\Users\Admin\AppData\Local\Temp\23.exe"

C:\Users\Admin\AppData\Local\Temp\22.exe

"C:\Users\Admin\AppData\Local\Temp\22.exe"

C:\Users\Admin\AppData\Local\Temp\21.exe

"C:\Users\Admin\AppData\Local\Temp\21.exe"

C:\Users\Admin\AppData\Local\Temp\20.exe

"C:\Users\Admin\AppData\Local\Temp\20.exe"

C:\Users\Admin\AppData\Local\Temp\19.exe

"C:\Users\Admin\AppData\Local\Temp\19.exe"

C:\Users\Admin\AppData\Local\Temp\18.exe

"C:\Users\Admin\AppData\Local\Temp\18.exe"

C:\Users\Admin\AppData\Local\Temp\17.exe

"C:\Users\Admin\AppData\Local\Temp\17.exe"

C:\Users\Admin\AppData\Local\Temp\16.exe

"C:\Users\Admin\AppData\Local\Temp\16.exe"

C:\Users\Admin\AppData\Local\Temp\15.exe

"C:\Users\Admin\AppData\Local\Temp\15.exe"

C:\Users\Admin\AppData\Local\Temp\14.exe

"C:\Users\Admin\AppData\Local\Temp\14.exe"

C:\Users\Admin\AppData\Local\Temp\13.exe

"C:\Users\Admin\AppData\Local\Temp\13.exe"

C:\Users\Admin\AppData\Local\Temp\12.exe

"C:\Users\Admin\AppData\Local\Temp\12.exe"

C:\Users\Admin\AppData\Local\Temp\11.exe

"C:\Users\Admin\AppData\Local\Temp\11.exe"

C:\Users\Admin\AppData\Local\Temp\10.exe

"C:\Users\Admin\AppData\Local\Temp\10.exe"

C:\Users\Admin\AppData\Local\Temp\9.exe

"C:\Users\Admin\AppData\Local\Temp\9.exe"

C:\Users\Admin\AppData\Local\Temp\8.exe

"C:\Users\Admin\AppData\Local\Temp\8.exe"

C:\Users\Admin\AppData\Local\Temp\7.exe

"C:\Users\Admin\AppData\Local\Temp\7.exe"

C:\Users\Admin\AppData\Local\Temp\6.exe

"C:\Users\Admin\AppData\Local\Temp\6.exe"

C:\Users\Admin\AppData\Local\Temp\5.exe

"C:\Users\Admin\AppData\Local\Temp\5.exe"

C:\Users\Admin\AppData\Local\Temp\4.exe

"C:\Users\Admin\AppData\Local\Temp\4.exe"

C:\Users\Admin\AppData\Local\Temp\3.exe

"C:\Users\Admin\AppData\Local\Temp\3.exe"

C:\Users\Admin\AppData\Local\Temp\2.exe

"C:\Users\Admin\AppData\Local\Temp\2.exe"

C:\Users\Admin\AppData\Local\Temp\1.exe

"C:\Users\Admin\AppData\Local\Temp\1.exe"

C:\Users\Admin\AppData\Local\Temp\Files\twztl.exe

"C:\Users\Admin\AppData\Local\Temp\Files\twztl.exe"

C:\Users\Admin\AppData\Local\Temp\Files\peinf.exe

"C:\Users\Admin\AppData\Local\Temp\Files\peinf.exe"

C:\Windows\sysblvrvcr.exe

C:\Windows\sysblvrvcr.exe

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS /wait

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"

C:\Windows\SysWOW64\sc.exe

sc stop UsoSvc

C:\Windows\SysWOW64\sc.exe

sc stop WaaSMedicSvc

C:\Windows\SysWOW64\sc.exe

sc stop wuauserv

C:\Users\Admin\AppData\Local\Temp\Files\66e705d09b33c_jack.exe

"C:\Users\Admin\AppData\Local\Temp\Files\66e705d09b33c_jack.exe"

C:\Windows\SysWOW64\sc.exe

sc stop DoSvc

C:\Windows\SysWOW64\sc.exe

sc stop BITS /wait

C:\Windows\SysWOW64\notepad.exe

C:\Users\Public\Documents\RGNR_40B57505.txt

Network

Country Destination Domain Proto
US 8.8.8.8:53 urlhaus.abuse.ch udp
US 151.101.130.49:443 urlhaus.abuse.ch tcp
CH 147.45.44.104:80 147.45.44.104 tcp
US 8.8.8.8:53 49.130.101.151.in-addr.arpa udp
US 8.8.8.8:53 104.44.45.147.in-addr.arpa udp
FR 188.165.164.184:80 ip-addr.es tcp
FR 188.165.164.184:443 ip-addr.es tcp
FR 94.247.31.19:8080 tcp
RU 185.215.113.84:80 450d4a71-458d-4d35-bd01-b075cdb0d900.random.tsrv1.ws tcp
US 8.8.8.8:53 84.113.215.185.in-addr.arpa udp
RU 185.215.113.84:80 450d4a71-458d-4d35-bd01-b075cdb0d900.random.tsrv1.ws tcp
US 208.95.112.1:80 ip-api.com tcp
US 208.95.112.1:80 ip-api.com tcp
US 208.95.112.1:80 ip-api.com tcp
GB 104.82.234.109:443 steamcommunity.com tcp
US 208.95.112.1:80 ip-api.com tcp
US 208.95.112.1:80 ip-api.com tcp
US 208.95.112.1:80 ip-api.com tcp
US 208.95.112.1:80 ip-api.com tcp
US 208.95.112.1:80 ip-api.com tcp
US 208.95.112.1:80 ip-api.com tcp
US 208.95.112.1:80 ip-api.com tcp
US 208.95.112.1:80 ip-api.com tcp
US 208.95.112.1:80 ip-api.com tcp
US 208.95.112.1:80 ip-api.com tcp
US 208.95.112.1:80 ip-api.com tcp
US 208.95.112.1:80 ip-api.com tcp
US 208.95.112.1:80 ip-api.com tcp
US 208.95.112.1:80 ip-api.com tcp
US 208.95.112.1:80 ip-api.com tcp
US 208.95.112.1:80 ip-api.com tcp
US 208.95.112.1:80 ip-api.com tcp
US 208.95.112.1:80 ip-api.com tcp
US 208.95.112.1:80 ip-api.com tcp
US 208.95.112.1:80 ip-api.com tcp
US 208.95.112.1:80 ip-api.com tcp
US 208.95.112.1:80 ip-api.com tcp
CN 124.222.72.51:12345 tcp
RU 185.215.113.66:80 185.215.113.66 tcp
RU 185.215.113.66:80 185.215.113.66 tcp
US 15.197.225.128:80 kenesrakishev.net tcp
FR 91.121.12.127:4141 tcp

Files

memory/2688-0-0x00000000748F1000-0x00000000748F2000-memory.dmp

memory/2688-1-0x00000000748F0000-0x0000000074EA1000-memory.dmp

memory/2688-2-0x00000000748F0000-0x0000000074EA1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe

MD5 2a94f3960c58c6e70826495f76d00b85
SHA1 e2a1a5641295f5ebf01a37ac1c170ac0814bb71a
SHA256 2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce
SHA512 fbf55b55fcfb12eb8c029562956229208b9e8e2591859d6336c28a590c92a4d0f7033a77c46ef6ebe07ddfca353aba1e84b51907cd774beab148ee901c92d62f

C:\Users\Admin\AppData\Local\Temp\a76e49df84ba2a7b33e8ea959995b5e6faecb90d551ef169d8272ce9042c35a5.exe

MD5 6f8e78dd0f22b61244bb69827e0dbdc3
SHA1 1884d9fd265659b6bd66d980ca8b776b40365b87
SHA256 a76e49df84ba2a7b33e8ea959995b5e6faecb90d551ef169d8272ce9042c35a5
SHA512 5611a83616380f55e7b42bb0eef35d65bd43ca5f96bf77f343fc9700e7dfaa7dcf4f6ecbb2349ac9df6ab77edd1051b9b0f7a532859422302549f5b81004632d

memory/2020-25-0x0000000000400000-0x000000000043D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\asena.exe

MD5 7529e3c83618f5e3a4cc6dbf3a8534a6
SHA1 0f944504eebfca5466b6113853b0d83e38cf885a
SHA256 ec35c76ad2c8192f09c02eca1f263b406163470ca8438d054db7adcf5bfc0597
SHA512 7eef97937cc1e3afd3fca0618328a5b6ecb72123a199739f6b1b972dd90e01e07492eb26352ee00421d026c63af48973c014bdd76d95ea841eb2fefd613631cc

C:\Users\Admin\AppData\Local\Temp\Bomb.exe

MD5 31f03a8fe7561da18d5a93fc3eb83b7d
SHA1 31b31af35e6eed00e98252e953e623324bd64dde
SHA256 2027197f05dac506b971b3bd2708996292e6ffad661affe9a0138f52368cc84d
SHA512 3ea7c13a0aa67c302943c6527856004f8d871fe146150096bc60855314f23eae6f507f8c941fd7e8c039980810929d4930fcf9c597857d195f8c93e3cc94c41d

C:\Users\Admin\AppData\Local\Temp\CryptoWall.exe

MD5 919034c8efb9678f96b47a20fa6199f2
SHA1 747070c74d0400cffeb28fbea17b64297f14cfbd
SHA256 e036d68b8f8b7afc6c8b6252876e1e290f11a26d4ad18ac6f310662845b2c734
SHA512 745a81c50bbfd62234edb9788c83a22e0588c5d25c00881901923a02d7096c71ef5f0cd5b73f92ad974e5174de064b0c5ea8044509039aab14b2aed83735a7c4

memory/4856-46-0x00007FFCD6033000-0x00007FFCD6035000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\d6caf64597bd5e0803f7d0034e73195e83dae370450a2e890b82f77856830167.exe

MD5 e8ae3940c30296d494e534e0379f15d6
SHA1 3bcb5e7bc9c317c3c067f36d7684a419da79506c
SHA256 d6caf64597bd5e0803f7d0034e73195e83dae370450a2e890b82f77856830167
SHA512 d07b8e684fc1c7a103b64b46d777091bb79103448e91f862c12f0080435feff1c9e907472b7fd4e236ff0b0a8e90dbbaaac202e2238f95578fed1ff6f5247386

memory/4856-47-0x0000000000A10000-0x0000000000A88000-memory.dmp

memory/1272-57-0x0000000000350000-0x0000000000375000-memory.dmp

memory/1616-58-0x0000000000510000-0x0000000000518000-memory.dmp

memory/1616-61-0x0000000004E80000-0x0000000004F1C000-memory.dmp

C:\Users\Public\Documents\RGNR_40B57505.txt

MD5 0880547340d1b849a7d4faaf04b6f905
SHA1 37fa5848977fd39df901be01c75b8f8320b46322
SHA256 84449f1e874b763619271a57bfb43bd06e9c728c6c6f51317c56e9e94e619b25
SHA512 9048a3d5ab7472c1daa1efe4a35d559fc069051a5eb4b8439c2ef25318b4de6a6c648a7db595e7ae76f215614333e3f06184eb18b2904aace0c723f8b9c35a91

memory/4172-1078-0x0000000001290000-0x00000000012B5000-memory.dmp

memory/1272-1120-0x0000000000350000-0x0000000000375000-memory.dmp

C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif

MD5 44c432c49a8114a069ba7d0bb9c4b055
SHA1 fe07a84c847353bfc3515287c09bee8111d5eab8
SHA256 e87ee3d334120d18e4ff439d394e336f9b47057cbcbcb78178aaeab5ffa9c861
SHA512 c975be01e7f78068fdf25d16d3eff3f0b47a0699155132515b5fd00e7a5e093474441f1b497d2188e05f0e533a2e5b2dd7352c5ba0e7e88b81fd8ad12c63caac

C:\Program Files\Java\jre-1.8\legal\javafx\glib.md

MD5 cc6cfead0f4100adc348971fa103368b
SHA1 31ea0d314421453fa0fd0e3825b0e1ce9d615cc3
SHA256 0a759313ad0143a711832b7412c647a34767968b45d53becb9e4f6fc7eb27593
SHA512 39d16b512c6471e162b0bc102a8c179e433511afbab1720fa483e67f72ac438643d03153bbd94c86623f07f81e78cd22fab9b1e84c74e77c513a116aa17f0b87

C:\Program Files\Java\jre-1.8\legal\javafx\gstreamer.md

MD5 dd6a98a633280e7a4261d68d0b1fb6dc
SHA1 543902c19188ddb144e27c6b8947989006cad742
SHA256 0acfd98d6c2b5a18f5a67d74c6514eefb21914330ff200fbcc2ce1ea6082a463
SHA512 03390072b76d8c4be247da62f899de9c56b9e22b994d5b57cb5da7c298e462ade7ec6afbc4e42c9d477b2349a3514d962bbe311fcb90ffa0ebd725826ea1ce5c

C:\Program Files\Java\jre-1.8\legal\javafx\libxslt.md

MD5 2bcc99f5de86080525934bb1998609b3
SHA1 ef4cfe3ab81b290c0bcc45ab3c9cbfbe7cecdd51
SHA256 89e77b15705f91bf142d9571bde47a585c74322d35e70f0a8490bc1bb77bf396
SHA512 2803343ad3c6a8934c0f44ca1dac3b0fc33de008d9fa3413144b4ad22c6855167c3a2370d6649920aa5f794d12e5f01708fdce7920d549f9c8e5980baeb28e4a

C:\Program Files\Java\jre-1.8\legal\jdk\dynalink.md

MD5 c98c9e7229b587d0b6c407eebe3eb682
SHA1 8dd88e1bebf752d0ba30e2c5d3ca5d77d3e23f39
SHA256 64b1ff8195f789fe8e97d7c22a84183d823d06a490dd01cfb0d3c9d1f283df59
SHA512 3e3e132b397674ac0bb85fdeedb0bb4bd2963941d301c590df6b775ffb2f7030360cf128a271447a9373b51008f657764d8ba616373df305750af7136048f647

C:\Program Files\Java\jre-1.8\legal\jdk\icu.md

MD5 4445361d0a4c405d6940ebb8d87dffc3
SHA1 83202b69ed95a9514ade82f9979b8d1583c11256
SHA256 14f741387edfef5ba90540b59e87190ae6bf254532343ef1dc87f67e8b7c3207
SHA512 47eae1f1b034c58080cc86ba956032eac1e79c4791b135620c357e284a9b1d23181e65fa681d24ae167ef216bc8972a045adf863da5664c73420f45963ad84f1

C:\Program Files\Java\jre-1.8\legal\jdk\cryptix.md

MD5 4f6e7cde8a9e49c8c3243cc5767c5f9d
SHA1 16f643f52939b830309b9f668709e86ace58e2e0
SHA256 78921682c6dcef8e01b471d956bf6c78fd6928c04ad249ead76f4c6832e65e4d
SHA512 a9c83f27c09ed6a2183c3d9670e8ad1178802e2dbef9a71ac92c79b58bff3960c15c330b8fcfa65acf5334bf2c8da046e6aa4aafb9e344cc2ae6c1bd29f40b0b

C:\Program Files\Java\jre-1.8\legal\jdk\colorimaging.md

MD5 b42e6d176d463bbdf271361daa3fc1f2
SHA1 b771b71dee004517f0b8a755c7c96fc898991252
SHA256 3e33fe1097771e8f89d32baf837264fbdaec579717cd60bda697497afa0ca625
SHA512 46033b44f835cd3b9b086c30b18df7cc532a8be42c3497e9b686c42cedd4a3ed05a9e7e2741354ec542a46df2b273d9cb8d1bfeaf55e5310f724d930bae93200

C:\Program Files\Java\jre-1.8\legal\jdk\cldr.md

MD5 c6cb8179158cf760b84a17144ebaf1a9
SHA1 c260a5fc4a94da3538d83fc34d9761c5b77144ca
SHA256 838d260bf246a7215f7c0a0117a3d3b8c0531968a60ed0e64a82a1bf111c2ff5
SHA512 28fdeb3ae5d5d9ff2c19abcf352afa34f0ca80ec755014f111c22d93784f58f7e36d0df840f349766ec807ee00f839ba128526ed04459f95a506f8925b15d5b9

C:\Program Files\Java\jre-1.8\legal\jdk\jcup.md

MD5 6f3081ab8f690571a0d4e400b2b3dec6
SHA1 2b3c9fa52035b4d0194dd314b418b8a2fe501a91
SHA256 3f2ea544cb5630d3bfa5447c4aaec853b82ac4ff0562a91b0df4079279dfabb6
SHA512 d24c1ad43c1e9f900da45b511e3034680175e063c80a4297f7081b01628bfa2991096674a2be87971e567a6a452b3bdb7aac8c3ded8be53770f500ccc694a217

C:\Program Files\Java\jre-1.8\legal\jdk\zlib.md

MD5 1901b6b12beec5537615c8116d594144
SHA1 435904fabc6ef8da7de21281b93286202f0c4b2d
SHA256 a8ff74ec1de660a71576e2729be19a3fb260b4b288c4b9c58bd4fc08e851ddba
SHA512 fa9e70d336ede1b292aa9601310c32682d6a36c125fadf027684a0a5525b28237e1a05fdb1a696eacb81b786ec7d115d9422d8087be42a18246cd4090770f571

C:\Program Files\Java\jre-1.8\legal\jdk\xmlresolver.md

MD5 c3febb44566248a223e0b54986390f8d
SHA1 d0ee801dcdc5d483801b88425b2137514cbeee64
SHA256 543c356851f05281ed7e43f085fac121beadc6c9a4f07211877c7d255be716dd
SHA512 b58737b42346c477b7e42212b61b3d36d654e08425aa4ad5ccd1ed4b69a41a27751e71eb2729c1a230658da4486aad5bc935d3b3981a1f417f5824f2567e60ea

C:\Users\Admin\AppData\Local\Temp\Files\66b211924622f_LummaC2.exe

MD5 6796c089b30aa2e34f560a27f7d230f3
SHA1 67370f925233ac1ee01b74d755a9b7ebe20abef6
SHA256 e5bfc88e1b74ed30d700d8c198322c04029e8db407c5f9f053a6290892b697db
SHA512 19020abf60ad2267a230f576fa8cf765deb571f9933521ae80c57c56e791bf9cbf68c7a14e77ff0eae772a8d95f6b38f1366c617b95ba56583386d88d9c564ee

C:\Program Files\Java\jre-1.8\lib\deploy\messages_zh_HK.properties

MD5 027c507228f7e708d49cd7fb24f366f8
SHA1 adb33303fff7ce01a1fcad516604415084c38c44
SHA256 e0637734a9140c2d13f95ed7b9db83c66157673867b7ac8194bd1468d3f70b28
SHA512 6faf2dc67438953994cac18ac99736857f79317d2760b58727727867cb6cd0f363176f363383b9c318510c25e92f186aa18005005eca0323ea82ade07d41bb45

C:\Program Files\Java\jre-1.8\legal\jdk\xerces.md

MD5 ef9ce854a5109ba7635fdce2139125b3
SHA1 4559f7dd264a366551b05a3c86da06f30ade3221
SHA256 c69a8ed89825f5e3dba778ee7b69d749c94690c7c8f37e2b10c99ff4552f5078
SHA512 0f84e462ffe368c522de009413ddc2feb8fd5f15e471be35a2d5ec6917fd2c87438a6d1cdd43f73a750a5ec1b322ee837b2fe79fad1e3222bc6a88ea1f08820c

C:\Program Files\Java\jre-1.8\legal\jdk\xalan.md

MD5 3365f0fb61968f0bb6d7b5b846d002d4
SHA1 73927bf38e0d7a4cacbe81219e89c56531d7f24f
SHA256 3df26cfa88be1872b65d320114519ebe0d212202237d201eb2ce604ab262088c
SHA512 53456fdaa4c357d0e84e9f6b3c57341057981ddb27dab1b358762fe09cfd42da6d07a2219647a908f5c884046cad66a80311f79f1a1995c095c05a3949d396b0

C:\Program Files\Java\jre-1.8\legal\jdk\unicode.md

MD5 1205ba5cd46d8ccd73580d207ded165f
SHA1 56d4077ae6995911d71e50ef4593ad671c7e849d
SHA256 241214e2754f5289fc58a87fda490359e7c9a41ae968e1653e6027c4b3cb8bc5
SHA512 54b641c725dc3d30715783ccda4711252e17cf73f6db9a933a591198ce7880d9ddebac05c76f25dfa6dbbc26d3500590ee550ef4b3a4b9c2e40f6f0cad8a9559

C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md

MD5 6511f0d0487f08a6dca3dd6a0daa273d
SHA1 e9a51228815eeeb9de63ce2c4e0e2bd8324d1f46
SHA256 6cb652fa30789cc0c9116629bf7602193d750e82191bd747fbfda761605548d9
SHA512 c16f86e237ead6e108b9bacf256d431292cdb5492b34e052daf4895b4f1009a26d4bfc72a3b393c52811b4e53e3298c029bb879a4947451cc06d66414a86f44b

C:\Users\Admin\AppData\Local\Temp\25.exe

MD5 476d959b461d1098259293cfa99406df
SHA1 ad5091a232b53057968f059d18b7cfe22ce24aab
SHA256 47f2a0b4b54b053563ba60d206f1e5bd839ab60737f535c9b5c01d64af119f90
SHA512 9c5284895072d032114429482ccc9b62b073447de35de2d391f6acad53e3d133810b940efb1ed17d8bd54d24fce0af6446be850c86766406e996019fcc3a4e6e

C:\Program Files\Java\jre-1.8\legal\jdk\santuario.md

MD5 d8e458e4eeac9c3f53e94c9903ddd6aa
SHA1 3e332579be923b04b9577fc7d1bc04a4c457dbda
SHA256 91e5a836d249077fd47abc2051eb8c7cee779ecaabb94307578ff1196af19443
SHA512 c492c5aa3403cd7c950e91b4d3c1eefa20890a713c0ed5b2d143d3a49e276ae92e08bae3b1ccc7d2f940bfe54aef9ac4ddc48e18539d98104ffb8a3793242261

C:\Program Files\Java\jre-1.8\legal\jdk\relaxngom.md

MD5 97fd5d86d4683dd59c10fb4d9096d7bd
SHA1 3e357504caebb5c94a6d71d5e2dab686c6723c8a
SHA256 9c06801d4b565296e71e68ba81cac864e3ac082ed907ee4e07f941132a66e845
SHA512 d6c8907341e53481f7dde4728126034ecb4696593782052f41899031f89ec3bb05100c8440b0980e72393aadf84ebfc40fa9d6f51995074090ffc4588b8245ab

C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md

MD5 0d0862ba24cb9bbfd48824ad25398de2
SHA1 2d23eb4432eb59899f4008bfd3adab173602dad7
SHA256 d108484e057619d0e850b00e589500aaeae23d17097afc244958dc2ab1f8d891
SHA512 c822eebfb8011edc698d832c237244869be203e1798c8a84df9e03bf4a75e6216e153f732338e8cdb0bd286f4db3deffd52ebbb3f386d725fb1e01f38d2eab5d

C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md

MD5 fb1f52a645b394f65602b889fdb75994
SHA1 857cbf8883001e6fa74641d2de67824090a5e352
SHA256 e7b5fb94cb35620f20a872fdfe6f615ec23b020c1c742b3db1fadc7f62b943be
SHA512 44cb539a7ea7b7103ee9a2be1fb99c7dbb82340354fe93ace947c2ce4df2b26ef1e6a0cdc6bdc390a6c3a37c102ac62745420493926dc6a225949510ed16c7dc

C:\Program Files\Java\jre-1.8\legal\jdk\relaxngcc.md

MD5 7219560b685f9a6a2cef8e142c7c58af
SHA1 1af618a3c5b19cd169418a312c7b1e713761d8fd
SHA256 2323a8c7b1db03d38dfb82bf7187b857c1da6db355f50b0c97b2e9a85b6bb105
SHA512 597408ca4b002ddf5da9efaa2b23c961dfffc8d758e0c23afde199a038c3d07d245e1fcfac6ec287f517d78298d0be64b5c83b70a32d6cc80667c3b4991a27df

C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11wrapper.md

MD5 d71be4c11161ef541da43079eb1f3d4b
SHA1 445ec52415b888a58cdfbc659f579022fc903199
SHA256 e1e972ff49f6d687f72ae0707762f9090c25b6652304283a95f17df74fdac805
SHA512 cb5ffb9e403678409baae8e8ea1cd74e414591c97abfdb35fc724dea00f162bfca93cb510a474a670d66c6a048c179f7a6316d360885d4e57e5301211e629915

C:\Program Files\Java\jre-1.8\legal\jdk\mesa3d.md

MD5 3fd709461213304aea59d9b812f43e13
SHA1 50f349e4da2ce455f821c634349da926ed62c736
SHA256 1e83d5cf537aec69333648bc7c62ae3cc10812d2f2388718eed04953f5a93e7d
SHA512 387a403e61eaa7f8f69a479a41d0dc415d12ae5f3bd5a76b95a6444919489b3b81e7516256f67b158b9e68edcf018026340c1623222faca3bef76070e7f6cab6

C:\Program Files\Java\jre-1.8\legal\jdk\libpng.md

MD5 6de3fb07ca25307554f5f020420999a2
SHA1 8f315cdad20f4151e83da99535e3146810410972
SHA256 2b7537edcb8cf3de7ab49ea6340b1dad4e1005afb99b01460afb28305d76620b
SHA512 ec1686355225da1ab837f3bfbb7dd4a41890c8a363e2079525ac80586cc37e309984452c84a8d3ebd3e7a705966a9ccc8abd952d3637c12fb13d2ec8c31f49c4

C:\Program Files\Java\jre-1.8\legal\jdk\lcms.md

MD5 347f01333bfc5ef1b99f889330b6c153
SHA1 0a90ec3cece037b1931ed67b1bcd2226b8065086
SHA256 3adbfbb289c5c5d39bbdd2b5d019582866ce370e1657bac5b9b126a224398a81
SHA512 affd9bab51fc94cf5e4d1ebb225e1a8d21da58c3f2a3228ccf6aa6fd8f1a35c8ce4be90a9e742d9bc62abd9470adb42f17a9c20dee9eb6ee9d77ef6adade89e2

C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md

MD5 a3d55beeed1b59781b828a1da8b26aa6
SHA1 076fa795c5574646dfee77a38afd00f7e6cf7708
SHA256 008129556f2ef79159e8605000a73446648e3a0de5f263fef729a5a17e571d08
SHA512 2a9cf6abbc511e962d62942946ebcd436deec079460d0c1cbea0b69d26b99088d53c1ca286fab03c45c9a960e24d6b13a3ea20ea8e3886010945af4b78545132

C:\Program Files\Java\jre-1.8\legal\jdk\jopt-simple.md

MD5 521678b4982435801f883da5b394bb0c
SHA1 4b48a7b28f57483a4b3fd264e87a6a4635a0f468
SHA256 9fd9a4faf32ec5fe0cc91af31c5fca6b80028fe1461be2a689c75846b571a857
SHA512 2df526c26dd7bcca5d9d8ad502ff015d435900b273fc94c8e41dc6023960d8ac8f2988713d68de77ca7ab5e55c2df939bcb08d215adbb72d6b01b7d2c3f746d7

C:\Program Files\Java\jre-1.8\legal\jdk\joni.md

MD5 fbb679e6b0b034a9e84e3c88d5fd9024
SHA1 1d85f0dd6bc69b9122c637482d9fb8ad7189214d
SHA256 53a1ee63d3215c876f3bf7af318fd6554eccc409b3a92fd05bd4adb91496b78d
SHA512 a7b3d2c6bb060825d23961eb82801bbb98ad194e2fb36d27ea34947621fd37465abd0d0d09d7e8bd603921e540cbfe7c290318555ddf3c46bdf735a3d914253a

C:\Program Files\Java\jre-1.8\legal\jdk\giflib.md

MD5 74cd78bf4c853e697f2c77fd78767277
SHA1 9084258411bf9559a3145d394c8eb68f1f5b5f2e
SHA256 ffa520d9363138b1d656d66b1963d8b1f53a467b20a819c0f2b51845141cbdb1
SHA512 6b2d6c280fd022fc1b99a9eba3f2cf05e78d4adbbafde68d6b182d1a8e15630c4fb5c2c68f1f4445c1de67efa88722d0bb228cf985439b0b126d3fe903bb0007

C:\Program Files\Java\jre-1.8\legal\jdk\freebxml.md

MD5 220b8620bbf3b51350aab660f0094349
SHA1 b2838da2c8bbde6af20d57288b17fb34706b04b1
SHA256 09762f4116798f2b653dcb3aedba07dec2c4a2e015b98964abde5217efe33b46
SHA512 5125b435c7b9411ad56491c2f9e4719f895c9c23128a50f588e70399b9152fffcb821c771485ff3df7a7b23078342f38b056d305e0835e5d41571b4bde792f47

C:\Program Files\Java\jre-1.8\legal\jdk\ecc.md

MD5 5e2daee21ef1e44b39874c97aec19618
SHA1 e646353a3bed739f8255e1bc8972005a80127b55
SHA256 e8019cb511ee85ac5a3dc97444fad2b7b7d895a32fd3545c9f5bf447bdb9b4ca
SHA512 1d4b3ea931d2e76e9f1b39430e94eff6f6889e1f59a0684f5cfa9b2b736f50da358ab7717b2a06489fe623faf537c7d399c1695e74b68970268923724cef840a

C:\Program Files\Java\jre-1.8\legal\jdk\asm.md

MD5 405049066308bc969236e47445210667
SHA1 cb5cc24b384dac72c8dfcbd8644c36af4b5d40e8
SHA256 66eb1bbc5a6c9d3d8b042faa2567ba82f1846988f8afd6d5b0c9e2d7e15f06cd
SHA512 7d8c39ac75fcb13977fe945d82c32c281ebe481760d86a1b2da634f09738aa553c94e7de932fa91c1efe4475c8df8bd08416fc96d9dbff5efd2d6395d3301ad4

C:\Program Files\Java\jre-1.8\legal\jdk\dom.md

MD5 8c190604346057d9a65c30452a894cdb
SHA1 1982b8be70aa5183ff384fcbbaf629c4f609bfc6
SHA256 f9a26fb3875d42cff9da4c23f4bc6245a626771cacf20f110622879b392b4862
SHA512 cb82d078e97f733b51ce276855ef1488bbf7e485bc042e5c90b2f42273e498ca1f1db0361c9a0b3c37cc96481b279680e3fc8f9281270c1733f0dccfac0a592b

C:\Program Files\Java\jre-1.8\legal\javafx\webkit.md

MD5 5e23bbccce4d1f5cd72b9e58c2b5070a
SHA1 e75350f06e50a4c4c60421f1dfdafbb1aa5597f7
SHA256 59a9e3bc03d13f40384ff8a40e35634f92b7e979b6a29e857a480031707b54b2
SHA512 213e7ab2a959dafa6f5a848de7f4844c68f660d9dfff20c205fcadfef0b21a21b16848de09a60946c0e5a4c9ab06843623fcc69c8ff8e1bdffa8c1af9971d75d

C:\Program Files\Java\jre-1.8\legal\javafx\public_suffix.md

MD5 a22db9479725e4f25e84b266bf470e7f
SHA1 486f150afca4444b295a5ac113e675d3bfa7cae1
SHA256 c67376997d0bb2dd480655848462ead73203577290da98ae1dd59188d817eaa6
SHA512 eb5f5bf86e28b3a57b898edfd43365e52d340f6ddfdf393009b101b0e59786bc5d5935dfc2915add9f625beb00954fd981178adcd4273f11569dfa2ba362f843

C:\Program Files\Java\jre-1.8\legal\javafx\mesa3d.md

MD5 e80d49e1c874940d22b32ccf1ee013fb
SHA1 3ba190c09571b48ffb61c39546622f7ed6603712
SHA256 b12c8125ff643b7848cdf575eccef857856ee3f82a13f3187f6be5b141183648
SHA512 f7b6f0c0b9fcd77bf9531998fc8c74867e611cf8129d37701e937cfee78ed994c49820a13c6c459917e871faf2d15234be230fde45850ef1b4e2f13f941e3229

C:\Program Files\Java\jre-1.8\legal\jdk\bcel.md

MD5 296e98a9c160a7289055ad6654989340
SHA1 8eaac7dc9bff378e3c5aa23918d46d1014c5bc64
SHA256 63e6abace584978f5bef300e21a38a40c671721ea4bb20d1e2113758c4d53b8e
SHA512 4e546c055fa5da92d7e6464fcef8cbe4377529588c3d44ecfeda4d2a1f7ec34c0ca118fd194a0257ea27fe2ecac31bdc6c24504ba7e0d73463dec2e71d31df2c

C:\Program Files\Java\jre-1.8\legal\javafx\libxml2.md

MD5 b4e005907860ca4671a845aa86ae0a23
SHA1 c1a53e8a0ac8318c56c390191eeaa1acfbf2e1e7
SHA256 77bc83c3c39c94df77ac4bfc20ff53574e246a3fa8acc5374c10956d20980c38
SHA512 708c81ed15ba5e8778414ce3567f8fb88220c6635989a336e96773cbbf39d902044f07e8da401647631701dab41e510fbc2e47c049223b328966828f24e466f4

C:\Program Files\Java\jre-1.8\legal\javafx\libffi.md

MD5 826cf564343fbaad719e9038ab37d688
SHA1 951e4073fd1f47f3033b11b2a91100eb020458c1
SHA256 a7b4eefb652de3aca03e03ed2f2b0034a0b0fdf5b389b3ad75dfe4a0270c9c67
SHA512 498cb5849e2b88f27bfb8ba2ff0660bcaf5ea38e333f3ff5ad5c6ea770ddbc1b09396c6169362f374cbec8cf9f48d184d9bd336c8c7796ef97b269c10c1a268a

C:\Program Files\Java\jre-1.8\legal\javafx\jpeg_fx.md

MD5 68c728de72b5cd34a90c68d1105774e5
SHA1 628bdf35148f166dfe0f057f0e8f609d1c9d749b
SHA256 3a89088192be48c5ce1e2f2cf2a1f02193120eda7a0fbe0ac48faa2653083b07
SHA512 73f0bfaf024657b7047d82a64091ecf6271b24dd219ad484681970002d391b7e88c02b1714e3c9c24ee89828f45f7ad23305cb40e72f57328771206ae953fa5b

C:\Program Files\Java\jre-1.8\legal\javafx\icu_web.md

MD5 b9a2cffd1da8ecb216715e4464b9d387
SHA1 11947d9a7d1dc8af84eb81fb31afb07969862d7e
SHA256 28626b9bb4822d0c8bd164d17bdd2590a721328b26a50c0487037263093b595e
SHA512 713dceb5b893ddbca1e0e7eb122caa8959a1e85bdaa02c1c4fe29d7f396385b617afdf0f2e2dd0ce57b0351bf83f5f8b2fdc583627ba08ae140400ba29bf0e92

C:\Program Files\Java\jre-1.8\legal\javafx\directshow.md

MD5 8c9e2d97cf882bb0425ac39e83e51b15
SHA1 b83c5f4294f9744267d4228ee2a41b3386dc18d8
SHA256 86c34f2757a547d9ab3556d9365b13d104f031e1510c0716db40d50e42f9bf4b
SHA512 31c3f2f858faf0dd62630ffb11264bd155b2d0d7d7e3a40ab6690cc835caab326ebfc88dea33e17c0e67269635a18383dccebfad7044725361ed203b9d27c56b

C:\Users\Admin\AppData\Local\Temp\24.exe

MD5 042dfd075ab75654c3cf54fb2d422641
SHA1 d7f6ac6dc57e0ec7193beb74639fe92d8cd1ecb9
SHA256 b91fb228051f1720427709ff849048bfd01388d98335e4766cd1c4808edc5136
SHA512 fada24d6b3992f39119fe8e51b8da1f6a6ca42148a0c21e61255643e976fde52076093403ccbc4c7cd2f62ccb3cdedd9860f2ac253bb5082fb9fe8f31d88200d

memory/872-1709-0x0000000000C90000-0x0000000000CA0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\23.exe

MD5 7e87c49d0b787d073bf9d687b5ec5c6f
SHA1 6606359f4d88213f36c35b3ec9a05df2e2e82b4e
SHA256 d811283c4e4c76cb1ce3f23528e542cff4747af033318f42b9f2deb23180c4af
SHA512 926d676186ec0b58b852ee0b41f171729b908a5be9ce5a791199d6d41f01569bcdc1fddd067f41bddf5cdde72b8291c4b4f65983ba318088a4d2d5d5f5cd53af

memory/2268-1826-0x0000000000160000-0x0000000000170000-memory.dmp

memory/3352-1849-0x0000000000E60000-0x0000000000E70000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\21.exe

MD5 a8e9ea9debdbdf5d9cf6a0a0964c727b
SHA1 aee004b0b6534e84383e847e4dd44a4ee6843751
SHA256 b388a205f12a6301a358449471381761555edf1bf208c91ab02461822190cbcf
SHA512 7037ffe416710c69a01ffd93772044cfb354fbf5b8fd7c5f24a3eabb4d9ddb91f4a9c386af4c2be74c7ffdbb0c93a32ff3752b6ab413261833b0ece7b7b1cb55

C:\Users\Admin\AppData\Local\Temp\22.exe

MD5 296bcd1669b77f8e70f9e13299de957e
SHA1 8458af00c5e9341ad8c7f2d0e914e8b924981e7e
SHA256 6f05cae614ca0e4751b2aaceea95716fd37a6bf3fae81ff1c565313b30b1aba2
SHA512 4e58a0f063407aed64c1cb59e4f46c20ff5b9391a02ceff9561456fef1252c1cdd0055417a57d6e946ec7b5821963c1e96eaf1dd750a95ca9136764443df93d7

C:\Users\Admin\AppData\Local\Temp\17.exe

MD5 c252459c93b6240bb2b115a652426d80
SHA1 d0dffc518bbd20ce56b68513b6eae9b14435ed27
SHA256 b31ea30a8d68c68608554a7cb610f4af28f8c48730945e3e352b84eddef39402
SHA512 0dcfcddd9f77c7d1314f56db213bd40f47a03f6df1cf9b6f3fb8ac4ff6234ca321d5e7229cf9c7cb6be62e5aa5f3aa3f2f85a1a62267db36c6eab9e154165997

C:\Users\Admin\AppData\Local\Temp\11.exe

MD5 6c734f672db60259149add7cc51d2ef0
SHA1 2e50c8c44b336677812b518c93faab76c572669b
SHA256 24945bb9c3dcd8a9b5290e073b70534da9c22d5cd7fda455e5816483a27d9a7d
SHA512 1b4f5b4d4549ed37e504e62fbcb788226cfb24db4bfb931bc52c12d2bb8ba24b19c46f2ced297ef7c054344ef50b997357e2156f206e4d5b91fdbf8878649330

C:\Users\Admin\AppData\Local\Temp\2.exe

MD5 012a1710767af3ee07f61bfdcd47ca08
SHA1 7895a89ccae55a20322c04a0121a9ae612de24f4
SHA256 12d159181d496492a057629a49fb90f3d8be194a34872d8d039d53fb44ea4c3c
SHA512 e023cac97cba4426609aeaa37191b426ff1d5856638146feab837e59e3343434a2bb8890b538fdf9391e492cbefcf4afde8e29620710d6bd06b8c1ad226b5ec4

C:\Users\Admin\AppData\Local\Temp\3.exe

MD5 a83dde1e2ace236b202a306d9270c156
SHA1 a57fb5ce8d2fe6bf7bbb134c3fb7541920f6624f
SHA256 20ab2e99b18b5c2aedc92d5fd2df3857ee6a1f643df04203ac6a6ded7073d5e8
SHA512 f733fdad3459d290ef39a3b907083c51b71060367b778485d265123ab9ce00e3170d2246a4a2f0360434d26376292803ccd44b0a5d61c45f2efaa28d5d0994df

C:\Users\Admin\AppData\Local\Temp\Files\twztl.exe

MD5 f437204b3e1627d8b03eefdf360281ad
SHA1 c824e787a9786d5fdd19effdec54abef217e5b39
SHA256 d4bbc125a9e94de44f4deea9d6b10adc87a1ec1aedd753b39d26bb15817fdadb
SHA512 bdb6fc7d1e7f61df6a7ff3036fd56793e1096937fb07fbe033692f20de1bc81ca0215c5eff5a21627607c1ca514296d9598490c244bba5ec60c74653e1978910

C:\Users\Admin\AppData\Local\Temp\4.exe

MD5 c24de797dd930dea6b66cfc9e9bb10ce
SHA1 37c8c251e2551fd52d9f24b44386cfa0db49185a
SHA256 db99f9a2d6b25dd83e0d00d657eb326f11cc8055266e4e91c3aec119eaf8af01
SHA512 0e29b6ce2bdc14bf8fb6f8324ff3e39b143ce0f3fa05d65231b4c07e241814fb335ede061b525fe25486329d335adc06f71b804dbf4bf43e17db0b7cd620a7c6

C:\Users\Admin\AppData\Local\Temp\15.exe

MD5 c936e231c240fbf47e013423471d0b27
SHA1 36fabff4b2b4dfe7e092727e953795416b4cd98f
SHA256 629bf48c1295616cbbb7f9f406324e0d4fcd79310f16d487dd4c849e408a4202
SHA512 065793554be2c86c03351adc5a1027202b8c6faf8e460f61cc5e87bcd2fe776ee0c086877e75ad677835929711bea182c03e20e872389dfb7d641e17a1f89570

C:\Users\Admin\AppData\Local\Temp\7.exe

MD5 c84f50869b8ee58ca3f1e3b531c4415d
SHA1 d04c660864bc2556c4a59778736b140c193a6ab2
SHA256 fa54653d9b43eb40539044faf2bdcac010fed82b223351f6dfe7b061287b07d3
SHA512 bb8c98e2dadb884912ea53e97a2ea32ac212e5271f571d7aa0da601368feabee87e1be17d1a1b7738c56167f01b1788f3636aac1f7436c5b135fa9d31b229e94

memory/2912-2242-0x0000000000020000-0x0000000000030000-memory.dmp

memory/1000-2241-0x0000000000220000-0x0000000000230000-memory.dmp

memory/4000-2240-0x0000000000180000-0x0000000000190000-memory.dmp

memory/412-2239-0x00000000007B0000-0x00000000007C0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\8.exe

MD5 7cfe29b01fae3c9eadab91bcd2dc9868
SHA1 d83496267dc0f29ce33422ef1bf3040f5fc7f957
SHA256 2c3bfb9cc6c71387ba5c4c03e04af7f64bf568bdbe4331e9f094b73b06bddcff
SHA512 f6111d6f8b609c1fc3b066075641dace8c34efb011176b5c79a6470cc6941a9727df4ceb2b96d1309f841432fa745348fc2fdaf587422eebd484d278efe3aeac

C:\Users\Admin\AppData\Local\Temp\1.exe

MD5 8ec649431556fe44554f17d09ad20dd6
SHA1 b058fbcd4166a90dc0d0333010cca666883dbfb1
SHA256 d1faee8dabc281e66514f9ceb757ba39a6747c83a1cf137f4b284a9b324f3dc4
SHA512 78f0d0f87b4e217f12a0d66c4dfa7ad7cf4991d46fdddfaeae47474a10ce15506d79a2145a3432a149386083c067432f42f441c88922731d30cd7ebfe8748460

memory/4248-2338-0x0000000000CF0000-0x0000000000D00000-memory.dmp

memory/2824-2337-0x0000000000960000-0x0000000000970000-memory.dmp

memory/5240-2358-0x0000000000420000-0x0000000000430000-memory.dmp

memory/1976-2372-0x0000000000610000-0x0000000000620000-memory.dmp

memory/2312-2357-0x0000000000240000-0x0000000000250000-memory.dmp

memory/1880-2356-0x0000000000830000-0x0000000000840000-memory.dmp

memory/2412-2355-0x00000000007D0000-0x00000000007E0000-memory.dmp

memory/1580-2354-0x0000000000800000-0x0000000000810000-memory.dmp

memory/4720-2353-0x00000000001B0000-0x00000000001C0000-memory.dmp

memory/1536-2352-0x0000000000E20000-0x0000000000E30000-memory.dmp

memory/4400-2345-0x00000000007C0000-0x00000000007D0000-memory.dmp

memory/1008-2336-0x0000000000360000-0x0000000000370000-memory.dmp

memory/3936-2335-0x0000000000A40000-0x0000000000A50000-memory.dmp

memory/3092-2334-0x0000000000E50000-0x0000000000E60000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\10.exe

MD5 d6f9ccfaad9a2fb0089b43509b82786b
SHA1 3b4539ea537150e088811a22e0e186d06c5a743d
SHA256 9af50adf3be17dc18ab4efafcf6c6fb6110336be4ea362a7b56b117e3fb54c73
SHA512 8af1d5f67dad016e245bdda43cc53a5b7746372f90750cfcca0d31d634f2b706b632413c815334c0acfded4dd77862d368d4a69fe60c8c332bc54cece7a4c3cd

memory/2928-2320-0x0000000000F10000-0x0000000000F20000-memory.dmp

memory/4940-2318-0x0000000000F40000-0x0000000000F50000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\5.exe

MD5 84c958e242afd53e8c9dae148a969563
SHA1 e876df73f435cdfc4015905bed7699c1a1b1a38d
SHA256 079d320d3c32227ba4b9acddf60bfcdf660374cb7e55dba5ccf7beeaedd2cdef
SHA512 9e6cb07909d0d77ebb5b52164b1fa40ede30f820c9773ea3a1e62fb92513d05356dfef0e7ef49bf2ad177d3141720dc1c5edceb616cef77baec9acdd4bbc5bae

C:\Users\Admin\AppData\Local\Temp\16.exe

MD5 0ab873a131ea28633cb7656fb2d5f964
SHA1 e0494f57aa8193b98e514f2bc5e9dc80b9b5eff0
SHA256 a83e219dd110898dfe516f44fb51106b0ae0aca9cc19181a950cd2688bbeeed2
SHA512 4859758f04fe662d58dc32c9d290b1fa95f66e58aef7e27bc4b6609cc9b511aa688f6922dbf9d609bf9854b619e1645b974e366c75431c3737c3feed60426994

C:\Users\Admin\AppData\Local\Temp\9.exe

MD5 28c50ddf0d8457605d55a27d81938636
SHA1 59c4081e8408a25726c5b2e659ff9d2333dcc693
SHA256 ebda356629ac21d9a8e704edc86c815770423ae9181ebbf8ca621c8ae341cbd5
SHA512 4153a095aa626b5531c21e33e2c4c14556892035a4a524a9b96354443e2909dcb41683646e6c1f70f1981ceb5e77f17f6e312436c687912784fcb960f9b050fe

C:\Users\Admin\AppData\Local\Temp\12.exe

MD5 7ac9f8d002a8e0d840c376f6df687c65
SHA1 a364c6827fe70bb819b8c1332de40bcfa2fa376b
SHA256 66123f7c09e970be594abe74073f7708d42a54b1644722a30887b904d823e232
SHA512 0dd36611821d8e9ad53deb5ff4ee16944301c3b6bb5474f6f7683086cde46d5041974ec9b1d3fb9a6c82d9940a5b8aec75d51162999e7096154ad519876051fe

C:\Users\Admin\AppData\Local\Temp\13.exe

MD5 c76ee61d62a3e5698ffccb8ff0fda04c
SHA1 371b35900d1c9bfaff75bbe782280b251da92d0e
SHA256 fbf7d12dd702540cbaeeecf7bddf64158432ef4011bace2a84f5b5112aefe740
SHA512 a76fee1eb0d3585fa16d9618b8e76b8e144787448a2b8ff5fbd72a816cbd89b26d64db590a2a475805b14a9484fc00dbc3642d0014954ec7850795dcf2aa1ee7

C:\Users\Admin\AppData\Local\Temp\14.exe

MD5 e6c863379822593726ad5e4ade69862a
SHA1 4fe1522c827f8509b0cd7b16b4d8dfb09eee9572
SHA256 ae43886fee752fb4a20bb66793cdd40d6f8b26b2bf8f5fbd4371e553ef6d6433
SHA512 31d1ae492e78ed3746e907c72296346920f5f19783254a1d2cb8c1e3bff766de0d3db4b7b710ed72991d0f98d9f0271caefc7a90e8ec0fe406107e3415f0107e

C:\Users\Admin\AppData\Local\Temp\6.exe

MD5 27422233e558f5f11ee07103ed9b72e3
SHA1 feb7232d1b317b925e6f74748dd67574bc74cd4d
SHA256 1fa6a4dc1e7d64c574cb54ae8fd71102f8c6c41f2bd9a93739d13ff6b77d41ac
SHA512 2d3f424a24e720f83533ace28270b59a254f08d4193df485d1b7d3b9e6ae53db39ef43d5fc7de599355469ad934d8bcb30f68d1aaa376df11b9e3dec848a5589

memory/4108-2032-0x0000000000EC0000-0x0000000000ED0000-memory.dmp

memory/4948-2236-0x0000000000910000-0x0000000000920000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\18.exe

MD5 d32bf2f67849ffb91b4c03f1fa06d205
SHA1 31af5fdb852089cde1a95a156bb981d359b5cd58
SHA256 1123f4aea34d40911ad174f7dda51717511d4fa2ce00d2ca7f7f8e3051c1a968
SHA512 1e08549dfcbcfbe2b9c98cd2b18e4ee35682e6323d6334dc2a075abb73083c30229ccd720d240bcda197709f0b90a0109fa60af9f14765da5f457a8c5fce670a

C:\Users\Admin\AppData\Local\Temp\19.exe

MD5 4c1e3672aafbfd61dc7a8129dc8b36b5
SHA1 15af5797e541c7e609ddf3aba1aaf33717e61464
SHA256 6dac4351c20e77b7a2095ece90416792b7e89578f509b15768c9775cf4fd9e81
SHA512 eab1eabca0c270c78b8f80989df8b9503bdff4b6368a74ad247c67f9c2f74fa0376761e40f86d28c99b1175db64c4c0d609bedfd0d60204d71cd411c71de7c20

C:\Users\Admin\AppData\Local\Temp\20.exe

MD5 f18f47c259d94dcf15f3f53fc1e4473a
SHA1 e4602677b694a5dd36c69b2f434bedb2a9e3206c
SHA256 34546f0ecf4cd9805c0b023142f309cbb95cfcc080ed27ff43fb6483165218c1
SHA512 181a5aa4eed47f21268e73d0f9d544e1ceb9717d3abf79b6086584ba7bdb7387052d7958c25ebe687bfdcd0b6cca9d8cf12630234676394f997b80c745edaa38

C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME.txt

MD5 eb9c8d838c71fefb8f4d6f8478f0300e
SHA1 c270060984816a86436392968b1f1a248cdf1787
SHA256 955d5c55865555b227ac0a28020a75089315e9b2c1ef056c2d1d53b16d7d9df2
SHA512 5d24d274cde4f91905983aeb00c2bed65557777f5b89e71d525f7d00660eb7e9bb7401ee6804b34abb7ca63543e850d3bc632841d1c8b4f0adb8c50e461eb664

C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt

MD5 686b7f4f93abf66588f27e4d614681b6
SHA1 edda8d1bdcf2206cca438e299f7cced464ee0358
SHA256 1b508d412e87f5f4040589fca6ca2a8dc11390611359640315c3ced72c4ce7c9
SHA512 15d7a64f03f6817554b17ddb4b8de5246746ddf7e9a564a6cf0eda0716e399694815936eabd11d6b6a25165e2c27de9b4a7f4814a5b38dbed490e544d2b58354

C:\Program Files\Java\jre-1.8\LICENSE

MD5 fb1c93c91af4ce1b2fcc3869779b2faa
SHA1 c58cb1ec97a72357e8824944efa2b986118f00b4
SHA256 293aea4ced6bdd9533daf2d36711c02283a15d89942cd113a753b92c95fb0b02
SHA512 539156b55433d000f380b6e0580eee89b0c3568daf778208922fe839897566b590664c9461fb150ecdab8ae49cfaf15eb4d457b50abbfd6bf55eb355c5cece0c

C:\Program Files\Java\jre-1.8\COPYRIGHT

MD5 5ee1319ed93735a4544bf5e980afb65b
SHA1 3802cfd368de6848636db8e339fe2f7945fbe964
SHA256 6595f7a5c5ec1956dd0a207c3a0e5ad9d9531c084fb099a45be6ccbba717d161
SHA512 0ad8511f97f0396a838bd1b073bdef06cd206e3b0565b5dff1c98d48c6961cda60395597d92ee68ee01fdbd297ed22b7b14c6c982f3b6780ea82f16f7d5224bd

C:\Users\Admin\AppData\Local\Temp\Files\peinf.exe

MD5 23b1eaa94b3e9421106d6e3eb79064df
SHA1 1472b3fd4648049820b48409eca265feed547365
SHA256 b3ae3b2422adecb9e7bc7e43a1ecbc616b62ff10a3c51b4eeb7ac6fab5eeee02
SHA512 38aff701f485bd9678f6a9a440eb867ff8b9af9c68c27c4e3b0d7444d1a09240ecd946c7e38ec608d83447be74fcaf06db572159275a04ddd2aea0c31cf7ce11

C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub2019_eula.txt

MD5 e2d9b07f40fb4e85bd94dc6ae9549db2
SHA1 fec15deb18b47fbe271fedc1580d2d0a12fa4559
SHA256 58237e524251c838415fd88b1dd8e48b1085389681ff52c6cf28902922df46d1
SHA512 03e0b521c63932fbc9aab34197a9edcadb2a42728bf879914774e237a0817f1db36731314de3f8ebc396b8cff38b64a100e67fd108ea936c1da24d6b46c799e7

C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC_K_COL.HXK

MD5 d40dff0e03dc36f967296f07fbbace0c
SHA1 ccc427ad28fa5f666e951962196c350bf5dc6105
SHA256 ecb29d8a3f147977f7db984adf14b96b9a938448e9340dc745ee134c931cd2da
SHA512 74c0873b2fddcfcfac428f8aed83d9d74741e9a3f20bd0a1ee97f71482f896d49c4bb53ce3e73e9b4d332140343f2b70c3d0e414a88d0dd307b793044b80eb12

C:\Program Files\Microsoft Office\root\Office16\1033\MSOUC_F_COL.HXK

MD5 3452757f8ccb4e4c576f023101444c7b
SHA1 a2863797bd0eda8edecf2664116d3f0a18e5434a
SHA256 5e997ca6439d75acbee406e9829c257a354c1d886a47ffb257c3abea5d7e44e5
SHA512 e13a4c9fa65c2f36d6dd01b5dd92d0e7f852dc5e2a884ca2cb21ff9dca166f39639fdffe1b1a2e22801c8ef52ac9d25720484fd04fd5e5256af465f65bc3a980

C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe.config

MD5 69001e0d5bfd2e032fa87be137490da6
SHA1 e7db10feff4491c029177dcc379b4d3064563a63
SHA256 3818c850523a1d04d1440fbe6c0fcd9ee6a2d6afe6323ad73855d083bc9bcf24
SHA512 6d0a911417981e7142446b1ff0fb82c555d0603fcc8a40ce8bb9c3fd4bc6edb9e83c27f9d650f6de29d0544f4e5148f881a35166c89e4e04077aeb55f03c95a3

C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\SIST02.XSL

MD5 50b544ae14d5df6b8fa50f14c4c17516
SHA1 7bafc641720e3c160e40c0e0f5bc99306e15b4ae
SHA256 dc83cd160ec96809cc72992e476ffe393f3fae81b198ff12099302722efcd6cc
SHA512 65fd51adbf8e0996f81dd69a5460feff4ac7a12411ea73c1480bef7ba252ee5bee7599f22758f0df42058b30c67afbfd0067cab0c87919cc443a7b74828fcbce

memory/2688-5341-0x00000000748F0000-0x0000000074EA1000-memory.dmp

C:\Program Files\Microsoft Office\root\Office16\PROOF\msgr8fr.dub

MD5 985bc02bae70a8105cdddbd6f1841173
SHA1 b6a694b61cad8648c7fa9402d7569b1a8b82d121
SHA256 dd61e8945b6056ac805e21d83654c606b2280539def8a23cc2f556056f853403
SHA512 f5d153326288f9551eb751965ebff2330eeb4cce02c4ee2e7f6e61d255d891087dba37e9cb8255ba1bf93603cd1c968b43fe9d21839d980fbbc182fc2d94e772

C:\Program Files\Microsoft Office\root\Office16\pkeyconfig-office.xrm-ms

MD5 36fce320c4eac19049aeece28fed47b6
SHA1 a9b78cc9bbfe91e0ead9e087203151aa0a07bf5e
SHA256 d2eff82784372199822038a0a8ae95bb0d05695e1937b14fa68a764c7793aa85
SHA512 d7e46f0bd161b3c5bcfbc78499c4ff95610b66b3e326181fbed0bfca344bab7108f1ce230d5627ddc1e738475592c18ae9e54e6bf565d80cba64a2e2dc3d741e

memory/4888-7314-0x0000000002CA0000-0x0000000002CD6000-memory.dmp

memory/4888-7446-0x0000000005460000-0x0000000005A8A000-memory.dmp

memory/4888-7805-0x0000000005280000-0x00000000052A2000-memory.dmp

memory/4888-7807-0x0000000005B00000-0x0000000005B66000-memory.dmp

memory/4888-7806-0x0000000005A90000-0x0000000005AF6000-memory.dmp

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Cartridges\Informix.xsl

MD5 e60f0025be5ad145670a22db6d9a19f8
SHA1 4e39459ae1d3e579389a9a07a64393b5d268fe0c
SHA256 7a46dce0e6b23e2766281663a473e86a731cc7f61a87d747c433583c87403cfa
SHA512 a0f2f38678ed5c59a738a413ed41a3ef1386172566061ea390d0b321be6910eb9ef424fda89a485c7db84284479f0efe7e74f468b9622713c01b3045bd4798bf

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Cartridges\msjet.xsl

MD5 99b5dfec7b9fc61cdd00b52a39b82a2c
SHA1 e4fbf3dc2c3a8ceae19ccde4be70ab8f17be5406
SHA256 5d320d73151add53b6f872b35ea534198e306ba15fd43021c5edd5a359c4476d
SHA512 5548d929fd7300d8cf8b00b12df8a4986dc9e698c55cd2d497301e680aee7dda043b9bbb2cb483bbabc09ee95d848d15bfc060dee0d7c13f5209e95aa796b125

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Cartridges\hive.xsl

MD5 2526aff547f3ce02da60ff1d0f0b7d7e
SHA1 862165c590ccdf8fc8f458d492bbdc3840698b45
SHA256 e062a3024a4fb8fb73396fa3d2b60588d3cfeaa3b375d6810ae5c011625e9708
SHA512 22980f8a30da0a0cfd17c731a74c0ddba7718735383d058d9819efa7e2982a588b0531bab6c1f5f9b5f7a508804f66a05e11e368c0b1a377cd9eb4fe62756bc7

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Cartridges\Sybase.xsl

MD5 23eddcf242d2ff1cd63f0eaf1c6b7864
SHA1 86c5c4fef5309b45cb09634af18030d74ed3cebb
SHA256 dead93b226892803e07ab303feae2fcb68726d94e26422624211d73ffb0558fb
SHA512 1acf5a0bcd9359d34c15f28f1ea4705dbc8ca33929ca6fc25eb2b1374434f75a262fa515aa18c38370a36fadd5449ddd8770d9dc2a410ade35d1ede05b9b3a99

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nhw0sfbk.yt4.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Cartridges\sql70.xsl

MD5 b78346d220973681e6439d47590e808d
SHA1 9209b5e87065b89f7652ef55ad1cd7a0ae2bdf60
SHA256 fc03615a9241442a607bde731bd46d19f6a0426fafd2de0f84e47acae2ab21c9
SHA512 b09e750f5186e2fd2c406356f0f56f01ef6ad63fb953be04183856ab06aeafd75a8688a27765c07ddce4ce181b16361488e1418d3fe3e49ae18a0ff84cd5d32e

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Cartridges\sql2000.xsl

MD5 a054992f988d4d5ec256aa2ebb6cd6e6
SHA1 6e6a60462ad45a9f9bf23248a950700ddb984fef
SHA256 4371ae1e58237c777ce1a048a46fbb87773a6452a8f432538a782f293e68c6ae
SHA512 95e61cde7946847de07b15218893f1bcc63eb86c1320099b878f7ff91ca577dea690c81f9753c2d0a9bbbbf58be700c41d7883af71762dd1a48140659376db6f

memory/4888-7934-0x0000000005C70000-0x0000000005FC7000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Files\66e705d09b33c_jack.exe

MD5 abdbcc23bd8f767e671bac6d2ff60335
SHA1 18ca867c0502b353e9aad63553efd4eb4e25723f
SHA256 45a7b861baac5f8234433fefd9dbdd0a5f288a18b72346b6b6917cf56882bf85
SHA512 67c00713e6d24d192c0f8e3e49fa146418faf72b2bb42c276ad560f08e39c68f4ab446c47c7e7710778aee9ca1f193ad65e061645b6bcec414844165b5e16bc7

memory/4888-8407-0x0000000006420000-0x000000000646C000-memory.dmp

C:\Program Files\VideoLAN\VLC\locale\da\LC_MESSAGES\vlc.mo

MD5 2120bc7353179f920970f3bbe33e6756
SHA1 872af05d0bbb21938faebfff23ef6a2f44ddbcdd
SHA256 0b8f0c7edd38cb30647eac2779651f7b759dbedca687a255b8a4f6b07ab8ee7f
SHA512 ef362b30b3a085983972a239274dc781be7496132265fe7dbee90553b3dc100430db1d77d9da1ce7ced62c005ade81083aafd985f5cda41cf15db0aba2167b61

memory/4888-8363-0x0000000006110000-0x000000000612E000-memory.dmp

memory/3516-8534-0x0000000000FD0000-0x00000000013E4000-memory.dmp

memory/4888-9838-0x00000000066E0000-0x0000000006714000-memory.dmp

memory/4888-9840-0x000000006F390000-0x000000006F3DC000-memory.dmp

memory/4888-9917-0x00000000070E0000-0x00000000070FE000-memory.dmp

memory/4888-9931-0x0000000007100000-0x00000000071A4000-memory.dmp

memory/4888-10031-0x0000000007B00000-0x000000000817A000-memory.dmp

memory/4888-10032-0x0000000007480000-0x000000000749A000-memory.dmp

memory/4888-10092-0x00000000074E0000-0x00000000074EA000-memory.dmp

memory/4888-10138-0x0000000007700000-0x0000000007796000-memory.dmp

memory/4888-10224-0x0000000007680000-0x0000000007691000-memory.dmp

memory/4888-10574-0x00000000076B0000-0x00000000076BE000-memory.dmp

memory/4888-10739-0x00000000076C0000-0x00000000076D5000-memory.dmp

memory/4888-10777-0x00000000077A0000-0x00000000077BA000-memory.dmp

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\aic_file_icons_retina_thumb.png

MD5 8603a661b7a7a7511000f0b7d40b49fd
SHA1 191e5ecb1db7cbdfaad62b3272a9ceb9cb4798d9
SHA256 e299a52dc15072d27f63c3f3ef7aabf7731bebe55da048de04eaab8205bc18e4
SHA512 ace816e0bb376d1c9c5b928ff809b31aa65561ec56745b4364b0e0950243ad00272d6388fa18e800edd91bf9f9eb29ce257629f7dc988826f40e4c3fbc9a023a

memory/4888-11280-0x00000000077C0000-0x00000000077C8000-memory.dmp

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\duplicate.svg

MD5 ad51efa9ab38efd6f64286583a99677b
SHA1 8d060b91903c55d52b8b3df5ada1638755478f99
SHA256 fd66706ac9c5ce3ec462131e554f925f27da59be3c01dea8b56437ed2974c24c
SHA512 01a6e2c8b84f48d2bb7f3c6dff97a9c2ff1766fbdfbf98170cb0c85bd5225475b651b9ada10a43e024e8d4681a07b056c9e5bae3a259461a0463aab7f1a312c8

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_closereview_18.svg

MD5 e2b45484c46bef4fa94ad9dc04020034
SHA1 5dccf58a0d9a81032628dd070905663155fb0d56
SHA256 e2f0cd6280b34381952f8e5b56ecfccf129bec31563f4a3d7f103991fe1f1b7f
SHA512 9f871332569a9ce3f182ee051b8b8d06fed123f47db55eb72e6b5f4e6b0411e7e9fd1b872c642cf080f99d74b8603dee89814926171f27f3850095a6d7e432a3

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_editpdf_18.svg

MD5 88c7a9e91a37350234650636d9dd8b29
SHA1 7fcfdb4ffc160b8a813d393789ca112ab1293c83
SHA256 5aa48f0d29a76bce0c76d7da2ac3f94d71ac2b8044ba4633064cff5e6c5b8d02
SHA512 57b5271850fa5538da9d54326e0a20724208b07c76fe54e8b641ca35ab4de4d290dbf4a6ce376bd6a064e2c53a3d0e867e78d54b251840a403355d9e059d6e1d

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_fillandsign_18.svg

MD5 ec2ad17b6784764ee32b1cdf875ffa5b
SHA1 0f4826ed1f9f883420cbb2beb16c2e88e1fa6b0c
SHA256 6b93fa720839bed98bf7a34851a3b4d4f21ff78906621320171395f512d166f5
SHA512 4031180d86fcfbc0d26138f5f6a125606eac24e25f8c632e9f405bdc08f645a9bb7f456ded58860c82baa4fc9bf3ac167281cc3301d41191cac71be41d98cea9

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_nextarrow_default.svg.ragnar_40B57505

MD5 047a2351945f9510929eb11da1cedd40
SHA1 09cfb5e76ca4be9238e86ef1d4367ab1b798f8e0
SHA256 0d28c0812777d7268951b97dc732c5e5bb5cb7410fe15c7696f45fa3cf3f5127
SHA512 4b1fb98a9f242eab77e78518e7fce25eda6eb2c3364b7cdeaed0fe3cad43a5706c96d452aec243754ecfe29854bacbdbecdcdf203351c47b47a5289ad63a9cea

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_newfolder-default.svg

MD5 32db5f850f36364d9577e158a9c77ef1
SHA1 b4b97690f9a563c7c546ee83914eed83fbf490fa
SHA256 f024c97995141c1c11e0cd5cd22653a2ae6b16908d0f2f5d0368724d951e2a60
SHA512 346d4dea827370507a2c8e14e6eeea55225aae7f76571a96f981c1d712542bb7fa2497e569405a985801172de0fc4f62b0a52ed4cab0a8aa07a03e10e08f9c77

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_move_18.svg

MD5 f663759602cf9d15334bb4d7e3f4a56d
SHA1 2fa74eace584e1dbeba129d912d0bb57aec053ce
SHA256 ff9495beec9ae819d28cbfbb017ac8037c18ca4839b4d339d64ff61b4271d4bb
SHA512 2ed211d13d9790405caf953c7f274c84cb607ce548168fa3ff600c8033bfe886fbade6bb3431abb6d593c1485aa6d9d124c704e95196135a3422ee3ffcd73b69

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_export_18.svg

MD5 ab4fbd19090aedcdd103aa95be248b87
SHA1 26141d926ec7948fa4ad713f4a7111d3b0ebfa56
SHA256 f7e98f1783db964790ae78ad283f47e30ac9afc144b99db7792f7e118d91af92
SHA512 55de892d04178079f29e163a5b1b8cb5078e607246a058c63139f5137073bce504e8ba36a6fe712f02cdd6b683c859b83b13fa10611a8838fdb37e3f0b2fe3e2

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_comment_18.svg

MD5 9793bbff839cfdeaa10659bb345563f0
SHA1 473b8b634390309dac0848b23fb8caaf3238edda
SHA256 4636cf0d7676194ae6ba3b2e69f2295568a4e77539ec1e38622b701231577283
SHA512 8a38cca586c162ac49fc80d4b99c093175f302f61a1e6f10c4fcddfdb8ac57a381e133bf390fc8ca3fb5368bb7c2889f0ad56aba749ee2fc8612fbbf13da71c8

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_backarrow_default.svg

MD5 1d02a48b54becea95ba36bced1211c26
SHA1 0dcd053d8192dbdca84a739f9aa1276839c83477
SHA256 53db5cd24575300cbe98dd662ec25d327fdad216a1dd6ed312b176b6931172be
SHA512 c8974e9d0d0eeb8fae8cea16d56781d1978bb476b48aa780db01bfc37b0a06b1af8b23499a3338d29e966c934aa3c5e93e0274340f1008b0d18ca1d8070d4896

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions2x.png

MD5 c86d10110ac5c0933c9f67cdeb023f63
SHA1 c8bd1dcb129780022fac8ff79313cf0b5a8652e1
SHA256 5a89f6fac8b150fc11633e4b350346031690613b4e366da3d908e49863cc3c8d
SHA512 c4226666138ff9321240d399dccd4b4ee8132d8718cdae83ff8febb4a1470f75f1ecb615cbf53aa04eb7776514519e30e1373c04ed6fe51c827dcde162f07d38

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\selection-actions.png

MD5 bb71ed6f8239070f113d9b700f812ca8
SHA1 49d80c81ad737601266dd23c5af9c2f7c8c9865c
SHA256 b51f6046d0d47b750d382dcd99353849733ae561f04f7c0823e50f1a25d64d76
SHA512 c1edbba9ae8ac9fbc5eba05fc37e8e2b788e91dd65577a8b4dd3e07b56cc8a7dbd040db3c20dc5cfdaa3c1344e2f87a1daae697826ea87d7daefa552c912b64c

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\remove.svg

MD5 82c046677e521867da78c71c8df37698
SHA1 a7f25c59d321934eeb30c61a105b9898946c35f5
SHA256 9136c1de862cab3bfd5b27e58b91552e403929dbc8a5017309ee75ae2e55d7ac
SHA512 05d61ea0d7fc34fd2da37ec0efe973f13d06fe4af7fe54b69e60857cbce583882e3f647483d517f9c363df113891654f1eab4fb68bb1dfb8139840117f2ff670

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_organize_18.svg

MD5 10eea30256cb27eb2d6c4d3dab8fbb86
SHA1 5470d055b0ed8abb08b6c971a1e7460b4f0bd4d7
SHA256 fe646df37c3fd524665674b30cc5fb80238e9abcf93d42686db17164105cdb49
SHA512 ebb1603a8569590ed226da8c9f63e33006b0b6912df4494450d6948972a79f708ec4b6ff1ee6df0111fe30bf351baee5a8fcd401854582f10a66fe6dffc45d49

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_share_18.svg

MD5 6c675585d5046312425481d031246374
SHA1 206489c5014b4c18d6079ec12b69dace39bd2fd0
SHA256 97268c10e6fdc583697b2fb80aebee96858400f0db74941991462b9253aea0ea
SHA512 54f246e88baec4380f82b5903403ea05ccc95e919b1ac5cab28682b8aa604c421613a7f81db4d84d210e67fa990462d163c29a34bf6bc1757d985f25d7b09443

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_sendforsignature_18.svg

MD5 487137ab56ad9da07e64978b91bc551b
SHA1 5da5cf044e63ae01cbdf279a6bb83a8d7d40ddb5
SHA256 80db44836027dfb66828b5c6175f2db98ff5aa4495080499342ad712e8729212
SHA512 0a293769f6320a0d1fa661ecc8f58d3be95cea9d93102034148eef8645968fefe3b89300aac2d1babaea7313453b49cb9aceba6e95bb052f04f80e8af7544c22

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_rename_18.svg

MD5 4208819bc6ea06ef832986806068cf0f
SHA1 cfb8c795c029dac9ed3c969a1b4003e25efbc7b7
SHA256 69a0de157b18d9ba593d88dab536742d1cdadd9a46d6b77f9cd7ae2522cdcc96
SHA512 b42448aa324a44f053bf2b184e6f779177fba2194cadf4f99bb333ac7534867c112090f6fe203c04efd07bd5639472dc24e6e313177aaa229f0aee065ade418e

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\root\ui-strings.js

MD5 321fc5362ebc1912b1cfc61789becdc9
SHA1 9b607429a13eab5db7b9b3d6371e913077c71ea6
SHA256 3e52c59aab98861bad03dc9e9625dc526243ef2d681603f61eee36ead7af24af
SHA512 4e921278d9af2d4b156396ab0fc73cd03a7daafe61d2c37e356f0344a326142f65d5e05a114cc85541eea6cf3a09e8a37a0039bf29405fe2e86467b16994a12b

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\root\ui-strings.js

MD5 352111d2ab296f9920b30ec5f28bbc8a
SHA1 9f86bd051dcbdcd12b691967ba03bb18458d4e60
SHA256 9400d55d8b22099a565ede7613dc0d71fe5995cec68526c02bfb3f70c4262560
SHA512 f3c5fa9c49d67c69fd7140e6d0ffb98e056c2c51563e1f05a875ad4f9e7e3736f924111dea1957aafefb8a2abcbba2c70c43a9bafd962f01b89e6c69fe52d573

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\root\ui-strings.js

MD5 dfb8b69924d2ceeb869b31f54bf44252
SHA1 056578292c1ab80a7832bba14413871e3d3bfea9
SHA256 e7828f8e932fee0654ba0d4089396b8dc2fb1d2ba7231d4bc484fb2729d33db6
SHA512 2251b2dfb3ccdff89c0f3a42ef7399ca8ac242ee47a38dd78f65dc799073e56434b4a86ef9bfd32cfb828fd10e192662288a5a261cff3a75c5351924d09a5e6e

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\root\ui-strings.js

MD5 2c4c777dfe3967efb48d6759e0b677d9
SHA1 e3eeec2d3827878321ee0548340a90004b528b2a
SHA256 60603e74a1eeb60e862bace3bdf4e2b1cb54a46c36d0e4be99dfbe5ace94d200
SHA512 8048e68e03bba5269e870f74c47f4e872901e11b3318ff24f3fe3965b4f7b39671d5fe585b6ca116d3b1b82fb2377d72d8059bdb7fc7158024e2ee63a0817007

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\he-il\ui-strings.js

MD5 bb7a6f7bed4a5a970a2e102146223115
SHA1 e747209ae8386e48d875e9d8f46bf283668d2651
SHA256 32bf63c839282f3edffd09b3ca280dc34e030c76d92167eddc14aa9c9dca1a84
SHA512 b9ade84a81d994720e853a27a805858f43d64576d59527fddadf49c334db36d266ad6435523fcae7b2a228b4497b9394ed10c76757e3c334103d19d9d27078a3

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\root\ui-strings.js

MD5 f804e189971b45b5d58a9bafe126c5c1
SHA1 d588ae3efa9552dc1e3f00f56953933fbdd8ad68
SHA256 3c9b8d4d93d1de94ac35b51cf092a286441f1eeff86bad0cb86bb3c51e4ee3ea
SHA512 1c932fd1c9a64d074679ffe65b19e0e6392fb1f28da51fe393e9815d9931e0aad18633659733129040e607e9e07385ec25a85062d017e7bc7153839b300a818a

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\convertpdf-tool-view.js

MD5 ff360d6871c64c56291685fdbbe471fb
SHA1 de0502b96c4bf3abf5573633fb31de79573b51ee
SHA256 41b1c4dc3d2b3a0fdcef2146b6e90ed24684d27122ef87b63e33d48b92ad2c4b
SHA512 6eb5605dc1821a83c47682a193ad5ac3248f99d351db8423c6fd743570697c907a020ecaed0360cbe2eb8fac857e1b466b6be292d3d5c152fafb411832d6b41e

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\convertpdf-selector.js

MD5 59ea524667cdafaf48e668db55c429ed
SHA1 577200a957fed3947766ee62901b9c8449c92c08
SHA256 6ee4c5928798d48a1038b30e564ed5427485a286911fd3b1a266545b0bcf78f5
SHA512 c998a8b25fe420e0b54bc8848ef2ba7cc70e95b502940445298b9b53c5512608c5094ea9e72d2c887a89eda198e40936e0c51a8a29096ff766183ca1303a7a4e

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\root\ui-strings.js.ragnar_40B57505

MD5 c99c29339c62a43e62522887069f513d
SHA1 77501198f34cd2a9c971bb5ab99043c6d4100a7b
SHA256 f7bad3bedfa00f69a8fd4ac0bc252b3ccfa979631fb8df5694a865e8565d425e
SHA512 ed543ebd52cdb82b0c48c4d5576638134cb0da3dd7acf05aed63ba1f87511ed71dd37675ba0da45eaf9db7b2c3912e85ce7373b1cd88a30d2f3bb00bc40448fa

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon.png

MD5 98675cdba2c9f56b2751de6bf0496e01
SHA1 48eccfd4e40a988160504f085575a65deff7c0b2
SHA256 416d10ae59aa36b33d3fade370dabecdef3f8cd5212a27e550ca7f28da316e6b
SHA512 3bad08f73e8eb8c30082912a8aedc907e0faae2c7806d5a97443e453239c6f31d775b42dc71d6338b62aec9c691fbf9faaf3369958e026fe7737b2cf3cb4c319

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover_2x.png

MD5 e609ba4cca848608db4a77b5ef528a7f
SHA1 95d9b6eba9c558750143e8501b3ab289a6bf7daf
SHA256 9895389c02515550fcaa55ec59bdced958d48ec31933ea4a7fab12f74e25d55c
SHA512 5a15adafa60cb1c41133bac19c85e894e5dbc81545fb26be9d28431970669534c6e7e14149e3369fa5be559e7409cf0b3859b8ed898d03e29a46a9c143f7e8ae

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover.png

MD5 809bb24d5c559097ebb3f1afd58dd268
SHA1 e666dd65af324a8946e14d017d103774b2084d0f
SHA256 dd79f54a659aee75cbaa74badf9fb91af16f26d2053ed1a71b2fedde78f75c2a
SHA512 c5cc85a44e6b3736dbe42e68986c33cb33cbf51448639025cb4d55fcf7feec5852af04803dcc90c9a2d42362de1ab828d1cf560d2386401574c14ca04cecf1cd

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_2x.png

MD5 25dcd3675aeb099f6c614efa49a3d6d6
SHA1 66e3b3e4590d503678f3b2620b521d1898408f05
SHA256 61d8773ba798ccc7c58a6610363153d6f0d5a4f081a434b4adb8a3c2526d849b
SHA512 730f935cd8b5ca0c5dd37ec225556d68fb1f1e8cde1eac2b476588d77034766bcacd62ecc3063b21d5ab91fe61ec0dab495475265c5b18c25f9c8f5913bd22ab

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png

MD5 85f163616780da8ce38ea26b4d175e8b
SHA1 7fd1802fd11892ac03ef2949b1bce9d2e54630b2
SHA256 39995d3eec0bf68403dd29424e5a6d1096736a726ca01ece6369d9c6989bd657
SHA512 b23dec19726c78c480a7d77d4e2cc18550ee8b1d4f8d004d6a0e1918bde5acaed0f0cc171df3fb2e400b92d441eb358b0758fb80728fd75325f534074ffbb7f3

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\example_icons.png

MD5 8aacc62c6d242bd28e10d876647c9a4b
SHA1 c124e6fbce7a44577bdc88253b39db4249265d1f
SHA256 d41daf844bf3abf4f3048c6ba87bb087d92a5fa5522d8625727e348e6babd8a2
SHA512 4951c7862e0c0519a0f5fd1ebb3b095709fc9c48df252bde4302454e6a2993eacdae8bcc561e50615d97f5e2ddce0233699b6d6cc7b3352346e371bc107b8976

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover_2x.png

MD5 fcf069ff0837737dfee5e48aae3dafea
SHA1 99d8f91c0c8f5d13e1e58232ad55254562fa952c
SHA256 066410c40d52e49022f3ce3a3c162be6e98835aad013d6dcaf9df20bf3180a75
SHA512 31fc31ccf342cf35499de0dfbaca95cc235024a6fbeba3e2f5f92735cab9930ed54e75f93735ed35f11e58946e12e3a845279532e8d6f6143ecbd050d95dd490

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png

MD5 c7eb272281c82f2162988bdb082e0799
SHA1 4ff88644bf8fd5db60d57e2d2013b5ab5dfb81e6
SHA256 b43f5ee1b17e880d3c16092f24bf9e513367a24bb23e026a0e9601afb375984d
SHA512 0d87eb184fd8d8f95572a2b679058e6a59f073dc3a0832d7887fdab79aaa54ba19d99a2a0790091a39c90d0793fa14e8307ecd082d83ee49b230184c58b7b500

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\rhp_world_icon.png

MD5 ad56c2a16b2a059a3c5c8ec81dd2e2df
SHA1 90aab8a7cf97be983e3cb8bc8de27e5e47d7cef8
SHA256 03f566081b43f0b66b3126c81546c0f47fd3ad3d2756a651a287ba70ea528f2b
SHA512 aa0d40969f4c497199697fc9115012df4b59513315e525a683fd8fc068a2c074f6c587fd7f6cc8cc31c44f72fa76929f33891416f51864b3a5194a3d91720c41

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\themes\dark\example_icons2x.png

MD5 949e55e44e0aa76ac64cab73716209c1
SHA1 7e47b877bc7bcf2dab698dd1bcefd2c231ed191f
SHA256 95c63a4daf7e4fa18aa99ab6e5a4b888850941a758265a89bd8442e28a660b17
SHA512 21a9d1ad76eeac9e5aab2f2b817138c5b1b4ca7a0844e58cc9f7c2ce0e3e6d5102e36940127554d50dc00154ce9b945b2958e8135924ed98eb2ac115f14ac438

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\root\ui-strings.js

MD5 a734da95fc3ca6207a890cfe3b1e3e4a
SHA1 c5ba98005fec46b40c11c96e71210d604baab82b
SHA256 a3e83628d62f6ab13581f807fece9611e169487f87d1b25fe4c61e4d4eabb8d4
SHA512 bef98cafed020c25e0f7c3d70f26f4884e8ccfbc2736303589a358bc6acf9305df3a85d244454503039b930b88ef007fd8556073ef104a142a1e4c7519865790

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fr-ma\ui-strings.js

MD5 1218c72f43cf7ef15ca40be058bbb078
SHA1 7be6f322168b7d6c96f6fed16f160b2d2360862f
SHA256 b2b9e46efab7ae6c4edc83d41f6713cba67f314e5ed844cdbf4fcb0f196a5844
SHA512 cdbbf31d6654182b304ff8f01ac07e3b6f56e53219615367571166899a0f18c77515eb777d883c439bb66bef254f6b67dc9779dd75d952a74934905d3dae8a90

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\root\ui-strings.js

MD5 a34aaeb289e9a6e0c34b8fa23a3918ad
SHA1 cb6032b9451a51f0f4ae08dd073e81269bf91ab9
SHA256 f36caa7684488a11da46c64bbbad4ad97c15070f8bfa79cee54297308d5b49b7
SHA512 b979f04f7e5ea48beba01a5fa9700b47c807ef980504fe707acb37a19f98032802f4d258d5428452aadc3eba0cb19b8b4df2933d1b2997408d5e389144086f29

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\images\s_checkbox_selected_18.svg

MD5 d76c7c5ee8b6193cf93af52095edcb47
SHA1 cfe26c0c259c63d95ff486abade1f5b2723925ed
SHA256 43085daef0f443131b3b9bf83e84d817100e87e0943e5e38376160ccc6dee871
SHA512 4bc0eded1c17705cfcb5e673ad2dc941e3556cee313720cad99c54c1d25dbcc434b472c53aeaae9e1a6aecec51c214cbc416691bc11fa36c6794903848b76119

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\images\themes\dark\s_checkbox_unselected_18.svg

MD5 6782c28966c5bf0020379996802e59f1
SHA1 f91fd694bddbe26bb0c670f70fa187c943c53424
SHA256 f9a0025febd5ca73bad07b0f2852157adb4b2bcc746b3c9c1136a55b68e6ad5a
SHA512 86130087ab90ad80235fb9e1b0efdf68a42b36c7be91c92ae095a4920c9ee63fdd9df22d8893bd613153eff3ea722aa11f4829b8b845e3b862381dfae9e410aa

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\root\ui-strings.js

MD5 56bfac790521dbef72a0893220259d66
SHA1 eb3cff44d8ed1f7a15d69eba99ae237140cba776
SHA256 097a2f781ad214d862020d44a4850505fc37a675f1038ebf915722bff33bc99d
SHA512 a1b7d4bf7e40c803f761b6ae55151f711f42988d6e110592c475136c2708a29f0856d6633eab94ea28079aba7c61e1a396f5d0dbc63e4fc159acca5d4414fca3

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\fr-ma\ui-strings.js

MD5 bf0233dc95b3f49ed4e609ec43431f42
SHA1 d4fc83d9f18b11406bdbce78eaaa76a48ed31380
SHA256 0254b2051238d82c35c0b6d871facf7e05e95e3136ce73b2c0391e6ce637e8aa
SHA512 f5c957e00973b247c37c1ee278bdf1ca64180b348e6af4a0dad4fd2704720c6029697b68b46f1863df954bcc2c87f44da3924ffe75a98661c60668d71308cab2

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\fr-ma\ui-strings.js

MD5 b22d0a9d79a6f29780e429d6124ca4e4
SHA1 5e61871d8fd700cbd1c44d5b0fd6d590e1a90a7d
SHA256 a0fe91c2598a50537b393f42c7258c23f0b33df058d3437ed64114c34adbd400
SHA512 f9099bdedf73cf667d02628ae3c3ce846bd76891cc117ffc2c65f59df2dbba75f3ca0a2dd125e0f10e20867d87ee76af47111d818facdf1b139ec3d5b796be17

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\themes\dark\new_icons_retina.png

MD5 5b99da4a5d2003acf98304035ac029cd
SHA1 e0660b8738bdb8d84d435842d176ab048f1c4d68
SHA256 9b7ad44eb2758a87dd670e010441fd80e5690786b163cb5e428a9630c915adb7
SHA512 91f0d1ab10f5752f4c185840098a8c671b749ac21060ba2c5b6d9b5742f4a20407fc0a030714e1eb0dc9bca9a1c8a5461840c7f0e8e1c848f72c695af788e7a3

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\themes\dark\new_icons.png

MD5 53d3eb56803172c2ac597666ff7481b2
SHA1 2e85b49eedbc91c5e7ff2482ffb517d0f1540257
SHA256 f3ddbc1b751ef063845b68b2b9353845b87ed7d3799ebe3a9ffc1b99c11a0f22
SHA512 ba936341ffd45f0d1acf91b3b0ebb1eb3a3cd516bf395636662442f232afa1a8884163808372e0ee8b6735eca638c0002b18e99044cdd79dafc9c57556f2211f

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\themes\dark\icons_retina.png

MD5 7e53f40ef2c0993f966b9787a718395e
SHA1 02618b9924919df75e9ddaed7833c3eabe384d22
SHA256 cceb1d14063ed680cf5563338ab4dd008165485cc3d0afbdebb5440439958351
SHA512 aeff19c35af3305d556a15fb8447d579c9282e2eaaa27177a3092944edc5af2a8b7269a17443d72c7e95031a1e0668e89194b95e439083e0a472dc9e84b5569b

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\themes\dark\icons_ie8.gif

MD5 335766ae2d7d552c9bcae0984c2d3d15
SHA1 51746709c3154b63a14c8b109f6a1392f4812920
SHA256 31b7e64d43b1f139e5e32b950530a29097c9995ed1574b3f6a2dc1b685ce5f41
SHA512 b40f2a63299d05fd52c3b1d6c398edf9ae06fa883f2e69f8e3e9577f49d8de03d5145b7f63e19ca93988fb695cba64bd4e99d8fa26cf05770892dc190e99a0d7

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\themes\dark\icons.png

MD5 a22e3ee34e8119308c40e06a7eaed102
SHA1 4a95839e199dc391f04d87f1ab23b32e85e5ccc8
SHA256 5a8e698df704ba3f6efe421cceb3ae6b6aef032ccdc7df3c1ca136722db7117e
SHA512 319d45fd6eddd2508d8012635aeafffb46f64df137431ee8eaf083d6d97290d52ac53287a424f9e4eaae52cddaad2c379b024be5580c30510ef0e38a046ee66b

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\bg_patterns_header.png.ragnar_40B57505

MD5 f6d9a1e0f9c94f5d2c61bce5a49baf9f
SHA1 30dbb3e84a859eec521b308422bc16a3332ed796
SHA256 6eddb94ffce36b4cb43ec20934f31a7378ff1982d5cb451a3d56da945dcbd27b
SHA512 a5e2e47e8b9c381956dc729f41c0dbd55554b60e2aff382853adc20d866bc811e6514771340a03c04d59779878cc00ee985b425e93b927eb9cba6326b26fb869

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\illustrations_retina.png

MD5 ee11d7fc7fd94eaba464d8cdd9e0efb4
SHA1 0e26ec0efa7b49328d4b7f8186e7e8d9a562e3ac
SHA256 b9d5366a1a0d9b70b2fae71f1f784244478853c3de55f8e2f27495f38cd90079
SHA512 ec769f7fb4de877c4198f6238e98d7a54fc1f6aa8d2c16cd2f30910256427b664a1b27c97c0d7899a3c652856ad87d963e7eb8eff800ca8a1c52cb6f2b0983d1

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\illustrations.png

MD5 7ef186b957b88d08a21a82e601a048b7
SHA1 810fdf6174cae3b3f6c2c4c201f5a9e5ff49d950
SHA256 543d73639e0f2db5324583a528f55aa58578b708d47cb979650dc45ae550d93d
SHA512 6f25afd960f5e3217fa0acd8c2d26eb1fe45180cd6e488eb4bb78bb1bf09fc9bf5b47b7fd6fbec9a4bf2cd6466a01a637fcf9cfa9fcd843b4b6d2b15f5593d29

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\bg_pattern_RHP.png

MD5 4c60889ffe9101e7c0dcc31489ccd611
SHA1 f2556e26e2532793b224bb8c24ce4c937283824a
SHA256 5090101fdc05a5167bde5459916d649b765218e161b249cec9c37ca77c7956f4
SHA512 e56f3b0fba7cff51af766077bb66250ba675d11a051480c06bf1ad607e3141da173e43bb3f5f87363bc4e273d3f9503a548480cba0766480ade8f95ae3e230b2

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\root\ui-strings.js

MD5 5fcd4db7b9f08a8cd184c3fee3135584
SHA1 7aa5934a2b0dceadaad52ed9632fdc4aafaa6332
SHA256 828261392b7627bbef2ac07b93ceab961e9ddfbd2c6f63458bb3971f4b3ba9c1
SHA512 c4fa328c401e98eb8d6a0d5415f7af88bb79ea7af719163f0b7c8b5e920832180c427c934901b0bd5f43338f3e231ddace990e9ef7b38ff027eb929833b63207

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\sl-sl\ui-strings.js

MD5 84f4554735276c2b5d6b9aa7395c636f
SHA1 0ada08f3c03977689b1033abe398fd4b1437795c
SHA256 d90225a8f91a812fa281af5f486e2c2d50539d8e14b3c2822b45587fb8d6aebf
SHA512 7f33b795ed548677d3c76e432a7d22c1a81d0247444a2b75a489a4f2934d3612a2eb57f90345ecc322e5ec6b74a1fff396f8fdc7dea1a0cfc395a1a7d31c79d2

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\en-gb\ui-strings.js

MD5 6dd7619a82b941b2696554b3f9ec8069
SHA1 e4109ed436eb0b069ea657e2f09aee450691e6dc
SHA256 e7bbdf987f91971afd28c19c1bdcddbdd090fbadfb2df68ad4751d88d1da9a4b
SHA512 ffadd46a4d127a10c0ea9cb1b1a6a37c87de976a425425862620023f42c92e281d085d13a89c91a560084a7648a12aacd90d80765bb6197271cc12a6cb06897d

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\root\ui-strings.js

MD5 4789dbb22e2944ac3296fe1be86b96c8
SHA1 24463adab4154424a8ec904f241253134d26f30e
SHA256 105f69dcf1f73a32bf1d79d22e7856b76884fd345c512f61446d6f50c2fbb8a8
SHA512 1f027c5e3a1cd4141e6ec14660c7084462ca0bf4650eea4d539ac26386a7ecbf6ed165ec87baaeba006f19a5cdfdf7ec3bebc6c4c7c3e52935c69c0c619b7d03

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\css\main-selector.css

MD5 ff52c5b62bd4a46ce9ccf1763f0ef03f
SHA1 d7e30a6576e375c27a6dd7fcd351804350f95052
SHA256 30093cdd7ed0ec90f25933182ab3b7c5447ac5167330d638e5c3c216aec3196d
SHA512 5f7943c47fcc4f3dd064bb16ef22be107a2778d4ff20c5983bd38532aba7991505a1fa13970dc897fd4afc30c9f190b97c48af804ea32d01192da6178ce5a0fc

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\ui-strings.js

MD5 ac6c42d12e3fedf686d5dd3575568374
SHA1 932311b3d8db11ae5c83d6fd5ff55f5e2a3b9b9f
SHA256 c7c32fa88a72e4fdb408fb56f6787dfece90b4362b6b26b8b144888051f20259
SHA512 41d42177c5dc22023c80df60834d7f83f77e8f0ac8ff62897473d9cd0d96a93e8371795db4cd6b5d12a0faf9b67ac89df28035a253beea283556c5d624d5520e

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\root\ui-strings.js

MD5 61de8b85766baee95657c29a82a83e09
SHA1 085da36055ea7cf0aced5d53097fe4c62af43f3d
SHA256 9168fc294588a202d3f2923725e39a560ff840439c332a6552fc471ab88f3508
SHA512 45bda35b6d0755c8716945aa1091a8b43202e6ce60532c065ba3082dcf72b987f70ebee1e6eac6c27385d22cf7fef7d0b9a7820839575f27b1e5d53db7bce75e

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ui-strings.js

MD5 d2294cb45988e87d5bb9c3280bebc05d
SHA1 6a7364505a67cf0c6665e9e90e2616ac75d90e91
SHA256 4c6f02502161fd299805d0a55b4c2825cfe02cdeb280109a86e3acb677dfcb98
SHA512 130e21b346ef0bee271656c72a22dbf7d72c87e6d0efa09dce5e713e275a392f0932f0a07546363d8f1f09204e86fea76d39456f6bb3b694591e25db915468eb

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\root\ui-strings.js

MD5 7dc8e2467ddb9fcee741a65a9ba5c42e
SHA1 d6bd2e645ede0f980af5f874970eea9205760db3
SHA256 50b7516a2fbee7482c2c55a5a23d9571075f67fb0f672d4d9b2fd12242f4d376
SHA512 55f9bc8559c34fdfafed4337eb82275a7568bde5835dd6cb9e18a389d44062ac3013f8823290321619325092c6311ce1b0d8be96ab4668917e30663a4f8e8dba

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\root\ui-strings.js

MD5 da6ef25fa12870eba659bfd92ea2d7c9
SHA1 a40d61dfa06b0e58d88553c85d961ade40c77d21
SHA256 23d2b66d8a1535b2f78495086f1d1b6c8d7263d354bd2f546c7a509ebecbf6d0
SHA512 8fc7eac574ba079442c3ebb587da32ac0bcda396f08587ba8e0a3a8f878a62a7d35bebf245d6e31f946b0f0f5632b8ddb793d4ba8cf491e7446f16946c4c70f2

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\en_get.svg

MD5 5f3a41a2f266c140ff9feebfd015b17b
SHA1 1981c2fd4ba2b3c44274808e0e57d2ab931cac08
SHA256 89d7d383dc9bd83af7ca11e305ef704968d1913fd99167e0712d03afe012b530
SHA512 2bc9ad7190c4ff1ab089ffebac8d6e5c8c285480686209c2c21b4d17797c14c81c585727e6d026792c631343e7488663ab5909ce59fdf6267ce3d98efe150e98

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\root\ui-strings.js

MD5 b962dc556c1259c02a41fb57a48c9129
SHA1 36e0d6bd9261cca430e13b0abcc815c6cfcc99f5
SHA256 881bdfb9ffa69aef90db9ca6415683026bafbc610b6f05a9182276bdd1848ab8
SHA512 600d2e7247f1e3e40ee1b7a8ea8ed83ed60da1bec9cf8885db530053d8cb08f88323c1b392c256f73f99533e781bb9ff7c9a34753912972ee4d853ed33acf39d

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\root\ui-strings.js

MD5 4e565b0c39faba3307c209544df0a761
SHA1 5622c8cafab549d24c40b21da69154779c7b8ce6
SHA256 a9b50685864907b32966d888b729b75a85af5f8e9ddf9c7c0d0450d970ad9fef
SHA512 520dc95b9d7f1a6e75577f28380882f32faecf9afb5ad1c5e631caa672a4a657c6dfd233e6ddbf0c463e46c80e36890b9e27d6c948a1262e040fd6dafd1ecadf

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\root\ui-strings.js

MD5 9f3fd07045f89f820bd21e381d86f704
SHA1 74b2ebe5eb4a99e106469e90e067310b86bf52e3
SHA256 40a180d13e183acca23392709fe964f2b1584981470c8856f160eb315fb3e777
SHA512 b0b662822f0892cbb55bfdd1d6afa66aabdf893bf5551bddb94995a0362c74d38b56cd5dc6cb0648e276cadaf55d33c3a6903a4be91a87864be7c4637aebc08b

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\css\main-selector.css

MD5 8847ec15ae8b00a6f87480d2ea3d778a
SHA1 cd3ae4f27bb73445cbde05f6637d21d4a6e2d6a6
SHA256 35144e9fbdd33547f4e5a97cc897addafa4906eb0081165105e77e865587e261
SHA512 9969954de828ddf8560a66547570fc1909ab97d77ac5a95d545e1901f6ec38042dadc7fb6b85c46806d350ac598533c6cebaea19d134e48f66c1fcbb4bf8a361

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_cs_135x40.svg

MD5 d9ef71e863b1da545b0367b39455b89f
SHA1 29e248db609f3d47c893b95f79cc2638c4eed46e
SHA256 b25cd2b0b37cbe28e73da6ff9c8a1966b65687c61de9cb7ce9360ee42898fb45
SHA512 2f07fb5a751ca70c2a4428895c547ae1dfe2aa844512f4a7ba91e42e7ad07661a2b43b1848bb18e8f9cf240ca87e69337993ad9fa2df7b0090c03d3e154c9249

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_da_135x40.svg

MD5 73fc1abe27a2f04bbbbd6bf5c5f9a55d
SHA1 501bfdbdc08ca9593a429987658c764095b68435
SHA256 b4c99b696421bfd4d1535e299c5ddbcce954e11d4f8858d73eeab6d9f4911b8c
SHA512 5cd0cc033b3c7a7f70dec83fadba3eb35feb7a6c0ed3a564da723f3d891457f68af63a159f379d9bf224f7fddf187ec3d7904ac1942f5780632f3a4ac81d7e96

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_de_135x40.svg

MD5 ab868fb26b9758a44fd433b6b82c58cf
SHA1 de2208c9ff09f2f60bd3aa8a07d4145bfc91f511
SHA256 e3b60645e6e07231496d06cea504ec65d0dc89dca1f50da5b16b696e3e7c09a1
SHA512 d1f036249b996a844cb5f74d8868d476e39dce2341a3c816ba208c020f4916ff8237707542abf506390dd81b090b1f2eb0e36fde28d191e20b2fe12b049c5d0f

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_es_135x40.svg

MD5 c2c5c1d73afbda7e59d53ef48da23ea4
SHA1 8b22c2e0bccb01344b996aabbde12ab88cd509bb
SHA256 3d9b67843e85aec6f01282d748342542cb936757ca011b9e21a919572032fc52
SHA512 45d9f831a831ffbc154744a6ef8baa1048db17d7a4c5d4429b78261f6495f00ef1633f676d3cc672d525d4ca76d44d7c7439462c4804d04f093f940878af898e

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_fi_135x40.svg

MD5 ec304be68531f2f9972b7779b6a44ee1
SHA1 5e6361ea1da1fe5236bcf1f47739ff9380586a78
SHA256 171f60303e056fe5f6d5c6fd6f321fd97a70488b1069a161349939c4c62b7e5d
SHA512 5fa9cc57d3883904bed9eec17e1352d653b69440312147e595470d97771da51bea547c16ca50a7cac828a1a2677647f80986d5a6f30955231cb4c5e63cc2ca9c

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_fr_135x40.svg

MD5 92e0aaefc385d5bded8895dc84b79f6a
SHA1 c720c48af8af73d6753976fe43136f038dd94a19
SHA256 4e76d0b4f8c049648d04cc1af90edb0dd82e6d8ea62aa9a320bca312d1829920
SHA512 f49758770cd30a97177fd2feccbf18aba9058e6de971c87f28621b26b4ccaf5f7724b558a48f3a008be310189042146e71eac0547104c9be57d673466431014a

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_it_135x40.svg

MD5 81333b43aba399a52774d4e71b14ff50
SHA1 01f3359f39bd911c21472093562fbb983b407ae7
SHA256 7d93eab9fe8e28a4568cc01ae217a47b841d97476d4c22bc8eb0a791b2349a8d
SHA512 f94d43c543374d8938a67738cab2da00c7f177a981d8946111d4664527700a63911bc606d0cf52bf06eb086d3cab88b1eb05eb7196e7af4006ff1722bdb92f10

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_zh_cn_135x40.svg

MD5 d0cc08909b4b3e994ff3e950e29d835a
SHA1 6edbbe1d24aae1dcfea2b441114758407b7f72df
SHA256 529a38165363e7442d1846400f309cf58d7e0e5bf1fb368535b7f895c1ff7e18
SHA512 64b0afae3aacb202ef0d4245b4156364ff8accd674639eb5e1163d5af3d4ee6a565cf151c083fbec8ca0ade6d7a76d5061c79bd7f224dbb1eec9fc42c0adab53

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_tr_135x40.svg

MD5 5ab13955539bef27153d05df2f6aa5bb
SHA1 9ab0325ca807f50eb6938ed2d13063a13325160a
SHA256 318fb501df45be905951113c639338fc69c2a4572ffdf4a995864cdcf369203b
SHA512 2082ce2c4dab937d5053096e275b7158b53bfbeedb8bb6c7fa223faac3fac88a4457d134533d8521dd0bd00bd7204422c16ba527cc7ff616d0235e028805af46

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_sv_135x40.svg

MD5 fe291e781de76ca5d8c1117397c0ce86
SHA1 027f5241c8de1b61acd8fe76189711bf54e4ae16
SHA256 6559e428d276512f8891710acf4f5609803b8510903094e51a5bb179d261a0a9
SHA512 06a37d4bb178ecdfdbaebf5fddcd07bcfdf9ff302d77fe9bed9acd2e2256285de5da69203a4af9943d291376ad3b4c596d0283b138ec4511dea84e42d21d34b9

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_ru_135x40.svg

MD5 e1adb570c4b503c3f71dd568cbdb7a9f
SHA1 7bc49b2bf0207491e0e0e2c3a9736c2d20e1b66e
SHA256 8699d0e8417bd91976d878caa81297ab413d892e6647a4f78d7b74563d2641b6
SHA512 716576ecb75665afdf18a9eda6df22b17c628e78bd5aeaa3bfc260d29ca4dcfae6991fe55ad7949879ed209bed6db9a7ee07cdbb36fedb374e8782625d0232cd

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_pt_135x40.svg

MD5 c4938a29fa4b7946d91275a6d5cc066e
SHA1 6318360c5f13f49ad2c916609bf988000a93ba4a
SHA256 6a31f5e51854ba94e08f38b7235d4802feb3397b3533d9aff2ff1e1a82a029bd
SHA512 7373a954e62cfd26791235b2f54944d7c0822fa2b9273122cd2fedab2db4bf7e1ccb61d1083d60591bc60467dced3988d420be81f062b9f63f1c047103c1ef0d

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_pl_135x40.svg

MD5 69b090688cf7308f5ee011b85c658aef
SHA1 2396cdd15bee0872bb0fcce1baa937b621ba52a2
SHA256 68a6b87762f4ea091393414fb7e09097342a049a8e093a821a43cf2893df7cd9
SHA512 84dcc8072d18b551bf46648b205b65ef812f05e56f0ea41b2b79ebb04c5220d8bee4c9f077650306c07f300a0df5811346b390efea99752cb7d9c68720f40bfd

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_nb_135x40.svg

MD5 f261f972a6090880cf0c6f99786d7433
SHA1 a9a3f6d8ba5abf1283c47a41e2042218442e3f83
SHA256 7702940ac0baa0c42274f1c018b089b01a2faff7a0795f98ccf918a7168b657c
SHA512 cfeab75f13014e27545ffbf864a6434fb4d4449dbe5007e939f5ab89157532513c61c071415dd200fd1b58a415bdcdc55f35e995910457a19bc43cae2e39e94b

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_ko_135x40.svg

MD5 0f78b790ae451ab8bc3ec582ef579d17
SHA1 c9ab7b44e1bf2ac94a8ff38f402e1b457a8b65a2
SHA256 69325b1ca525427e70027261929cddefb97121dac8fb46fdde0865f87bad14bf
SHA512 a9c78be2b7b82c94b4b932a2e38a7b085e66b601841fec1c0b5a78b99b0325a91adbe7c2b6132292e190549e20d556930d3bf14067c296fd96ec6bf9f9fec09d

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_ja_135x40.svg

MD5 ff5f42fc7f38991b8f156396d5f40c5a
SHA1 41087ea721ae49b1810033a5fb8d108a960e9877
SHA256 3059da8055b4a436a4ba464fb15e656de7dabd7fc30a1538e33699b650ab14b6
SHA512 8987b99655cc187c7650ee522af196a8bab70797ea53357e557d4afc6e25c98c94886138d021d635f69669cc765acb2cd373d28f28935fcbacb9fc98ad3cbd74

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_zh_tw_135x40.svg

MD5 156f685e331d41f23e192fd87f7abfa2
SHA1 bb890fe0988f12501b89c9883b15da1cb0a9d398
SHA256 e656a4d0e236f2af18313711dbc00b85a2c14bc544ff137d35e0e4fa4be499e3
SHA512 cc596e3c07a180077c0beccb21537c81e201e47bdf01f73ded2c085e79bfbdbef2c9ffa28bce9ee62ee4841fe3ce928981b0d15b17de2ee1cd05ae55b08c8f3a

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\cs_get.svg

MD5 c42328a353d1be9fe255b6efc9daa8cc
SHA1 de1f22ec73dcef5b0cf662e6993a39601953f036
SHA256 caa2f095b32fc6c25a0461f99e4d01eb824e4c41494471d998fcbe08952b9caa
SHA512 9edca667d98e85dfab5ba5f99eeaf1cb258ddd34d1cc3d1e8659a6179f6bc9ef8c4bd98908998d61c3b89980c7991405eb3bc2556ba2cc36315d0081bfa5bd26

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\da_get.svg

MD5 11acf39468b685ec09737a84057aa99d
SHA1 1c311fcc74f116711fa4936e76f37bb03cd43ca7
SHA256 5d2f89b72dd4db1c1a4dd4a1e1da857151ecd97f978497198a2f8df6dfe607ce
SHA512 d1a6e7894e9dbfd4c8bc2962f15505629ef51847412fefd797ea0d67c1ec12e1e28751a095f518795310d9378b93878e24e534704b5fe258dc85ce976c8b9a3e

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\de_get.svg

MD5 faaea4f5ae958c175c391e388892bb5c
SHA1 f4a2cd5e3ffeb0bbb9063a0e4b7d3505e9cdb2c9
SHA256 60764fd5c6806b2f2a76108a1e116628951425a34248dc6ee05d060e97ba01fa
SHA512 1a93458ad634c44b927f636fc4cc301add5a9fe6097c41ae445fa1df1c2965150bef809d2d08e3f69f5ed57ff2291e92758831526f57281d607aa0b926429a8e

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\es-419_get.svg

MD5 f3df9a5ff6b6ca8b260d614c9bb57e1b
SHA1 56aeeaa9e4eba71388df201ff987d9b747c59aea
SHA256 d033b4cf832d68f8869ee6bac2250eb2f2e6d4c6084dce843fe1897b044afa2f
SHA512 7e4caec3073c7bcdb2f371e23f9ce6cb53a96f02249203d764b73a800604fa4b71252694ff4a12fe9bc9ff5ff333d4f69fa9b58f8f6cd39f3b7bc97fdb71be2d

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\fr_get.svg

MD5 e7aa79c582fab61757cad5b143d23877
SHA1 34247d1ae7e7791eb5fd167dcb927c69f09f1d81
SHA256 f8a2029f99850c15566254dcf5bd9474bd6920a3fba1b83ee5602d5d1951065e
SHA512 bb58707143764914a487c18fb3f59e370294dd524bf18a7fddfba4f1b29f50103f72881bc90d3c1a15fc1f41d20c15b68e0b227cbd8417199d11058556349279

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\fi_get.svg

MD5 2e2e772acf0ba0853d594732b8a4e559
SHA1 d47ddeafbcd4a024e6c36ce97658d3167462f7d2
SHA256 9a453926710bc2126e578e5a60c0c2f032810c81ae1f1493e9bcbe5577d4f9e9
SHA512 e7ba1f3731354f1b6dce1d6be710df015561d38c99b6271b90ea05e95ffa8467528a5373159fe2108228fb250833340a0ad75fb9ac1946fc00e4aadc71b09a20

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\it_get.svg

MD5 bf23a2a6181b5c4e8180c73807f2e01b
SHA1 937ec22edc90d781169841775b012fce9dffaa02
SHA256 d3ed9b33076885e8bf7ed0c33f5cb730e193fb73ab1cd272a39b2ae908672824
SHA512 c03ed338778fe526ae13cceeefb9ac7ef2e1b414bc4bd0ede43d1e9db52226a599ea3c2d61d918a17cb8afc123014db40ab740465a5428098214ce5aed1e79a6

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\ko_get.svg

MD5 67380f25edf51412730e666f75d84291
SHA1 53f2616fe156152b9d9eb572b99a332c4238bc95
SHA256 7f2595f877ae56f8b9a49604642e57e5082729246baf0cfbc3c08dac21d55a6d
SHA512 11f119bfbab4f7cde7c86a240a0490d41b8f68de0b432ee79eb2ef8ae380004e6759250ddc499422aeea81518b022966766c140ccb51a8d3a0398813ccdd349f

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\no_get.svg

MD5 0e03cb2e156201a5b4826dc6b22aa022
SHA1 fc02950ea4e1d668c8ff4596f06d857c0ba07359
SHA256 5b2de4d991a52ab0cf3972c5ad83c3d25ea931491296f83a0db815269f2011df
SHA512 89ab41e722c27967f0bd64ec211bec9f458a4ce4ab0f66901141ffbe55580ef38f90cb576983131f6830d6d2574832ea1680ea20e935b2996e3a326ee7fdcb21

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\pl_get.svg

MD5 8c84e57397e12857c203793ba58e1353
SHA1 d70b8a77581e0fb8a7b22f88923c2dc6a41a5d4e
SHA256 de925a2e98421ce3c28bfe0e591c2d6ca4fdfb79ccad37da45dfc5f3939bdc44
SHA512 48d1642aacf4cd5ad9ecf46cf9357c7e639399c66cc7305bb24dcce987216b0d820939dd528c4d5bdaa3cc6a68b16393c56b571f6a41e23006f15407353aec56

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\pt-br_get.svg

MD5 2b94399559ee3b3b8958abdae0605f09
SHA1 c5a72793f0c962ed918cc906dce933dfbc1eaccb
SHA256 49038041591c9b838a9b9bcd6265054a09ae49de1f1528cf6e67b1cbac38012f
SHA512 9c24a97451a3923d061d2c8f255efe3c8198b0bece1c63350deb8dd9aaf41a6db951fadea8574832b7a1826cd22df06a4ea5bca01e2aa4991869af68853777a7

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\ru_get.svg

MD5 fd12ceaf37cfc018b551037691757026
SHA1 25d6eb70d4b197217ae9c3bb133ecdc0f04b17d2
SHA256 5d501404e6351a4f4c94452e73fa6f0274aadc83d793a04c343ac309c65567a1
SHA512 aa761ed24961853e9a465f1ba4487b1941a392454fb81e86b4b51e0eeb52b6f5577245d66bf9a790aa9dc7b4167950215fa101814263f9009f83b6c197611b1d

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\sv_get.svg

MD5 5294f096e5d4933fb6464889533daebb
SHA1 06de491db36f05fd93715661f3f43aa92a7e24e1
SHA256 0541808933a981f16c126a1e60f230b4bcd0211afc9f05c400dba056644fc154
SHA512 6fc1ae8caf03f3a21da27eccef9b1b56f41166523dccd848f7341d2680e45332e39e9b965e99bda07b7f2e01c338dd2fb3e4590cd242232102a4e538654865e5

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\tr_get.svg

MD5 2e931255deef7a3843d70b28d0930d5d
SHA1 cd31904e9a2b6a294416a080b102ea4f906b0da6
SHA256 b12a77132c9a9687c3d5a9123f1cfe9070d96da734fe4f93173358d5ca90c9bd
SHA512 b4234d3df7f0bbdf1dbb3328b83a35d2b1e8dd62f900b941dcb9eeccc7573218710cde4c0627c099539ffbf1b33ce3295d1adc4e6d789da1c93a3910c8308bdb

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\zh-cn_get.svg

MD5 6c6f3780b1b277e3cd94d32015fe148f
SHA1 b1b5e3e0faa274eb648b5b6e07782a0dc4e62828
SHA256 8334591ab8e18a9440471fb63b2ed8cc2799761f287cd8faa37b211a7f75c69a
SHA512 eeb4e252aa3e6ff63d29e3e3c994c72f0b942ffa379770b4cade748e183f0aeb3dac754a0209696e89b20b2e2c4063c3f8a890ff55ac75145a5b0c2196e114da

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\zh-tw_get.svg

MD5 d7234a2c4b50bcaf441147412819b27f
SHA1 2e83485fe400fbaf436bbed07565f11333199559
SHA256 206f125533c98e84bb1f5e7599b70b91f8ce80e9d2d52545975ef37962357f5d
SHA512 f48916661287b802d63fe7c009df8308d59df0b2dd070a1acaf731414818ca059f0fdff6bd01658b31433b5916613076cdd64d55469654b83465ffbaad448bcc

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\root\ui-strings.js

MD5 72effe35e560b9d5ae57624cbc779cff
SHA1 cf054710749799e5ff0ee0fcd533fc09a6343440
SHA256 6ab3db7de407b2d7cb8b361cbba4206e9cf19565703547e6a41501b4b693bd8b
SHA512 fee93d8197d0190caa2ab9db0b9d275b5ac7432c6a03b68db5719ae1650260fe51a56906c5111fd893082bf4cff957a5f79c2487163f8e9f2e4c94d32acc405f

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\ui-strings.js

MD5 5452d72cbe02d17019e2ad4d14a8c9fe
SHA1 8b858ed98777e08233282b1c659e0d134f116a2e
SHA256 3f0f1654cf3d79b135b3cc79bb6ae32118d659ba6b3f7dfae76c345a780b097c
SHA512 ee070eb244199275ce6082bf00771a8ba254e44573443cdb3ab8fd9434225ab07d684e4d43ed91824ac8b839de2c5f062cd4eb45c636044d333a62a165aba020

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\css\main.css

MD5 3a6ecdba5d768aa9a7a95aed7ebf83bd
SHA1 cd01a7d33d2ca4aa354bc8dfd2e3f0dea3e6f07f
SHA256 62c3f89bb14e2acc1698ab0fd489d1261357d9f88eadb918cd1827252b9148c4
SHA512 90fe870e5649103d16a6f7bde7489669c24870cc6550e604eb31fb2ff27fc03637e806eb99a7fa1930d6d5542a222ecf78ee1bc81bfeff77e1544e84c08e578a

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\he-il\ui-strings.js

MD5 6f48064fcd051002838f9f8b9f1c90b1
SHA1 d1157b925242e64949e870b9cf131f8dcc8388d6
SHA256 28e5ae1afc237584b8862c7a35f97ddfe62f8864bd52d087fb3296237f633d08
SHA512 e0fd2ff8283d3b76ae6713e17a2ce5a808e0b7e560d0a764742ec3e5dda09522472b7a94428cee931cf441a376eb4411cecec4e06ee2408a0c194e1da4aff23f

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\root\ui-strings.js

MD5 78481d04cbae1b8ead94f8bd150e87a2
SHA1 022850b0e8e45f8c3b1a69bf6579a4e09e7ba125
SHA256 a19c1300786015debb05d202e7c8d9eb458492db947d5b386833207d3459c4c7
SHA512 cbb0bfdf2cdb9c79d61d67a0343728cba1c56007608c213379baffc8ce9fad6e938f5d841a30369955d934a0d2ad3e46205ff917843387586b85d3da2cec89e8

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\nb-no\ui-strings.js

MD5 8c99f686af523cc9b56557a874aae59a
SHA1 56040478d790120a48a708a82a07847abb71c13e
SHA256 532186a4c49b6bc8e3fe5cfa500c0dad760c6f3b62b0c57fa1d5075ca7a3b0ed
SHA512 b0f5b28b5488e178046c5857c930830d38f651b93350dd91c57f67bd9fdf8d5fc56c27b72ca9bfbfeb5095de1edaf629959009e286888cae49bb03398626144e

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\css\main-selector.css

MD5 f0c03478daf61fbe026fccc0f58dd580
SHA1 0dc34dbe4a96c325877d11f5ceb5c82228ab8029
SHA256 ff8dbef25bcb0e4fd7f7c30835e5f448ab5771fba405bdc07913757757fc45c6
SHA512 b56dc903ede1135022d72b73a8416e307229bab9bfcddaf8a74334c0b99810bd93d531fa548ca0f0193d2554cc8b85616bf9963567bccf00fb27889070c338b3

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\progress.gif

MD5 81bad5386f61797f8385eca6bebf0b0a
SHA1 9306e26754379709308577ae95cda05dff5009da
SHA256 1550d1a9ba12a5cbbdc36dd1ba1d96b28288ebc9a446513803686849daf8c49b
SHA512 ef0174b27603786738532b5ccc01e95bd5d2045378b91616d26dbe70904e34a9c8d09b297f94ded32edba231d9c81e8311cdd31b7f9619b0b4376d8aeeaafe94

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\faf_icons.png

MD5 95c652faae67975b64eccb4425a7d290
SHA1 ceb612c1a988d57079fbf3cdd9fab986fbb3a0da
SHA256 01f4062cd5f7e31baf6b62c8c28fb6b7976c7dbf37ee65ced1b65ed4c6d9106d
SHA512 0025efdae306980681f53b8c0e34ca414072e5f0d3c9b6afa845ab34c076377e158094f36efd6d07634fb23d5df0387017749f25cb01d8cd380a2fc4e31c61b1

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\root\ui-strings.js

MD5 d5377b63404872da6d600c42434d149e
SHA1 1857404c2638dd40ab944a3beff4d2233be6c763
SHA256 09a2976e26febc125f2087aa73bb97a6bfc71f167f4936eafc21f19ec1ec2e23
SHA512 eeb0c05505cce65a1946e8f8e4f96e45b4ca314fcf13b79d3d239b007964912e6ed2a21a82370e6af418d6b95cc1078ce752ee3ce124d0583b4321fa3faefad4

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\sl-sl\ui-strings.js

MD5 5a23693ce73e0aa50d79a2eeb71d052c
SHA1 c52f15156a97cd139cfe2b132a4802a7fd36d896
SHA256 d8b0603b523f81ad51baab4d1b2c5fc24ed61f8b7b4a79b7b0715c94659bac60
SHA512 6e9cab63cb077ccd3196d50327780bad377e71c48569e3b1e68de092cd6247ad32fb5eba8f09e862f491648adccea946d1051ce1eb5b12d445294fa258c1950e

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\root\ui-strings.js

MD5 e34461216ec3b218f13f13581dcc562d
SHA1 03e4603af63de6bc41f361e7e38fb974a8e642ac
SHA256 76bd1ff29a2751915bb49c79dc42151db8ef29d10f37600d105d535863bc72d2
SHA512 6f473bfc4a6129cf47f2e3462231bd300b1369746893db79f7a97c092cbeb339a1df3e55ac97da2ebb5c732d587db084c80c0ea294293bb8536ab19f90d0d736

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\bun.png

MD5 d543fd5a99f81839f7c576fabec7782a
SHA1 e786461002a943a33dc1876be14b399457a4a2a5
SHA256 339b5e2972c4d26ff04c97883e6b8c4442617eb261e5559391d6795698dde17c
SHA512 127ff8cb76f530130723f51d75b3d86a34ec1880987b23eaa0d44e4c652d294412c844799aed55fef3bfa77191f6b410412652f809596a8cae535e08f8587a75

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\cstm_brand_preview.png

MD5 aacdca85273f3b693ffa36a057bb0c64
SHA1 4b17c518ac7e8a4eb6aeef039e89345a53188062
SHA256 748de441662ed3786b3579ab91d8eb2c784f645effc122278158020f9f469318
SHA512 3e7e0a172a666a5747c76f113e39d14c0e42feb7ade4e8c2676c3c3c3a481e86fe5a6d4200323556d6d4adbfdbb4b374ad80bb4763428ed5767ceea641a9a7af

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\cstm_brand_preview2x.png

MD5 7a9530205bd921129d142f90d659349b
SHA1 92a064125e8e64047edf1829a01c98f0156a6036
SHA256 0d010e073c84ce5e161f1caf6c6faf42ee588125f8774661c74d54df366e38de
SHA512 095edea43b8dd8940bbc0caef342e994c4bd2df2ed04573fb6ebf420f318a8e8309d0da56f67b91825a74182ecc8b3740e7d3d120f2184d6e783a5ad0e1f3d10

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\dd_arrow_small.png

MD5 db9081ca66268a7e3e7475a4ca7e9a99
SHA1 bfd20ba78934891c191d0fcf784777dcc1ca5fdf
SHA256 e78c759a4d41063673bb10f3018bdc96d0211c1a4efe6953bd316ccaf1061f2d
SHA512 b5486b244746f77c616a3ecf5fe53f751ad4916d6b9c4bc3d14bcbb35b79dbae9fbbe85020f3d249a8ff8cec05318594322ccabaeba02892a97888629787beb1

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\dd_arrow_small2x.png

MD5 62961ab790e2d4f07fe991cbdceb1f31
SHA1 9d14e8548034282be24c6ff82cf571ec22966f30
SHA256 ed0dd45b92b6cae91b9b936f1f6a5a294fc684409858bfcf8fefa4548f5a6f81
SHA512 1701a58a48d31151ee7fabe2381de9a973846582db12cf6cdac57ac01e74ea5e76af0a679bfb3020000b42d5a1c49c3ea025585381c9a5444bf36e9dc01fbf89

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\illustrations.png

MD5 de317410c21483670c90a6070ba0fe2b
SHA1 de8b66c1dc8388201ced642f368034467d907a6f
SHA256 7fddd085b16ef84900438f02740cb5aac49ac8a0ab5e354b87ee402add5ea9f6
SHA512 3b0ea2aa61748650ac9b7287f5c39eb0e336ca7c586b8916de83c66b5f9eb774edfde66fbfe0fdc3198f855dc2f24848339066c16e29ebff540c1ace85eb4713

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\nub.png

MD5 10eedf50806841b203bc7f8669e68a32
SHA1 21b41e41b858ea761ad0cd6359701ce72f6a4abb
SHA256 ae9682fe129d0e2f35cd1a98891fc4fb44100e5dde2283cfaa43e7e3506911fe
SHA512 dfd9ba3300aa7ff24583522e41fc361a204bd69cf91bf3099f261733f777973f44187db8769fc9836a6f0c1e6ff9ec2b9a7b2626208b5084dc993cc2162cd330

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\share_icons.png

MD5 29d4534d9480c04e1b0b82a9057716f2
SHA1 6ec0ce2edebe6f9ab8c47f636a36af26da42c69f
SHA256 9abb8c786cfffadd0bd9ac5eb3907c654aebb6d4d59ecb71fc2db8f434f0cb05
SHA512 c0e7e3d0f377f1549b808db6d3170bc1aef1016a312ff9305a6fae926c3ac5e3fa2e9ebb53bf0fc52870eafdfae49aa378bb519762328df77fa82f85cf799f67

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\share_icons2x.png

MD5 32580ea675c9b3c789ff879e52f1e2f6
SHA1 6207aa8f259cf4eb8127438a3f899e1b066e8b57
SHA256 cd92e7c499e29e7eebf2d68a45225447aa596d6e7cf62a068552776e1cfccad7
SHA512 a404720a89aed19f1a2513821c3997d0359b0b024a106088fa7e686dc561b2e904eb6e39190a123af1563ba34a9dab8a52353c062e0dcdd37a1a9b13d1d5817b

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\s_filter_18.svg

MD5 38d7defc557ca87f4d66e01b577969cc
SHA1 d9beaa15f6acbd8a9b8b950cf14a82e4269aec06
SHA256 76ac75ad07b1d407ca25ac4e33c40827f28c4c7d651afb21d684dff9c4fded1c
SHA512 ac22f79cb3dc9b755de2ae36f515e396147b37d35f0a17d3e6d9105c6c5e5d86b22b011216d2048be2bdd3fe807242e334b9f16167d4c16c0cbe9574cf942b97

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\s_listview_18.svg

MD5 9558ee423d827f12fd9d1e060d83a2cd
SHA1 948013cfdf5922486dc4237d8e34f36944fbd1aa
SHA256 c775703b26a44f9494e57641e4863145016ff98de7941159e1364abceacd379d
SHA512 47dd8f24908dd57a0307d13b0d913f5e427506a8be1f4e3f27f663a419c659647d118ec592b53debcd65da33276fd6bdbe1f743f040860c8499f10838ea35feb

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\s_opencarat_18.svg

MD5 b30e9291e56e711da6b74520c5637dbb
SHA1 66197dd22a6ca89eb66ccfc8ff2eef7ce24232a1
SHA256 66e8fd997dfa2e5c3b26e2541bff38a3222622ab37a5615ab3dffc04fef2034d
SHA512 943b14a838aa50c4a892cb936388a10bddba250fe6397e3cdb3e000e3f665e38cdc5a8d59759080bad74faeec70cd42423834859573b05fc67c6cb1d1df42eaa

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\s_thumbnailview_18.svg

MD5 6d0ac7a4765be78e419b5d041c831a2b
SHA1 6a5c09eb455604de04dc2a50fc9ebdee225e5a71
SHA256 5fc4193f03005a429af98f75b39635b16137549a3bb91ebcad43d9fdbbbbc4fa
SHA512 7ffba29773f6e279806b0e83f29638768745a57d4cd06b8caa6d11dcbac4545f6f186ba92e91799c3292eaf0320d0bccf5a9f8d208f1bad8d0208ed174c8bd46

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\root\ui-strings.js

MD5 0d00cd25cfc3e8cd9554d44810a9ac0e
SHA1 6181c0f3c14ff7e4cb2f327c1c53004973b18608
SHA256 dd5e7422da9463bd4c5f70292b3f05198bf13db9421951cded961f2f112b577d
SHA512 c4965c1094bb6ff28d80f4599828c5760ad16e688788e6d4993b8072b8c76646682121d43fc069e7354270ed0f24aa12025aa971b24c9cba97d2df25124812f4

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\themes\dark\adc_logo.png

MD5 0756d7411f429329a8d5244de3727b00
SHA1 f32557578f25f4410071a98f17ef74363af822ae
SHA256 b8845b7022446d910c8b1d714e94757cd2a30b036bfb4c934c8ce6201870f505
SHA512 cd36fd44c644450d354d86ddecad46201d936330df1b8f3bbce033d96e11d3f446e0ca9cf0a5777dc01f334c95c557fb07185e733f122f01ed36e023eeae27f8

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\themes\dark\logo_retina.png

MD5 21380e07d7c79b41d7c25795619dc48e
SHA1 f1d9af7a514d66c56ae60b6760e4d9921c9ba44c
SHA256 d6defe07bdd1d4eb2d3fc62c976e897e3f399d2f3b17e35c60f8404ea2a388b0
SHA512 65bc103ef17673812b31b8de06ec11460ba916c3b44f802f0fe66b0a28e8eff3b922b256625dbe4ef3d0f9570174f5d0c98c0a5aee8b1ff5e11ce6576c7176c1

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\adobe_spinner.gif

MD5 2567aa3527dfa7643ef8f0cbed09fbc1
SHA1 e37114c9a57b443c7dae23aa266db58388bffe3f
SHA256 9a9364699a6343eb27b3107fa60717883d1ee5c4e8cb50f803beed3614edde58
SHA512 44576ddf3a221cd49d94bfbe00de28e1bcfb485f8cdf52cece0520db9492807b4615a3171883174866f42cf22f0bd8761285521980fc83472e2f9189cd1c572b

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\dark\sat_logo.png

MD5 34c1c640a14b72dee15eeab333aba401
SHA1 bf2f4ffb9a06461eae69ed2f025dc2f355858c4c
SHA256 b2a268845ea0c57b5cc91f8ed4c4c50baf94be45b509a73ba174ea3507b2e788
SHA512 2a318bf95c865e0a24783b1f370b23291cf9b8bbf1a552635820263e34eb2a7ae13fbbfa6422bce11deb50604c9388c71d08c45d672db381980aab9b6d7fa296

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\dark\sat_logo_2x.png

MD5 74934fc527d92c26872104c537821fd1
SHA1 e1a3fed009355edfb7d508fd98cbe04b5e58ae57
SHA256 2363c1ba416de1f4404ddee1b21d355209d02c9a4c0fb8e351462cb352655647
SHA512 985b226ed482c8e706b4d83196453399aa4f6b7bcd523554cefbe867bbbfe3e8a294e6708ace6d02480f44a85a87ab7bf386f94e4caec147de0a63d059567b0b

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\en-gb\ui-strings.js

MD5 203482e99927d0e1a1ed8999821ecfaa
SHA1 0ebae028708b66198418cac143cfebcc8bddf630
SHA256 66d14b284d469ab3bb9d559f9b390dff07f200ca20bc9a271d4c194985394594
SHA512 0873283e23470abeed974fb2b1599adcc8f18e1802059ef21fae9026d765867fa7c116bcbe83da4fceb0eb93a0dd51ec0d1a91358f9a4afe250c39dc2716d1bb

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\root\ui-strings.js

MD5 85547854dfa788e824603c36a90646d1
SHA1 be8667268612df48eb31ff74166d0cabd1455f05
SHA256 7c37d81a97a1861b731604ca2faea59eafee4bdf623b9962d10ff0904d03cf08
SHA512 09f1e10606693915caf47ed02e0b62a11b183247b0c50abd7ff02088bbb68fa12d91d4193bc886710eceda45d9f40c07a49c6c2e2dc079010d08da01846b863e

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\es-es\ui-strings.js

MD5 48e7475725f91340bc7973ab91868601
SHA1 68ff49cacf20809f661b33e19b13f70422774337
SHA256 6ddc3cb2a97ac4df5db4d156a1e1f93d1012a65e64d3fa8d2dcb06c9e2a7dea2
SHA512 ed01a67a44cb53184eca2f2d9d6f487237b3640b5cf7a73d061bec49a0377b30f321212e0d3a5156aa9c67eb3cc8a42a9221f0696813a19200b23aa189924162

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\root\ui-strings.js

MD5 d0c0ccd96a91072e06a9136fc41f0267
SHA1 7139717c965d693466c77ab49ead74f33d4bd239
SHA256 1763f463812a7be0c0bb60a951f334fa83c62b2b4d41fc65e7a0ec77b7aa8107
SHA512 50704a4c10efc95a1acfede7fd4b17258b5fd460b33cc1bff9177f9165756d4857b28d0f84caa6d515a89f8f209e39d0b114d04bc0923ac881553caddd4ce760

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\ui-strings.js

MD5 c038e992a136a3e4ccad803e265a9908
SHA1 ebdf7e4f5bfac8bf65ec04d0bfecc2a70a68b9b5
SHA256 088b2966bf1c4a7773269c1811f58427088cf0977e8d0aa1c5270611fb99e2d8
SHA512 9a0c4574c5b96e85d1d66431297677adbd311c333205a6ccbffb088cd80937ea87c36063286d05a2e8b4c303d40116b6478b630bf4069f9afe8dc981b912342e

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\he-il\ui-strings.js

MD5 e7838c62416890b1a54b8e3c737c3921
SHA1 785f264a0f9ea8cbb6ef0af7f427ae516142afe2
SHA256 b64c12c9afc725933ffd091121a9eeb218f3d825634dbb3ecd3a6c15627fa8ea
SHA512 2b01fc33fe4aced4b23cb7880c27fd8cf1abef21e2715c86b1e1d70d1720d9ef9a134c2268bd45d1ff92062ed4ae8123adc5b311e2ab950698d426c44a1a4320

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\root\ui-strings.js

MD5 82869cb735b2c1ab7fa7e2493a97f586
SHA1 78b0cbd1bd08aa895eebed273c13a1fb3d1c2952
SHA256 8e689e9885e9d17c360119d4c843a46afabf707c51c3246a32a332eacddab597
SHA512 d59bdb9b59905ad7e96e59b1ed537413c14ab63570fa2f46f8534fe42ca6ea419726ca4e0d278838f2797a545da8f2563f2ec8e5c8563fdbd825aa9680ff91c6

C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB_EURO.txt

MD5 dc221e00b9ce4d88e11e3f721fcb48fe
SHA1 3a7e23a2c4b03c98d22b333c32573b148b4e9994
SHA256 0d0bab2bae9b576d4b2cbfc6503b1388940915cae43d2c38f5d031e0dda8e0a6
SHA512 ed08d9c5a83eb6ba46007ad6e2ca139b38b1e05b86efa555913773e323ae9aa31e0d06476e741920016f12232a193a982b46be24d719a2fe07abbdc4f325bc80

C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\ResiliencyLinks\identity_proxy\identity_helper.Sparse.Internal.msix.DATA

MD5 e3242925ebbdf99e2e9684ceb1fbf584
SHA1 bdae6c0c6f4853a8e4b7a6fcbb330c306e4d2867
SHA256 2913b4587b92bb72515dd32dbe07e122822970357add0aeaa2527ca92a02622c
SHA512 a84be94cdf64dd86b9b8d71d15928c68e8f20c2fa3b67ae8d4c6d4f42c6a208b09dfe9de5ba9c3c872d6c32fd9f01b5aca41c194b037a7697f601df422570848

C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\Trust Protection Lists\Mu\Other

MD5 419381756bd757a4763c44f5b2e22866
SHA1 c95d2e28f8efa9d35071c6e3073286062657374f
SHA256 d7c51d32eeeafafae9e6107953175a8c5b01c63054614a17066dd2c49a79d9d5
SHA512 2eea4ab10e71dbdfb6e254804b26a4fe7e09ef86ceef5a916d64756092849e648febf64476afe79322deb40ecd1188a522a53ac5c6648a79ec065e5072bdf067

C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\notification_helper.exe.manifest

MD5 19c74bf5cb95c139e8a89bf7c9fd0117
SHA1 77e3268e43dced9000741aef1a9ef505c8956434
SHA256 28206aec3c3e684f4ba98f93edd052ff14384027c3ef071f98ea784ff32a7343
SHA512 ef21d89728c195ac3d6d8aafc857bc43a541bf12aaa1b3adb15bd8b223cf8cbaf9a89bb3ad0a6d34564141835c3cd5c170892de5f66a456741eeabafde0bd649

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\identity_proxy\resources.pri

MD5 4525d3928c38d636bc2bdc1538dd055f
SHA1 c98f04344f37f4e7b798a0d63204dbe9270292c3
SHA256 bbe0d5a6d34b7246be346513a641b096132e4a97b5778ad518124cd67b94b968
SHA512 c12f4baac1ebc47ee5a33e7766e1306ad6ff91edf5a4a6cac714a832f6004908c219705378c96812dfb9d44de825840ff5155a5c6d8ec71fd5154cc05ca62b6d

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\devtools\de.pak

MD5 677e33a7203634f89276d97fb727a662
SHA1 3ee2b9eb0c8316b7efd330ca2884779cd6a85422
SHA256 840508c0260765c8f6d8f20b3ce245334d1d4802d118df33435e54aa8ca14dd7
SHA512 d8653db44f4d948021e7af9f50e3e5c69f9f56b4da2ae24b21f42eedc3218804af7b1f09390207e94649fc5ef373e532009b78ca8f404e4b0fff7848e847f913

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\pt-PT.pak

MD5 f1936dd4ebfa14b34a9e00d85d086b61
SHA1 ed2a995507d7e76518d46afa8ced76c3112d9e70
SHA256 8d4e1636c2f97262ab73360525394d5e82a14096e93136ef4b4cb53ac21e30b7
SHA512 8df32e367d24bf410b1ed63dd7a53e5855e337cde0d4962a61737fc1b5e54e81d9b8c886add413d454f03f107dffb469f86333bd1fb2f02d1820af10a880b077

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\sq.pak

MD5 2d694c35e383bdca89413d944fda5400
SHA1 f38c3fce7f6838c34a4b495a56f266c96aae06b3
SHA256 f5c715e15163159f707afdb054ee0856e74625825f33d3c6a49f9f08b18220b3
SHA512 c1e4511ec5bdf83b4d2d056233f951a5047e6266d841bee3e2d604f6c78c23cf828328dd10b025f138f6172d1cbbf9a3d8ad86da0dc41cae186e423190f4feec

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\MEIPreload\preloaded_data.pb

MD5 b9a61fdae787e36772e8112897683ee3
SHA1 5cd1dcef9ef2c050a373c3c22b340b535413147b
SHA256 14b98c9f8371ef871ccc963420c325e767bab1d3d5bfdf667da52dd5eb96d276
SHA512 0da7daa288ad2c5bdb644ec93fa0c334e2349676832d922502f4083b781d590249ff88a99e70ec6a552f18071c0d373da644f5ca48d00369815350b6de8ae58f

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\MEIPreload\manifest.json

MD5 bbf83cc712bcbb242dd3b25afff3d160
SHA1 5bddcaa75a30f6bde5bb24bcb62dec8222254382
SHA256 4b304d43f3a1ecd8044d719d2c475777ae15556224ad736b618a33f833b7689d
SHA512 c31fb173bf73c0634f7f9f4a7d9ad66ab88d326cdc1722eb1a97235e753dca8d9edd87b6611723d465a854c638e3b06647805104871842220e9b12cf9c1dfe41

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\zh-TW.pak

MD5 855db7ac31abca1abe1d182edb4de25d
SHA1 77ae1e4e5d7814efcb1c5cc0fb04fafce96b7e7a
SHA256 c6e6094ab584ca1902f5210fbf1f708b6484e8dc2860c47af5fdcdb36e5b161b
SHA512 0499503d8f580656d2a5c79f8a8199febff0bc284133f84034cf47a7aa483aba86bfcc81a9d3d21f1b2ba613ddd9f933bbc1e3fd3f14ed659a7ffeacf9b09efe

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\zh-CN.pak

MD5 78d894cf42129b7f5f9bf8b28d23bbb3
SHA1 1817c837947d91ab0477ba6dda0fc94a519b41e2
SHA256 9b3314dded9eabfc631ecae8d81929a1e4dba9ca925a003b9c8d7167855ebd6e
SHA512 2d3825e769aace712b12c74de9b5e3cded785a1158813874d27cd180bfb7b2e144f37f3c15df7cca0b6a050bb31aab53b2fc097a85bbc4ddb4a2ec90be213b6c

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\vi.pak

MD5 1063fbda2a9e42f27584b43e2e5d77a4
SHA1 a7cd9d0b7f3d82571f09bd71fd5f2bc3380bf016
SHA256 113caebb15cca94e5f878dac94abc8bef5081a1a238fce12802e576fe4185bcd
SHA512 2e91500f1f6ba7d17fa5cf026ec0e43c061b1dd19a621a1bbdd9e35f47d2286ede8395070fb2a1891ed5537de40bf50d604ebb665a947cbe114e40a55df1b324

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\MLModels\nexturl.ort

MD5 b54ab670046c170223a370d3609919f1
SHA1 7f0a78e02fef09c31d026c3d604db5b444248cfc
SHA256 e2fe943d0bbc905a47d846d04486722fca44c5f9299cdf8b4786de26db8115fa
SHA512 bb936da8c8ed0b73786c6fe46d6296a4e67de5ddcb9703d55ab23b1bab5fa904b22c6adb32a6990876aab8719609bbb1289ef82ffd9431a04fe6a689f4778ad5

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Trust Protection Lists\Mu\Entities.DATA

MD5 6a71759900fd735dad1f3b3e7912478b
SHA1 67ceaf19c588b403ebcd20adf06383d002989e46
SHA256 dac5f26a0039a521c2ec71575eca50b962806ae05f2ba5e7c7ae5a97f26ebc04
SHA512 c6d8a1785d85be91df4a349e6bda2da2ed47e95b0ca2fb4fa95312390e2fdb93dfa8dbce95fc9499b1ef6a23ec0f28588a2caa4345caf8e1ee11c2904fb01f0e

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\v8_context_snapshot.bin.DATA

MD5 3804b7529d8eda6c668645e377435d85
SHA1 b7f1c2657fe47befac4b606408f1428f135aa336
SHA256 f0b6ca8b6cfbe548ec0fa8b45069255674459d3532b2289a1d63ed82d0ebc1e0
SHA512 8e861c828371ce4c000ff12e6d622fbe170ff620078433b6b34071296114163bd2a83898c2b53a3b661e0c293fe5a25229061518450f70a0d70c78436e19321f

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\Installer\msedge_7z.data

MD5 b541709634318bb13650684bfa973617
SHA1 774a2ef05703d1c6e8d70fdfeeb854ac6ffe330f
SHA256 2f40807396262d8233035878b5fe8b4b2c2ce7bd6d9267b086d42b2f62b54ab8
SHA512 d6bdec39ed78d118f16735e6fe1fe7d8956fb8092ace0c309c64e480af9c6efaba974fa6dc20959e3593ea96dc9610306b82b2082bfc8eae24c0089318ffd6af

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\identity_proxy\internal.identity_helper.exe.manifest

MD5 3a30da49f3f893b29400ea15f36aafc1
SHA1 2292adc520ec43f88aea64d6bfd217cc2b16d97c
SHA256 0d410abb26de839c9bff1c9076c17967b1ff5ceea91fef1efc2a8cd778b4f06f
SHA512 9cc116168a45a5e001af3618b108e33abbab4a9561dcdc44310d6d3ced4017e1f4ca8ccf08ac381de36863d216eff01c81c19cdf22768cc662c4c077e5565ba5

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\identity_proxy\dev.identity_helper.exe.manifest

MD5 4e6193f33dd2989c962823e3b9b89dc5
SHA1 c8832d5868a97483e0e23ef6853f677922b4af7b
SHA256 fd6ae30ed2c1dd8dc29ea63f7ff3472fef2b5c5f738f8087e66260c5ce3401ad
SHA512 db1a048075ee803f6d3b15ca21550ac512b48a76f659e6e7bbfb24cd186a152f928f327523cdb02270ddaa5d35f7806df5fe6ef49aa9f3104900ce6e6678715d

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\show_third_party_software_licenses.bat

MD5 0bf5b40938e9e7376d9d12d352eb68a5
SHA1 3af223365db5d7c7d3466df6099cfee68ba2606e
SHA256 587b2a80c4a3f68c03ff361d679e4771e1102ff262d4cb2e20e8cb17f1b1ef37
SHA512 cfcbc1884e7e8d502db12dc0ac85307c2b7e3bf05b1676ffac92ba3aecfd8f37a32123179cc3e945d84a37465750142a43edd41ba1cef49964346131acfecea0

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\msedge.EtwManifest.man

MD5 a79fc4f4f55a180a430d59c8b3428739
SHA1 d77938728964a089f0569ad732de09700c52b6e0
SHA256 f85f094c07b363b8a2c756b2172dc115152d9f88f6e843a0d29f1f0ca5b2d884
SHA512 b1a62a5dbd89b67aba80c7c886e912e0a6481e4a4fe2fd87bbc93ecbac7e8eaeee6d4b17e60899d30f218b6059dac80bf29bfcabb78f8caab0db6a0c8f8b6229

C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\en-US\MSFT_PackageManagement.schema.mfl

MD5 e871ed5c2786cd0592522ac78c4f98ab
SHA1 ffc4f42ac2e8939e0b9ed802bf76daf301b5af00
SHA256 a42256b26a06d6896ad4610876081299ab6adacc9477397517d0190d2d02f6fa
SHA512 0cadf2a55cc4728e247d0517e62cd837891f912bb6a5f695dfd3e2c038697c2c6bfd36a92a03492a892611f8234a873c4b674127eda95e0e25241b973c694df5

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\90.0.818.66.manifest

MD5 7b294ff5b51e32e0f027ceb0e01bc9e2
SHA1 b668d9701ce47c6a89171437c01867e96a0595d4
SHA256 3b7d3e103e2f25c88c9fe73bcbec219babb2af07635ffbe25fd851e06b2648bc
SHA512 c18c3beff1ca9a0a0e6ba2a690306c5066a910e6a18a5ff2baf12a20c20976256ca51102963d3e155a0d51ed547271de03a810a63836f6e99c8543ece56cc1f0

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\identity_proxy\canary.identity_helper.exe.manifest

MD5 d3452f01d00c31eac563def23f360730
SHA1 2179299391d154ca6d7cfa4bbff3ccc7f99264fc
SHA256 93f4557ac4e7f157d7abcc7903318c834691c5cb59ee8cfc8ed90499f11649ec
SHA512 34e1a45e273be2a3de44423c98ffe2c56ff15b69cc97b351af851d05bc8402f99cbdda82362b57e61dbc4f630f3d7fad858e44a4094b59968fe23bda7d9fc206

C:\Program Files (x86)\Microsoft\EdgeWebView\Application\90.0.818.66\identity_proxy\beta.identity_helper.exe.manifest

MD5 5fc1a879a038792ee6ba63df659a86d7
SHA1 fe9942c82c6a3e8749c7069244b7a850e2da422e
SHA256 5b46f849e97ddcaac54b40bfc046fa87142a09cca35332a2067b0c7a01e584ad
SHA512 7e02e3046e3caa56cdcc0e55b534a0b3e5b637a87d6730fbd34cbe681255aa7ecf411de28ed149a901ce990fb734f0de4d416d93531ed3d3c1342286726f73b8

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\resources.pak.DATA

MD5 d929bfdf22d20925268cb76bf421a9f1
SHA1 cda6d9795718d1d6d913246f21d01c97229dd0ac
SHA256 7144d413364ad74c078469aaa4952131eb1752ecba2ad1eeafee3f7476c601b7
SHA512 2272e7db2a22817db24dc88a8ee10b1b5af1c6c6c56f50afc30edc6f138071dd4998ada5384a2a4efea8858429ba191c3a1586fdfe7ca749dc2eb59859e591b4

C:\Users\Admin\AppData\Local\Comms\UnistoreDB\USStmp.jtx

MD5 8d9d7e488e3afcc9d5df9c5af470e7a0
SHA1 57b38e74aa6f17a1e5a304b13033371766a6f17c
SHA256 1ba6250917aadd380d1efa5756d630b05158eac6dfb56e51eb1da91cd5b67a54
SHA512 08d22c50bf90ec0e151f7070620f7356cd34942049ab4351bcde4a6b2009f64f2b04788085b4468b7f64f936a5a4d18d5ff1a793ec2f37ec45c878eb46261af9

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\MANIFEST-000001

MD5 fe84ee7d616c607fb3aeca549e136854
SHA1 77945325a07f79781d4d5d8bf0d71dea8fd1b92b
SHA256 d089f1c8c255be8a0fbb8d0e064548bb4513b817baf1851ad4466e25ebbace6c
SHA512 091425c9adb843823904b50fb1fc23292004c282fe07db6f61df0c7576d3c6f7241bca713b4182865e81315a851aeca56bb0ef9a534158b9befa5e4f7bed3b04

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\CURRENT

MD5 dabb60254ef9bcff6d1651ae592a1bfa
SHA1 99b574060efd95a58228d104b287b3816b367939
SHA256 f7b50381145a1806cde4e5d4a31f1efa497e96657b59a88d20854b6a8429a6de
SHA512 11cd51fbed7ba5eb7b231b20d4a938fbdb7a0d5a91518153e29adc3d8773e3983c6f06731b085ff1fbf318fc03c3d155c2a4fd327f582997c97651cbccb215e9

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\nacl_irt_x86_64.nexe.DATA

MD5 7bb065a244160c985963452b93178084
SHA1 92eaac3d9dc5f4cd55e21e6b28f422b4d32b6f17
SHA256 ffcc5d7cdae368e569d6826345af30217ea4a4772cc2fb1558ecfc60b60b7f5c
SHA512 d7166a52dd80e3baa33a27496ebf1c74b88b437c25c6f1a334dd41ad468ededeb1892a9c97b2e360d93fb7ee8703cea8f8bf3a6c7fc1018553c8135444103021

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\msedge_200_percent.pak.DATA

MD5 776204b93f497ddc8d15b59d2e779e5b
SHA1 a46c894634162fef2e599c18713b1740178aa54b
SHA256 7f51c6abfcec4424788b8ecf36403bdcc1d63551e8e29ae56b3aa56c9f16d411
SHA512 43c0a156d5af241a3dcbdc45035904c5b4463909718916bbfb6cac2209575ee8e916c5df71d0355e1eaa7626b1467a1ac7f6583557267dacd9718b58b89a2420

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\msedge_100_percent.pak.DATA

MD5 6b3a713d17a2a91431041268a1954f8a
SHA1 d42c45ad1a262c958a2b518491388ae4bfb54d8a
SHA256 76afa1942d5565d666c6f88c2b92eb08b8d4dc46176c19b2fc88dddc7bd422fd
SHA512 4e5767bf9290fa81d0e346c37193f7370c4ea313c9d7290768b58cce0addfa5784b36672d0fef350c22941ddcdc103c3d9decd20902ee2b5322d4fd40cf503d7

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\msedgewebview2.exe.sig.DATA

MD5 91c08fe2b92feb2abb06fef6d017c11b
SHA1 5224380a23be96d5b204fb2552a15a52bd7c5a31
SHA256 3cafbac9043efb596ec4db1131459e687324b62d26d7d63165f2b35c2a5d953a
SHA512 ee7fd91f275c3137dc12d1b55f1958cf183ee61c472b7e8f28076c75b58eed67ebcc667fd5583fc179c13a2eae17d61424758da6a8d999b639dbcb003eb3470c

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\msedge.exe.sig.DATA

MD5 6907fcbc5c895238aa83677457b90134
SHA1 9e89278c376b88e66274c8a88fbc787d0fc999cc
SHA256 b971139cbb338c864eb4293c5c18f47e96ea6b863e8939524b574af0fd79778c
SHA512 e7e27ce5d9930db487fdff4d242133ea358273dde7085485508c52085ed511640775fb1dd8995bcb72ffb9c205ab59d219b3f1fa7b8c98907c5cd90cc2f91000

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\msedge.dll.sig.DATA

MD5 8f6895c56d91ad1143d03b11e391cac6
SHA1 86e6b7e86236dcd8ea10e111e3a8a6152ed2cc91
SHA256 a15a9d049447cab58bd779c3d8d5dc8798f9c49202c92e231aa5d7e5b811a0b9
SHA512 406b02a55d9d1bbda04949c07efb46c6e5f607dd6374b56753e5b0fbcc8d5ee84dfacf32693c3a8a224ac25258cb5f3f1d8bb3e2318dfb116c36f5d2dc9f0cf8

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_0

MD5 190460c6d62937a78ad08a6bbb05a2f5
SHA1 56f11f4adcc5dc5278642e20ead8dec04b9f3ddf
SHA256 732380372eff436e2d21583b582d5aa1e6968d19f57f7e56830b02be18bc4792
SHA512 8f320c3805dca41ee691bcd395901d5bff48da71bc3e97de04ae18377124afc737ba8668dd97344505b596f33a4222abe774988fcb2f1bb8e311d8cdac0d2893

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_3

MD5 6771588ab316f512b512b2d3764854fa
SHA1 53f397f50087725230266697a753df0967e65631
SHA256 e2637b689f7becf52b235a4590c49b0f9a59d5f9b4065ece0568292b1be17c21
SHA512 e83802f8b7fdbf52f28bf28d85d35a24c18237caa617010dcf8020ea35370e1eb7ae7b4dc743d2512ba0685373ef83b6d503f6a39c34bad1f9e1cdd6856a0306

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_2

MD5 cdc91a65b2276f4d306c7ffa4f62abbe
SHA1 6549bc13642602aed3ce81824a7a20518dac504d
SHA256 4735ecc3e825bc1029913ad50ed131ad61c1b4424ba262f609cf9d5991120e8b
SHA512 f3c1f006450c2302cb6b68678dde8f2f2734924256561a269939330a25acd9c7ad186b86c685e08d66d40199b0a5d7d6d1c7f459645c8c646c8b2df75c1744a7

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_1

MD5 444c36270a124b74d07c31f1b0d4997d
SHA1 b11ab363784ca37d968b337ed19699b5fb44fa12
SHA256 c24c1803fbb542bdd68b88fd09c522f86133db2952684cc490f5ff44391f89a1
SHA512 cc65faf93b40aec7f7fdae6486a254f4c92873bdc4a745beccb9c6904c757da64961db14cfa6e1fb3fc7519b718f22837de1d6e33ee1fb051669dfbe32586a20

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\icudtl.dat.DATA

MD5 21ca78cec427e5efd7b809f6dca201a5
SHA1 9e4f3fea47c505372e0d5ecdd6612600d1078157
SHA256 0669b204449c06de26da9453baf0286fbb384e4553dbd5780e3a906fbbc3a937
SHA512 27b3ed59a07cd351bcbfdecb025761c29a643d898713e5f17967356ec431e47bd6a770ce530999afe0c0beb1b6d4e8899a9bc57852ec0d6ad69177057673f726

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\EdgeWebView.dat.DATA

MD5 5f10aa7e3ebe6a82bb03a76f0596d1a5
SHA1 3e661e9a723bfab29df33fe1a929732bd0aa942b
SHA256 26bc6ad9b485ea29a68742cc7a12efb11a9ab8e5a31d6674eaa5f30d214c1243
SHA512 be76c0d39e0d966c2029f08bf328411809210c7089a098b793ca99d8f8bbed582056bfd58f902c24dff7da339cdfa446789aa3395aeda139044672c55f811a41

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Edge.dat.DATA

MD5 6d169f185092f5635a69f4e2ba3bb073
SHA1 b7163580ea836bbd03b19700338212c7ecb019d0
SHA256 ee3611765c2a9432b90a6c62dc1b417e65dc5c31fe7b8a41b1bc4bec980ffae0
SHA512 1664be9b0dc9f5310d954a094a304fa05da01f87de6bde5d7c5d78492172558570324d0868b72e0d2a294e5bed044d1fe03cde803e4de74fac3d203403381d7b

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\WidevineCdm\manifest.json.DATA

MD5 647cb4d8e58b2da80186d90d855931d3
SHA1 0de1ed59c10b991a246f8520190bc7a36fa4e950
SHA256 ce82750fbb96f6c50c31379bf66bc2b4b21fb5a221907a194386a5247b9efde2
SHA512 73bc6c302f6eb4c26acbc0a3ac7f18514a7d5e203e80d41e1e5b43749a3315a3675910d9ea2c4fca9adca7e3f7604c479eb743bbaad3e215a67a24a29136d4d2

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\WidevineCdm\_platform_specific\win_x64\widevinecdm.dll.sig.DATA

MD5 3cc100c91f5372f1b72195ab8b856e7f
SHA1 f522212cdb711e3caa8f2480d35d872dea9794b0
SHA256 afdc04aeba62b18a22dbce9ef20840ea7946e19bbc28026ac0b7b6eaae18e151
SHA512 ddcf555aa9dd803e3f2ae5d27c5a32cb0c2ed649fda18f4a1269dcce39fce1ad93ace04720583aae3d200a8a086b39cd983ff28503e7070cad81351bef612278

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\VisualElements\SmallLogoDev.png.DATA

MD5 55bc33b7db23455a48883eedf4581f82
SHA1 1e6eb614a059615337d6cc8f1a2818be1458fc09
SHA256 a2fc290271abb7ba1960cd2ebf652b17e51d6762cbf1c90fb52a9705c6d164df
SHA512 f8ba9085022e9915232164576fe10c2f55e11fe9775fb4926436d5da19d6ff39ffe9e261cc63598a366136a2a87a732081f406dda0cb77f9ec95418aed32cb20

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\VisualElements\SmallLogoCanary.png.DATA

MD5 dd761a06794b5e598c4aa320354bdc14
SHA1 912310e59f8f14beaf8730bad705d24644e01499
SHA256 f6614bf58ffa4373e3a64005a38a70ab8e0717f1b53689ff6780e017f6a084a3
SHA512 554aacff6ab581e5f3c59b73a196ab23351d979139c277d96dfa2a88ce7b31571ad55e48c16ee8f5b2708958fc90f9d1e8d3035086fe9cd8deade167942a8552

C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\winword.exe_Rules.xml

MD5 d3f39b735d9caddb7d9185542cc03965
SHA1 ef3e4c6c6295901db01fe81cf36b4bf2e24d18f9
SHA256 5f7222850604fde35fd0855de1b8ea68d9d44a9cfb879693ec4fdb07128ac928
SHA512 0387a94cd87cbd8d8686e7bdc4b8a2955678ed2f2e4845530533cd8a139ea2d4710c27a31a07257cff2d2e988aff3928a38ea925ab1ce065a1444ae45c9ecd29

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\VisualElements\SmallLogoBeta.png.DATA

MD5 ac440eb2d64b82679ce16440f101ab6d
SHA1 b984236e4a4ea19c356400fbffdb5c7f8bcd3a3b
SHA256 e5870b4d2eb0f6669cb05b06f55a8f36c15cf255c40e67d05f168811d3708b37
SHA512 88e38f32900370dab64ece2e95acb75d6c24079f02f75645238de08825990484fe1a466c2a7e6daf79096686fec4d4fea4d04bfd0eed4e9b14adffe1ab8d88b4

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\VisualElements\SmallLogo.png.DATA

MD5 83d720811e2a0f681fc72227bb0db2b2
SHA1 0863997074ae1232bd14ffbece8b4dc6dabc3eee
SHA256 2a176e5a7c9943d8d2af835f44129e8d014b8b0080549c1cbf6de7d19bc63c7f
SHA512 460bc8029a14dc0f83b3c5701f03b338896bf6a0a72bb9cf97023b297011dd3d17e762b8efc2823056393597dfea7488278571d3fb5d547448080da0a88b6d70

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\VisualElements\LogoDev.png.DATA

MD5 8baca08f19dec87190b9efeb82f03224
SHA1 babac5b76b495524e0cf25110d9c1a0584195736
SHA256 21a9a9b8fbfea4eddee9c95e3aa9fc8a8121d050313e745a1cefaa6bc6f8b6b5
SHA512 4efeae41ca65214e7d1c5383141120fc0c8e280152c533f3d52d3e3a3c969c3b9643b698cb1315ec2c11007b0af309ba549192446fb3f64ee7639f575bd4ed59

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\VisualElements\LogoCanary.png.DATA

MD5 962b0345c51146a5b60b570ff6bb9111
SHA1 568fafd8f9b403e6f0038b89fed0e5ae11b61fcd
SHA256 503d4c0bebba06e6461a920cccd996c5b6477e6d0a6657d64fa0019da6b9ca5c
SHA512 2a1a7c6689464d9a49e4d675feb97894d7ed6b3bf366d4e7efb1166024d72ab6f5cec0ac15e82e9bbbe88798fc67c157c6ce73fb2637da38159c6421045b9ee6

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\VisualElements\LogoBeta.png.DATA

MD5 810a1cb756f6bcff15cedd11af741308
SHA1 9a71664eafe7efc069d58ee15f49124619736637
SHA256 d5d168eb723b771d244264e821882d572808d44ec8e39a4f48271356efeafa8e
SHA512 b97528e48348079217b249237c317e3ec2f9c9b36353499927b4e1fdc2c4d6e800838ab440776a69a0ac5fbba66bef5b98afd2b5d123cc185350c149f37a93a0

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\VisualElements\Logo.png.DATA

MD5 55c39e701ad565d9330416ec5865b1c5
SHA1 a09bd96b1288ca203c74de98a1361cebdae049a0
SHA256 8a6d5e78ed98e0a3857e614e88712f92f329d7ba8640477e2769462e81c4ed8a
SHA512 e8a65b7071172210bd24f7edea357c8134ba6abb7eec0ead44e50d44b16d34728e6ed63103d90599116aff94640de01ebdc2a705428a30fbbaccfe652fb15fb7

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Trust Protection Lists\manifest.json.DATA

MD5 35924f759350d7c565c6ef2746a8a59c
SHA1 9eb9b3239da02edc7cce79df6280ab18cc1779fa
SHA256 004d21104bb4f4dcd6d8534356da81e095eaa5cb8216ee8ae758f03bbb57cfe0
SHA512 b01221cdcb75055e3f88973c265cccb50292b02df8509c155f2aa423fbae2ee7afbfbd611b2555d5d992a7f79afbab62e3882f6b339aa875e73b067f78055f9a

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Trust Protection Lists\Sigma\Staging.DATA

MD5 e763ebce86302431ce26659317eb2888
SHA1 1cb016ca0650402990705934ce5959f5527d893c
SHA256 6955929e52b08d9a8dc8b5eaab41f9c600b2dc35b5aa630343c46bed9c7ef6b9
SHA512 b4f435a7a5145acaf493ec8e85fb49eff75c8238f5cdd9f4529fcee2639c2f310d93088774189b3900050eb26a7a9ec6865c0ffecbe00b82e5efe70af6d4dbcf

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Trust Protection Lists\Sigma\Social.DATA

MD5 15b56c313ff502271a43b72ff4f183a9
SHA1 724f0ab994464609520a99e579fb0b59096c078b
SHA256 9062c3d926db68a50777d2fdb587cc296cde3274450527406b05474513cba96b
SHA512 94276158858d58a224f98d383bbe99c703ee59d4bcdd11eac08482a157b2b6046141cbc8fc2f8b77fc0f0a5f36fa0b6a77ccec794708612d1719361f8f08eac0

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Trust Protection Lists\Sigma\LICENSE.DATA

MD5 e43e38f848a232506b9f00045b8d74f4
SHA1 c1a5e2aa138ea1b02e10007cffbad16c0ca5a73f
SHA256 9c1330f6ec44be2aa2bc9526d6d916f94025cda8eec2b69d6eb18f793c7820db
SHA512 780e36827861fcac45f67f44124d5f84bfd6d18c94b1fb0ba1f2c88461e275116f2cbaed19d7493f41e549aa629837189448adbb36db84ac6654ad41899fc096

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Trust Protection Lists\Sigma\Fingerprinting.DATA

MD5 4db33dfab9de19928f81c7a494cb2f4d
SHA1 081895f7f7f9ea6e1ae635b4afed94358006a2c1
SHA256 7117c890aa39ad0fd4135ace8bb2541cc93e4be4a7b3e48cd2888728fee84fb4
SHA512 411e189596e48248d4ce5cb308daf468efee3284a2cf486feff4715c5f5bd2600777ba4cde59cdd7ab47bdb20d354cfc80ecf109afa2b5fd89d7dbc1a4d519da

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Trust Protection Lists\Sigma\Entities.DATA

MD5 682cd0c975608fe61e269872e36552a4
SHA1 00c4640ec908613c8446b00c035a7b0ba9ec6996
SHA256 f6b6a204a6b6e2e46e8ac89b826bce65281aa56d8fc46b2f7ee709cb35b1271b
SHA512 7d5f9c89a390b0c7a6f1ed0fd30841f82f49a2d02332ba129c9d70c7565e0db704d5939e6512f2591c1e96c220a7cf689406f028b1c08a9ede46829a4b140537

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Trust Protection Lists\Sigma\Cryptomining.DATA

MD5 399ef8b05f73900a3cb34d4bebc9e587
SHA1 4f15a5c644f1de45bd94193b594a86a1bfb5ec22
SHA256 e78da6db9bec947c786cefa6c7a30ce2268b26a45bd2f00ba456239fd7f7b2cc
SHA512 5a60633a9e7c050403f438c61fad148e0e39822b3d447264a5c2c0b54e69b5a94bc21bcb9ae370db6874dfeeef359551f5c7a6fc90e6e0b28048fdab40b50b73

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Trust Protection Lists\Sigma\Content.DATA

MD5 20aea114dc1a97a574bdd37ecd1ea7a3
SHA1 9bb22937d02e29c42ccbd4ea21237d5bc62b2adc
SHA256 409fd2c8a832b3700241d147441c8af652bf2d8f064053c72634170913b07641
SHA512 5001140258df7e0eb7d4b4e7b7f0f3d0038423b8b9d4df750d4ddc3f13e7ae54afb208bda916e8d066f75a449e45be46627eea936d55a567ab982686cdc572fc

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Trust Protection Lists\Sigma\Analytics.DATA

MD5 6b2f919a7befa375b039be5c5da11f5e
SHA1 38154e95ed7a5ce6c99e60bcea83ea8c7b328603
SHA256 f57e053c75598cad1351dc10d7a9a9fea50776a6cbdc42c5297ee5e2300079fd
SHA512 ce13b25572edc99651c970996b85d89f5cddf86479de457836ec03c9f2e647bf3faeed98fb05f67e2992a48150f810e9276c17d54371729eaa16c043d8ab7021

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Trust Protection Lists\Sigma\Advertising.DATA

MD5 15260505b399fd161cd44d3de9916b5b
SHA1 f29de97ab39ebb1e7e281170a1bd7a8baa7bce0e
SHA256 9f252f75ff4ffa0bb008c80ae4095013684e427fd8e71d3d8e142b66f9de77bf
SHA512 c74546a8ce255f8d565914012a1b2725f27817a08ced6503b4e8993b76ce801707af4984c32e76c09556f26f43c56ea2499a4c89bc30e3204f502cda71bc08d2

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Trust Protection Lists\Mu\TransparentAdvertisers.DATA

MD5 7c2431564f099ca79eaf3fc9fcca9787
SHA1 04ac530f72a54cd812de50ffb1f607157b07317c
SHA256 6e477a5f1c156242d8715b6f2aa98894834477b4fe074bbbb32b17c471494859
SHA512 9344a31ccefaa391e457d0e285d5d862a59fcef3898429e3d42320e7c35b0cbe933f8a0bfbcb8fd75661c4a975c5820d8834ba4f1c010f6ba192121882c57b0c

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Trust Protection Lists\Mu\Social.DATA

MD5 cd30da54415f714f558f079ec0e3b59a
SHA1 653c06947439e244f723f4d6290efe58ca8506fa
SHA256 1b855dde02df8933cb30abc6edf8b6f6c3119aca435b1cb83431192a81b8d8ce
SHA512 1aeb24e884050475d240b7ccb6397a2d686fd0451a1ca8673991b00bbf5518c004624e03cecc17bf0c8c7b74c9db030b6f2cc0f806e72c9f0fc0b016bfb323a4

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Trust Protection Lists\Mu\LICENSE.DATA

MD5 1842fcf77bf85f4e21ae0055318aae38
SHA1 73b44b069b7f8ccadb27cabfc767d181f874a86f
SHA256 cdcc41cd927629be4e4b7a2740ade528f4b1312b572b308232094e38a396f412
SHA512 8f22be546e9811aaea9673e62fb1316193e1c80f7993a50d4f7fb608bb426982f499e6b93a4d93a0aa89a60436cc0e6d68636d727a8bb8ef623b4758e450c7eb

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Trust Protection Lists\Mu\Fingerprinting.DATA

MD5 cf1cb15b0fbad3da83b49161363b6e16
SHA1 eeb0b08503df25f44bcbb1d40d401b75115c3b93
SHA256 76b1379b0ff315f4ca68ebdd11c188b15d9d56130402e212343e658d7ccc3742
SHA512 e2284b1a316f247e8d30276a62bf100b0b5b6b29dd46f61cc9aeba13b8d3a760101137dcdba1c7b5d5ac374e23658e48acc21668c170aeab76c029683923156c

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Trust Protection Lists\Mu\Cryptomining.DATA

MD5 05d97c5ad851cc5b7c92f3ca87ba1a57
SHA1 97744885ddb82825ebbf5f8f6db07700a8723e26
SHA256 c5707b3d14cdb847a19732b8f6c1be1c368b5dc0bd79f48b4b21337dfd748450
SHA512 b69acee40b65d5c6eec55b6b11051bbef53020a427a7eeb4233e20ef5207305249acc7d8548b65d3641ea0004d606f4563b2e5a5b9335493c35549812fe14b14

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Trust Protection Lists\Mu\Content.DATA

MD5 2f5ff372c1a218af85d62fdf14379d54
SHA1 9e828ef7ee1a2b76e62d40cd3f3f25756757b75c
SHA256 448fadb6bf71ccacf759e022f84461586b9ea6b237533b4bfb82eabd2bdd0689
SHA512 69a9a648e67c20b3650c1a40b66cfb08b6f3ade54d409fe164b94c8c6919c11ae575231b59874660156c01fb6a25713363e69b4b59de2d3df1116cbd7f242a65

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Trust Protection Lists\Mu\CompatExceptions.DATA

MD5 730884346c8421b4943b24a6aa501722
SHA1 888f6feeccc31aae0ba24523518d446d9d526442
SHA256 afa7fc112b53b5dfd90404f4f6d5f7d72f1ae0fc196392ee6bd7c28a330bfeba
SHA512 f69348a76a1a7ec2cd137ba207c8740a24483b5d72973051fe7ed2f395d1bfcb25bd592b9fb92bf22f9f3136b5420b050b2eda9c47bd294709921d4a9642a1a9

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Trust Protection Lists\Mu\Analytics.DATA

MD5 ba7b04c0586c71003b850d721fa68f69
SHA1 9e5aa87c0073303050d17e6feed6405850b5c82f
SHA256 3a79d7cc04ff623296c88a6f5b15f038b2a1cacbe2d7d359fe6876057d48edc4
SHA512 5a6193ea090c3220da0ad99358927701abc8ca0305d42492611344370bc2b0c1bdd7f7906185865a46f270054cb0187cf72313100584d9a4535f2e5fc8f33f53

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\ResiliencyLinks\Trust Protection Lists\Mu\Advertising.DATA

MD5 4d2b1abd789ca6e93390dc2215b067d7
SHA1 e9816baafa17ff5c11a571b58e8757c65db44954
SHA256 25f862b2eae71ef928ea123c2b49c38519a539e8c772e5999f7c9a1c404fa153
SHA512 bb8db3a8b6b251f9a22d464bbf4c71485bba345d82ed8cf21a5145fe1e79879fb8665e196422d691186ea515b393ee14ef37e46973b1dddb7cde371fb00a89cc

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Notifications\SoftLandingAssetLight.gif

MD5 3ad1e9601262763f514f66b3193d806e
SHA1 8eb0be9f97aab7a74c520a7ef562a50ae99edf3b
SHA256 7951b6d439ed70eb97c90ac803855ae78a4d357d2fbf0b92db7bc4b0c676a2d6
SHA512 feb7d2226d66034e28643c4eeef9a9db88cea7db7e40b560c56d2eb5c09943fcefdde9f1f7903fe257abec6fb88a5a3a738afe66a5ef98e8e70103d847d0b12b

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Notifications\SoftLandingAssetDark.gif

MD5 2511be64f0d8958829a5149cebba28ab
SHA1 8cea5385fafb6d5fb63b6be3e75778d0a9e33467
SHA256 34e77078dcb72a51116d366a1f217ce07045ad303942b907391434ed4c2f4f58
SHA512 90b854602eff0e6ac9e079ca96dedffaaa5ae8df15fad37936155922bd9a7096cb031a1f7b56dba879ffb0014d5104b2fa75e0ff45fdde1e3e725268df7f14d7

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\MLModels\autofill_labeling_features_email.txt

MD5 4ae061bf646bc0775bd5977899058f40
SHA1 1b8b0882c2a9bb49ae1b0c074a86386ea88c4625
SHA256 0ca31424b1f689fa40b1b66c5bcbc45243133a123c0cd0792f6f641eef2683c6
SHA512 1ae26ebf852cc26f21005d14f541127a46b8827d5a18ff912a2a29cd4f5bc711de0be189baba38c4389d85edaa64ceecd00f256debf70c1eb4e464ee1e50254f

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\MLModels\autofill_labeling_features.txt

MD5 a0b2509862dfbe2d358abdaf74bfdad5
SHA1 10cbf872fade0ee8661abfbf4367f5cd8cecb492
SHA256 f7f0bbe225957eaffbd0e01643a306530f9a22e655c028cbef5afc4af28dd94e
SHA512 7b3e23c12efdb206affb62398611a5045b86d3a1ec22ed81539d4fff17fecf1dfd4a0ebad0da5b668a56c684e62dd57d4d56255b836cee3673eb6014f4e81ceb

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\MLModels\autofill_labeling_email.ort

MD5 f9ceb8056375451a08ccfd02f6b86e50
SHA1 0a29fb622e75a968a11abfa3f630e3314e1952af
SHA256 878906e8705c8bf77fb1deb3a032f9b9cb5096e6dc4c54b7cce9b99babd5241c
SHA512 13b8715d7d31a2f4fa0e0ff95d5dc84434b14a36da15733f0194939b6921b1d886814c82d7b011cad3af649199520f78b92f9d32481d19b3b60f763c16cee73b

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\MLModels\autofill_labeling.ort

MD5 548e0ab963e4eb583ce238dda14bd841
SHA1 083e09659a5289b786700b907396bfd8fbd14e30
SHA256 0f26afcce7d0aa994222e359e2615783be71fabcece382fd19837a914416ef1a
SHA512 e8b300d4b28c0ef563b21769b0075927e4f2d9863a103389d0268cb32b86b61f0e5691ab3a41305875c14c1631101d7b191fb16605abcdc7f6542f51b5604b65

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\ur.pak

MD5 6dae1092c2c5c540c0d58f69265c97ec
SHA1 30e810168a0885e3444d877039664cce50833d45
SHA256 cfd369fac9b3967697d18fa410076558673f3931609de73c4ea77448ff9669b8
SHA512 6071a7ba940beaaee96b7e2c56d6b09a009bebe0e38d5d78f443ebfd55d5d448e6807c22cb05dda182e59427a3cc429902445634319112188f0e131b3e3d0799

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\uk.pak

MD5 4fd985b1123afb8f9b60b2944967a32a
SHA1 9e88c3bd428acdfb5fe63f56cf7bd4fbcdb79021
SHA256 3d30f5a167f7acb02d8fab7703fbbc3bad144b6d1731c0a32b35642afe8ec8e6
SHA512 c92db74b14367c8b2d01fc239477f689315aa6e09b9230a7fc21d061481b2a065f0aab4bd3dc3a33f646e3241b304e2123f4a6dc63f08294fc770cbadb21e3fa

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\ug.pak

MD5 ee996ce6545da7452db1ff6d44ac3333
SHA1 053a14b4c177e4588ba33d5beba7f3b29e25b763
SHA256 fb762f5f35a6cc634a43eaf95029dcba34b94e6ef6a9cdb9c53e57faacc7223a
SHA512 041c0cd9c9ac69f59b456fa0752bb467d622dcffcb0fec7039e54329d48250c25b3c54648518ced896756136af616dc9c70e00985bce2eb10d392a986fca79f7

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\tt.pak

MD5 bdbd095e83f20316968a4bfa637cf780
SHA1 ea8edb3bd0ca335bb187e2defb09671130ff99d1
SHA256 c9a8d54cd0604ad3f58b8a2e68ccd8d50d9852cf5c32e707d9f85b294a1a9b89
SHA512 dbf894f788a95c4fdcbaa3e108e06a4898f6766b4c48924b5a290fafbcef981a2057ce2c5541cd24d0cc36979633b4f6c0700aa5b353a9237991263972b57d43

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\tr.pak

MD5 404ede281c7f3eca006d14309e06862b
SHA1 3781e8aacd64c6cc0de805026b6e0a76fbaf585e
SHA256 a8983c91e32e92a28e37a207b6369ac2491f3e9adf5593297028980d29f96cc5
SHA512 647877521daf1a747dde33450b37139b7ca0f97d2b301db6468080b11f671910d1e69c88fdb45e25e23ed144fe7dd015e4be1b7a06c1c43af8bfe63c285924ea

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\th.pak

MD5 dc05d88474bc8f8f1cf433782c2537f2
SHA1 b3652769af1e7674e996f3aa2a03dfd9c9e17b43
SHA256 a3f09030bd46dc8df9d9d58166d5f0959ee90971334b9ec38fb264ec9694386f
SHA512 43e553f588b26292b49ad947af9e253e07a17bec47f893815524bd47a665a7bb9d3e602b4b75d2ad0eab1ea3c98b179f81f0f6df81483069209525539bb8d6c0

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\te.pak

MD5 b613ada47d206444bf44ba46a5c9f5da
SHA1 91a3ffee42c6a7a84ea16b3438589731c28e2195
SHA256 7bd33bcac73dbaa92954646fcf79f6fa60f906ba5403c5ffa4d16ef3d1e4e21c
SHA512 c7342fa206f15b9f91d93671a91feab726b13826c23064a1b66990311ea7fae70fe2f8f05f158a296188e5c2ae64f06f9b1763752ed489e09a7adc39dcd78707

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\ta.pak

MD5 70526b58773a746198d784893527adb5
SHA1 035f51e2f5c7a770f828ff50356ea04dc8f4b5c3
SHA256 d2c7cc7b8d24b1ebd20780028c603ed6c9f99db6884a681d94bbe2dd2a44b9f5
SHA512 3b1283a8c6e17f2c552801bb38a577738434c6dd71bafeeee6706994975e0404d1a9451d7ce44643fad14bd65a0c9a12f2d8f9753deb14c6ce19c93e3a4326f5

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\sv.pak

MD5 b7958c96d261716cbc1aad931b389d40
SHA1 b4158ddb0fe30e4633d1f081fcdf3e38b28ef233
SHA256 67d771cafb457cf21f6f8490191b8c76e036e7a6cfb4e4877f2efbe867310f5a
SHA512 3b81ad7b37ed1a4fb801cb3f65aef1372d34878f5791a1be53dcf14946ed0b5b20be74e7188270d7c87008b583a9cf660e2e2214b23fc4430381bc28e3bdf43c

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\sr.pak

MD5 44136fd06a9bb3f7a57578fb140b4c7f
SHA1 a50e83e2da58d088907d0ee30e3b1568e0e01b34
SHA256 c77129a245774e4f9837b287ff0c5b08f6f8dbf1c95f24c4bac7b3176414261d
SHA512 0cd7fdecedc7d65c79cce85e0071aab6f41733018b1b44c24b249a0ea44e85fefacf6a92426d078b2bbf10177319c8356126d1f402438d5ea6c309539e2cd7ac

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\sr-Latn-RS.pak

MD5 65390e1345a791cb3bbe5b78370dfaa8
SHA1 e8b370f1f9a80a825684cbd4e6b679ccb60919c8
SHA256 a80eeb46111a59bd538bc890a40a4cebcf7a2de8019ed6db6056966b976baa04
SHA512 c0d0c3a39c2b768ed04445f779c552ad87b2a3c48a4d3c3a625a028ab981062825991709fc8a64b78bac92930598fb1b3fe538fbe190c65933ad23bccfc1757e

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\sr-Cyrl-BA.pak

MD5 47d55556eae022eb4bf7ae2c01c62597
SHA1 e846067543ce0431bdbf034723601bcaccf3ec60
SHA256 cc2d17b508b0fec1ec118ce4bb7ce71b9f2c024cfbe7c41c2d97ed3cd645e813
SHA512 84c2bfe916e468f10c7f91f0c94b8d6b221c1837728dd522ddd1ac0957b3d4d9f235e38992dfa929c4dc59c63ad3018c79db27ab2366300d20299ec3c04a1f21

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\sl.pak

MD5 6ae2ae9bc488d0967c1640c2ef0cb3f9
SHA1 70c7afa852cc979eac69336ed83ae077b5689a92
SHA256 bca6c93810e8830d3f4b39b0fcd0b8a8121441abac14c2d1f8cb8a0665db5752
SHA512 818a56a12fb7f9f7fa1d49370ef3cdb9d0eb36f2bf278625f0ea03e8fd3a336efb96fc56ced81cd4a0852dfeffe1f1cd17f4a8042d2b61c07d749595479b8de1

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\sk.pak

MD5 e0893798752ffb071604a3f41212e99f
SHA1 02224d6135f80127e170403f2a6a14ba42b120c5
SHA256 c89bd99bee99bc80ff30871c90d37490b46fa731878216d01569debba3f23cfe
SHA512 9a8dbec425d69b5c05dc3d82e20e31ff3f27e1caffe955bcf857e856f79ecb7c3abc8aa4cc35a21ec2d8983ec1c03ab47391e0e93814ea3f489535ccfaf60636

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\ru.pak

MD5 10ddccf8726124c8dcf4ce19f73277c4
SHA1 44b75e8d1b39c730dc6d0bfbe720a3060d58efed
SHA256 3604a233db6c38dfd94c5695c65ea40f1ae32ce00788ae7df5e653e9ff70a2f0
SHA512 844777b79027921f848d2db533a898995c5aa70cd9b957b0359151881c06deba439021f588547c9ab76a4648e8282d2274aeab6f88c28c3d41d5d1ee9c4042bb

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\ro.pak

MD5 160ab18a48f051fbdc42f7c3a5aea75f
SHA1 ef874feb5dae025d1917d3d980b2da0bee3327c3
SHA256 6e4d751af2b1a3fabd496541afe0c8179ede8ac372b91ad5aed56059efba40f9
SHA512 ddca61cbd8049a6af8043d93fb73b26b240e9b3a4791c9d3cfbe8d38e1ec6b3b4c3d396b8629941cac2da58c081eed7270c2f978480b8edcc63bc9d54d2a0029

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\qu.pak

MD5 fdff22e1757d8ef7a827e0e4a4ad7f26
SHA1 96970e9a3beb57fb7e55fa434ea8d05f41dec472
SHA256 df6b3769671883246f5f05e15eddca0d83f23015af7a994f43979b004f835641
SHA512 a85fda3f250066f2f6e3910714028641339d88dce4874d4e273753ff365ef5b048829a69c913934380d34d4fb1b324695e7ee0a1b01d990837aca3efb8b96629

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\ja.pak

MD5 96f918cfacef741aa93026388750815d
SHA1 a7e670e71e6651d1f4fd9abfd7e32c3f290035b1
SHA256 f2f3ffd0bac48989e2ac9128592dd6e4209a5415bcb50513e748e217fbeb1f4d
SHA512 fc117db9312c29dcbc0a0e86690b066531217f26602c65ff595274d1d750be451b692f611755fde02d4ee2eec02c7aeac912ab42d284545a3c886539daea0f4d

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\pt-BR.pak

MD5 9c0ab552615df19b568ff0810cbf5149
SHA1 1a9e5484d20574ec85eb90226ab90bdd3c4b1e16
SHA256 3b71989ab3679972def8501baba8c3396a4c4b8e4d36ad10c2e3766f28ce3c15
SHA512 d2d23ade7e25ac0b9bbd4a0a340921445ea2382f8960efdc4cb7d4869d14476b1bc9aaabb9cabdda242b91ae119bc5c8d9f292475af754ea1d7f050ae725aed4

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\pl.pak

MD5 2e83535e824a113317cc4b337d5e085d
SHA1 b22cecbaeaf41d6e9aaa760c8e2e048cf5396faa
SHA256 72b05daddda73cf0bbff7fe8dbd767fc8a6630efca3d5ea1cf2504a8ced51699
SHA512 5939b4d58022e765d5803084802c552e9f43de75d231cd81131d0ff404fc8c79a3a4a08d001cb7ce594c0340259c23d9fd950e9d0b8424c7453fef132c6710e7

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\pa.pak

MD5 d94a3d3e1a5f2e72b936d1aa31bf22e9
SHA1 71a80406eab09d2c28a37ca99a451386f7d0a810
SHA256 aadf76be9941db3a8e3a5a3d07fc8d6faedbdd142a21b8be6f40934cbe9e0372
SHA512 2c048a8f094820b835a0eaf99110f439d2bf8d0a77e73600107090d137500906efc01e10263c10be36309eddac640ab1b69b69e0d0afc5d1f84b333a5ecb20b8

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\or.pak

MD5 310ef007e467224e91e2e4ad14da935a
SHA1 c374dce66c31e6dad9f49bc509e7b6051b480d76
SHA256 d3912ab1ca1281be0b01871ab73057a0d8d035a2c8a924d84c9576f5092cc816
SHA512 99613ebc36a00184771f69d5b4a1c685f1dcfdea126d40bcb4d017c685e2c44cef768fdf695328e7c5c046f25cdd9f3242ae05323037e21574f6356fcc9568b9

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\nn.pak

MD5 c6d81fa78fb3b0f8c40f763b90397c94
SHA1 0136cfb3e35ed0dcb349496b696a640c954098ca
SHA256 471110f64cf9a3cbab382429f7da59163d8a72882b0264d32d4e1dced5e54392
SHA512 12177c926548d9ead1e34539cac4dcb4f552150eee2c7d3553864d0b2bd9221abaab76952569bdb1b3e1e53ae162f0c197be0b6b106eea1238f852e439884c16

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\ne.pak

MD5 80aeb0c34f22b98b05c8fc7eb1240c0d
SHA1 5a71fd9f583a47bfb95adc62157b33c0c22caea4
SHA256 70e1b7ba053eee914fda9bc212639b864dd58ad3c893c8358e3fdc0c45c37ab1
SHA512 229bcbe0ab0108f5827fbf34fa919d41c6e703fbe8b25219e9298e363d159837b4ce3a275d99fedd518252495ecb1742a018aa2ba54a798c426d39c75b7aecf0

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\nb.pak

MD5 a7b6da809420ceb257a4ac26aa48a096
SHA1 7bb5672cc742d953ac4ede69001be7e4b9e2748b
SHA256 d4b92cfe268f4f3ee63a5991a31d24638341332dfd9e9b7bb1530e974100389c
SHA512 74ef8291b1ff9beec3e47afa0cee3ff7c927304657765b64806bf580b3a78c32c0833291e4e1e3b7346d0a313a4d2e1210f28fade575b0a02d238a8fad90b7a3

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\mt.pak

MD5 d112b983e7cc10cd1cfcc1e81d01b75e
SHA1 19744044245d64fea89bb90df059bb0cd4f214a0
SHA256 36eb21d75f662d97ac5befcc91c9e645d52ae75a82a825e04b372b22dc42510e
SHA512 4de2f101c79aa60701ed8f9e52a689ad9717fc236544ce3ea6a2923205e43d3ca082074314f9ff96dde89e1d97f6e454ffa015b0c7a744dfa054130bd6cd0abf

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\ms.pak

MD5 7cd7e0e776f8096edccadda4edee431a
SHA1 46d632d90077ae910a0271b858105839d0910504
SHA256 69b9ef08d0ecb9c55d15e6f5b10ecd0349d6533b5bc75503130b261f3df5de4d
SHA512 b4adefa358a34598a9a17e8302dda66f9cb8ab8fd097d63fa4bd2662c91aa49dbd7e7191f7606c3d0b894bf22c05222b8833f568aef333345708d3af61c0c072

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\mr.pak

MD5 a798519e05b2cc2781f80dd4927bfbb2
SHA1 1539e191cc241dcb2a8dccb2f33c1441b326c1c5
SHA256 ae1ba5e99c7d9ea2209f472a47af3f3613292433317c1a524b40c7f5e6ca00d8
SHA512 2eb53e0c06fa30483486ec4caace093caf9a89f39b11eb1599111317b0572e1f8039353800619ee8615a3c78c988b1bf6ac97282440f8373223170274ba4459e

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\ml.pak

MD5 8de687c34e5ad8080abbe7df0e6ecf44
SHA1 28527eb2ca1e611e0ccec56b657348b2071ad88a
SHA256 e84b9488d31ea90f034f53dfefc1924d17f5e4774c76144a3ff93fdd63fa1774
SHA512 955b29b0e8db54d107ec1c7d785e8dc141b57d9b0a62d418ed178edf9e1c63b08823864e4faa288d38ae3e7e579227243320a2ad4a8113d2103f976d545f8890

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\mk.pak

MD5 4990c9a4df99b3fb67151f9a5d90a2bd
SHA1 8dfb97bd4806d8bc4ecb81ec104f8f05140d96f2
SHA256 f8b70cf0d6d84f869078ae2116db1db58983512fecedac7a9cad41868da2f92b
SHA512 f434d54cf6f8ba7095bfa8a056d2d09c4fa7d1d70eacc55dbca80d524568f5a3269982e093078a099e3b0deb8295a34e0a0322dcb698bb2396e402f03a9e2130

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\mi.pak

MD5 af23eb1a38d20b34abe90a4e90f95d3c
SHA1 a433a43ceedf48b22f7d9c6b06753614047a80ff
SHA256 ad5d153e35e5641eb61b7098f5df51d0f17ba0449966a951aff7e528d11db962
SHA512 599784bd0850a1283aa249448d82909c05d8ead56a582684a1a11082d3a083f793aff5214a748d5cf1649da394ae3773ac0a6e745fec6b6d3ef40a2776ee41f7

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\lv.pak

MD5 bed45aba0b603550530e96205d3b296e
SHA1 e6ffa7342fe0ed151ca926acec40086901020ffd
SHA256 356b71e487ea6ea7c0e3b1bad8b961c4eb95b247e7941180548de6a5464c1f14
SHA512 bbc77fdadf3edadd5baa7109d05f178fb68184fd4a6c47b02ce2ea6d56b9a29ee82b64d239cd6cee61fd89efc839404ab637973c664d136ec6d0072698ab5e6d

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\lt.pak

MD5 5bd515b88a9838a813458a953e6352ba
SHA1 f0b7b108d1441d2a2a31a12a3432d3eeea146084
SHA256 9fc6a5e2324c54665cb87e521a8104403f24fdcfae07d281d0cd67de6610756b
SHA512 b5603d634d15cd00ea7064d41ec497ee29aa25db54080adf72695d61c0911b8e002089278c3d8011fad7d84d56e34207944f2176054e2201a084abe184979730

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\lo.pak

MD5 d518859d93fe89184555f9985458f632
SHA1 94c052e6618ad25cfe8942feb3dd499416f290a7
SHA256 d6040876e82849b2719867c00f96d99e9548520db16d1747e3cc25bbaf056be3
SHA512 6a5b213c8d3a229ad6f5ba9414aeb27681772fbc4548f8af4543846a85caf7b3dac7ea07b091feaf7665e2f52d048146253e8c743fe91e01142aa7045e7a45de

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\lb.pak.ragnar_40B57505

MD5 c3f969d2434e507b40787565109ca767
SHA1 62bc6dff0d81110f854e1568838f228285f878df
SHA256 e1d2d89e3ada61d8bf5341aa2fbf37c8487cc22b3faae49ebef87d6e2646ebbe
SHA512 01cd6df79519519a23b6fa0cbbd7956a5e1c95c50ccbd399b3632db0812ba381cb622930fa15bdea3c86a6ed13eeab1264197101cf9d8ca70b1063d939a5ea92

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\kok.pak

MD5 b64efaf99473952bf3fc86f7629cb6a8
SHA1 9d99954e1fde3023428a099ac6e6bf423630b064
SHA256 a37c35bb73b148d5e746e3707c5355aeaa21ac06a0b60bbb069fce2d4ab0609f
SHA512 f99da2f52a5c2b9e90665701bf97c5dbe648480485ca6ccb5d316526cb53b2584419be892098fd4fbd5248fbb0199b29cc8cde19ded3c72fba4446dcc6285647

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\ko.pak

MD5 94943887e097d5382bbac3f36fc9662f
SHA1 f58e5e604677b2e11d218a9b15d706352d63d9f7
SHA256 e9416619f75ed7dc7f55d960a24f77e9aeedb4c8566f7032811247e54acbbc04
SHA512 3e8a0acde74ddca26b24e626547d41c907a95f0c71c9b59000d454328d2a0fb14e4f26781c0d46c8494e3a152ef506638e3119e044aeb0dc3580b6699c086927

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\kn.pak

MD5 8a67676f7566d54390cebe7cbea2eddf
SHA1 43ebfd4797e336a82a71cbbb3f742af88d1b2202
SHA256 63251c783e4e4f9f26051be36cc8f735c5a915ecc25bdc154e86eafc010d2f4d
SHA512 2bc24cba19b0ae2a74e1f4869db851fdaaf8d805b83172a803eab94cca9fc603e77854a03a6f355d3098f7ebd2735ebf6d003435c4c18d0e3dc7d89795f97ecf

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\km.pak

MD5 8f0edcefb110fa441ec8d5792860b1e7
SHA1 20aea98f4b0b0071f6bda07854572b2f6c7c7c24
SHA256 4f1409642b73e72e376692ad9fdec9f699f929d42f92ed1404e755c005142e4d
SHA512 a4e944e27e5ad803e67dafc65fa2023436264b19829e7c1a2502a9c8379d56fb06f12f507e976860a8764d10ad562354bcad14cb259c429f5109ce2f0444c295

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\kk.pak

MD5 c408faad23437ed0f3ba3f1fb0267de2
SHA1 b72a122dbab1b7466fd6e0ac2b88dca0826c8c1c
SHA256 a2dee3581debfc083fd8bec32115a024befbc6f904aa1798961749b23e633a93
SHA512 f010fac702a8df004689c84bc7395fe110ee2afd5fc742406c9e285dfd1bb1d59f72de9132452ea4254b54ca584fe6a0795632ebbfca940f2e5aeb6db70dbc99

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\ka.pak

MD5 f8c34a874eeb120e8178847b4ceb9460
SHA1 56aa754831399d6924dcd995b3235aaa0dbf108e
SHA256 eaeee7ebc607ff45761660a3aa8f36504701b7d7b52047cba3a1903bfc10cfb1
SHA512 3d8929b2abd481c0aca64b9e87d4f58499a49e48d27033671a70d6dae62cae1f6a7a0029ea5d1bfc85b1af8ae8a1d6879de4068a24b6cb12ba3a831e19197dba

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\it.pak

MD5 5f23d265b93e05875f2b4839680e66aa
SHA1 4cb48663d2633a102a8073d24f1179a85635c98a
SHA256 235ff61893fedea63c8a07bd964b35a3d69e4d9b5c3a5db8710ce32f048b79b9
SHA512 0dc3c2b83e55f59a6ee6dd981290e1979158ef49e8e79c3d270268372d684b98e325edece6bbc5e52e04e5bc5b9e2f1f587d53181f48558b12f31519e9c67687

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\is.pak

MD5 45512b28e2982b58a8570f4ad941e662
SHA1 8ac5fc6d64b14def15922cc18884501b611c8501
SHA256 ee426807648539b0f6e88f42450851b1a20a5b08ef023e7ab3d83e7389872bb6
SHA512 a326e8d04aa4f6a93c62f33a461e54ba9d25a339bcfdf0ef357aa1d405be5e9a4ec4cba8e2ceba93d89c72ceb8b7da2c3cff30acdf1030289b6adc47477669cb

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\id.pak

MD5 e173a3d0311bbefe2621309d5edd83bd
SHA1 0704f1b84ea65cf14fba90a0e7b1da8bf73d320f
SHA256 72b3199607db3358c5a84e433eb8b3200e53f74b8c77e4c22f4c8a4fbdc14bbb
SHA512 df95a8872742c5f911af76339316ae4edad2b5df53c0d5c5a78a5a364064c835ee71d7d9c7798e4ca54a090eb4da92c29468dfc7b2ae8981deb2ff1d99a3dfc5

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\hu.pak

MD5 27c7354bf57f2708a672837933deac7f
SHA1 49193709f2578604b7e6901c01adba42fb57674a
SHA256 107a61ffbd9bd618386e9f85f2dc7e05a41889fedda7195e3313ebd734d7fd7d
SHA512 d6ee46e0ee9fb187eb30fff585a5cf30d62c60fa95a79d0fb04031dadb67b4eeeed091d3c2c5934cabea5e67bb71d81143fe38fc3edd027b527426bfe6e054cc

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\hr.pak

MD5 0a7097ced351fd2755fac09a083ebedb
SHA1 59ba66b2d25d3a2ee3eda4c9012e434c531e7f94
SHA256 0d3999b626eed2052ff7c114b48332c61aaf5df5bc8a25c500ebf81fd71e71b8
SHA512 39ef6953de4247fa1c260e7e2d1623035901492ad8f1f85b42fb46c5aeb3a483965a0ec6e81c6051c760cb1e9f86472a83c85fc44e3644a82fd99a049ced601a

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\hi.pak

MD5 cf6bbff142a55d06ec0de4af649c64f9
SHA1 db8e894d7851f2c0e6131b96011892fb268c41ba
SHA256 c90c9908ec699a2cde23f856d9b7b857f47d7d979fb79bd59819d2f00a6810c5
SHA512 eadc364195682d15b4ed78c0b35e7803bba755549d8ae58b99789995c4f602e3a2d9341f4df3d9216e1ead895361b2e54e1d79a81f34c34da92bea4687d5c8a1

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\he.pak

MD5 b871782745948ff8cb9ac0f49c462218
SHA1 fbb3807476208e2b37c8a6cc9018e159f20df962
SHA256 405e63ff9e87b4d4012fc69b7a4b149108cbb088b72f1b39d39795db046ac6d6
SHA512 ef1b6ca7ecc9c16e263e35eb1b4571bbc335352f0500b7fd497a5e42897f876479c29b2f67000ac1b40c0bf57665fbf776c1dccab8d07ee6860f9d126a9e174e

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\gu.pak

MD5 9b357e7d0689de8f609e05c7f0a9ffdc
SHA1 34fd7a545912ad9a1498e0f6300d74fa1e74a5ca
SHA256 79faa44389554690fc81929c0e831c37934c26f358e1b2c0863d0ec88c182e3a
SHA512 651d4ad7b0084cb32eb4c3e1583b9f430a298f6b1d3637c7eca5e18c8ddebee452d16a5f5e06bb415dce5fa2cba5e80114fa5dfa18e3462847fd3d82e0c772fa

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\gl.pak

MD5 30bdec939aecfcd06d28ece196c7ef7e
SHA1 e20a005399ed1bea6b6e9f4c34ac9cc972ea5422
SHA256 040acd0062e7c25b5098e05233d40e8b7ded40c935f0013d5e003dd38a34ef4b
SHA512 6658ede92efce2b2d599f1aca5ed40b0290b02711086aa4ec68541d26cdad822c199eddc32e59742dc99e99b17293601d2ae533404b70fabf432078fef0d71d1

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\gd.pak

MD5 7a35362ef2ccbe91ee13707827ebfe22
SHA1 8cdd68cde0d8ac386e64588f24f329114ae1e541
SHA256 55a1361fd0e832a00d4fe1ef2229f896cbb4b38c922411d942061d3ee2e39850
SHA512 ea53e19edb02e11941f6d35c7ef458d76adb4ad199f6771af55c35fd7ae8db1d67342156ee0b237e6a48f06d8342426dd542ef7f58c9f2d4db9c6b0da3b14f54

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\fr.pak

MD5 d5b33cc5a8c74b1a353116663e8dec3e
SHA1 14508c24dc0123ae6ce70def248c0bcbc06e0d7b
SHA256 995190ef397e20a1bc3bfac1581e9a53f8c8f6d2a4ad0257d46a8eef0f01b813
SHA512 3f46f85e379d54cb9c94efa21d4ecfb3a539e0a0e7b88e52e8fe71a7def67a859193e0c4d873b7dccee5d98813396304d07393d136b42754044747e2a0a4dfe3

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\fr-CA.pak

MD5 dbd6cd50ebc6a1af2b7e088addbbe8e0
SHA1 6759275d0fdd8c9a44d9d925093ed81a971778dd
SHA256 df43be28a69383a90fb2e60279e4c3b92c7bad0479e6326c3c7a0466b3e40d7f
SHA512 2d13ec5a49d34402589b70be8a4541c86aa991f97f5f5b7a4d836fb069386d2e7d3c51763116011428a140457c06cb4fc5d56320df82f4e788f254ac6a35a51a

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\fil.pak

MD5 30955e807eaedc751c469609e3bd00ae
SHA1 83d36c364348b004118a18d7e37139857ecdb06a
SHA256 45954e06b08f9bb2a489fedcd50cdf46472275711349befa35a43765faf4db2f
SHA512 c21409007d1ecfddb61d90c3c314062ee573e665f1de12562481ce4c63b63d90576684d7fee19a4307e8e13dd4c5ae1a8b79358b54f87c203267a6f3a7fbc107

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\fi.pak

MD5 146eedf8db4feb571310c6452703f440
SHA1 54b8d717694643802e25539280b2426762df9924
SHA256 7885dc45f4c3cf06e09040934c1fad83068aab1e29fe98e29cb094cdcaa6f25d
SHA512 ed8a439bd598841def42e25682527535fa519a45b67e7d64b9b5f06e6224ec14c4d7e71c2da670b81ed916a3be2b41b8b44b4cffa9d5a1d7e77a6f3b2729a775

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\fa.pak

MD5 37854d2791e842e5d40ed2ada842a7d9
SHA1 d98fcdee0583e35a12078920c993927462fc5d93
SHA256 4dad3bdfaaf5dc21a02818d1e4640ab257e19be5c6bd541158669f62788b7b63
SHA512 8f6cb9c00b4e2f21d83d10234cfbf619e220e1a86434e93f05debdaaa7403c4d0c3ed43102c7c7b324ed78d2d4ba752ea50bf4da6b08013a28aa197ca00e9949

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\eu.pak

MD5 2702c5aa1964fe7550249cde7ae46dbf
SHA1 67d8e1157f416e0786f69c673110293d29b7f1da
SHA256 e82673e191563138cdb35f00a94d0a051da06b7bb34ac7ec34c106b1853c7e2d
SHA512 0f46dc7b5e05c9e7cfbb3dbe070f2335517a6d14039a3485e59343be51be8197d977d3f2b0d6cef03ed33fb4258f55efe2e0e9be1519e0382899c02cb260d4d9

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\et.pak

MD5 cec6e40630ed04471e0aaba29c2772cf
SHA1 c92eebea920c20a5e8f88300ffae04429739b0f8
SHA256 196d01890bf91789c4c18195a29a3198b906a69d72f5e63ab242b89c15f69cc4
SHA512 20a541bfca9c42e701dc2e81e4b2385cd8132e9551eb555ed44e348298891c27f86b1ecbdfa887990e20299997c4d732d2132e434364db012f63b4b1d2e8e5b5

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\es.pak

MD5 cdd0109108fe2a7457751342c074a6d5
SHA1 45c601ab35df9ff937781185eb98b3009ab304aa
SHA256 1335599995b576f49f3064b06c5194f227a7b57f1e54a3c6fdd903339afab9ce
SHA512 1694f30c5b84d3e6e247de336eab1eadc5ea403ab1304e6f2395ccc08c41684e907b6ec52f20f17b25977f6cb91dc834a29728c95dce0d193454b57de8ed2951

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\es-419.pak

MD5 3d376f221f3cc64de4d2f427a07d46e8
SHA1 286e2c35e5771015bba3b2530ecdfca8c297ea0f
SHA256 90146a7258c1bd58611c53db108dda8031d4bdcf09aefc5b99ef215d1ad0f78c
SHA512 579c0ccada1b35868d38210ed3912be3800aafabfaf0e9fda37be15e8e6de3451085741eb75a776978ee9c4815c4000abf63e9e8a9adb2a5cba40e1965f28fda

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\en-US.pak

MD5 cc7e51e55d53c9e36e35d414fe568273
SHA1 9fef1e6fcd102b89f49ef2b0e59e9c2623248eb8
SHA256 052466d41511eb7a4729d8f94ef87e2da471f285aa2fb1e86d06adc0759240eb
SHA512 1423d0cc2eeca839afd4132f2ae3e896418f85f36b77bcc3a584ca9caa88d62be1dbdbf4fcd32c565098503936fe54df9288109a09f3ab2d9cabc90aa9da5c76

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\en-GB.pak

MD5 912c02d4f1912f721076d43346cc44f7
SHA1 b1799a71dd51cf0a6832cc84ea009107bb9248dd
SHA256 808e51c01732140c1bf1d09839bac49c87ee3a41537ccdcdde291d9cbec2e188
SHA512 eb6ee72733bbe2301f9955a6516f2678629b6a6fee8cc3cabecdd9f708429b1107e41b4d74c6562cd2751262a2965c9d94095639e630c3c9309e616742aa09b6

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\el.pak

MD5 6ebd99ac2938004e3163b51f24e42f5a
SHA1 0dbdc54b3753290719ac3badde18842bd9d973f0
SHA256 f2cb392275d0f4ace0d9de02b8c9f8decf24c6aa92c76575c8bc87dd97408323
SHA512 19c998b1471fd7b433589039b3eaed4ee33266423f5afa86449722ceb838dd8e006d965bf14a1e0ca127206b6d3c8a53eed44e6f515d3b56daee81e9933fce1a

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\da.pak

MD5 b08812088a328f4d4252367825426b3d
SHA1 9610c7ce11ba84a0e894cca8fbed188fa9eb1891
SHA256 7dc2a46c8e7fe1ddd38c154b3386acda196adae04d78b56a557968f1d6b6d944
SHA512 6c10af701f7ca41f12861a553584836302d79523535c8eb0afc39fa63fde17d4bf526729d0c39e64b24d06a885c96a1f46d3e6adb351e84d74075c016bc38444

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\cy.pak

MD5 738b846b6022a9e26ea5adc7a699d7c6
SHA1 546158531b2f8089ccb523f97b1e182d69788773
SHA256 207784c5b915124a48e52cef9e7245946407b1342e49c6445c6d9693645af6cd
SHA512 8b2208b35de0ec2380a9685cac671bcc1957312b27321ff6d9dc224dec69d0d178a9848008b226a52d89bc77ff891f4526152c37d429041f504e2daa9eff129a

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\cs.pak

MD5 f7f9a439fdc6318655576f6f581ef553
SHA1 21c0b84a555bfbba5ac021b91bed18b3e8d5ba1d
SHA256 446613b98c5153e73e8c358a231543de3e9befeb019a8a947c53d27ecd3df5e5
SHA512 567c88b650b129afba7700a5a33ccef05689369f0f9ac4469ff803f1fc41b26ee17ba75558655254ef751406a1cc753d606f378d260670db814b73e1b5849c49

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\ca.pak

MD5 0a8be152dbae84c986c244cd943098e2
SHA1 12923839441765b5a30eb5de84cef3e74e3a20af
SHA256 4bdbd7cd88c3eb8c1dac7a4adb40c7517831cf722fb8a8c7b0c9e1665e3a5995
SHA512 aea1b0c6c89135531733288653bf833de5a2b5ad1849310ccb6a689c1c14acaf84cf1f191369c3d04969ade3ea6e1b6e7370561d8e78a1fb0ac0a7fbc40ea08f

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\bn-IN.pak

MD5 3cbc9b4ce15424d1e70fb5b2a5a618a3
SHA1 c7124fe809b8b9bbb4b17fd497b989065d6e62f8
SHA256 f82f22bd0e519cca2a1cd664cef8997b7b55e2ffe7d5913285c7230934ab9b2c
SHA512 8ff0b52931ebcb8ebb7dd9df5cdc494af6dfff6515716359b7408764b9d139149bd88f8ef92fe1d04aecfe833d99a3cd03dbd7cc9cba7ceda5dcc91831a04a57

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\bg.pak

MD5 8116abf0039dd67e049848676b7cb994
SHA1 f786ad781380685961a552438d4dd90e94e33ef4
SHA256 06c3bcf94c366306c5d2db992196c0cb0bc42fa48e551947bfec1a3d2ff39e87
SHA512 b5c25b4fa464f3598a582a1b65ab48eabd57062dbdb49c3641c58fec747bd7c6835670d6bff0f6e91c9942bdaedd17f346027b57e991b589450d4f5247ac3a75

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\az.pak

MD5 a36b7d45cbb638c6f571a1027f52707a
SHA1 588826005ff170b4d5cf8a48e5a53dcb387602f4
SHA256 22a965ef69af5a820fc66446c7aa86af17cf6948a3190f0949b460c8f69fa921
SHA512 f161280f8f8f6a5d9a6e97acd85b89a970b1312d6914f22c1122c61be8c1452ebb96ee44f460c5770a0f2eb169181fd8bb803c38c81aaea2d6e72aa19b9dfee2

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\ar.pak

MD5 00ec29825e3fca0370890880f7b7b20a
SHA1 cda16da14dce5ca4afcc102edd8b3b2fc9371cc8
SHA256 9a54e67056963d7f44934c3db741d6dd7a7598f11d336ee08878f4f195f5fee2
SHA512 1fca59b9749e873906612b0275e79c2df0cbf053368f1b03ea6aec466678b75e53340c393b16f09303707c59dfc3002e74aa8dc3b567c9b337e05c63ab23557e

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\am.pak

MD5 ae922406173662f518306ec7522edde6
SHA1 e0645e7edbafb307c8813e2a87d7236df2a0b006
SHA256 10e41801293db96b8eac864c242749bbc9ac8de892ad3bec8816301200cbf4fb
SHA512 145619c88fe7cac32dd921c49dff315abeb2f25477d371c35771ed9de017e020bd0c32fbee8622c715c40293299731ac0fbdc715b7c0a58860a187c05ae6d4e3

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\af.pak

MD5 9fd4cb16ad60bb718bd7a2657c4628f1
SHA1 45bdbe00ba33bd32f337800048bb1805176e3f30
SHA256 c75d5e0184a5b278db0d237b745ecca30de9eff9af408ab1cee9b10c04457216
SHA512 07d4aa90ff8c2dc02fe7eab348fc7c014e8ac6c92be943b35bb48f834a0aff47a1748c6632e11a975586944211c8b488d647c9509d9a85f7f9d18c22907d1769

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\devtools\zh-TW.pak

MD5 fd336522ea054e54245f67bdd48289f6
SHA1 032f4aed2fe692aa078eded53b2cf4566bd3ce1c
SHA256 00b61df6a5d558a06665c3c8278a4506493c94ace3e3b9f938fb593a966611bb
SHA512 9065164d20a32450a773c38d4f202dfa1792dcc5d58826eb122fe20b86fb90bbd6f8c2ddd3480792d4dbd684b9eae4f84069fcd25054361c33586da1a06df3d3

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\devtools\zh-CN.pak

MD5 ede851c3b07ede3b66898221f21ca167
SHA1 3b966f4dc215ba38921b28a845cf063e16ceb60a
SHA256 60537c100542d3045fe94375deb872cfadfbb8150b6119b8276b98565ecebd75
SHA512 606821a5efea0f8618e1753770ce8c383c57a63d8cef703843bc0a09d5af14e43ec7f3e2b77e25507533c93aa2518caefbbdd6bc32ccf7bfe64fe1a65228ee32

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\devtools\ru.pak

MD5 3dfee32a2b066bf70528a7354cb31a93
SHA1 b8d6c4c0d58f3ea0e8a9158feef1d000b9ab456d
SHA256 9c8fc8f5a205b1a6d7d14fcdef655ed1658e39e564d9aef83255202e6ee3c39e
SHA512 5164822dff7f16c38a52b0e36fef74f7c3f1ca45c7acd99333dc117f23c6539f7fb8920eeb6ce3ada8739b3463f9490b61c77630fc059da15f723b134413c4a9

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\devtools\ko.pak

MD5 99f6d3be6ad94bc2c1c35568be6ad748
SHA1 8d093f2cbaca6d0fe6f688f0cc13726329553aab
SHA256 ec2124805d371d87d42279f6c1325a2412b82c174de927ce51f967793db37681
SHA512 68d41e0cf75e23f11c342e79786343a4d206ad992ab8ce8b07fae0b132114d22269ee16f82fd4a18f715b4ea3a690448d97213bc0e7ab96ceaba4618a988eabe

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\devtools\ja.pak

MD5 3f112a5204deac3ed3b4340d543880f7
SHA1 b1c90b4af8275469e89e6bc38d8996385ab11c26
SHA256 1f4e0cfe696966f0d74d400fdd0537de167c71800d7b16c71c9aa26e4bf2977c
SHA512 b8133c762439157aad6a9d74c496fb5cd1236310ed9be605c2bf5743acc29f426cf4141eb2e2aefd7e2e95e8ae3fff75bac9338b7d05b0b9cad4d73897db4207

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\nl.pak

MD5 c4d980067cb41a90ed0b74b49a4c078a
SHA1 9b192fa657f85beef372c0a51587b5c046512f23
SHA256 4168b44068a2458798facfc6ca53972510dd106dc75b44d8d0dfb9e34440fcb8
SHA512 4a4369aa684e6ce1a226fcd35676d95f04b2bcbc5c66234f89a2f224626dfcdcc17862f5e2b21b81ccea0567694bdc8b8e39cac44307bf0e8de28303f84f2979

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\identity_proxy\identity_helper.Sparse.Dev.msix

MD5 f548060cfc55b1c15d38f736f5f8da8a
SHA1 61f366d54fc75364381524d7b2dc70c3a513f4b2
SHA256 1ee4c8dd107cbdeab9abcd25b8f01d5bdf6dc64dab398af69e4c4fd20046386b
SHA512 5e3173242a17ed417c769622c8f0ba25bca06d5bdb39ddaf5d9cb8a5d3132e64ba1acdb55f58bcadc83efc38a6d624657cf6f9ec5f8a6084720d6fe63dff9895

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\identity_proxy\identity_helper.Sparse.Beta.msix

MD5 23145e7edd61112079ca1477cd4ae987
SHA1 e83d4e0f9afd10bfb41d903f326105482ce3722b
SHA256 bc6835aa271167f774b3987f10c94713bc12b2826df86a4c3d71740448aa2e21
SHA512 fa7cc8c3894f5e1165643c201f32a99a560f5f469bbb76c1b608a8375fbdc5c9db1da40fe303dddfc44cf86022c9ed42e57d0e495b467a40ebbadf8b68f2b976

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\ga.pak

MD5 a2c2bfa802bdd77c942eb4f5ee802b89
SHA1 a2d4d9053df68de39fdde4d3ae25d34c4f588769
SHA256 f50ed0255916b952cef3ea5a285f033d6e202bc50f579cf873fdda2704812900
SHA512 724bea8e0889521b8cf603f6305e007ecc17f9328b0a9fb7200d36fae5cdcc604d0d867c984c50d243ca627b75a88dc574415add10092c5fb18a959ca98fb730

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\de.pak

MD5 bb7215d867c16144788fd50a944587a5
SHA1 45d762253ac52bb03de719555979c6d479f426ab
SHA256 c3b4fa3bf4595b33ea87a82dd7f905b5df48e08e9ef6ea379377addf0ba3061d
SHA512 038d38b35dd1352fb76d74adfeaabcf0c2baf309d82f6067f404cf4aa2fd5becc61aa57747893d1caeefcefb9ec9ad9194a6a0e25474e6eba9311f536118a870

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\ca-Es-VALENCIA.pak

MD5 82e7ce8da8604f367c53b746ee5e8f1e
SHA1 ffc1d7baf99c1247e91cd05a6724e59feb8deb79
SHA256 c56862f662dc2c386a801cb397a194182c570b762b55f7944e119f0ad86347ba
SHA512 880f24fa90168f0f4657592b777ad51613ac231bf45cb316001aae4b00796a5557a9347e6af3869b09eafd048f5ea2a7f98379c955c2f0c9425c46ddb5a825a9

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\bs.pak

MD5 81a9d7dca6b81a595029de28560e0d15
SHA1 749df18e8e21981cb6f73ee71eae982405db9098
SHA256 d29f171c4a3c254479dd58f85a54fabab5ed87e2cb64bbb9f8c151a7c4a1c36d
SHA512 e3c35ec6e48e32ca8015b54c8e7a42b1031793345b9b3fa062de3467ca1e5b4df92e2dfdf92c4ee1e9485356fe5fdec4ec86d10c747500791dd7cd5ca5c2644c

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\as.pak.ragnar_40B57505

MD5 41b6083a75cbed8b29345c2d4dccdc35
SHA1 353cce945a60513c885a541bb470872a44b83d8b
SHA256 21ae615a0b320f35cf51464b86753e45f12d44dff4a4ba79943348dcf235a84e
SHA512 9884d04143da116f287199edc505e2bc75aaef520047da8f245bfe187db713272c2e1fa4ebe1dc26ff907f504a2a2f7503cb963c8e59528326d1bbfd284a9909

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\devtools\pt-BR.pak

MD5 3380fa4cd55e666de25d16a9edc70c35
SHA1 d9937728ee0a908060df66ad8eb10880c26cbb4f
SHA256 bd02b4a63b447ab71de76db00edb4ec78277477ee024b838151b32b40eeb334b
SHA512 48b8ef85aec0d874f0b7e33f4cb3c0d0bff54df270179a338369ac0214d45219d0c67002bcd61546bf6e66b2724a3ae66cbb64fc8465a5e11c111b4232105c51

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\devtools\it.pak

MD5 cf119f900e0825f62b3c2ca5ee578edf
SHA1 c890792204d237f6e290a034233fc128af39a0d5
SHA256 bdf26301bdf0b48d0b222422c262f684e84d39de6361137e7cc1b8bd3c163c74
SHA512 ccb1ee760eb89c661deba2a068df069a7202e6e11447248afadca05de8711a9ccafa130a6a984cef6199f29389af88d233c094d0180d6f87d6cae7c0ab7637a8

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\devtools\fr.pak

MD5 e27c4dd1a5c5bfefa30f020eb5b6bcc8
SHA1 b25d4ec9cb283990515ecddbe8f2323ee5e4af78
SHA256 c73d77d2f116ecada2f9cad66437a337a218eb18df80b9c355496d23966d7d38
SHA512 a740ea0610ecd86f995800a6a4caae20825a6e6dfefd796259e36d6d21e927451313075e816223988a54b8038cb45e85287eb34d274abc46aedcf4a2ead6a84f

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Locales\devtools\es.pak

MD5 aeea96895e422fe08ca035bcc3b87e44
SHA1 a38fc9d96d553d64cc1912f3f9172c245650d8fa
SHA256 dcd6ee302abacb995caf5600ca2cc6caf9467eb4bac83c72703d434a07117a82
SHA512 7653de4ca420c238288d9cfd7e4e107f53705c6847ea4be1ea2de90ce91b440199563728f1fbd11a380ca6ebf651b268d83f1ce4b3fd1de347c0c20ec1d4cfda

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\identity_proxy\identity_helper.Sparse.Canary.msix

MD5 0fcfc9d6d16d9d90c211343dda8cfe19
SHA1 ef99b7ac427f4f254b8e331f9686a7984da8d714
SHA256 7b362a2f46d800ed8000a9d2907214b36fbc5e466311264d736010d805875794
SHA512 a55cab123084e894608223f4389e3dd8c252573de3c2fd0a04540a77947df96edbc2af3204ed4d38e8a4e50d6eac5b569b58cae183eb4d0b5b28ddd924096100

C:\Program Files (x86)\Microsoft\EdgeCore\90.0.818.66\Extensions\external_extensions.json

MD5 9fd31c130c1833b4c725cedba8b74442
SHA1 e856167dd032b8828c0ae2a3840f8fe1c26290ec
SHA256 8b4d3837f83e79629e9e335a2b4a8cebb7d310af7c728a7bc598ba7a61d5915d
SHA512 338879c0995642f9d61fd940dbec6bfbe33615d9681ee17ba2cb63613b95aa50f4d384040d5abc6c395c93202fc0cff94829a5d93913954a9f95087dbb99c54b

C:\Users\Admin\AppData\Local\Packages\E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy\Settings\settings.dat

MD5 38eae504e2c827c36d230077519a0390
SHA1 d31845d98301be217cd340abd7475467de13834f
SHA256 984bca1617a2d3efe013dfe7fa58044c1624e073edb333d664abd775681fd949
SHA512 ec2e02a743b69bde02413044d7b47c8fab5d1fac7eab49363c76591bfadadba126a458614985af99cc378ce4abeff0c0e59cd507f580093362edfd6a8b2213e8

C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AppData\CacheStorage\Files4\NYYYO7F4_1\T6B0HK8G_2\2M6XA65WAN_30

MD5 add2d7fce9ac13639f3346fc0582f7e5
SHA1 7dace4d0ad6837604ffdc9535402bbd064014ff1
SHA256 24199703486ab4fa3b17522b7047f69bcc1055cf03a14b01c6b4985801a45185
SHA512 aacbea74b4132dc110c0e613e53a00ab8fe853784cc0355b5b5bd68991969387f62a0ebe3bdb955865d22e2665fbea6db4c168a72600ec08af665e453a7565d0

C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{66596a95-fe46-47d2-bffe-07008645ffe2}\0.2.filtertrie.intermediate.txt

MD5 15344bc62f87e0379c170c046f73915e
SHA1 cf6bdae846a1ef3dc33a423d7b56c77b9c0bf5b3
SHA256 1bb16d5540e93b9adea6e7f7909c56e7acd7bb1deadd9ed4bd2cda2bfe32abef
SHA512 6c0fcd8bd9cbe27389e796f9a13449a9851042fdb1d3a613114246ed67bd4142cd88f7ed2f82efb3cfa671cca3cc946c8ec810db00dcc291a0edd938cfc270ca

C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{66596a95-fe46-47d2-bffe-07008645ffe2}\0.1.filtertrie.intermediate.txt

MD5 2831cb0c8715e3576617161ca3ffe98e
SHA1 12bc63b5eaa846a49032f5e70004099f528c8ca8
SHA256 1969b9c32e8335b3c36cf90980b52700ca7ec7d65800108a5a1ab46d146296af
SHA512 0f9883e8369338ba0ed6cd5a844c9bed7548bc0fae34ac914ca4d3110e653c496384cbb2a9d4439c06c56ec8aea6bc2cc057c954b53849903d2d35f7f930e060

C:\Users\Admin\AppData\Local\Temp\wctB8C2.tmp

MD5 8f0fd83323a91eba939a917073131760
SHA1 54359d78dd7697dde2429ffd27d0f674032d9d98
SHA256 edbd0d41549008cad89e794a553b3c59e74688821a472eb09843ef7cac83da5f
SHA512 ee4276b16b4cd8d43e3563a28740b4c51393141c82f7f3bf2037228738d104df55755c2358f0fda3dcf1606c34630552cd0c4e5efbdee462fa858dbb5b862331

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A

MD5 3e3e90cfba6d56e57973136b5a2ad942
SHA1 e8c2389ffcee0019a9ab2940fa9fa9e192fad9a3
SHA256 187d513056bca465bad106b8d39ea5ade851e433b5038a40d60e9517c4165abe
SHA512 7a66330bfc7f3cf7c3e2fcdb1d7f8247a4eaff5f0193e9a35b85d1230a82d6cbec8f01616b436d67185f0c02df9f518ac17c1ade02ebb483d19c1c2ee2ecec47

C:\vcredist2010_x86.log.html

MD5 342cc2a47abfaf8564f4b1348705f830
SHA1 fae43aff630c2c8a0ed1c1c66dbde07fc536fda3
SHA256 60b118c3390039411f9c85cf2eaea304adb821471ca6826074570f0570eb54fd
SHA512 2cb6fa1eb0c54cc52a81a11e21c514dd2278ee5963fee76c52118b3b7d76aa5d7da22a0027e2ee92740d1373d2446520e7e88b3be7ad5ced193725c62d9c601b

Analysis: behavioral1

Detonation Overview

Submitted

2024-09-29 03:40

Reported

2024-09-29 03:41

Platform

win7-20240708-en

Max time kernel

30s

Max time network

31s

Command Line

C:\Windows\Explorer.EXE

Signatures

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Mars Stealer

stealer marsstealer

Modifies security service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4" C:\Windows\sysklnorbcv.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4" C:\Windows\sysblvrvcr.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4" C:\Windows\sysarddrvs.exe N/A

Phorphiex payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Phorphiex, Phorpiex

worm trojan loader phorphiex

RagnarLocker

ransomware ragnarlocker

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\sysklnorbcv.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\sysblvrvcr.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\sysblvrvcr.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1" C:\Windows\sysblvrvcr.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1" C:\Windows\sysarddrvs.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\sysblvrvcr.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\sysarddrvs.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\sysarddrvs.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\sysklnorbcv.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1" C:\Windows\sysklnorbcv.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\sysklnorbcv.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\sysarddrvs.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\sysarddrvs.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\sysklnorbcv.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\sysklnorbcv.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\sysblvrvcr.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\sysblvrvcr.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\sysarddrvs.exe N/A

Xworm

trojan rat xworm

xmrig

miner xmrig

Deletes shadow copies

ransomware defense_evasion impact execution

Renames multiple (7830) files with added filename extension

ransomware

XMRig Miner payload

miner
Description Indicator Process Target
N/A N/A N/A N/A

Downloads MZ/PE file

Stops running service(s)

evasion execution

Credentials from Password Stores: Windows Credential Manager

credential_access stealer

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\RGNR_4A38E1C8.txt C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\817c058e.exe C:\Windows\syswow64\explorer.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a76e49df84ba2a7b33e8ea959995b5e6faecb90d551ef169d8272ce9042c35a5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\CryptoWall.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\25.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\24.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\22.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\23.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\21.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\20.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\18.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\16.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\19.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\17.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\15.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\14.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\13.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\12.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\11.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\10.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\8.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\6.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\2.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Files\peinf.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Files\nxmr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Files\r.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Files\npp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Files\66e8772555389_lsndfsg.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Files\tdrpload.exe N/A
N/A N/A C:\Windows\sysklnorbcv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Files\11.exe N/A
N/A N/A C:\Windows\sysblvrvcr.exe N/A
N/A N/A C:\Windows\sysarddrvs.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\284718698.exe N/A
N/A N/A C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\PCCooker_x64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PCCooker_x64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PCCooker_x64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PCCooker_x64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PCCooker_x64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PCCooker_x64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\PCCooker_x64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Windows\SysWOW64\WerFault.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Files\npp.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Files\npp.exe N/A
N/A N/A C:\Windows\system32\taskeng.exe N/A

Reads user/profile data of web browsers

spyware stealer

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\sysklnorbcv.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\sysblvrvcr.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1" C:\Windows\sysblvrvcr.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\sysblvrvcr.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\sysarddrvs.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiSpywareOverride = "1" C:\Windows\sysblvrvcr.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\sysblvrvcr.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\sysarddrvs.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\sysarddrvs.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\sysarddrvs.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\sysklnorbcv.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiSpywareOverride = "1" C:\Windows\sysklnorbcv.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1" C:\Windows\sysklnorbcv.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" C:\Windows\sysblvrvcr.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1" C:\Windows\sysarddrvs.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\sysklnorbcv.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" C:\Windows\sysklnorbcv.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" C:\Windows\sysklnorbcv.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" C:\Windows\sysblvrvcr.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" C:\Windows\sysarddrvs.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiSpywareOverride = "1" C:\Windows\sysarddrvs.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\817c058 = "C:\\817c058e\\817c058e.exe" C:\Windows\syswow64\explorer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\*17c058 = "C:\\817c058e\\817c058e.exe" C:\Windows\syswow64\explorer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\817c058e = "C:\\Users\\Admin\\AppData\\Roaming\\817c058e.exe" C:\Windows\syswow64\explorer.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\*17c058e = "C:\\Users\\Admin\\AppData\\Roaming\\817c058e.exe" C:\Windows\syswow64\explorer.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sysklnorbcv.exe" C:\Users\Admin\AppData\Local\Temp\Files\r.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sysblvrvcr.exe" C:\Users\Admin\AppData\Local\Temp\Files\tdrpload.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sysarddrvs.exe" C:\Users\Admin\AppData\Local\Temp\Files\11.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\asena.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-addr.es N/A N/A
N/A myexternalip.com N/A N/A
N/A ip-api.com N/A N/A
N/A ip-api.com N/A N/A
N/A ip-api.com N/A N/A

Writes to the Master Boot Record (MBR)

bootkit persistence
Description Indicator Process Target
File opened for modification \??\PHYSICALDRIVE0 C:\Users\Admin\AppData\Local\Temp\asena.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3492 set thread context of 3460 N/A C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe C:\Windows\System32\conhost.exe
PID 3492 set thread context of 4940 N/A C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe C:\Windows\System32\dwm.exe

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0293828.WMF C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD10290_.GIF C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\SIGN98.POC C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_few-showers.png C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\META-INF\RGNR_4A38E1C8.txt C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File created C:\Program Files\VideoLAN\VLC\locale\cy\RGNR_4A38E1C8.txt C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_blue_snow.png C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00837_.WMF C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0285820.WMF C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\EXITEML.ICO C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\RSSITEM.CFG C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\settings.html C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InkWatson.exe.mui C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\RGNR_4A38E1C8.txt C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\WET C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\js\RGNR_4A38E1C8.txt C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\js\clock.js C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\OLADD.FAE C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.CO.KR.XML C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\29.png C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\London C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\29.png C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BS00445_.WMF C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUB6INTL.REST.IDX_DLL C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14869_.GIF C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Full\full.png C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Luxembourg C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-application-views.xml C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\es-ES\msinfo32.exe.mui C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\SIGNHM.POC C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Noumea C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\MST7 C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\RGNR_4A38E1C8.txt C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\NEWS.DPV C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\OFFICE10.MMW C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\WORDREP.XML C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\deploy\messages_pt_BR.properties C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\Windows Mail\en-US\WinMail.exe.mui C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\Windows NT\TableTextService\es-ES\TableTextService.dll.mui C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD00586_.WMF C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\as80.xsl C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\BIZCARD.DPV C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ADVZIP.DIC C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\InkWatson.exe.mui C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\Windows Journal\es-ES\PDIALOG.exe.mui C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EVRGREEN\EVRGREEN.ELM C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA00494_.WMF C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File created C:\Program Files (x86)\Common Files\System\en-US\RGNR_4A38E1C8.txt C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00158_.GIF C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0136865.WMF C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\14.png C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\Microsoft Games\More Games\ja-JP\MoreGames.dll.mui C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\graph_over.png C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\RGNR_4A38E1C8.txt C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\THEMES.INF C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsplk.xml C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\San_Juan C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE01661_.WMF C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Horizon.xml C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\STUDIO\PREVIEW.GIF C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\Sounds\People\MMHMM.WAV C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSPPT.OLB C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\calendar.html C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.swt.nl_ja_4.4.0.v20140623020002.jar C:\Users\Admin\AppData\Local\Temp\asena.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\sysklnorbcv.exe C:\Users\Admin\AppData\Local\Temp\Files\r.exe N/A
File created C:\Windows\sysblvrvcr.exe C:\Users\Admin\AppData\Local\Temp\Files\tdrpload.exe N/A
File opened for modification C:\Windows\sysblvrvcr.exe C:\Users\Admin\AppData\Local\Temp\Files\tdrpload.exe N/A
File created C:\Windows\sysarddrvs.exe C:\Users\Admin\AppData\Local\Temp\Files\11.exe N/A
File opened for modification C:\Windows\sysarddrvs.exe C:\Users\Admin\AppData\Local\Temp\Files\11.exe N/A
File created C:\Windows\sysklnorbcv.exe C:\Users\Admin\AppData\Local\Temp\Files\r.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\Files\r.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\Files\npp.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\Files\11.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\notepad.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\PCCooker_x64.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\asena.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\syswow64\explorer.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\syswow64\vssadmin.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\sysklnorbcv.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\Files\tdrpload.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\sysarddrvs.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\CryptoWall.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\Files\66e8772555389_lsndfsg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\a76e49df84ba2a7b33e8ea959995b5e6faecb90d551ef169d8272ce9042c35a5.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\syswow64\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\sysblvrvcr.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\sc.exe N/A

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\vssadmin.exe N/A
N/A N/A C:\Windows\syswow64\vssadmin.exe N/A

Opens file in notepad (likely ransom note)

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\notepad.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\CryptoWall.exe N/A
N/A N/A C:\Windows\syswow64\explorer.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\wmic.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\25.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\24.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\22.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\23.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\21.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\20.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\18.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\16.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\17.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\19.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\15.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\14.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\12.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\13.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\10.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\11.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\9.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\6.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\System32\dwm.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Windows\System32\dwm.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2740 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Local\Temp\PCCooker_x64.exe C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe
PID 2740 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Local\Temp\PCCooker_x64.exe C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe
PID 2740 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Local\Temp\PCCooker_x64.exe C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe
PID 2740 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Local\Temp\PCCooker_x64.exe C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe
PID 2740 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Temp\PCCooker_x64.exe C:\Users\Admin\AppData\Local\Temp\a76e49df84ba2a7b33e8ea959995b5e6faecb90d551ef169d8272ce9042c35a5.exe
PID 2740 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Temp\PCCooker_x64.exe C:\Users\Admin\AppData\Local\Temp\a76e49df84ba2a7b33e8ea959995b5e6faecb90d551ef169d8272ce9042c35a5.exe
PID 2740 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Temp\PCCooker_x64.exe C:\Users\Admin\AppData\Local\Temp\a76e49df84ba2a7b33e8ea959995b5e6faecb90d551ef169d8272ce9042c35a5.exe
PID 2740 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Temp\PCCooker_x64.exe C:\Users\Admin\AppData\Local\Temp\a76e49df84ba2a7b33e8ea959995b5e6faecb90d551ef169d8272ce9042c35a5.exe
PID 2740 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\PCCooker_x64.exe C:\Users\Admin\AppData\Local\Temp\asena.exe
PID 2740 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\PCCooker_x64.exe C:\Users\Admin\AppData\Local\Temp\asena.exe
PID 2740 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\PCCooker_x64.exe C:\Users\Admin\AppData\Local\Temp\asena.exe
PID 2740 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\PCCooker_x64.exe C:\Users\Admin\AppData\Local\Temp\asena.exe
PID 2740 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Local\Temp\PCCooker_x64.exe C:\Users\Admin\AppData\Local\Temp\Bomb.exe
PID 2740 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Local\Temp\PCCooker_x64.exe C:\Users\Admin\AppData\Local\Temp\Bomb.exe
PID 2740 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Local\Temp\PCCooker_x64.exe C:\Users\Admin\AppData\Local\Temp\Bomb.exe
PID 2740 wrote to memory of 2824 N/A C:\Users\Admin\AppData\Local\Temp\PCCooker_x64.exe C:\Users\Admin\AppData\Local\Temp\Bomb.exe
PID 2740 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\PCCooker_x64.exe C:\Users\Admin\AppData\Local\Temp\CryptoWall.exe
PID 2740 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\PCCooker_x64.exe C:\Users\Admin\AppData\Local\Temp\CryptoWall.exe
PID 2740 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\PCCooker_x64.exe C:\Users\Admin\AppData\Local\Temp\CryptoWall.exe
PID 2740 wrote to memory of 2580 N/A C:\Users\Admin\AppData\Local\Temp\PCCooker_x64.exe C:\Users\Admin\AppData\Local\Temp\CryptoWall.exe
PID 2564 wrote to memory of 2568 N/A C:\Users\Admin\AppData\Local\Temp\asena.exe C:\Windows\System32\Wbem\wmic.exe
PID 2564 wrote to memory of 2568 N/A C:\Users\Admin\AppData\Local\Temp\asena.exe C:\Windows\System32\Wbem\wmic.exe
PID 2564 wrote to memory of 2568 N/A C:\Users\Admin\AppData\Local\Temp\asena.exe C:\Windows\System32\Wbem\wmic.exe
PID 2564 wrote to memory of 2568 N/A C:\Users\Admin\AppData\Local\Temp\asena.exe C:\Windows\System32\Wbem\wmic.exe
PID 2564 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\asena.exe C:\Windows\system32\vssadmin.exe
PID 2564 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\asena.exe C:\Windows\system32\vssadmin.exe
PID 2564 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\asena.exe C:\Windows\system32\vssadmin.exe
PID 2564 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\asena.exe C:\Windows\system32\vssadmin.exe
PID 2580 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Local\Temp\CryptoWall.exe C:\Windows\syswow64\explorer.exe
PID 2580 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Local\Temp\CryptoWall.exe C:\Windows\syswow64\explorer.exe
PID 2580 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Local\Temp\CryptoWall.exe C:\Windows\syswow64\explorer.exe
PID 2580 wrote to memory of 2556 N/A C:\Users\Admin\AppData\Local\Temp\CryptoWall.exe C:\Windows\syswow64\explorer.exe
PID 2556 wrote to memory of 2084 N/A C:\Windows\syswow64\explorer.exe C:\Windows\syswow64\svchost.exe
PID 2556 wrote to memory of 2084 N/A C:\Windows\syswow64\explorer.exe C:\Windows\syswow64\svchost.exe
PID 2556 wrote to memory of 2084 N/A C:\Windows\syswow64\explorer.exe C:\Windows\syswow64\svchost.exe
PID 2556 wrote to memory of 2084 N/A C:\Windows\syswow64\explorer.exe C:\Windows\syswow64\svchost.exe
PID 2556 wrote to memory of 2272 N/A C:\Windows\syswow64\explorer.exe C:\Windows\syswow64\vssadmin.exe
PID 2556 wrote to memory of 2272 N/A C:\Windows\syswow64\explorer.exe C:\Windows\syswow64\vssadmin.exe
PID 2556 wrote to memory of 2272 N/A C:\Windows\syswow64\explorer.exe C:\Windows\syswow64\vssadmin.exe
PID 2556 wrote to memory of 2272 N/A C:\Windows\syswow64\explorer.exe C:\Windows\syswow64\vssadmin.exe
PID 2824 wrote to memory of 628 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\25.exe
PID 2824 wrote to memory of 628 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\25.exe
PID 2824 wrote to memory of 628 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\25.exe
PID 2824 wrote to memory of 1800 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\24.exe
PID 2824 wrote to memory of 1800 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\24.exe
PID 2824 wrote to memory of 1800 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\24.exe
PID 2824 wrote to memory of 1092 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\23.exe
PID 2824 wrote to memory of 1092 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\23.exe
PID 2824 wrote to memory of 1092 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\23.exe
PID 2824 wrote to memory of 1280 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\22.exe
PID 2824 wrote to memory of 1280 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\22.exe
PID 2824 wrote to memory of 1280 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\22.exe
PID 2824 wrote to memory of 1372 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\21.exe
PID 2824 wrote to memory of 1372 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\21.exe
PID 2824 wrote to memory of 1372 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\21.exe
PID 2824 wrote to memory of 696 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\20.exe
PID 2824 wrote to memory of 696 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\20.exe
PID 2824 wrote to memory of 696 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\20.exe
PID 2824 wrote to memory of 2328 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\19.exe
PID 2824 wrote to memory of 2328 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\19.exe
PID 2824 wrote to memory of 2328 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\19.exe
PID 2824 wrote to memory of 3036 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\18.exe
PID 2824 wrote to memory of 3036 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\18.exe
PID 2824 wrote to memory of 3036 N/A C:\Users\Admin\AppData\Local\Temp\Bomb.exe C:\Users\Admin\AppData\Local\Temp\18.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\PCCooker_x64.exe

"C:\Users\Admin\AppData\Local\Temp\PCCooker_x64.exe"

C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe

"C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"

C:\Users\Admin\AppData\Local\Temp\a76e49df84ba2a7b33e8ea959995b5e6faecb90d551ef169d8272ce9042c35a5.exe

"C:\Users\Admin\AppData\Local\Temp\a76e49df84ba2a7b33e8ea959995b5e6faecb90d551ef169d8272ce9042c35a5.exe"

C:\Users\Admin\AppData\Local\Temp\asena.exe

"C:\Users\Admin\AppData\Local\Temp\asena.exe"

C:\Users\Admin\AppData\Local\Temp\Bomb.exe

"C:\Users\Admin\AppData\Local\Temp\Bomb.exe"

C:\Users\Admin\AppData\Local\Temp\CryptoWall.exe

"C:\Users\Admin\AppData\Local\Temp\CryptoWall.exe"

C:\Windows\syswow64\explorer.exe

"C:\Windows\syswow64\explorer.exe"

C:\Windows\System32\Wbem\wmic.exe

wmic.exe shadowcopy delete

C:\Windows\system32\vssadmin.exe

vssadmin delete shadows /all /quiet

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\syswow64\svchost.exe

-k netsvcs

C:\Windows\syswow64\vssadmin.exe

vssadmin.exe Delete Shadows /All /Quiet

C:\Users\Admin\AppData\Local\Temp\25.exe

"C:\Users\Admin\AppData\Local\Temp\25.exe"

C:\Users\Admin\AppData\Local\Temp\24.exe

"C:\Users\Admin\AppData\Local\Temp\24.exe"

C:\Users\Admin\AppData\Local\Temp\23.exe

"C:\Users\Admin\AppData\Local\Temp\23.exe"

C:\Users\Admin\AppData\Local\Temp\22.exe

"C:\Users\Admin\AppData\Local\Temp\22.exe"

C:\Users\Admin\AppData\Local\Temp\21.exe

"C:\Users\Admin\AppData\Local\Temp\21.exe"

C:\Users\Admin\AppData\Local\Temp\20.exe

"C:\Users\Admin\AppData\Local\Temp\20.exe"

C:\Users\Admin\AppData\Local\Temp\19.exe

"C:\Users\Admin\AppData\Local\Temp\19.exe"

C:\Users\Admin\AppData\Local\Temp\18.exe

"C:\Users\Admin\AppData\Local\Temp\18.exe"

C:\Users\Admin\AppData\Local\Temp\17.exe

"C:\Users\Admin\AppData\Local\Temp\17.exe"

C:\Users\Admin\AppData\Local\Temp\16.exe

"C:\Users\Admin\AppData\Local\Temp\16.exe"

C:\Users\Admin\AppData\Local\Temp\15.exe

"C:\Users\Admin\AppData\Local\Temp\15.exe"

C:\Users\Admin\AppData\Local\Temp\14.exe

"C:\Users\Admin\AppData\Local\Temp\14.exe"

C:\Users\Admin\AppData\Local\Temp\13.exe

"C:\Users\Admin\AppData\Local\Temp\13.exe"

C:\Users\Admin\AppData\Local\Temp\12.exe

"C:\Users\Admin\AppData\Local\Temp\12.exe"

C:\Users\Admin\AppData\Local\Temp\11.exe

"C:\Users\Admin\AppData\Local\Temp\11.exe"

C:\Users\Admin\AppData\Local\Temp\10.exe

"C:\Users\Admin\AppData\Local\Temp\10.exe"

C:\Users\Admin\AppData\Local\Temp\9.exe

"C:\Users\Admin\AppData\Local\Temp\9.exe"

C:\Users\Admin\AppData\Local\Temp\8.exe

"C:\Users\Admin\AppData\Local\Temp\8.exe"

C:\Users\Admin\AppData\Local\Temp\7.exe

"C:\Users\Admin\AppData\Local\Temp\7.exe"

C:\Users\Admin\AppData\Local\Temp\6.exe

"C:\Users\Admin\AppData\Local\Temp\6.exe"

C:\Users\Admin\AppData\Local\Temp\5.exe

"C:\Users\Admin\AppData\Local\Temp\5.exe"

C:\Users\Admin\AppData\Local\Temp\4.exe

"C:\Users\Admin\AppData\Local\Temp\4.exe"

C:\Users\Admin\AppData\Local\Temp\3.exe

"C:\Users\Admin\AppData\Local\Temp\3.exe"

C:\Users\Admin\AppData\Local\Temp\2.exe

"C:\Users\Admin\AppData\Local\Temp\2.exe"

C:\Users\Admin\AppData\Local\Temp\1.exe

"C:\Users\Admin\AppData\Local\Temp\1.exe"

C:\Users\Admin\AppData\Local\Temp\Files\peinf.exe

"C:\Users\Admin\AppData\Local\Temp\Files\peinf.exe"

C:\Users\Admin\AppData\Local\Temp\Files\nxmr.exe

"C:\Users\Admin\AppData\Local\Temp\Files\nxmr.exe"

C:\Users\Admin\AppData\Local\Temp\Files\r.exe

"C:\Users\Admin\AppData\Local\Temp\Files\r.exe"

C:\Users\Admin\AppData\Local\Temp\Files\npp.exe

"C:\Users\Admin\AppData\Local\Temp\Files\npp.exe"

C:\Users\Admin\AppData\Local\Temp\Files\66e8772555389_lsndfsg.exe

"C:\Users\Admin\AppData\Local\Temp\Files\66e8772555389_lsndfsg.exe"

C:\Users\Admin\AppData\Local\Temp\Files\tdrpload.exe

"C:\Users\Admin\AppData\Local\Temp\Files\tdrpload.exe"

C:\Windows\sysklnorbcv.exe

C:\Windows\sysklnorbcv.exe

C:\Users\Admin\AppData\Local\Temp\Files\11.exe

"C:\Users\Admin\AppData\Local\Temp\Files\11.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4100 -s 556

C:\Windows\sysblvrvcr.exe

C:\Windows\sysblvrvcr.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#evrkcgqew#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Microsoft Windows Security' /tr '''C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Microsoft Windows Security' -RunLevel 'Highest' -Force; }

C:\Windows\sysarddrvs.exe

C:\Windows\sysarddrvs.exe

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"

C:\Windows\SysWOW64\sc.exe

sc stop UsoSvc

C:\Windows\SysWOW64\sc.exe

sc stop WaaSMedicSvc

C:\Windows\SysWOW64\sc.exe

sc stop wuauserv

C:\Windows\SysWOW64\sc.exe

sc stop DoSvc

C:\Windows\SysWOW64\sc.exe

sc stop BITS

C:\Users\Admin\AppData\Local\Temp\284718698.exe

C:\Users\Admin\AppData\Local\Temp\284718698.exe

C:\Windows\system32\schtasks.exe

"C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /tn "Microsoft Windows Security" /tr "'C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe'"

C:\Windows\System32\schtasks.exe

C:\Windows\System32\schtasks.exe /run /tn "Microsoft Windows Security"

C:\Windows\system32\taskeng.exe

taskeng.exe {5FA97DB1-9E67-4B03-8A4B-D550D6D780E7} S-1-5-21-3551809350-4263495960-1443967649-1000:NNYJZAHP\Admin:Interactive:[1]

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS /wait

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "1929688580656377976-295824043-1382859206-1683566219-216522869-1466335992-2073643159"

C:\Windows\SysWOW64\sc.exe

sc stop UsoSvc

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"

C:\Windows\SysWOW64\sc.exe

sc stop WaaSMedicSvc

C:\Windows\SysWOW64\sc.exe

sc stop wuauserv

C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe

"C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe"

C:\Windows\SysWOW64\sc.exe

sc stop DoSvc

C:\Windows\SysWOW64\sc.exe

sc stop BITS /wait

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "14630793053598072418059618817862058281905627898-2050079385221972120-1207914239"

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "1685714872-170731794-9543617591699560818145881411054327875236826053-339629342"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"

C:\Windows\SysWOW64\sc.exe

sc stop UsoSvc

C:\Windows\SysWOW64\sc.exe

sc stop WaaSMedicSvc

C:\Windows\SysWOW64\sc.exe

sc stop wuauserv

C:\Windows\SysWOW64\sc.exe

sc stop DoSvc

C:\Windows\SysWOW64\sc.exe

sc stop BITS

C:\Windows\SysWOW64\notepad.exe

C:\Users\Public\Documents\RGNR_4A38E1C8.txt

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#evrkcgqew#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Microsoft Windows Security' /tr '''C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Microsoft Windows Security' -RunLevel 'Highest' -Force; }

C:\Windows\system32\schtasks.exe

"C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /tn "Microsoft Windows Security" /tr "'C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe'"

C:\Windows\System32\conhost.exe

C:\Windows\System32\conhost.exe

C:\Windows\System32\dwm.exe

C:\Windows\System32\dwm.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\12.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\6.exe'

Network

Country Destination Domain Proto
US 8.8.8.8:53 ip-addr.es udp
FR 188.165.164.184:80 ip-addr.es tcp
US 8.8.8.8:53 myexternalip.com udp
US 34.160.111.145:80 myexternalip.com tcp
FR 94.247.28.26:2525 tcp
US 8.8.8.8:53 urlhaus.abuse.ch udp
US 151.101.130.49:443 urlhaus.abuse.ch tcp
US 8.8.8.8:53 aiiaiafrzrueuedur.net udp
RU 185.215.113.66:80 aiiaiafrzrueuedur.net tcp
US 8.8.8.8:53 d38c6492-db8a-468e-9680-b62c6443b8b0.random.aefiabeuodbauobfafoebbf.net udp
RU 185.215.113.66:80 d38c6492-db8a-468e-9680-b62c6443b8b0.random.aefiabeuodbauobfafoebbf.net tcp
US 8.8.8.8:53 ip-api.com udp
US 8.8.8.8:53 ip-api.com udp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 208.95.112.1:80 ip-api.com tcp
US 208.95.112.1:80 ip-api.com tcp
US 208.95.112.1:80 ip-api.com tcp
US 208.95.112.1:80 ip-api.com tcp
US 208.95.112.1:80 ip-api.com tcp
US 208.95.112.1:80 ip-api.com tcp
US 208.95.112.1:80 ip-api.com tcp
US 208.95.112.1:80 ip-api.com tcp
US 208.95.112.1:80 ip-api.com tcp
US 208.95.112.1:80 ip-api.com tcp
US 208.95.112.1:80 ip-api.com tcp
US 208.95.112.1:80 ip-api.com tcp
US 208.95.112.1:80 ip-api.com tcp
US 208.95.112.1:80 ip-api.com tcp
US 208.95.112.1:80 ip-api.com tcp
US 208.95.112.1:80 ip-api.com tcp
US 208.95.112.1:80 ip-api.com tcp
US 208.95.112.1:80 ip-api.com tcp
US 208.95.112.1:80 ip-api.com tcp
US 208.95.112.1:80 ip-api.com tcp
US 208.95.112.1:80 ip-api.com tcp
US 208.95.112.1:80 ip-api.com tcp
US 208.95.112.1:80 ip-api.com tcp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 app.aefiabeuodbauobfafoebbf.net udp
RU 185.215.113.66:80 app.aefiabeuodbauobfafoebbf.net tcp
US 8.8.8.8:53 demo.aefiabeuodbauobfafoebbf.net udp
RU 185.215.113.66:80 demo.aefiabeuodbauobfafoebbf.net tcp
CH 147.45.44.104:80 147.45.44.104 tcp
US 8.8.8.8:53 aefiabeuodbauobfafoebbf.net udp
RU 185.215.113.66:80 aefiabeuodbauobfafoebbf.net tcp
US 8.8.8.8:53 9d4e04ce-a517-4d13-a463-30c7edb00ca5.random.aefiabeuodbauobfafoebbf.net udp
RU 185.215.113.66:80 9d4e04ce-a517-4d13-a463-30c7edb00ca5.random.aefiabeuodbauobfafoebbf.net tcp
CN 121.40.100.23:12616 tcp
US 8.8.8.8:53 twizt.net udp
RU 185.215.113.66:80 twizt.net tcp
US 8.8.8.8:53 kenesrakishev.net udp
US 3.33.251.168:80 kenesrakishev.net tcp
RU 185.215.113.66:80 twizt.net tcp
RU 185.215.113.66:80 twizt.net tcp
RU 185.215.113.66:80 twizt.net tcp
RU 185.215.113.66:80 twizt.net tcp
RU 185.215.113.66:80 twizt.net tcp
RU 185.215.113.66:80 twizt.net tcp
US 209.148.85.151:8080 tcp
US 8.8.8.8:53 twizthash.net udp
RU 185.215.113.66:5152 twizthash.net tcp

Files

memory/2740-0-0x0000000074BC1000-0x0000000074BC2000-memory.dmp

memory/2740-1-0x0000000074BC0000-0x000000007516B000-memory.dmp

memory/2740-2-0x0000000074BC0000-0x000000007516B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe

MD5 2a94f3960c58c6e70826495f76d00b85
SHA1 e2a1a5641295f5ebf01a37ac1c170ac0814bb71a
SHA256 2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce
SHA512 fbf55b55fcfb12eb8c029562956229208b9e8e2591859d6336c28a590c92a4d0f7033a77c46ef6ebe07ddfca353aba1e84b51907cd774beab148ee901c92d62f

C:\Users\Admin\AppData\Local\Temp\asena.exe

MD5 7529e3c83618f5e3a4cc6dbf3a8534a6
SHA1 0f944504eebfca5466b6113853b0d83e38cf885a
SHA256 ec35c76ad2c8192f09c02eca1f263b406163470ca8438d054db7adcf5bfc0597
SHA512 7eef97937cc1e3afd3fca0618328a5b6ecb72123a199739f6b1b972dd90e01e07492eb26352ee00421d026c63af48973c014bdd76d95ea841eb2fefd613631cc

memory/2800-29-0x0000000000400000-0x000000000043D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\a76e49df84ba2a7b33e8ea959995b5e6faecb90d551ef169d8272ce9042c35a5.exe

MD5 6f8e78dd0f22b61244bb69827e0dbdc3
SHA1 1884d9fd265659b6bd66d980ca8b776b40365b87
SHA256 a76e49df84ba2a7b33e8ea959995b5e6faecb90d551ef169d8272ce9042c35a5
SHA512 5611a83616380f55e7b42bb0eef35d65bd43ca5f96bf77f343fc9700e7dfaa7dcf4f6ecbb2349ac9df6ab77edd1051b9b0f7a532859422302549f5b81004632d

\Users\Admin\AppData\Local\Temp\CryptoWall.exe

MD5 919034c8efb9678f96b47a20fa6199f2
SHA1 747070c74d0400cffeb28fbea17b64297f14cfbd
SHA256 e036d68b8f8b7afc6c8b6252876e1e290f11a26d4ad18ac6f310662845b2c734
SHA512 745a81c50bbfd62234edb9788c83a22e0588c5d25c00881901923a02d7096c71ef5f0cd5b73f92ad974e5174de064b0c5ea8044509039aab14b2aed83735a7c4

C:\Users\Admin\AppData\Local\Temp\Bomb.exe

MD5 31f03a8fe7561da18d5a93fc3eb83b7d
SHA1 31b31af35e6eed00e98252e953e623324bd64dde
SHA256 2027197f05dac506b971b3bd2708996292e6ffad661affe9a0138f52368cc84d
SHA512 3ea7c13a0aa67c302943c6527856004f8d871fe146150096bc60855314f23eae6f507f8c941fd7e8c039980810929d4930fcf9c597857d195f8c93e3cc94c41d

memory/2740-28-0x0000000004790000-0x00000000047CD000-memory.dmp

memory/2740-27-0x0000000004790000-0x00000000047CD000-memory.dmp

memory/2556-45-0x0000000000080000-0x00000000000A5000-memory.dmp

memory/2704-48-0x00000000002D0000-0x00000000002D8000-memory.dmp

memory/2824-51-0x0000000000B10000-0x0000000000B88000-memory.dmp

memory/2084-52-0x00000000000C0000-0x00000000000E5000-memory.dmp

C:\Users\Public\Documents\RGNR_4A38E1C8.txt

MD5 0880547340d1b849a7d4faaf04b6f905
SHA1 37fa5848977fd39df901be01c75b8f8320b46322
SHA256 84449f1e874b763619271a57bfb43bd06e9c728c6c6f51317c56e9e94e619b25
SHA512 9048a3d5ab7472c1daa1efe4a35d559fc069051a5eb4b8439c2ef25318b4de6a6c648a7db595e7ae76f215614333e3f06184eb18b2904aace0c723f8b9c35a91

C:\Program Files\Java\jdk1.7.0_80\db\bin\NetworkServerControl

MD5 44cf006c2e5d9b09dd6246e60ac5b390
SHA1 2690ab79f86f50be323be488287f4426068f5abe
SHA256 48025c9dea2b5358a077caa7fc4b2f0b3609ecc7d5b846155d8e4b9837c4dc51
SHA512 b2162a32cceed83a2f5476f78ac66d70a9b42d55929dd00c7087d8ffc7a3a134bf151a86f72089984cce346f33b1ece69e3ce975c9b7c198dd3f70717c7e0672

C:\Users\Admin\AppData\Local\Temp\25.exe

MD5 476d959b461d1098259293cfa99406df
SHA1 ad5091a232b53057968f059d18b7cfe22ce24aab
SHA256 47f2a0b4b54b053563ba60d206f1e5bd839ab60737f535c9b5c01d64af119f90
SHA512 9c5284895072d032114429482ccc9b62b073447de35de2d391f6acad53e3d133810b940efb1ed17d8bd54d24fce0af6446be850c86766406e996019fcc3a4e6e

C:\Users\Admin\AppData\Local\Temp\23.exe

MD5 7e87c49d0b787d073bf9d687b5ec5c6f
SHA1 6606359f4d88213f36c35b3ec9a05df2e2e82b4e
SHA256 d811283c4e4c76cb1ce3f23528e542cff4747af033318f42b9f2deb23180c4af
SHA512 926d676186ec0b58b852ee0b41f171729b908a5be9ce5a791199d6d41f01569bcdc1fddd067f41bddf5cdde72b8291c4b4f65983ba318088a4d2d5d5f5cd53af

C:\Users\Admin\AppData\Local\Temp\22.exe

MD5 296bcd1669b77f8e70f9e13299de957e
SHA1 8458af00c5e9341ad8c7f2d0e914e8b924981e7e
SHA256 6f05cae614ca0e4751b2aaceea95716fd37a6bf3fae81ff1c565313b30b1aba2
SHA512 4e58a0f063407aed64c1cb59e4f46c20ff5b9391a02ceff9561456fef1252c1cdd0055417a57d6e946ec7b5821963c1e96eaf1dd750a95ca9136764443df93d7

C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif

MD5 caf29626b38d7c25b6477afd6b5da105
SHA1 6966d41c9b3a3ce9de33006db068c48203e74977
SHA256 adb74b8832bc98422bfcbd8da95ad66f627425cd7fff0a941cc5af02e4a6d705
SHA512 fc2beac3181239f4a38d451193892a56e76a841f0eafdf4340125aa455887b9f8fe30507382b9b7727162ef29b8601a6adb6af278e933cb19c3d2f8dca3643d6

C:\Users\Admin\AppData\Local\Temp\24.exe

MD5 042dfd075ab75654c3cf54fb2d422641
SHA1 d7f6ac6dc57e0ec7193beb74639fe92d8cd1ecb9
SHA256 b91fb228051f1720427709ff849048bfd01388d98335e4766cd1c4808edc5136
SHA512 fada24d6b3992f39119fe8e51b8da1f6a6ca42148a0c21e61255643e976fde52076093403ccbc4c7cd2f62ccb3cdedd9860f2ac253bb5082fb9fe8f31d88200d

memory/628-917-0x0000000001000000-0x0000000001010000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\19.exe

MD5 4c1e3672aafbfd61dc7a8129dc8b36b5
SHA1 15af5797e541c7e609ddf3aba1aaf33717e61464
SHA256 6dac4351c20e77b7a2095ece90416792b7e89578f509b15768c9775cf4fd9e81
SHA512 eab1eabca0c270c78b8f80989df8b9503bdff4b6368a74ad247c67f9c2f74fa0376761e40f86d28c99b1175db64c4c0d609bedfd0d60204d71cd411c71de7c20

memory/696-1036-0x00000000000C0000-0x00000000000D0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\18.exe

MD5 d32bf2f67849ffb91b4c03f1fa06d205
SHA1 31af5fdb852089cde1a95a156bb981d359b5cd58
SHA256 1123f4aea34d40911ad174f7dda51717511d4fa2ce00d2ca7f7f8e3051c1a968
SHA512 1e08549dfcbcfbe2b9c98cd2b18e4ee35682e6323d6334dc2a075abb73083c30229ccd720d240bcda197709f0b90a0109fa60af9f14765da5f457a8c5fce670a

memory/1372-1013-0x0000000000B90000-0x0000000000BA0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\17.exe

MD5 c252459c93b6240bb2b115a652426d80
SHA1 d0dffc518bbd20ce56b68513b6eae9b14435ed27
SHA256 b31ea30a8d68c68608554a7cb610f4af28f8c48730945e3e352b84eddef39402
SHA512 0dcfcddd9f77c7d1314f56db213bd40f47a03f6df1cf9b6f3fb8ac4ff6234ca321d5e7229cf9c7cb6be62e5aa5f3aa3f2f85a1a62267db36c6eab9e154165997

C:\Users\Admin\AppData\Local\Temp\20.exe

MD5 f18f47c259d94dcf15f3f53fc1e4473a
SHA1 e4602677b694a5dd36c69b2f434bedb2a9e3206c
SHA256 34546f0ecf4cd9805c0b023142f309cbb95cfcc080ed27ff43fb6483165218c1
SHA512 181a5aa4eed47f21268e73d0f9d544e1ceb9717d3abf79b6086584ba7bdb7387052d7958c25ebe687bfdcd0b6cca9d8cf12630234676394f997b80c745edaa38

C:\Users\Admin\AppData\Local\Temp\16.exe

MD5 0ab873a131ea28633cb7656fb2d5f964
SHA1 e0494f57aa8193b98e514f2bc5e9dc80b9b5eff0
SHA256 a83e219dd110898dfe516f44fb51106b0ae0aca9cc19181a950cd2688bbeeed2
SHA512 4859758f04fe662d58dc32c9d290b1fa95f66e58aef7e27bc4b6609cc9b511aa688f6922dbf9d609bf9854b619e1645b974e366c75431c3737c3feed60426994

C:\Users\Admin\AppData\Local\Temp\21.exe

MD5 a8e9ea9debdbdf5d9cf6a0a0964c727b
SHA1 aee004b0b6534e84383e847e4dd44a4ee6843751
SHA256 b388a205f12a6301a358449471381761555edf1bf208c91ab02461822190cbcf
SHA512 7037ffe416710c69a01ffd93772044cfb354fbf5b8fd7c5f24a3eabb4d9ddb91f4a9c386af4c2be74c7ffdbb0c93a32ff3752b6ab413261833b0ece7b7b1cb55

memory/1800-979-0x0000000000CE0000-0x0000000000CF0000-memory.dmp

memory/1280-974-0x0000000001300000-0x0000000001310000-memory.dmp

memory/1092-969-0x0000000000BA0000-0x0000000000BB0000-memory.dmp

memory/3036-1048-0x0000000000FC0000-0x0000000000FD0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\14.exe

MD5 e6c863379822593726ad5e4ade69862a
SHA1 4fe1522c827f8509b0cd7b16b4d8dfb09eee9572
SHA256 ae43886fee752fb4a20bb66793cdd40d6f8b26b2bf8f5fbd4371e553ef6d6433
SHA512 31d1ae492e78ed3746e907c72296346920f5f19783254a1d2cb8c1e3bff766de0d3db4b7b710ed72991d0f98d9f0271caefc7a90e8ec0fe406107e3415f0107e

memory/1464-1064-0x0000000000940000-0x0000000000950000-memory.dmp

memory/2328-1063-0x0000000000A70000-0x0000000000A80000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\15.exe

MD5 c936e231c240fbf47e013423471d0b27
SHA1 36fabff4b2b4dfe7e092727e953795416b4cd98f
SHA256 629bf48c1295616cbbb7f9f406324e0d4fcd79310f16d487dd4c849e408a4202
SHA512 065793554be2c86c03351adc5a1027202b8c6faf8e460f61cc5e87bcd2fe776ee0c086877e75ad677835929711bea182c03e20e872389dfb7d641e17a1f89570

memory/2924-1057-0x0000000000220000-0x0000000000230000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\13.exe

MD5 c76ee61d62a3e5698ffccb8ff0fda04c
SHA1 371b35900d1c9bfaff75bbe782280b251da92d0e
SHA256 fbf7d12dd702540cbaeeecf7bddf64158432ef4011bace2a84f5b5112aefe740
SHA512 a76fee1eb0d3585fa16d9618b8e76b8e144787448a2b8ff5fbd72a816cbd89b26d64db590a2a475805b14a9484fc00dbc3642d0014954ec7850795dcf2aa1ee7

C:\Users\Admin\AppData\Local\Temp\12.exe

MD5 7ac9f8d002a8e0d840c376f6df687c65
SHA1 a364c6827fe70bb819b8c1332de40bcfa2fa376b
SHA256 66123f7c09e970be594abe74073f7708d42a54b1644722a30887b904d823e232
SHA512 0dd36611821d8e9ad53deb5ff4ee16944301c3b6bb5474f6f7683086cde46d5041974ec9b1d3fb9a6c82d9940a5b8aec75d51162999e7096154ad519876051fe

memory/2892-1119-0x0000000000170000-0x0000000000180000-memory.dmp

memory/2592-1114-0x00000000010C0000-0x00000000010D0000-memory.dmp

memory/948-1139-0x0000000000DC0000-0x0000000000DD0000-memory.dmp

memory/1700-1141-0x0000000001070000-0x0000000001080000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\10.exe

MD5 d6f9ccfaad9a2fb0089b43509b82786b
SHA1 3b4539ea537150e088811a22e0e186d06c5a743d
SHA256 9af50adf3be17dc18ab4efafcf6c6fb6110336be4ea362a7b56b117e3fb54c73
SHA512 8af1d5f67dad016e245bdda43cc53a5b7746372f90750cfcca0d31d634f2b706b632413c815334c0acfded4dd77862d368d4a69fe60c8c332bc54cece7a4c3cd

C:\Users\Admin\AppData\Local\Temp\11.exe

MD5 6c734f672db60259149add7cc51d2ef0
SHA1 2e50c8c44b336677812b518c93faab76c572669b
SHA256 24945bb9c3dcd8a9b5290e073b70534da9c22d5cd7fda455e5816483a27d9a7d
SHA512 1b4f5b4d4549ed37e504e62fbcb788226cfb24db4bfb931bc52c12d2bb8ba24b19c46f2ced297ef7c054344ef50b997357e2156f206e4d5b91fdbf8878649330

memory/804-1194-0x0000000000960000-0x0000000000970000-memory.dmp

memory/1600-1189-0x0000000000CA0000-0x0000000000CB0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\8.exe

MD5 7cfe29b01fae3c9eadab91bcd2dc9868
SHA1 d83496267dc0f29ce33422ef1bf3040f5fc7f957
SHA256 2c3bfb9cc6c71387ba5c4c03e04af7f64bf568bdbe4331e9f094b73b06bddcff
SHA512 f6111d6f8b609c1fc3b066075641dace8c34efb011176b5c79a6470cc6941a9727df4ceb2b96d1309f841432fa745348fc2fdaf587422eebd484d278efe3aeac

memory/1184-1211-0x0000000000970000-0x0000000000980000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\6.exe

MD5 27422233e558f5f11ee07103ed9b72e3
SHA1 feb7232d1b317b925e6f74748dd67574bc74cd4d
SHA256 1fa6a4dc1e7d64c574cb54ae8fd71102f8c6c41f2bd9a93739d13ff6b77d41ac
SHA512 2d3f424a24e720f83533ace28270b59a254f08d4193df485d1b7d3b9e6ae53db39ef43d5fc7de599355469ad934d8bcb30f68d1aaa376df11b9e3dec848a5589

C:\Users\Admin\AppData\Local\Temp\7.exe

MD5 c84f50869b8ee58ca3f1e3b531c4415d
SHA1 d04c660864bc2556c4a59778736b140c193a6ab2
SHA256 fa54653d9b43eb40539044faf2bdcac010fed82b223351f6dfe7b061287b07d3
SHA512 bb8c98e2dadb884912ea53e97a2ea32ac212e5271f571d7aa0da601368feabee87e1be17d1a1b7738c56167f01b1788f3636aac1f7436c5b135fa9d31b229e94

C:\Users\Admin\AppData\Local\Temp\9.exe

MD5 28c50ddf0d8457605d55a27d81938636
SHA1 59c4081e8408a25726c5b2e659ff9d2333dcc693
SHA256 ebda356629ac21d9a8e704edc86c815770423ae9181ebbf8ca621c8ae341cbd5
SHA512 4153a095aa626b5531c21e33e2c4c14556892035a4a524a9b96354443e2909dcb41683646e6c1f70f1981ceb5e77f17f6e312436c687912784fcb960f9b050fe

memory/2764-1263-0x0000000000D00000-0x0000000000D10000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\4.exe

MD5 c24de797dd930dea6b66cfc9e9bb10ce
SHA1 37c8c251e2551fd52d9f24b44386cfa0db49185a
SHA256 db99f9a2d6b25dd83e0d00d657eb326f11cc8055266e4e91c3aec119eaf8af01
SHA512 0e29b6ce2bdc14bf8fb6f8324ff3e39b143ce0f3fa05d65231b4c07e241814fb335ede061b525fe25486329d335adc06f71b804dbf4bf43e17db0b7cd620a7c6

C:\Users\Admin\AppData\Local\Temp\5.exe

MD5 84c958e242afd53e8c9dae148a969563
SHA1 e876df73f435cdfc4015905bed7699c1a1b1a38d
SHA256 079d320d3c32227ba4b9acddf60bfcdf660374cb7e55dba5ccf7beeaedd2cdef
SHA512 9e6cb07909d0d77ebb5b52164b1fa40ede30f820c9773ea3a1e62fb92513d05356dfef0e7ef49bf2ad177d3141720dc1c5edceb616cef77baec9acdd4bbc5bae

memory/2268-1313-0x0000000000DD0000-0x0000000000DE0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\3.exe

MD5 a83dde1e2ace236b202a306d9270c156
SHA1 a57fb5ce8d2fe6bf7bbb134c3fb7541920f6624f
SHA256 20ab2e99b18b5c2aedc92d5fd2df3857ee6a1f643df04203ac6a6ded7073d5e8
SHA512 f733fdad3459d290ef39a3b907083c51b71060367b778485d265123ab9ce00e3170d2246a4a2f0360434d26376292803ccd44b0a5d61c45f2efaa28d5d0994df

memory/1008-1274-0x00000000009F0000-0x0000000000A00000-memory.dmp

memory/2432-1223-0x0000000000280000-0x0000000000290000-memory.dmp

memory/1736-1317-0x00000000011C0000-0x00000000011D0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\2.exe

MD5 012a1710767af3ee07f61bfdcd47ca08
SHA1 7895a89ccae55a20322c04a0121a9ae612de24f4
SHA256 12d159181d496492a057629a49fb90f3d8be194a34872d8d039d53fb44ea4c3c
SHA512 e023cac97cba4426609aeaa37191b426ff1d5856638146feab837e59e3343434a2bb8890b538fdf9391e492cbefcf4afde8e29620710d6bd06b8c1ad226b5ec4

C:\Users\Admin\AppData\Local\Temp\1.exe

MD5 8ec649431556fe44554f17d09ad20dd6
SHA1 b058fbcd4166a90dc0d0333010cca666883dbfb1
SHA256 d1faee8dabc281e66514f9ceb757ba39a6747c83a1cf137f4b284a9b324f3dc4
SHA512 78f0d0f87b4e217f12a0d66c4dfa7ad7cf4991d46fdddfaeae47474a10ce15506d79a2145a3432a149386083c067432f42f441c88922731d30cd7ebfe8748460

memory/908-1433-0x0000000000B20000-0x0000000000B30000-memory.dmp

memory/1444-1373-0x0000000000010000-0x0000000000020000-memory.dmp

memory/2996-1436-0x0000000000AE0000-0x0000000000AF0000-memory.dmp

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\UTC

MD5 cf3c00ffe27a6a2bb1b8dfe5b4edb52f
SHA1 1446305eb8d43c95347c5c69373fb99b1928d0ee
SHA256 9480c1b3952fe6da847dc185f674e4b0bc6a7fb28c14d62958f249c42184d8c8
SHA512 4c04365870066225ed0e7883ee954f41bf50a28808a0e16e3b3d5d846781901e6d88867c2df50d23311ac4aa12fdf0af014cdb3896907690c82b463c98ceb864

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\EST

MD5 9f986a593e3b7b9dc449d518209bc588
SHA1 16fbe6950c9d9a40eb0ec5d3df914fe33c34e371
SHA256 6d97bb4162e00f8a4f7afa0c6049fc2a82a9a2c94a99d4ed8e29cc785e97e370
SHA512 1c1ac23350a64750a6230c8146db7998fd1ae71794477d66697fb5c758f3104719fd7e7cfd80f37f1842097f5f5de84b81bb6cab1d02c06e2369ac868f8980ab

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\HST

MD5 6c1b5cc315b7c8cc49d1d3cc2bd6b93d
SHA1 0fa50423c426daab243e1b7476e8b567443c4748
SHA256 652a8444d257fd43c9fdf960d37c07015e5dcc3b779c0967a04f971c44220de9
SHA512 d380e53be91fda1c2ba8a091cbaf3cf8a3cc4e13dcc07154567aedad81fd51896a6d3f5ba0fb1ba03d1c2b7ff6042c79684d742711d228480d2185059a77b322

C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\MST

MD5 ea278de32d7caa26c37bf87a40af4bc0
SHA1 b5cbbf8267048a03fde3f9b807a14b0598d98276
SHA256 554610e35ac3854ea089f3d1cb55cf1cc16c707f3bcb984165ebf1eedcaf2f99
SHA512 f1568e16315acf6487e132e73cdb1aedcc3b5e8de0946e45aa6c9fff39b4547510700109181ce73007869cae3f59a3579e58a0098d1ed1a38ab2e989e96fb67b

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html

MD5 0507e01b3f7c2fceab94b1e61ddaadeb
SHA1 809df741bc0437948a60b973ab8cfe72cf0a4d0c
SHA256 da92841601987217edf6b17607726e286f51ebef91bc3b15a038bdda53ea1259
SHA512 dd7b21ab70128046aa569ee00ffbf3720e45179687296dd24e433875e2de470d213ca02e702adf47aed5876910f84f2127f6af23bfbff5efd18f2753ef831bb0

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html

MD5 72cfc0afb345b3ca334e7fd71f7ea01d
SHA1 a466a5fb6fcc56a46dcf8b85c830325faf703fa9
SHA256 1ec375b8866ed35c9019492e8d64061462984ad92987d6b039ce62d996755925
SHA512 b139e6b33c6dd63d3cc8205cdd9d50e5a5fe89499e9490a2f59388631dd1d2ec400ab55102a8356b9794aee28248a3e420abc35ade838986f3f371541ec588fa

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\eclipse.inf

MD5 61284aa6a8d30d75a218e9f628e6e9d6
SHA1 9e41f801435c8d777b0d243bb93c08a9eb05e386
SHA256 2a7354650a04f67ea3212ac440ad333f0bd8dc14db17ae6fa4c11e2c1b5521e0
SHA512 16476b91851874d2f8d060d53c0648876500f7f7b0ec78ff606fd8e0d9cc48368f30316147a6befb06709fa7664c60278d74f6c832dadfdddd1eb0d4d582ff49

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\asl-v20.txt

MD5 ad624aa86088c38d98f2a3a72265d2b6
SHA1 0c637772972afe593f352a40c0909faa94cc145e
SHA256 f7714f10bb7b78df16fc6156d3d3c19db55c4034d748899be66a8a3a6d6bb0ee
SHA512 85ae362b4618fb52b93c345caaed2408f926f747ca876498503d957ce1d5e9df7e3619a3dd0dcd0dd8c53fc974de2e8ccc5fa68945734bfbea79a84e9db6902c

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.RSA

MD5 e721dee3e02e9ebb615251bad6d7bfdd
SHA1 326285e98b81161ae976383d0e8b80241dc942ff
SHA256 a1a99cccc631694d9fd04c553ff52a4134277ed7c61b401941eacbec48782fd6
SHA512 ba58bd8d39dac93c0c60106bfcf0651223f63c17d5e264ed8aa42306132f38fd1d6c248eb1113d42de4c47debfe89f9ffa8e586217069e9daa3757db48e1c2d2

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\ECLIPSE_.RSA

MD5 b69a80ab2bd206ef23ca5ff1e3e19d1f
SHA1 dfe840d65a91db102887642239af02f678112a6d
SHA256 9da7f94d637e6e8cb36d8932a5987b76ec96922da0109e8c45ce16aa3554db29
SHA512 7c6a298ff007ccd9fed03581522350acab1a97d20fdd7eccb5a8ff660afe1540decfbda4f95be632d12217384620f13a349b4e779b03332c01092f115c0aac85

C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\META-INF\MANIFEST.MF

MD5 7a6c8578ada22f5e63bb3d532754e9bb
SHA1 5ff6dd09e3bff587fc79907beb86514c7f93f089
SHA256 1e15d9a3386bfa13865c0252ca33dd89c26e847014d2f0d69f73cb5d20b860f7
SHA512 ac3c89e3f4ceb26bdf5d22db38d4fe6d703438726b2fccf3fa5fec1522c2ec531f9d18db293c2f021cd3edb37e7357af05fe89e07d7d79d895d552cb1bc9029f

C:\Users\Admin\AppData\Local\Temp\Cab1788.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Temp\Tar179B.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Program Files\Java\jre7\lib\deploy\messages_zh_HK.properties

MD5 fbcba436c61240213cc9f43feaf0c1ca
SHA1 c4b9abce7a166cc3f9128d9b3a8d530a77c31a9b
SHA256 9f4c3c9fc8cfb1074c7dd0b1e144499def0fdc9a0bc8e500b70b5afca21c645e
SHA512 4d68ac6fc6de1cc2d378882d8cd6e28de00a9e82e58ca340237253fac7490ed78277ba366734ce6d898cda11c8ca91cb4005b5fcfa76be19ad13ab1f37546852

C:\Program Files\Java\jre7\lib\zi\Atlantic\South_Georgia

MD5 851ae64011897d0718a8ce5a6c551752
SHA1 1b4cf18a0aa186e2224112692b000f0cc7c8801b
SHA256 b4f995d6e006e5b88eba3f8d582db3b01d871bbc24f3b270c00153f176365efd
SHA512 9ebe7f13e4278699759e276c5942969c38f7204c53dba2eb42e9fa3e0f30aeaa7d2d3b3a7b9e09f1b9d1e6259f33c88f46eec0c37919643fc382cc5a1f6b1f77

C:\Program Files\Java\jre7\lib\zi\Etc\GMT+4

MD5 0cd87261a60f9d5bbc528a4220ce4913
SHA1 0b1aa296d977abe251c7a9638632fa37468f4be6
SHA256 a8e20da78e97befa921d13248387f40e23c445a30896343c37b767aa8ba76334
SHA512 53eb995e1f2480ea74cc08aa8874ad4789e117b2c2ce11bb936e32d2714cd52825cc9d68e1c7849bbfe750a01a2d279389d38820673398c6ecf0e65c8e51e23b

C:\Program Files\Java\jre7\lib\zi\Etc\GMT+9

MD5 c9814d8b1c8fb5e8423f181d7a350c52
SHA1 c6a40b78edb4f8313a48cf0166f038feee2ba7cf
SHA256 8732685e1048c7ccf0f724287116ba7fffdb327b11ad5373b52c39c33c957699
SHA512 4c82744736f2e2fabbe3e72d48afbcfddbca4b6bfbbd6ae34b7c9d788d92e8ce39c8051bb2d5f73fe16d6d371ea58ade49f723b4cf873445cafb5c439b5e37f4

C:\Program Files\Java\jre7\lib\zi\Etc\GMT+8

MD5 891f4c0889efcb82455b0fc055163831
SHA1 561fbf1ffe4567eaa9147815e0c497a3990285d9
SHA256 173071c78b744398eeadd00f580cc20fc70d91870e72660121ae52a9d1524351
SHA512 70dcd98a9abc07677023a07fe361472403d4a8cc571f6c871d115aa9742b774547a9cf77b9d39b83c458d247bbb00c7e0abf15481db0d07987e078f4de6dc794

C:\Program Files\Java\jre7\lib\zi\Etc\GMT+6

MD5 256e51bb05316c9952dec37d1b65d5cd
SHA1 9636443aad7d99b73b23b6bd6ca4dc34485f72a6
SHA256 ac2f756e5bda727f13517593a80c463db6f6092b3471bde0e1bdd33d2d15c944
SHA512 e4cde75e0f3697c125dcc4aa82c65a9d1c2265e617a728855096faf36875dd21c32a0e9943b002c8175bc3df368326c0f52d74a2e1c2559921c7796199e5ab48

C:\Program Files\Java\jre7\lib\zi\Etc\GMT-10

MD5 2fa5f6c75c3305d57d44d1dd990672af
SHA1 f4f8ed41ff047bdde82cb2d0b58d1beba4bd9303
SHA256 88089c9863d104ba38a02c5f457fa87b57da152bac4de04810f4a2697c84735d
SHA512 6c16b99f95f2d39b26410d3be23f5d6257052fc45a0b7d263849ea73f46b2f863b2de97d14955d11f61873deb39e6eba6cbfc7bfc48dabac2e72df595dcd19e1

C:\Program Files\Java\jre7\lib\zi\Etc\GMT-7

MD5 9ca9b9b3726df6b400530136bb018492
SHA1 b55ca496ca12715f94ab7dc4c152a2ae2ef40f08
SHA256 4db421bf3c4b6bbe0df129dc7d3d86080868e27533a052323e5d8990999d542b
SHA512 f6ffd98eab583ac0f77ac18b538805201368666eefc287800bad13b7482ef578c58735b2e6fb9c822954c87c152a9d5d104d2414151501abbad2ed5f5c6cc906

C:\Program Files\Java\jre7\lib\zi\CET

MD5 aee524ba9ebbf5d62a10583690a1f72d
SHA1 07db04ddb0d30320bf3d08dea8e036c7fb477ec7
SHA256 bae6b17810640a541be49d3f67a141baf4bf4736da34df28d8b243a2f671b861
SHA512 b9e44ec7453f0162847064ce1bd040c126f8ea052d36741cd66a590793c300ae54cd6b5e1d23a0acacb6b65b2c55c93597dc98a061597636f989123ee53a212e

C:\Program Files\Java\jre7\LICENSE

MD5 9b85e28b22bf9131b1cde7bbe2b5d94d
SHA1 7cd5a697825ee570a0a512babbb1e3a9ccb6012d
SHA256 e99907b17231185f2d36abf6a8a3d07e052d48400790395a4f3aa665a33a5965
SHA512 143125069f0fbae14279002811288a811cb3006ab0aa54159f44855c69f69b42375af518e93254ec3e2e6b34cf839b1b6c6c093ceea93aac69bc045fd533eb0b

C:\Program Files\Java\jre7\COPYRIGHT

MD5 c585c2b51b525eed2129bcf4d4193cdf
SHA1 401f7d369b4102c93b8e1baed50787ada6a4e045
SHA256 7c2379ce95807a2ffaecc5d0b66aff364fed6b294bbb5b5cb8d0b1937ee54909
SHA512 f3859c553beed6fc2fa38dbc2490a944eee722c3985456456bef3405100bd99152653f80affbbf06938b9539eec7d3dfd52e488b6a21e5da0ed797be978b206d

C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt

MD5 2cb7e71bc58b4ddc1685b6c536765639
SHA1 b87b039cf7e5b95216e38038ae5acc0f583e2a6d
SHA256 81fceea6d71c2fc70a9f2b3bbfd1cf6f8b46f284f58b342bb30ab4a112d83767
SHA512 37eb1fe7eff9d57b057ec662ff1cf8415e139d7025fe9bf33238868c8de7c9115b4f0ad334df95b4761c9d5afa9210662c62fe0f227b736819bccc72c98f749a

C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME.txt

MD5 5019ad3a37640ccbf00ec5d735ae5fd1
SHA1 704b9bfe1891caf2fbf1487ce2c2b42d05ad29fb
SHA256 c50c84a322a93d6a1f4bea0ed9e7e54b5b430d06eabac39922f3fe15fbf8708b
SHA512 2dc9eb31fd26858b4922efe9dc31d02c474b298158f67a358c8d43e32259e7d5d112f7f5fa7d663ea31da75e9d1ac2294c5b3f4fdba339f7b65b9607312935be

memory/2740-6155-0x0000000074BC0000-0x000000007516B000-memory.dmp

C:\Program Files\VideoLAN\VLC\locale\da\LC_MESSAGES\vlc.mo

MD5 8ffcca17098c9e98d983f42e4630aa4d
SHA1 3baa86e58f465d0e133fdfcbeecd5ca5f1e2838c
SHA256 668703fae822dac4ef81edc62002ee3138f9243a6c04e0ecc7f860c8577c9aa3
SHA512 463e9240163131b64017ad4bc4564aa68b59a4013fcb023877136cdd30690773413cd07e0208f16e0c79a5ab13e5405b7d292e4a72560c3721503636fce849d1

memory/2556-6566-0x0000000000080000-0x00000000000A5000-memory.dmp

C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB_EURO.txt

MD5 5450fa9a02d7c1dd219c03f73aaa9d3e
SHA1 0986066c03569a63948b88036d5867c6f428d143
SHA256 4686b2e8600e83d79d850ebb1ff5db363ccf022594afb47de4f3abf76f7926f6
SHA512 8f6b80b9190ab4762ad2981d3f3f8df5945df6f7309acb3b2462ccf7b42df843ea166095c59487046c49a679d945aefc894fbd672e50897d7cf8e9a5d9f92001

C:\Users\Admin\AppData\Local\Temp\Files\r.exe

MD5 a775d164cf76e9a9ff6afd7eb1e3ab2e
SHA1 0b390cd5a44a64296b592360b6b74ac66fb26026
SHA256 794ba0b949b2144057a1b68752d8fa324f1a211afc2231328be82d17f9308979
SHA512 80b2d105d2fac2e56b7ea9e1b56057e94ffe594c314ea96668d387ab120b24be580c58d68d37aca07273d3ce80f0d74f072102469f35cb02e2295817e1f16808

memory/4100-10974-0x0000000001150000-0x00000000011A4000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Files\tdrpload.exe

MD5 f437204b3e1627d8b03eefdf360281ad
SHA1 c824e787a9786d5fdd19effdec54abef217e5b39
SHA256 d4bbc125a9e94de44f4deea9d6b10adc87a1ec1aedd753b39d26bb15817fdadb
SHA512 bdb6fc7d1e7f61df6a7ff3036fd56793e1096937fb07fbe033692f20de1bc81ca0215c5eff5a21627607c1ca514296d9598490c244bba5ec60c74653e1978910

C:\Users\Admin\AppData\Local\Temp\Files\11.exe

MD5 e2e3268f813a0c5128ff8347cbaa58c8
SHA1 4952cbfbdec300c048808d79ee431972b8a7ba84
SHA256 d8b83f78ed905a7948e2e1e371f0f905bcaaabbb314c692fee408a454f8338a3
SHA512 cb5aeda8378a9a5470f33f2b70c22e77d2df97b162ba953eb16da085b3c434be31a5997eac11501db0cb612cdb30fa9045719fcd10c7227c56cc782558e0c3bc

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_ON.GIF

MD5 4bbfcd51258bc33d62ec8c160a0184fa
SHA1 61c34e0d3926b3304d52c4877bd3909cb100c89c
SHA256 05da868f2fe536a20d659b7179aa2878190fd7ae172508610e3eacc15ace8e81
SHA512 ddbb966f9b24f22080dddc66bee018968f30cfb0836350cf52c3b68b63c95e1492990cce0cc1c7b5e326eba54a18d3594dae95884e136bc9e7219a4960ff6bf0

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_OFF.GIF

MD5 1ce87515b06516e1fe9d4954f5631eba
SHA1 64691b1146ecaf33583812d85d8a1c9f77eb6cef
SHA256 e350e3675beb0a95b9d60e50346405c529b861427ad20e8730be41dd0c34c9b1
SHA512 de1b721af981353317a7ec3afdb2a76157a9959b0fea69ffe441c06b6f8b6cbb85ffcfbea6c96d300415b72bab1b67fdd5e12fe2d6b0858b7edd98032aa10bf9

C:\Program Files (x86)\Microsoft Office\Office14\1033\GRAPH_K_COL.HXK

MD5 3fd37f4b7d9abe0796b2318a46566a10
SHA1 79d32f0e35a8d77b4003fe24ebd82ab063fbec23
SHA256 7776438628a9843a5e25bc3439618c7fae0e5844c4878935c0d3ea40f447e87a
SHA512 5a7469d7c07f5758980d97e1b132f9ec8d93fb615191929c0af9ce51f03cd6d9f6e1e301b7af47e199c0c57249f871cbe87eda4806ee7d4b7d6db6072759b375

C:\Program Files (x86)\Microsoft Office\Office14\1033\GRAPH_F_COL.HXK

MD5 2bef0a90ba778f3d077dc9c400492922
SHA1 2280207d4bcfb778743d10fccf90c9bd587734be
SHA256 f853d308239853f2d758f753f79c3ecf8f6a4ceee7ea840dbede64111ad94509
SHA512 a391e84fab2705cb30b2dca701bf46d2f92cf6319f50f99677c8ca9f842cbfb170e816f55bbfbac7818f7bfec8ababf9c242a4614ca2629c535751d3b88d1a53

C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\Style\SIST02.XSL

MD5 d2bf23d6e3b215826e78ff84c209ca9c
SHA1 9cebae1e82470f4210ac94f101146d7c6f661ab8
SHA256 305f9289b07c704ddcfe4499547693f79e33f741236e7860e756aa523656caab
SHA512 2de91ff859807fc39e247ece22025ff91b6af78fa526610c8d5d71da6ccb33a211d5875f5c3165b0fbc1972e02b029e07f62d3520160f5486ecc153c6b6c54a0

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BabyBlue\BUTTON.GIF

MD5 fca6a3ee2883e508d8b746c417f6af88
SHA1 601f24bf361303d1cbc390bd88e36a6d8d142e82
SHA256 a520c51d2264563ccc7c50a1b95c7890fffbdb435e3745909a7209868a22b454
SHA512 9aacaa87ea598bffc59eb2bd78e3cdefab9e3869b86aee0b9d55406798721cdcfa50e10abdd0778337a6be0e1c28defc4c16b1dbf575284f8c019ff2184413d6

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\TAB_ON.GIF

MD5 3faedde54471022493a9cc31a12bc7c6
SHA1 e21bfc269870d5c9afda36f5cf2231cd804daff8
SHA256 199007009c90a90b2195838f69e0cf157f909effd065ea498339c6abb58810ba
SHA512 9de4acc1d48543043f41c552c5e382744fd2f6701193aad31c18f4fbfafa35ef99bcf11a0d4e23a8d8e85f338c76500775b5145cf7e8509bc767ac18e373ae89

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\TAB_OFF.GIF

MD5 6ae18a762b3dac8ae1fa04c2e8e94006
SHA1 3a3ffa5767f5eddc42e0e475f937ebeb9724d6d5
SHA256 cbefbd7765d1472937437faca5ddf6e5d4a72273cb8565887cbf187b382a6072
SHA512 d3d2087844a3dca74194ace9bf5636fdf0e698083d1dbef34b49dda2212849464e994d4651f298908d6376c553d1e9ed4283f78e4bd2f965a175e2db7e393cd2

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Earthy.gif

MD5 a347970e033c02c2726945ae5abe7c10
SHA1 31a6ef168d98b14bafef5fee79d62f3b6d8b9630
SHA256 7fc09a6b34da301f330118f49c1ecf619e8c0005092abd4a39643c700ef3fb9c
SHA512 b807a89ecae9d667d8375df2ca61f5d830d6facc8c26e5b4a6f0901e229de221527ab53e93fe18a2f9594e92b1883fc5eecf0b28b6ffaa88df9443d4d0d4702d

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Country.gif

MD5 8076eb47140bc2f257352c0d2366d894
SHA1 c4b7df47a8306a5ac8da046efb0ad32a8cfd0ce4
SHA256 8572d5f820e4bd1b2217ea2cab28a828b389bdb3643d62fc00cc8e45dd6edcb2
SHA512 f4bcf64cac800e5947ece87466fbf9432000ef441d9b6030484c4b3700f833a4f3160cdd5df5ea06df89164ea5e61d34a51911fbd37e86b0243874e67eb52cf3

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Casual.gif

MD5 e6a9f087e17571bb4ef0d53e2fbbf6e2
SHA1 cde479dcbb6bf4730df58c3789a2474538b06423
SHA256 4f898eba0ff29c9b298c68a104ad66a177984f4aed61dd03b7dd31cfbbfce4d0
SHA512 bc07c4e814b3083b1de3ce06e3fb16e1751e6cf2930444674be7484ac0ba9c71e3931520871e87aedd7e89d51be5050f7ba1013fd193c00c82b632429280df0f

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\BG_ADOBE.GIF

MD5 aa2f429f302f5aba81d56aa6062e1519
SHA1 ce4a0c29bae84eabdbf00b1662767e5fcbc6d625
SHA256 07c29e9744d0d244c0c085b5dcc0c41238d04b29fe1861769eb991966e1ea332
SHA512 c8b5462ddef072f5cadbf62231f1d56c2ce77edc8a25ab7afb618ef51c1b5492caae295b8113627ed4bab747b0cc05f24588fa3569269916605fd8bbd071aa32

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Groove.gif

MD5 2dae2b37bdae692f1463ef1f44434f66
SHA1 f122be09135621c21737e81799fe65e7da64d898
SHA256 8918c014a7fa4552418f1067502c9cbce0e035062918d52fd08dc755e1146cb7
SHA512 83c581f33b13e30c2b26ce3c72b611146744c2a98cae874647c2caec20247dffbefc099164d3648ef9face24ff6cbb66428e13161246c7fdf61a455402755d9c

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_GreenTea.gif

MD5 26d3362ac225173927fcf22916d367fb
SHA1 0b20f3501d70e3591e72d4c0becca879538ebc0f
SHA256 104c6845b3897f7df62a6d1b0d85504c6bf69f93d1bae16176937c6306e67778
SHA512 17c6645fa95d7b3253e819d9b01aad3ba2ff077afddc8bb4a3edfd6d126196f62332dadd002a5ba939a80708de32a28f2c3459768f484f7c697ced922b1d3cfd

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_LightSpirit.gif

MD5 867cc9cd105ddf5f7e2c9aad5b9ab594
SHA1 e0aae1dc6b03e2dcc7883bae53793df648fa018a
SHA256 be45556d83b9f606a22e4277471cae9e593a309349b248827c6e7493a70ef351
SHA512 6fde5f610d586a17ba070ce54cd66f8052b32c9b9a0a09522b0789d88e9dae20dc7fc14944ebb2aae66307d15795e2739715f1ab6a8927fd138f32a127985378

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_OliveGreen.gif

MD5 c434c0dcba04cd3554ec37d88bb2cba3
SHA1 5d593c6f110fd7c2c418415a6957c5736007bb75
SHA256 8267c9e306b5ef7f1a00fae8d9ca51eb5108281c219da77e3547ea4237da8f88
SHA512 d8b415b628226ef3f8856ff0ab6d2a0a3f774a05ac398f01b6463987f680fa80356f6ad49600151cf085707d93ce1cd95181cd912130867a66a30ab0093f5fe0

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_TexturedBlue.gif

MD5 98a13d67629bd53e45d1ed6839a353cf
SHA1 3cc1fb1a2426cff050cf971bf58c3c8821143d12
SHA256 53cfcd4c713518734d6f262d0752b7f85bb6358fb0f2afe585575510cd57e1fd
SHA512 d20fac501f3ac926a764e3369182cfc6b4d367d32e529dd88923e921b551feef2a054fb6b52569d510e1193ad27a974d3c687a7f6e86bab41b87c378b2755405

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_SlateBlue.gif

MD5 8bc17b9f6589d704f684135f1e2009fd
SHA1 d3bffa30cd620e8957165f0e91310c8a171b528e
SHA256 793719e926fb71d2f7f101c785ed84fb2151bb8afba3fa29b3969c6acfda7748
SHA512 0d8f5593448a38f3b087b0caaba0d863382cbfc61c7a0698af061e1e24cd2ced378a4f4cbc20d3df2c1d2eae79fcdc2bff9b65951fc6fa176c89a18d8d5eb0ed

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Premium.gif

MD5 6f5ada24f3fe64899a6f2a07aa07d968
SHA1 b75745f8b48908cf3ca615594fffa022d50bf671
SHA256 875e36832e3765f5a4e5e958eaf3f21b801cc5ba339614502e0e6b016c70fa8a
SHA512 30235688047063a55b445f6c400813872655aec7d405de0db51538ad405701e9bf1d2f2a9088088273e044a92395c3e8e74e7dc172edd55dc2e28d4023a2dfea

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_VelvetRose.gif

MD5 6112fbd21d74b034ea7c9407ee2ea3be
SHA1 6602aa9f32cd123c4fed72c8c4195cd7ededeb05
SHA256 3e15ea7b1b1ac20ae21c30a003d1054eec850ab52d9aaaaedd8c337546abc746
SHA512 a52a8ff334af5debf146eef0aca06397c246585c7eeb81bc096700f4da2f09d6f49af39f819d7126d5123a3aa8ad0bf2f402797e130b9cf012ee41a01d26ab93

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BabyBlue\HEADER.GIF

MD5 53137707d69908c42dc8704e56d762b0
SHA1 60298a62a37411f9790092508b06702dfde4da6b
SHA256 fd7ba7caaf5a69b46259751a309339877fd02043f4b1bc0b6d52a3c91c2433f0
SHA512 2628a1139df3c95ecdc35444bd0e5903e971600db5aa48b5675d0afad66122e3cd4755dfddba39c88620d0ed66d054dfd08d21b840db61fb1ea4680fbbe77b2c

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightOrange\background.gif

MD5 5b94a87ea161eab48ef36e9aef47c12b
SHA1 2bf5644927d33bbc2b27eb6739515e93c742a9e5
SHA256 53a057372aa3c17fd3fb1085de40041683b1ebfde95516ea31a28334bfc44129
SHA512 80f6753fdee753c8b15d9b5f1f798d67f494638b0f6a1fc94471c53798f1699de23ad25290bbc3b55af40cae9d21c55b19b40fdc9d8535d767aab9740acaefac

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightYellow\HEADER.GIF

MD5 0b1178a9fefe803345069367fbb1cc5f
SHA1 798f9f23fbfbb8b64a79a85ee89f00a9f421479e
SHA256 29f885299264a5b1ae70e2ef51df70fd870088251b68b394763a32291d8d49c9
SHA512 2b597359941d50913d841ce28cfc3406dd33590acfd987788e3985e6385c5cff13cbe8d5e44f6b581f08748565a9c0b61fa03ca2ab255e9725bb8ef715950d29

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Desert\HEADER.GIF

MD5 b4e3947ebc4ff1b8bc40d6825fae1989
SHA1 2a34c45e8fb5884aea59f40463b43222931b6424
SHA256 2bb32377e379ffe4a3a8e1183db641fbf411433f36a088861c8ce2ef6858fb5d
SHA512 6a97cfcd92f2745124f32226d960df2d1ba10606ccd788a1d5854b2052bb23f1699c201c5bdb22aab7e7fec48893d665f1e45dfa76bc041f81df902d393b0ea2

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\GrayCheck\HEADER.GIF

MD5 381b532cb25ef909ac0fdeed3124e36c
SHA1 2b6a288d0936aa8ae0e9fd4282496be41594614b
SHA256 f684290d942f5f16ee2fa08aa54fcc29aabb1e4d717203e9aa1c4adf8da97bb9
SHA512 da7926f9de5b0bd2913c35c254b11226c15227840a2c44a18d1ff3f1b72dbfc1c42b0900b9c6a655705bceb42cd85bdf8d4d4688f5ee955007b86054254251fc

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\TAB_ON.GIF

MD5 dfa48097765b85ce073eb9d62a10c0e7
SHA1 2fdb33022115d7f1e56dfdf1a6d05a47324963f0
SHA256 6c4be9fdebf61966eaeca8ba677ceb9cb97234996744bf34d92dc5a1f79be2b5
SHA512 0928ceb63bb053b19d0a96fb8594b9757c2b39d0336a9341053dc279cb9190f23ce66989912b56f0ef97414b6e790cf6ebc00e91580b88cc907191b553deb2d2

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\TAB_OFF.GIF

MD5 dfe018618564a30f3e5a84e6733dc4cc
SHA1 6f06487e031cf78399778512401a4921401376b6
SHA256 dc398b84460b729da2b073f9b2a206fc69f5712d3882675959969f1448b638c5
SHA512 783802043a339c5ce9dec2b14631081e6c9a339ffa740ffcb6c9f98e06951dd9b8cb74bfc6bc654b5a86a8536e8be6a4aa6dd3d35358b9777dff8c30cba98e75

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\TAB_OFF.GIF

MD5 75b5510afd1d1e7e58de8dcea52e2137
SHA1 8dc91b9b352626cf89d9f5bd962888ecd3004aba
SHA256 450fdcaa8a5340613dd1dc56bd760753b88f42c7e75227a7e6953543f6f1d12b
SHA512 11defc4521a2ceb522403f4568c2ed51f32b1c49104d4f0754e9e255d2e3b19f52d60d454ff75ee1b7c719a649841ac7b6c5cc709438dc66d3f142401b28009d

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Oasis\HEADER.GIF

MD5 e74fb2b3a57bd819a3a6a9df8b52ecb4
SHA1 3cd4e8671d1e9ef661deeb5c6560e40de25e8b65
SHA256 fd1e99357bd8de01417e47dcff0654207d95de795e3616d9ac8e788df4a8ca46
SHA512 ea3c4df838b1427f0bbd90ea12881f000b42181e3b6995b42a5361cd6e4e1ac37ee652ed98f7c5530150d484b8d1bdd2d51c182c381fc023c861cde8cf1b281c

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\background.gif

MD5 f24f29168b1bc82056d9f2c9635d7709
SHA1 52688588221bfd594abb340be0007d4402990c6f
SHA256 9def357905dcca0b1fcb1f053dbca5073b9be566ddf1e07a668f2d80a780599f
SHA512 811ddf4f695d034734304dce3f76e37b0dc6962bdf3e85e0e1aa4699830ba349a895c0195ca8ebff1907fa30c662be5669e8e920c29070e4b7419399b9bf8bb4

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SpringGreen\BUTTON.GIF

MD5 e61870301d159405d91687219d9f1c1f
SHA1 21202156c8c7e9b08275f90e166e8c4e59fb8afe
SHA256 751489495d29afcfdeba17aa6e385c862154deeacb916b9fb87bd3ffcff05ff6
SHA512 0c8c8d41876c79a84e8ac7291d2202e7e435fccc98c9e3760a414cfba955b0400c5bf15781a585fc7870b9db093d9abecd8b8ed48d121c100b15b54c33896eea

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\TAB_ON.GIF

MD5 42c0f4b35ef7318da747fe7def94f37d
SHA1 8f19d8b4c346535631d490f08bf6d288d957ea5e
SHA256 2977d6d252d0e25a59eb218fd7894b30a7cddd6f33a929c4e2d55845d9ef9132
SHA512 45ce944f8119796e09324565a5f29eb49ab3aab46d47a784bfbb90ece0f4f2e227514d65d9fee2cea73c4abdc107b0b8fb8c37a3bf80339526f071cfed85f45d

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\TAB_OFF.GIF

MD5 9ef05e80bc0905a0c155f498c49cc3ad
SHA1 e6bb60863f6ede5ebbd9150700bffcbd46ccfded
SHA256 59ed72d3e398639c7e540f6d477cca25727ae91156a4de83b12606166a80bbd3
SHA512 8f7bc003be184378339289dace406d32f6cc3d37c539be6329ec83c6947bdc77784cac867f59b0946e909f178b9f81ea193ac97fabd36eaf383426cdfeb3db44

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\HEADER.GIF

MD5 789f2c8e11937b24ed6d1467e019035f
SHA1 66de4e5a5291f94bc19a98c3049ad78bf3ddede6
SHA256 ef1a243f2e3acb1b2b834e59a1af04fb835d19d232cb0f0d216254a6a29ec6ed
SHA512 20c73b9b7e1b686ceb8201a9413fb692bafe7a09ae6e22457d40e263e75f375c0450462bb2b1494e0c5d658461fab3de1ee0e3f22200b35c0420d9fdfdd57ff4

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl\HEADER.GIF

MD5 566698adb7f54522df1b02517264c8b4
SHA1 dc9502700001e895828c944eb5ac1753e851f888
SHA256 b6b4fcd58665823f54e36bccf73208cc7c6e8b5ff2b4ba918be21b16ddc7d44a
SHA512 3f59e53f6d95a43378018a3a76a693d9f41de89b5d008ab54dea53403f521409310735518c23e38ad7194263a1d3627939a7910339b4222b7537523c7931c6b5

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl\background.gif

MD5 f6a67c3379fa4eb1e1bb4239eeabe3ca
SHA1 9c224b21bc6cf56cc9496516442afc223a445579
SHA256 fd9b5fc8d6bf7c709433be8ddeee7b2b57f64132f94df2336e158582a7842ea6
SHA512 beae8451a944dcea0ae997bb4c9ccb5c1d3f10c10b73f082697f31a23e384fd400623d3ef516a5eee9f60b791e7f03618da64422240f60c2c8a8b40988774d15

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SoftBlue\background.gif

MD5 8887ac0e18bd564672828a9012851ff5
SHA1 b257fb5849027f82c29d00c98fcd3a4e78524bc4
SHA256 52b7802b5abe586bae04fa44c48a74c1c4bcdaab7c90e943a5f834f33b736011
SHA512 658687f98109a52a782c35a14fe5faeb141ac6ea55fb51feae851c682185e2adfa0c67f02a38f0a7192db4eee3cdfe4acfc95a11aa7c7cc9db9af97e358a216a

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\TAB_ON.GIF

MD5 3c96c765f2976140779825b6f5838d69
SHA1 95d501e1bd9cdccd840093ad02533c37d701e7ae
SHA256 060d7518cd5e8cff9980dc915f53947164bf3839641620a15d4baa28496a5d3c
SHA512 e46f57b92d5cd70da520f723d84f7c22d54679096114dc8f3e7ba26df14bfd0fc5aaed02d75d3fd95de4dc41b3473fa851475dbb28ca70367047a8183607e5bd

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FORM.ICO

MD5 eda1efbd748b05a8b523ad4f34d18ebf
SHA1 7d1d02f17b9f33ed51b1e2b457984fc81e141956
SHA256 56da0521d3e302b43d12acbef7dd39f1d9582abc560d7604e837b84329ae2f26
SHA512 5ffdeae7b1856e9e88c0d085882a2b92e060707eab0e8756e779b6fe54a403e5d0b38b6abace82de866790df4ef62ddd9ba27a7db7667629fe9ed3358bdf946e

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_FormsHomePageBlank.gif

MD5 55ee88e4a90f7c3c74c05628b6331d56
SHA1 a5f65eeee3cd249c6e255363688470625ae06f9b
SHA256 b3928918343487176ad4ee48a2911c70d6247122f5713e883deca3996f127ddb
SHA512 9d9e47e698600554461eaa028883fb501b05bab23c98d2cfa1c91e4e38156391caca0dcc5419b006a782b210077f1e5251b675a5406715247a6e6a9ccc5fe401

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\attention.gif

MD5 e48e12995e1ebdc8c5a9e8b52d9b696c
SHA1 96026e3d918c37add6ef917984be44340d6e340a
SHA256 dfc76884176891c268a6fe19c7f408900da6a55fbbc81b1e451d0768791d1e1f
SHA512 45fe26ba34360ddc358ee97cc1e092c5460aeb98ed1bc35451b181c57aca642716e3aca4152662443e1e80b6e41ee51fef564553fb392000c989e1c6133bd6d4

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrowMask.bmp

MD5 379b15514fb6bd8f79c77d8e8793f432
SHA1 4a8c91ca775d6bfacf6c4b8cb24459d899bccdd6
SHA256 c2fbb99bd7bd337a26693a7ba2fc84ec6172a0100b9b4b3cd932e4b60c922eab
SHA512 b25659eae50d9c040e81e1a153137813befd34f5c49c22e64cd2aa1d6b9d316fe82291cf6cde82db54daadfece9903f3f07d928e65f179835885fe5e6beceb6a

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrow.jpg

MD5 4b69359ce9a55e98cabd1460ab03621b
SHA1 6b6d06b56b36047d6fb117e2d906d87b3d29918f
SHA256 6ba1ea4fd63cc3352ba97c6eedf314ce7bb49d7f1dc86088842ed8e468ad6e60
SHA512 6d2d6cd72d6645eaaa17d40ce632d24f65e067dd4d62f706528389573f367771307e86a2dc3d6fe17c95a63376ef97f08657bf414cccf5c60faf320c74eb9080

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_bullets.gif

MD5 698cc5bdbda5b1df09b0041cefac3431
SHA1 43b693dbe4681eb59ec25168dfd96aa5eb85b8c9
SHA256 3058f69ec226cc63650e48d6c42a268063390743e11957f088cc6f238a335eda
SHA512 2df72ffe299a75256ad1827d503a08bac7ba80d52bdf825d64280238c92b1febf14ad553fcae2a6228a6b81ff26148d16a1a1f971c40d45eaf0739a0072b4780

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_pressed.gif

MD5 6f6dde0e762f6dd5864c051b25ec1823
SHA1 e8ce1298935f2732a48bcf7a97370cc1d17f8635
SHA256 fe357617c48e4848b7ff9a8a9d42dca3b16a6d6416872dc0fea16e0d4e919196
SHA512 8e3ba25818c42ee571f435c0de664f4980940e96089c990f7095c1ee45c538849311a56263b9243c8f5328f6d59a234710215cef95402dd1981c3637a8292bf5

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_justify.gif

MD5 e1d5842e66e190e1713c5f2a8ded6c3c
SHA1 d9f0c67614206a52da34350ff52f0d76b7a2ac5a
SHA256 25585918f846bebe0a39206cca248adf455cb5b5d0e142298ea1f9861df8d044
SHA512 71f232b3470f3ab7847df4cf421480fa82f517a13e714e9e0d6c96748b5ff7e00d451e1e115697202112515c9b4771c3f85bccdabb8d37145920ac170067ce5d

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_increaseindent.gif

MD5 01bc71ac756313c1e7a00d23e8ec4c3f
SHA1 6ce1122337bc9c473c2242a5a79f78de7e0fabf3
SHA256 4266a130acd4fbe2fe7379077d9014e980c6657e550d39fae39adaf8637a5eca
SHA512 10a46f6668834ab88c5838eb7ac6d4059edd67c6813053f0b028778c097899b48fa06ba88db6317c80457da9a77876b308192093e56b003d2864880d9e425f5c

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_decreaseindent.gif

MD5 5e6465e83b5629b75ab141dfc0651049
SHA1 65ba68b557dbcb50d4cb76dba8c45ae232b6df3d
SHA256 26f175390317102d6d1239b3353b3cd48d568d872e3fbc8008d0497fec015fff
SHA512 6af91ae0df238df05009361fb5cc7e6ee682fd5cc046b7f496dbbfabd4055ef4dc2cf2fdd8bd8034facb388b60691981f0a9a7454cfdb11852eb840e769e01d4

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_center.gif

MD5 27c1d351d99dfe1f58b34a14f8bf295c
SHA1 cfc461eb73f8f40070afb5b0b2ab96962e6b17cc
SHA256 5bac6002d66d8f44d0150c1c9db4852c1ebd1e843543969386366fb9eb2f222b
SHA512 cd4ecab04c9d9f42a56cd144ce4d272b94eb7720a8737393101eb3252001d62aab0ce6ce5216e47648019b5d1904f4c8bda2a641dd037f18545bc8a89869b24c

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIconsMask.bmp

MD5 b6b89609e3f44334b0ebc3371928baeb
SHA1 e30527db60023d475201d7f1060a48bdd22f5eb3
SHA256 81119a23e0669170f1cfb5525f9cd38d040b5b01224615f657926f0ce8d28eaf
SHA512 a22d8802dad4b29f7692a50115821d7b6b3381b1f2dfc04dbd13e1c447443248b49f4194e4b4a82e0a51262bdd8e14db2bffe425ab39e7917bd4470151bbf751

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIcons.jpg

MD5 21b7aace96d3fbd6f825bf0237741a91
SHA1 126c4a909fb6c1014b7a94720264657819d38575
SHA256 047255ce523b87119e110c345299a2bf018502a371d92e3edd5be6cd3b77611b
SHA512 328686d8cedcd2c246769b472d1eee689e3b3cdc62c8acbb27d3d1b90cded567376d0cee4318636dce8c336679e0fb50084c76242d5244e5c4cc53e103c1a534

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\ERROR.GIF

MD5 930b333d102d15935ddf58a7d7467e08
SHA1 3f2abed3560089d7df4708e5ffcc75034fba1dec
SHA256 63928fe36e1b837ce3b1424c3632b802d2924e4c975ea4a09b805718fe5c2d9a
SHA512 b33c509d99dd448e0632742a7144c5c2ecbfedf44d3bd7ed79f14b88aa01155a6efc3ba887ee6d1afccac1205732ed1f87014fbe3ebd140afc857dfdda72dae3

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_choosefont.gif

MD5 93bbe033fb1bc845f2d4e041873273d6
SHA1 a6b08e181d85374931780c4eea46254445283402
SHA256 5176119dce88a2ab7da52e3a41a140cf40baa9f712ec0c7c788b084b285855c0
SHA512 bf489df6115176f29830f623d6af3939743f8f20bb5f1aba7aa6a753a6238dbcc7b6148c97bbbf780b9a8343e9212d8994d6893e04e9263bac092a2b795d8d2a

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\RTF_BOLD.GIF

MD5 4a76feeb2cf85f66249e168aab455670
SHA1 49127a1df930aa33a076251d4a86c4373368b5d1
SHA256 f4bd53f99d111c8ca3099c957d12f16fe037706eebd50354a24dad8669467c68
SHA512 f01840b73ad34becccb907b41f6a8681cc70da0334a60db3e6f2858a0468aacfbff2b9c474ae2778b6e04c676e9ddecbf44b9e2c05dc268286da7f3802ee9e66

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormToolImages.jpg

MD5 7c1aab547636dd291caaf235d9c9ca5d
SHA1 670be8ff3d793f3224be327214c2b619c14bd0cf
SHA256 25a9958366f3d61cd1e9be211aac960d65f97ad23173f844b8589e4eeb3626df
SHA512 d5a1d3dab2f2a97d6043bbc38fcd1c960e8ab2b86a887f9186b9e244c1d6ed37f475c59383e9d871270e3f8a1c2888632f0df8cf6fe8e5c394e68e35d37aeb33

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignright.gif

MD5 86d88b49d4ab480f3300690ed81a8476
SHA1 6c314162718194743dd181dd047d71f1bfbbec65
SHA256 93ef479338588a8fbb8668502cd7ab61009da08c997e6238ec29fe4579aca673
SHA512 80b1bd60a48d55cb36c69c74b78ff16c1524925d86b9ced1f10f7cb998bb3bece24b769cb9539a751454774b0cf533a5727c17ca5f5b8f1c6c3da0eae3a7c5ad

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignleft.gif

MD5 31a0a57c47d8c7a8ccbac74d86472f27
SHA1 2d30666d62dd0fc9709bdb3806c1f7e8c540cdae
SHA256 66ffbf7926beacea979f473370dd7cd45a949255fedddbbc91d43245e91eb9a8
SHA512 77153733ba2dcb637ea54565cb1383592b18250fea7e52fc43627ad21b1c2d765f1edd23f17ad03bb48ced28ad91be28998de958385ef0dbf708e2b0d04af684

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\LAUNCH.GIF

MD5 fb6756e3164185bac849f2775238d694
SHA1 ad193949a926285cba2f54c5769f3baab9fe283e
SHA256 0f7f2de82a00c657a2c95f22dd99bbc9bec8eb18fa2283c73d80b571950fc5b0
SHA512 10c3602f12d5d4e658f1b6def0ef14945026dbc74ebec63f4fb2910a66e419c8a372361fe287861dc634993b537438a26d7a386cc316313138082ea1780a6033

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\DELETE.GIF

MD5 5b13eb7222ea1a3f43e6e488321cf782
SHA1 177ba8cfbc2de7cb9d9f1d0bdceeb30510ff4929
SHA256 f7f9225d0c33d2d947c7ea699d3383cb5ae6a0045848b3d8536a68fda0b52649
SHA512 bbaf6d92b3f67f631ecda13a7d96ce2708fd97c1f3d1c63d1bc05bd082cf03e0f3b2dcb21487ddc1103232a5e8c5378869fae4c5481685559e190dca467aa684

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\CALENDAR.GIF

MD5 9cd80dd3582191359d2394a7febbe518
SHA1 9550ac5462f455232385102079ca97883afadf3c
SHA256 11857da224224ad559edc0e0d8c7db891022984814a9421e187c2a6f09c8ab7c
SHA512 e15d811f06578a00c83b80e91516b5168b51665d46f6cd5538acb6973f5a28e049040640848d93421b4d90bfe50f2a2288538bf313a31d4f3c9fe7c1700b0231

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\ADD.GIF

MD5 eadaa5df41ac1c4475c86c011c7fefc7
SHA1 1fd7dda815bdc0cfca8d49d19533a2aaec4e95b2
SHA256 887c63f924ff6b46d1d2077ab280cfc3f18072c50ccbde8d85a0d515e83031f0
SHA512 10cf77b71c7663211ae94265cb0f8b4f64b8f27eabcbe9db25bfbfecc037e5170bb0bd690638403a8a5524e42953880a33d09b352ea5f92677fc95567720a3b3

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\ViewHeaderPreview.jpg

MD5 a41578932c93af5c5b4b0c091a7ccaad
SHA1 05e3c6b63532d57c02d25e5aa40fde5c7963352a
SHA256 bfae1e673654cdb769311c323400edba701629626562b07f60bb07f8c15a5681
SHA512 517b85fe904b10479a2005880256780395b041aec59ddb481fc40d087a58792fcfa04433651fd5af2dfde952624c9f14a6c4241ba7cad45ee609c207543bb227

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\VIEW.ICO

MD5 8a0817aabdd23cfc7eb38f331ae1701d
SHA1 0ea53d73b04711850c62a87a02da285b39709fae
SHA256 56f848d465f0a4978179d792e0bc736451e4deb69f9246ca31a635dbb1696440
SHA512 d287dbf66ee6bb0589492a5f8369294d416caddc2b3ef284006e4b8676366fa2b731aff3fc231188140812aa4dcca302b8a58f7b7a60beb9a024fa08e4bd0592

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_underline.gif

MD5 b09396fe71e7e01238e3a73e62fd4b55
SHA1 f4b3481bf3d07506014d299cb6912a75a2163614
SHA256 a0612459f47f2f13c8dbe65dbc9b09277b881c99f27ad3ce0e98f1be37a9d38a
SHA512 ebf2cef0db98fb093beb6c30c7b738daf394c8d0681b99799e726c511808b30ab068600c10697a19e4759a70cdd2f44dbba1ec275f7e0816229f14c0abcbaa13

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_italic.gif

MD5 8157f0cc070e38c4f61a27917a348064
SHA1 9f3f1fce04a5e4df50902b0ad9e56cb2fa354392
SHA256 68d8d73ae439d2a7998cfd7a39729fafe80cada2ac8027c8da73e05d363cbdf5
SHA512 2835ef8d5034fa6d22b9b0e2f644b7055216af81cf718eadcde87c8702a1c54a80e9c34af9b2fcc78023835810fe46ba1f9db0663e3454530ebb04b9d98f50d7

C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\InfoPathOMV12\Microsoft.Office.InfoPath.xml

MD5 acabbe1829567cf9ad83151168acddab
SHA1 6fa2105f8fcac6893ff3694e32a1361b7432335e
SHA256 89f8bcca447b10b8f201f6ea1834c3c303a8e8c0a7898581f17acf6c7daedc50
SHA512 dc29bd796c9108960927187bf1a7a6b3df3b9019f44d681bf280d051ee05a5ba5e93fb4cac8dea1a2b7d32f6dc57ad71577674813c7dae118f5d4ab6a16180a2

C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\TALK21.COM.XML

MD5 d792b99250fceeadb9f59955e7e8214b
SHA1 6abcad9fda469b9859326961e5f5a735330a3aa3
SHA256 1d26565572ba12b801e6d4b89df771cfa3838409a29198965a4a23a2c1ab6a4c
SHA512 333e54f6ca46bc429820afa14032484beb1c42616e18ff04f9a4090711a943401825c480eb64c82228c7d620ceb48a132545a56cd9c2b5571f4a3dd3b03ad889

C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.COM.XML

MD5 2490a2bef96a722d17a36eb4be389aa1
SHA1 cf7eed88dfe07fb04bd16523e1ec9dbe83f19520
SHA256 f32a914c9b3ddae2e85e541e535e0cefc492b974cbf5633ad6556f69a869db52
SHA512 5d5f1b239dccbe6f5b5d12c5e3e2b764b0456ce78cb734ef7e6b99abc2b31519ba3d075d2264127f0e24ef7cbf582373136efea6630ff7da60b4e25dbbbd8065

memory/3284-17176-0x000000001B4A0000-0x000000001B782000-memory.dmp

memory/3284-17367-0x0000000001F00000-0x0000000001F08000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\JEA5FD58IDOZSD51LU62.temp

MD5 a98fde7ad28f3a5299f181a56fb03451
SHA1 f3d747f1730d213effbb193918b0b86e2e76ebb0
SHA256 e1575705d2b4e23fae45eaace38c38b72e3fb8a1897c94b4ac7a0b4f23596a1e
SHA512 8fb2ac81d36f733eae8d148e0e1f745906e5151623a6f2adf4cdd36a44fb3f6f6c4d58b50ec4c86c4313df3194af5639f042590d7a711cdb6b5cc9648a2571f6

memory/4536-17845-0x000000013FE00000-0x0000000140397000-memory.dmp

C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe

MD5 13b26b2c7048a92d6a843c1302618fad
SHA1 89c2dfc01ac12ef2704c7669844ec69f1700c1ca
SHA256 1753ad35ece25ab9a19048c70062e9170f495e313d7355ebbba59c38f5d90256
SHA512 d6aff89b61c9945002a6798617ad304612460a607ef1cfbdcb32f8932ca648bcee1d5f2e0321bb4c58c1f4642b1e0ececc1eb82450fdec7dff69b5389f195455

C:\Users\Admin\AppData\Local\Microsoft\Feeds\Feeds for United States~\USA~dgov Updates~c News and Features~.feed-ms

MD5 628f4c9c686f390052ee9eba14deff0a
SHA1 1864440407c1aad09a39f8861c9ecaf8f0c93195
SHA256 cbbb8c0f375af479ec583d33f9aec4f0a473260e53b081f14ebe2016ea2be22c
SHA512 544792560b3f42b6ed351d997fdd3df9d833bf18ef5b5b48391b23151a76647c1df3daa14d99596d988e9305a95d9c0f8b13719afd34ee517f6a0383143d0fd4

C:\Users\Admin\Documents\RequestClose.xlsx

MD5 d506e66ac386bc3810e06a2e78152a11
SHA1 ad734eb2caeb01dbb9e001d4a428fd4ee85a8f30
SHA256 e0eb5a8ed124fbce01d822114692e5c43a084e38fc20546db914fd42fb3cb251
SHA512 bf0fdf31f88f66e4177e4cefdebbe553aeae425f66f153552bdd5b28cd135cd5e6955e41b7ccbf8a9c4c1f0ce1951bb5e9298957ac0415fdca7a84b80b130cda

C:\vcredist2010_x86.log.html

MD5 5da28831e166ff0e16d890e8e2498dc2
SHA1 0a3072aa3a50143e177c2c8baa3f057b9bfff16a
SHA256 e3ba66416f1b6af04709a3e554788dffad473383f00fc7da7191a8a66fd89dfc
SHA512 2c457c795faa10e96b2866ba3ae2ad6935f1acd4cb60db454e41eb18066fb63b2eab76bd92498423d4d74dd7966adbd7f6cf2f22f64b0118244a3ace4b1514fc

C:\Users\Admin\AppData\Local\Temp\72711708.exe

MD5 1fcb78fb6cf9720e9d9494c42142d885
SHA1 fef9c2e728ab9d56ce9ed28934b3182b6f1d5379
SHA256 84652bb8c63ca4fd7eb7a2d6ef44029801f3057aa2961867245a3a765928dd02
SHA512 cdf58e463af1784aea86995b3e5d6b07701c5c4095e30ec80cc901ffd448c6f4f714c521bf8796ffa8c47538bf8bf5351e157596efaa7ab88155d63dc33f7dc3

memory/4928-19937-0x000000001B4F0000-0x000000001B7D2000-memory.dmp

memory/4940-19944-0x00000000000B0000-0x00000000000D0000-memory.dmp

memory/3492-19943-0x000000013F110000-0x000000013F6A7000-memory.dmp